2018-08-27 15:17:32 +00:00
|
|
|
/* systemd_journal.c
|
|
|
|
*
|
|
|
|
* Wiretap Library
|
|
|
|
* Copyright (c) 1998 by Gilbert Ramirez <gram@alumni.rice.edu>
|
|
|
|
*
|
|
|
|
* SPDX-License-Identifier: GPL-2.0-or-later
|
|
|
|
*/
|
|
|
|
|
|
|
|
#include "config.h"
|
|
|
|
|
|
|
|
#include <errno.h>
|
|
|
|
#include <string.h>
|
|
|
|
#include <stdlib.h>
|
|
|
|
#include "wtap-int.h"
|
2018-09-10 23:49:36 +00:00
|
|
|
#include "pcapng_module.h"
|
2018-08-27 15:17:32 +00:00
|
|
|
#include "file_wrappers.h"
|
|
|
|
#include "systemd_journal.h"
|
|
|
|
|
|
|
|
// To do:
|
|
|
|
// - Request a pcap encapsulation type.
|
|
|
|
// - Should we add separate types for binary, plain, and JSON or add a metadata header?
|
|
|
|
|
|
|
|
// Systemd journals are stored in the following formats:
|
|
|
|
// Journal File Format (native binary): https://www.freedesktop.org/wiki/Software/systemd/journal-files/
|
|
|
|
// Journal Export Format: https://www.freedesktop.org/wiki/Software/systemd/export/
|
|
|
|
// Journal JSON format: https://www.freedesktop.org/wiki/Software/systemd/json/
|
|
|
|
// This reads Journal Export Format files but could be extended to support
|
|
|
|
// the binary and JSON formats.
|
|
|
|
|
|
|
|
// Example data:
|
|
|
|
// __CURSOR=s=1d56bab64d414960b9907ab0cc7f7c62;i=2;b=1497926e8b4b4d3ca6a5805e157fa73c;m=5d0ae5;t=56f2f5b66ce6f;x=20cb01e28bb496a8
|
|
|
|
// __REALTIME_TIMESTAMP=1529624071163503
|
|
|
|
// __MONOTONIC_TIMESTAMP=6097637
|
|
|
|
// _BOOT_ID=1497926e8b4b4d3ca6a5805e157fa73c
|
|
|
|
// PRIORITY=6
|
|
|
|
// _MACHINE_ID=62c342838a6e436dacea041aa4b5064b
|
|
|
|
// _HOSTNAME=example.wireshark.org
|
|
|
|
// _SOURCE_MONOTONIC_TIMESTAMP=0
|
|
|
|
// _TRANSPORT=kernel
|
|
|
|
// SYSLOG_FACILITY=0
|
|
|
|
// SYSLOG_IDENTIFIER=kernel
|
|
|
|
// MESSAGE=Initializing cgroup subsys cpuset
|
|
|
|
|
2019-04-05 01:56:27 +00:00
|
|
|
static gboolean systemd_journal_read(wtap *wth, wtap_rec *rec, Buffer *buf,
|
|
|
|
int *err, gchar **err_info, gint64 *data_offset);
|
2018-08-27 15:17:32 +00:00
|
|
|
static gboolean systemd_journal_seek_read(wtap *wth, gint64 seek_off,
|
|
|
|
wtap_rec *rec, Buffer *buf, int *err, gchar **err_info);
|
|
|
|
static gboolean systemd_journal_read_export_entry(FILE_T fh, wtap_rec *rec,
|
|
|
|
Buffer *buf, int *err, gchar **err_info);
|
|
|
|
|
|
|
|
// The Journal Export Format specification doesn't place limits on entry
|
|
|
|
// lengths or lines per entry. We do.
|
|
|
|
#define MAX_EXPORT_ENTRY_LENGTH WTAP_MAX_PACKET_SIZE_STANDARD
|
|
|
|
#define MAX_EXPORT_ENTRY_LINES 100
|
|
|
|
|
2020-08-02 21:56:05 +00:00
|
|
|
// Strictly speaking, we only need __REALTIME_TIMESTAMP= since we use
|
|
|
|
// that to set the packet timestamp. According to
|
|
|
|
// https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html
|
|
|
|
// __CURSOR= and __MONOTONIC_TIMESTAMP= should be present as well, so
|
|
|
|
// check for them order to improve our heuristics.
|
2018-08-27 15:17:32 +00:00
|
|
|
#define FLD__CURSOR "__CURSOR="
|
|
|
|
#define FLD__REALTIME_TIMESTAMP "__REALTIME_TIMESTAMP="
|
|
|
|
#define FLD__MONOTONIC_TIMESTAMP "__MONOTONIC_TIMESTAMP="
|
|
|
|
|
2021-02-19 22:46:42 +00:00
|
|
|
static int systemd_journal_file_type_subtype = -1;
|
|
|
|
|
|
|
|
void register_systemd_journal(void);
|
|
|
|
|
2018-08-27 15:17:32 +00:00
|
|
|
wtap_open_return_val systemd_journal_open(wtap *wth, int *err _U_, gchar **err_info _U_)
|
|
|
|
{
|
|
|
|
gchar *entry_buff = (gchar*) g_malloc(MAX_EXPORT_ENTRY_LENGTH);
|
|
|
|
gchar *entry_line = NULL;
|
|
|
|
gboolean got_cursor = FALSE;
|
|
|
|
gboolean got_rt_ts = FALSE;
|
|
|
|
gboolean got_mt_ts = FALSE;
|
|
|
|
int line_num;
|
|
|
|
|
|
|
|
errno = 0;
|
|
|
|
for (line_num = 0; line_num < MAX_EXPORT_ENTRY_LINES; line_num++) {
|
|
|
|
entry_line = file_gets(entry_buff, MAX_EXPORT_ENTRY_LENGTH, wth->fh);
|
|
|
|
if (!entry_line) {
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
if (entry_line[0] == '\n') {
|
|
|
|
break;
|
|
|
|
} else if (strncmp(entry_line, FLD__CURSOR, strlen(FLD__CURSOR)) == 0) {
|
|
|
|
got_cursor = TRUE;
|
|
|
|
} else if (strncmp(entry_line, FLD__REALTIME_TIMESTAMP, strlen(FLD__REALTIME_TIMESTAMP)) == 0) {
|
|
|
|
got_rt_ts = TRUE;
|
|
|
|
} else if (strncmp(entry_line, FLD__MONOTONIC_TIMESTAMP, strlen(FLD__MONOTONIC_TIMESTAMP)) == 0) {
|
|
|
|
got_mt_ts = TRUE;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
g_free(entry_buff);
|
|
|
|
|
|
|
|
if (file_seek(wth->fh, 0, SEEK_SET, err) == -1) {
|
|
|
|
return WTAP_OPEN_ERROR;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!got_cursor || !got_rt_ts || !got_mt_ts) {
|
|
|
|
return WTAP_OPEN_NOT_MINE;
|
|
|
|
}
|
|
|
|
|
2021-02-19 22:46:42 +00:00
|
|
|
wth->file_type_subtype = systemd_journal_file_type_subtype;
|
2018-08-27 15:17:32 +00:00
|
|
|
wth->subtype_read = systemd_journal_read;
|
|
|
|
wth->subtype_seek_read = systemd_journal_seek_read;
|
|
|
|
wth->file_encap = WTAP_ENCAP_SYSTEMD_JOURNAL;
|
|
|
|
wth->file_tsprec = WTAP_TSPREC_USEC;
|
2020-07-29 08:30:54 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Add an IDB; we don't know how many interfaces were
|
|
|
|
* involved, so we just say one interface, about which
|
|
|
|
* we only know the link-layer type, snapshot length,
|
|
|
|
* and time stamp resolution.
|
|
|
|
*/
|
|
|
|
wtap_add_generated_idb(wth);
|
|
|
|
|
2018-08-27 15:17:32 +00:00
|
|
|
return WTAP_OPEN_MINE;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Read the next packet */
|
2019-04-05 01:56:27 +00:00
|
|
|
static gboolean systemd_journal_read(wtap *wth, wtap_rec *rec, Buffer *buf,
|
|
|
|
int *err, gchar **err_info, gint64 *data_offset)
|
2018-08-27 15:17:32 +00:00
|
|
|
{
|
|
|
|
*data_offset = file_tell(wth->fh);
|
|
|
|
|
|
|
|
/* Read record. */
|
2019-04-05 01:56:27 +00:00
|
|
|
if (!systemd_journal_read_export_entry(wth->fh, rec, buf, err, err_info)) {
|
2018-08-27 15:17:32 +00:00
|
|
|
/* Read error or EOF */
|
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
|
|
|
|
return TRUE;
|
|
|
|
}
|
|
|
|
|
|
|
|
static gboolean
|
|
|
|
systemd_journal_seek_read(wtap *wth, gint64 seek_off,
|
|
|
|
wtap_rec *rec, Buffer *buf,
|
|
|
|
int *err, gchar **err_info)
|
|
|
|
{
|
|
|
|
if (file_seek(wth->random_fh, seek_off, SEEK_SET, err) == -1)
|
|
|
|
return FALSE;
|
|
|
|
|
|
|
|
/* Read record. */
|
|
|
|
if (!systemd_journal_read_export_entry(wth->random_fh, rec, buf, err, err_info)) {
|
|
|
|
/* Read error or EOF */
|
|
|
|
if (*err == 0) {
|
|
|
|
/* EOF means "short read" in random-access mode */
|
|
|
|
*err = WTAP_ERR_SHORT_READ;
|
|
|
|
}
|
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
return TRUE;
|
|
|
|
}
|
|
|
|
|
|
|
|
static gboolean
|
|
|
|
systemd_journal_read_export_entry(FILE_T fh, wtap_rec *rec, Buffer *buf, int *err, gchar **err_info)
|
|
|
|
{
|
|
|
|
size_t fld_end = 0;
|
2018-09-10 23:49:36 +00:00
|
|
|
gchar *buf_ptr;
|
2018-08-27 15:17:32 +00:00
|
|
|
gchar *entry_line = NULL;
|
|
|
|
gboolean got_cursor = FALSE;
|
|
|
|
gboolean got_rt_ts = FALSE;
|
|
|
|
gboolean got_mt_ts = FALSE;
|
|
|
|
gboolean got_double_newline = FALSE;
|
|
|
|
int line_num;
|
|
|
|
size_t rt_ts_len = strlen(FLD__REALTIME_TIMESTAMP);
|
|
|
|
|
2018-09-10 23:49:36 +00:00
|
|
|
ws_buffer_assure_space(buf, MAX_EXPORT_ENTRY_LENGTH);
|
|
|
|
buf_ptr = (gchar *) ws_buffer_start_ptr(buf);
|
|
|
|
|
2018-08-27 15:17:32 +00:00
|
|
|
for (line_num = 0; line_num < MAX_EXPORT_ENTRY_LINES; line_num++) {
|
2018-09-10 23:49:36 +00:00
|
|
|
entry_line = file_gets(buf_ptr + fld_end, MAX_EXPORT_ENTRY_LENGTH - (int) fld_end, fh);
|
2018-08-27 15:17:32 +00:00
|
|
|
if (!entry_line) {
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
fld_end += strlen(entry_line);
|
|
|
|
if (entry_line[0] == '\n') {
|
|
|
|
got_double_newline = TRUE;
|
|
|
|
break;
|
|
|
|
} else if (strncmp(entry_line, FLD__CURSOR, strlen(FLD__CURSOR)) == 0) {
|
|
|
|
got_cursor = TRUE;
|
|
|
|
} else if (strncmp(entry_line, FLD__REALTIME_TIMESTAMP, rt_ts_len) == 0) {
|
|
|
|
errno = 0;
|
|
|
|
unsigned long rt_ts = strtoul(entry_line+rt_ts_len, NULL, 10);
|
|
|
|
if (!errno) {
|
|
|
|
rec->ts.secs = (time_t) rt_ts / 1000000;
|
|
|
|
rec->ts.nsecs = (rt_ts % 1000000) * 1000;
|
|
|
|
rec->tsprec = WTAP_TSPREC_USEC;
|
|
|
|
got_rt_ts = TRUE;
|
|
|
|
}
|
|
|
|
} else if (strncmp(entry_line, FLD__MONOTONIC_TIMESTAMP, strlen(FLD__MONOTONIC_TIMESTAMP)) == 0) {
|
|
|
|
got_mt_ts = TRUE;
|
|
|
|
} else if (!strstr(entry_line, "=")) {
|
|
|
|
// Start of binary data.
|
|
|
|
if (fld_end >= MAX_EXPORT_ENTRY_LENGTH - 8) {
|
|
|
|
*err = WTAP_ERR_BAD_FILE;
|
|
|
|
*err_info = g_strdup_printf("systemd: binary length too long");
|
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
guint64 data_len, le_data_len;
|
|
|
|
if (!wtap_read_bytes(fh, &le_data_len, 8, err, err_info)) {
|
|
|
|
return FALSE;
|
|
|
|
}
|
2018-09-10 23:49:36 +00:00
|
|
|
memcpy(buf_ptr + fld_end, &le_data_len, 8);
|
2018-08-27 15:17:32 +00:00
|
|
|
fld_end += 8;
|
|
|
|
data_len = pletoh64(&le_data_len);
|
|
|
|
if (data_len < 1 || data_len - 1 >= MAX_EXPORT_ENTRY_LENGTH - fld_end) {
|
|
|
|
*err = WTAP_ERR_BAD_FILE;
|
|
|
|
*err_info = g_strdup_printf("systemd: binary data too long");
|
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
// Data + trailing \n
|
2018-09-10 23:49:36 +00:00
|
|
|
if (!wtap_read_bytes(fh, buf_ptr + fld_end, (unsigned) data_len + 1, err, err_info)) {
|
2018-08-27 15:17:32 +00:00
|
|
|
return FALSE;
|
|
|
|
}
|
2018-09-07 18:37:16 +00:00
|
|
|
fld_end += (size_t) data_len + 1;
|
2018-08-27 15:17:32 +00:00
|
|
|
}
|
|
|
|
if (MAX_EXPORT_ENTRY_LENGTH < fld_end + 2) { // \n\0
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!got_cursor || !got_rt_ts || !got_mt_ts) {
|
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!got_double_newline && !file_eof(fh)) {
|
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
|
2021-06-17 20:52:45 +00:00
|
|
|
rec->rec_type = REC_TYPE_SYSTEMD_JOURNAL_EXPORT;
|
2021-08-30 02:12:13 +00:00
|
|
|
rec->block = wtap_block_create(WTAP_BLOCK_SYSTEMD_JOURNAL_EXPORT);
|
2018-09-10 23:49:36 +00:00
|
|
|
rec->presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
|
2021-06-17 20:52:45 +00:00
|
|
|
rec->rec_header.systemd_journal_export_header.record_len = (guint32) fld_end;
|
2018-08-27 15:17:32 +00:00
|
|
|
|
|
|
|
return TRUE;
|
|
|
|
}
|
|
|
|
|
wiretap: have file handlers advertise blocks and options supported.
Instead of a "supports name resolution" Boolean and bitflags for types of
comments supported, provide a list of block types that the file
type/subtype supports, with each block type having a list of options
supported. Indicate whether "supported" means "one instance" or
"multiple instances".
"Supports" doesn't just mean "can be written", it also means "could be
read".
Rename WTAP_BLOCK_IF_DESCRIPTION to WTAP_BLOCK_IF_ID_AND_INFO, to
indicate that it provides, in addition to information about the
interface, an ID (implicitly, in pcapng files, by its ordinal number)
that is associated with every packet in the file. Emphasize that in
comments - just because your capture file format can list the interfaces
on which a capture was done, that doesn't mean it supports this; it
doesn't do so if the file doesn't indicate, for every packet, on which
of those interfaces it was captured (I'm looking at *you*, Microsoft
Network Monitor...).
Use APIs to query that information to do what the "does this file
type/subtype support name resolution information", "does this file
type/subtype support all of these comment types", and "does this file
type/subtype support - and require - interface IDs" APIs did.
Provide backwards compatibility for Lua.
This allows us to eliminate the WTAP_FILE_TYPE_SUBTYPE_ values for IBM's
iptrace; do so.
2021-02-21 22:18:04 +00:00
|
|
|
static const struct supported_block_type systemd_journal_blocks_supported[] = {
|
|
|
|
/*
|
2021-02-24 11:09:03 +00:00
|
|
|
* We support systemd journal blocks, with no comments or other options.
|
wiretap: have file handlers advertise blocks and options supported.
Instead of a "supports name resolution" Boolean and bitflags for types of
comments supported, provide a list of block types that the file
type/subtype supports, with each block type having a list of options
supported. Indicate whether "supported" means "one instance" or
"multiple instances".
"Supports" doesn't just mean "can be written", it also means "could be
read".
Rename WTAP_BLOCK_IF_DESCRIPTION to WTAP_BLOCK_IF_ID_AND_INFO, to
indicate that it provides, in addition to information about the
interface, an ID (implicitly, in pcapng files, by its ordinal number)
that is associated with every packet in the file. Emphasize that in
comments - just because your capture file format can list the interfaces
on which a capture was done, that doesn't mean it supports this; it
doesn't do so if the file doesn't indicate, for every packet, on which
of those interfaces it was captured (I'm looking at *you*, Microsoft
Network Monitor...).
Use APIs to query that information to do what the "does this file
type/subtype support name resolution information", "does this file
type/subtype support all of these comment types", and "does this file
type/subtype support - and require - interface IDs" APIs did.
Provide backwards compatibility for Lua.
This allows us to eliminate the WTAP_FILE_TYPE_SUBTYPE_ values for IBM's
iptrace; do so.
2021-02-21 22:18:04 +00:00
|
|
|
*/
|
2021-06-17 20:52:45 +00:00
|
|
|
{ WTAP_BLOCK_SYSTEMD_JOURNAL_EXPORT, MULTIPLE_BLOCKS_SUPPORTED, NO_OPTIONS_SUPPORTED }
|
wiretap: have file handlers advertise blocks and options supported.
Instead of a "supports name resolution" Boolean and bitflags for types of
comments supported, provide a list of block types that the file
type/subtype supports, with each block type having a list of options
supported. Indicate whether "supported" means "one instance" or
"multiple instances".
"Supports" doesn't just mean "can be written", it also means "could be
read".
Rename WTAP_BLOCK_IF_DESCRIPTION to WTAP_BLOCK_IF_ID_AND_INFO, to
indicate that it provides, in addition to information about the
interface, an ID (implicitly, in pcapng files, by its ordinal number)
that is associated with every packet in the file. Emphasize that in
comments - just because your capture file format can list the interfaces
on which a capture was done, that doesn't mean it supports this; it
doesn't do so if the file doesn't indicate, for every packet, on which
of those interfaces it was captured (I'm looking at *you*, Microsoft
Network Monitor...).
Use APIs to query that information to do what the "does this file
type/subtype support name resolution information", "does this file
type/subtype support all of these comment types", and "does this file
type/subtype support - and require - interface IDs" APIs did.
Provide backwards compatibility for Lua.
This allows us to eliminate the WTAP_FILE_TYPE_SUBTYPE_ values for IBM's
iptrace; do so.
2021-02-21 22:18:04 +00:00
|
|
|
};
|
|
|
|
|
2021-02-19 22:46:42 +00:00
|
|
|
static const struct file_type_subtype_info systemd_journal_info = {
|
|
|
|
"systemd journal export", "systemd_journal", NULL, NULL,
|
wiretap: have file handlers advertise blocks and options supported.
Instead of a "supports name resolution" Boolean and bitflags for types of
comments supported, provide a list of block types that the file
type/subtype supports, with each block type having a list of options
supported. Indicate whether "supported" means "one instance" or
"multiple instances".
"Supports" doesn't just mean "can be written", it also means "could be
read".
Rename WTAP_BLOCK_IF_DESCRIPTION to WTAP_BLOCK_IF_ID_AND_INFO, to
indicate that it provides, in addition to information about the
interface, an ID (implicitly, in pcapng files, by its ordinal number)
that is associated with every packet in the file. Emphasize that in
comments - just because your capture file format can list the interfaces
on which a capture was done, that doesn't mean it supports this; it
doesn't do so if the file doesn't indicate, for every packet, on which
of those interfaces it was captured (I'm looking at *you*, Microsoft
Network Monitor...).
Use APIs to query that information to do what the "does this file
type/subtype support name resolution information", "does this file
type/subtype support all of these comment types", and "does this file
type/subtype support - and require - interface IDs" APIs did.
Provide backwards compatibility for Lua.
This allows us to eliminate the WTAP_FILE_TYPE_SUBTYPE_ values for IBM's
iptrace; do so.
2021-02-21 22:18:04 +00:00
|
|
|
FALSE, BLOCKS_SUPPORTED(systemd_journal_blocks_supported),
|
2021-02-19 22:46:42 +00:00
|
|
|
NULL, NULL, NULL
|
|
|
|
};
|
|
|
|
|
|
|
|
void register_systemd_journal(void)
|
|
|
|
{
|
2021-02-24 03:10:35 +00:00
|
|
|
systemd_journal_file_type_subtype = wtap_register_file_type_subtype(&systemd_journal_info);
|
2021-02-19 22:46:42 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Register name for backwards compatibility with the
|
|
|
|
* wtap_filetypes table in Lua.
|
|
|
|
*/
|
|
|
|
wtap_register_backwards_compatibility_lua_name("SYSTEMD_JOURNAL",
|
|
|
|
systemd_journal_file_type_subtype);
|
|
|
|
}
|
|
|
|
|
2018-08-27 15:17:32 +00:00
|
|
|
/*
|
2019-07-26 18:43:17 +00:00
|
|
|
* Editor modelines - https://www.wireshark.org/tools/modelines.html
|
2018-08-27 15:17:32 +00:00
|
|
|
*
|
|
|
|
* Local variables:
|
|
|
|
* c-basic-offset: 4
|
|
|
|
* tab-width: 8
|
|
|
|
* indent-tabs-mode: nil
|
|
|
|
* End:
|
|
|
|
*
|
|
|
|
* vi: set shiftwidth=4 tabstop=8 expandtab:
|
|
|
|
* :indentSize=4:tabSize=8:noTabs=true:
|
|
|
|
*/
|