2 * -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
3 * hooks.c - a TCP/IP protocol filter for ziffy
5 * Copyright (c) 1998-2001 R. Carbone <rocco@ntop.org>
6 * -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
27 * Operating System include files
31 #include <sys/types.h>
32 #include <sys/socket.h>
35 #include <arpa/inet.h>
42 #include <netinet/in.h>
45 #if HAVE_NETINET_IF_ETHER_H
46 #include <netinet/if_ether.h>
49 #if HAVE_NETINET_IN_SYSTM_H
50 #include <netinet/in_systm.h>
53 #include <netinet/ip.h>
54 #include <netinet/tcp.h>
56 #include "pcap.h" /* Packet Capture Library */
60 void fmemdmp (FILE * fd, char * ptr, int size, char * text);
68 * to allow a pretty-print of lower-layers address I save
69 * relevant pointers to all the protocol data units in global variables,
70 * rather than pass them across function calls.
71 * So, for example, if someone is interested in the paired source and
72 * destination IP addressed, they can be easily accessed by global 'ip' pointer.
77 * hooks to the known protocols in the ethernet packets
79 static struct ether_header * e = NULL;
80 static struct ip * ip = NULL;
81 static struct tcphdr * tcp = NULL;
82 extern u_char * z3950;
85 * sizes of the known protocols in the ethernet packets
87 static int eth_size = 0;
88 static int eth_hlen = 0;
89 static int ip_size = 0;
90 static int ip_hlen = 0;
91 static int tcp_size = 0;
92 static int tcp_hlen = 0;
93 extern int z3950_size;
98 static char buf [256]; /* should be enough for humans !!! */
100 struct hostent * host = NULL;
103 host = gethostbyaddr ((char *) & ip -> ip_src, sizeof (ip -> ip_src), AF_INET);
105 sprintf (buf, "%s", host ? host -> h_name : inet_ntoa (ip -> ip_src));
112 return ((int) ntohs (tcp -> th_sport));
116 char * dsthost (void)
118 static char buf [256]; /* should be enough for humans !!! */
120 struct hostent * host = NULL;
123 host = gethostbyaddr ((char *) & ip -> ip_dst, sizeof (ip -> ip_dst), AF_INET);
125 sprintf (buf, "%s", host ? host -> h_name : inet_ntoa (ip -> ip_dst));
132 return ((int) ntohs (tcp -> th_dport));
137 * stolen from the addrtoname.c in tcpdump
139 static char hex [] = "0123456789abcdef";
141 static char * etheraddr_string (u_char * e)
143 static char buf [sizeof ("00:00:00:00:00:00")];
149 strcpy (buf, "00:00:00:00:00:00");
152 * hacked to manage DLT_NULL
158 if ((j = * e >> 4) != 0)
160 * p ++ = hex [* e ++ & 0xf];
161 for (i = 5; -- i >= 0; )
164 if ((j = * e >> 4) != 0)
166 * p ++ = hex [* e ++ & 0xf];
174 * Parse the incoming Ethernet Packet and set hooks to all pertinent data.
176 * 'h' is the pointer to the packet header (independent from interfaces)
177 * 'p' is the pointer to the packet data
179 * Warning: I really want libpcap to give me aligned packets
181 z3950apdu * pduhook (const struct pcap_pkthdr * h, const u_char * p)
183 static unsigned long ethno = 0; /* # of ethernet packets received by the decoder */
184 static unsigned long ipno = 0; /* # of IP packets received by the decoder */
185 static unsigned long tcpno = 0; /* # of TCP packets received by the decoder */
189 z3950apdu * apdu = NULL;
194 e = (struct ether_header *) p;
199 * The header is only 4 bytes long in case of no link-layer encapsulation (DLT_NULL).
200 * It contains a network order 32 bit integer that specifies the family, e.g. AF_INET
203 eth_hlen = dlt == DLT_NULL ? 4 : sizeof (struct ether_header);
208 printf ("ETHER: ----- Ether Header -----\n"),
210 printf ("ETHER: Packet %ld arrived at %s\n", ethno, timestamp (& h -> ts, ABS_FMT)),
211 printf ("ETHER: Total size = %d : header = %d : data = %d\n",
212 eth_size, eth_hlen, eth_size - eth_hlen),
213 printf ("ETHER: Source = %s\n",
214 etheraddr_string (dlt == DLT_NULL ? NULL : (u_char *) & e -> ether_shost)),
215 printf ("ETHER: Destination = %s\n",
216 etheraddr_string (dlt == DLT_NULL ? NULL : (u_char *) & e -> ether_dhost)),
218 fmemdmp (stdout, (char *) e, eth_size, "Ethernet Packet");
221 * Process only IP packets (or loopback packets when testing at home sweet home)
223 if (dlt == DLT_NULL || ntohs (e -> ether_type) == ETHERTYPE_IP)
228 ip = (struct ip *) (p + eth_hlen);
233 * ip->ip_hl*4 = size of the IP (Header Only)
234 * ntohs (ip->ip_len) = size of the IP (Full Packet)
235 * ip_size = eth_size - eth_hlen (better IMO)
237 ip_size = eth_size - eth_hlen;
238 ip_hlen = ip -> ip_hl * 4;
243 printf ("IP: ----- IP Header -----\n"),
245 printf ("IP: Packet %ld arrived at %s\n", ipno, timestamp (& h -> ts, ABS_FMT)),
246 printf ("IP: Total size = %d : header = %d : data = %d\n",
247 ip_size, ip_hlen, ip_size - ip_hlen),
248 printf ("IP: Source = %s\n", inet_ntoa (ip -> ip_src)),
249 printf ("IP: Destination = %s\n", inet_ntoa (ip -> ip_dst)),
253 fmemdmp (stdout, (char *) ip, ip_size, "IP Packet");
257 * i am looking for Z39.50 APDUs over TCP/IP. so...
259 if (ip -> ip_p == IPPROTO_TCP)
264 q = (u_char *) ip + ip_hlen;
265 tcp = (struct tcphdr *) q;
270 * tcp->th_off*4 = size of the TCP (Header Only)
272 tcp_size = ip_size - ip_hlen;
273 tcp_hlen = tcp -> th_off * 4;
278 printf ("TCP: ----- TCP Header -----\n"),
280 printf ("TCP: Packet %ld arrived at %s\n", tcpno, timestamp (& h -> ts, ABS_FMT)),
281 printf ("TCP: Total size = %d : header = %d : data = %d\n",
282 tcp_size, tcp_hlen, tcp_size - tcp_hlen),
283 printf ("TCP: Source = %d\n", ntohs (tcp -> th_sport)),
284 printf ("TCP: Destination = %d\n", ntohs (tcp -> th_dport)),
286 fmemdmp (stdout, (char *) tcp, tcp_size, "TCP Packet");
289 * Application Protocol
290 * (time to play with Z39.50 APDUs here)
292 z3950 = (u_char *) e + eth_hlen + ip_hlen + tcp_hlen;
295 * Higher Protocol Packet Size
297 z3950_size = tcp_size - tcp_hlen;
299 apdu = parseable (z3950, z3950_size);
302 printf ("TCP: ----- TCP Header -----\n"),
304 printf ("TCP: Packet %ld arrived at %s\n", tcpno, timestamp (& h -> ts, ABS_FMT)),
305 printf ("TCP: Total size = %d : header = %d : data = %d\n",
306 tcp_size, tcp_hlen, tcp_size - tcp_hlen),
307 printf ("TCP: Source = %d\n", ntohs (tcp -> th_sport)),
308 printf ("TCP: Destination = %d\n", ntohs (tcp -> th_dport)),
310 fmemdmp (stdout, (char *) tcp, tcp_size, "TCP Packet");