wiretap/toshiba.c

   1 /* toshiba.c
   2  *
   3  * $Id$
   4  *
   5  * Wiretap Library
   6  * Copyright (c) 1998 by Gilbert Ramirez <gram@alumni.rice.edu>
   7  *
   8  * This program is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU General Public License
  10  * as published by the Free Software Foundation; either version 2
  11  * of the License, or (at your option) any later version.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  * GNU General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * along with this program; if not, write to the Free Software
  20  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  21  */
  22
  23 #include "config.h"
  24 #include "wtap-int.h"
  25 #include "buffer.h"
  26 #include "toshiba.h"
  27 #include "file_wrappers.h"
  28
  29 #include <stdio.h>
  30 #include <stdlib.h>
  31 #include <string.h>
  32
  33 /* This module reads the output of the 'snoop' command in the Toshiba
  34  * TR-600 and TR-650 "Compact" ISDN Routers. You can telnet to the
  35  * router and run 'snoop' on the different channels, and at different
  36  * detail levels. Be sure to choose the 'dump' level to get the hex dump.
  37  * The 'snoop' command has nothing to do with the Solaris 'snoop'
  38  * command, except that they both capture packets.
  39  */
  40
  41 /*
  42    Example 'snoop' output data:
  43
  44 Script started on Thu Sep  9 21:48:49 1999
  45 \e]0;gram@nirvana:/tmp\a$ telnet 10.0.0.254
  46 Trying 10.0.0.254...
  47 Connected to 10.0.0.254.
  48 Escape character is '^]'.
  49
  50
  51 TR-600(tr600) System Console
  52
  53 Login:admin
  54 Password:*******
  55 *--------------------------------------------------------*
  56 |             T O S H I B A    T R - 6 0 0               |
  57 |                 <  Compact Router >                    |
  58 |                       V1.02.02                         |
  59 |                                                        |
  60 |  (C) Copyright TOSHIBA Corp. 1997 All rights reserved. |
  61 *--------------------------------------------------------*
  62
  63 tr600>snoop dump b1
  64  Trace start?(on/off/dump/dtl)->dump
  65  IP Address?->b1
  66 B1 Port Filetering
  67 Trace start(Dump Mode)...
  68
  69 tr600>[No.1] 00:00:09.14 B1:1 Tx 207.193.26.136->151.164.1.8 DNS  SPORT=1028 LEN=38 CHKSUM=4FD4 ID=2390 Query RD QCNT=1 pow.zing.org?
  70 OFFSET 0001-0203-0405-0607-0809-0A0B-0C0D-0E0F 0123456789ABCDEF LEN=67
  71 0000 : FF03 003D C000 0008 2145 0000 3A12 6500 ...=....!E..:.e.
  72 0010 : 003F 11E6 58CF C11A 8897 A401 0804 0400 .?..X...........
  73 0020 : 3500 264F D409 5601 0000 0100 0000 0000 5.&O..V.........
  74 0030 : 0003 706F 7704 7A69 6E67 036F 7267 0000 ..pow.zing.org..
  75 0040 : 0100 01                                 ...
  76
  77 [No.2] 00:00:09.25 B1:1 Rx 151.164.1.8->207.193.26.136 DNS  DPORT=1028 LEN=193 CHKSUM=3E06 ID=2390 Answer RD RA QCNT=1 pow.zing.org? ANCNT=1 pow.zing.org=206.57.36.90 TTL=2652
  78 OFFSET 0001-0203-0405-0607-0809-0A0B-0C0D-0E0F 0123456789ABCDEF LEN=222
  79 0000 : FF03 003D C000 0013 2145 0000 D590 9340 ...=....!E.....@
  80 0010 : 00F7 116F 8E97 A401 08CF C11A 8800 3504 ...o..........5.
  81 0020 : 0400 C13E 0609 5681 8000 0100 0100 0300 ...>..V.........
  82 0030 : 0303 706F 7704 7A69 6E67 036F 7267 0000 ..pow.zing.org..
  83 0040 : 0100 01C0 0C00 0100 0100 000A 5C00 04CE ............\...
  84 0050 : 3924 5A04 5A49 4E47 036F 7267 0000 0200 9$Z.ZING.org....
  85 0060 : 0100 016F 5B00 0D03 4841 4E03 5449 5703 ...o[...HAN.TIW.
  86 0070 : 4E45 5400 C02E 0002 0001 0001 6F5B 0006 NET.........o[..
  87 0080 : 034E 5331 C02E C02E 0002 0001 0001 6F5B .NS1..........o[
  88 0090 : 001C 0854 414C 4945 5349 4E0D 434F 4E46 ...TALIESIN.CONF
  89 00A0 : 4142 554C 4154 494F 4E03 434F 4D00 C042 ABULATION.COM..B
  90 00B0 : 0001 0001 0001 51EC 0004 CE39 2406 C05B ......Q....9$..[
  91 00C0 : 0001 0001 0001 6F5B 0004 CE39 245A C06D ......o[...9$Z.m
  92 00D0 : 0001 0001 0001 4521 0004 187C 1F01      ......E!...|..
  93
  94  */
  95
  96 /* Magic text to check for toshiba-ness of file */
  97 static const char toshiba_hdr_magic[]  =
  98 { 'T', ' ', 'O', ' ', 'S', ' ', 'H', ' ', 'I', ' ', 'B', ' ', 'A' };
  99 #define TOSHIBA_HDR_MAGIC_SIZE  (sizeof toshiba_hdr_magic  / sizeof toshiba_hdr_magic[0])
 100
 101 /* Magic text for start of packet */
 102 static const char toshiba_rec_magic[]  = { '[', 'N', 'o', '.' };
 103 #define TOSHIBA_REC_MAGIC_SIZE  (sizeof toshiba_rec_magic  / sizeof toshiba_rec_magic[0])
 104
 105 /*
 106  * XXX - is this the biggest packet we can get?
 107  */
 108 #define TOSHIBA_MAX_PACKET_LEN  16384
 109
 110 static gboolean toshiba_read(wtap *wth, int *err, gchar **err_info,
 111         gint64 *data_offset);
 112 static gboolean toshiba_seek_read(wtap *wth, gint64 seek_off,
 113         struct wtap_pkthdr *phdr, Buffer *buf, int len,
 114         int *err, gchar **err_info);
 115 static gboolean parse_single_hex_dump_line(char* rec, guint8 *buf,
 116         guint byte_offset);
 117 static gboolean parse_toshiba_packet(FILE_T fh, struct wtap_pkthdr *phdr,
 118         Buffer *buf, int *err, gchar **err_info);
 119
 120 /* Seeks to the beginning of the next packet, and returns the
 121    byte offset.  Returns -1 on failure, and sets "*err" to the error
 122    and "*err_info" to null or an additional error string. */
 123 static gint64 toshiba_seek_next_packet(wtap *wth, int *err, gchar **err_info)
 124 {
 125   int byte;
 126   guint level = 0;
 127   gint64 cur_off;
 128
 129   while ((byte = file_getc(wth->fh)) != EOF) {
 130     if (byte == toshiba_rec_magic[level]) {
 131       level++;
 132       if (level >= TOSHIBA_REC_MAGIC_SIZE) {
 133               /* note: we're leaving file pointer right after the magic characters */
 134         cur_off = file_tell(wth->fh);
 135         if (cur_off == -1) {
 136           /* Error. */
 137           *err = file_error(wth->fh, err_info);
 138           return -1;
 139         }
 140         return cur_off + 1;
 141       }
 142     } else {
 143       level = 0;
 144     }
 145   }
 146   /* EOF or error. */
 147   *err = file_error(wth->fh, err_info);
 148   return -1;
 149 }
 150
 151 #define TOSHIBA_HEADER_LINES_TO_CHECK   200
 152 #define TOSHIBA_LINE_LENGTH             240
 153
 154 /* Look through the first part of a file to see if this is
 155  * a Toshiba trace file.
 156  *
 157  * Returns TRUE if it is, FALSE if it isn't or if we get an I/O error;
 158  * if we get an I/O error, "*err" will be set to a non-zero value and
 159  * "*err_info" will be set to null or an additional error string.
 160  */
 161 static gboolean toshiba_check_file_type(wtap *wth, int *err, gchar **err_info)
 162 {
 163         char    buf[TOSHIBA_LINE_LENGTH];
 164         guint   i, reclen, level, line;
 165         char    byte;
 166
 167         buf[TOSHIBA_LINE_LENGTH-1] = 0;
 168
 169         for (line = 0; line < TOSHIBA_HEADER_LINES_TO_CHECK; line++) {
 170                 if (file_gets(buf, TOSHIBA_LINE_LENGTH, wth->fh) == NULL) {
 171                         /* EOF or error. */
 172                         *err = file_error(wth->fh, err_info);
 173                         return FALSE;
 174                 }
 175
 176                 reclen = (guint) strlen(buf);
 177                 if (reclen < TOSHIBA_HDR_MAGIC_SIZE) {
 178                         continue;
 179                 }
 180
 181                 level = 0;
 182                 for (i = 0; i < reclen; i++) {
 183                         byte = buf[i];
 184                         if (byte == toshiba_hdr_magic[level]) {
 185                                 level++;
 186                                 if (level >= TOSHIBA_HDR_MAGIC_SIZE) {
 187                                         return TRUE;
 188                                 }
 189                         }
 190                         else {
 191                                 level = 0;
 192                         }
 193                 }
 194         }
 195         *err = 0;
 196         return FALSE;
 197 }
 198
 199
 200 int toshiba_open(wtap *wth, int *err, gchar **err_info)
 201 {
 202         /* Look for Toshiba header */
 203         if (!toshiba_check_file_type(wth, err, err_info)) {
 204                 if (*err != 0 && *err != WTAP_ERR_SHORT_READ)
 205                         return -1;
 206                 return 0;
 207         }
 208
 209         wth->file_encap = WTAP_ENCAP_PER_PACKET;
 210         wth->file_type_subtype = WTAP_FILE_TYPE_SUBTYPE_TOSHIBA;
 211         wth->snapshot_length = 0; /* not known */
 212         wth->subtype_read = toshiba_read;
 213         wth->subtype_seek_read = toshiba_seek_read;
 214         wth->tsprecision = WTAP_FILE_TSPREC_CSEC;
 215
 216         return 1;
 217 }
 218
 219 /* Find the next packet and parse it; called from wtap_read(). */
 220 static gboolean toshiba_read(wtap *wth, int *err, gchar **err_info,
 221     gint64 *data_offset)
 222 {
 223         gint64  offset;
 224
 225         /* Find the next packet */
 226         offset = toshiba_seek_next_packet(wth, err, err_info);
 227         if (offset < 1)
 228                 return FALSE;
 229         *data_offset = offset;
 230
 231         /* Parse the packet */
 232         return parse_toshiba_packet(wth->fh, &wth->phdr, wth->frame_buffer,
 233             err, err_info);
 234 }
 235
 236 /* Used to read packets in random-access fashion */
 237 static gboolean
 238 toshiba_seek_read(wtap *wth, gint64 seek_off,
 239         struct wtap_pkthdr *phdr, Buffer *buf, int len _U_,
 240         int *err, gchar **err_info)
 241 {
 242         if (file_seek(wth->random_fh, seek_off - 1, SEEK_SET, err) == -1)
 243                 return FALSE;
 244
 245         if (!parse_toshiba_packet(wth->random_fh, phdr, buf, err, err_info)) {
 246                 if (*err == 0)
 247                         *err = WTAP_ERR_SHORT_READ;
 248                 return FALSE;
 249         }
 250         return TRUE;
 251 }
 252
 253 /* Parses a packet. */
 254 static gboolean
 255 parse_toshiba_packet(FILE_T fh, struct wtap_pkthdr *phdr, Buffer *buf,
 256     int *err, gchar **err_info)
 257 {
 258         union wtap_pseudo_header *pseudo_header = &phdr->pseudo_header;
 259         char    line[TOSHIBA_LINE_LENGTH];
 260         int     num_items_scanned;
 261         int     pkt_len, pktnum, hr, min, sec, csec;
 262         char    channel[10], direction[10];
 263         int     i, hex_lines;
 264         guint8  *pd;
 265
 266         /* Our file pointer should be on the line containing the
 267          * summary information for a packet. Read in that line and
 268          * extract the useful information
 269          */
 270         if (file_gets(line, TOSHIBA_LINE_LENGTH, fh) == NULL) {
 271                 *err = file_error(fh, err_info);
 272                 if (*err == 0) {
 273                         *err = WTAP_ERR_SHORT_READ;
 274                 }
 275                 return FALSE;
 276         }
 277
 278         /* Find text in line after "[No.". Limit the length of the
 279          * two strings since we have fixed buffers for channel[] and
 280          * direction[] */
 281         num_items_scanned = sscanf(line, "%9d] %2d:%2d:%2d.%9d %9s %9s",
 282                         &pktnum, &hr, &min, &sec, &csec, channel, direction);
 283
 284         if (num_items_scanned != 7) {
 285                 *err = WTAP_ERR_BAD_FILE;
 286                 *err_info = g_strdup("toshiba: record header isn't valid");
 287                 return FALSE;
 288         }
 289
 290         /* Scan lines until we find the OFFSET line. In a "telnet" trace,
 291          * this will be the next line. But if you save your telnet session
 292          * to a file from within a Windows-based telnet client, it may
 293          * put in line breaks at 80 columns (or however big your "telnet" box
 294          * is). CRT (a Windows telnet app from VanDyke) does this.
 295          * Here we assume that 80 columns will be the minimum size, and that
 296          * the OFFSET line is not broken in the middle. It's the previous
 297          * line that is normally long and can thus be broken at column 80.
 298          */
 299         do {
 300                 if (file_gets(line, TOSHIBA_LINE_LENGTH, fh) == NULL) {
 301                         *err = file_error(fh, err_info);
 302                         if (*err == 0) {
 303                                 *err = WTAP_ERR_SHORT_READ;
 304                         }
 305                         return FALSE;
 306                 }
 307
 308                 /* Check for "OFFSET 0001-0203" at beginning of line */
 309                 line[16] = '\0';
 310
 311         } while (strcmp(line, "OFFSET 0001-0203") != 0);
 312
 313         num_items_scanned = sscanf(line+64, "LEN=%9d", &pkt_len);
 314         if (num_items_scanned != 1) {
 315                 *err = WTAP_ERR_BAD_FILE;
 316                 *err_info = g_strdup("toshiba: OFFSET line doesn't have valid LEN item");
 317                 return FALSE;
 318         }
 319
 320         phdr->presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
 321         phdr->ts.secs = hr * 3600 + min * 60 + sec;
 322         phdr->ts.nsecs = csec * 10000000;
 323         phdr->caplen = pkt_len;
 324         phdr->len = pkt_len;
 325
 326         switch (channel[0]) {
 327                 case 'B':
 328                         phdr->pkt_encap = WTAP_ENCAP_ISDN;
 329                         pseudo_header->isdn.uton = (direction[0] == 'T');
 330                         pseudo_header->isdn.channel = (guint8)
 331                             strtol(&channel[1], NULL, 10);
 332                         break;
 333
 334                 case 'D':
 335                         phdr->pkt_encap = WTAP_ENCAP_ISDN;
 336                         pseudo_header->isdn.uton = (direction[0] == 'T');
 337                         pseudo_header->isdn.channel = 0;
 338                         break;
 339
 340                 default:
 341                         phdr->pkt_encap = WTAP_ENCAP_ETHERNET;
 342                         /* XXX - is there an FCS in the frame? */
 343                         pseudo_header->eth.fcs_len = -1;
 344                         break;
 345         }
 346
 347         /* Make sure we have enough room for the packet */
 348         buffer_assure_space(buf, TOSHIBA_MAX_PACKET_LEN);
 349         pd = buffer_start_ptr(buf);
 350
 351         /* Calculate the number of hex dump lines, each
 352          * containing 16 bytes of data */
 353         hex_lines = pkt_len / 16 + ((pkt_len % 16) ? 1 : 0);
 354
 355         for (i = 0; i < hex_lines; i++) {
 356                 if (file_gets(line, TOSHIBA_LINE_LENGTH, fh) == NULL) {
 357                         *err = file_error(fh, err_info);
 358                         if (*err == 0) {
 359                                 *err = WTAP_ERR_SHORT_READ;
 360                         }
 361                         return FALSE;
 362                 }
 363                 if (!parse_single_hex_dump_line(line, pd, i * 16)) {
 364                         *err = WTAP_ERR_BAD_FILE;
 365                         *err_info = g_strdup("toshiba: hex dump not valid");
 366                         return FALSE;
 367                 }
 368         }
 369         return TRUE;
 370 }
 371
 372 /*
 373           1         2         3         4
 374 0123456789012345678901234567890123456789012345
 375 0000 : FF03 003D C000 0008 2145 0000 3A12 6500 ...=....!E..:.e.
 376 0010 : 003F 11E6 58CF C11A 8897 A401 0804 0400 .?..X...........
 377 0020 : 0100 01                                 ...
 378 */
 379
 380 #define START_POS       7
 381 #define HEX_LENGTH      ((8 * 4) + 7) /* eight clumps of 4 bytes with 7 inner spaces */
 382
 383 /* Take a string representing one line from a hex dump and converts the
 384  * text to binary data. We check the printed offset with the offset
 385  * we are passed to validate the record. We place the bytes in the buffer
 386  * at the specified offset.
 387  *
 388  * In the process, we're going to write all over the string.
 389  *
 390  * Returns TRUE if good hex dump, FALSE if bad.
 391  */
 392 static gboolean
 393 parse_single_hex_dump_line(char* rec, guint8 *buf, guint byte_offset) {
 394
 395         int             pos, i;
 396         char            *s;
 397         unsigned long   value;
 398         guint16         word_value;
 399
 400         /* Get the byte_offset directly from the record */
 401         rec[4] = '\0';
 402         s = rec;
 403         value = strtoul(s, NULL, 16);
 404
 405         if (value != byte_offset) {
 406                 return FALSE;
 407         }
 408
 409         /* Go through the substring representing the values and:
 410          *      1. Replace any spaces with '0's
 411          *      2. Place \0's every 5 bytes (to terminate the string)
 412          *
 413          * Then read the eight sets of hex bytes
 414          */
 415
 416         for (pos = START_POS; pos < START_POS + HEX_LENGTH; pos++) {
 417                 if (rec[pos] == ' ') {
 418                         rec[pos] = '0';
 419                 }
 420         }
 421
 422         pos = START_POS;
 423         for (i = 0; i < 8; i++) {
 424                 rec[pos+4] = '\0';
 425
 426                 word_value = (guint16) strtoul(&rec[pos], NULL, 16);
 427                 buf[byte_offset + i * 2 + 0] = (guint8) (word_value >> 8);
 428                 buf[byte_offset + i * 2 + 1] = (guint8) (word_value & 0x00ff);
 429                 pos += 5;
 430         }
 431
 432         return TRUE;
 433 }