2 * -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
3 * hooks.c - a TCP/IP protocol filter for ziffy
5 * Copyright (c) 1998-2001 R. Carbone <rocco@ntop.org>
6 * -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
25 # if !defined(_BSD_SOURCE)
31 * Operating System include files
35 #include <sys/types.h>
36 #include <sys/socket.h>
39 #include <netinet/in.h>
40 #include <arpa/inet.h>
44 #if HAVE_NETINET_IF_ETHER_H
45 #include <netinet/if_ether.h>
48 #if HAVE_NETINET_IN_SYSTM_H
49 #include <netinet/in_systm.h>
52 #include <netinet/ip.h>
53 #include <netinet/tcp.h>
55 #include "pcap.h" /* Packet Capture Library */
59 void fmemdmp (FILE * fd, char * ptr, int size, char * text);
67 * to allow a pretty-print of lower-layers address I save
68 * relevant pointers to all the protocol data units in global variables,
69 * rather than pass them across function calls.
70 * So, for example, if someone is interested in the paired source and
71 * destination IP addressed, they can be easily accessed by global 'ip' pointer.
76 * hooks to the known protocols in the ethernet packets
78 static struct ether_header * e = NULL;
79 static struct ip * ip = NULL;
80 static struct tcphdr * tcp = NULL;
81 extern u_char * z3950;
84 * sizes of the known protocols in the ethernet packets
86 static int eth_size = 0;
87 static int eth_hlen = 0;
88 static int ip_size = 0;
89 static int ip_hlen = 0;
90 static int tcp_size = 0;
91 static int tcp_hlen = 0;
92 extern int z3950_size;
97 static char buf [256]; /* should be enough for humans !!! */
99 struct hostent * host = NULL;
102 host = gethostbyaddr ((char *) & ip -> ip_src, sizeof (ip -> ip_src), AF_INET);
104 sprintf (buf, "%s", host ? host -> h_name : inet_ntoa (ip -> ip_src));
111 return ((int) ntohs (tcp -> th_sport));
115 char * dsthost (void)
117 static char buf [256]; /* should be enough for humans !!! */
119 struct hostent * host = NULL;
122 host = gethostbyaddr ((char *) & ip -> ip_dst, sizeof (ip -> ip_dst), AF_INET);
124 sprintf (buf, "%s", host ? host -> h_name : inet_ntoa (ip -> ip_dst));
131 return ((int) ntohs (tcp -> th_dport));
136 * stolen from the addrtoname.c in tcpdump
138 static char hex [] = "0123456789abcdef";
140 static char * etheraddr_string (u_char * e)
142 static char buf [sizeof ("00:00:00:00:00:00")];
148 strcpy (buf, "00:00:00:00:00:00");
151 * hacked to manage DLT_NULL
157 if ((j = * e >> 4) != 0)
159 * p ++ = hex [* e ++ & 0xf];
160 for (i = 5; -- i >= 0; )
163 if ((j = * e >> 4) != 0)
165 * p ++ = hex [* e ++ & 0xf];
173 * Parse the incoming Ethernet Packet and set hooks to all pertinent data.
175 * 'h' is the pointer to the packet header (independent from interfaces)
176 * 'p' is the pointer to the packet data
178 * Warning: I really want libpcap to give me aligned packets
180 z3950apdu * pduhook (const struct pcap_pkthdr * h, const u_char * p)
182 static unsigned long ethno = 0; /* # of ethernet packets received by the decoder */
183 static unsigned long ipno = 0; /* # of IP packets received by the decoder */
184 static unsigned long tcpno = 0; /* # of TCP packets received by the decoder */
188 z3950apdu * apdu = NULL;
193 e = (struct ether_header *) p;
198 * The header is only 4 bytes long in case of no link-layer encapsulation (DLT_NULL).
199 * It contains a network order 32 bit integer that specifies the family, e.g. AF_INET
202 eth_hlen = dlt == DLT_NULL ? 4 : sizeof (struct ether_header);
207 printf ("ETHER: ----- Ether Header -----\n"),
209 printf ("ETHER: Packet %ld arrived at %s\n", ethno, timestamp (& h -> ts, ABS_FMT)),
210 printf ("ETHER: Total size = %d : header = %d : data = %d\n",
211 eth_size, eth_hlen, eth_size - eth_hlen),
212 printf ("ETHER: Source = %s\n",
213 etheraddr_string (dlt == DLT_NULL ? NULL : (char *) & e -> ether_shost)),
214 printf ("ETHER: Destination = %s\n",
215 etheraddr_string (dlt == DLT_NULL ? NULL : (char *) & e -> ether_dhost)),
217 fmemdmp (stdout, (char *) e, eth_size, "Ethernet Packet");
220 * Process only IP packets (or loopback packets when testing at home sweet home)
222 if (dlt == DLT_NULL || ntohs (e -> ether_type) == ETHERTYPE_IP)
227 ip = (struct ip *) (p + eth_hlen);
232 * ip->ip_hl*4 = size of the IP (Header Only)
233 * ntohs (ip->ip_len) = size of the IP (Full Packet)
234 * ip_size = eth_size - eth_hlen (better IMO)
236 ip_size = eth_size - eth_hlen;
237 ip_hlen = ip -> ip_hl * 4;
242 printf ("IP: ----- IP Header -----\n"),
244 printf ("IP: Packet %ld arrived at %s\n", ipno, timestamp (& h -> ts, ABS_FMT)),
245 printf ("IP: Total size = %d : header = %d : data = %d\n",
246 ip_size, ip_hlen, ip_size - ip_hlen),
247 printf ("IP: Source = %s\n", inet_ntoa (ip -> ip_src)),
248 printf ("IP: Destination = %s\n", inet_ntoa (ip -> ip_dst)),
252 fmemdmp (stdout, (char *) ip, ip_size, "IP Packet");
256 * i am looking for Z39.50 APDUs over TCP/IP. so...
258 if (ip -> ip_p == IPPROTO_TCP)
263 q = (u_char *) ip + ip_hlen;
264 tcp = (struct tcphdr *) q;
269 * tcp->th_off*4 = size of the TCP (Header Only)
271 tcp_size = ip_size - ip_hlen;
272 tcp_hlen = tcp -> th_off * 4;
277 printf ("TCP: ----- TCP Header -----\n"),
279 printf ("TCP: Packet %ld arrived at %s\n", tcpno, timestamp (& h -> ts, ABS_FMT)),
280 printf ("TCP: Total size = %d : header = %d : data = %d\n",
281 tcp_size, tcp_hlen, tcp_size - tcp_hlen),
282 printf ("TCP: Source = %d\n", ntohs (tcp -> th_sport)),
283 printf ("TCP: Destination = %d\n", ntohs (tcp -> th_dport)),
285 fmemdmp (stdout, (char *) tcp, tcp_size, "TCP Packet");
288 * Application Protocol
289 * (time to play with Z39.50 APDUs here)
291 z3950 = (u_char *) e + eth_hlen + ip_hlen + tcp_hlen;
294 * Higher Protocol Packet Size
296 z3950_size = tcp_size - tcp_hlen;
298 apdu = parseable (z3950, z3950_size);
301 printf ("TCP: ----- TCP Header -----\n"),
303 printf ("TCP: Packet %ld arrived at %s\n", tcpno, timestamp (& h -> ts, ABS_FMT)),
304 printf ("TCP: Total size = %d : header = %d : data = %d\n",
305 tcp_size, tcp_hlen, tcp_size - tcp_hlen),
306 printf ("TCP: Source = %d\n", ntohs (tcp -> th_sport)),
307 printf ("TCP: Destination = %d\n", ntohs (tcp -> th_dport)),
309 fmemdmp (stdout, (char *) tcp, tcp_size, "TCP Packet");