1 |
/* -*- coding: utf-8 -*- |
2 |
darkstattype.c - Program to decode darkstat's dumpfile. |
3 |
|
4 |
$Ximalas$ |
5 |
|
6 |
Tested on FreeBSD/amd64 stable/9 r263290 with clang 3.3. |
7 |
|
8 |
Copyright © 2014, Trond Endrestøl <Trond.Endrestol@ximalas.info> |
9 |
All rights reserved. |
10 |
|
11 |
Redistribution and use in source and binary forms, with or without |
12 |
modification, are permitted provided that the following conditions are met: |
13 |
|
14 |
1. Redistributions of source code must retain the above copyright notice, this |
15 |
list of conditions and the following disclaimer. |
16 |
2. Redistributions in binary form must reproduce the above copyright notice, |
17 |
this list of conditions and the following disclaimer in the documentation |
18 |
and/or other materials provided with the distribution. |
19 |
|
20 |
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND |
21 |
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED |
22 |
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE |
23 |
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR |
24 |
ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES |
25 |
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; |
26 |
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND |
27 |
ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
28 |
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS |
29 |
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
30 |
*/ |
31 |
|
32 |
#include <errno.h> |
33 |
#include <stdbool.h> |
34 |
#include <stdint.h> |
35 |
#include <stdio.h> |
36 |
#include <stdlib.h> |
37 |
#include <string.h> |
38 |
#include <time.h> |
39 |
#include <unistd.h> |
40 |
|
41 |
const char *progname = NULL; |
42 |
const char *filename = NULL; |
43 |
FILE *file = NULL; |
44 |
bool follow_specification = false; |
45 |
|
46 |
int main(int argc, char **argv) |
47 |
{ |
48 |
void show_usage(int exitcode); |
49 |
void show_version(void); |
50 |
void decode_file(void); |
51 |
|
52 |
int i; |
53 |
|
54 |
progname = argv[0]; |
55 |
|
56 |
opterr = 0; |
57 |
while ( (i = getopt(argc, argv, "fhv")) != -1) { |
58 |
switch (i) { |
59 |
case 'f': |
60 |
follow_specification = !follow_specification; |
61 |
break; |
62 |
|
63 |
case 'h': |
64 |
show_usage(EXIT_SUCCESS); |
65 |
break; |
66 |
|
67 |
case 'v': |
68 |
show_version(); |
69 |
break; |
70 |
|
71 |
case '?': |
72 |
/*FALLTHROUGH*/ |
73 |
default: |
74 |
fprintf(stderr, "%s: illegal option -%c\n\n", progname, optopt); |
75 |
show_usage(EXIT_FAILURE); |
76 |
break; |
77 |
} // switch |
78 |
} // while |
79 |
argc -= optind; |
80 |
argv += optind; |
81 |
|
82 |
if (*argv == NULL) { |
83 |
fprintf(stderr, "%s: missing filename\n\n", progname); |
84 |
show_usage(EXIT_FAILURE); |
85 |
} // if |
86 |
|
87 |
while (*argv != NULL) { |
88 |
filename = *argv; |
89 |
|
90 |
decode_file(); |
91 |
|
92 |
argv++; |
93 |
} // while |
94 |
|
95 |
return EXIT_SUCCESS; |
96 |
} // main() |
97 |
|
98 |
void show_usage(int exitcode) |
99 |
{ |
100 |
fprintf((exitcode == EXIT_SUCCESS) ? stdout : stderr, |
101 |
"Usage: %s [-f] [-h] [-v] filename ...\n" |
102 |
" E.g.: %s darkstat.db\n\n" |
103 |
|
104 |
"Options:\n" |
105 |
"-f\tToggle follow strict specification, default is false.\n" |
106 |
"-h\tShow this help message and exit.\n" |
107 |
"-v\tShow version and copyright and exit.\n", |
108 |
progname, progname); |
109 |
|
110 |
exit(exitcode); |
111 |
} // show_usage() |
112 |
|
113 |
void show_version(void) |
114 |
{ |
115 |
puts("darkstattype 1.0"); |
116 |
puts("$Ximalas$"); |
117 |
puts(""); |
118 |
|
119 |
puts("Copyright © 2014, Trond Endrestøl <Trond.Endrestol@ximalas.info>"); |
120 |
puts("All rights reserved."); |
121 |
puts(""); |
122 |
puts("Redistribution and use in source and binary forms, with or without"); |
123 |
puts("modification, are permitted provided that the following conditions are met:"); |
124 |
puts(""); |
125 |
puts("1. Redistributions of source code must retain the above copyright notice, this"); |
126 |
puts(" list of conditions and the following disclaimer."); |
127 |
puts("2. Redistributions in binary form must reproduce the above copyright notice,"); |
128 |
puts(" this list of conditions and the following disclaimer in the documentation"); |
129 |
puts(" and/or other materials provided with the distribution."); |
130 |
puts(""); |
131 |
puts("THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND"); |
132 |
puts("ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED"); |
133 |
puts("WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE"); |
134 |
puts("DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR"); |
135 |
puts("ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES"); |
136 |
puts("(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;"); |
137 |
puts("LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND"); |
138 |
puts("ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT"); |
139 |
puts("(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS"); |
140 |
puts("SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."); |
141 |
|
142 |
exit(EXIT_SUCCESS); |
143 |
} // show_version() |
144 |
|
145 |
uint8_t read8u(void); |
146 |
int8_t read8s(void); |
147 |
uint16_t read16u(void); |
148 |
int16_t read16s(void); |
149 |
uint32_t read32u(void); |
150 |
int32_t read32s(void); |
151 |
uint64_t read64u(void); |
152 |
int64_t read64s(void); |
153 |
|
154 |
void indent(void); |
155 |
void exdent(void); |
156 |
void print_indentation(void); |
157 |
|
158 |
void print_time_t(time_t t); |
159 |
|
160 |
void decode_file(void) |
161 |
{ |
162 |
void decode_host_db_v1(void); |
163 |
void decode_graph_db_v1(void); |
164 |
|
165 |
uint32_t fileheader; |
166 |
uint32_t sectionheader; |
167 |
|
168 |
uint32_t i; |
169 |
|
170 |
if ( (file = fopen(filename, "rb")) == NULL) { |
171 |
fprintf(stderr, "%s: fopen(\"%s\") = %s (%d)\n", progname, filename, strerror(errno), errno); |
172 |
exit(EXIT_FAILURE); |
173 |
} // if |
174 |
|
175 |
#define FILE_HEADER_V1 0xDA314159U |
176 |
|
177 |
if ( (fileheader = read32u()) != FILE_HEADER_V1) { // not darkstat export format |
178 |
fprintf(stderr, "%s:%s:%ld: file header = 0x%x, not 0x%x\n", progname, filename, ftell(file), fileheader, FILE_HEADER_V1); |
179 |
exit(EXIT_FAILURE); |
180 |
} // if |
181 |
|
182 |
printf("File header 0x%x\n", fileheader); |
183 |
|
184 |
// Possible section header for host_db v1 and later graph_db v1. |
185 |
indent(); |
186 |
|
187 |
#define HOST_DB_V1 0xDA485301U |
188 |
#define GRAPH_DB_V1 0xDA475201U |
189 |
|
190 |
for (i = 0; i < 2; i++) { |
191 |
if ( (sectionheader = read32u()) == HOST_DB_V1) { |
192 |
print_indentation(); |
193 |
printf("Section header host_db v1 0x%x\n", sectionheader); |
194 |
decode_host_db_v1(); |
195 |
} // if |
196 |
else if (sectionheader == GRAPH_DB_V1) { |
197 |
print_indentation(); |
198 |
printf("Section header graph_db v1 0x%x\n", sectionheader); |
199 |
decode_graph_db_v1(); |
200 |
} // else if |
201 |
else { |
202 |
fprintf(stderr, "%s:%s:%ld: unknown section header = 0x%x, neither 0x%x nor 0x%x\n", progname, filename, ftell(file), sectionheader, HOST_DB_V1, GRAPH_DB_V1); |
203 |
exit(EXIT_FAILURE); |
204 |
} // else |
205 |
} // for |
206 |
|
207 |
exdent(); |
208 |
|
209 |
if (fclose(file) != 0) { |
210 |
fprintf(stderr, "%s: fclose(\"%s\") = %s (%d)\n", progname, filename, strerror(errno), errno); |
211 |
exit(EXIT_FAILURE); |
212 |
} // if |
213 |
} // decode_file() |
214 |
|
215 |
void decode_host_db_v1(void) |
216 |
{ |
217 |
void decode_host_header_v1(void); |
218 |
void decode_host_header_v2(void); |
219 |
void decode_host_header_v3(void); |
220 |
|
221 |
uint32_t hostcount; |
222 |
uint32_t i; |
223 |
|
224 |
indent(); |
225 |
|
226 |
hostcount = read32u(); |
227 |
|
228 |
print_indentation(); |
229 |
printf("Host count %u\n", hostcount); |
230 |
|
231 |
for (i = 0; i < hostcount; i++) { |
232 |
uint32_t hostheader; |
233 |
|
234 |
print_indentation(); |
235 |
printf("Host #%u of %u:\n", i + 1, hostcount); |
236 |
|
237 |
indent(); |
238 |
|
239 |
#define HOST_HEADER_V3 0x48535403U |
240 |
#define HOST_HEADER_V2 0x48535402U |
241 |
#define HOST_HEADER_V1 0x48535401U |
242 |
|
243 |
if ( (hostheader = read32u()) == HOST_HEADER_V3) { // host header v3 |
244 |
print_indentation(); |
245 |
printf("Host header v3 0x%x\n", hostheader); |
246 |
decode_host_header_v3(); |
247 |
} // if |
248 |
else if (hostheader == HOST_HEADER_V2) { // host header v2 |
249 |
print_indentation(); |
250 |
printf("Host header v2 0x%x\n", hostheader); |
251 |
decode_host_header_v2(); |
252 |
} // else if |
253 |
else if (hostheader == HOST_HEADER_V1) { // host header v1 |
254 |
print_indentation(); |
255 |
printf("Host header v1 0x%x\n", hostheader); |
256 |
decode_host_header_v1(); |
257 |
} // else if |
258 |
else { // unknown host header version |
259 |
fprintf(stderr, "%s:%s:%ld: unknown host header = 0x%x, neither 0x%x nor 0x%x nor 0x%x\n", progname, filename, ftell(file), hostheader, HOST_HEADER_V3, HOST_HEADER_V2, HOST_HEADER_V1); |
260 |
exit(EXIT_FAILURE); |
261 |
} // else |
262 |
|
263 |
exdent(); |
264 |
} // for |
265 |
|
266 |
exdent(); |
267 |
} // decode_host_db_v1() |
268 |
|
269 |
void decode_protos_data(void); |
270 |
void decode_tcp_data(void); |
271 |
void decode_udp_data(void); |
272 |
|
273 |
void decode_host_header_v1(void) |
274 |
{ |
275 |
uint8_t ipv4address[4]; |
276 |
uint8_t macaddress[6]; |
277 |
uint8_t hostnamelen; |
278 |
uint8_t hostname[256]; |
279 |
uint64_t bytesin; |
280 |
uint64_t bytesout; |
281 |
uint8_t protosdata; |
282 |
uint8_t tcpdata; |
283 |
uint8_t udpdata; |
284 |
|
285 |
uint8_t i; |
286 |
|
287 |
indent(); |
288 |
|
289 |
ipv4address[0] = read8u(); |
290 |
ipv4address[1] = read8u(); |
291 |
ipv4address[2] = read8u(); |
292 |
ipv4address[3] = read8u(); |
293 |
|
294 |
print_indentation(); |
295 |
printf("IPv4 address %u.%u.%u.%u\n", |
296 |
ipv4address[0], ipv4address[1], ipv4address[2], ipv4address[3]); |
297 |
|
298 |
macaddress[0] = read8u(); |
299 |
macaddress[1] = read8u(); |
300 |
macaddress[2] = read8u(); |
301 |
macaddress[3] = read8u(); |
302 |
macaddress[4] = read8u(); |
303 |
macaddress[5] = read8u(); |
304 |
|
305 |
print_indentation(); |
306 |
printf("MAC address %02x:%02x:%02x:%02x:%02x:%02x\n", macaddress[0], macaddress[1], macaddress[2], macaddress[3], macaddress[4], macaddress[5]); |
307 |
|
308 |
hostnamelen = read8u(); |
309 |
|
310 |
print_indentation(); |
311 |
printf("Hostname length %u\n", hostnamelen); |
312 |
|
313 |
for (i = 0; i < hostnamelen; i++) { |
314 |
hostname[i] = read8u(); |
315 |
} // for |
316 |
hostname[i] = '\0'; |
317 |
|
318 |
print_indentation(); |
319 |
printf("Hostname %s\n", hostname); |
320 |
|
321 |
bytesin = read64u(); |
322 |
|
323 |
print_indentation(); |
324 |
printf("Bytes in %lu\n", bytesin); |
325 |
|
326 |
bytesout = read64u(); |
327 |
|
328 |
print_indentation(); |
329 |
printf("Bytes out %lu\n", bytesout); |
330 |
|
331 |
if ( (protosdata = read8u()) != 'P') { // missing protos data |
332 |
fprintf(stderr, "%s:%s:%ld: expecting character P, not %c\n", progname, filename, ftell(file), protosdata); |
333 |
exit(EXIT_FAILURE); |
334 |
} // if |
335 |
|
336 |
decode_protos_data(); |
337 |
|
338 |
if ( (tcpdata = read8u()) != 'T') { // missing tcp data |
339 |
fprintf(stderr, "%s:%s:%ld: expecting character T, not %c\n", progname, filename, ftell(file), tcpdata); |
340 |
exit(EXIT_FAILURE); |
341 |
} // if |
342 |
|
343 |
decode_tcp_data(); |
344 |
|
345 |
if ( (udpdata = read8u()) != 'U') { // missing udp data |
346 |
fprintf(stderr, "%s:%s:%ld: expecting character U, not %c\n", progname, filename, ftell(file), udpdata); |
347 |
exit(EXIT_FAILURE); |
348 |
} // if |
349 |
|
350 |
decode_udp_data(); |
351 |
|
352 |
exdent(); |
353 |
} // decode_host_header_v1 |
354 |
|
355 |
void decode_host_header_v2(void) |
356 |
{ |
357 |
uint8_t ipv4address[4]; |
358 |
uint8_t macaddress[6]; |
359 |
int64_t lastseen; |
360 |
uint8_t hostnamelen; |
361 |
uint8_t hostname[256]; |
362 |
uint64_t bytesin; |
363 |
uint64_t bytesout; |
364 |
uint8_t protosdata; |
365 |
uint8_t tcpdata; |
366 |
uint8_t udpdata; |
367 |
|
368 |
uint8_t i; |
369 |
|
370 |
indent(); |
371 |
|
372 |
ipv4address[0] = read8u(); |
373 |
ipv4address[1] = read8u(); |
374 |
ipv4address[2] = read8u(); |
375 |
ipv4address[3] = read8u(); |
376 |
|
377 |
print_indentation(); |
378 |
printf("IPv4 address %u.%u.%u.%u\n", |
379 |
ipv4address[0], ipv4address[1], ipv4address[2], ipv4address[3]); |
380 |
|
381 |
if (follow_specification == true) { |
382 |
macaddress[0] = read8u(); |
383 |
macaddress[1] = read8u(); |
384 |
macaddress[2] = read8u(); |
385 |
macaddress[3] = read8u(); |
386 |
macaddress[4] = read8u(); |
387 |
macaddress[5] = read8u(); |
388 |
|
389 |
print_indentation(); |
390 |
printf("MAC address %02x:%02x:%02x:%02x:%02x:%02x\n", macaddress[0], macaddress[1], macaddress[2], macaddress[3], macaddress[4], macaddress[5]); |
391 |
|
392 |
lastseen = read64s(); |
393 |
|
394 |
print_indentation(); |
395 |
printf("Last seen 0x%lx = %ld = ", lastseen, lastseen); |
396 |
print_time_t(lastseen); |
397 |
puts(""); |
398 |
} // if |
399 |
else { |
400 |
lastseen = read64s(); |
401 |
|
402 |
print_indentation(); |
403 |
printf("Last seen 0x%lx = %ld = ", lastseen, lastseen); |
404 |
print_time_t(lastseen); |
405 |
puts(""); |
406 |
|
407 |
macaddress[0] = read8u(); |
408 |
macaddress[1] = read8u(); |
409 |
macaddress[2] = read8u(); |
410 |
macaddress[3] = read8u(); |
411 |
macaddress[4] = read8u(); |
412 |
macaddress[5] = read8u(); |
413 |
|
414 |
print_indentation(); |
415 |
printf("MAC address %02x:%02x:%02x:%02x:%02x:%02x\n", macaddress[0], macaddress[1], macaddress[2], macaddress[3], macaddress[4], macaddress[5]); |
416 |
} // else |
417 |
|
418 |
hostnamelen = read8u(); |
419 |
|
420 |
print_indentation(); |
421 |
printf("Hostname length %u\n", hostnamelen); |
422 |
|
423 |
for (i = 0; i < hostnamelen; i++) { |
424 |
hostname[i] = read8u(); |
425 |
} // for |
426 |
hostname[i] = '\0'; |
427 |
|
428 |
print_indentation(); |
429 |
printf("Hostname %s\n", hostname); |
430 |
|
431 |
bytesin = read64u(); |
432 |
|
433 |
print_indentation(); |
434 |
printf("Bytes in %lu\n", bytesin); |
435 |
|
436 |
bytesout = read64u(); |
437 |
|
438 |
print_indentation(); |
439 |
printf("Bytes out %lu\n", bytesout); |
440 |
|
441 |
if ( (protosdata = read8u()) != 'P') { // missing protos data |
442 |
fprintf(stderr, "%s:%s:%ld: expecting character P, not %c\n", progname, filename, ftell(file), protosdata); |
443 |
exit(EXIT_FAILURE); |
444 |
} // if |
445 |
|
446 |
decode_protos_data(); |
447 |
|
448 |
if ( (tcpdata = read8u()) != 'T') { // missing tcp data |
449 |
fprintf(stderr, "%s:%s:%ld: expecting character T, not %c\n", progname, filename, ftell(file), tcpdata); |
450 |
exit(EXIT_FAILURE); |
451 |
} // if |
452 |
|
453 |
decode_tcp_data(); |
454 |
|
455 |
if ( (udpdata = read8u()) != 'U') { // missing udp data |
456 |
fprintf(stderr, "%s:%s:%ld: expecting character U, not %c\n", progname, filename, ftell(file), udpdata); |
457 |
exit(EXIT_FAILURE); |
458 |
} // if |
459 |
|
460 |
decode_udp_data(); |
461 |
|
462 |
exdent(); |
463 |
} // decode_host_header_v2 |
464 |
|
465 |
void decode_host_header_v3(void) |
466 |
{ |
467 |
uint8_t addressfamily; |
468 |
uint8_t ipv4address[4]; |
469 |
uint16_t ipv6address[8]; |
470 |
uint8_t macaddress[6]; |
471 |
int64_t lastseen; |
472 |
uint8_t hostnamelen; |
473 |
uint8_t hostname[256]; |
474 |
uint64_t bytesin; |
475 |
uint64_t bytesout; |
476 |
uint8_t protosdata; |
477 |
uint8_t tcpdata; |
478 |
uint8_t udpdata; |
479 |
|
480 |
uint8_t i; |
481 |
|
482 |
indent(); |
483 |
|
484 |
if ( (addressfamily = read8u()) == 0x04) { // IPv4 address |
485 |
print_indentation(); |
486 |
printf("IPv4 address family (0x%02x)\n", addressfamily); |
487 |
|
488 |
ipv4address[0] = read8u(); |
489 |
ipv4address[1] = read8u(); |
490 |
ipv4address[2] = read8u(); |
491 |
ipv4address[3] = read8u(); |
492 |
|
493 |
print_indentation(); |
494 |
printf("IPv4 address %u.%u.%u.%u\n", |
495 |
ipv4address[0], ipv4address[1], ipv4address[2], ipv4address[3]); |
496 |
} // if |
497 |
else if (addressfamily == 0x06) { // IPv6 address |
498 |
print_indentation(); |
499 |
printf("IPv6 address family (0x%02x)\n", addressfamily); |
500 |
|
501 |
ipv6address[0] = read16u(); |
502 |
ipv6address[1] = read16u(); |
503 |
ipv6address[2] = read16u(); |
504 |
ipv6address[3] = read16u(); |
505 |
ipv6address[4] = read16u(); |
506 |
ipv6address[5] = read16u(); |
507 |
ipv6address[6] = read16u(); |
508 |
ipv6address[7] = read16u(); |
509 |
|
510 |
print_indentation(); |
511 |
printf("IPv6 address %04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x\n", |
512 |
ipv6address[0], |
513 |
ipv6address[1], |
514 |
ipv6address[2], |
515 |
ipv6address[3], |
516 |
ipv6address[4], |
517 |
ipv6address[5], |
518 |
ipv6address[6], |
519 |
ipv6address[7]); |
520 |
} // else if |
521 |
else { // unknown address family |
522 |
fprintf(stderr, "%s:%s:%ld: unknown address family = 0x%x, neither 0x%x nor 0x%x\n", progname, filename, ftell(file), addressfamily, 0x04, 0x06); |
523 |
exit(EXIT_FAILURE); |
524 |
} // else |
525 |
|
526 |
if (follow_specification == true) { |
527 |
macaddress[0] = read8u(); |
528 |
macaddress[1] = read8u(); |
529 |
macaddress[2] = read8u(); |
530 |
macaddress[3] = read8u(); |
531 |
macaddress[4] = read8u(); |
532 |
macaddress[5] = read8u(); |
533 |
|
534 |
print_indentation(); |
535 |
printf("MAC address %02x:%02x:%02x:%02x:%02x:%02x\n", macaddress[0], macaddress[1], macaddress[2], macaddress[3], macaddress[4], macaddress[5]); |
536 |
|
537 |
lastseen = read64s(); |
538 |
|
539 |
print_indentation(); |
540 |
printf("Last seen 0x%lx = %ld = ", lastseen, lastseen); |
541 |
print_time_t(lastseen); |
542 |
puts(""); |
543 |
} // if |
544 |
else { |
545 |
lastseen = read64s(); |
546 |
|
547 |
print_indentation(); |
548 |
printf("Last seen 0x%lx = %ld = ", lastseen, lastseen); |
549 |
print_time_t(lastseen); |
550 |
puts(""); |
551 |
|
552 |
macaddress[0] = read8u(); |
553 |
macaddress[1] = read8u(); |
554 |
macaddress[2] = read8u(); |
555 |
macaddress[3] = read8u(); |
556 |
macaddress[4] = read8u(); |
557 |
macaddress[5] = read8u(); |
558 |
|
559 |
print_indentation(); |
560 |
printf("MAC address %02x:%02x:%02x:%02x:%02x:%02x\n", macaddress[0], macaddress[1], macaddress[2], macaddress[3], macaddress[4], macaddress[5]); |
561 |
} // else |
562 |
|
563 |
hostnamelen = read8u(); |
564 |
|
565 |
print_indentation(); |
566 |
printf("Hostname length %u\n", hostnamelen); |
567 |
|
568 |
for (i = 0; i < hostnamelen; i++) { |
569 |
hostname[i] = read8u(); |
570 |
} // for |
571 |
hostname[i] = '\0'; |
572 |
|
573 |
print_indentation(); |
574 |
printf("Hostname %s\n", hostname); |
575 |
|
576 |
bytesin = read64u(); |
577 |
|
578 |
print_indentation(); |
579 |
printf("Bytes in %lu\n", bytesin); |
580 |
|
581 |
bytesout = read64u(); |
582 |
|
583 |
print_indentation(); |
584 |
printf("Bytes out %lu\n", bytesout); |
585 |
|
586 |
if ( (protosdata = read8u()) != 'P') { // missing protos data |
587 |
fprintf(stderr, "%s:%s:%ld: expecting character P, not %c\n", progname, filename, ftell(file), protosdata); |
588 |
exit(EXIT_FAILURE); |
589 |
} // if |
590 |
|
591 |
decode_protos_data(); |
592 |
|
593 |
if ( (tcpdata = read8u()) != 'T') { // missing tcp data |
594 |
fprintf(stderr, "%s:%s:%ld: expecting character T, not %c\n", progname, filename, ftell(file), tcpdata); |
595 |
exit(EXIT_FAILURE); |
596 |
} // if |
597 |
|
598 |
decode_tcp_data(); |
599 |
|
600 |
if ( (udpdata = read8u()) != 'U') { // missing udp data |
601 |
fprintf(stderr, "%s:%s:%ld: expecting character U, not %c\n", progname, filename, ftell(file), udpdata); |
602 |
exit(EXIT_FAILURE); |
603 |
} // if |
604 |
|
605 |
decode_udp_data(); |
606 |
|
607 |
exdent(); |
608 |
} // decode_host_header_v3 |
609 |
|
610 |
void decode_protos_data(void) |
611 |
{ |
612 |
uint8_t ipprotocount; |
613 |
|
614 |
uint8_t i; |
615 |
|
616 |
ipprotocount = read8u(); |
617 |
|
618 |
print_indentation(); |
619 |
printf("IP Proto count %u\n", ipprotocount); |
620 |
|
621 |
indent(); |
622 |
|
623 |
for (i = 0; i < ipprotocount; i++) { |
624 |
uint8_t proto; |
625 |
uint64_t in; |
626 |
uint64_t out; |
627 |
|
628 |
print_indentation(); |
629 |
printf("Protocol #%u of %u:\n", i + 1, ipprotocount); |
630 |
|
631 |
proto = read8u(); |
632 |
|
633 |
indent(); |
634 |
print_indentation(); |
635 |
printf("Protocol 0x%02x\n", proto); |
636 |
|
637 |
in = read64u(); |
638 |
|
639 |
print_indentation(); |
640 |
printf("In %lu\n", in); |
641 |
|
642 |
out = read64u(); |
643 |
|
644 |
print_indentation(); |
645 |
printf("Out %lu\n", out); |
646 |
|
647 |
exdent(); |
648 |
} // for |
649 |
|
650 |
exdent(); |
651 |
} // decode_protos_data(); |
652 |
|
653 |
void decode_tcp_data(void) |
654 |
{ |
655 |
uint8_t tcpprotocount; |
656 |
|
657 |
uint16_t i; |
658 |
|
659 |
tcpprotocount = read16u(); |
660 |
|
661 |
print_indentation(); |
662 |
printf("TCP proto count %u\n", tcpprotocount); |
663 |
|
664 |
indent(); |
665 |
|
666 |
for (i = 0; i < tcpprotocount; i++) { |
667 |
uint16_t port; |
668 |
uint64_t syn; |
669 |
uint64_t in; |
670 |
uint64_t out; |
671 |
|
672 |
port = read16u(); |
673 |
|
674 |
print_indentation(); |
675 |
printf("Port %u:\n", port); |
676 |
|
677 |
syn = read64u(); |
678 |
|
679 |
indent(); |
680 |
print_indentation(); |
681 |
printf("SYN %lu\n", syn); |
682 |
|
683 |
in = read64u(); |
684 |
|
685 |
print_indentation(); |
686 |
printf("In %lu\n", in); |
687 |
|
688 |
out = read64u(); |
689 |
|
690 |
print_indentation(); |
691 |
printf("Out %lu\n", out); |
692 |
|
693 |
exdent(); |
694 |
} // for |
695 |
|
696 |
exdent(); |
697 |
} // decode_tcp_data() |
698 |
|
699 |
void decode_udp_data(void) |
700 |
{ |
701 |
uint8_t udpprotocount; |
702 |
|
703 |
uint16_t i; |
704 |
|
705 |
udpprotocount = read16u(); |
706 |
|
707 |
print_indentation(); |
708 |
printf("UDP proto count %u\n", udpprotocount); |
709 |
|
710 |
indent(); |
711 |
|
712 |
for (i = 0; i < udpprotocount; i++) { |
713 |
uint16_t port; |
714 |
uint64_t in; |
715 |
uint64_t out; |
716 |
|
717 |
port = read16u(); |
718 |
|
719 |
print_indentation(); |
720 |
printf("Port %u:\n", port); |
721 |
|
722 |
in = read64u(); |
723 |
|
724 |
indent(); |
725 |
print_indentation(); |
726 |
printf("In %lu\n", in); |
727 |
|
728 |
out = read64u(); |
729 |
|
730 |
print_indentation(); |
731 |
printf("Out %lu\n", out); |
732 |
|
733 |
exdent(); |
734 |
} // for |
735 |
|
736 |
exdent(); |
737 |
} // decode_udp_data() |
738 |
|
739 |
void decode_graph_db_v1(void) |
740 |
{ |
741 |
int64_t lasttime; |
742 |
|
743 |
uint32_t i; |
744 |
|
745 |
lasttime = read64s(); |
746 |
|
747 |
indent(); |
748 |
print_indentation(); |
749 |
printf("Last time 0x%lx = %ld = ", lasttime, lasttime); |
750 |
print_time_t(lasttime); |
751 |
puts(""); |
752 |
|
753 |
for (i = 0; i < 4; i++) { |
754 |
uint8_t nbars; |
755 |
uint8_t idxlastbar; |
756 |
|
757 |
uint32_t j; |
758 |
|
759 |
print_indentation(); |
760 |
printf("Graph #%u of 4:\n", i + 1); |
761 |
|
762 |
nbars = read8u(); |
763 |
|
764 |
indent(); |
765 |
print_indentation(); |
766 |
printf("Number of bars %u\n", nbars); |
767 |
|
768 |
idxlastbar = read8u(); |
769 |
|
770 |
print_indentation(); |
771 |
printf("Index of last bar %u\n", idxlastbar); |
772 |
|
773 |
indent(); |
774 |
for (j = 0; j < idxlastbar; j++) { |
775 |
uint64_t in; |
776 |
uint64_t out; |
777 |
|
778 |
print_indentation(); |
779 |
printf("Bar #%u of %u:\n", j + 1, idxlastbar); |
780 |
|
781 |
in = read64u(); |
782 |
|
783 |
indent(); |
784 |
print_indentation(); |
785 |
printf("In %lu\n", in); |
786 |
|
787 |
out = read64u(); |
788 |
|
789 |
print_indentation(); |
790 |
printf("Out %lu\n", out); |
791 |
|
792 |
exdent(); |
793 |
} // for |
794 |
exdent(); |
795 |
|
796 |
exdent(); |
797 |
} // for |
798 |
|
799 |
exdent(); |
800 |
} // decode_graph_db_v1() |
801 |
|
802 |
void handle_file_error(void); |
803 |
|
804 |
uint8_t read8u(void) |
805 |
{ |
806 |
size_t r; |
807 |
uint8_t v; |
808 |
|
809 |
if ( (r = fread((void *)&v, sizeof(v), 1, file)) != 1) { |
810 |
handle_file_error(); |
811 |
} // if |
812 |
|
813 |
return v; |
814 |
} // read8u() |
815 |
|
816 |
int8_t read8s(void) |
817 |
{ |
818 |
size_t r; |
819 |
int8_t v; |
820 |
|
821 |
if ( (r = fread((void *)&v, sizeof(v), 1, file)) != 1) { |
822 |
handle_file_error(); |
823 |
} // if |
824 |
|
825 |
return v; |
826 |
} // read8s() |
827 |
|
828 |
#ifdef __LITTLE_ENDIAN__ |
829 |
#include <netinet/in.h> |
830 |
#endif |
831 |
|
832 |
uint16_t read16u(void) |
833 |
{ |
834 |
size_t r; |
835 |
uint16_t v; |
836 |
|
837 |
if ( (r = fread((void *)&v, sizeof(v), 1, file)) != 1) { |
838 |
handle_file_error(); |
839 |
} // if |
840 |
|
841 |
#ifdef __LITTLE_ENDIAN__ |
842 |
v = ntohs(v); |
843 |
#endif |
844 |
|
845 |
return v; |
846 |
} // read16u() |
847 |
|
848 |
int16_t read16s(void) |
849 |
{ |
850 |
size_t r; |
851 |
int16_t v; |
852 |
|
853 |
if ( (r = fread((void *)&v, sizeof(v), 1, file)) != 1) { |
854 |
handle_file_error(); |
855 |
} // if |
856 |
|
857 |
#ifdef __LITTLE_ENDIAN__ |
858 |
v = ntohs(v); |
859 |
#endif |
860 |
|
861 |
return v; |
862 |
} // read16s() |
863 |
|
864 |
uint32_t read32u(void) |
865 |
{ |
866 |
size_t r; |
867 |
uint32_t v; |
868 |
|
869 |
if ( (r = fread((void *)&v, sizeof(v), 1, file)) != 1) { |
870 |
handle_file_error(); |
871 |
} // if |
872 |
|
873 |
#ifdef __LITTLE_ENDIAN__ |
874 |
v = ntohl(v); |
875 |
#endif |
876 |
|
877 |
return v; |
878 |
} // read32u() |
879 |
|
880 |
int32_t read32s(void) |
881 |
{ |
882 |
size_t r; |
883 |
int32_t v; |
884 |
|
885 |
if ( (r = fread((void *)&v, sizeof(v), 1, file)) != 1) { |
886 |
handle_file_error(); |
887 |
} // if |
888 |
|
889 |
#ifdef __LITTLE_ENDIAN__ |
890 |
v = ntohl(v); |
891 |
#endif |
892 |
|
893 |
return v; |
894 |
} // read32s() |
895 |
|
896 |
uint64_t read64u(void) |
897 |
{ |
898 |
size_t r; |
899 |
uint64_t v; |
900 |
|
901 |
#ifdef __LITTLE_ENDIAN__ |
902 |
uint64_t tmp; |
903 |
uint32_t *p1 = (uint32_t *)&v; |
904 |
uint32_t *p2 = (uint32_t *)&tmp; |
905 |
#endif |
906 |
|
907 |
if ( (r = fread((void *)&v, sizeof(v), 1, file)) != 1) { |
908 |
handle_file_error(); |
909 |
} // if |
910 |
|
911 |
#ifdef __LITTLE_ENDIAN__ |
912 |
p2[1] = ntohl(p1[0]); |
913 |
p2[0] = ntohl(p1[1]); |
914 |
v = tmp; |
915 |
#endif |
916 |
|
917 |
return v; |
918 |
} // read64u() |
919 |
|
920 |
int64_t read64s(void) |
921 |
{ |
922 |
size_t r; |
923 |
int64_t v; |
924 |
|
925 |
#ifdef __LITTLE_ENDIAN__ |
926 |
int64_t tmp; |
927 |
int32_t *p1 = (int32_t *)&v; |
928 |
int32_t *p2 = (int32_t *)&tmp; |
929 |
#endif |
930 |
|
931 |
if ( (r = fread((void *)&v, sizeof(v), 1, file)) != 1) { |
932 |
handle_file_error(); |
933 |
} // if |
934 |
|
935 |
#ifdef __LITTLE_ENDIAN__ |
936 |
p2[1] = ntohl(p1[0]); |
937 |
p2[0] = ntohl(p1[1]); |
938 |
v = tmp; |
939 |
#endif |
940 |
|
941 |
return v; |
942 |
} // read64s() |
943 |
|
944 |
void handle_file_error(void) |
945 |
{ |
946 |
int saved_errno = errno; |
947 |
|
948 |
if (feof(file) != 0) { |
949 |
fprintf(stderr, "%s:%s:%ld: premature end-of-file\n", progname, filename, ftell(file)); |
950 |
exit(EXIT_FAILURE); |
951 |
} // if |
952 |
|
953 |
if (ferror(file) != 0) { |
954 |
fprintf(stderr, "%s:%s:%ld: file error, errno = %s (%d)\n", progname, filename, ftell(file), strerror(saved_errno), saved_errno); |
955 |
exit(EXIT_FAILURE); |
956 |
} // if |
957 |
} // handle_file_error() |
958 |
|
959 |
int64_t indentation = 0LL; |
960 |
|
961 |
void indent(void) |
962 |
{ |
963 |
if (indentation < (INT64_MAX - 2LL)) { |
964 |
indentation += 2LL; |
965 |
} // if |
966 |
} // indent() |
967 |
|
968 |
void exdent(void) |
969 |
{ |
970 |
indentation -= 2LL; |
971 |
|
972 |
if (indentation < 0LL) { |
973 |
indentation = 0LL; |
974 |
}// if |
975 |
} // exdent() |
976 |
|
977 |
void print_indentation(void) |
978 |
{ |
979 |
int64_t i; |
980 |
|
981 |
for (i = 0; i < indentation; i++) { |
982 |
putchar(' '); |
983 |
} // for |
984 |
} // print_indentation() |
985 |
|
986 |
void print_time_t(time_t t) |
987 |
{ |
988 |
struct tm *stm; |
989 |
char buffer[1024]; |
990 |
|
991 |
stm = gmtime(&t); |
992 |
|
993 |
// ISO 8601 format |
994 |
if (strftime(buffer, sizeof(buffer), "%Y-%m-%dT%H:%M:%S%z", stm) == 0) { |
995 |
int saved_errno = errno; |
996 |
|
997 |
fprintf(stderr, "%s:%s:%ld: strftime() error, errno = %s (%d)\n", progname, filename, ftell(file), strerror(saved_errno), saved_errno); |
998 |
exit(EXIT_FAILURE); |
999 |
} // if |
1000 |
|
1001 |
fputs(buffer, stdout); |
1002 |
} // print_time_t() |
1003 |
|
1004 |
// darkstattype.c |