/* follow.c * * Copyright 1998 Mike Hall * * Wireshark - Network traffic analyzer * By Gerald Combs * Copyright 1998 Gerald Combs * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. * */ #include "config.h" #include #include #include #ifdef HAVE_UNISTD_H #include #endif #include #include #include #include #include #include "follow.h" #include #include typedef struct _tcp_frag { guint32 seq; guint32 len; guint32 data_len; gchar *data; struct _tcp_frag *next; } tcp_frag; WS_DLL_PUBLIC_DEF FILE* data_out_file = NULL; gboolean empty_tcp_stream; gboolean incomplete_tcp_stream; static guint32 stream_to_follow[MAX_STREAM] = {0}; static gboolean find_addr[MAX_STREAM] = {FALSE}; static gboolean find_index[MAX_STREAM] = {FALSE}; static address tcp_addr[2]; static stream_addr ip_address[2]; static guint port[2]; static guint bytes_written[2]; static gboolean is_ipv6 = FALSE; void follow_stats(follow_stats_t* stats) { int i; for (i = 0; i < 2 ; i++) { stats->ip_address[i] = ip_address[i]; stats->port[i] = port[i]; stats->bytes_written[i] = bytes_written[i]; } stats->is_ipv6 = is_ipv6; } /* This will build a display filter text that will only pass the packets related to the stream. There is a chance that two streams could intersect, but not a very good one */ gchar* build_follow_conv_filter( packet_info *pi, const char* append_filter ) { char* buf; int len; conversation_t *conv=NULL; struct tcp_analysis *tcpd; struct udp_analysis *udpd; wmem_list_frame_t* protos; int proto_id; const char* proto_name; gboolean is_tcp = FALSE, is_udp = FALSE; protos = wmem_list_head(pi->layers); /* walk the list of a available protocols in the packet to figure out if any of them affect context sensitivity */ while (protos != NULL) { proto_id = GPOINTER_TO_INT(wmem_list_frame_data(protos)); proto_name = proto_get_protocol_filter_name(proto_id); if (!strcmp(proto_name, "tcp")) { is_tcp = TRUE; } else if (!strcmp(proto_name, "udp")) { is_udp = TRUE; } protos = wmem_list_frame_next(protos); } if( ((pi->net_src.type == AT_IPv4 && pi->net_dst.type == AT_IPv4) || (pi->net_src.type == AT_IPv6 && pi->net_dst.type == AT_IPv6)) && is_tcp && (conv=find_conversation(pi->fd->num, &pi->src, &pi->dst, pi->ptype, pi->srcport, pi->destport, 0)) != NULL ) { /* TCP over IPv4/6 */ tcpd=get_tcp_conversation_data(conv, pi); if (tcpd) { if (append_filter == NULL) { buf = g_strdup_printf("tcp.stream eq %d", tcpd->stream); } else { buf = g_strdup_printf("((tcp.stream eq %d) && (%s))", tcpd->stream, append_filter); } stream_to_follow[TCP_STREAM] = tcpd->stream; if (pi->net_src.type == AT_IPv4) { len = 4; is_ipv6 = FALSE; } else { len = 16; is_ipv6 = TRUE; } } else { return NULL; } } else if( ((pi->net_src.type == AT_IPv4 && pi->net_dst.type == AT_IPv4) || (pi->net_src.type == AT_IPv6 && pi->net_dst.type == AT_IPv6)) && is_udp && (conv=find_conversation(pi->fd->num, &pi->src, &pi->dst, pi->ptype, pi->srcport, pi->destport, 0)) != NULL ) { /* UDP over IPv4/6 */ udpd=get_udp_conversation_data(conv, pi); if (udpd) { if (append_filter == NULL) { buf = g_strdup_printf("udp.stream eq %d", udpd->stream); } else { buf = g_strdup_printf("((udp.stream eq %d) && (%s))", udpd->stream, append_filter); } stream_to_follow[UDP_STREAM] = udpd->stream; if (pi->net_src.type == AT_IPv4) { len = 4; is_ipv6 = FALSE; } else { len = 16; is_ipv6 = TRUE; } } else { return NULL; } } else { return NULL; } memcpy(&ip_address[0], pi->net_src.data, len); memcpy(&ip_address[1], pi->net_dst.data, len); port[0] = pi->srcport; port[1] = pi->destport; return buf; } static gboolean udp_follow_packet(void *tapdata _U_, packet_info *pinfo, epan_dissect_t *edt _U_, const void *data _U_) { if (find_addr[UDP_STREAM]) { if (pinfo->net_src.type == AT_IPv6) { is_ipv6 = TRUE; } else { is_ipv6 = FALSE; } memcpy(&ip_address[0], pinfo->net_src.data, pinfo->net_src.len); memcpy(&ip_address[1], pinfo->net_dst.data, pinfo->net_dst.len); port[0] = pinfo->srcport; port[1] = pinfo->destport; find_addr[UDP_STREAM] = FALSE; } return FALSE; } /* here we are going to try and reconstruct the data portion of a TCP session. We will try and handle duplicates, TCP fragments, and out of order packets in a smart way. */ static tcp_frag *frags[2] = { 0, 0 }; static guint32 seq[2]; static stream_addr src_addr[2]; static guint src_port[2] = { 0, 0 }; void reset_stream_follow(stream_type stream) { tcp_frag *current, *next; int i; remove_tap_listener(&stream_to_follow[stream]); find_addr[stream] = FALSE; find_index[stream] = FALSE; if (stream == TCP_STREAM) { empty_tcp_stream = TRUE; incomplete_tcp_stream = FALSE; for( i=0; i<2; i++ ) { seq[i] = 0; memset(&src_addr[i], 0, sizeof(src_addr[i])); src_port[i] = 0; memset(&ip_address[i], 0, sizeof(src_addr[i])); port[i] = 0; bytes_written[i] = 0; current = frags[i]; while( current ) { next = current->next; g_free( current->data ); g_free( current ); current = next; } frags[i] = NULL; } } } gchar* build_follow_index_filter(stream_type stream) { gchar *buf; find_addr[stream] = TRUE; if (stream == TCP_STREAM) { buf = g_strdup_printf("tcp.stream eq %d", stream_to_follow[TCP_STREAM]); } else { GString * error_string; buf = g_strdup_printf("udp.stream eq %d", stream_to_follow[UDP_STREAM]); error_string = register_tap_listener("udp_follow", &stream_to_follow[UDP_STREAM], buf, 0, NULL, udp_follow_packet, NULL); if (error_string) { g_string_free(error_string, TRUE); } } return buf; } /* select a tcp stream to follow via it's address/port pairs */ gboolean follow_addr(stream_type stream, const address *addr0, guint port0, const address *addr1, guint port1) { if (addr0 == NULL || addr1 == NULL || addr0->type != addr1->type || port0 > G_MAXUINT16 || port1 > G_MAXUINT16 ) { return FALSE; } if (find_index[stream] || find_addr[stream]) { return FALSE; } switch (addr0->type) { default: return FALSE; case AT_IPv4: case AT_IPv6: is_ipv6 = addr0->type == AT_IPv6; break; } memcpy(&ip_address[0], addr0->data, addr0->len); port[0] = port0; memcpy(&ip_address[1], addr1->data, addr1->len); port[1] = port1; if (stream == TCP_STREAM) { find_index[TCP_STREAM] = TRUE; set_address(&tcp_addr[0], addr0->type, addr0->len, &ip_address[0]); set_address(&tcp_addr[1], addr1->type, addr1->len, &ip_address[1]); } return TRUE; } /* select a stream to follow via its index */ gboolean follow_index(stream_type stream, guint32 indx) { if (find_index[stream] || find_addr[stream]) { return FALSE; } find_addr[stream] = TRUE; stream_to_follow[stream] = indx; memset(ip_address, 0, sizeof ip_address); port[0] = port[1] = 0; return TRUE; } guint32 get_follow_index(stream_type stream) { return stream_to_follow[stream]; } /* * Editor modelines - http://www.wireshark.org/tools/modelines.html * * Local Variables: * c-basic-offset: 2 * tab-width: 8 * indent-tabs-mode: nil * End: * * ex: set shiftwidth=2 tabstop=8 expandtab: * :indentSize=2:tabSize=8:noTabs=true: */