mergecap.c

   1 /* Combine dump files, either by appending or by merging by timestamp
   2  *
   3  * Wireshark - Network traffic analyzer
   4  * By Gerald Combs <gerald@wireshark.org>
   5  * Copyright 1998 Gerald Combs
   6  *
   7  * SPDX-License-Identifier: GPL-2.0-or-later
   8  *
   9  * Mergecap written by Scott Renfro <scott@renfro.org> based on
  10  * editcap by Richard Sharpe and Guy Harris
  11  *
  12  */
  13
  14 #include <config.h>
  15 #define WS_LOG_DOMAIN  LOG_DOMAIN_MAIN
  16
  17 #include <stdio.h>
  18 #include <stdlib.h>
  19 #include <glib.h>
  20
  21 #include <wsutil/ws_getopt.h>
  22
  23 #include <string.h>
  24
  25 #include <wiretap/wtap.h>
  26
  27 #include <wsutil/clopts_common.h>
  28 #include <wsutil/cmdarg_err.h>
  29 #include <wsutil/filesystem.h>
  30 #include <wsutil/file_util.h>
  31 #include <wsutil/privileges.h>
  32 #include <wsutil/strnatcmp.h>
  33 #include <wsutil/ws_assert.h>
  34 #include <wsutil/wslog.h>
  35
  36 #include <cli_main.h>
  37 #include <wsutil/version_info.h>
  38
  39 #ifdef HAVE_PLUGINS
  40 #include <wsutil/plugins.h>
  41 #endif
  42
  43 #include <wiretap/merge.h>
  44
  45 #include "ui/failure_message.h"
  46
  47 #define LONGOPT_COMPRESS                LONGOPT_BASE_APPLICATION+1
  48
  49 /*
  50  * Show the usage
  51  */
  52 static void
  53 print_usage(FILE *output)
  54 {
  55     fprintf(output, "\n");
  56     fprintf(output, "Usage: mergecap [options] -w <outfile>|- <infile> [<infile> ...]\n");
  57     fprintf(output, "\n");
  58     fprintf(output, "Output:\n");
  59     fprintf(output, "  -a                concatenate rather than merge files.\n");
  60     fprintf(output, "                    default is to merge based on frame timestamps.\n");
  61     fprintf(output, "  -s <snaplen>      truncate packets to <snaplen> bytes of data.\n");
  62     fprintf(output, "  -w <outfile>|-    set the output filename to <outfile> or '-' for stdout.\n");
  63     fprintf(output, "                    if the output filename has the .gz extension, it will be compressed to a gzip archive\n");
  64     fprintf(output, "  -F <capture type> set the output file type; default is pcapng.\n");
  65     fprintf(output, "                    an empty \"-F\" option will list the file types.\n");
  66     fprintf(output, "  -I <IDB merge mode> set the merge mode for Interface Description Blocks; default is 'all'.\n");
  67     fprintf(output, "                    an empty \"-I\" option will list the merge modes.\n");
  68     fprintf(output, "  --compress <type> compress the output file using the type compression format.\n");
  69     fprintf(output, "\n");
  70     fprintf(output, "Miscellaneous:\n");
  71     fprintf(output, "  -h, --help        display this help and exit.\n");
  72     fprintf(output, "  -V                verbose output.\n");
  73     fprintf(output, "  -v, --version     print version information and exit.\n");
  74 }
  75
  76 /*
  77  * Report an error in command-line arguments.
  78  */
  79 static void
  80 mergecap_cmdarg_err(const char *fmt, va_list ap)
  81 {
  82     fprintf(stderr, "mergecap: ");
  83     vfprintf(stderr, fmt, ap);
  84     fprintf(stderr, "\n");
  85 }
  86
  87 /*
  88  * Report additional information for an error in command-line arguments.
  89  */
  90 static void
  91 mergecap_cmdarg_err_cont(const char *fmt, va_list ap)
  92 {
  93     vfprintf(stderr, fmt, ap);
  94     fprintf(stderr, "\n");
  95 }
  96
  97 static void
  98 list_capture_types(void) {
  99     GArray *writable_type_subtypes;
 100
 101     fprintf(stderr, "mergecap: The available capture file types for the \"-F\" flag are:\n");
 102     writable_type_subtypes = wtap_get_writable_file_types_subtypes(FT_SORT_BY_NAME);
 103     for (unsigned i = 0; i < writable_type_subtypes->len; i++) {
 104         int ft = g_array_index(writable_type_subtypes, int, i);
 105         fprintf(stderr, "    %s - %s\n", wtap_file_type_subtype_name(ft),
 106                 wtap_file_type_subtype_description(ft));
 107     }
 108     g_array_free(writable_type_subtypes, TRUE);
 109 }
 110
 111 static void
 112 list_idb_merge_modes(void) {
 113     int i;
 114
 115     fprintf(stderr, "mergecap: The available IDB merge modes for the \"-I\" flag are:\n");
 116     for (i = 0; i < IDB_MERGE_MODE_MAX; i++) {
 117         fprintf(stderr, "    %s\n", merge_idb_merge_mode_to_string(i));
 118     }
 119 }
 120
 121 static void
 122 list_output_compression_types(void) {
 123     GSList *output_compression_types;
 124
 125     fprintf(stderr, "mergecap: The available output compress type(s) for the \"--compress\" flag are:\n");
 126     output_compression_types = wtap_get_all_output_compression_type_names_list();
 127     for (GSList *compression_type = output_compression_types;
 128         compression_type != NULL;
 129         compression_type = g_slist_next(compression_type)) {
 130             fprintf(stderr, "   %s\n", (const char *)compression_type->data);
 131         }
 132
 133     g_slist_free(output_compression_types);
 134 }
 135
 136 static bool
 137 merge_callback(merge_event event, int num,
 138         const merge_in_file_t in_files[], const unsigned in_file_count,
 139         void *data _U_)
 140 {
 141     unsigned i;
 142
 143     switch (event) {
 144
 145         case MERGE_EVENT_INPUT_FILES_OPENED:
 146             for (i = 0; i < in_file_count; i++) {
 147                 fprintf(stderr, "mergecap: %s is type %s.\n", in_files[i].filename,
 148                         wtap_file_type_subtype_description(wtap_file_type_subtype(in_files[i].wth)));
 149             }
 150             break;
 151
 152         case MERGE_EVENT_FRAME_TYPE_SELECTED:
 153             /* for this event, num = frame_type */
 154             if (num == WTAP_ENCAP_PER_PACKET) {
 155                 /*
 156                  * Find out why we had to choose WTAP_ENCAP_PER_PACKET.
 157                  */
 158                 int first_frame_type, this_frame_type;
 159
 160                 first_frame_type = wtap_file_encap(in_files[0].wth);
 161                 for (i = 1; i < in_file_count; i++) {
 162                     this_frame_type = wtap_file_encap(in_files[i].wth);
 163                     if (first_frame_type != this_frame_type) {
 164                         fprintf(stderr, "mergecap: multiple frame encapsulation types detected\n");
 165                         fprintf(stderr, "          defaulting to WTAP_ENCAP_PER_PACKET\n");
 166                         fprintf(stderr, "          %s had type %s (%s)\n",
 167                                 in_files[0].filename,
 168                                 wtap_encap_description(first_frame_type),
 169                                 wtap_encap_name(first_frame_type));
 170                         fprintf(stderr, "          %s had type %s (%s)\n",
 171                                 in_files[i].filename,
 172                                 wtap_encap_description(this_frame_type),
 173                                 wtap_encap_name(this_frame_type));
 174                         break;
 175                     }
 176                 }
 177             }
 178             fprintf(stderr, "mergecap: selected frame_type %s (%s)\n",
 179                     wtap_encap_description(num),
 180                     wtap_encap_name(num));
 181             break;
 182
 183         case MERGE_EVENT_READY_TO_MERGE:
 184             fprintf(stderr, "mergecap: ready to merge records\n");
 185             break;
 186
 187         case MERGE_EVENT_RECORD_WAS_READ:
 188             /* for this event, num = count */
 189             fprintf(stderr, "Record: %d\n", num);
 190             break;
 191
 192         case MERGE_EVENT_DONE:
 193             fprintf(stderr, "mergecap: merging complete\n");
 194             break;
 195     }
 196
 197     /* false = do not stop merging */
 198     return false;
 199 }
 200
 201 int
 202 main(int argc, char *argv[])
 203 {
 204     char               *configuration_init_error;
 205     int                 opt;
 206     static const struct ws_option long_options[] = {
 207         {"help", ws_no_argument, NULL, 'h'},
 208         {"version", ws_no_argument, NULL, 'v'},
 209         {"compress", ws_required_argument, NULL, LONGOPT_COMPRESS},
 210         {0, 0, 0, 0 }
 211     };
 212     bool                  do_append        = false;
 213     bool                  verbose          = false;
 214     int                   in_file_count    = 0;
 215     uint32_t              snaplen          = 0;
 216     int                   file_type        = WTAP_FILE_TYPE_SUBTYPE_UNKNOWN;
 217     char                  *out_filename    = NULL;
 218     bool                  status           = true;
 219     idb_merge_mode        mode             = IDB_MERGE_MODE_MAX;
 220     wtap_compression_type compression_type = WTAP_UNKNOWN_COMPRESSION;
 221     merge_progress_callback_t cb;
 222
 223     cmdarg_err_init(mergecap_cmdarg_err, mergecap_cmdarg_err_cont);
 224
 225     /* Initialize log handler early so we can have proper logging during startup. */
 226     ws_log_init("mergecap", vcmdarg_err);
 227
 228     /* Early logging command-line initialization. */
 229     ws_log_parse_args(&argc, argv, vcmdarg_err, 1);
 230
 231     ws_noisy("Finished log init and parsing command line log arguments");
 232
 233 #ifdef _WIN32
 234     create_app_running_mutex();
 235 #endif /* _WIN32 */
 236
 237     /* Initialize the version information. */
 238     ws_init_version_info("Mergecap", NULL, NULL);
 239
 240     /*
 241      * Get credential information for later use.
 242      */
 243     init_process_policies();
 244
 245     /*
 246      * Attempt to get the pathname of the directory containing the
 247      * executable file.
 248      */
 249     configuration_init_error = configuration_init(argv[0], NULL);
 250     if (configuration_init_error != NULL) {
 251         cmdarg_err(
 252                 "Can't get pathname of directory containing the mergecap program: %s.",
 253                 configuration_init_error);
 254         g_free(configuration_init_error);
 255     }
 256
 257     init_report_failure_message("mergecap");
 258
 259     wtap_init(true);
 260
 261     /* Process the options first */
 262     while ((opt = ws_getopt_long(argc, argv, "aF:hI:s:vVw:", long_options, NULL)) != -1) {
 263
 264         switch (opt) {
 265             case 'a':
 266                 do_append = !do_append;
 267                 break;
 268
 269             case 'F':
 270                 file_type = wtap_name_to_file_type_subtype(ws_optarg);
 271                 if (file_type < 0) {
 272                     cmdarg_err("\"%s\" isn't a valid capture file type",
 273                                ws_optarg);
 274                     list_capture_types();
 275                     status = false;
 276                     goto clean_exit;
 277                 }
 278                 break;
 279
 280             case 'h':
 281                 show_help_header("Merge two or more capture files into one.");
 282                 print_usage(stdout);
 283                 goto clean_exit;
 284                 break;
 285
 286             case 'I':
 287                 mode = merge_string_to_idb_merge_mode(ws_optarg);
 288                 if (mode == IDB_MERGE_MODE_MAX) {
 289                     cmdarg_err("\"%s\" isn't a valid IDB merge mode",
 290                                ws_optarg);
 291                     list_idb_merge_modes();
 292                     status = false;
 293                     goto clean_exit;
 294                 }
 295                 break;
 296
 297             case 's':
 298                 snaplen = get_nonzero_uint32(ws_optarg, "snapshot length");
 299                 break;
 300
 301             case 'V':
 302                 verbose = true;
 303                 break;
 304
 305             case 'v':
 306                 show_version();
 307                 goto clean_exit;
 308                 break;
 309
 310             case 'w':
 311                 out_filename = ws_optarg;
 312                 break;
 313
 314             case LONGOPT_COMPRESS:
 315                 compression_type = wtap_name_to_compression_type(ws_optarg);
 316                 if (compression_type == WTAP_UNKNOWN_COMPRESSION) {
 317                     cmdarg_err("\"%s\" isn't a valid output compression mode",
 318                                 ws_optarg);
 319                     list_output_compression_types();
 320                     goto clean_exit;
 321                 }
 322                 break;
 323             case '?':              /* Bad options if GNU getopt */
 324                 switch(ws_optopt) {
 325                     case'F':
 326                         list_capture_types();
 327                         break;
 328                     case'I':
 329                         list_idb_merge_modes();
 330                         break;
 331                     case LONGOPT_COMPRESS:
 332                         list_output_compression_types();
 333                         break;
 334                     default:
 335                         print_usage(stderr);
 336                 }
 337                 status = false;
 338                 goto clean_exit;
 339                 break;
 340         }
 341     }
 342
 343     /* Default to pcapng when writing. */
 344     if (file_type == WTAP_FILE_TYPE_SUBTYPE_UNKNOWN)
 345         file_type = wtap_pcapng_file_type_subtype();
 346
 347     cb.callback_func = merge_callback;
 348     cb.data = NULL;
 349
 350     /* check for proper args; at a minimum, must have an output
 351      * filename and one input file
 352      */
 353     in_file_count = argc - ws_optind;
 354     if (!out_filename) {
 355         cmdarg_err("an output filename must be set with -w");
 356         cmdarg_err_cont("run with -h for help");
 357         status = false;
 358         goto clean_exit;
 359     }
 360     if (in_file_count < 1) {
 361         cmdarg_err("No input files were specified");
 362         return 1;
 363     }
 364
 365     if (compression_type == WTAP_UNKNOWN_COMPRESSION) {
 366         /* An explicitly specified compression type overrides filename
 367          * magic. (Should we allow specifying "no" compression with, e.g.
 368          * a ".gz" extension?) */
 369         const char *sfx = strrchr(out_filename, '.');
 370         if (sfx) {
 371             compression_type = wtap_extension_to_compression_type(sfx + 1);
 372         }
 373     }
 374
 375     if (compression_type == WTAP_UNKNOWN_COMPRESSION) {
 376         compression_type = WTAP_UNCOMPRESSED;
 377     }
 378
 379     if (!wtap_can_write_compression_type(compression_type)) {
 380         cmdarg_err("Output files can't be written as %s",
 381                 wtap_compression_type_description(compression_type));
 382         status = false;
 383         goto clean_exit;
 384     }
 385
 386     if (compression_type != WTAP_UNCOMPRESSED && !wtap_dump_can_compress(file_type)) {
 387         cmdarg_err("The file format %s can't be written to output compressed format",
 388             wtap_file_type_subtype_name(file_type));
 389         status = false;
 390         goto clean_exit;
 391     }
 392
 393     /*
 394      * Setting IDB merge mode must use a file format that supports
 395      * (and thus requires) interface ID and information blocks.
 396      */
 397     if (mode != IDB_MERGE_MODE_MAX &&
 398             wtap_file_type_subtype_supports_block(file_type, WTAP_BLOCK_IF_ID_AND_INFO) == BLOCK_NOT_SUPPORTED) {
 399         cmdarg_err("The IDB merge mode can only be used with an output format that identifies interfaces");
 400         status = false;
 401         goto clean_exit;
 402     }
 403
 404     /* if they didn't set IDB merge mode, set it to our default */
 405     if (mode == IDB_MERGE_MODE_MAX) {
 406         mode = IDB_MERGE_MODE_ALL_SAME;
 407     }
 408
 409     /* open the outfile */
 410     if (strcmp(out_filename, "-") == 0) {
 411         /* merge the files to the standard output */
 412         status = merge_files_to_stdout(file_type,
 413                 (const char *const *) &argv[ws_optind],
 414                 in_file_count, do_append, mode, snaplen,
 415                 get_appname_and_version(),
 416                 verbose ? &cb : NULL, compression_type);
 417     } else {
 418         /* merge the files to the outfile */
 419         status = merge_files(out_filename, file_type,
 420                 (const char *const *) &argv[ws_optind], in_file_count,
 421                 do_append, mode, snaplen, get_appname_and_version(),
 422                 verbose ? &cb : NULL, compression_type);
 423     }
 424
 425 clean_exit:
 426     wtap_cleanup();
 427     free_progdirs();
 428     return status ? 0 : 2;
 429 }