contrib/ipfilter/ipsd/snit.c

   1 /*
   2  * (C)opyright 1992-1998 Darren Reed. (from tcplog)
   3  *
   4  * See the IPFILTER.LICENCE file for details on licencing.
   5  *
   6  *   The author of this software makes no garuntee about the
   7  * performance of this package or its suitability to fulfill any purpose.
   8  *
   9  */
  10
  11 #include <stdio.h>
  12 #include <netdb.h>
  13 #include <ctype.h>
  14 #include <signal.h>
  15 #include <errno.h>
  16 #include <sys/types.h>
  17 #include <sys/time.h>
  18 #include <sys/timeb.h>
  19 #include <sys/socket.h>
  20 #include <sys/file.h>
  21 #include <sys/ioctl.h>
  22 #include <net/nit.h>
  23 #include <sys/fcntlcom.h>
  24 #include <sys/dir.h>
  25 #include <net/nit_if.h>
  26 #include <net/nit_pf.h>
  27 #include <net/nit_buf.h>
  28 #include <net/packetfilt.h>
  29 #include <sys/stropts.h>
  30
  31 #include <net/if.h>
  32 #include <netinet/in.h>
  33 #include <netinet/in_systm.h>
  34 #include <netinet/ip.h>
  35 #include <netinet/if_ether.h>
  36 #include <netinet/ip_var.h>
  37 #include <netinet/udp.h>
  38 #include <netinet/udp_var.h>
  39 #include <netinet/tcp.h>
  40 #include <netinet/tcpip.h>
  41
  42 #ifndef lint
  43 static  char    snitid[] = "@(#)snit.c  1.2 12/3/95 (C)1995 Darren Reed";
  44 #endif
  45
  46 #define BUFSPACE        32768
  47
  48 /*
  49  * Be careful to only include those defined in the flags option for the
  50  * interface are included in the header size.
  51  */
  52 #define BUFHDR_SIZE  (sizeof(struct nit_bufhdr))
  53 #define NIT_HDRSIZE  (BUFHDR_SIZE)
  54
  55 static  int     timeout;
  56
  57
  58 int     ack_recv(ep)
  59 char    *ep;
  60 {
  61         struct  tcpiphdr        tip;
  62         struct  tcphdr  *tcp;
  63         struct  ip      *ip;
  64
  65         ip = (struct ip *)&tip;
  66         tcp = (struct tcphdr *)(ip + 1);
  67         bcopy(ep + 14, (char *)ip, sizeof(*ip));
  68         bcopy(ep + 14 + (ip->ip_hl << 2), (char *)tcp, sizeof(*tcp));
  69         if (ip->ip_off & 0x1fff != 0)
  70                 return 0;
  71         if (0 == detect(ip, tcp))
  72                 return 1;
  73         return 0;
  74 }
  75
  76
  77 int     readloop(fd, dst)
  78 int     fd;
  79 struct  in_addr dst;
  80 {
  81         static  u_char  buf[BUFSPACE];
  82         register u_char *bp, *cp, *bufend;
  83         register struct nit_bufhdr      *hp;
  84         register int    cc;
  85         time_t  now = time(NULL);
  86         int     done = 0;
  87
  88         while ((cc = read(fd, buf, BUFSPACE-1)) >= 0) {
  89                 if (!cc)
  90                         if ((time(NULL) - now) > timeout)
  91                                 return done;
  92                         else
  93                                 continue;
  94                 bp = buf;
  95                 bufend = buf + cc;
  96                 /*
  97                  * loop through each snapshot in the chunk
  98                  */
  99                 while (bp < bufend) {
 100                         cp = (u_char *)((char *)bp + NIT_HDRSIZE);
 101                         /*
 102                          * get past NIT buffer
 103                          */
 104                         hp = (struct nit_bufhdr *)bp;
 105                         /*
 106                          * next snapshot
 107                          */
 108                         bp += hp->nhb_totlen;
 109                         done += ack_recv(cp);
 110                 }
 111                 return done;
 112         }
 113         perror("read");
 114         exit(-1);
 115 }
 116
 117 int     initdevice(device, tout)
 118 char    *device;
 119 int     tout;
 120 {
 121         struct  strioctl si;
 122         struct  timeval to;
 123         struct  ifreq ifr;
 124         struct  packetfilt pfil;
 125         u_long  if_flags;
 126         u_short *fwp = pfil.Pf_Filter;
 127         int     ret, offset, fd, snaplen= 76, chunksize = BUFSPACE;
 128
 129         if ((fd = open("/dev/nit", O_RDWR)) < 0)
 130             {
 131                 perror("/dev/nit");
 132                 exit(-1);
 133             }
 134
 135         /*
 136          * Create some filter rules for our TCP watcher. We only want ethernet
 137          * pacets which are IP protocol and only the TCP packets from IP.
 138          */
 139         offset = 6;
 140         *fwp++ = ENF_PUSHWORD + offset;
 141         *fwp++ = ENF_PUSHLIT | ENF_CAND;
 142         *fwp++ = htons(ETHERTYPE_IP);
 143         *fwp++ = ENF_PUSHWORD + sizeof(struct ether_header)/sizeof(short)+4;
 144         *fwp++ = ENF_PUSHLIT | ENF_AND;
 145         *fwp++ = htons(0x00ff);
 146         *fwp++ = ENF_PUSHLIT | ENF_COR;
 147         *fwp++ = htons(IPPROTO_TCP);
 148         *fwp++ = ENF_PUSHWORD + sizeof(struct ether_header)/sizeof(short)+4;
 149         *fwp++ = ENF_PUSHLIT | ENF_AND;
 150         *fwp++ = htons(0x00ff);
 151         *fwp++ = ENF_PUSHLIT | ENF_CAND;
 152         *fwp++ = htons(IPPROTO_UDP);
 153         pfil.Pf_FilterLen = fwp - &pfil.Pf_Filter[0];
 154         /*
 155          * put filter in place.
 156          */
 157         if (ioctl(fd, I_PUSH, "pf") == -1)
 158             {
 159                 perror("ioctl: I_PUSH pf");
 160                 exit(1);
 161             }
 162         if (ioctl(fd, NIOCSETF, &pfil) == -1)
 163             {
 164                 perror("ioctl: NIOCSETF");
 165                 exit(1);
 166             }
 167         /*
 168          * arrange to get messages from the NIT STREAM and use NIT_BUF option
 169          */
 170         ioctl(fd, I_SRDOPT, (char*)RMSGD);
 171         ioctl(fd, I_PUSH, "nbuf");
 172         /*
 173          * set the timeout
 174          */
 175         timeout = tout;
 176         si.ic_timout = 1;
 177         to.tv_sec = 1;
 178         to.tv_usec = 0;
 179         si.ic_cmd = NIOCSTIME;
 180         si.ic_len = sizeof(to);
 181         si.ic_dp = (char*)&to;
 182         if (ioctl(fd, I_STR, (char*)&si) == -1)
 183             {
 184                 perror("ioctl: NIT timeout");
 185                 exit(-1);
 186             }
 187         /*
 188          * set the chunksize
 189          */
 190         si.ic_cmd = NIOCSCHUNK;
 191         si.ic_len = sizeof(chunksize);
 192         si.ic_dp = (char*)&chunksize;
 193         if (ioctl(fd, I_STR, (char*)&si) == -1)
 194                 perror("ioctl: NIT chunksize");
 195         if (ioctl(fd, NIOCGCHUNK, (char*)&chunksize) == -1)
 196             {
 197                 perror("ioctl: NIT chunksize");
 198                 exit(-1);
 199             }
 200         printf("NIT buffer size: %d\n", chunksize);
 201
 202         /*
 203          * request the interface
 204          */
 205         strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name));
 206         ifr.ifr_name[sizeof(ifr.ifr_name) - 1] = ' ';
 207         si.ic_cmd = NIOCBIND;
 208         si.ic_len = sizeof(ifr);
 209         si.ic_dp = (char*)&ifr;
 210         if (ioctl(fd, I_STR, (char*)&si) == -1)
 211             {
 212                 perror(ifr.ifr_name);
 213                 exit(1);
 214             }
 215
 216         /*
 217          * set the snapshot length
 218          */
 219         si.ic_cmd = NIOCSSNAP;
 220         si.ic_len = sizeof(snaplen);
 221         si.ic_dp = (char*)&snaplen;
 222         if (ioctl(fd, I_STR, (char*)&si) == -1)
 223             {
 224                 perror("ioctl: NIT snaplen");
 225                 exit(1);
 226             }
 227         (void) ioctl(fd, I_FLUSH, (char*)FLUSHR);
 228         return fd;
 229 }