6:35 a.m.
Signed-off-by: Vitezslav Samel <vitezslav(a)samel.cz>
---
src/itrafmon.c | 697 ++++++++++++++++++++++++++++----------------------------
1 files changed, 349 insertions(+), 348 deletions(-)
diff --git a/src/itrafmon.c b/src/itrafmon.c
index 597f82c..1e8dd7c 100644
--- a/src/itrafmon.c
+++ b/src/itrafmon.c
@@ -1141,390 +1141,391 @@ void ipmon(struct OPTIONS *options, struct filterstate
*ofilter,
}
}
- if (readlen > 0) {
- total_pkts++;
- show_stats(statwin, total_pkts);
-
- pkt_result =
- processpacket((char *) tpacket, &packet,
- (unsigned int *) &readlen, &br,
- &sport, &dport, &fromaddr,
- ofilter, MATCH_OPPOSITE_ALWAYS,
- ifname, options->v6inv4asv6);
-
- if (pkt_result != PACKET_OK)
- continue;
-
- if ((fromaddr.sll_protocol != ETH_P_IP)
- && (fromaddr.sll_protocol != ETH_P_IPV6)) {
- add_othp_entry(&othptbl, &table, 0, 0, NULL,
- NULL, NOT_IP,
- fromaddr.sll_protocol, fromaddr.sll_hatype,
- (char *) tpacket,
- (char *) packet, br, ifname, 0,
- 0, 0, logging, logfile,
- options->servnames, 0, &nomem);
- continue;
+ if (readlen <= 0)
+ continue;
+
+ total_pkts++;
+ show_stats(statwin, total_pkts);
+
+ pkt_result =
+ processpacket((char *) tpacket, &packet,
+ (unsigned int *) &readlen, &br,
+ &sport, &dport, &fromaddr,
+ ofilter, MATCH_OPPOSITE_ALWAYS,
+ ifname, options->v6inv4asv6);
+
+ if (pkt_result != PACKET_OK)
+ continue;
+
+ if ((fromaddr.sll_protocol != ETH_P_IP)
+ && (fromaddr.sll_protocol != ETH_P_IPV6)) {
+ add_othp_entry(&othptbl, &table, 0, 0, NULL,
+ NULL, NOT_IP,
+ fromaddr.sll_protocol, fromaddr.sll_hatype,
+ (char *) tpacket,
+ (char *) packet, br, ifname, 0,
+ 0, 0, logging, logfile,
+ options->servnames, 0, &nomem);
+ continue;
+ } else {
+ if (fromaddr.sll_protocol == ETH_P_IP) {
+ ippacket = (struct iphdr *) packet;
+ iphlen = ippacket->ihl * 4;
+ ip6packet = NULL;
+ protocol = ippacket->protocol;
+ frag_off = ippacket->frag_off;
} else {
- if (fromaddr.sll_protocol == ETH_P_IP) {
- ippacket = (struct iphdr *) packet;
- iphlen = ippacket->ihl * 4;
- ip6packet = NULL;
- protocol = ippacket->protocol;
- frag_off = ippacket->frag_off;
+ ip6packet = (struct ip6_hdr *) packet;
+ iphlen = 40;
+ ippacket = NULL;
+ protocol = ip6packet->ip6_nxt;
+ frag_off = 0;
+ }
+ transpacket =
+ (struct tcphdr *) (packet + iphlen);
+
+ if (protocol == IPPROTO_TCP) {
+
+ if (ippacket != NULL) {
+ tcpentry =
+ in_table(&table,
+ ippacket->saddr,
+ ippacket->daddr,
+ NULL, NULL,
+ ntohs(sport),
+ ntohs(dport),
+ ifname, logging,
+ logfile, &nomem,
+ options);
} else {
- ip6packet = (struct ip6_hdr *) packet;
- iphlen = 40;
- ippacket = NULL;
- protocol = ip6packet->ip6_nxt;
- frag_off = 0;
+ tcpentry =
+ in_table(&table, 0, 0,
+ (uint8_t
+ *) (&ip6packet->
+ ip6_src.
+ s6_addr),
+ (uint8_t
+ *) (&ip6packet->
+ ip6_dst.
+ s6_addr),
+ ntohs(sport),
+ ntohs(dport),
+ ifname, logging,
+ logfile, &nomem,
+ options);
}
- transpacket =
- (struct tcphdr *) (packet + iphlen);
-
- if (protocol == IPPROTO_TCP) {
-
- if (ippacket != NULL) {
- tcpentry =
- in_table(&table,
- ippacket->saddr,
- ippacket->daddr,
- NULL, NULL,
- ntohs(sport),
- ntohs(dport),
- ifname, logging,
- logfile, &nomem,
- options);
- } else {
- tcpentry =
- in_table(&table, 0, 0,
- (uint8_t
- *) (&ip6packet->
- ip6_src.
- s6_addr),
- (uint8_t
- *) (&ip6packet->
- ip6_dst.
- s6_addr),
- ntohs(sport),
- ntohs(dport),
- ifname, logging,
- logfile, &nomem,
- options);
- }
- /*
- * Add a new entry if it doesn't exist, and,
- * to reduce the chances of stales, not a FIN.
- */
+ /*
+ * Add a new entry if it doesn't exist, and,
+ * to reduce the chances of stales, not a FIN.
+ */
- if ((ntohs(frag_off) & 0x3fff) == 0) { /* first frag only */
- if ((tcpentry == NULL)
- && (!(transpacket->fin))) {
-
- /*
- * Ok, so we have a packet. Add it if this connection
- * is not yet closed, or if it is a SYN packet.
- */
-
- if (!nomem) {
- wasempty =
- (table.
- head ==
- NULL);
- if (ippacket !=
- NULL)
- tcpentry
- =
- addentry
- (&table,
- (unsigned
- long)
- ippacket->
- saddr,
- (unsigned
- long)
- ippacket->
- daddr,
- NULL,
- NULL,
- sport,
- dport,
- ippacket->
- protocol,
- ifname,
- &revlook,
- rvnfd,
- options->
- servnames,
- &nomem);
- else
- tcpentry
- =
- addentry
- (&table,
- 0,
- 0,
- (uint8_t
- *)
- (&ip6packet->
- ip6_src.
- s6_addr),
- (uint8_t
- *)
- (&ip6packet->
- ip6_dst.
- s6_addr),
- sport,
- dport,
- ip6packet->
- ip6_nxt,
- ifname,
- &revlook,
- rvnfd,
- options->
- servnames,
- &nomem);
- if (tcpentry !=
- NULL) {
- printentry
- (&table,
- tcpentry->
- oth_connection,
- screen_idx,
- mode);
+ if ((ntohs(frag_off) & 0x3fff) == 0) { /* first frag only */
+ if ((tcpentry == NULL)
+ && (!(transpacket->fin))) {
- if (wasempty) {
- set_barptr
- ((void *) &(table.barptr), table.firstvisible,
&(table.firstvisible->starttime), &(table.firstvisible->spanbr),
sizeof(unsigned long), statwin, &statcleared, statx);
- table.
- baridx
- =
- 1;
- }
-
- if ((table.barptr == tcpentry) || (table.barptr ==
tcpentry->oth_connection))
- set_barptr
- ((void *) &(table.barptr), table.barptr,
&(table.barptr->starttime), &(table.barptr->spanbr), sizeof(unsigned long),
statwin, &statcleared, statx);
- }
- }
- }
- }
- /*
- * If we had an addentry() success, we should have no
- * problem here. Same thing if we had a table lookup
- * success.
- */
-
- if (tcpentry != NULL) {
/*
- * Don't bother updating the entry if the connection
- * has been previously reset. (Does this really
- * happen in practice?)
+ * Ok, so we have a packet. Add it if this connection
+ * is not yet closed, or if it is a SYN packet.
*/
- if (!
- (tcpentry->
- stat & FLAG_RST)) {
- if (revlook) {
- p_sstat =
- tcpentry->
- s_fstat;
- p_dstat =
- tcpentry->
- d_fstat;
- }
- if (ippacket != NULL)
- updateentry
+ if (!nomem) {
+ wasempty =
+ (table.
+ head ==
+ NULL);
+ if (ippacket !=
+ NULL)
+ tcpentry
+ =
+ addentry
(&table,
- tcpentry,
- transpacket,
- tpacket,
- fromaddr.sll_hatype,
- readlen,
- br,
+ (unsigned
+ long)
+ ippacket->
+ saddr,
+ (unsigned
+ long)
ippacket->
- frag_off,
- logging,
+ daddr,
+ NULL,
+ NULL,
+ sport,
+ dport,
+ ippacket->
+ protocol,
+ ifname,
&revlook,
rvnfd,
- options,
- logfile,
+ options->
+ servnames,
&nomem);
else
- updateentry
+ tcpentry
+ =
+ addentry
(&table,
- tcpentry,
- transpacket,
- tpacket,
- fromaddr.sll_hatype,
- readlen,
- readlen, 0,
- logging,
+ 0,
+ 0,
+ (uint8_t
+ *)
+ (&ip6packet->
+ ip6_src.
+ s6_addr),
+ (uint8_t
+ *)
+ (&ip6packet->
+ ip6_dst.
+ s6_addr),
+ sport,
+ dport,
+ ip6packet->
+ ip6_nxt,
+ ifname,
&revlook,
rvnfd,
- options,
- logfile,
- &nomem);
- /*
- * Log first packet of a TCP connection except if
- * it's a RST, which was already logged earlier in
- * updateentry()
- */
-
- if ((tcpentry->pcount ==
- 1)
- &&
- (!(tcpentry->
- stat & FLAG_RST))
- && (logging)) {
- strcpy
- (msgstring,
- "first packet");
- if (transpacket->syn)
- strcat
- (msgstring,
- " (SYN)");
-
- writetcplog
- (logging,
- logfile,
- tcpentry,
- readlen,
options->
- mac,
- msgstring);
- }
-
- if ((revlook)
- &&
- (((p_sstat !=
- RESOLVED)
- && (tcpentry->
- s_fstat ==
- RESOLVED))
- ||
- ((p_dstat !=
- RESOLVED)
- && (tcpentry->
- d_fstat ==
- RESOLVED)))) {
- clearaddr
- (&table,
- tcpentry,
- screen_idx);
- clearaddr
- (&table,
- tcpentry->
- oth_connection,
- screen_idx);
- }
- printentry(&table,
- tcpentry,
- screen_idx,
- mode);
-
- /*
- * Special cases: Update other direction if it's
- * an ACK in response to a FIN.
- *
- * -- or --
- *
- * Addresses were just resolved for the other
- * direction, so we should also do so here.
- */
-
- if (((tcpentry->oth_connection->finsent == 2) && /* FINed and ACKed
*/
- (ntohl
- (transpacket->
- seq) ==
- tcpentry->
- oth_connection->
- finack))
- || ((revlook)
- &&
- (((p_sstat !=
- RESOLVED)
- && (tcpentry->
- s_fstat ==
- RESOLVED))
- ||
- ((p_dstat !=
- RESOLVED)
- && (tcpentry->
- d_fstat ==
- RESOLVED)))))
+ servnames,
+ &nomem);
+ if (tcpentry !=
+ NULL) {
printentry
(&table,
tcpentry->
oth_connection,
screen_idx,
mode);
+
+ if (wasempty) {
+ set_barptr
+ ((void *) &(table.barptr), table.firstvisible,
&(table.firstvisible->starttime), &(table.firstvisible->spanbr),
sizeof(unsigned long), statwin, &statcleared, statx);
+ table.
+ baridx
+ =
+ 1;
+ }
+
+ if ((table.barptr == tcpentry) || (table.barptr == tcpentry->oth_connection))
+ set_barptr
+ ((void *) &(table.barptr), table.barptr,
&(table.barptr->starttime), &(table.barptr->spanbr), sizeof(unsigned long),
statwin, &statcleared, statx);
+ }
}
}
- } else if (ippacket != NULL) {
- fragment =
- ((ntohs(ippacket->frag_off) &
- 0x1fff) != 0);
+ }
+ /*
+ * If we had an addentry() success, we should have no
+ * problem here. Same thing if we had a table lookup
+ * success.
+ */
- if (ippacket->protocol == IPPROTO_ICMP) {
+ if (tcpentry != NULL) {
+ /*
+ * Don't bother updating the entry if the connection
+ * has been previously reset. (Does this really
+ * happen in practice?)
+ */
+ if (!
+ (tcpentry->
+ stat & FLAG_RST)) {
+ if (revlook) {
+ p_sstat =
+ tcpentry->
+ s_fstat;
+ p_dstat =
+ tcpentry->
+ d_fstat;
+ }
+ if (ippacket != NULL)
+ updateentry
+ (&table,
+ tcpentry,
+ transpacket,
+ tpacket,
+ fromaddr.sll_hatype,
+ readlen,
+ br,
+ ippacket->
+ frag_off,
+ logging,
+ &revlook,
+ rvnfd,
+ options,
+ logfile,
+ &nomem);
+ else
+ updateentry
+ (&table,
+ tcpentry,
+ transpacket,
+ tpacket,
+ fromaddr.sll_hatype,
+ readlen,
+ readlen, 0,
+ logging,
+ &revlook,
+ rvnfd,
+ options,
+ logfile,
+ &nomem);
/*
- * Cancel the corresponding TCP entry if an ICMP
- * Destination Unreachable or TTL Exceeded message
- * is received.
+ * Log first packet of a TCP connection except if
+ * it's a RST, which was already logged earlier in
+ * updateentry()
*/
- if (((struct icmphdr *)
- transpacket)->type ==
- ICMP_DEST_UNREACH)
- process_dest_unreach
- (&table, (char *)
- transpacket,
- ifname, &nomem);
+ if ((tcpentry->pcount ==
+ 1)
+ &&
+ (!(tcpentry->
+ stat & FLAG_RST))
+ && (logging)) {
+ strcpy
+ (msgstring,
+ "first packet");
+ if (transpacket->syn)
+ strcat
+ (msgstring,
+ " (SYN)");
+
+ writetcplog
+ (logging,
+ logfile,
+ tcpentry,
+ readlen,
+ options->
+ mac,
+ msgstring);
+ }
- }
- add_othp_entry(&othptbl, &table,
- ippacket->saddr,
- ippacket->daddr, NULL,
- NULL, IS_IP,
- ippacket->protocol,
- fromaddr.sll_hatype,
- (char *) tpacket,
- (char *) transpacket,
- readlen, ifname,
- &revlook, rvnfd,
- options->timeout,
- logging, logfile,
- options->servnames,
- fragment, &nomem);
+ if ((revlook)
+ &&
+ (((p_sstat !=
+ RESOLVED)
+ && (tcpentry->
+ s_fstat ==
+ RESOLVED))
+ ||
+ ((p_dstat !=
+ RESOLVED)
+ && (tcpentry->
+ d_fstat ==
+ RESOLVED)))) {
+ clearaddr
+ (&table,
+ tcpentry,
+ screen_idx);
+ clearaddr
+ (&table,
+ tcpentry->
+ oth_connection,
+ screen_idx);
+ }
+ printentry(&table,
+ tcpentry,
+ screen_idx,
+ mode);
- } else {
- if (ip6packet->ip6_nxt ==
- IPPROTO_ICMPV6) {
- if (((struct icmp6_hdr *)
- transpacket)->icmp6_type ==
- ICMP6_DST_UNREACH)
- process_dest_unreach
- (&table, (char *)
- transpacket,
- ifname, &nomem);
+ /*
+ * Special cases: Update other direction if it's
+ * an ACK in response to a FIN.
+ *
+ * -- or --
+ *
+ * Addresses were just resolved for the other
+ * direction, so we should also do so here.
+ */
+
+ if (((tcpentry->oth_connection->finsent == 2) && /* FINed and ACKed
*/
+ (ntohl
+ (transpacket->
+ seq) ==
+ tcpentry->
+ oth_connection->
+ finack))
+ || ((revlook)
+ &&
+ (((p_sstat !=
+ RESOLVED)
+ && (tcpentry->
+ s_fstat ==
+ RESOLVED))
+ ||
+ ((p_dstat !=
+ RESOLVED)
+ && (tcpentry->
+ d_fstat ==
+ RESOLVED)))))
+ printentry
+ (&table,
+ tcpentry->
+ oth_connection,
+ screen_idx,
+ mode);
}
- add_othp_entry(&othptbl, &table, 0, 0,
- &ip6packet->ip6_src,
- &ip6packet->ip6_dst,
- IS_IP,
- ip6packet->ip6_nxt,
- fromaddr.sll_hatype,
- (char *) tpacket,
- (char *) transpacket,
- readlen, ifname,
- &revlook, rvnfd,
- options->timeout,
- logging, logfile,
- options->servnames,
- fragment, &nomem);
}
+ } else if (ippacket != NULL) {
+ fragment =
+ ((ntohs(ippacket->frag_off) &
+ 0x1fff) != 0);
+
+ if (ippacket->protocol == IPPROTO_ICMP) {
+
+ /*
+ * Cancel the corresponding TCP entry if an ICMP
+ * Destination Unreachable or TTL Exceeded message
+ * is received.
+ */
+
+ if (((struct icmphdr *)
+ transpacket)->type ==
+ ICMP_DEST_UNREACH)
+ process_dest_unreach
+ (&table, (char *)
+ transpacket,
+ ifname, &nomem);
+
+ }
+ add_othp_entry(&othptbl, &table,
+ ippacket->saddr,
+ ippacket->daddr, NULL,
+ NULL, IS_IP,
+ ippacket->protocol,
+ fromaddr.sll_hatype,
+ (char *) tpacket,
+ (char *) transpacket,
+ readlen, ifname,
+ &revlook, rvnfd,
+ options->timeout,
+ logging, logfile,
+ options->servnames,
+ fragment, &nomem);
+
+ } else {
+ if (ip6packet->ip6_nxt ==
+ IPPROTO_ICMPV6) {
+ if (((struct icmp6_hdr *)
+ transpacket)->icmp6_type ==
+ ICMP6_DST_UNREACH)
+ process_dest_unreach
+ (&table, (char *)
+ transpacket,
+ ifname, &nomem);
+ }
+ add_othp_entry(&othptbl, &table, 0, 0,
+ &ip6packet->ip6_src,
+ &ip6packet->ip6_dst,
+ IS_IP,
+ ip6packet->ip6_nxt,
+ fromaddr.sll_hatype,
+ (char *) tpacket,
+ (char *) transpacket,
+ readlen, ifname,
+ &revlook, rvnfd,
+ options->timeout,
+ logging, logfile,
+ options->servnames,
+ fragment, &nomem);
}
}
}
--
1.7.8.4