epan/dissectors/packet-logcat.c

   1 /* packet-logcat.c
   2  * Routines for Android Logcat binary format v1 and v2
   3  *
   4  * Copyright 2014, Michal Labedzki for Tieto Corporation
   5  *
   6  * Wireshark - Network traffic analyzer
   7  * By Gerald Combs <gerald@wireshark.org>
   8  * Copyright 1998 Gerald Combs
   9  *
  10  * SPDX-License-Identifier: GPL-2.0-or-later
  11  */
  12
  13 #include "config.h"
  14
  15 #include <epan/packet.h>
  16 #include <epan/expert.h>
  17 #include <epan/exported_pdu.h>
  18 #include <epan/tap.h>
  19 #include <epan/prefs.h>
  20 #include <wiretap/wtap.h>
  21
  22 static int proto_logcat;
  23
  24 static int hf_logcat_version;
  25 static int hf_logcat_length;
  26 static int hf_logcat_padding;
  27 static int hf_logcat_header_size;
  28 static int hf_logcat_pid;
  29 static int hf_logcat_tid;
  30 static int hf_logcat_timestamp;
  31 static int hf_logcat_timestamp_seconds;
  32 static int hf_logcat_timestamp_nanoseconds;
  33 static int hf_logcat_euid;
  34 static int hf_logcat_priority;
  35 static int hf_logcat_tag;
  36 static int hf_logcat_log;
  37
  38 static int ett_logcat;
  39 static int ett_logcat_timestamp;
  40 static int ett_logcat_log;
  41
  42 static dissector_handle_t logcat_handle;
  43 static dissector_handle_t data_text_lines_handle;
  44
  45 static int exported_pdu_tap = -1;
  46
  47 static expert_field ei_invalid_payload_length;
  48
  49 static bool  pref_one_line_info_column = true;
  50
  51 const value_string priority_vals[] = {
  52     { 0x00,  "Unknown" },
  53     { 0x01,  "Default" },
  54     { 0x02,  "Verbose" },
  55     { 0x03,  "Debug" },
  56     { 0x04,  "Info" },
  57     { 0x05,  "Warning" },
  58     { 0x06,  "Error" },
  59     { 0x07,  "Fatal" },
  60     { 0x08,  "Silent" },
  61     { 0, NULL }
  62 };
  63
  64 void proto_register_logcat(void);
  65 void proto_reg_handoff_logcat(void);
  66
  67 static int detect_version(tvbuff_t *tvb, int offset) {
  68     uint16_t        payload_length;
  69     uint16_t        try_header_size;
  70
  71     payload_length  = tvb_get_letohs(tvb, offset);
  72     try_header_size = tvb_get_letohs(tvb, offset + 2);
  73
  74     if (try_header_size != 24)
  75         return 1;
  76
  77     if (tvb_reported_length_remaining(tvb, offset + 24 + payload_length) >= 0)
  78         return 2;
  79
  80     return 1;
  81 }
  82
  83 static int
  84 dissect_logcat(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_)
  85 {
  86     int          offset = 0;
  87     proto_tree  *maintree;
  88     proto_item  *mainitem;
  89     proto_tree  *subtree;
  90     proto_item  *subitem;
  91     uint16_t     length;
  92     uint16_t     check_length;
  93     uint32_t     string_length;
  94     int          logger_version;
  95     uint8_t     *log;
  96     char        *c;
  97     tvbuff_t    *next_tvb;
  98
  99     col_set_str(pinfo->cinfo, COL_PROTOCOL, "Logcat");
 100     col_clear(pinfo->cinfo, COL_INFO);
 101
 102     mainitem = proto_tree_add_item(tree, proto_logcat, tvb, offset, -1, ENC_NA);
 103     maintree = proto_item_add_subtree(mainitem, ett_logcat);
 104
 105     logger_version = detect_version(tvb, offset);
 106
 107     subitem = proto_tree_add_uint(maintree, hf_logcat_version, tvb, offset, 0, logger_version);
 108     proto_item_set_generated(subitem);
 109
 110     proto_tree_add_item(maintree, hf_logcat_length, tvb, offset, 2, ENC_LITTLE_ENDIAN);
 111     length = tvb_get_letohs(tvb, offset);
 112     offset += 2;
 113
 114     if (logger_version == 1) {
 115         proto_tree_add_item(maintree, hf_logcat_padding, tvb, offset, 2, ENC_LITTLE_ENDIAN);
 116     } else {
 117         proto_tree_add_item(maintree, hf_logcat_header_size, tvb, offset, 2, ENC_LITTLE_ENDIAN);
 118     }
 119     offset += 2;
 120
 121     proto_tree_add_item(maintree, hf_logcat_pid, tvb, offset, 4, ENC_LITTLE_ENDIAN);
 122     offset += 4;
 123
 124     proto_tree_add_item(maintree, hf_logcat_tid, tvb, offset, 4, ENC_LITTLE_ENDIAN);
 125     offset += 4;
 126
 127     subitem = proto_tree_add_item(maintree, hf_logcat_timestamp, tvb, offset, 8, ENC_LITTLE_ENDIAN);
 128     subtree = proto_item_add_subtree(subitem, ett_logcat_timestamp);
 129
 130     proto_tree_add_item(subtree, hf_logcat_timestamp_seconds, tvb, offset, 4, ENC_LITTLE_ENDIAN);
 131     offset += 4;
 132
 133     proto_tree_add_item(subtree, hf_logcat_timestamp_nanoseconds, tvb, offset, 4, ENC_LITTLE_ENDIAN);
 134     offset += 4;
 135
 136     if (logger_version >= 2) {
 137         proto_tree_add_item(maintree, hf_logcat_euid, tvb, offset, 4, ENC_LITTLE_ENDIAN);
 138         offset += 4;
 139     }
 140
 141     /* payload */
 142     proto_tree_add_item(maintree, hf_logcat_priority, tvb, offset, 1, ENC_LITTLE_ENDIAN);
 143     offset += 1;
 144     check_length = 1;
 145
 146     string_length = tvb_strsize(tvb, offset);
 147     proto_tree_add_item(maintree, hf_logcat_tag, tvb, offset, string_length, ENC_UTF_8 | ENC_NA);
 148
 149     set_address_tvb(&pinfo->src, AT_STRINGZ, string_length + 1, tvb, offset);
 150     set_address(&pinfo->dst, AT_STRINGZ, 7, "Logcat");
 151
 152     offset += string_length;
 153     check_length += string_length;
 154
 155     string_length = length - string_length - 1;
 156     log = tvb_get_string_enc(pinfo->pool, tvb, offset, string_length, ENC_UTF_8);
 157
 158     /* New line characters convert to spaces to ensure column Info display one line */
 159     if (pref_one_line_info_column) {
 160         while ((c = g_utf8_strchr(log, string_length, '\n')))
 161             *c = ' ';
 162         while ((c = g_utf8_strchr(log, string_length, '\r')))
 163             *c = ' ';
 164     }
 165
 166     subitem = proto_tree_add_item(maintree, hf_logcat_log, tvb, offset, string_length, ENC_UTF_8 | ENC_NA);
 167     subtree = proto_item_add_subtree(subitem, ett_logcat_log);
 168
 169     next_tvb = tvb_new_subset_length(tvb, offset, string_length - 1);
 170     call_dissector(data_text_lines_handle, next_tvb, pinfo, subtree);
 171
 172     col_add_str(pinfo->cinfo, COL_INFO, log);
 173     offset += string_length;
 174     check_length += string_length;
 175
 176     if (length != check_length)
 177         proto_tree_add_expert(maintree, pinfo, &ei_invalid_payload_length, tvb, offset, tvb_reported_length_remaining(tvb, offset));
 178
 179     if (have_tap_listener(exported_pdu_tap)) {
 180
 181         exp_pdu_data_t *exp_pdu_data = export_pdu_create_tags(pinfo, "logcat", EXP_PDU_TAG_DISSECTOR_NAME, NULL);
 182
 183         exp_pdu_data->tvb_captured_length = tvb_captured_length(tvb);
 184         exp_pdu_data->tvb_reported_length = tvb_reported_length(tvb);
 185         exp_pdu_data->pdu_tvb = tvb;
 186         tap_queue_packet(exported_pdu_tap, pinfo, exp_pdu_data);
 187     }
 188
 189     return offset;
 190 }
 191
 192 void
 193 proto_register_logcat(void)
 194 {
 195     module_t         *module;
 196     expert_module_t  *expert_module;
 197     static hf_register_info hf[] = {
 198         { &hf_logcat_version,
 199             { "Logger Version",                  "logcat.logger_version",
 200             FT_UINT8, BASE_DEC, NULL, 0x00,
 201             NULL, HFILL }
 202         },
 203         { &hf_logcat_length,
 204             { "Payload Length",                  "logcat.length",
 205             FT_UINT16, BASE_DEC, NULL, 0x00,
 206             "Payload start after nanoseconds or euid", HFILL }
 207         },
 208         { &hf_logcat_padding,
 209             { "Padding",                         "logcat.padding",
 210             FT_UINT16, BASE_HEX, NULL, 0x00,
 211             "No matter what, we get 2 bytes of padding", HFILL }
 212         },
 213         { &hf_logcat_header_size,
 214             { "Header Size",                     "logcat.header_size",
 215             FT_UINT16, BASE_HEX, NULL, 0x00,
 216             "Size of struct logger_entry_v2", HFILL }
 217         },
 218         { &hf_logcat_pid,
 219             { "PID",                             "logcat.pid",
 220             FT_INT32, BASE_DEC, NULL, 0x00,
 221             "Process ID", HFILL }
 222         },
 223         { &hf_logcat_tid,
 224             { "TID",                             "logcat.tid",
 225             FT_INT32, BASE_DEC, NULL, 0x00,
 226             "Thread ID", HFILL }
 227         },
 228         { &hf_logcat_timestamp,
 229             { "Timestamp",                       "logcat.timestamp",
 230             FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x00,
 231             NULL, HFILL }
 232         },
 233         { &hf_logcat_timestamp_seconds,
 234             { "Timestamp in seconds",            "logcat.timestamp.seconds",
 235             FT_INT32, BASE_DEC, NULL, 0x00,
 236             NULL, HFILL }
 237         },
 238         { &hf_logcat_timestamp_nanoseconds,
 239             { "Nanoseconds Timestamp",           "logcat.timestamp.nanoseconds",
 240             FT_INT32, BASE_DEC, NULL, 0x00,
 241             NULL, HFILL }
 242         },
 243         { &hf_logcat_euid,
 244             { "EUID",                            "logcat.euid",
 245             FT_UINT32, BASE_DEC, NULL, 0x00,
 246             "Effective UID of logger", HFILL }
 247         },
 248         { &hf_logcat_priority,
 249             { "Priority",                        "logcat.priority",
 250             FT_UINT8, BASE_DEC, VALS(priority_vals), 0x00,
 251             NULL, HFILL }
 252         },
 253         { &hf_logcat_tag,
 254             { "Tag",                             "logcat.tag",
 255             FT_STRINGZ, BASE_NONE, NULL, 0x00,
 256             NULL, HFILL }
 257         },
 258         { &hf_logcat_log,
 259             { "Log",                             "logcat.log",
 260             FT_STRINGZ, BASE_NONE, NULL, 0x00,
 261             NULL, HFILL }
 262         }
 263     };
 264
 265     static int *ett[] = {
 266         &ett_logcat,
 267         &ett_logcat_timestamp,
 268         &ett_logcat_log
 269     };
 270
 271     static ei_register_info ei[] = {
 272         { &ei_invalid_payload_length, { "logcat.expert.invalid_payload_length", PI_PROTOCOL, PI_WARN, "Payload length does not meet sum of payload data length", EXPFILL }},
 273     };
 274
 275     proto_logcat = proto_register_protocol("Android Logcat", "Logcat", "logcat");
 276     proto_register_field_array(proto_logcat, hf, array_length(hf));
 277     proto_register_subtree_array(ett, array_length(ett));
 278     logcat_handle = register_dissector("logcat", dissect_logcat, proto_logcat);
 279
 280     expert_module = expert_register_protocol(proto_logcat);
 281     expert_register_field_array(expert_module, ei, array_length(ei));
 282
 283     exported_pdu_tap = register_export_pdu_tap("Logcat");
 284
 285     module = prefs_register_protocol(proto_logcat, NULL);
 286     prefs_register_bool_preference(module, "oneline_info_column",
 287             "Use oneline info column",
 288             "Use oneline info column by replace all new line characters by spaces",
 289             &pref_one_line_info_column);
 290 }
 291
 292
 293 void
 294 proto_reg_handoff_logcat(void)
 295 {
 296     data_text_lines_handle = find_dissector_add_dependency("data-text-lines", proto_logcat);
 297
 298     dissector_add_uint("wtap_encap", WTAP_ENCAP_LOGCAT, logcat_handle);
 299
 300     dissector_add_for_decode_as_with_preference("tcp.port", logcat_handle);
 301 }
 302
 303 /*
 304  * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
 305  *
 306  * Local variables:
 307  * c-basic-offset: 4
 308  * tab-width: 8
 309  * indent-tabs-mode: nil
 310  * End:
 311  *
 312  * vi: set shiftwidth=4 tabstop=8 expandtab:
 313  * :indentSize=4:tabSize=8:noTabs=true:
 314  */