1 |
/* |
/* -*- coding: utf-8 -*- |
2 |
darkstattype.c - Program to decode darkstat's dumpfile. |
darkstattype.c - Program to decode darkstat's dumpfile. |
3 |
|
|
4 |
$Ximalas$ |
$Ximalas$ |
5 |
|
|
6 |
Tested on FreeBSD/amd64 stable/9 r263290 with clang 3.3. |
Tested on FreeBSD/i386 stable/8 r255624 with gcc 4.2.1. |
7 |
|
Tested on FreeBSD/amd64 stable/9 r263963 with clang 3.3. |
8 |
|
Tested on FreeBSD/amd64 stable/9 r263963 with clang 3.3 using -m32. |
9 |
|
|
10 |
Copyright © 2014, Trond Endrestøl <Trond.Endrestol@ximalas.info> |
Copyright © 2014, Trond Endrestøl <Trond.Endrestol@ximalas.info> |
11 |
All rights reserved. |
All rights reserved. |
12 |
|
|
13 |
Redistribution and use in source and binary forms, with or without |
Redistribution and use in source and binary forms, with or without |
14 |
modification, are permitted provided that the following conditions are met: |
modification, are permitted provided that the following conditions are met: |
15 |
|
|
16 |
1. Redistributions of source code must retain the above copyright notice, this |
1. Redistributions of source code must retain the above copyright notice, this |
17 |
list of conditions and the following disclaimer. |
list of conditions and the following disclaimer. |
18 |
2. Redistributions in binary form must reproduce the above copyright notice, |
2. Redistributions in binary form must reproduce the above copyright notice, |
19 |
this list of conditions and the following disclaimer in the documentation |
this list of conditions and the following disclaimer in the documentation |
20 |
and/or other materials provided with the distribution. |
and/or other materials provided with the distribution. |
21 |
|
|
22 |
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND |
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND |
23 |
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED |
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED |
24 |
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE |
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE |
25 |
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR |
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR |
26 |
ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES |
ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES |
27 |
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; |
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; |
28 |
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND |
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND |
29 |
ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
30 |
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS |
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS |
31 |
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
32 |
*/ |
*/ |
33 |
|
|
34 |
#include <errno.h> |
#include <errno.h> |
35 |
|
#include <stdbool.h> |
36 |
|
#include <stdint.h> |
37 |
#include <stdio.h> |
#include <stdio.h> |
38 |
#include <stdlib.h> |
#include <stdlib.h> |
39 |
#include <string.h> |
#include <string.h> |
40 |
#include <time.h> |
#include <time.h> |
41 |
#include <unistd.h> |
#include <unistd.h> |
42 |
|
|
43 |
const char * progname = NULL; |
const char *progname = NULL; |
44 |
const char * filename = NULL; |
const char *filename = NULL; |
45 |
FILE *file = NULL; |
FILE *file = NULL; |
46 |
|
bool follow_specification = false; |
47 |
|
|
48 |
int main(int argc, char **argv) |
int main(int argc, char **argv) |
49 |
{ |
{ |
50 |
void show_usage(int exitcode); |
void show_usage(int exitcode); |
51 |
void show_version(void); |
void show_version(void); |
52 |
void decode_file(void); |
void decode_file(void); |
53 |
|
|
54 |
int i; |
int i; |
55 |
|
|
56 |
progname = argv[0]; |
progname = argv[0]; |
57 |
|
|
58 |
opterr = 0; |
opterr = 0; |
59 |
while ( (i = getopt(argc, argv, "hv")) != -1) { |
while ( (i = getopt(argc, argv, "fhv")) != -1) { |
60 |
switch (i) { |
switch (i) { |
61 |
|
case 'f': |
62 |
|
follow_specification = !follow_specification; |
63 |
|
break; |
64 |
|
|
65 |
case 'h': |
case 'h': |
66 |
show_usage(EXIT_SUCCESS); |
show_usage(EXIT_SUCCESS); |
67 |
break; |
break; |
68 |
|
|
69 |
case 'v': |
case 'v': |
70 |
show_version(); |
show_version(); |
71 |
break; |
break; |
72 |
|
|
73 |
case '?': |
case '?': |
74 |
/*FALLTHROUGH*/ |
/*FALLTHROUGH*/ |
75 |
default: |
default: |
76 |
fprintf(stderr, "%s: illegal option -%c\n\n", progname, optopt); |
fprintf(stderr, "%s: illegal option -%c\n\n", |
77 |
|
progname, optopt); |
78 |
show_usage(EXIT_FAILURE); |
show_usage(EXIT_FAILURE); |
79 |
break; |
break; |
80 |
} // switch |
} // switch |
81 |
} // while |
} // while |
82 |
argc -= optind; |
argc -= optind; |
83 |
argv += optind; |
argv += optind; |
84 |
|
|
85 |
if (argv[0] == NULL) { |
if (*argv == NULL) { |
86 |
fprintf(stderr, "%s: missing filename\n\n", progname); |
fprintf(stderr, "%s: missing filename\n\n", |
87 |
|
progname); |
88 |
show_usage(EXIT_FAILURE); |
show_usage(EXIT_FAILURE); |
89 |
} // if |
} // if |
90 |
|
|
91 |
filename = argv[0]; |
while (*argv != NULL) { |
92 |
|
filename = *argv; |
93 |
|
|
94 |
decode_file(); |
decode_file(); |
95 |
|
|
96 |
|
argv++; |
97 |
|
} // while |
98 |
|
|
99 |
return EXIT_SUCCESS; |
return EXIT_SUCCESS; |
100 |
} // main() |
} // main() |
101 |
|
|
102 |
void show_usage(int exitcode) |
void show_usage(int exitcode) |
103 |
{ |
{ |
104 |
fprintf((exitcode == EXIT_SUCCESS) ? stdout : stderr, |
fprintf((exitcode == EXIT_SUCCESS) ? stdout : stderr, |
105 |
"Usage: %s [-h] [-v] filename\n" |
"Usage: %s [-f | -h | -v] filename [...]\n" |
106 |
" E.g.: %s darkstat.db\n", |
" E.g.: %s darkstat.db\n\n" |
107 |
|
|
108 |
|
"Options:\n" |
109 |
|
"-f\tToggle follow strict specification, default is false.\n" |
110 |
|
"-h\tShow this help message and exit.\n" |
111 |
|
"-v\tShow version and copyright and exit.\n", |
112 |
progname, progname); |
progname, progname); |
113 |
|
|
114 |
exit(exitcode); |
exit(exitcode); |
115 |
} // show_usage() |
} // show_usage() |
116 |
|
|
117 |
void show_version(void) |
void show_version(void) |
118 |
{ |
{ |
119 |
puts("darkstattype 1.0"); |
puts("darkstattype 1.0"); |
120 |
puts("$Ximalas$"); |
puts("$Ximalas$"); |
121 |
puts(""); |
puts(""); |
122 |
|
|
123 |
puts("Copyright © 2014, Trond Endrestøl <Trond.Endrestol@ximalas.info>"); |
puts("Copyright © 2014, Trond Endrestøl <Trond.Endrestol@ximalas.info>"); |
124 |
puts("All rights reserved."); |
puts("All rights reserved."); |
125 |
puts(""); |
puts(""); |
126 |
puts("Redistribution and use in source and binary forms, with or without"); |
puts("Redistribution and use in source and binary forms, with or without"); |
127 |
puts("modification, are permitted provided that the following conditions are met:"); |
puts("modification, are permitted provided that the following conditions are met:"); |
128 |
puts(""); |
puts(""); |
129 |
puts("1. Redistributions of source code must retain the above copyright notice, this"); |
puts("1. Redistributions of source code must retain the above copyright notice, this"); |
130 |
puts(" list of conditions and the following disclaimer."); |
puts(" list of conditions and the following disclaimer."); |
131 |
puts("2. Redistributions in binary form must reproduce the above copyright notice,"); |
puts("2. Redistributions in binary form must reproduce the above copyright notice,"); |
132 |
puts(" this list of conditions and the following disclaimer in the documentation"); |
puts(" this list of conditions and the following disclaimer in the documentation"); |
133 |
puts(" and/or other materials provided with the distribution."); |
puts(" and/or other materials provided with the distribution."); |
134 |
puts(""); |
puts(""); |
135 |
puts("THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND"); |
puts("THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND"); |
136 |
puts("ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED"); |
puts("ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED"); |
137 |
puts("WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE"); |
puts("WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE"); |
138 |
puts("DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR"); |
puts("DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR"); |
139 |
puts("ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES"); |
puts("ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES"); |
140 |
puts("(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;"); |
puts("(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;"); |
141 |
puts("LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND"); |
puts("LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND"); |
142 |
puts("ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT"); |
puts("ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT"); |
143 |
puts("(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS"); |
puts("(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS"); |
144 |
puts("SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."); |
puts("SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."); |
145 |
|
|
146 |
exit(EXIT_SUCCESS); |
exit(EXIT_SUCCESS); |
147 |
} // show_version() |
} // show_version() |
148 |
|
|
149 |
/* |
uint8_t read8u(void); |
150 |
With clang 3.3 on FreeBSD/amd64 stable/9 r263290: |
int8_t read8s(void); |
151 |
|
uint16_t read16u(void); |
152 |
|
int16_t read16s(void); |
153 |
|
uint32_t read32u(void); |
154 |
|
int32_t read32s(void); |
155 |
|
uint64_t read64u(void); |
156 |
|
int64_t read64s(void); |
157 |
|
|
|
char = 1 byte = 8 bits |
|
|
short = 2 bytes = 16 bits |
|
|
int = 4 bytes = 32 bits |
|
|
long = 8 bytes = 64 bits |
|
|
*/ |
|
|
unsigned char read8u(void); |
|
|
signed char read8s(void); |
|
|
unsigned short read16u(void); |
|
|
signed short read16s(void); |
|
|
unsigned int read32u(void); |
|
|
signed int read32s(void); |
|
|
unsigned long read64u(void); |
|
|
signed long read64s(void); |
|
|
|
|
158 |
void indent(void); |
void indent(void); |
159 |
void exdent(void); |
void exdent(void); |
160 |
void print_indentation(void); |
void print_indentation(void); |
161 |
|
|
162 |
void print_time_t(time_t t); |
void print_time_t(time_t t); |
163 |
|
|
164 |
void decode_file(void) |
void decode_file(void) |
165 |
{ |
{ |
166 |
void decode_host_db_v1(void); |
void decode_host_db_v1(void); |
167 |
void decode_graph_db_v1(void); |
void decode_graph_db_v1(void); |
168 |
|
|
169 |
unsigned int fileheader; |
uint32_t fileheader; |
170 |
unsigned int sectionheader; |
uint32_t sectionheader; |
171 |
|
|
172 |
unsigned int i; |
uint32_t i; |
173 |
|
|
174 |
if ( (file = fopen(filename, "rb")) == NULL) { |
if ( (file = fopen(filename, "rb")) == NULL) { |
175 |
fprintf(stderr, "%s: fopen(\"%s\") = %s (%d)\n", progname, filename, strerror(errno), errno); |
fprintf(stderr, "%s: fopen(\"%s\") = %s (%d)\n", |
176 |
|
progname, filename, strerror(errno), errno); |
177 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
178 |
} // if |
} // if |
179 |
|
|
180 |
if ( (fileheader = read32u()) != 0xDA314159U) { // not darkstat export format |
#define FILE_HEADER_V1 0xDA314159U |
181 |
fprintf(stderr, "%s:%s: file header = 0x%x, not 0x%x\n", progname, filename, fileheader, 0xDA314159U); |
|
182 |
|
if ( (fileheader = read32u()) != FILE_HEADER_V1) { // not darkstat export format |
183 |
|
fprintf(stderr, "%s:%s:%ld: file header = 0x%x, not 0x%x\n", |
184 |
|
progname, filename, ftell(file), fileheader, FILE_HEADER_V1); |
185 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
186 |
} // if |
} // if |
187 |
|
|
188 |
printf("File header 0x%x\n", fileheader); |
printf("File header 0x%x\n", fileheader); |
189 |
|
|
190 |
// Possible section header for host_db v1 and later graph_db v1. |
// Possible section header for host_db v1 and later graph_db v1. |
191 |
indent(); |
indent(); |
192 |
|
|
193 |
|
#define HOST_DB_V1 0xDA485301U |
194 |
|
#define GRAPH_DB_V1 0xDA475201U |
195 |
|
|
196 |
for (i = 0; i < 2; i++) { |
for (i = 0; i < 2; i++) { |
197 |
if ( (sectionheader = read32u()) == 0xDA485301U) { |
if ( (sectionheader = read32u()) == HOST_DB_V1) { |
198 |
print_indentation(); |
print_indentation(); |
199 |
printf("Section header 0x%x\n", sectionheader); |
printf("Section header host_db v1 0x%x\n", sectionheader); |
200 |
decode_host_db_v1(); |
decode_host_db_v1(); |
201 |
} // if |
} // if |
202 |
else if (sectionheader == 0xDA475201U) { |
else if (sectionheader == GRAPH_DB_V1) { |
203 |
print_indentation(); |
print_indentation(); |
204 |
printf("Section header 0x%x\n", sectionheader); |
printf("Section header graph_db v1 0x%x\n", sectionheader); |
205 |
decode_graph_db_v1(); |
decode_graph_db_v1(); |
206 |
} // else if |
} // else if |
207 |
else { |
else { |
208 |
fprintf(stderr, "%s:%s: unknown section header = 0x%x, neither 0x%x nor 0x%x\n", progname, filename, sectionheader, 0xDA485301U, 0xDA475201U); |
fprintf(stderr, |
209 |
|
"%s:%s:%ld: unknown section header = 0x%x, neither 0x%x nor 0x%x\n", |
210 |
|
progname, filename, ftell(file), sectionheader, HOST_DB_V1, |
211 |
|
GRAPH_DB_V1); |
212 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
213 |
} // else |
} // else |
214 |
} // for |
} // for |
215 |
|
|
216 |
exdent(); |
exdent(); |
217 |
|
|
218 |
|
if (fclose(file) != 0) { |
219 |
|
fprintf(stderr, "%s: fclose(\"%s\") = %s (%d)\n", |
220 |
|
progname, filename, strerror(errno), errno); |
221 |
|
exit(EXIT_FAILURE); |
222 |
|
} // if |
223 |
} // decode_file() |
} // decode_file() |
224 |
|
|
225 |
void decode_host_db_v1(void) |
void decode_host_db_v1(void) |
226 |
{ |
{ |
227 |
void decode_host_header_v1(void); |
void decode_host_header_v1(void); |
228 |
void decode_host_header_v2(void); |
void decode_host_header_v2(void); |
229 |
void decode_host_header_v3(void); |
void decode_host_header_v3(void); |
230 |
|
|
231 |
unsigned int hostcount; |
uint32_t hostcount; |
232 |
unsigned int i; |
uint32_t i; |
233 |
|
|
234 |
indent(); |
indent(); |
235 |
|
|
236 |
hostcount = read32u(); |
hostcount = read32u(); |
237 |
|
|
238 |
print_indentation(); |
print_indentation(); |
239 |
printf("Host count %u\n", hostcount); |
printf("Host count %u\n", |
240 |
|
hostcount); |
241 |
|
|
242 |
for (i = 0; i < hostcount; i++) { |
for (i = 0; i < hostcount; i++) { |
243 |
unsigned int hostheader; |
uint32_t hostheader; |
244 |
|
|
245 |
print_indentation(); |
print_indentation(); |
246 |
printf("Host #%u of %u:\n", i + 1, hostcount); |
printf("Host #%u of %u:\n", |
247 |
|
i + 1, hostcount); |
248 |
|
|
249 |
indent(); |
indent(); |
250 |
|
|
251 |
if ( (hostheader = read32u()) == 0x48535403U) { // host header v3 |
#define HOST_HEADER_V3 0x48535403U |
252 |
|
#define HOST_HEADER_V2 0x48535402U |
253 |
|
#define HOST_HEADER_V1 0x48535401U |
254 |
|
|
255 |
|
if ( (hostheader = read32u()) == HOST_HEADER_V3) { // host header v3 |
256 |
print_indentation(); |
print_indentation(); |
257 |
printf("Host header v3 0x%x\n", hostheader); |
printf("Host header v3 0x%x\n", |
258 |
|
hostheader); |
259 |
decode_host_header_v3(); |
decode_host_header_v3(); |
260 |
} // if |
} // if |
261 |
else if (hostheader == 0x48535402U) { // host header v2 |
else if (hostheader == HOST_HEADER_V2) { // host header v2 |
262 |
print_indentation(); |
print_indentation(); |
263 |
printf("Host header v2 0x%x\n", hostheader); |
printf("Host header v2 0x%x\n", |
264 |
|
hostheader); |
265 |
decode_host_header_v2(); |
decode_host_header_v2(); |
266 |
} // else if |
} // else if |
267 |
else if (hostheader == 0x48535401U) { // host header v1 |
else if (hostheader == HOST_HEADER_V1) { // host header v1 |
268 |
print_indentation(); |
print_indentation(); |
269 |
printf("Host header v1 0x%x\n", hostheader); |
printf("Host header v1 0x%x\n", |
270 |
|
hostheader); |
271 |
decode_host_header_v1(); |
decode_host_header_v1(); |
272 |
} // else if |
} // else if |
273 |
else { // unknown host header version |
else { // unknown host header version |
274 |
fprintf(stderr, "%s:%s: unknown host header = 0x%x, neither 0x%x nor 0x%x nor 0x%x\n", progname, filename, hostheader, 0x48535403U, 0x48535402U, 0x48535401U); |
fprintf(stderr, |
275 |
|
"%s:%s:%ld: unknown host header = 0x%x, neither 0x%x nor 0x%x nor 0x%x\n", |
276 |
|
progname, filename, ftell(file), hostheader, HOST_HEADER_V3, |
277 |
|
HOST_HEADER_V2, HOST_HEADER_V1); |
278 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
279 |
} // else |
} // else |
280 |
|
|
281 |
exdent(); |
exdent(); |
282 |
} // for |
} // for |
283 |
|
|
284 |
exdent(); |
exdent(); |
285 |
} // decode_host_db_v1() |
} // decode_host_db_v1() |
286 |
|
|
287 |
void decode_protos_data(void); |
void decode_protos_data(void); |
288 |
void decode_tcp_data(void); |
void decode_tcp_data(void); |
289 |
void decode_udp_data(void); |
void decode_udp_data(void); |
290 |
|
|
291 |
void decode_host_header_v1(void) |
void decode_host_header_v1(void) |
292 |
{ |
{ |
293 |
unsigned char ipv4address[4]; |
uint8_t ipv4address[4]; |
294 |
unsigned char macaddress[6]; |
uint8_t macaddress[6]; |
295 |
unsigned char hostnamelen; |
uint8_t hostnamelen; |
296 |
unsigned char hostname[256]; |
uint8_t hostname[256]; |
297 |
unsigned long bytesin; |
uint64_t bytesin; |
298 |
unsigned long bytesout; |
uint64_t bytesout; |
299 |
unsigned char protosdata; |
uint8_t protosdata; |
300 |
unsigned char tcpdata; |
uint8_t tcpdata; |
301 |
unsigned char udpdata; |
uint8_t udpdata; |
302 |
|
|
303 |
unsigned char i; |
uint8_t i; |
304 |
|
|
305 |
indent(); |
indent(); |
306 |
|
|
307 |
ipv4address[0] = read8u(); |
ipv4address[0] = read8u(); |
308 |
ipv4address[1] = read8u(); |
ipv4address[1] = read8u(); |
309 |
ipv4address[2] = read8u(); |
ipv4address[2] = read8u(); |
310 |
ipv4address[3] = read8u(); |
ipv4address[3] = read8u(); |
311 |
|
|
312 |
print_indentation(); |
print_indentation(); |
313 |
printf("IPv4 address %d.%d.%d.%d\n", |
printf("IPv4 address %hhu.%hhu.%hhu.%hhu\n", |
314 |
ipv4address[0], ipv4address[1], ipv4address[2], ipv4address[3]); |
ipv4address[0], ipv4address[1], ipv4address[2], ipv4address[3]); |
315 |
|
|
316 |
macaddress[0] = read8u(); |
macaddress[0] = read8u(); |
317 |
macaddress[1] = read8u(); |
macaddress[1] = read8u(); |
318 |
macaddress[2] = read8u(); |
macaddress[2] = read8u(); |
319 |
macaddress[3] = read8u(); |
macaddress[3] = read8u(); |
320 |
macaddress[4] = read8u(); |
macaddress[4] = read8u(); |
321 |
macaddress[5] = read8u(); |
macaddress[5] = read8u(); |
322 |
|
|
323 |
print_indentation(); |
print_indentation(); |
324 |
printf("MAC address %02x:%02x:%02x:%02x:%02x:%02x\n", macaddress[0], macaddress[1], macaddress[2], macaddress[3], macaddress[4], macaddress[5]); |
printf("MAC address %02hhx:%02hhx:%02hhx:%02hhx:%02hhx:%02hhx\n", |
325 |
|
macaddress[0], macaddress[1], macaddress[2], |
326 |
|
macaddress[3], macaddress[4], macaddress[5]); |
327 |
|
|
328 |
hostnamelen = read8u(); |
hostnamelen = read8u(); |
329 |
|
|
330 |
print_indentation(); |
print_indentation(); |
331 |
printf("Hostname length %d\n", hostnamelen); |
printf("Hostname length %u\n", |
332 |
|
hostnamelen); |
333 |
|
|
334 |
for (i = 0; i < hostnamelen; i++) { |
for (i = 0; i < hostnamelen; i++) { |
335 |
hostname[i] = read8u(); |
hostname[i] = read8u(); |
336 |
} // for |
} // for |
337 |
hostname[i] = '\0'; |
hostname[i] = '\0'; |
338 |
|
|
339 |
print_indentation(); |
print_indentation(); |
340 |
printf("Hostname %s\n", hostname); |
printf("Hostname %s\n", |
341 |
|
hostname); |
342 |
|
|
343 |
bytesin = read64u(); |
bytesin = read64u(); |
344 |
|
|
345 |
print_indentation(); |
print_indentation(); |
346 |
printf("Bytes in %lu\n", bytesin); |
printf("Bytes in %llu\n", |
347 |
|
(unsigned long long)bytesin); |
348 |
|
|
349 |
bytesout = read64u(); |
bytesout = read64u(); |
350 |
|
|
351 |
print_indentation(); |
print_indentation(); |
352 |
printf("Bytes out %lu\n", bytesout); |
printf("Bytes out %llu\n", |
353 |
|
(unsigned long long)bytesout); |
354 |
|
|
355 |
if ( (protosdata = read8u()) != 'P') { // missing protos data |
if ( (protosdata = read8u()) != 'P') { // missing protos data |
356 |
fprintf(stderr, "%s: expecting character P, not %c\n", progname, protosdata); |
fprintf(stderr, |
357 |
|
"%s:%s:%ld: expecting character P, not %c\n", |
358 |
|
progname, filename, ftell(file), protosdata); |
359 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
360 |
} // if |
} // if |
361 |
|
|
362 |
decode_protos_data(); |
decode_protos_data(); |
363 |
|
|
364 |
if ( (tcpdata = read8u()) != 'T') { // missing tcp data |
if ( (tcpdata = read8u()) != 'T') { // missing tcp data |
365 |
fprintf(stderr, "%s: expecting character T, not %c\n", progname, tcpdata); |
fprintf(stderr, |
366 |
|
"%s:%s:%ld: expecting character T, not %c\n", |
367 |
|
progname, filename, ftell(file), tcpdata); |
368 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
369 |
} // if |
} // if |
370 |
|
|
371 |
decode_tcp_data(); |
decode_tcp_data(); |
372 |
|
|
373 |
if ( (udpdata = read8u()) != 'U') { // missing udp data |
if ( (udpdata = read8u()) != 'U') { // missing udp data |
374 |
fprintf(stderr, "%s: expecting character U, not %c\n", progname, udpdata); |
fprintf(stderr, |
375 |
|
"%s:%s:%ld: expecting character U, not %c\n", |
376 |
|
progname, filename, ftell(file), udpdata); |
377 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
378 |
} // if |
} // if |
379 |
|
|
380 |
decode_udp_data(); |
decode_udp_data(); |
381 |
|
|
382 |
exdent(); |
exdent(); |
383 |
} // decode_host_header_v1 |
} // decode_host_header_v1 |
384 |
|
|
385 |
void decode_host_header_v2(void) |
void decode_host_header_v2(void) |
386 |
{ |
{ |
387 |
unsigned char ipv4address[4]; |
uint8_t ipv4address[4]; |
388 |
unsigned char macaddress[6]; |
uint8_t macaddress[6]; |
389 |
signed long lastseen; |
int64_t lastseen; |
390 |
unsigned char hostnamelen; |
uint8_t hostnamelen; |
391 |
unsigned char hostname[256]; |
uint8_t hostname[256]; |
392 |
unsigned long bytesin; |
uint64_t bytesin; |
393 |
unsigned long bytesout; |
uint64_t bytesout; |
394 |
unsigned char protosdata; |
uint8_t protosdata; |
395 |
unsigned char tcpdata; |
uint8_t tcpdata; |
396 |
unsigned char udpdata; |
uint8_t udpdata; |
397 |
|
|
398 |
unsigned char i; |
uint8_t i; |
399 |
|
|
400 |
indent(); |
indent(); |
401 |
|
|
402 |
ipv4address[0] = read8u(); |
ipv4address[0] = read8u(); |
403 |
ipv4address[1] = read8u(); |
ipv4address[1] = read8u(); |
404 |
ipv4address[2] = read8u(); |
ipv4address[2] = read8u(); |
405 |
ipv4address[3] = read8u(); |
ipv4address[3] = read8u(); |
406 |
|
|
407 |
print_indentation(); |
print_indentation(); |
408 |
printf("IPv4 address %d.%d.%d.%d\n", |
printf("IPv4 address %hhu.%hhu.%hhu.%hhu\n", |
409 |
ipv4address[0], ipv4address[1], ipv4address[2], ipv4address[3]); |
ipv4address[0], ipv4address[1], ipv4address[2], ipv4address[3]); |
410 |
|
|
411 |
macaddress[0] = read8u(); |
if (follow_specification == true) { |
412 |
macaddress[1] = read8u(); |
macaddress[0] = read8u(); |
413 |
macaddress[2] = read8u(); |
macaddress[1] = read8u(); |
414 |
macaddress[3] = read8u(); |
macaddress[2] = read8u(); |
415 |
macaddress[4] = read8u(); |
macaddress[3] = read8u(); |
416 |
macaddress[5] = read8u(); |
macaddress[4] = read8u(); |
417 |
|
macaddress[5] = read8u(); |
418 |
|
|
419 |
print_indentation(); |
print_indentation(); |
420 |
printf("MAC address %02x:%02x:%02x:%02x:%02x:%02x\n", macaddress[0], macaddress[1], macaddress[2], macaddress[3], macaddress[4], macaddress[5]); |
printf("MAC address %02hhx:%02hhx:%02hhx:%02hhx:%02hhx:%02hhx\n", |
421 |
|
macaddress[0], macaddress[1], macaddress[2], |
422 |
|
macaddress[3], macaddress[4], macaddress[5]); |
423 |
|
|
424 |
lastseen = read64s(); |
lastseen = read64s(); |
425 |
|
|
426 |
print_indentation(); |
print_indentation(); |
427 |
printf("Last seen %ld = ", lastseen); |
printf("Last seen 0x%llx = %lld = ", |
428 |
print_time_t(lastseen); |
(unsigned long long)lastseen, (long long)lastseen); |
429 |
puts(""); |
print_time_t(lastseen); |
430 |
|
puts(""); |
431 |
|
} // if |
432 |
|
else { |
433 |
|
lastseen = read64s(); |
434 |
|
|
435 |
|
print_indentation(); |
436 |
|
printf("Last seen 0x%llx = %lld = ", |
437 |
|
(unsigned long long)lastseen, (long long)lastseen); |
438 |
|
print_time_t(lastseen); |
439 |
|
puts(""); |
440 |
|
|
441 |
|
macaddress[0] = read8u(); |
442 |
|
macaddress[1] = read8u(); |
443 |
|
macaddress[2] = read8u(); |
444 |
|
macaddress[3] = read8u(); |
445 |
|
macaddress[4] = read8u(); |
446 |
|
macaddress[5] = read8u(); |
447 |
|
|
448 |
|
print_indentation(); |
449 |
|
printf("MAC address %02hhx:%02hhx:%02hhx:%02hhx:%02hhx:%02hhx\n", |
450 |
|
macaddress[0], macaddress[1], macaddress[2], |
451 |
|
macaddress[3], macaddress[4], macaddress[5]); |
452 |
|
} // else |
453 |
|
|
454 |
hostnamelen = read8u(); |
hostnamelen = read8u(); |
455 |
|
|
456 |
print_indentation(); |
print_indentation(); |
457 |
printf("Hostname length %d\n", hostnamelen); |
printf("Hostname length %hhu\n", |
458 |
|
hostnamelen); |
459 |
|
|
460 |
for (i = 0; i < hostnamelen; i++) { |
for (i = 0; i < hostnamelen; i++) { |
461 |
hostname[i] = read8u(); |
hostname[i] = read8u(); |
462 |
} // for |
} // for |
463 |
hostname[i] = '\0'; |
hostname[i] = '\0'; |
464 |
|
|
465 |
print_indentation(); |
print_indentation(); |
466 |
printf("Hostname %s\n", hostname); |
printf("Hostname %s\n", |
467 |
|
hostname); |
468 |
|
|
469 |
bytesin = read64u(); |
bytesin = read64u(); |
470 |
|
|
471 |
print_indentation(); |
print_indentation(); |
472 |
printf("Bytes in %lu\n", bytesin); |
printf("Bytes in %llu\n", |
473 |
|
(unsigned long long)bytesin); |
474 |
|
|
475 |
bytesout = read64u(); |
bytesout = read64u(); |
476 |
|
|
477 |
print_indentation(); |
print_indentation(); |
478 |
printf("Bytes out %lu\n", bytesout); |
printf("Bytes out %llu\n", |
479 |
|
(unsigned long long)bytesout); |
480 |
|
|
481 |
if ( (protosdata = read8u()) != 'P') { // missing protos data |
if ( (protosdata = read8u()) != 'P') { // missing protos data |
482 |
fprintf(stderr, "%s: expecting character P, not %c\n", progname, protosdata); |
fprintf(stderr, |
483 |
|
"%s:%s:%ld: expecting character P, not %c\n", |
484 |
|
progname, filename, ftell(file), protosdata); |
485 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
486 |
} // if |
} // if |
487 |
|
|
488 |
decode_protos_data(); |
decode_protos_data(); |
489 |
|
|
490 |
if ( (tcpdata = read8u()) != 'T') { // missing tcp data |
if ( (tcpdata = read8u()) != 'T') { // missing tcp data |
491 |
fprintf(stderr, "%s: expecting character T, not %c\n", progname, tcpdata); |
fprintf(stderr, |
492 |
|
"%s:%s:%ld: expecting character T, not %c\n", |
493 |
|
progname, filename, ftell(file), tcpdata); |
494 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
495 |
} // if |
} // if |
496 |
|
|
497 |
decode_tcp_data(); |
decode_tcp_data(); |
498 |
|
|
499 |
if ( (udpdata = read8u()) != 'U') { // missing udp data |
if ( (udpdata = read8u()) != 'U') { // missing udp data |
500 |
fprintf(stderr, "%s: expecting character U, not %c\n", progname, udpdata); |
fprintf(stderr, |
501 |
|
"%s:%s:%ld: expecting character U, not %c\n", |
502 |
|
progname, filename, ftell(file), udpdata); |
503 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
504 |
} // if |
} // if |
505 |
|
|
506 |
decode_udp_data(); |
decode_udp_data(); |
507 |
|
|
508 |
exdent(); |
exdent(); |
509 |
} // decode_host_header_v2 |
} // decode_host_header_v2 |
510 |
|
|
511 |
void decode_host_header_v3(void) |
void decode_host_header_v3(void) |
512 |
{ |
{ |
513 |
unsigned char addressfamily; |
uint8_t addressfamily; |
514 |
unsigned char ipv4address[4]; |
uint8_t ipv4address[4]; |
515 |
unsigned char ipv6address[16]; |
uint16_t ipv6address[8]; |
516 |
unsigned char macaddress[6]; |
uint8_t macaddress[6]; |
517 |
signed long lastseen; |
int64_t lastseen; |
518 |
unsigned char hostnamelen; |
uint8_t hostnamelen; |
519 |
unsigned char hostname[256]; |
uint8_t hostname[256]; |
520 |
unsigned long bytesin; |
uint64_t bytesin; |
521 |
unsigned long bytesout; |
uint64_t bytesout; |
522 |
unsigned char protosdata; |
uint8_t protosdata; |
523 |
unsigned char tcpdata; |
uint8_t tcpdata; |
524 |
unsigned char udpdata; |
uint8_t udpdata; |
525 |
|
|
526 |
unsigned char i; |
uint8_t i; |
527 |
|
|
528 |
indent(); |
indent(); |
529 |
|
|
530 |
if ( (addressfamily = read8u()) == 0x04) { // IPv4 address |
#define A_F_4 0x04 |
531 |
|
#define A_F_6 0x06 |
532 |
|
|
533 |
|
if ( (addressfamily = read8u()) == A_F_4) { // IPv4 address |
534 |
print_indentation(); |
print_indentation(); |
535 |
printf("IPv4 address family (0x%02x)\n", addressfamily); |
printf("IPv4 address family (0x%02hhx)\n", |
536 |
|
addressfamily); |
537 |
|
|
538 |
ipv4address[0] = read8u(); |
ipv4address[0] = read8u(); |
539 |
ipv4address[1] = read8u(); |
ipv4address[1] = read8u(); |
540 |
ipv4address[2] = read8u(); |
ipv4address[2] = read8u(); |
541 |
ipv4address[3] = read8u(); |
ipv4address[3] = read8u(); |
542 |
|
|
543 |
print_indentation(); |
print_indentation(); |
544 |
printf("IPv4 address %d.%d.%d.%d\n", |
printf("IPv4 address %hhu.%hhu.%hhu.%hhu\n", |
545 |
ipv4address[0], ipv4address[1], ipv4address[2], ipv4address[3]); |
ipv4address[0], ipv4address[1], ipv4address[2], ipv4address[3]); |
546 |
} // if |
} // if |
547 |
else if (addressfamily == 0x06) { // IPv6 address |
else if (addressfamily == A_F_6) { // IPv6 address |
548 |
print_indentation(); |
print_indentation(); |
549 |
printf("IPv6 address family (0x%02x)\n", addressfamily); |
printf("IPv6 address family (0x%02hhx)\n", |
550 |
|
addressfamily); |
551 |
|
|
552 |
ipv6address[ 0] = read8u(); |
ipv6address[0] = read16u(); |
553 |
ipv6address[ 1] = read8u(); |
ipv6address[1] = read16u(); |
554 |
ipv6address[ 2] = read8u(); |
ipv6address[2] = read16u(); |
555 |
ipv6address[ 3] = read8u(); |
ipv6address[3] = read16u(); |
556 |
ipv6address[ 4] = read8u(); |
ipv6address[4] = read16u(); |
557 |
ipv6address[ 5] = read8u(); |
ipv6address[5] = read16u(); |
558 |
ipv6address[ 6] = read8u(); |
ipv6address[6] = read16u(); |
559 |
ipv6address[ 7] = read8u(); |
ipv6address[7] = read16u(); |
|
ipv6address[ 8] = read8u(); |
|
|
ipv6address[ 9] = read8u(); |
|
|
ipv6address[10] = read8u(); |
|
|
ipv6address[11] = read8u(); |
|
|
ipv6address[12] = read8u(); |
|
|
ipv6address[13] = read8u(); |
|
|
ipv6address[14] = read8u(); |
|
|
ipv6address[15] = read8u(); |
|
560 |
|
|
561 |
print_indentation(); |
print_indentation(); |
562 |
printf("IPv6 address %02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x\n", |
printf("IPv6 address %04hx:%04hx:%04hx:%04hx:%04hx:%04hx:%04hx:%04hx\n", |
563 |
ipv6address[ 0], |
ipv6address[0], ipv6address[1], ipv6address[2], ipv6address[3], |
564 |
ipv6address[ 1], |
ipv6address[4], ipv6address[5], ipv6address[6], ipv6address[7]); |
|
ipv6address[ 2], |
|
|
ipv6address[ 3], |
|
|
ipv6address[ 4], |
|
|
ipv6address[ 5], |
|
|
ipv6address[ 6], |
|
|
ipv6address[ 7], |
|
|
ipv6address[ 8], |
|
|
ipv6address[ 9], |
|
|
ipv6address[10], |
|
|
ipv6address[11], |
|
|
ipv6address[12], |
|
|
ipv6address[13], |
|
|
ipv6address[14], |
|
|
ipv6address[15]); |
|
565 |
} // else if |
} // else if |
566 |
else { // unknown address family |
else { // unknown address family |
567 |
fprintf(stderr, "%s:%s: unknown address family = 0x%x, neither 0x%x nor 0x%x\n", progname, filename, addressfamily, 0x04, 0x06); |
fprintf(stderr, |
568 |
|
"%s:%s:%ld: unknown address family = 0x%hhx, neither 0x%x nor 0x%x\n", |
569 |
|
progname, filename, ftell(file), addressfamily, A_F_4, A_F_6); |
570 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
571 |
} // else |
} // else |
572 |
|
|
573 |
macaddress[0] = read8u(); |
if (follow_specification == true) { |
574 |
macaddress[1] = read8u(); |
macaddress[0] = read8u(); |
575 |
macaddress[2] = read8u(); |
macaddress[1] = read8u(); |
576 |
macaddress[3] = read8u(); |
macaddress[2] = read8u(); |
577 |
macaddress[4] = read8u(); |
macaddress[3] = read8u(); |
578 |
macaddress[5] = read8u(); |
macaddress[4] = read8u(); |
579 |
|
macaddress[5] = read8u(); |
580 |
|
|
581 |
print_indentation(); |
print_indentation(); |
582 |
printf("MAC address %02x:%02x:%02x:%02x:%02x:%02x\n", macaddress[0], macaddress[1], macaddress[2], macaddress[3], macaddress[4], macaddress[5]); |
printf("MAC address %02hhx:%02hhx:%02hhx:%02hhx:%02hhx:%02hhx\n", |
583 |
|
macaddress[0], macaddress[1], macaddress[2], |
584 |
|
macaddress[3], macaddress[4], macaddress[5]); |
585 |
|
|
586 |
lastseen = read64s(); |
lastseen = read64s(); |
587 |
|
|
588 |
print_indentation(); |
print_indentation(); |
589 |
printf("Last seen %ld = ", lastseen); |
printf("Last seen 0x%llx = %lld = ", |
590 |
print_time_t(lastseen); |
(unsigned long long)lastseen, (long long)lastseen); |
591 |
puts(""); |
print_time_t(lastseen); |
592 |
|
puts(""); |
593 |
|
} // if |
594 |
|
else { |
595 |
|
lastseen = read64s(); |
596 |
|
|
597 |
|
print_indentation(); |
598 |
|
printf("Last seen 0x%llx = %lld = ", |
599 |
|
(unsigned long long)lastseen, (long long)lastseen); |
600 |
|
print_time_t(lastseen); |
601 |
|
puts(""); |
602 |
|
|
603 |
|
macaddress[0] = read8u(); |
604 |
|
macaddress[1] = read8u(); |
605 |
|
macaddress[2] = read8u(); |
606 |
|
macaddress[3] = read8u(); |
607 |
|
macaddress[4] = read8u(); |
608 |
|
macaddress[5] = read8u(); |
609 |
|
|
610 |
|
print_indentation(); |
611 |
|
printf("MAC address %02hhx:%02hhx:%02hhx:%02hhx:%02hhx:%02hhx\n", |
612 |
|
macaddress[0], macaddress[1], macaddress[2], |
613 |
|
macaddress[3], macaddress[4], macaddress[5]); |
614 |
|
} // else |
615 |
|
|
616 |
hostnamelen = read8u(); |
hostnamelen = read8u(); |
617 |
|
|
618 |
print_indentation(); |
print_indentation(); |
619 |
printf("Hostname length %d\n", hostnamelen); |
printf("Hostname length %hhu\n", |
620 |
|
hostnamelen); |
621 |
|
|
622 |
for (i = 0; i < hostnamelen; i++) { |
for (i = 0; i < hostnamelen; i++) { |
623 |
hostname[i] = read8u(); |
hostname[i] = read8u(); |
624 |
} // for |
} // for |
625 |
hostname[i] = '\0'; |
hostname[i] = '\0'; |
626 |
|
|
627 |
print_indentation(); |
print_indentation(); |
628 |
printf("Hostname %s\n", hostname); |
printf("Hostname %s\n", |
629 |
|
hostname); |
630 |
|
|
631 |
bytesin = read64u(); |
bytesin = read64u(); |
632 |
|
|
633 |
print_indentation(); |
print_indentation(); |
634 |
printf("Bytes in %lu\n", bytesin); |
printf("Bytes in %llu\n", |
635 |
|
(unsigned long long)bytesin); |
636 |
|
|
637 |
bytesout = read64u(); |
bytesout = read64u(); |
638 |
|
|
639 |
print_indentation(); |
print_indentation(); |
640 |
printf("Bytes out %lu\n", bytesout); |
printf("Bytes out %llu\n", |
641 |
|
(unsigned long long)bytesout); |
642 |
|
|
643 |
if ( (protosdata = read8u()) != 'P') { // missing protos data |
if ( (protosdata = read8u()) != 'P') { // missing protos data |
644 |
fprintf(stderr, "%s: expecting character P, not %c\n", progname, protosdata); |
fprintf(stderr, |
645 |
|
"%s:%s:%ld: expecting character P, not %c\n", |
646 |
|
progname, filename, ftell(file), protosdata); |
647 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
648 |
} // if |
} // if |
649 |
|
|
650 |
decode_protos_data(); |
decode_protos_data(); |
651 |
|
|
652 |
if ( (tcpdata = read8u()) != 'T') { // missing tcp data |
if ( (tcpdata = read8u()) != 'T') { // missing tcp data |
653 |
fprintf(stderr, "%s: expecting character T, not %c\n", progname, tcpdata); |
fprintf(stderr, |
654 |
|
"%s:%s:%ld: expecting character T, not %c\n", |
655 |
|
progname, filename, ftell(file), tcpdata); |
656 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
657 |
} // if |
} // if |
658 |
|
|
659 |
decode_tcp_data(); |
decode_tcp_data(); |
660 |
|
|
661 |
if ( (udpdata = read8u()) != 'U') { // missing udp data |
if ( (udpdata = read8u()) != 'U') { // missing udp data |
662 |
fprintf(stderr, "%s: expecting character U, not %c\n", progname, udpdata); |
fprintf(stderr, |
663 |
|
"%s:%s:%ld: expecting character U, not %c\n", |
664 |
|
progname, filename, ftell(file), udpdata); |
665 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
666 |
} // if |
} // if |
667 |
|
|
668 |
decode_udp_data(); |
decode_udp_data(); |
669 |
|
|
670 |
exdent(); |
exdent(); |
671 |
} // decode_host_header_v3 |
} // decode_host_header_v3 |
672 |
|
|
673 |
void decode_protos_data(void) |
void decode_protos_data(void) |
674 |
{ |
{ |
675 |
unsigned char ipprotocount; |
uint8_t ipprotocount; |
676 |
|
|
677 |
unsigned char u; |
uint8_t i; |
678 |
|
|
679 |
ipprotocount = read8u(); |
ipprotocount = read8u(); |
680 |
|
|
681 |
print_indentation(); |
print_indentation(); |
682 |
printf("IP Proto count %d\n", ipprotocount); |
printf("IP Proto count %hhu\n", |
683 |
|
ipprotocount); |
684 |
|
|
685 |
indent(); |
indent(); |
686 |
|
|
687 |
for (u = 0; u < ipprotocount; u++) { |
for (i = 0; i < ipprotocount; i++) { |
688 |
unsigned char proto; |
uint8_t proto; |
689 |
unsigned long in; |
uint64_t in; |
690 |
unsigned long out; |
uint64_t out; |
691 |
|
|
692 |
print_indentation(); |
print_indentation(); |
693 |
printf("Protocol #%u of %u:\n", u + 1, ipprotocount); |
printf("Protocol #%u of %hhu:\n", |
694 |
|
i + 1, ipprotocount); |
695 |
|
|
696 |
proto = read8u(); |
proto = read8u(); |
697 |
|
|
698 |
indent(); |
indent(); |
699 |
print_indentation(); |
print_indentation(); |
700 |
printf("Protocol 0x%02x\n", proto); |
printf("Protocol 0x%02hhx\n", |
701 |
|
proto); |
702 |
|
|
703 |
in = read64u(); |
in = read64u(); |
704 |
|
|
705 |
print_indentation(); |
print_indentation(); |
706 |
printf("In %lu\n", in); |
printf("In %llu\n", |
707 |
|
(unsigned long long)in); |
708 |
|
|
709 |
out = read64u(); |
out = read64u(); |
710 |
|
|
711 |
print_indentation(); |
print_indentation(); |
712 |
printf("Out %lu\n", out); |
printf("Out %llu\n", |
713 |
|
(unsigned long long)out); |
714 |
|
|
715 |
exdent(); |
exdent(); |
716 |
} // for |
} // for |
717 |
|
|
718 |
exdent(); |
exdent(); |
719 |
} // decode_protos_data(); |
} // decode_protos_data(); |
720 |
|
|
721 |
void decode_tcp_data(void) |
void decode_tcp_data(void) |
722 |
{ |
{ |
723 |
unsigned char tcpprotocount; |
uint8_t tcpprotocount; |
724 |
|
|
725 |
unsigned short i; |
uint16_t i; |
726 |
|
|
727 |
tcpprotocount = read16u(); |
tcpprotocount = read16u(); |
728 |
|
|
729 |
print_indentation(); |
print_indentation(); |
730 |
printf("TCP proto count %d\n", tcpprotocount); |
printf("TCP proto count %hhu\n", |
731 |
|
tcpprotocount); |
732 |
|
|
733 |
indent(); |
indent(); |
734 |
|
|
735 |
for (i = 0; i < tcpprotocount; i++) { |
for (i = 0; i < tcpprotocount; i++) { |
736 |
unsigned short port; |
uint16_t port; |
737 |
unsigned long syn; |
uint64_t syn; |
738 |
unsigned long in; |
uint64_t in; |
739 |
unsigned long out; |
uint64_t out; |
740 |
|
|
741 |
port = read16u(); |
port = read16u(); |
742 |
|
|
743 |
print_indentation(); |
print_indentation(); |
744 |
printf("Port %d:\n", port); |
printf("Port %hu:\n", |
745 |
|
port); |
746 |
|
|
747 |
syn = read64u(); |
syn = read64u(); |
748 |
|
|
749 |
indent(); |
indent(); |
750 |
print_indentation(); |
print_indentation(); |
751 |
printf("SYN %lu\n", syn); |
printf("SYN %llu\n", |
752 |
|
(unsigned long long)syn); |
753 |
|
|
754 |
in = read64u(); |
in = read64u(); |
755 |
|
|
756 |
print_indentation(); |
print_indentation(); |
757 |
printf("In %lu\n", in); |
printf("In %llu\n", |
758 |
|
(unsigned long long)in); |
759 |
|
|
760 |
out = read64u(); |
out = read64u(); |
761 |
|
|
762 |
print_indentation(); |
print_indentation(); |
763 |
printf("Out %lu\n", out); |
printf("Out %llu\n", |
764 |
|
(unsigned long long)out); |
765 |
|
|
766 |
exdent(); |
exdent(); |
767 |
} // for |
} // for |
768 |
|
|
769 |
exdent(); |
exdent(); |
770 |
} // decode_tcp_data() |
} // decode_tcp_data() |
771 |
|
|
772 |
void decode_udp_data(void) |
void decode_udp_data(void) |
773 |
{ |
{ |
774 |
unsigned char udpprotocount; |
uint8_t udpprotocount; |
775 |
|
|
776 |
unsigned short i; |
uint16_t i; |
777 |
|
|
778 |
udpprotocount = read16u(); |
udpprotocount = read16u(); |
779 |
|
|
780 |
print_indentation(); |
print_indentation(); |
781 |
printf("UDP proto count %d\n", udpprotocount); |
printf("UDP proto count %hhu\n", |
782 |
|
udpprotocount); |
783 |
|
|
784 |
indent(); |
indent(); |
785 |
|
|
786 |
for (i = 0; i < udpprotocount; i++) { |
for (i = 0; i < udpprotocount; i++) { |
787 |
unsigned short port; |
uint16_t port; |
788 |
unsigned long in; |
uint64_t in; |
789 |
unsigned long out; |
uint64_t out; |
790 |
|
|
791 |
port = read16u(); |
port = read16u(); |
792 |
|
|
793 |
print_indentation(); |
print_indentation(); |
794 |
printf("Port %d:\n", port); |
printf("Port %hu:\n", |
795 |
|
port); |
796 |
|
|
797 |
in = read64u(); |
in = read64u(); |
798 |
|
|
799 |
indent(); |
indent(); |
800 |
print_indentation(); |
print_indentation(); |
801 |
printf("In %lu\n", in); |
printf("In %llu\n", |
802 |
|
(unsigned long long)in); |
803 |
|
|
804 |
out = read64u(); |
out = read64u(); |
805 |
|
|
806 |
print_indentation(); |
print_indentation(); |
807 |
printf("Out %lu\n", out); |
printf("Out %llu\n", |
808 |
|
(unsigned long long)out); |
809 |
|
|
810 |
exdent(); |
exdent(); |
811 |
} // for |
} // for |
812 |
|
|
813 |
exdent(); |
exdent(); |
814 |
} // decode_udp_data() |
} // decode_udp_data() |
815 |
|
|
816 |
void decode_graph_db_v1(void) |
void decode_graph_db_v1(void) |
817 |
{ |
{ |
818 |
signed long lasttime; |
int64_t lasttime; |
819 |
|
|
820 |
unsigned int i; |
uint32_t i; |
821 |
|
|
822 |
lasttime = read64s(); |
lasttime = read64s(); |
823 |
|
|
824 |
indent(); |
indent(); |
825 |
print_indentation(); |
print_indentation(); |
826 |
printf("Last time %ld = ", lasttime); |
printf("Last time 0x%llx = %lld = ", |
827 |
|
(unsigned long long)lasttime, (long long)lasttime); |
828 |
print_time_t(lasttime); |
print_time_t(lasttime); |
829 |
puts(""); |
puts(""); |
830 |
|
|
831 |
for (i = 0; i < 4; i++) { |
for (i = 0; i < 4; i++) { |
832 |
unsigned char nbars; |
uint8_t nbars; |
833 |
unsigned char idxlastbar; |
uint8_t idxlastbar; |
834 |
|
|
835 |
unsigned int j; |
uint32_t j; |
836 |
|
|
837 |
print_indentation(); |
print_indentation(); |
838 |
printf("Graph #%d of 4:\n", i + 1); |
printf("Graph #%u of 4:\n", |
839 |
|
i + 1); |
840 |
|
|
841 |
nbars = read8u(); |
nbars = read8u(); |
842 |
|
|
843 |
indent(); |
indent(); |
844 |
print_indentation(); |
print_indentation(); |
845 |
printf("Number of bars %u\n", nbars); |
printf("Number of bars %hhu\n", |
846 |
|
nbars); |
847 |
|
|
848 |
idxlastbar = read8u(); |
idxlastbar = read8u(); |
849 |
|
|
850 |
print_indentation(); |
print_indentation(); |
851 |
printf("Index of last bar %u\n", idxlastbar); |
printf("Index of last bar %hhu\n", |
852 |
|
idxlastbar); |
853 |
|
|
854 |
indent(); |
indent(); |
855 |
for (j = 0; j < idxlastbar; j++) { |
for (j = 0; j < idxlastbar; j++) { |
856 |
unsigned long in; |
uint64_t in; |
857 |
unsigned long out; |
uint64_t out; |
858 |
|
|
859 |
print_indentation(); |
print_indentation(); |
860 |
printf("Bar #%u of %u:\n", j + 1, idxlastbar); |
printf("Bar #%u of %hhu:\n", |
861 |
|
j + 1, idxlastbar); |
862 |
|
|
863 |
in = read64u(); |
in = read64u(); |
864 |
|
|
865 |
indent(); |
indent(); |
866 |
print_indentation(); |
print_indentation(); |
867 |
printf("In %lu\n", in); |
printf("In %llu\n", |
868 |
|
(unsigned long long)in); |
869 |
|
|
870 |
out = read64u(); |
out = read64u(); |
871 |
|
|
872 |
print_indentation(); |
print_indentation(); |
873 |
printf("Out %lu\n", out); |
printf("Out %llu\n", |
874 |
|
(unsigned long long)out); |
875 |
|
|
876 |
exdent(); |
exdent(); |
877 |
} // for |
} // for |
878 |
exdent(); |
exdent(); |
879 |
|
|
880 |
exdent(); |
exdent(); |
881 |
} // for |
} // for |
882 |
|
|
883 |
exdent(); |
exdent(); |
884 |
} // decode_graph_db_v1() |
} // decode_graph_db_v1() |
885 |
|
|
886 |
void handle_file_error(void); |
void handle_file_error(void); |
887 |
|
|
888 |
unsigned char read8u(void) |
uint8_t read8u(void) |
889 |
{ |
{ |
890 |
size_t r; |
size_t r; |
891 |
unsigned char v; |
uint8_t v; |
892 |
|
|
|
//fprintf(stderr, "%s: sizeof(unsigned char) = %ld\n", progname, sizeof(v)); |
|
|
|
|
893 |
if ( (r = fread((void *)&v, sizeof(v), 1, file)) != 1) { |
if ( (r = fread((void *)&v, sizeof(v), 1, file)) != 1) { |
894 |
handle_file_error(); |
handle_file_error(); |
895 |
} // if |
} // if |
896 |
|
|
897 |
return v; |
return v; |
898 |
} // read8u() |
} // read8u() |
899 |
|
|
900 |
signed char read8s(void) |
int8_t read8s(void) |
901 |
{ |
{ |
902 |
size_t r; |
size_t r; |
903 |
signed char v; |
int8_t v; |
904 |
|
|
|
//fprintf(stderr, "%s: sizeof(signed char) = %ld\n", progname, sizeof(v)); |
|
|
|
|
905 |
if ( (r = fread((void *)&v, sizeof(v), 1, file)) != 1) { |
if ( (r = fread((void *)&v, sizeof(v), 1, file)) != 1) { |
906 |
handle_file_error(); |
handle_file_error(); |
907 |
} // if |
} // if |
908 |
|
|
909 |
return v; |
return v; |
910 |
} // read8s() |
} // read8s() |
911 |
|
|
912 |
#ifdef __LITTLE_ENDIAN__ |
#ifdef __LITTLE_ENDIAN__ |
913 |
#include <netinet/in.h> |
#include <netinet/in.h> |
914 |
#endif |
#endif |
915 |
|
|
916 |
unsigned short read16u(void) |
uint16_t read16u(void) |
917 |
{ |
{ |
918 |
size_t r; |
size_t r; |
919 |
unsigned short v; |
uint16_t v; |
920 |
|
|
|
//fprintf(stderr, "%s: sizeof(unsigned short) = %ld\n", progname, sizeof(v)); |
|
|
|
|
921 |
if ( (r = fread((void *)&v, sizeof(v), 1, file)) != 1) { |
if ( (r = fread((void *)&v, sizeof(v), 1, file)) != 1) { |
922 |
handle_file_error(); |
handle_file_error(); |
923 |
} // if |
} // if |
924 |
|
|
925 |
#ifdef __LITTLE_ENDIAN__ |
#ifdef __LITTLE_ENDIAN__ |
926 |
v = ntohs(v); |
v = ntohs(v); |
927 |
#endif |
#endif |
928 |
|
|
929 |
return v; |
return v; |
930 |
} // read16u() |
} // read16u() |
931 |
|
|
932 |
signed short read16s(void) |
int16_t read16s(void) |
933 |
{ |
{ |
934 |
size_t r; |
size_t r; |
935 |
signed short v; |
int16_t v; |
936 |
|
|
|
//fprintf(stderr, "%s: sizeof(signed short) = %ld\n", progname, sizeof(v)); |
|
|
|
|
937 |
if ( (r = fread((void *)&v, sizeof(v), 1, file)) != 1) { |
if ( (r = fread((void *)&v, sizeof(v), 1, file)) != 1) { |
938 |
handle_file_error(); |
handle_file_error(); |
939 |
} // if |
} // if |
940 |
|
|
941 |
#ifdef __LITTLE_ENDIAN__ |
#ifdef __LITTLE_ENDIAN__ |
942 |
v = ntohs(v); |
v = ntohs(v); |
943 |
#endif |
#endif |
944 |
|
|
945 |
return v; |
return v; |
946 |
} // read16s() |
} // read16s() |
947 |
|
|
948 |
unsigned int read32u(void) |
uint32_t read32u(void) |
949 |
{ |
{ |
950 |
size_t r; |
size_t r; |
951 |
unsigned int v; |
uint32_t v; |
952 |
|
|
|
//fprintf(stderr, "%s: sizeof(unsigned int) = %ld\n", progname, sizeof(v)); |
|
|
|
|
953 |
if ( (r = fread((void *)&v, sizeof(v), 1, file)) != 1) { |
if ( (r = fread((void *)&v, sizeof(v), 1, file)) != 1) { |
954 |
handle_file_error(); |
handle_file_error(); |
955 |
} // if |
} // if |
956 |
|
|
957 |
#ifdef __LITTLE_ENDIAN__ |
#ifdef __LITTLE_ENDIAN__ |
958 |
v = ntohl(v); |
v = ntohl(v); |
959 |
#endif |
#endif |
960 |
|
|
961 |
return v; |
return v; |
962 |
} // read32u() |
} // read32u() |
963 |
|
|
964 |
signed int read32s(void) |
int32_t read32s(void) |
965 |
{ |
{ |
966 |
size_t r; |
size_t r; |
967 |
signed int v; |
int32_t v; |
968 |
|
|
|
//fprintf(stderr, "%s: sizeof(signed int) = %ld\n", progname, sizeof(v)); |
|
|
|
|
969 |
if ( (r = fread((void *)&v, sizeof(v), 1, file)) != 1) { |
if ( (r = fread((void *)&v, sizeof(v), 1, file)) != 1) { |
970 |
handle_file_error(); |
handle_file_error(); |
971 |
} // if |
} // if |
972 |
|
|
973 |
#ifdef __LITTLE_ENDIAN__ |
#ifdef __LITTLE_ENDIAN__ |
974 |
v = ntohl(v); |
v = ntohl(v); |
975 |
#endif |
#endif |
976 |
|
|
977 |
return v; |
return v; |
978 |
} // read32s() |
} // read32s() |
979 |
|
|
980 |
unsigned long read64u(void) |
uint64_t read64u(void) |
981 |
{ |
{ |
982 |
size_t r; |
size_t r; |
983 |
unsigned long v; |
uint64_t v; |
|
unsigned int *p = (unsigned int *)&v; |
|
984 |
|
|
985 |
//fprintf(stderr, "%s: sizeof(unsigned long) = %ld\n", progname, sizeof(v)); |
#ifdef __LITTLE_ENDIAN__ |
986 |
|
uint64_t tmp; |
987 |
|
uint32_t *p1 = (uint32_t *)&v; |
988 |
|
uint32_t *p2 = (uint32_t *)&tmp; |
989 |
|
#endif |
990 |
|
|
991 |
if ( (r = fread((void *)&v, sizeof(v), 1, file)) != 1) { |
if ( (r = fread((void *)&v, sizeof(v), 1, file)) != 1) { |
992 |
handle_file_error(); |
handle_file_error(); |
993 |
} // if |
} // if |
994 |
|
|
995 |
#ifdef __LITTLE_ENDIAN__ |
#ifdef __LITTLE_ENDIAN__ |
996 |
p[0] = ntohl((unsigned int)p[0]); |
p2[1] = ntohl(p1[0]); |
997 |
p[1] = ntohl((unsigned int)p[1]); |
p2[0] = ntohl(p1[1]); |
998 |
|
v = tmp; |
999 |
#endif |
#endif |
1000 |
|
|
1001 |
return v; |
return v; |
1002 |
} // read64u() |
} // read64u() |
1003 |
|
|
1004 |
signed long read64s(void) |
int64_t read64s(void) |
1005 |
{ |
{ |
1006 |
size_t r; |
size_t r; |
1007 |
signed long v; |
int64_t v; |
|
signed int *p = (signed int *)&v; |
|
1008 |
|
|
1009 |
//fprintf(stderr, "%s: sizeof(signed long) = %ld\n", progname, sizeof(v)); |
#ifdef __LITTLE_ENDIAN__ |
1010 |
|
int64_t tmp; |
1011 |
|
int32_t *p1 = (int32_t *)&v; |
1012 |
|
int32_t *p2 = (int32_t *)&tmp; |
1013 |
|
#endif |
1014 |
|
|
1015 |
if ( (r = fread((void *)&v, sizeof(v), 1, file)) != 1) { |
if ( (r = fread((void *)&v, sizeof(v), 1, file)) != 1) { |
1016 |
handle_file_error(); |
handle_file_error(); |
1017 |
} // if |
} // if |
1018 |
|
|
1019 |
#ifdef __LITTLE_ENDIAN__ |
#ifdef __LITTLE_ENDIAN__ |
1020 |
p[0] = ntohl((signed int)p[0]); |
p2[1] = ntohl(p1[0]); |
1021 |
p[1] = ntohl((signed int)p[1]); |
p2[0] = ntohl(p1[1]); |
1022 |
|
v = tmp; |
1023 |
#endif |
#endif |
1024 |
|
|
1025 |
return v; |
return v; |
1026 |
} // read64s() |
} // read64s() |
1027 |
|
|
1028 |
void handle_file_error(void) |
void handle_file_error(void) |
1029 |
{ |
{ |
1030 |
|
int saved_errno = errno; |
1031 |
|
|
1032 |
if (feof(file) != 0) { |
if (feof(file) != 0) { |
1033 |
fprintf(stderr, "%s:%s: premature end-of-file\n", progname, filename); |
fprintf(stderr, |
1034 |
|
"%s:%s:%ld: premature end-of-file\n", |
1035 |
|
progname, filename, ftell(file)); |
1036 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
1037 |
} // if |
} // if |
1038 |
|
|
1039 |
if (ferror(file) != 0) { |
if (ferror(file) != 0) { |
1040 |
fprintf(stderr, "%s:%s: file error, errno = %s (%d)\n", progname, filename, strerror(errno), errno); |
fprintf(stderr, |
1041 |
|
"%s:%s:%ld: file error, errno = %s (%d)\n", |
1042 |
|
progname, filename, ftell(file), |
1043 |
|
strerror(saved_errno), saved_errno); |
1044 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
1045 |
} // if |
} // if |
1046 |
} // handle_file_error() |
} // handle_file_error() |
1047 |
|
|
1048 |
signed long long indentation = 0LL; |
int64_t indentation = 0LL; |
1049 |
|
|
1050 |
void indent(void) |
void indent(void) |
1051 |
{ |
{ |
1052 |
indentation += 2LL; |
if (indentation < (INT64_MAX - 2LL)) { |
1053 |
|
indentation += 2LL; |
1054 |
|
} // if |
1055 |
} // indent() |
} // indent() |
1056 |
|
|
1057 |
void exdent(void) |
void exdent(void) |
1058 |
{ |
{ |
1059 |
indentation -= 2LL; |
indentation -= 2LL; |
1060 |
|
|
1061 |
if (indentation < 0LL) { |
if (indentation < 0LL) { |
1062 |
indentation = 0LL; |
indentation = 0LL; |
1063 |
}// if |
}// if |
1064 |
} // exdent() |
} // exdent() |
1065 |
|
|
1066 |
void print_indentation(void) |
void print_indentation(void) |
1067 |
{ |
{ |
1068 |
signed long long i; |
int64_t i; |
1069 |
|
|
1070 |
for (i = 0; i < indentation; i++) { |
for (i = 0; i < indentation; i++) { |
1071 |
putchar(' '); |
putchar(' '); |
1072 |
} // for |
} // for |
1073 |
} // print_indentation() |
} // print_indentation() |
1074 |
|
|
1075 |
void print_time_t(time_t t) |
void print_time_t(time_t t) |
1076 |
{ |
{ |
1077 |
struct tm *stm; |
struct tm *stm; |
1078 |
char buffer[1024]; |
char buffer[1024]; |
1079 |
|
|
1080 |
stm = gmtime(&t); |
stm = gmtime(&t); |
1081 |
|
|
1082 |
// ISO 8601 format |
// ISO 8601 format |
1083 |
if (strftime(buffer, sizeof(buffer), "%Y-%m-%dT%H:%M:%S%z", stm) == 0) { |
if (strftime(buffer, sizeof(buffer), "%Y-%m-%dT%H:%M:%S%z", stm) == 0) { |
1084 |
fprintf(stderr, "%s:%s: strftime() error, errno = %s (%d)\n", progname, filename, strerror(errno), errno); |
int saved_errno = errno; |
1085 |
|
|
1086 |
|
fprintf(stderr, |
1087 |
|
"%s:%s:%ld: strftime() error, errno = %s (%d)\n", |
1088 |
|
progname, filename, ftell(file), |
1089 |
|
strerror(saved_errno), saved_errno); |
1090 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
1091 |
} // if |
} // if |
1092 |
|
|
1093 |
fputs(buffer, stdout); |
fputs(buffer, stdout); |
1094 |
} // print_time_t() |
} // print_time_t() |
1095 |
|
|
1096 |
// darkstattype.c |
// darkstattype.c |