-
Notifications
You must be signed in to change notification settings - Fork 19
/
snoop.c
2052 lines (1790 loc) · 61.5 KB
/
snoop.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
/**
* Simple Fuzz
* Copyright (c) 2009-2011, Aaron Conole <[email protected]>
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. Neither the name of the author nor the names of its contributors
* may be used to endorse or promote products derived from this software
* without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
*/
#define DEBUG_MODE 0
#include <stdio.h>
#include <fcntl.h>
#ifdef __WIN32__
# include "windows.h"
# include "winsock2.h"
struct timezone {
int tz_minuteswest; /* minutes west of Greenwich */
int tz_dsttime; /* type of DST correction */
};
extern int gettimeofday(struct timeval *, struct timezone *);
extern time_t time(time_t *);
typedef unsigned int uint32_t;
/* if we don't have mstcpip "special" codes */
# ifndef SIO_RCVALL
# define SIO_RCVALL _WSAIOW(IOC_VENDOR,1)
# endif /* SIO_RCVALL */
# define ERROR_PRINT _PANIC_
# define __LITTLE_ENDIAN__
/* the following defines are taken from if_ether.h
* credit must be given to:
* Author: Fred N. van Kempen, <[email protected]>
* Donald Becker, <[email protected]>
* Alan Cox, <[email protected]>
* Steve Whitehouse, <[email protected]>
*/
# define ETH_P_IP 0x0800 /* Internet Protocol packet */
# define ETH_P_X25 0x0805 /* CCITT X.25 */
# define ETH_P_ARP 0x0806 /* Address Resolution packet */
# define ETH_P_BPQ 0x08FF /* G8BPQ AX.25 Ethernet Packet [ NOT AN OFFICIALLY REGISTERED ID ] */
# define ETH_P_IEEEPUP 0x0a00 /* Xerox IEEE802.3 PUP packet */
# define ETH_P_IEEEPUPAT 0x0a01 /* Xerox IEEE802.3 PUP Addr Trans packet */
# define ETH_P_DEC 0x6000 /* DEC Assigned proto */
# define ETH_P_DNA_DL 0x6001 /* DEC DNA Dump/Load */
# define ETH_P_DNA_RC 0x6002 /* DEC DNA Remote Console */
# define ETH_P_DNA_RT 0x6003 /* DEC DNA Routing */
# define ETH_P_LAT 0x6004 /* DEC LAT */
# define ETH_P_DIAG 0x6005 /* DEC Diagnostics */
# define ETH_P_CUST 0x6006 /* DEC Customer use */
# define ETH_P_SCA 0x6007 /* DEC Systems Comms Arch */
# define ETH_P_RARP 0x8035 /* Reverse Addr Res packet */
# define ETH_P_ATALK 0x809B /* Appletalk DDP */
# define ETH_P_AARP 0x80F3 /* Appletalk AARP */
# define ETH_P_8021Q 0x8100 /* 802.1Q VLAN Extended Header */
# define ETH_P_IPX 0x8137 /* IPX over DIX */
# define ETH_P_IPV6 0x86DD /* IPv6 over bluebook */
# define ETH_P_PAUSE 0x8808 /* IEEE Pause frames. See 802.3 31B */
# define ETH_P_SLOW 0x8809 /* Slow Protocol. See 802.3ad 43B */
# define ETH_P_WCCP 0x883E /* Web-cache coordination protocol
* defined in draft-wilson-wrec-wccp-v2-00.txt */
# define ETH_P_PPP_DISC 0x8863 /* PPPoE discovery messages */
# define ETH_P_PPP_SES 0x8864 /* PPPoE session messages */
# define ETH_P_MPLS_UC 0x8847 /* MPLS Unicast traffic */
# define ETH_P_MPLS_MC 0x8848 /* MPLS Multicast traffic */
# define ETH_P_ATMMPOA 0x884c /* MultiProtocol Over ATM */
# define ETH_P_ATMFATE 0x8884 /* Frame-based ATM Transport
* over Ethernet
*/
# define ETH_P_AOE 0x88A2 /* ATA over Ethernet */
# define ETH_P_TIPC 0x88CA /* TIPC */
# define INCREMENT_CAP 0
# define SOCK_FAM_TYPE AF_INET
# define SOCK_PROTO_TYPE IPPROTO_RAW
typedef unsigned int uint;
typedef unsigned short ushort;
struct timespec {
long tv_sec;
long tv_nsec;
};
#else /* ! __WIN32__ */
# include <stdint.h>
# include <sys/param.h>
# include <sys/socket.h>
# include <resolv.h>
# include <arpa/inet.h>
# include <net/ethernet.h>
# include <errno.h>
# include <sys/types.h>
# include <string.h>
# include <netinet/in_systm.h>
# include <netinet/in.h>
# include <netinet/tcp.h>
# include <netinet/ip.h>
# include <unistd.h>
# include <sys/select.h>
# include <sys/time.h>
# define ERROR_PRINT perror
# ifdef __BYTE_ORDER
# if __BYTE_ORDER == __LITTLE_ENDIAN
# define __LITTLE_ENDIAN__ 1
# else
# if __BYTE_ORDER == __BIG_ENDIAN
# define __BIG_ENDIAN__ 1
# else
# error "Unknown byte order"
# endif
# endif /* __BYTE_ORDER */
# endif
# ifdef __linux__
//# include <netpacket/packet.h>
# include <features.h>
# include <linux/if.h>
# include <linux/if_ether.h>
# include <linux/if_packet.h>
# include <sys/ioctl.h>
# include <sched.h>
# define SOCK_FAM_TYPE PF_PACKET
# define SOCK_PROTO_TYPE htons(ETH_P_ALL)
# endif /*__LINUX__*/
# include <signal.h>
# include <time.h>
# include <unistd.h>
#endif /* !__WIN32__ */
#include "os-abs.h"
#define IP_SIZE 4
#ifndef ETH_ALEN
# define ETH_ALEN 6
#endif /*ETH_ALEN*/
#define ETH_SRC_FILTER 0x00000001
#define ETH_DST_FILTER 0x00000002
#define ETH_TYPE_FILTER 0x00000004
#define ETH_VLAN_FILTER 0x00000008
#define IP_SRC_FILTER 0x00000010
#define IP_DST_FILTER 0x00000020
#define IP_PROTO_FILTER 0x00000040
#define UDP_TCP_SPORT_FILTER 0x00000080
#define UDP_TCP_DPORT_FILTER 0x00000100
#define ARBITRARY_U8_FILTER 0x00000200
#define ARBITRARY_U16_FILTER 0x00000400
#define ARBITRARY_U32_FILTER 0x00000800
#define ARBITRARY_MSK_FILTER 0x00001000
#define IP_TOS_BYTE_FILTER 0x00002000
#define STRING_FILTER 0x00004000
typedef unsigned char uchar;
uint filter_mask = 0;
uchar eth_src_is_mac_filter[ETH_ALEN];
uchar eth_src_not = 0;
uchar eth_dst_is_mac_filter[ETH_ALEN];
uchar eth_dst_not = 0;
uint eth_type_is_filter;
uchar eth_type_not = 0;
uint eth_vlan_is_filter;
uchar eth_vlan_not = 0;
uint need_IP = 0;
uint ip_src_is_filter;
uchar ip_src_not = 0;
uint ip_dst_is_filter;
uchar ip_dst_not = 0;
uchar ip_addr_or = 0;
uint ipproto_is_filter;
uchar ipproto_not = 0;
uint udp_tcp_sport_is_filter;
uchar udp_tcp_sport_not = 0;
uint udp_tcp_dport_is_filter;
uchar udp_tcp_dport_not = 0;
uint arbitrary_u8_filter_pos = 0;
uchar arbitrary_u8_filter;
uchar arbitrary_u8_not = 0;
uint arbitrary_u16_filter_pos = 0;
ushort arbitrary_u16_filter;
uchar arbitrary_u16_not = 0;
uint arbitrary_u32_filter_pos = 0;
uint arbitrary_u32_filter;
uchar arbitrary_u32_not = 0;
uint arbitrary_msk_filter_pos = 0;
uint arbitrary_msk_filter;
uchar arbitrary_msk_not = 0;
uchar ip_tos_byte_filter;
uchar ip_tos_byte_filter_not = 0;
uchar string_filter[1024] = {0};
uchar string_filter_not = 0;
typedef enum { eETH_ADDR, eIP_ADDR } EAddress;
uint peak_rate = 0;
uint avg_rate = 0;
uint avg_samples = 0;
uint min_rate = 0xffffffff;
uint current_second_bytes = 0;
struct histogram_row
{
uint pkt_size;
uint pkt_count;
uint32_t time_slice;
};
#define MAX_NUM_ROWS 1522
struct histogram_row histogram[MAX_NUM_ROWS+1];
struct histogram_row burst_hist[65535];
/*--------------------------------------------------------------------*/
/* This structure defines the fields within the ip frame. Since this */
/* program gets the lowest-level packet, fragmented packets are not */
/* reassembled. The first few fields contain the MAC addresses of the*/
/* source and destination. Note that this structure is set for little-*/
/* endian format. */
/* So I cheated and stole someone else's ip header... sue me */
/*--------------------------------------------------------------------*/
#pragma pack(1)
struct ip_packet {
#ifdef __LITTLE_ENDIAN__
uint header_len:4; /* header length in words in 32bit words */
uint version:4; /* 4-bit version */
#else /*!__LITTLE_ENDIAN__ */
uint version:4;
uint header_len:4;
#endif/*!__LITTLE_ENDIAN__ */
uint serve_type:8; /* how to service packet */
uint packet_len:16; /* total size of packet in bytes */
uint ID:16; /* fragment ID */
#ifdef __LITTLE_ENDIAN__
uint frag_offset:13; /* to help reassembly */
uint more_frags:1; /* flag for "more frags to follow" */
uint dont_frag:1; /* flag to permit fragmentation */
uint __reserved:1; /* always zero */
#else/*!__LITTLE_ENDIAN__ */
uint __reserved:1;
uint more_frags:1;
uint dont_frag:1;
uint frag_offset:13;
#endif/*!__LITTLE_ENDIAN__ */
uint time_to_live:8; /* maximum router hop count */
uint protocol:8; /* ICMP, UDP, TCP */
uint hdr_chksum:16; /* ones-comp. checksum of header */
union
{
uint addr:32;
uchar IPv4_src[IP_SIZE]; /* IP address of originator */
} ip_src;
union
{
uint addr:32;
uchar IPv4_dst[IP_SIZE]; /* IP address of destination */
} ip_dst;
uchar options[0]; /* up to 40 bytes */
uchar data[0]; /* message data up to 64KB */
};
struct tcpudp_port_header
{
uint srcPort: 16;
uint dstPort: 16;
};
typedef struct _udpHdr
{
uint srcPort: 16;
uint dstPort: 16;
uint udpPktLen: 16;
uint cksum: 16;
}udpHdr;
typedef union _optsUnion
{
struct
{
#ifdef __LITTLE_ENDIAN__
uint fin:1;
uint syn:1;
uint rst:1;
uint psh:1;
uint ack:1;
uint urg:1;
uint res:2;
#elif defined __BIG_ENDIAN__
uint res:2;
uint urg:1;
uint ack:1;
uint psh:1;
uint rst:1;
uint syn:1;
uint fin:1;
#else
# error "Set Big/Little Endianness"
#endif
}flags;
uchar options;
}opts;
typedef struct _tcpHdr
{
uint srcPort:16;
uint dstPort:16;
uint seqNum;
uint ackNum;
#ifdef __LITTLE_ENDIAN__
uint reserved : 4; // 4 bits
uint dataOffset : 4; // 4 bits
#elif defined __BIG_ENDIAN__
uint dataOffset : 4; // 4 bits
uint reserved : 4; // 4 bits
#else
# error "Set Big/Little endianness"
#endif
opts options;
uint window: 16;
uint cksum: 16;
uint urgp: 16;
} tcpHdr;
struct eth_packet {
uchar dst_mac[ETH_ALEN];
uchar src_mac[ETH_ALEN];
uint eth_type:16;
};
struct eth_8021q_packet {
uchar dst_mac[ETH_ALEN];
uchar src_mac[ETH_ALEN];
uint eth_type:16;
uint priority: 3;
uint cfi: 1;
uint vlan_id: 12;
uint ether_type:16;
};
struct tcp_pseudo /*the tcp pseudo header*/
{
unsigned int src_addr;
unsigned int dst_addr;
unsigned char zero;
unsigned char proto;
unsigned short length;
} pseudohead;
#pragma pack()
inline unsigned int endian_swap_32(unsigned int x)
{
x = (x>>24) |
((x<<8) & 0x00ff0000) |
((x>>8) & 0x0000ff00) |
(x<<24) ;
return x;
}
inline unsigned short endian_swap_16(unsigned short x)
{
x = (x>>8)|
(x<<8);
return x;
}
void DebugPrint(char *buf){
#if DEBUG_MODE
printf("DEBUG - %s\n", buf);
#endif /* DEBUG */
}
#include "sfuzz-plugin.h"
long checksum(unsigned short *addr, unsigned int count) {
/* Compute Internet Checksum for "count" bytes
* beginning at location "addr".
*/
register long sum = 0;
while( count > 1 ) {
/* This is the inner loop */
sum += * addr++;
count -= 2;
}
/* Add left-over byte, if any */
if( count > 0 )
sum += * (unsigned char *) addr;
/* Fold 32-bit sum to 16 bits */
while (sum>>16)
sum = (sum & 0xffff) + (sum >> 16);
return ~sum;
}
long get_udp_checksum(struct ip_packet * myip, udpHdr * myudp)
{
long res;
unsigned short total_len = ntohs(myip->packet_len);
int udpdatalen = total_len - sizeof(udpHdr) - (myip->header_len*4);
pseudohead.src_addr=myip->ip_src.addr;
pseudohead.dst_addr=myip->ip_dst.addr;
pseudohead.zero=0;
pseudohead.proto=IPPROTO_TCP;
pseudohead.length=htons(sizeof(udpHdr) + udpdatalen );
int totaludp_len = sizeof(struct tcp_pseudo) + sizeof(udpHdr) + udpdatalen;
unsigned short * udp = (unsigned short*)malloc(totaludp_len);
memcpy((unsigned char *)udp,&pseudohead,sizeof(struct tcp_pseudo));
memcpy((unsigned char *)udp+sizeof(struct tcp_pseudo),(unsigned char *)myudp,sizeof(udpHdr));
memcpy((unsigned char *)udp+sizeof(struct tcp_pseudo)+sizeof(udpHdr), (unsigned char *)myip+(myip->header_len*4)+(sizeof(udpHdr)), udpdatalen);
res = checksum(udp,totaludp_len);
free(udp);
return res;
}
long get_tcp_checksum(struct ip_packet * myip, tcpHdr * mytcp)
{
long res = 0;
unsigned short total_len = ntohs(myip->packet_len);
int tcpopt_len = mytcp->dataOffset*4 - 20;
int tcpdatalen = total_len - (mytcp->dataOffset*4) - (myip->header_len*4);
pseudohead.src_addr=myip->ip_src.addr;
pseudohead.dst_addr=myip->ip_dst.addr;
pseudohead.zero=0;
pseudohead.proto=IPPROTO_TCP;
pseudohead.length=htons(sizeof(tcpHdr) + tcpopt_len + tcpdatalen);
int totaltcp_len = sizeof(struct tcp_pseudo) + sizeof(tcpHdr) + tcpopt_len + tcpdatalen;
unsigned short * tcp = (unsigned short*)malloc(totaltcp_len);
memcpy((unsigned char *)tcp,&pseudohead,sizeof(struct tcp_pseudo));
memcpy((unsigned char *)tcp+sizeof(struct tcp_pseudo),(unsigned char *)mytcp,sizeof(tcpHdr));
memcpy((unsigned char *)tcp+sizeof(struct tcp_pseudo)+sizeof(tcpHdr), (unsigned char *)myip+(myip->header_len*4)+(sizeof(tcpHdr)), tcpopt_len);
memcpy((unsigned char *)tcp+sizeof(struct tcp_pseudo)+sizeof(tcpHdr)+tcpopt_len, (unsigned char *)mytcp+(mytcp->dataOffset*4), tcpdatalen);
res = checksum(tcp,totaltcp_len);
free(tcp);
return res;
}
plugin_provisor *g_plugin;
void WriteAddr(char *buf, unsigned int buflen,
char *msg, unsigned char *addr, EAddress is_ip){
int i,l = 0;
static struct {
int len;
char *fmt;
char delim;
} addr_fmt[] = {{ETH_ALEN, "%x", ':'}, {IP_SIZE, "%d", '.'}};
if(msg != NULL)
l += snprintf(buf, buflen, "%s", msg);
for ( i = 0; i < addr_fmt[is_ip].len; i++ ){
if(l < buflen) l += snprintf(buf+l, buflen - l,
addr_fmt[is_ip].fmt, addr[i]);
if ( i < addr_fmt[is_ip].len-1 )
if(l < buflen){ buf[l++] = addr_fmt[is_ip].delim; }
}
}
void PrintAddr(char* msg, unsigned char *addr, EAddress is_ip)
{
char buf[8192] = {0};
WriteAddr(buf, 8192, msg, addr, is_ip);
printf("%s",buf);
}
char *GetProtocol(uint value){
static char protohex[5] = {0};
switch (value){
case IPPROTO_IP: return "IP";
case IPPROTO_ICMP: return "ICMP";
case IPPROTO_IGMP: return "IGMP";
#ifndef __WIN32__
case IPPROTO_PIM: return "PIM";
case IPPROTO_RSVP: return "RSVP";
case IPPROTO_GRE: return "GRE";
case IPPROTO_IPIP: return "IPIP";
case IPPROTO_EGP: return "EGP";
#endif
case IPPROTO_TCP: return "TCP";
case IPPROTO_PUP: return "PUP";
case IPPROTO_UDP: return "UDP";
case IPPROTO_IDP: return "IDP";
case IPPROTO_IPV6: return "IPV6";
case IPPROTO_RAW: return "RAW";
default:
snprintf(protohex, 5, "0x%02x", value);
return protohex;
}
}
char *GetEtherType(int eth_type)
{
static char protohex[12] = {0};
switch(eth_type)
{
case ETH_P_IP: return "IPv4";
case ETH_P_8021Q: return "802.1Q";
case ETH_P_ARP: return "ARP";
#ifndef __WIN32__
case ETH_P_LOOP: return "EthLoop";
#endif
case ETH_P_X25: return "X.25";
case ETH_P_RARP: return "RARP";
case ETH_P_IPV6: return "IPv6";
case ETH_P_TIPC: return "TIPC";
default:
snprintf(protohex, 12, "0x%04x", eth_type);
return protohex;
}
}
int eth_contains_ip(struct eth_packet *eth_pkt)
{
if(ntohs(eth_pkt->eth_type) == ETH_P_8021Q)
{
int lctr = 1;
struct eth_8021q_packet *eth_vlan_pkt =
(struct eth_8021q_packet *)eth_pkt;
while(ntohs(eth_vlan_pkt->ether_type) == ETH_P_8021Q)
{
++lctr;
char *cur_ptr = (char *)eth_vlan_pkt;
cur_ptr += 4;
eth_vlan_pkt = (struct eth_8021q_packet *)cur_ptr;
}
if(ntohs(eth_vlan_pkt->ether_type) != ETH_P_IP)
return 0;
return 14 + (lctr * 4);
}
else if (ntohs(eth_pkt->eth_type) == ETH_P_IP)
return 14;
return 0;
}
int ipcmp(uchar *ipstruct_addr, int addr)
{
int ipstr_addr = *((int*)ipstruct_addr);
#if DEBUG_MODE
printf("IPAddrFilter: in[%X],flt[%X]\n", addr, ipstr_addr);
#endif
return (addr) ? ((addr == ipstr_addr) ? 1 : 0) : 1;
}
int ethmask_cmp(uchar *retr_addr, uchar *filter_addr)
{
int i =0 ;
#if DEBUG_MODE
printf("EtherAddrFilter: in[%06X],flt[%06X]\n",
(unsigned int)retr_addr,
(unsigned int)filter_addr);
#endif
for(;i<ETH_ALEN;++i)
{
if(filter_addr[i] != retr_addr[i])
return 0;
}
return 1;
}
int ethtype_cmp(uint retr_type, uint filter_type)
{
return (retr_type == filter_type) ? 1 : 0;
}
int ethvlan_cmp(struct eth_packet *eth_pkt, uint vlan_tag)
{
struct eth_8021q_packet *q_pkt = (void *)(eth_pkt);
uint retr_id;
if(!ethtype_cmp(ntohs(eth_pkt->eth_type), ETH_P_8021Q))
return 0;
retr_id = q_pkt->vlan_id;
return (ntohs(retr_id) == vlan_tag) ? 1 : 0;
}
int udptcp_sport_cmp(struct ip_packet *ip, uint filter_port)
{
uchar *buffer = (void *)ip;
struct tcpudp_port_header *hdr = (void *)(buffer + (ip->header_len*4));
if((ip->protocol != IPPROTO_TCP) &&
(ip->protocol != IPPROTO_UDP))
return 0;
return (ntohs(hdr->srcPort) == filter_port) ? 1 : 0;
}
int udptcp_dport_cmp(struct ip_packet *ip, uint filter_port)
{
uchar *buffer = (void *)ip;
struct tcpudp_port_header *hdr = (void *)(buffer + (ip->header_len*4));
if((ip->protocol != IPPROTO_TCP) &&
(ip->protocol != IPPROTO_UDP))
return 0;
return (ntohs(hdr->dstPort) == filter_port) ? 1 : 0;
}
#pragma pack(1)
struct arp_packet {
uint hw_type : 16;
uint proto_type : 16;
uchar alen;
uchar proto_alen;
uint opcode : 16;
};
#pragma pack()
#define ARP_NETROM 0
#define ARP_ETHER 1
#define ARP_EETHER 2
#define ARP_AX25 3
#define ARP_PRONET 4
#define ARP_CHAOS 5
#define ARP_BLANK 6
#define ARP_ARCNET 7
#define ARP_APPLET 8
#define ARP_REQUEST 1
#define ARP_REPLY 2
char *arp_hwtype_tostr(unsigned short hwtype)
{
switch (hwtype)
{
case ARP_NETROM:
return "NetRom";
case ARP_ETHER:
return "Ethernet";
case ARP_EETHER:
return "ExpEther";
case ARP_AX25:
return "AX.25";
case ARP_PRONET:
return "ProNet";
case ARP_CHAOS:
return "CHAOS";
case ARP_BLANK:
return "\"blank\"";
case ARP_ARCNET:
return "ARCNET";
case ARP_APPLET:
return "APPLETalk";
default:
return "unknown";
}
}
char *arp_target_proto(struct arp_packet *arp)
{
unsigned char *tgt_proto_start;
static char buf[80] = {0};
if((ntohs(arp->hw_type) != ARP_ETHER) || (ntohs(arp->proto_type) != ETH_P_IP))
{
return "???";
}
tgt_proto_start = ((unsigned char *) arp);
tgt_proto_start += sizeof(struct arp_packet);
tgt_proto_start += 16;
WriteAddr(buf, 80, NULL, tgt_proto_start, eIP_ADDR);
return buf;
}
char *arp_target_hw(struct arp_packet *arp)
{
unsigned char *tgt_hw_start;
static char buf[80] = {0};
if((ntohs(arp->hw_type) != ARP_ETHER) || (ntohs(arp->proto_type) != ETH_P_IP))
{
return "???";
}
tgt_hw_start = ((unsigned char *) arp);
tgt_hw_start += sizeof(struct arp_packet);
tgt_hw_start += 10;
WriteAddr(buf, 80, NULL, tgt_hw_start, eETH_ADDR);
return buf;
}
char *arp_sender_proto(struct arp_packet *arp)
{
unsigned char *snd_proto_start;
static char buf[80] = {0};
if((ntohs(arp->hw_type) != ARP_ETHER) || (ntohs(arp->proto_type) != ETH_P_IP))
{
return "???";
}
snd_proto_start = ((unsigned char *) arp) ;
snd_proto_start += sizeof(struct arp_packet);
snd_proto_start += 6;
WriteAddr(buf, 80, NULL, snd_proto_start, eIP_ADDR);
return buf;
}
char *arp_sender_hw(struct arp_packet *arp)
{
unsigned char *snd_hw_start;
static char buf[80] = {0};
if((ntohs(arp->hw_type) != ARP_ETHER) || (ntohs(arp->proto_type) != ETH_P_IP))
{
return "???";
}
snd_hw_start = ((unsigned char *) arp);
snd_hw_start += sizeof(struct arp_packet);
WriteAddr(buf, 80, NULL, snd_hw_start, eETH_ADDR);
return buf;
}
void PrintExtraEtherInfo(struct eth_packet *eth_pkt)
{
struct eth_8021q_packet *q_pkt = (void *)(eth_pkt);
if(ethtype_cmp(ntohs(eth_pkt->eth_type), ETH_P_8021Q))
{
printf(",vlan_prio=%d,cfi=%c,vlan_id=%d\nVlanEtherType=%s",
q_pkt->priority, q_pkt->cfi ? 'T' : 'F',
ntohs(q_pkt->vlan_id),GetEtherType(ntohs(q_pkt->ether_type)));
return;
}
if(ethtype_cmp(ntohs(eth_pkt->eth_type), ETH_P_ARP))
{
char *tmp = (char *)eth_pkt;
tmp += sizeof(struct eth_packet);
struct arp_packet *arp = (struct arp_packet *) tmp;
printf("\nARP HW Type: %x[%s]\n", ntohs(arp->hw_type),
arp_hwtype_tostr(ntohs(arp->hw_type)));
if(ntohs(arp->opcode) == ARP_REQUEST)
{
printf("Who has ");
printf("(%s)", GetEtherType(ntohs(arp->proto_type)));
printf(" : %s; tell %s @ %s",
arp_target_proto(arp),
arp_sender_proto(arp), arp_sender_hw(arp));
}
else if(ntohs(arp->opcode) == ARP_REPLY)
{
printf("(%s)", GetEtherType(ntohs(arp->proto_type)));
printf(" : tell %s @ %s that %s is reached \n\tvia %s",
arp_target_proto(arp), arp_target_hw(arp),
arp_sender_proto(arp), arp_sender_hw(arp));
}
else
printf(", ARP OPCODE unknown :%d", ntohs(arp->opcode));
printf("\n");
}
}
#define FILTER_CHK_MASK(a,b) (((uint)a&(uint)b) == (uint)b)
#define FILTER_SET_MASK(a,b) (!FILTER_CHK_MASK(a,b)?a |= b : a)
void *__internal_memmem(const void *hs, size_t hsl, const void *nd, size_t ndl);
char DumpPacket(char *buffer, int len, int quiet)
{
struct eth_packet *eth_pkt=(void *)(buffer);
struct ip_packet *ip = NULL;
if(FILTER_CHK_MASK(filter_mask, STRING_FILTER))
{
void *truth;
size_t ndl = strlen((const char *)string_filter);
size_t mmlen = (size_t) len;
truth = __internal_memmem(buffer, mmlen, string_filter, ndl);
if(truth != NULL)
{
if(string_filter_not)
return -1;
}else if(truth == NULL)
return -1;
}
if(FILTER_CHK_MASK(filter_mask, ARBITRARY_MSK_FILTER))
{
uint ff = ntohl(*((uint*)(buffer+arbitrary_msk_filter_pos)));
if(len < arbitrary_msk_filter_pos+4)
return -1;
uchar truth = (FILTER_CHK_MASK(ff, arbitrary_msk_filter));
if(truth)
{
if(arbitrary_msk_not)
return -1;
}else if (!truth)
return -1;
}
if(FILTER_CHK_MASK(filter_mask, ARBITRARY_U8_FILTER))
{
if(len < arbitrary_u8_filter_pos+1)
return -1;
if((buffer[arbitrary_u8_filter_pos] == arbitrary_u8_filter))
{
if(arbitrary_u8_not)
return -1;
}else if (!arbitrary_u8_not)
return -1;
}
if(FILTER_CHK_MASK(filter_mask, ARBITRARY_U16_FILTER))
{
if(len < arbitrary_u16_filter_pos+2)
return -1;
if((ntohs(*((ushort*)(buffer+arbitrary_u16_filter_pos))) ==
arbitrary_u16_filter))
{
if(arbitrary_u16_not)
return -1;
}else if(!arbitrary_u16_not)
return -1;
}
if(FILTER_CHK_MASK(filter_mask, ARBITRARY_U32_FILTER))
{
if(len < arbitrary_u32_filter_pos+4)
return -1;
if((ntohl(*((uint*)(buffer+arbitrary_u32_filter_pos))) ==
arbitrary_u32_filter))
{
if(arbitrary_u32_not)
return -1;
}
else if (!arbitrary_u32_not)
return -1;
}
/* filter out the cruft - in userspace I know! */
if(FILTER_CHK_MASK(filter_mask, ETH_SRC_FILTER))
{
if(ethmask_cmp(eth_pkt->src_mac, eth_src_is_mac_filter))
{
if(eth_src_not)
return -1;
}else if(!eth_src_not)
return -1;
}
if(FILTER_CHK_MASK(filter_mask, ETH_DST_FILTER))
{
if(ethmask_cmp(eth_pkt->dst_mac, eth_dst_is_mac_filter))
{
if(eth_dst_not)
return -1;
}else if (!eth_dst_not)
return -1;
}
if(FILTER_CHK_MASK(filter_mask, ETH_TYPE_FILTER))
{
if(ethtype_cmp(ntohs(eth_pkt->eth_type), eth_type_is_filter))
{
if(eth_type_not)
return -1;
}else if(!eth_type_not)
return -1;
}
if(FILTER_CHK_MASK(filter_mask, ETH_VLAN_FILTER))
{
if(ethvlan_cmp(eth_pkt, eth_vlan_is_filter))
{
if(eth_vlan_not)
return -1;
}else if(!eth_vlan_not)
return -1;
}
if(eth_contains_ip(eth_pkt))
{
char skip_dest_addr = 0;
ip = (void *)(buffer + eth_contains_ip(eth_pkt));
if(FILTER_CHK_MASK(filter_mask, IP_SRC_FILTER))
{
if(ipcmp(ip->ip_src.IPv4_src, ip_src_is_filter))
{
if(ip_src_not)
return -1;
// matched the source, skip dest addr
if(ip_addr_or) skip_dest_addr = 1;
}else if(!ip_src_not && !ip_addr_or)
return -1;
}
if(!skip_dest_addr && FILTER_CHK_MASK(filter_mask, IP_DST_FILTER))
{
if(ipcmp(ip->ip_dst.IPv4_dst, ip_dst_is_filter))
{
if(ip_dst_not)
return -1;
}else if(!ip_dst_not)
return -1;
}
if(FILTER_CHK_MASK(filter_mask, IP_TOS_BYTE_FILTER))
{
if(ip->serve_type == ip_tos_byte_filter)
{
if(ip_tos_byte_filter_not)
return -1;
}else if (!ip_tos_byte_filter_not)
return -1;
}
if(FILTER_CHK_MASK(filter_mask, IP_PROTO_FILTER))
{
if(ip->protocol == ipproto_is_filter)
{
if(ipproto_not)
return -1;
}else if (!ipproto_not)
return -1;