1 |
/* -*- coding: utf-8 -*- |
2 |
darkstattype.c - Program to decode darkstat's dumpfile. |
3 |
|
4 |
$Ximalas$ |
5 |
|
6 |
Tested on FreeBSD/amd64 stable/9 r263290 with clang 3.3. |
7 |
|
8 |
Copyright © 2014, Trond Endrestøl <Trond.Endrestol@ximalas.info> |
9 |
All rights reserved. |
10 |
|
11 |
Redistribution and use in source and binary forms, with or without |
12 |
modification, are permitted provided that the following conditions are met: |
13 |
|
14 |
1. Redistributions of source code must retain the above copyright notice, this |
15 |
list of conditions and the following disclaimer. |
16 |
2. Redistributions in binary form must reproduce the above copyright notice, |
17 |
this list of conditions and the following disclaimer in the documentation |
18 |
and/or other materials provided with the distribution. |
19 |
|
20 |
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND |
21 |
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED |
22 |
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE |
23 |
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR |
24 |
ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES |
25 |
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; |
26 |
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND |
27 |
ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
28 |
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS |
29 |
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
30 |
*/ |
31 |
|
32 |
#include <errno.h> |
33 |
#include <stdbool.h> |
34 |
#include <stdint.h> |
35 |
#include <stdio.h> |
36 |
#include <stdlib.h> |
37 |
#include <string.h> |
38 |
#include <time.h> |
39 |
#include <unistd.h> |
40 |
|
41 |
const char *progname = NULL; |
42 |
const char *filename = NULL; |
43 |
FILE *file = NULL; |
44 |
bool follow_specification = false; |
45 |
|
46 |
int main(int argc, char **argv) |
47 |
{ |
48 |
void show_usage(int exitcode); |
49 |
void show_version(void); |
50 |
void decode_file(void); |
51 |
|
52 |
int i; |
53 |
|
54 |
progname = argv[0]; |
55 |
|
56 |
opterr = 0; |
57 |
while ( (i = getopt(argc, argv, "fhv")) != -1) { |
58 |
switch (i) { |
59 |
case 'f': |
60 |
follow_specification = !follow_specification; |
61 |
break; |
62 |
|
63 |
case 'h': |
64 |
show_usage(EXIT_SUCCESS); |
65 |
break; |
66 |
|
67 |
case 'v': |
68 |
show_version(); |
69 |
break; |
70 |
|
71 |
case '?': |
72 |
/*FALLTHROUGH*/ |
73 |
default: |
74 |
fprintf(stderr, "%s: illegal option -%c\n\n", |
75 |
progname, optopt); |
76 |
show_usage(EXIT_FAILURE); |
77 |
break; |
78 |
} // switch |
79 |
} // while |
80 |
argc -= optind; |
81 |
argv += optind; |
82 |
|
83 |
if (*argv == NULL) { |
84 |
fprintf(stderr, "%s: missing filename\n\n", |
85 |
progname); |
86 |
show_usage(EXIT_FAILURE); |
87 |
} // if |
88 |
|
89 |
while (*argv != NULL) { |
90 |
filename = *argv; |
91 |
|
92 |
decode_file(); |
93 |
|
94 |
argv++; |
95 |
} // while |
96 |
|
97 |
return EXIT_SUCCESS; |
98 |
} // main() |
99 |
|
100 |
void show_usage(int exitcode) |
101 |
{ |
102 |
fprintf((exitcode == EXIT_SUCCESS) ? stdout : stderr, |
103 |
"Usage: %s [-f | -h | -v] filename [...]\n" |
104 |
" E.g.: %s darkstat.db\n\n" |
105 |
|
106 |
"Options:\n" |
107 |
"-f\tToggle follow strict specification, default is false.\n" |
108 |
"-h\tShow this help message and exit.\n" |
109 |
"-v\tShow version and copyright and exit.\n", |
110 |
progname, progname); |
111 |
|
112 |
exit(exitcode); |
113 |
} // show_usage() |
114 |
|
115 |
void show_version(void) |
116 |
{ |
117 |
puts("darkstattype 1.0"); |
118 |
puts("$Ximalas$"); |
119 |
puts(""); |
120 |
|
121 |
puts("Copyright © 2014, Trond Endrestøl <Trond.Endrestol@ximalas.info>"); |
122 |
puts("All rights reserved."); |
123 |
puts(""); |
124 |
puts("Redistribution and use in source and binary forms, with or without"); |
125 |
puts("modification, are permitted provided that the following conditions are met:"); |
126 |
puts(""); |
127 |
puts("1. Redistributions of source code must retain the above copyright notice, this"); |
128 |
puts(" list of conditions and the following disclaimer."); |
129 |
puts("2. Redistributions in binary form must reproduce the above copyright notice,"); |
130 |
puts(" this list of conditions and the following disclaimer in the documentation"); |
131 |
puts(" and/or other materials provided with the distribution."); |
132 |
puts(""); |
133 |
puts("THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND"); |
134 |
puts("ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED"); |
135 |
puts("WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE"); |
136 |
puts("DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR"); |
137 |
puts("ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES"); |
138 |
puts("(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;"); |
139 |
puts("LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND"); |
140 |
puts("ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT"); |
141 |
puts("(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS"); |
142 |
puts("SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."); |
143 |
|
144 |
exit(EXIT_SUCCESS); |
145 |
} // show_version() |
146 |
|
147 |
uint8_t read8u(void); |
148 |
int8_t read8s(void); |
149 |
uint16_t read16u(void); |
150 |
int16_t read16s(void); |
151 |
uint32_t read32u(void); |
152 |
int32_t read32s(void); |
153 |
uint64_t read64u(void); |
154 |
int64_t read64s(void); |
155 |
|
156 |
void indent(void); |
157 |
void exdent(void); |
158 |
void print_indentation(void); |
159 |
|
160 |
void print_time_t(time_t t); |
161 |
|
162 |
void decode_file(void) |
163 |
{ |
164 |
void decode_host_db_v1(void); |
165 |
void decode_graph_db_v1(void); |
166 |
|
167 |
uint32_t fileheader; |
168 |
uint32_t sectionheader; |
169 |
|
170 |
uint32_t i; |
171 |
|
172 |
if ( (file = fopen(filename, "rb")) == NULL) { |
173 |
fprintf(stderr, "%s: fopen(\"%s\") = %s (%d)\n", |
174 |
progname, filename, strerror(errno), errno); |
175 |
exit(EXIT_FAILURE); |
176 |
} // if |
177 |
|
178 |
#define FILE_HEADER_V1 0xDA314159U |
179 |
|
180 |
if ( (fileheader = read32u()) != FILE_HEADER_V1) { // not darkstat export format |
181 |
fprintf(stderr, "%s:%s:%ld: file header = 0x%x, not 0x%x\n", |
182 |
progname, filename, ftell(file), fileheader, FILE_HEADER_V1); |
183 |
exit(EXIT_FAILURE); |
184 |
} // if |
185 |
|
186 |
printf("File header 0x%x\n", fileheader); |
187 |
|
188 |
// Possible section header for host_db v1 and later graph_db v1. |
189 |
indent(); |
190 |
|
191 |
#define HOST_DB_V1 0xDA485301U |
192 |
#define GRAPH_DB_V1 0xDA475201U |
193 |
|
194 |
for (i = 0; i < 2; i++) { |
195 |
if ( (sectionheader = read32u()) == HOST_DB_V1) { |
196 |
print_indentation(); |
197 |
printf("Section header host_db v1 0x%x\n", sectionheader); |
198 |
decode_host_db_v1(); |
199 |
} // if |
200 |
else if (sectionheader == GRAPH_DB_V1) { |
201 |
print_indentation(); |
202 |
printf("Section header graph_db v1 0x%x\n", sectionheader); |
203 |
decode_graph_db_v1(); |
204 |
} // else if |
205 |
else { |
206 |
fprintf(stderr, |
207 |
"%s:%s:%ld: unknown section header = 0x%x, neither 0x%x nor 0x%x\n", |
208 |
progname, filename, ftell(file), sectionheader, HOST_DB_V1, |
209 |
GRAPH_DB_V1); |
210 |
exit(EXIT_FAILURE); |
211 |
} // else |
212 |
} // for |
213 |
|
214 |
exdent(); |
215 |
|
216 |
if (fclose(file) != 0) { |
217 |
fprintf(stderr, "%s: fclose(\"%s\") = %s (%d)\n", |
218 |
progname, filename, strerror(errno), errno); |
219 |
exit(EXIT_FAILURE); |
220 |
} // if |
221 |
} // decode_file() |
222 |
|
223 |
void decode_host_db_v1(void) |
224 |
{ |
225 |
void decode_host_header_v1(void); |
226 |
void decode_host_header_v2(void); |
227 |
void decode_host_header_v3(void); |
228 |
|
229 |
uint32_t hostcount; |
230 |
uint32_t i; |
231 |
|
232 |
indent(); |
233 |
|
234 |
hostcount = read32u(); |
235 |
|
236 |
print_indentation(); |
237 |
printf("Host count %u\n", |
238 |
hostcount); |
239 |
|
240 |
for (i = 0; i < hostcount; i++) { |
241 |
uint32_t hostheader; |
242 |
|
243 |
print_indentation(); |
244 |
printf("Host #%u of %u:\n", |
245 |
i + 1, hostcount); |
246 |
|
247 |
indent(); |
248 |
|
249 |
#define HOST_HEADER_V3 0x48535403U |
250 |
#define HOST_HEADER_V2 0x48535402U |
251 |
#define HOST_HEADER_V1 0x48535401U |
252 |
|
253 |
if ( (hostheader = read32u()) == HOST_HEADER_V3) { // host header v3 |
254 |
print_indentation(); |
255 |
printf("Host header v3 0x%x\n", |
256 |
hostheader); |
257 |
decode_host_header_v3(); |
258 |
} // if |
259 |
else if (hostheader == HOST_HEADER_V2) { // host header v2 |
260 |
print_indentation(); |
261 |
printf("Host header v2 0x%x\n", |
262 |
hostheader); |
263 |
decode_host_header_v2(); |
264 |
} // else if |
265 |
else if (hostheader == HOST_HEADER_V1) { // host header v1 |
266 |
print_indentation(); |
267 |
printf("Host header v1 0x%x\n", |
268 |
hostheader); |
269 |
decode_host_header_v1(); |
270 |
} // else if |
271 |
else { // unknown host header version |
272 |
fprintf(stderr, |
273 |
"%s:%s:%ld: unknown host header = 0x%x, neither 0x%x nor 0x%x nor 0x%x\n", |
274 |
progname, filename, ftell(file), hostheader, HOST_HEADER_V3, |
275 |
HOST_HEADER_V2, HOST_HEADER_V1); |
276 |
exit(EXIT_FAILURE); |
277 |
} // else |
278 |
|
279 |
exdent(); |
280 |
} // for |
281 |
|
282 |
exdent(); |
283 |
} // decode_host_db_v1() |
284 |
|
285 |
void decode_protos_data(void); |
286 |
void decode_tcp_data(void); |
287 |
void decode_udp_data(void); |
288 |
|
289 |
void decode_host_header_v1(void) |
290 |
{ |
291 |
uint8_t ipv4address[4]; |
292 |
uint8_t macaddress[6]; |
293 |
uint8_t hostnamelen; |
294 |
uint8_t hostname[256]; |
295 |
uint64_t bytesin; |
296 |
uint64_t bytesout; |
297 |
uint8_t protosdata; |
298 |
uint8_t tcpdata; |
299 |
uint8_t udpdata; |
300 |
|
301 |
uint8_t i; |
302 |
|
303 |
indent(); |
304 |
|
305 |
ipv4address[0] = read8u(); |
306 |
ipv4address[1] = read8u(); |
307 |
ipv4address[2] = read8u(); |
308 |
ipv4address[3] = read8u(); |
309 |
|
310 |
print_indentation(); |
311 |
printf("IPv4 address %hhu.%hhu.%hhu.%hhu\n", |
312 |
ipv4address[0], ipv4address[1], ipv4address[2], ipv4address[3]); |
313 |
|
314 |
macaddress[0] = read8u(); |
315 |
macaddress[1] = read8u(); |
316 |
macaddress[2] = read8u(); |
317 |
macaddress[3] = read8u(); |
318 |
macaddress[4] = read8u(); |
319 |
macaddress[5] = read8u(); |
320 |
|
321 |
print_indentation(); |
322 |
printf("MAC address %02hhx:%02hhx:%02hhx:%02hhx:%02hhx:%02hhx\n", |
323 |
macaddress[0], macaddress[1], macaddress[2], |
324 |
macaddress[3], macaddress[4], macaddress[5]); |
325 |
|
326 |
hostnamelen = read8u(); |
327 |
|
328 |
print_indentation(); |
329 |
printf("Hostname length %u\n", |
330 |
hostnamelen); |
331 |
|
332 |
for (i = 0; i < hostnamelen; i++) { |
333 |
hostname[i] = read8u(); |
334 |
} // for |
335 |
hostname[i] = '\0'; |
336 |
|
337 |
print_indentation(); |
338 |
printf("Hostname %s\n", |
339 |
hostname); |
340 |
|
341 |
bytesin = read64u(); |
342 |
|
343 |
print_indentation(); |
344 |
printf("Bytes in %lu\n", |
345 |
bytesin); |
346 |
|
347 |
bytesout = read64u(); |
348 |
|
349 |
print_indentation(); |
350 |
printf("Bytes out %lu\n", |
351 |
bytesout); |
352 |
|
353 |
if ( (protosdata = read8u()) != 'P') { // missing protos data |
354 |
fprintf(stderr, |
355 |
"%s:%s:%ld: expecting character P, not %c\n", |
356 |
progname, filename, ftell(file), protosdata); |
357 |
exit(EXIT_FAILURE); |
358 |
} // if |
359 |
|
360 |
decode_protos_data(); |
361 |
|
362 |
if ( (tcpdata = read8u()) != 'T') { // missing tcp data |
363 |
fprintf(stderr, |
364 |
"%s:%s:%ld: expecting character T, not %c\n", |
365 |
progname, filename, ftell(file), tcpdata); |
366 |
exit(EXIT_FAILURE); |
367 |
} // if |
368 |
|
369 |
decode_tcp_data(); |
370 |
|
371 |
if ( (udpdata = read8u()) != 'U') { // missing udp data |
372 |
fprintf(stderr, |
373 |
"%s:%s:%ld: expecting character U, not %c\n", |
374 |
progname, filename, ftell(file), udpdata); |
375 |
exit(EXIT_FAILURE); |
376 |
} // if |
377 |
|
378 |
decode_udp_data(); |
379 |
|
380 |
exdent(); |
381 |
} // decode_host_header_v1 |
382 |
|
383 |
void decode_host_header_v2(void) |
384 |
{ |
385 |
uint8_t ipv4address[4]; |
386 |
uint8_t macaddress[6]; |
387 |
int64_t lastseen; |
388 |
uint8_t hostnamelen; |
389 |
uint8_t hostname[256]; |
390 |
uint64_t bytesin; |
391 |
uint64_t bytesout; |
392 |
uint8_t protosdata; |
393 |
uint8_t tcpdata; |
394 |
uint8_t udpdata; |
395 |
|
396 |
uint8_t i; |
397 |
|
398 |
indent(); |
399 |
|
400 |
ipv4address[0] = read8u(); |
401 |
ipv4address[1] = read8u(); |
402 |
ipv4address[2] = read8u(); |
403 |
ipv4address[3] = read8u(); |
404 |
|
405 |
print_indentation(); |
406 |
printf("IPv4 address %hhu.%hhu.%hhu.%hhu\n", |
407 |
ipv4address[0], ipv4address[1], ipv4address[2], ipv4address[3]); |
408 |
|
409 |
if (follow_specification == true) { |
410 |
macaddress[0] = read8u(); |
411 |
macaddress[1] = read8u(); |
412 |
macaddress[2] = read8u(); |
413 |
macaddress[3] = read8u(); |
414 |
macaddress[4] = read8u(); |
415 |
macaddress[5] = read8u(); |
416 |
|
417 |
print_indentation(); |
418 |
printf("MAC address %02hhx:%02hhx:%02hhx:%02hhx:%02hhx:%02hhx\n", |
419 |
macaddress[0], macaddress[1], macaddress[2], |
420 |
macaddress[3], macaddress[4], macaddress[5]); |
421 |
|
422 |
lastseen = read64s(); |
423 |
|
424 |
print_indentation(); |
425 |
printf("Last seen 0x%lx = %ld = ", |
426 |
lastseen, lastseen); |
427 |
print_time_t(lastseen); |
428 |
puts(""); |
429 |
} // if |
430 |
else { |
431 |
lastseen = read64s(); |
432 |
|
433 |
print_indentation(); |
434 |
printf("Last seen 0x%lx = %ld = ", |
435 |
lastseen, lastseen); |
436 |
print_time_t(lastseen); |
437 |
puts(""); |
438 |
|
439 |
macaddress[0] = read8u(); |
440 |
macaddress[1] = read8u(); |
441 |
macaddress[2] = read8u(); |
442 |
macaddress[3] = read8u(); |
443 |
macaddress[4] = read8u(); |
444 |
macaddress[5] = read8u(); |
445 |
|
446 |
print_indentation(); |
447 |
printf("MAC address %02hhx:%02hhx:%02hhx:%02hhx:%02hhx:%02hhx\n", |
448 |
macaddress[0], macaddress[1], macaddress[2], |
449 |
macaddress[3], macaddress[4], macaddress[5]); |
450 |
} // else |
451 |
|
452 |
hostnamelen = read8u(); |
453 |
|
454 |
print_indentation(); |
455 |
printf("Hostname length %hhu\n", |
456 |
hostnamelen); |
457 |
|
458 |
for (i = 0; i < hostnamelen; i++) { |
459 |
hostname[i] = read8u(); |
460 |
} // for |
461 |
hostname[i] = '\0'; |
462 |
|
463 |
print_indentation(); |
464 |
printf("Hostname %s\n", |
465 |
hostname); |
466 |
|
467 |
bytesin = read64u(); |
468 |
|
469 |
print_indentation(); |
470 |
printf("Bytes in %lu\n", |
471 |
bytesin); |
472 |
|
473 |
bytesout = read64u(); |
474 |
|
475 |
print_indentation(); |
476 |
printf("Bytes out %lu\n", |
477 |
bytesout); |
478 |
|
479 |
if ( (protosdata = read8u()) != 'P') { // missing protos data |
480 |
fprintf(stderr, |
481 |
"%s:%s:%ld: expecting character P, not %c\n", |
482 |
progname, filename, ftell(file), protosdata); |
483 |
exit(EXIT_FAILURE); |
484 |
} // if |
485 |
|
486 |
decode_protos_data(); |
487 |
|
488 |
if ( (tcpdata = read8u()) != 'T') { // missing tcp data |
489 |
fprintf(stderr, |
490 |
"%s:%s:%ld: expecting character T, not %c\n", |
491 |
progname, filename, ftell(file), tcpdata); |
492 |
exit(EXIT_FAILURE); |
493 |
} // if |
494 |
|
495 |
decode_tcp_data(); |
496 |
|
497 |
if ( (udpdata = read8u()) != 'U') { // missing udp data |
498 |
fprintf(stderr, |
499 |
"%s:%s:%ld: expecting character U, not %c\n", |
500 |
progname, filename, ftell(file), udpdata); |
501 |
exit(EXIT_FAILURE); |
502 |
} // if |
503 |
|
504 |
decode_udp_data(); |
505 |
|
506 |
exdent(); |
507 |
} // decode_host_header_v2 |
508 |
|
509 |
void decode_host_header_v3(void) |
510 |
{ |
511 |
uint8_t addressfamily; |
512 |
uint8_t ipv4address[4]; |
513 |
uint16_t ipv6address[8]; |
514 |
uint8_t macaddress[6]; |
515 |
int64_t lastseen; |
516 |
uint8_t hostnamelen; |
517 |
uint8_t hostname[256]; |
518 |
uint64_t bytesin; |
519 |
uint64_t bytesout; |
520 |
uint8_t protosdata; |
521 |
uint8_t tcpdata; |
522 |
uint8_t udpdata; |
523 |
|
524 |
uint8_t i; |
525 |
|
526 |
indent(); |
527 |
|
528 |
#define A_F_4 0x04 |
529 |
#define A_F_6 0x06 |
530 |
|
531 |
if ( (addressfamily = read8u()) == A_F_4) { // IPv4 address |
532 |
print_indentation(); |
533 |
printf("IPv4 address family (0x%02hhx)\n", |
534 |
addressfamily); |
535 |
|
536 |
ipv4address[0] = read8u(); |
537 |
ipv4address[1] = read8u(); |
538 |
ipv4address[2] = read8u(); |
539 |
ipv4address[3] = read8u(); |
540 |
|
541 |
print_indentation(); |
542 |
printf("IPv4 address %hhu.%hhu.%hhu.%hhu\n", |
543 |
ipv4address[0], ipv4address[1], ipv4address[2], ipv4address[3]); |
544 |
} // if |
545 |
else if (addressfamily == A_F_6) { // IPv6 address |
546 |
print_indentation(); |
547 |
printf("IPv6 address family (0x%02hhx)\n", |
548 |
addressfamily); |
549 |
|
550 |
ipv6address[0] = read16u(); |
551 |
ipv6address[1] = read16u(); |
552 |
ipv6address[2] = read16u(); |
553 |
ipv6address[3] = read16u(); |
554 |
ipv6address[4] = read16u(); |
555 |
ipv6address[5] = read16u(); |
556 |
ipv6address[6] = read16u(); |
557 |
ipv6address[7] = read16u(); |
558 |
|
559 |
print_indentation(); |
560 |
printf("IPv6 address %04hx:%04hx:%04hx:%04hx:%04hx:%04hx:%04hx:%04hx\n", |
561 |
ipv6address[0], ipv6address[1], ipv6address[2], ipv6address[3], |
562 |
ipv6address[4], ipv6address[5], ipv6address[6], ipv6address[7]); |
563 |
} // else if |
564 |
else { // unknown address family |
565 |
fprintf(stderr, |
566 |
"%s:%s:%ld: unknown address family = 0x%hhx, neither 0x%x nor 0x%x\n", |
567 |
progname, filename, ftell(file), addressfamily, A_F_4, A_F_6); |
568 |
exit(EXIT_FAILURE); |
569 |
} // else |
570 |
|
571 |
if (follow_specification == true) { |
572 |
macaddress[0] = read8u(); |
573 |
macaddress[1] = read8u(); |
574 |
macaddress[2] = read8u(); |
575 |
macaddress[3] = read8u(); |
576 |
macaddress[4] = read8u(); |
577 |
macaddress[5] = read8u(); |
578 |
|
579 |
print_indentation(); |
580 |
printf("MAC address %02hhx:%02hhx:%02hhx:%02hhx:%02hhx:%02hhx\n", |
581 |
macaddress[0], macaddress[1], macaddress[2], |
582 |
macaddress[3], macaddress[4], macaddress[5]); |
583 |
|
584 |
lastseen = read64s(); |
585 |
|
586 |
print_indentation(); |
587 |
printf("Last seen 0x%lx = %ld = ", |
588 |
lastseen, lastseen); |
589 |
print_time_t(lastseen); |
590 |
puts(""); |
591 |
} // if |
592 |
else { |
593 |
lastseen = read64s(); |
594 |
|
595 |
print_indentation(); |
596 |
printf("Last seen 0x%lx = %ld = ", |
597 |
lastseen, lastseen); |
598 |
print_time_t(lastseen); |
599 |
puts(""); |
600 |
|
601 |
macaddress[0] = read8u(); |
602 |
macaddress[1] = read8u(); |
603 |
macaddress[2] = read8u(); |
604 |
macaddress[3] = read8u(); |
605 |
macaddress[4] = read8u(); |
606 |
macaddress[5] = read8u(); |
607 |
|
608 |
print_indentation(); |
609 |
printf("MAC address %02hhx:%02hhx:%02hhx:%02hhx:%02hhx:%02hhx\n", |
610 |
macaddress[0], macaddress[1], macaddress[2], |
611 |
macaddress[3], macaddress[4], macaddress[5]); |
612 |
} // else |
613 |
|
614 |
hostnamelen = read8u(); |
615 |
|
616 |
print_indentation(); |
617 |
printf("Hostname length %hhu\n", |
618 |
hostnamelen); |
619 |
|
620 |
for (i = 0; i < hostnamelen; i++) { |
621 |
hostname[i] = read8u(); |
622 |
} // for |
623 |
hostname[i] = '\0'; |
624 |
|
625 |
print_indentation(); |
626 |
printf("Hostname %s\n", |
627 |
hostname); |
628 |
|
629 |
bytesin = read64u(); |
630 |
|
631 |
print_indentation(); |
632 |
printf("Bytes in %lu\n", |
633 |
bytesin); |
634 |
|
635 |
bytesout = read64u(); |
636 |
|
637 |
print_indentation(); |
638 |
printf("Bytes out %lu\n", |
639 |
bytesout); |
640 |
|
641 |
if ( (protosdata = read8u()) != 'P') { // missing protos data |
642 |
fprintf(stderr, |
643 |
"%s:%s:%ld: expecting character P, not %c\n", |
644 |
progname, filename, ftell(file), protosdata); |
645 |
exit(EXIT_FAILURE); |
646 |
} // if |
647 |
|
648 |
decode_protos_data(); |
649 |
|
650 |
if ( (tcpdata = read8u()) != 'T') { // missing tcp data |
651 |
fprintf(stderr, |
652 |
"%s:%s:%ld: expecting character T, not %c\n", |
653 |
progname, filename, ftell(file), tcpdata); |
654 |
exit(EXIT_FAILURE); |
655 |
} // if |
656 |
|
657 |
decode_tcp_data(); |
658 |
|
659 |
if ( (udpdata = read8u()) != 'U') { // missing udp data |
660 |
fprintf(stderr, |
661 |
"%s:%s:%ld: expecting character U, not %c\n", |
662 |
progname, filename, ftell(file), udpdata); |
663 |
exit(EXIT_FAILURE); |
664 |
} // if |
665 |
|
666 |
decode_udp_data(); |
667 |
|
668 |
exdent(); |
669 |
} // decode_host_header_v3 |
670 |
|
671 |
void decode_protos_data(void) |
672 |
{ |
673 |
uint8_t ipprotocount; |
674 |
|
675 |
uint8_t i; |
676 |
|
677 |
ipprotocount = read8u(); |
678 |
|
679 |
print_indentation(); |
680 |
printf("IP Proto count %hhu\n", |
681 |
ipprotocount); |
682 |
|
683 |
indent(); |
684 |
|
685 |
for (i = 0; i < ipprotocount; i++) { |
686 |
uint8_t proto; |
687 |
uint64_t in; |
688 |
uint64_t out; |
689 |
|
690 |
print_indentation(); |
691 |
printf("Protocol #%u of %hhu:\n", |
692 |
i + 1, ipprotocount); |
693 |
|
694 |
proto = read8u(); |
695 |
|
696 |
indent(); |
697 |
print_indentation(); |
698 |
printf("Protocol 0x%02hhx\n", |
699 |
proto); |
700 |
|
701 |
in = read64u(); |
702 |
|
703 |
print_indentation(); |
704 |
printf("In %lu\n", |
705 |
in); |
706 |
|
707 |
out = read64u(); |
708 |
|
709 |
print_indentation(); |
710 |
printf("Out %lu\n", |
711 |
out); |
712 |
|
713 |
exdent(); |
714 |
} // for |
715 |
|
716 |
exdent(); |
717 |
} // decode_protos_data(); |
718 |
|
719 |
void decode_tcp_data(void) |
720 |
{ |
721 |
uint8_t tcpprotocount; |
722 |
|
723 |
uint16_t i; |
724 |
|
725 |
tcpprotocount = read16u(); |
726 |
|
727 |
print_indentation(); |
728 |
printf("TCP proto count %hhu\n", |
729 |
tcpprotocount); |
730 |
|
731 |
indent(); |
732 |
|
733 |
for (i = 0; i < tcpprotocount; i++) { |
734 |
uint16_t port; |
735 |
uint64_t syn; |
736 |
uint64_t in; |
737 |
uint64_t out; |
738 |
|
739 |
port = read16u(); |
740 |
|
741 |
print_indentation(); |
742 |
printf("Port %hu:\n", |
743 |
port); |
744 |
|
745 |
syn = read64u(); |
746 |
|
747 |
indent(); |
748 |
print_indentation(); |
749 |
printf("SYN %lu\n", |
750 |
syn); |
751 |
|
752 |
in = read64u(); |
753 |
|
754 |
print_indentation(); |
755 |
printf("In %lu\n", |
756 |
in); |
757 |
|
758 |
out = read64u(); |
759 |
|
760 |
print_indentation(); |
761 |
printf("Out %lu\n", |
762 |
out); |
763 |
|
764 |
exdent(); |
765 |
} // for |
766 |
|
767 |
exdent(); |
768 |
} // decode_tcp_data() |
769 |
|
770 |
void decode_udp_data(void) |
771 |
{ |
772 |
uint8_t udpprotocount; |
773 |
|
774 |
uint16_t i; |
775 |
|
776 |
udpprotocount = read16u(); |
777 |
|
778 |
print_indentation(); |
779 |
printf("UDP proto count %hhu\n", |
780 |
udpprotocount); |
781 |
|
782 |
indent(); |
783 |
|
784 |
for (i = 0; i < udpprotocount; i++) { |
785 |
uint16_t port; |
786 |
uint64_t in; |
787 |
uint64_t out; |
788 |
|
789 |
port = read16u(); |
790 |
|
791 |
print_indentation(); |
792 |
printf("Port %hu:\n", |
793 |
port); |
794 |
|
795 |
in = read64u(); |
796 |
|
797 |
indent(); |
798 |
print_indentation(); |
799 |
printf("In %lu\n", |
800 |
in); |
801 |
|
802 |
out = read64u(); |
803 |
|
804 |
print_indentation(); |
805 |
printf("Out %lu\n", |
806 |
out); |
807 |
|
808 |
exdent(); |
809 |
} // for |
810 |
|
811 |
exdent(); |
812 |
} // decode_udp_data() |
813 |
|
814 |
void decode_graph_db_v1(void) |
815 |
{ |
816 |
int64_t lasttime; |
817 |
|
818 |
uint32_t i; |
819 |
|
820 |
lasttime = read64s(); |
821 |
|
822 |
indent(); |
823 |
print_indentation(); |
824 |
printf("Last time 0x%lx = %ld = ", |
825 |
lasttime, lasttime); |
826 |
print_time_t(lasttime); |
827 |
puts(""); |
828 |
|
829 |
for (i = 0; i < 4; i++) { |
830 |
uint8_t nbars; |
831 |
uint8_t idxlastbar; |
832 |
|
833 |
uint32_t j; |
834 |
|
835 |
print_indentation(); |
836 |
printf("Graph #%u of 4:\n", |
837 |
i + 1); |
838 |
|
839 |
nbars = read8u(); |
840 |
|
841 |
indent(); |
842 |
print_indentation(); |
843 |
printf("Number of bars %hhu\n", |
844 |
nbars); |
845 |
|
846 |
idxlastbar = read8u(); |
847 |
|
848 |
print_indentation(); |
849 |
printf("Index of last bar %hhu\n", |
850 |
idxlastbar); |
851 |
|
852 |
indent(); |
853 |
for (j = 0; j < idxlastbar; j++) { |
854 |
uint64_t in; |
855 |
uint64_t out; |
856 |
|
857 |
print_indentation(); |
858 |
printf("Bar #%u of %hhu:\n", |
859 |
j + 1, idxlastbar); |
860 |
|
861 |
in = read64u(); |
862 |
|
863 |
indent(); |
864 |
print_indentation(); |
865 |
printf("In %lu\n", |
866 |
in); |
867 |
|
868 |
out = read64u(); |
869 |
|
870 |
print_indentation(); |
871 |
printf("Out %lu\n", |
872 |
out); |
873 |
|
874 |
exdent(); |
875 |
} // for |
876 |
exdent(); |
877 |
|
878 |
exdent(); |
879 |
} // for |
880 |
|
881 |
exdent(); |
882 |
} // decode_graph_db_v1() |
883 |
|
884 |
void handle_file_error(void); |
885 |
|
886 |
uint8_t read8u(void) |
887 |
{ |
888 |
size_t r; |
889 |
uint8_t v; |
890 |
|
891 |
if ( (r = fread((void *)&v, sizeof(v), 1, file)) != 1) { |
892 |
handle_file_error(); |
893 |
} // if |
894 |
|
895 |
return v; |
896 |
} // read8u() |
897 |
|
898 |
int8_t read8s(void) |
899 |
{ |
900 |
size_t r; |
901 |
int8_t v; |
902 |
|
903 |
if ( (r = fread((void *)&v, sizeof(v), 1, file)) != 1) { |
904 |
handle_file_error(); |
905 |
} // if |
906 |
|
907 |
return v; |
908 |
} // read8s() |
909 |
|
910 |
#ifdef __LITTLE_ENDIAN__ |
911 |
#include <netinet/in.h> |
912 |
#endif |
913 |
|
914 |
uint16_t read16u(void) |
915 |
{ |
916 |
size_t r; |
917 |
uint16_t v; |
918 |
|
919 |
if ( (r = fread((void *)&v, sizeof(v), 1, file)) != 1) { |
920 |
handle_file_error(); |
921 |
} // if |
922 |
|
923 |
#ifdef __LITTLE_ENDIAN__ |
924 |
v = ntohs(v); |
925 |
#endif |
926 |
|
927 |
return v; |
928 |
} // read16u() |
929 |
|
930 |
int16_t read16s(void) |
931 |
{ |
932 |
size_t r; |
933 |
int16_t v; |
934 |
|
935 |
if ( (r = fread((void *)&v, sizeof(v), 1, file)) != 1) { |
936 |
handle_file_error(); |
937 |
} // if |
938 |
|
939 |
#ifdef __LITTLE_ENDIAN__ |
940 |
v = ntohs(v); |
941 |
#endif |
942 |
|
943 |
return v; |
944 |
} // read16s() |
945 |
|
946 |
uint32_t read32u(void) |
947 |
{ |
948 |
size_t r; |
949 |
uint32_t v; |
950 |
|
951 |
if ( (r = fread((void *)&v, sizeof(v), 1, file)) != 1) { |
952 |
handle_file_error(); |
953 |
} // if |
954 |
|
955 |
#ifdef __LITTLE_ENDIAN__ |
956 |
v = ntohl(v); |
957 |
#endif |
958 |
|
959 |
return v; |
960 |
} // read32u() |
961 |
|
962 |
int32_t read32s(void) |
963 |
{ |
964 |
size_t r; |
965 |
int32_t v; |
966 |
|
967 |
if ( (r = fread((void *)&v, sizeof(v), 1, file)) != 1) { |
968 |
handle_file_error(); |
969 |
} // if |
970 |
|
971 |
#ifdef __LITTLE_ENDIAN__ |
972 |
v = ntohl(v); |
973 |
#endif |
974 |
|
975 |
return v; |
976 |
} // read32s() |
977 |
|
978 |
uint64_t read64u(void) |
979 |
{ |
980 |
size_t r; |
981 |
uint64_t v; |
982 |
|
983 |
#ifdef __LITTLE_ENDIAN__ |
984 |
uint64_t tmp; |
985 |
uint32_t *p1 = (uint32_t *)&v; |
986 |
uint32_t *p2 = (uint32_t *)&tmp; |
987 |
#endif |
988 |
|
989 |
if ( (r = fread((void *)&v, sizeof(v), 1, file)) != 1) { |
990 |
handle_file_error(); |
991 |
} // if |
992 |
|
993 |
#ifdef __LITTLE_ENDIAN__ |
994 |
p2[1] = ntohl(p1[0]); |
995 |
p2[0] = ntohl(p1[1]); |
996 |
v = tmp; |
997 |
#endif |
998 |
|
999 |
return v; |
1000 |
} // read64u() |
1001 |
|
1002 |
int64_t read64s(void) |
1003 |
{ |
1004 |
size_t r; |
1005 |
int64_t v; |
1006 |
|
1007 |
#ifdef __LITTLE_ENDIAN__ |
1008 |
int64_t tmp; |
1009 |
int32_t *p1 = (int32_t *)&v; |
1010 |
int32_t *p2 = (int32_t *)&tmp; |
1011 |
#endif |
1012 |
|
1013 |
if ( (r = fread((void *)&v, sizeof(v), 1, file)) != 1) { |
1014 |
handle_file_error(); |
1015 |
} // if |
1016 |
|
1017 |
#ifdef __LITTLE_ENDIAN__ |
1018 |
p2[1] = ntohl(p1[0]); |
1019 |
p2[0] = ntohl(p1[1]); |
1020 |
v = tmp; |
1021 |
#endif |
1022 |
|
1023 |
return v; |
1024 |
} // read64s() |
1025 |
|
1026 |
void handle_file_error(void) |
1027 |
{ |
1028 |
int saved_errno = errno; |
1029 |
|
1030 |
if (feof(file) != 0) { |
1031 |
fprintf(stderr, |
1032 |
"%s:%s:%ld: premature end-of-file\n", |
1033 |
progname, filename, ftell(file)); |
1034 |
exit(EXIT_FAILURE); |
1035 |
} // if |
1036 |
|
1037 |
if (ferror(file) != 0) { |
1038 |
fprintf(stderr, |
1039 |
"%s:%s:%ld: file error, errno = %s (%d)\n", |
1040 |
progname, filename, ftell(file), |
1041 |
strerror(saved_errno), saved_errno); |
1042 |
exit(EXIT_FAILURE); |
1043 |
} // if |
1044 |
} // handle_file_error() |
1045 |
|
1046 |
int64_t indentation = 0LL; |
1047 |
|
1048 |
void indent(void) |
1049 |
{ |
1050 |
if (indentation < (INT64_MAX - 2LL)) { |
1051 |
indentation += 2LL; |
1052 |
} // if |
1053 |
} // indent() |
1054 |
|
1055 |
void exdent(void) |
1056 |
{ |
1057 |
indentation -= 2LL; |
1058 |
|
1059 |
if (indentation < 0LL) { |
1060 |
indentation = 0LL; |
1061 |
}// if |
1062 |
} // exdent() |
1063 |
|
1064 |
void print_indentation(void) |
1065 |
{ |
1066 |
int64_t i; |
1067 |
|
1068 |
for (i = 0; i < indentation; i++) { |
1069 |
putchar(' '); |
1070 |
} // for |
1071 |
} // print_indentation() |
1072 |
|
1073 |
void print_time_t(time_t t) |
1074 |
{ |
1075 |
struct tm *stm; |
1076 |
char buffer[1024]; |
1077 |
|
1078 |
stm = gmtime(&t); |
1079 |
|
1080 |
// ISO 8601 format |
1081 |
if (strftime(buffer, sizeof(buffer), "%Y-%m-%dT%H:%M:%S%z", stm) == 0) { |
1082 |
int saved_errno = errno; |
1083 |
|
1084 |
fprintf(stderr, |
1085 |
"%s:%s:%ld: strftime() error, errno = %s (%d)\n", |
1086 |
progname, filename, ftell(file), |
1087 |
strerror(saved_errno), saved_errno); |
1088 |
exit(EXIT_FAILURE); |
1089 |
} // if |
1090 |
|
1091 |
fputs(buffer, stdout); |
1092 |
} // print_time_t() |
1093 |
|
1094 |
// darkstattype.c |