home *** CD-ROM | disk | FTP | other *** search
/ Power Hacker 2003 / Power_Hacker_2003.iso / E-zine / Magazines / crh / freebsd / rootkit / sniffit.0.3.5 / sniffit.0.3.5.c < prev    next >
Encoding:
C/C++ Source or Header  |  2002-05-27  |  47.3 KB  |  1,603 lines
  1. /* Sniffit main program file                                              */
  2. /*   - by           : Brecht Claerhout                                    */
  3. /*   - getaddrbyname: Godmar Back                                         */
  4.  
  5. #include "sn_config.h"                                  /* Config header file */
  6.  
  7. #include <unistd.h>
  8. #include <signal.h>
  9. #include <stdio.h>
  10. #include <netdb.h>
  11. #include <errno.h>
  12. #include <sys/stat.h>
  13. #include <sys/types.h>
  14. #include <sys/socket.h>
  15. #include <sys/time.h>
  16. #include <netinet/in.h>
  17. #ifdef INCLUDE_INTERFACE
  18. #include <sys/ipc.h>
  19. #include <sys/shm.h>
  20. #endif                 
  21. #include "pcap.h"  
  22.  
  23. /************************ Own includes *************************************/
  24. #include "sn_defines.h"                                 /* Various defines */
  25. #include "sn_structs.h"                                  /* All structures */
  26.  
  27. #include "sn_global.h"                                 /* some global defs */
  28. #include "sn_data.h"                                          /* data defs */
  29.  
  30. #include "sn_packets.h"                           /* My own packet structs */
  31. #include "sn_logfile.h"
  32. #include "sn_cfgfile.h"                            /* Config file handling */
  33.  
  34. #include "sn_plugins.h"                            /* Sniffit Plugins file */
  35.  
  36. #ifdef INCLUDE_INTERFACE
  37. #include "sn_interface.h"                            /* all ncurses stuff  */
  38. #endif
  39. #ifdef GENERATION
  40. #include "sn_generation.h"                    /* Sniffit Packet generation */
  41. #endif
  42.  
  43. #include "sniffit.h"                           /* definition of functions  */
  44.  
  45. static char Copyright[]= 
  46.     "Sniffit - Brecht Claerhout - Copyright 1996-97";
  47.  
  48. void quit (char *prog_name)                    /* Learn to use the program */
  49. {
  50.     printf(
  51. "usage: %s [-xdabvnN] [-P proto] [-A char] [-p port]\n"
  52. "       [-l sniflen] [-L loglevel] [-F snifdevice] [-M plugin]\n"
  53. #ifdef INCLUDE_INTERFACE
  54. "       [-D tty]" 
  55. " (-t<Target IP> | -s<Source IP>)"
  56. " | -i | -c<config file>]\n",
  57. #else
  58. "       (-t<Target IP> | -s<Source IP>) | -c<config file>]\n",
  59. #endif
  60.         prog_name);
  61. printf("Plugins Available:\n"); 
  62. #ifdef PLUGIN0_NAME
  63. printf("    0 -- %s\n",PLUGIN0_NAME);
  64. #endif
  65. #ifdef PLUGIN1_NAME
  66. printf("    1 -- %s\n",PLUGIN1_NAME);
  67. #endif
  68. #ifdef PLUGIN2_NAME
  69. printf("    2 -- %s\n",PLUGIN2_NAME);
  70. #endif
  71. #ifdef PLUGIN3_NAME
  72. printf("    3 -- %s\n",PLUGIN3_NAME);
  73. #endif
  74. #ifdef PLUGIN4_NAME
  75. printf("    4 -- %s\n",PLUGIN4_NAME);
  76. #endif
  77. #ifdef PLUGIN5_NAME
  78. printf("    5 -- %s\n",PLUGIN5_NAME);
  79. #endif
  80. #ifdef PLUGIN6_NAME
  81. printf("    6 -- %s\n",PLUGIN6_NAME);
  82. #endif
  83. #ifdef PLUGIN7_NAME
  84. printf("    7 -- %s\n",PLUGIN7_NAME);
  85. #endif
  86. #ifdef PLUGIN8_NAME
  87. printf("    8 -- %s\n",PLUGIN8_NAME);
  88. #endif
  89. #ifdef PLUGIN9_NAME
  90. printf("    9 -- %s\n",PLUGIN9_NAME);
  91. #endif
  92.  
  93. exit(0); 
  94. }
  95.  
  96. void my_exit (void)    {    exit(0);};
  97.  
  98. /* DEBUGGING INFO */
  99. #ifdef DEBUG
  100. void close_debug_device (void)
  101. {
  102. fclose(debug_dev);
  103. }
  104.  
  105. void debug_msg(char *debug_text)
  106. {
  107. fprintf(debug_dev,"%s (%d)\n",debug_text,debug_cnt);
  108. debug_cnt++;
  109. }
  110. #endif
  111.  
  112. char *strlower (char *string)
  113. {
  114.     int i;
  115.  
  116.     for(i=0;i<strlen(string);i++)
  117.             *(string+i) = ( isupper(*(string+i)) ? tolower(*(string+i)) : *(string+i) ); 
  118.     return string;
  119. }
  120.  
  121. void start_plugin(int PL_nr, struct Plugin_data *PL_d)
  122. {
  123. switch(PL_nr)
  124.     {
  125. #ifdef PLUGIN0_NAME
  126.     case 0: PLUGIN0(PL_d); break;
  127. #endif    
  128. #ifdef PLUGIN1_NAME
  129.     case 1: PLUGIN1(PL_d); break;
  130. #endif    
  131. #ifdef PLUGIN2_NAME
  132.     case 2: PLUGIN2(PL_d); break;
  133. #endif    
  134. #ifdef PLUGIN3_NAME
  135.     case 3: PLUGIN3(PL_d); break;
  136. #endif    
  137. #ifdef PLUGIN4_NAME
  138.     case 4: PLUGIN4(PL_d); break;
  139. #endif    
  140. #ifdef PLUGIN5_NAME
  141.     case 5: PLUGIN5(PL_d); break;
  142. #endif    
  143. #ifdef PLUGIN5_NAME
  144.     case 5: PLUGIN5(PL_d); break;
  145. #endif    
  146. #ifdef PLUGIN6_NAME
  147.     case 6: PLUGIN6(PL_d); break;
  148. #endif    
  149. #ifdef PLUGIN7_NAME
  150.     case 7: PLUGIN7(PL_d); break;
  151. #endif    
  152. #ifdef PLUGIN8_NAME
  153.     case 8: PLUGIN8(PL_d); break;
  154. #endif    
  155. #ifdef PLUGIN9_NAME
  156.     case 9: PLUGIN9(PL_d); break;
  157. #endif    
  158.     default: fprintf(stderr,"Plugin does not exist...\n"); exit(1); break;
  159.     }
  160. }
  161.  
  162. void reset_all (void) 
  163. {
  164.     start_dynam=NULL;
  165.     dynam_len=0;
  166. }
  167.  
  168. /* if do_file == 0, then don't handle the files */
  169. /* this is for the global logfile option        */
  170. struct file_info *add_dynam (char *file, char ptype, char do_file, 
  171.                                unsigned long cur_seq, int len) 
  172. {
  173.     int i;
  174.     FILE *f;
  175.     int last_time_out=0;
  176.     struct file_info *dummy_pointer; 
  177.     struct file_info *search_pointer; 
  178.  
  179.     if(dynam_len>=MAXCOUNT)
  180.         {
  181.                                      /* remove less effective connection from list */
  182.         search_pointer=start_dynam; dummy_pointer=start_dynam;          
  183.         do
  184.             {
  185.             if(search_pointer->time_out > last_time_out)
  186.                 {last_time_out=search_pointer->time_out;
  187.                 dummy_pointer=search_pointer;}
  188.             search_pointer=search_pointer->next;
  189.             }
  190.         while(search_pointer != NULL);
  191. #ifdef DEBUG
  192.             debug_msg("Auto timeout engaged (filename follows)");
  193.             debug_msg(dummy_pointer->filename);
  194. #endif
  195.         if(dummy_pointer->f==NULL)
  196.           delete_dynam(dummy_pointer->filename,dummy_pointer->proto,0);
  197.         else
  198.           delete_dynam(dummy_pointer->filename,dummy_pointer->proto,1);
  199.         printf("Too many connections... auto timeout\n"); 
  200.         }
  201.     if( (dummy_pointer=(struct file_info *)malloc(sizeof(struct file_info))) == NULL)
  202.         {printf("Couldn't allocate memory.\n"); exit(0);};
  203.     dummy_pointer->bytes=0;
  204.     dummy_pointer->proto=ptype;
  205.     strcpy(dummy_pointer->filename,file);
  206.     if(do_file!=0)
  207.         {
  208.         f = fopen(file,"a");   
  209.             if(f==NULL)
  210.             perror("Couldn't open logfile:"),exit(0);
  211.         dummy_pointer->f=f;
  212.         }
  213.     else    {
  214.         dummy_pointer->f=NULL;
  215.         }
  216.     dummy_pointer->next=NULL;
  217.     dummy_pointer->buffer=NULL;
  218.     dummy_pointer->log=0;
  219.     dummy_pointer->exp_seq=cur_seq+len;       
  220.     for(i=0;i<SCBUF;i++)    dummy_pointer->scroll_buf[i]=' ';       
  221.     dummy_pointer->scroll_buf[SCBUF]=0;       
  222.      
  223.     if(start_dynam==NULL)
  224.         start_dynam=dummy_pointer; 
  225.     else
  226.         {
  227.          search_pointer=start_dynam;
  228.         while(search_pointer->next != NULL)
  229.             search_pointer=search_pointer->next;
  230.         search_pointer->next=dummy_pointer;
  231.         }
  232.     dynam_len++;
  233.     return dummy_pointer;
  234. }
  235.  
  236. void delete_dynam (char *file, char ptype,char do_file)
  237. {
  238.     struct file_info *search_pointer;    
  239.     struct file_info *dummy_pointer;    
  240.  
  241.     if(start_dynam==NULL) return;
  242.     search_pointer=start_dynam;
  243.     if( (strcmp(search_pointer->filename,file)==0) &&
  244.                         (search_pointer->proto==ptype))
  245.         {
  246.         if(do_file!=0)    fclose(search_pointer->f);
  247.         start_dynam=search_pointer->next;
  248.         dynam_len--;
  249.         free(search_pointer);
  250.         return;
  251.         }
  252.      search_pointer=start_dynam;
  253.     if(search_pointer->next==NULL) return;
  254.     while(search_pointer->next != NULL)
  255.         {
  256.         if( (strcmp(search_pointer->next->filename,file)==0) &&
  257.                     (search_pointer->next->proto==ptype))
  258.             {
  259.             if(do_file!=0)     fclose(search_pointer->next->f);
  260.             dummy_pointer=search_pointer->next;
  261.             search_pointer->next=search_pointer->next->next;
  262.             if(dummy_pointer->buffer!=NULL) free(dummy_pointer->buffer);
  263.             free(dummy_pointer);
  264.             dynam_len--;
  265.             return;
  266.             }
  267.         search_pointer=search_pointer->next;
  268.         }
  269. }
  270.  
  271. /* returns NULL on failure */
  272. struct file_info *search_dynam(char *file, char ptype)
  273. {
  274.     struct file_info *search_pointer;
  275.  
  276.     if(start_dynam==NULL) return NULL;
  277.  
  278.      search_pointer=start_dynam;               /* time_out add */
  279.     do
  280.         {
  281.         search_pointer->time_out += 1;
  282.         search_pointer=search_pointer->next;
  283.         }
  284.     while(search_pointer != NULL);
  285.  
  286.      search_pointer=start_dynam;              /* actual search */
  287.     do
  288.         {
  289.         if( (strcmp(search_pointer->filename,file)==0) &&
  290.                     (search_pointer->proto==ptype))
  291.             {search_pointer->time_out=0;   /* timeout reset */
  292.             return search_pointer;}
  293.         search_pointer=search_pointer->next;
  294.         }
  295.     while(search_pointer != NULL);
  296.     return NULL;
  297. }
  298.  
  299. /* Type 0: TELNET  */
  300. void record_buf(struct file_info *dummy_pointer, unsigned long cur_seq_nr, 
  301.                              char *data, int len, int type) 
  302. {
  303. int i,j,noloop=0;
  304.  
  305. if(dummy_pointer->exp_seq != cur_seq_nr) 
  306.     {return;}
  307. noloop=0;
  308. for(i=0;i<len;i++)
  309.   {
  310.   j=dummy_pointer->bytes;
  311.   switch(type)
  312.       {
  313.     case 0: if(data[i]==TELNET_ENTER)                 /* return found */
  314.             {dummy_pointer->log++;noloop=1;};
  315.         break;
  316.     default: break;
  317.     }
  318.   if(noloop==1)    break;
  319.   if(j>=LOG_PASS_BUF)    break;
  320.   if(isprint(data[i]))
  321.     {dummy_pointer->buffer[j]=data[i];}
  322.   else  {dummy_pointer->buffer[j]='~';};
  323.   dummy_pointer->buffer[j+1]=0;
  324.   dummy_pointer->bytes+=1;
  325.   }
  326. #ifdef    DEBUG_ONSCREEN
  327.     printf("Record buffer: >%s<  (%d)\n",dummy_pointer->buffer,dummy_pointer->bytes); 
  328. #endif
  329. }
  330.  
  331. void sb_shift(struct file_info *dummy_pointer)
  332. {
  333. int i,j;
  334.  
  335. for(i=1;i<SCBUF;i++)
  336.     dummy_pointer->scroll_buf[i-1]=dummy_pointer->scroll_buf[i];
  337. }
  338.  
  339. void sbuf_update(struct file_info *dummy_pointer, unsigned long cur_seq_nr, 
  340.                                   char *data, int len) 
  341. {
  342. int i;
  343.  
  344. if(dummy_pointer->exp_seq != cur_seq_nr)
  345.     {return;}
  346.  
  347. for(i=0;i<len;i++)
  348.   {
  349.   sb_shift(dummy_pointer);
  350.   if(data[i]!=0)      /* used to be 'isprint', not possible for ftp logging */
  351.       {dummy_pointer->scroll_buf[SCBUF-1]=data[i];}
  352.   else    {dummy_pointer->scroll_buf[SCBUF-1]='.';};        
  353.   }
  354. #ifdef DEBUG_ONSCREEN
  355.     printf("scr_buf: %s\n",dummy_pointer->scroll_buf);
  356. #endif
  357. }
  358.  
  359. void print_iphead (struct IP_header *iphead, char icmp_or_plain)
  360. {
  361.         int dummy;
  362.     unsigned char *so,*dest;
  363.     
  364.     if(icmp_or_plain!=0)
  365.         printf("ICMP message concerned following IP packet:\n");
  366.     so=(unsigned char *)&(iphead->source);
  367.            dest=(unsigned char *)&(iphead->destination);
  368.     printf("from %u.%u.%u.%u to %u.%u.%u.%u\n",
  369.                     so[0],so[1],so[2],so[3],
  370.                                         dest[0],dest[1],dest[2],dest[3]);
  371.         dummy=iphead->type; dummy>>=5;
  372.         printf("IP Packet precedence: %s   (%c%c%c)\n",
  373.                                     IP_TYPE_precedence[dummy],
  374.                                         (iphead->type&IP_DELAY)?'D':'-',
  375.                                         (iphead->type&IP_THROUGHPUT)?'T':'-',
  376.                                         (iphead->type&IP_RELIABILITY)?'R':'-');
  377.         dummy=ntohs(iphead->flag_offset); dummy>>=13;
  378.         printf("FLAGS: %s %s     Time to live (secs): %d\n",
  379.                                     (dummy&IP_DF)?"DF":"--",
  380.                                         (dummy&IP_MF)?"MF":"--",
  381.                                      iphead->TTL);
  382.         if(iphead->protocol < 34)
  383.                 printf("Protocol (%d): %s\n",iphead->protocol,
  384.                         IP_PROTOCOL_number[iphead->protocol]);
  385.         else    printf("Protocol (%d) not recognised\n",iphead->protocol);
  386.     printf("\n");
  387. }
  388.  
  389. int check_packet(unsigned long ipaddr,
  390.         const struct packetheader *p_header, 
  391.         const unsigned char *sp,
  392.         char *file,
  393.         char *file2,
  394.         struct unwrap *info,
  395.         char *detail,
  396.         int MODE)       
  397.                                           /* MODE 0: -t   MODE 1: -s */
  398.                                           /* MODE 2: -b              */ 
  399. {
  400.         unsigned char *so,*dest;
  401.     char wc_so[20], wc_dest[20];
  402.     struct IP_header iphead;
  403.     struct TCP_header tcphead;
  404.     struct ICMP_header icmphead;
  405.     struct UDP_header udphead;
  406.     int proto;
  407.     unsigned int prior; char selected; int i;    /* Wildcard stuff */
  408.         unsigned char *str_IP;
  409.     unsigned int n_s;           /* strlen short notation for wc bugfix */
  410.  
  411.     proto=unwrap_packet(sp, info); 
  412.     if(proto == NO_IP)    return DONT_EXAMINE; /* no use in trying */
  413.     if(proto == NO_IP_4)    return DONT_EXAMINE; /* no use in trying */
  414.     if(proto == CORRUPT_IP)    
  415.       {printf("Suspicious Packet detected... (Split header)\n");
  416.        return DONT_EXAMINE;}
  417.  
  418.         memcpy(&iphead,(sp+PROTO_HEAD),sizeof(struct IP_header));
  419.     so=(unsigned char *)&(iphead.source);
  420.            dest=(unsigned char *)&(iphead.destination);
  421.  
  422.     if(info->FRAG_nf!=0)
  423.       {printf("Fragment Skipped...\n"); return DONT_EXAMINE; };
  424.  
  425.     if((proto==TCP)&&(PROTOCOLS&F_TCP)) 
  426.         {
  427. #ifdef DEBUG_ONSCREEN
  428. printf("TCP Packet\n");
  429. #endif
  430.         memcpy(&tcphead,(sp+PROTO_HEAD+info->IP_len),
  431.                         sizeof(struct TCP_header));
  432.         memcpy(detail,&tcphead,sizeof(struct TCP_header));
  433.  
  434.         if((WILDCARD==0)&&(CFG_FILE==0))     /* Selection criteria */
  435.           {
  436.           if (MODE == DEST && ipaddr != iphead.destination   /* -t */
  437.             ||
  438.                  MODE == SOURCE && ipaddr != iphead.source      /* -s */
  439.             ||
  440.               MODE == BOTH && ipaddr != iphead.destination   /* -b */
  441.                   && ipaddr != iphead.source
  442.                  )  return DONT_EXAMINE; /* Check destination/source IP */
  443.           }
  444.         else
  445.           {
  446.           if (WILDCARD!=0) /* Wildcards */
  447.             {   
  448. #ifdef DEBUG_ONSCREEN
  449. printf("WILDCARD\n");
  450. #endif
  451.             sprintf(wc_so,"%u.%u.%u.%u",so[0],so[1],so[2],so[3]);
  452.             sprintf(wc_dest,"%u.%u.%u.%u",dest[0],dest[1],dest[2],dest[3]);
  453.             n_s = strlen(IP);
  454.             if (MODE == DEST && (strncmp(wc_dest,IP,n_s)!=0) /* -t */
  455.                        ||
  456.                    MODE == SOURCE && (strncmp(wc_so,IP,n_s)!=0) /* -s */
  457.                     ||
  458.                 MODE == BOTH && (strncmp(wc_dest,IP,n_s)!=0) /* -b */
  459.                      && (strncmp(wc_so,IP,n_s)!=0)
  460.                    )   return DONT_EXAMINE; 
  461.                           /* Check destination/source IP */
  462.             }
  463.           else     { /* We are using the config file (4*Check) */
  464.                    prior=0; selected=0;
  465.                 sprintf(wc_so,"%u.%u.%u.%u",so[0],so[1],so[2],so[3]);
  466.                 sprintf(wc_dest,"%u.%u.%u.%u",dest[0],dest[1],dest[2],dest[3]);
  467. #ifdef DEBUG_ONSCREEN
  468. printf("CONCERNING: %s  %d - %s  %d\n",wc_so,ntohs(tcphead.source),wc_dest,ntohs(tcphead.destination));
  469. #endif
  470.                         /* Highest prior last (backward+break for speed)  */
  471.             for(i=(select_from_length-1);i>=0;i--)
  472.               {
  473.               if(prior > select_from_list[i].priority) break;
  474.               str_IP = select_from_list[i].host;
  475. #ifdef DEBUG_ONSCREEN
  476. printf("SF: %s  %d   Prior:%d\n",str_IP,select_from_list[i].port,select_from_list[i].priority);
  477. #endif
  478.                   if((select_from_list[i].port==0) || 
  479.                  (select_from_list[i].port==ntohs(tcphead.source)))
  480.                 {
  481.                 if(select_from_list[i].wildcard==0)
  482.                   {                          /* NO wildcard */ 
  483.                        if(strcmp(wc_so,str_IP)==0)
  484.                     {selected=1; 
  485.                                 prior=select_from_list[i].priority;
  486.                             break;} 
  487.                   }
  488.                 else
  489.                   {                            /* wildcard */
  490.                        if(strncmp(wc_so,str_IP,strlen(str_IP))==0)
  491.                      {selected=1; 
  492.                               prior=select_from_list[i].priority;
  493.                           break;} 
  494.                   }
  495.                     if(str_IP[0]==0)
  496.                     {selected=1; break;};
  497.                 }
  498.               }
  499.  
  500.             for(i=(select_to_length-1);i>=0;i--)
  501.               {
  502.               if(prior > select_to_list[i].priority) break;
  503.               str_IP = select_to_list[i].host;
  504. #ifdef DEBUG_ONSCREEN
  505. printf("ST: %s  %d   Prior:%d\n",str_IP,select_to_list[i].port,select_to_list[i].priority);
  506. #endif
  507.                   if((select_to_list[i].port==0) || 
  508.                  (select_to_list[i].port==ntohs(tcphead.destination)))
  509.                 {
  510.                 if(select_to_list[i].wildcard==0)
  511.                   {                          /* NO wildcard */ 
  512.                        if(strcmp(wc_dest,str_IP)==0)
  513.                     {selected=1;
  514.                                 prior=select_to_list[i].priority;
  515.                             break;} 
  516.                   }
  517.                 else
  518.                   {                            /* wildcard */
  519.                        if(strncmp(wc_dest,str_IP,strlen(str_IP))==0)
  520.                      {selected=1; 
  521.                               prior=select_to_list[i].priority;
  522.                           break;} 
  523.                   }
  524.                     if(str_IP[0]==0)
  525.                     {selected=1; break;};
  526.                     }
  527.               }
  528.  
  529.             for(i=(deselect_from_length-1);i>=0;i--)
  530.               {
  531.               if(prior > deselect_from_list[i].priority) break;
  532.               str_IP = deselect_from_list[i].host;
  533. #ifdef DEBUG_ONSCREEN
  534. printf("DF: %s  %d   Prior:%d\n",str_IP,deselect_from_list[i].port,deselect_from_list[i].priority);
  535. #endif
  536.                   if((deselect_from_list[i].port==0) || 
  537.                  (deselect_from_list[i].port==ntohs(tcphead.source)))
  538.                 {
  539.                 if(deselect_from_list[i].wildcard==0)
  540.                   {                          /* NO wildcard */ 
  541.                        if(strcmp(wc_so,str_IP)==0)
  542.                     {selected=0; 
  543.                                 prior=deselect_from_list[i].priority;
  544.                             break;} 
  545.                   }
  546.                 else
  547.                   {                            /* wildcard */
  548.                        if(strcmp(wc_so,str_IP)==0)
  549.                      {selected=0; 
  550.                               prior=deselect_from_list[i].priority;
  551.                           break;} 
  552.                   }
  553.                     if(str_IP[0]==0)
  554.                     {selected=0; break;};
  555.  
  556.                     }
  557.               }
  558.  
  559.             for(i=(deselect_to_length-1);i>=0;i--)
  560.               {
  561.               if(prior > deselect_to_list[i].priority) break;
  562.               str_IP = deselect_to_list[i].host;
  563. #ifdef DEBUG_ONSCREEN
  564. printf("DT: %s  %d   Prior:%d\n",str_IP,deselect_to_list[i].port,deselect_to_list[i].priority);
  565. #endif
  566.                   if((deselect_to_list[i].port==0) || 
  567.                  (deselect_to_list[i].port==ntohs(tcphead.destination)))
  568.                 {
  569.                 if(deselect_to_list[i].wildcard==0)
  570.                   {                          /* NO wildcard */ 
  571.                        if(strncmp(wc_dest,str_IP,strlen(str_IP))==0)
  572.                     {selected=0; 
  573.                                 prior=deselect_to_list[i].priority;
  574.                             break;} 
  575.                   }
  576.                 else
  577.                   {                            /* wildcard */
  578.                        if(strncmp(wc_dest,str_IP,strlen(str_IP))==0)
  579.                      {selected=0; 
  580.                               prior=deselect_to_list[i].priority;
  581.                           break;} 
  582.                   }
  583.                     if(str_IP[0]==0)
  584.                     {selected=0; break;};
  585.  
  586.                     }
  587.               }
  588.  
  589. #ifdef DEBUG_ONSCREEN
  590. printf("Selected: %d\n",selected);
  591. #endif
  592.                            if(selected==0) return DONT_EXAMINE; 
  593.  
  594.             }
  595.           }
  596.  
  597.         if( DEST_PORT && ntohs(tcphead.destination) != DEST_PORT) 
  598.             return DONT_EXAMINE;     /* Check dest. PORT */
  599.  
  600. #ifdef DEBUG_ONSCREEN
  601. printf("Packet accepted\n");
  602. #endif
  603.  
  604.                           /* inet_ntoa gave wrong output sometimes */
  605.         sprintf(file,"%u.%u.%u.%u.%u-%u.%u.%u.%u.%u",
  606.                     so[0],so[1],so[2],so[3],
  607.                     (unsigned short)ntohs(tcphead.source),
  608.                     dest[0],dest[1],dest[2],dest[3],
  609.                     (unsigned short)ntohs(tcphead.destination));
  610.         sprintf(file2,"%u.%u.%u.%u.%u-%u.%u.%u.%u.%u",
  611.                     dest[0],dest[1],dest[2],dest[3],
  612.                     (unsigned short)ntohs(tcphead.destination),
  613.                     so[0],so[1],so[2],so[3],
  614.                     (unsigned short)ntohs(tcphead.source));
  615.  
  616.         if ((ntohs(tcphead.offset_flag) & FIN) != 0)  
  617.                         /* check for reset conn. */
  618.             return TCP_FINISH;            /* packet is a FIN */
  619.  
  620. /* NEW TEST  */
  621.         if ((ntohs(tcphead.offset_flag) & RST) != 0)  
  622.                         /* check for reset conn. */
  623.             return TCP_FINISH;            /* packet is a FIN */
  624.  
  625.         /*
  626.         Used to be for speed, '-x' needs all info, so this too!
  627.         if (info->DATA_len == 0)
  628.               return DONT_EXAMINE;        
  629.         */
  630.  
  631.         return TCP_EXAMINE;                 /* interprete packet */
  632.         };
  633.     if((proto==ICMP)&&(PROTOCOLS&F_ICMP))      /* ICMP packet checking */
  634.         {
  635.         memcpy(&icmphead,(sp+PROTO_HEAD+info->IP_len),
  636.                         sizeof(struct ICMP_header));
  637.         memcpy(detail,&icmphead,sizeof(struct ICMP_header));
  638.         sprintf(file,"%u.%u.%u.%u > %u.%u.%u.%u",
  639.                     so[0],so[1],so[2],so[3],
  640.                     dest[0],dest[1],dest[2],dest[3]);
  641.         return ICMP_EXAMINE;
  642.         };
  643.     if((proto==UDP)&&(PROTOCOLS&F_UDP))       /* UDP packet checking */
  644.         {
  645. #ifdef DEBUG_ONSCREEN
  646. printf("UDP Packet\n");
  647. #endif
  648.         memcpy(&udphead,(sp+PROTO_HEAD+info->IP_len),
  649.                         sizeof(struct UDP_header));
  650.         memcpy(detail,&udphead,sizeof(struct UDP_header));
  651.  
  652.         if((WILDCARD==0)&&(CFG_FILE==0))     /* Selection criteria */
  653.           {
  654.           if (MODE == DEST && ipaddr != iphead.destination   /* -t */
  655.             ||
  656.                  MODE == SOURCE && ipaddr != iphead.source      /* -s */
  657.             ||
  658.               MODE == BOTH && ipaddr != iphead.destination   /* -b */
  659.                   && ipaddr != iphead.source
  660.                  )  return DONT_EXAMINE; /* Check destination/source IP */
  661.           }
  662.         else
  663.           {
  664.           if (WILDCARD!=0) /* Wildcards */
  665.             {   
  666.             sprintf(wc_so,"%u.%u.%u.%u",so[0],so[1],so[2],so[3]);
  667.             sprintf(wc_dest,"%u.%u.%u.%u",dest[0],dest[1],dest[2],dest[3]);
  668.             n_s = strlen(IP);
  669.             if (MODE == DEST && (strncmp(wc_dest,IP,n_s)!=0) /* -t */
  670.                        ||
  671.                    MODE == SOURCE && (strncmp(wc_so,IP,n_s)!=0) /* -s */
  672.                     ||
  673.                 MODE == BOTH && (strncmp(wc_dest,IP,n_s)!=0) /* -b */
  674.                      && (strncmp(wc_so,IP,n_s)!=0)
  675.                    )   return DONT_EXAMINE; 
  676.                           /* Check destination/source IP */
  677.             }
  678.           else     { /* We are using the config file (4*Check) */
  679.                    prior=0; selected=0;
  680.                 sprintf(wc_so,"%u.%u.%u.%u",so[0],so[1],so[2],so[3]);
  681.                 sprintf(wc_dest,"%u.%u.%u.%u",dest[0],dest[1],dest[2],dest[3]);
  682. #ifdef DEBUG_ONSCREEN
  683. printf("CONCERNING: %s  %d - %s  %d\n",wc_so,ntohs(udphead.source),wc_dest,ntohs(udphead.destination));
  684. #endif
  685.                         /* Highest prior last (backward+break for speed)  */
  686.             for(i=(select_from_length-1);i>=0;i--)
  687.               {
  688.               if(prior > select_from_list[i].priority) break;
  689.               str_IP = select_from_list[i].host;
  690. #ifdef DEBUG_ONSCREEN
  691. printf("SF: %s  %d   Prior:%d\n",str_IP,select_from_list[i].port,select_from_list[i].priority);
  692. #endif
  693.                   if((select_from_list[i].port==0) || 
  694.                  (select_from_list[i].port==ntohs(udphead.source)))
  695.                 {
  696.                 if(select_from_list[i].wildcard==0)
  697.                   {                          /* NO wildcard */ 
  698.                        if(strcmp(wc_so,str_IP)==0)
  699.                     {selected=1; 
  700.                                 prior=select_from_list[i].priority;
  701.                             break;} 
  702.                   }
  703.                 else
  704.                   {                            /* wildcard */
  705.                        if(strncmp(wc_so,str_IP,strlen(str_IP))==0)
  706.                      {selected=1; 
  707.                               prior=select_from_list[i].priority;
  708.                           break;} 
  709.                   }
  710.                     if(str_IP[0]==0)
  711.                     {selected=1; break;};
  712.                 }
  713.               }
  714.  
  715.             for(i=(select_to_length-1);i>=0;i--)
  716.               {
  717.               if(prior > select_to_list[i].priority) break;
  718.               str_IP = select_to_list[i].host;
  719. #ifdef DEBUG_ONSCREEN
  720. printf("ST: %s  %d   Prior:%d\n",str_IP,select_to_list[i].port,select_to_list[i].priority);
  721. #endif
  722.                   if((select_to_list[i].port==0) || 
  723.                  (select_to_list[i].port==ntohs(udphead.destination)))
  724.                 {
  725.                 if(select_to_list[i].wildcard==0)
  726.                   {                          /* NO wildcard */ 
  727.                        if(strcmp(wc_dest,str_IP)==0)
  728.                     {selected=1;
  729.                                 prior=select_to_list[i].priority;
  730.                             break;} 
  731.                   }
  732.                 else
  733.                   {                            /* wildcard */
  734.                        if(strncmp(wc_dest,str_IP,strlen(str_IP))==0)
  735.                      {selected=1; 
  736.                               prior=select_to_list[i].priority;
  737.                           break;} 
  738.                   }
  739.                     if(str_IP[0]==0)
  740.                     {selected=1; break;};
  741.                     }
  742.               }
  743.  
  744.             for(i=(deselect_from_length-1);i>=0;i--)
  745.               {
  746.               if(prior > deselect_from_list[i].priority) break;
  747.               str_IP = deselect_from_list[i].host;
  748. #ifdef DEBUG_ONSCREEN
  749. printf("DF: %s  %d   Prior:%d\n",str_IP,deselect_from_list[i].port,deselect_from_list[i].priority);
  750. #endif
  751.                   if((deselect_from_list[i].port==0) || 
  752.                  (deselect_from_list[i].port==ntohs(udphead.source)))
  753.                 {
  754.                 if(deselect_from_list[i].wildcard==0)
  755.                   {                          /* NO wildcard */ 
  756.                        if(strcmp(wc_so,str_IP)==0)
  757.                     {selected=0; 
  758.                                 prior=deselect_from_list[i].priority;
  759.                             break;} 
  760.                   }
  761.                 else
  762.                   {                            /* wildcard */
  763.                        if(strcmp(wc_so,str_IP)==0)
  764.                      {selected=0; 
  765.                               prior=deselect_from_list[i].priority;
  766.                           break;} 
  767.                   }
  768.                     if(str_IP[0]==0)
  769.                     {selected=0; break;};
  770.  
  771.                     }
  772.               }
  773.  
  774.             for(i=(deselect_to_length-1);i>=0;i--)
  775.               {
  776.               if(prior > deselect_to_list[i].priority) break;
  777.               str_IP = deselect_to_list[i].host;
  778. #ifdef DEBUG_ONSCREEN
  779. printf("DT: %s  %d   Prior:%d\n",str_IP,deselect_to_list[i].port,deselect_to_list[i].priority);
  780. #endif
  781.                   if((deselect_to_list[i].port==0) || 
  782.                  (deselect_to_list[i].port==ntohs(udphead.destination)))
  783.                 {
  784.                 if(deselect_to_list[i].wildcard==0)
  785.                   {                          /* NO wildcard */ 
  786.                        if(strncmp(wc_dest,str_IP,strlen(str_IP))==0)
  787.                     {selected=0; 
  788.                                 prior=deselect_to_list[i].priority;
  789.                             break;} 
  790.                   }
  791.                 else
  792.                   {                            /* wildcard */
  793.                        if(strncmp(wc_dest,str_IP,strlen(str_IP))==0)
  794.                      {selected=0; 
  795.                               prior=deselect_to_list[i].priority;
  796.                           break;} 
  797.                   }
  798.                     if(str_IP[0]==0)
  799.                     {selected=0; break;};
  800.  
  801.                     }
  802.               }
  803.  
  804. #ifdef DEBUG_ONSCREEN
  805. printf("Selected: %d\n",selected);
  806. #endif
  807.                            if(selected==0) return DONT_EXAMINE; 
  808.  
  809.             }
  810.           }
  811.  
  812.         if( DEST_PORT && ntohs(udphead.destination) != DEST_PORT) 
  813.             return DONT_EXAMINE;    /* Check dest. PORT */
  814.  
  815.                           /* inet_ntoa gave wrong output sometimes */
  816.         sprintf(file,"%u.%u.%u.%u.%u-%u.%u.%u.%u.%u",
  817.                     so[0],so[1],so[2],so[3],
  818.                     (unsigned short)ntohs(udphead.source),
  819.                     dest[0],dest[1],dest[2],dest[3],
  820.                     (unsigned short)ntohs(udphead.destination));
  821.         sprintf(file2,"%u.%u.%u.%u.%u-%u.%u.%u.%u.%u",
  822.                     dest[0],dest[1],dest[2],dest[3],
  823.                     (unsigned short)ntohs(udphead.destination),
  824.                     so[0],so[1],so[2],so[3],
  825.                     (unsigned short)ntohs(udphead.source));
  826.         return UDP_EXAMINE;                 /* interprete packet */
  827.         }
  828.     return DONT_EXAMINE;
  829. }
  830.  
  831. /* Default Processing of packets */
  832. pcap_handler packethandler(unsigned char *ipaddrpoint, 
  833.             const struct packetheader *p_header, 
  834.             const unsigned char *sp) 
  835. { 
  836.     char filename[50], filename2[50],header[SNAPLEN];
  837.     FILE *f;
  838.     struct file_info *dummy_pointer;
  839.     unsigned char status=0;
  840.     char *help;
  841.     int dummy,finish;                    /* look out it's signed */
  842.     unsigned long datalen, position, total_length, i, n, ipaddr;
  843.     struct unwrap info;
  844.         struct IP_header iphead;
  845.     struct TCP_header tcphead;
  846.     struct ICMP_header icmphead;
  847.     struct IP_header iphead_icmp;
  848.         struct UDP_header udphead;
  849.     struct Plugin_data PL_d, PL_dex;
  850.     
  851.     memcpy(&ipaddr,ipaddrpoint,sizeof(unsigned long));
  852.        
  853.     finish=check_packet(ipaddr,p_header,sp,filename,filename2,&info,header,SNIFMODE); 
  854.         if(PROTOCOLS & F_IP)
  855.                 memcpy(&iphead,(sp+PROTO_HEAD),sizeof(struct IP_header)),
  856.                             print_iphead(&iphead,0);
  857.         if(finish==DONT_EXAMINE) 
  858.         return;                         /* Packet is not for us */
  859.  
  860. #ifdef DEBUG_ONSCREEN
  861. printf("Processing Packet (finish: %d)\n",finish);
  862. #endif
  863.  
  864.     if((finish<10)||(finish>=20&&finish<30))         /* Start plugin */
  865.         {
  866.         /* fixing data structure */
  867.         memcpy(&(PL_d.PL_info),&info,sizeof(struct unwrap));
  868.                 memcpy(&(PL_d.PL_iphead),(sp+PROTO_HEAD),sizeof(struct IP_header));
  869.         memcpy(&(PL_d.PL_tcphead),(sp+PROTO_HEAD+info.IP_len),sizeof(struct TCP_header));
  870.         memcpy(&(PL_d.PL_udphead),(sp+PROTO_HEAD+info.IP_len),sizeof(struct UDP_header));
  871.         if(PL_d.PL_iphead.protocol == TCP)        
  872.           memcpy(PL_d.PL_data,(sp+PROTO_HEAD+info.IP_len+info.TCP_len),info.DATA_len);
  873.         if(PL_d.PL_iphead.protocol == UDP)        
  874.           memcpy(PL_d.PL_data,(sp+PROTO_HEAD+info.IP_len+info.UDP_len),info.DATA_len);
  875.         memcpy(PL_d.PL_packet,(sp+PROTO_HEAD),
  876.              info.IP_len+info.TCP_len+info.UDP_len+info.DATA_len);
  877.  
  878.         /* starting all plugins */
  879.         for(i=0;i<10;i++)
  880.             if(Plugin_Active[i]==1)
  881.                 {
  882.                 memcpy(&PL_dex,&PL_d,sizeof(struct Plugin_data));
  883.                 start_plugin(i,&PL_dex);
  884.                 }
  885.         }
  886.  
  887.     if((DUMPMODE & 32)&&(finish<10))    /* extended info TCP only */
  888.         {
  889.         memcpy(&tcphead,header,sizeof(struct TCP_header));
  890.         dummy=ntohs(tcphead.offset_flag);  
  891.         printf("\n");
  892.         printf("TCP Packet ID (from_IP.port-to_IP.port): %s\n",filename);
  893.         printf("   SEQ (hex): %lX   ",ntohl(tcphead.seq_nr));
  894.         if(dummy&ACK) printf("ACK (hex): %lX\n",ntohl(tcphead.ACK_nr));
  895.         printf("   FLAGS: %c%c%c%c%c%c",
  896.                 (dummy&URG)?'U':'-',(dummy&ACK)?'A':'-',
  897.                 (dummy&PSH)?'P':'-',(dummy&RST)?'R':'-',
  898.                 (dummy&SYN)?'S':'-',(dummy&FIN)?'F':'-');
  899.         if(dummy&ACK) 
  900.             printf("   Window: %X\n",ntohs(tcphead.window));
  901.         else     printf("\n");
  902.         };
  903.  
  904.     if((finish<10)&&(LOGLEVEL==0))              /* TCP packet */
  905.         /* I didn't use flags for later extention, and they */ 
  906.         /* don't come in pairs anyhow */
  907.         /* use return instead of else {if}, for later extention */
  908.         {
  909.         memcpy(&tcphead,header,sizeof(struct TCP_header));
  910.         switch(DUMPMODE & 223) /* without '32' bit 5 */ 
  911.           {
  912.           case 0:                     /* LOG mode */
  913.           status=0;
  914.  
  915.             dummy_pointer=search_dynam(filename, TCP);
  916.           if(dummy_pointer!=NULL) status=1; 
  917.           /* make a new entry unless it's reset */
  918.           if(status==0)               
  919.               {
  920.               if(finish==TCP_FINISH) return;      
  921.                     /* there was never data transmitted */
  922.             /* seq_nr & datalen not important here yet */
  923.             if((dummy_pointer=add_dynam(filename, TCP, 1, 0, 0))==NULL)
  924.                 return;
  925.             }
  926.           f=dummy_pointer->f;
  927.  
  928.           if(dummy_pointer->bytes<=SNIFLEN) {
  929.             const unsigned char *data = 
  930.                     sp+PROTO_HEAD+info.IP_len+info.TCP_len;
  931.             if(SNIFLEN!=0)
  932.                 dummy_pointer->bytes+=info.DATA_len;       
  933.                         /* last packet is written  */
  934.                                                 /* don't care about length */
  935.             if(ASC==0)
  936.                 {for(i=0;i<info.DATA_len;i++) 
  937.                     fprintf(f,"%c", data[i]);}
  938.             else    {
  939.                 for(i=0;i<info.DATA_len;i++)
  940.                     fprintf(f,"%c", isprint(data[i])?data[i]:non_printable);
  941.                 };
  942.               fflush(f);                                                  /* write all */
  943.             }
  944.           if(finish==TCP_FINISH) /* let's reset the connection */
  945.             delete_dynam(filename, TCP, 1);
  946.           break;
  947.         
  948.           case 1:         /* DUMP mode */
  949.             case 2:
  950.           case 3:
  951.               printf("Packet ID (from_IP.port-to_IP.port): %s\n",filename);
  952.             total_length=info.IP_len+info.TCP_len+info.DATA_len;
  953.             n = 0;
  954.             for(i=0;i<total_length;i++) {
  955.                 unsigned char c = sp[PROTO_HEAD+i];
  956.                 if(n > 75)
  957.                     n=0, printf("\n");
  958.                 if(DUMPMODE & 1)
  959.                     n += printf(" %02X",c); 
  960.                 if(DUMPMODE & 2)
  961.                     n += printf(" %c",isprint(c)?c:'.');
  962.             }
  963.             printf("\n\n");
  964.             break;
  965.     
  966.           case 128: break; /* NO LOGGING MODE */
  967.             default: 
  968.             printf("\nYou mixed incompatible options!\n");
  969.             exit(0); 
  970.           }
  971.               return;
  972.         }
  973.  
  974.     if((finish<10)&&(LOGLEVEL!=0))        /* TCP packet - logfile   */
  975.         /* This mode will grow, so I just copied the other if() */
  976.         /* instead of adding a dumpmode, I think this will keep */
  977.         /* things more simpel. Also I use the smart dynam       */ 
  978.         /* managment of connections                             */
  979.         {
  980.         memcpy(&tcphead,header,sizeof(struct TCP_header));
  981.           
  982.         dummy_pointer=search_dynam(filename, TCP);
  983.         if(dummy_pointer!=NULL) status=1; 
  984.         /* make a new entry unless it's reset */
  985.         if(status==0)               
  986.               {
  987.               if(finish!=TCP_FINISH) 
  988.                 if((dummy_pointer=add_dynam(filename, TCP, 0,ntohl(tcphead.seq_nr),info.DATA_len))==NULL)
  989.                     return;
  990.             }
  991.  
  992.         if(finish==TCP_FINISH) /* let's reset the connection */
  993.             {delete_dynam(filename, TCP, 0);}
  994.                 /*** return before using any search or pointer!!!!!!!! ***/
  995.                 /* Connections with FIN have deleted entries! */
  996.  
  997.         dummy=ntohs(tcphead.offset_flag);
  998.     
  999.         if(LOGLEVEL<10)          /* Raw logging */
  1000.           {
  1001.                if(dummy&SYN)    
  1002.                  print_conn(filename,"Connection initiated. (SYN)");
  1003.                if(dummy&FIN)   
  1004.                  print_conn(filename,"Connection ending. (FIN)");
  1005.                if(dummy&RST)   
  1006.                  print_conn(filename,"Connection reset. (RST)");
  1007.           return;
  1008.           }
  1009.         if(LOGLEVEL<30)          /* more sophisticated */
  1010.           {
  1011.           const unsigned char *data = sp+PROTO_HEAD+info.IP_len+info.TCP_len;
  1012.  
  1013.           if(search_dynam(filename2, TCP)==NULL)
  1014.                   {
  1015.              if(dummy&SYN)    
  1016.                      print_conn(filename,"Connection initiated.");
  1017.     
  1018.                   if(dummy&FIN)   
  1019.                      print_conn(filename2,"Connection closed.");
  1020.                 
  1021.              }
  1022.                if(dummy&FIN) return; /* needed, cauz entry don't exist  */  
  1023.           if(LOGLEVEL>=12)            /* loglevel 12 */
  1024.             {
  1025.             dummy_pointer=search_dynam(filename, TCP);
  1026.                     /* don't forget to check dummy_pointer!!! */
  1027.             
  1028.             if( (ntohs(tcphead.source) == 23) &&
  1029.                          (dummy_pointer!=NULL))/* from telnet */
  1030.               {
  1031.               sbuf_update(dummy_pointer,ntohl(tcphead.seq_nr),data,info.DATA_len);
  1032.               /* detect login */
  1033.               strlower(dummy_pointer->scroll_buf);
  1034.  
  1035.               if((dummy_pointer->log!=99)&&(strstr(dummy_pointer->scroll_buf,"login")!=NULL))
  1036.              {
  1037.             dummy_pointer->log=99;
  1038.             dummy_pointer=search_dynam(filename2, TCP);
  1039.                         if(dummy_pointer!=NULL)
  1040.                 {dummy_pointer->log=1; 
  1041.                 dummy_pointer->bytes=0;
  1042.                 dummy_pointer->buffer=malloc(LOG_PASS_BUF);
  1043.                 if(dummy_pointer->buffer==NULL) exit(1);
  1044.                 dummy_pointer->buffer[0]=0;
  1045.                 }
  1046.             else    {
  1047.                 print_conn(filename2,"Password missed due to overload.");
  1048.                 };
  1049. #ifdef DEBUG_ONSCREEN
  1050.             printf("Login detected, data initialised.\n");
  1051. #endif
  1052.             }
  1053.                }
  1054.  
  1055.             if( (ntohs(tcphead.destination) == 23) &&
  1056.                          (dummy_pointer!=NULL))/* TO telnet */
  1057.               {
  1058.               if(dummy_pointer->log==1)    /* log login */
  1059.             {
  1060.             record_buf(dummy_pointer,ntohl(tcphead.seq_nr),data,info.DATA_len,0);
  1061.                  if(dummy_pointer->log==2) /* login recorded */ 
  1062.                 {
  1063.                                 print_login(filename,dummy_pointer->buffer);
  1064.                      dummy_pointer->log=3; dummy_pointer->bytes=0;
  1065.                      dummy_pointer->buffer[0]=0;
  1066.                 }    
  1067.             }
  1068.               else
  1069.             {
  1070.                 if(dummy_pointer->log==3)    /* log pwd */
  1071.               {
  1072.               record_buf(dummy_pointer,ntohl(tcphead.seq_nr),data,info.DATA_len,0);
  1073.                    if(dummy_pointer->log==4) /* passwd recorded */ 
  1074.                 {
  1075.                                 print_pwd(filename,dummy_pointer->buffer);
  1076.                      dummy_pointer->log=0; dummy_pointer->bytes=0;
  1077.                      dummy_pointer->buffer[0]=0;
  1078.                 }    
  1079.                }
  1080.             }
  1081.                }
  1082.                     }
  1083.  
  1084.             if( (ntohs(tcphead.destination) == 21) &&
  1085.                          (dummy_pointer!=NULL))/* to FTP */
  1086.               {
  1087.               sbuf_update(dummy_pointer,ntohl(tcphead.seq_nr),data,info.DATA_len);
  1088.               /* detect USER en PASS  */
  1089.               if((help=strstr(dummy_pointer->scroll_buf,"USER"))!=NULL)
  1090.              {
  1091.             help+=strlen("USER ");
  1092.             for(i=0;i<SCBUF;i++)
  1093.                 if(dummy_pointer->scroll_buf[i]==FTP_ENTER)
  1094.                     dummy_pointer->scroll_buf[i]=0;
  1095.             print_ftp_user(filename,help);
  1096.             for(i=0;i<SCBUF;i++)    dummy_pointer->scroll_buf[i]=' ';       
  1097.             }
  1098.               if((help=strstr(dummy_pointer->scroll_buf,"PASS"))!=NULL)
  1099.              {
  1100.             help+=strlen("PASS ");
  1101.             for(i=0;i<SCBUF;i++)
  1102.                 if(dummy_pointer->scroll_buf[i]==FTP_ENTER)
  1103.                     dummy_pointer->scroll_buf[i]=0;
  1104.             print_ftp_pass(filename,help);
  1105.             for(i=0;i<SCBUF;i++)    dummy_pointer->scroll_buf[i]=' ';       
  1106.             }
  1107.  
  1108.                }
  1109.  
  1110.  
  1111.           if( (dummy_pointer=search_dynam(filename, TCP)) !=NULL)
  1112.                 {
  1113.             if(ntohl(tcphead.seq_nr)==dummy_pointer->exp_seq)
  1114.                        dummy_pointer->exp_seq+=info.DATA_len;
  1115.           /* if we miss a packet... no probs seq nr's get updated */
  1116.           /* cauz' we can't rely on ACK's from other side         */
  1117.             /* it's pretty good this way                            */
  1118.             if(ntohl(tcphead.seq_nr)>dummy_pointer->exp_seq)
  1119.                        dummy_pointer->exp_seq=ntohl(tcphead.seq_nr)+info.DATA_len;
  1120.             }
  1121.           return;
  1122.           }
  1123.         return;  /* DON'T FORGET THEM!!!! */
  1124.         }
  1125.     
  1126.     if(finish<20)            /* ICMP packet */
  1127.         {
  1128.         memcpy(&icmphead,header,sizeof(struct ICMP_header));
  1129.         memcpy(&iphead_icmp,
  1130.             (sp+PROTO_HEAD+info.IP_len+ICMP_HEADLENGTH+4),
  1131.             sizeof(struct IP_header));
  1132.         printf("ICMP message id: %s\n",filename);
  1133.         printf("  ICMP type: ");
  1134.         switch(icmphead.type)
  1135.             {
  1136.             case 0: printf("%s\n",ICMP_TYPE_0);
  1137.                 break;
  1138.             case 3: printf("%s\n",ICMP_TYPE_3);
  1139.                 printf("  Error: %s\n",
  1140.                     ICMP_type_3_code[icmphead.code]);
  1141.                 print_iphead(&iphead_icmp,1);
  1142.                 break;
  1143.             case 4: printf("%s\n",ICMP_TYPE_4);
  1144.                 print_iphead(&iphead_icmp,1);
  1145.                 break;
  1146.             case 5: printf("%s\n",ICMP_TYPE_5);
  1147.                 printf("  Error: %s\n",
  1148.                     ICMP_type_5_code[icmphead.code]);
  1149.                 print_iphead(&iphead_icmp,1);
  1150.                 break;
  1151.             case 8: printf("%s\n",ICMP_TYPE_8);
  1152.                 break;
  1153.             case 11:printf("%s\n",ICMP_TYPE_11);
  1154.                 printf("  Error: %s\n",
  1155.                     ICMP_type_11_code[icmphead.code]);
  1156.                 print_iphead(&iphead_icmp,1);
  1157.                 break;
  1158.             case 12:printf("%s\n",ICMP_TYPE_12);
  1159.                 print_iphead(&iphead_icmp,1);
  1160.                 break;
  1161.             case 13:printf("%s\n",ICMP_TYPE_13);
  1162.                 break;
  1163.             case 14: printf("%s\n",ICMP_TYPE_14);
  1164.                 break;
  1165.             case 15: printf("%s\n",ICMP_TYPE_15);
  1166.                 break;
  1167.             case 16: printf("%s\n",ICMP_TYPE_16);
  1168.                 break;
  1169.             case 17: printf("%s\n",ICMP_TYPE_17);
  1170.                 break;
  1171.             case 18: printf("%s\n",ICMP_TYPE_18);
  1172.                 break;
  1173.             default: printf("Unknown ICMP type!\n");break;
  1174.              }
  1175.         printf("\n");
  1176.         return;
  1177.         }
  1178.     if(finish<30)                   /* nothing yet */
  1179.         {
  1180.          memcpy(&udphead,header,sizeof(struct UDP_header));
  1181.         switch(DUMPMODE & 223) 
  1182.           {
  1183.           case 0: break;
  1184.           case 1:         /* DUMP mode */
  1185.             case 2:
  1186.           case 3:
  1187.               printf("UDP Packet ID (from_IP.port-to_IP.port): %s\n",filename);
  1188.             total_length=info.IP_len+info.UDP_len+info.DATA_len;
  1189.             n = 0;
  1190.             for(i=0;i<total_length;i++) 
  1191.                 {
  1192.                 unsigned char c = sp[PROTO_HEAD+i];
  1193.                 if(n > 75)
  1194.                     n=0, printf("\n");
  1195.                 if(DUMPMODE & 1)
  1196.                     n += printf(" %02X",c); 
  1197.                 if(DUMPMODE & 2)
  1198.                     n += printf(" %c",isprint(c)?c:'.');
  1199.                 }
  1200.             printf("\n\n");
  1201.             break;
  1202.             case 128: break; /* NO LOGGING MODE */
  1203.             default: 
  1204.             printf("\nImpossible error! Sniffer Hartattack!\n");
  1205.             exit(0);
  1206.           } 
  1207.         return;
  1208.         }
  1209. }
  1210.  
  1211.  
  1212. #ifdef INCLUDE_INTERFACE                         /* Interactive packethandling */ 
  1213. int check_mask (const struct packetheader *p_header, 
  1214.         const unsigned char *sp,
  1215.         char *conn_name, char *conn_name2,
  1216.         struct unwrap *info)
  1217.                                           /* return -1 : packet not for us */
  1218.                                           /* else finish value             */
  1219. {
  1220.     char helpstr1[20], helpstr2[20];
  1221.         unsigned char *so,*dest;
  1222.     struct IP_header iphead;
  1223.     struct TCP_header tcphead;
  1224.     int proto;
  1225.  
  1226.     proto=unwrap_packet(sp, info);
  1227.     if(proto == NO_IP)    return DONT_EXAMINE; /* no use in trying */
  1228.     if(proto == NO_IP_4)    return DONT_EXAMINE; /* no use in trying */
  1229.     if(proto == CORRUPT_IP)    return DONT_EXAMINE; /* no use in trying */
  1230.  
  1231.     if(info->FRAG_nf!=0)
  1232.       {return DONT_EXAMINE; };
  1233.  
  1234.     (*IP_nr_of_packets)++;
  1235.     if(proto==ICMP)  
  1236.         {(*ICMP_nr_of_packets)++; return DONT_EXAMINE;}
  1237.     if(proto==UDP)  
  1238.         {(*UDP_nr_of_packets)++; 
  1239.         (*UDP_bytes_in_packets)+=(info->UDP_len+info->DATA_len+info->IP_len);
  1240.         return DONT_EXAMINE;} 
  1241.     if(proto!=TCP)  return DONT_EXAMINE;  
  1242.     /* Packet info */
  1243.     (*TCP_nr_of_packets)++;
  1244.     (*TCP_bytes_in_packets)+=(info->TCP_len+info->DATA_len+info->IP_len);
  1245.                             /* Not a TCP packet */ 
  1246.     memcpy(&iphead,(sp+PROTO_HEAD),sizeof(struct IP_header));
  1247.     memcpy(&tcphead,(sp+PROTO_HEAD+info->IP_len),sizeof(struct TCP_header));
  1248.  
  1249.         if(mask->source_ip!=0 && iphead.source!=mask->source_ip)
  1250.         return DONT_EXAMINE;
  1251.         if(mask->destination_ip!=0 && iphead.destination!=mask->destination_ip)
  1252.         return DONT_EXAMINE;
  1253.     if(mask->destination_port && ntohs(tcphead.destination) != mask->destination_port) 
  1254.         return DONT_EXAMINE; 
  1255.     if(mask->source_port && ntohs(tcphead.source) != mask->source_port) 
  1256.         return DONT_EXAMINE; 
  1257.  
  1258.                           /* inet_ntoa gave wrong output sometimes */
  1259.     so=(unsigned char *)&(iphead.source);
  1260.         dest=(unsigned char *)&(iphead.destination);
  1261.  
  1262.     sprintf(helpstr1,"%u.%u.%u.%u",so[0],so[1],so[2],so[3]);
  1263.     sprintf(helpstr2,"%u.%u.%u.%u",dest[0],dest[1],dest[2],dest[3]);
  1264.  
  1265.     sprintf(conn_name,"%16s %5u  -> %16s %5u",
  1266.                 helpstr1,
  1267.                 ntohs(tcphead.source),
  1268.                 helpstr2,
  1269.                 ntohs(tcphead.destination));
  1270.     sprintf(conn_name2,"%16s %5u  -> %16s %5u",
  1271.                 helpstr2,
  1272.                 ntohs(tcphead.destination),
  1273.                 helpstr1,
  1274.                 ntohs(tcphead.source));
  1275.  
  1276.     if ((ntohs(tcphead.offset_flag) & FIN) != 0)/* check for reset conn. */
  1277.         return TCP_FINISH;                        /* packet is a FIN */
  1278.     if ((ntohs(tcphead.offset_flag) & RST) != 0)/* check for reset conn. */
  1279.         return TCP_FINISH;                        /* packet is a RST */
  1280.     if (info->DATA_len == 0)
  1281.           return DONT_EXAMINE;                   /* packet not for us */
  1282.     return TCP_EXAMINE;                            /* interprete packet */
  1283. }
  1284.  
  1285. pcap_handler interactive_packethandler(    char *dummy, 
  1286.                  const struct packetheader *p_header, 
  1287.                 const unsigned char *sp) 
  1288. { 
  1289.     char conn_name[CONN_NAMELEN], conn_name2[CONN_NAMELEN];
  1290.     int finish;                    /* look out it's signed */
  1291.     struct unwrap info;
  1292.  
  1293.     finish=check_mask(p_header,sp,conn_name,conn_name2,&info); 
  1294.     if(finish==DONT_EXAMINE) return;         /* Packet is not for us */
  1295.  
  1296.     if(finish!=TCP_FINISH) /* finish: already logged, or to short to add */
  1297.         add_itemlist(running_connections,conn_name);
  1298.     if(strcmp(log_conn->log_enter, conn_name)==0)
  1299.         {
  1300.                 const unsigned char *data=sp+PROTO_HEAD+info.IP_len+info.TCP_len;
  1301.          if(*DATAlength+info.DATA_len < LENGTH_OF_INTERPROC_DATA)
  1302.             {
  1303.             memcpy((connection_data+*DATAlength),data,info.DATA_len);
  1304.             *DATAlength+=info.DATA_len;
  1305.             }             
  1306.         }
  1307.     if(finish==TCP_FINISH)
  1308.         {
  1309.         del_itemlist(running_connections,conn_name);
  1310.         del_itemlist(running_connections,conn_name2);
  1311.         }
  1312.     kill(getppid(),SIGUSR1);
  1313. }
  1314. #endif
  1315.  
  1316. unsigned long getaddrbyname(char *name)
  1317. {
  1318.     struct hostent *he;
  1319.  
  1320.     if(isdigit(*name))
  1321.     return inet_addr(name);
  1322.     if(!(he = gethostbyname(name)))
  1323.         {
  1324. #ifdef DEBUG
  1325.     debug_msg("GetAddr: Couldn't get host.");
  1326. #endif
  1327.     /* perror(name); */
  1328.     }
  1329.  
  1330.     return he ? *(long*)*he->h_addr_list : 0;
  1331. }
  1332.  
  1333. int main(int argc,char *argv[])
  1334. {
  1335.     char *dev, forced_dev[20], buffer[SNAPLEN];
  1336.     int c,i;
  1337.     unsigned long ipaddr, memsize;
  1338.     int flag=0, doboth=0, FORCE_DEV=0, SUPPORTED=0;
  1339.     extern char *optarg;
  1340.  
  1341.     signal (SIGINT, my_exit);       /* controled CTRL-C exit */
  1342.     SNIFLEN=300;                             /* Set defaults */
  1343.     DEST_PORT=0;                             /* Dest Port    */
  1344.     SNIFMODE=DUMPMODE=PROTOCOLS=ASC=WILDCARD=CFG_FILE=NO_CHKSUM=0;
  1345.     LOGLEVEL=0;
  1346.     Logfile[0]=0;
  1347.     logging_device=NULL;  
  1348.     IP=NULL;
  1349.         for(i=0;i<10;i++)    Plugin_Active[i]=0; /* Active plugins */
  1350.  
  1351. #ifdef DEBUG
  1352.     if((debug_dev=fopen(DEBUG_DEVICE,"a"))<0)
  1353.         {printf("Couldn't open DEBUG device!\n");exit(0);}
  1354.     else
  1355.         {
  1356.         fprintf(debug_dev,"\n\nDEVICE OPENED FOR SNIFFIT DEBUGGING\n\n");
  1357.         exit_func(close_debug_device);    
  1358.         }
  1359. #endif
  1360.  
  1361. #ifdef INCLUDE_INTERFACE        
  1362.     while((c=getopt(argc,argv,"D:A:P:idp:l:xabt:s:F:c:nvL:M:N"))!=-1) { 
  1363. #else
  1364.     while((c=getopt(argc,argv,"A:P:dp:l:xabt:s:F:c:nvL:M:N"))!=-1) { 
  1365. #endif
  1366.                                                     /* Argument treating */
  1367.           switch(c) {
  1368.             case 'v':
  1369.                 printf("Sniffit Version %s - Copyright 1996-97 Brecht Claerhout\n",VERSION); 
  1370. #ifdef __DATE__
  1371.                 printf("Binary build %s %s\n",__DATE__,__TIME__);
  1372. #endif
  1373.                 quit(argv[0]);
  1374.                 break;
  1375.             case 'd':
  1376.                 DUMPMODE|=1;
  1377.                 break;
  1378.             case 'a':
  1379.                 DUMPMODE|=2;
  1380.                 break;
  1381.             case 'x':
  1382.                 DUMPMODE|=32;
  1383.                 break;
  1384.             case 'N':
  1385.                 DUMPMODE|=128;
  1386.                 break;
  1387.             case 'p':
  1388.                 DEST_PORT=atoi(optarg);
  1389.                 break;
  1390.             case 'l':
  1391.                 SNIFLEN=atol(optarg);
  1392.                 break;
  1393.             case 'L':
  1394.                 LOGLEVEL=atoi(optarg);
  1395.                 break;
  1396.             case 'b':
  1397.                 doboth=1;
  1398.                 break;
  1399.             case 'A':
  1400.                 ASC=1;
  1401.                 non_printable=*optarg;
  1402.                 break; 
  1403.             case 'D':
  1404.                 logging_device=optarg;
  1405.                 break; 
  1406.             case 'P':
  1407.                 optarg=strlower(optarg);
  1408.                 if(strstr(optarg,"tcp")) PROTOCOLS |= F_TCP;
  1409.                 if(strstr(optarg,"icmp")) PROTOCOLS |= F_ICMP;
  1410.                 if(strstr(optarg,"udp")) PROTOCOLS |= F_UDP;
  1411.                                 if(strstr(optarg,"ip")) PROTOCOLS |= F_IP;
  1412.                         break;
  1413.             case 's':
  1414.                 flag++;
  1415.                 SNIFMODE=SOURCE;
  1416.                 IP=optarg;
  1417.                 break; 
  1418.             case 't':
  1419.                 flag++;
  1420.                 SNIFMODE=DEST;
  1421.                 IP=optarg;
  1422.                 break; 
  1423.                         case 'i':
  1424.                                 flag++;
  1425.                 SNIFMODE=INTERACTIVE;
  1426.                                 break;
  1427.                         case 'n':
  1428.                 NO_CHKSUM=1;
  1429.                                 break;
  1430.             case 'M':
  1431.                 if( (atoi(optarg)>=0) && (atoi(optarg)<=9) )
  1432.                       Plugin_Active[atoi(optarg)]=1;
  1433.                 break;
  1434.             case 'F':
  1435.                 strcpy(forced_dev,optarg);
  1436.                                 FORCE_DEV=1;
  1437.                 break;
  1438.             case 'c':
  1439.                 flag++;
  1440.                 read_cfg_file(optarg); 
  1441. #ifdef DEBUG_ONSCREEN
  1442.                 printf("FINISHED INTERPRETING\n");
  1443.                 printf("sf:%d st:%d df:%d dt:%d\n",select_from_length,select_to_length, deselect_from_length, deselect_to_length);
  1444. #endif
  1445.                                 CFG_FILE=1;
  1446.                 break;
  1447.                   default : break;
  1448.         }
  1449.     }
  1450.  
  1451. #ifdef ALLOW_SUID
  1452.     if ((getuid()!=0)&&(geteuid()!=0))
  1453.         printf("You should be root to run this program!\n"), exit(1);
  1454. #else
  1455.     if (getuid()!=0)
  1456.         printf("You should be root to run this program!\n"), exit(1);
  1457. #endif
  1458.  
  1459.     if(flag!=1)     quit(argv[0]);
  1460.     if( (LOGLEVEL!=0) && (CFG_FILE==0) )    quit(argv[0]);
  1461.  
  1462.     if(LOGLEVEL != 0)    open_logfile();
  1463.     if(PROTOCOLS==0) PROTOCOLS |= F_TCP;
  1464.     if(doboth) SNIFMODE=BOTH;
  1465.         if((SNIFMODE!=INTERACTIVE)&&(CFG_FILE==0))  
  1466.         {
  1467. /*        if(index(IP,'@')) For SunOS  */
  1468.         if(strchr(IP,'@'))
  1469.           {printf("Wildcard detected, IP nr. not checked...\n");
  1470.           WILDCARD=1;
  1471. /*          strcpy(index(IP,'@'),"\0"); */
  1472.           strcpy(strchr(IP,'@'),"\0");
  1473.           }
  1474.         else
  1475.           {
  1476.           ipaddr = getaddrbyname(IP);
  1477.           if(ipaddr==0) 
  1478.             printf("Non existing host!\n"), exit(1);
  1479.           }
  1480.         }
  1481.     reset_all();       /* just to be sure */
  1482.  
  1483.     if( (dev=pcap_lookupdev(NULL))==NULL )  
  1484.         {
  1485.         printf("No network devices found.... Sniffit giving up.\n");
  1486.         exit(1);
  1487.         }
  1488.     
  1489.     if(FORCE_DEV!=0)
  1490.         {
  1491.         strcpy(dev,forced_dev);
  1492.         printf("Forcing device to %s (user requested)...\n",dev);
  1493.         printf("Make sure you have read the docs carefully.\n");
  1494.         PROTO_HEAD=FORCED_HEAD_LENGTH;
  1495.               }
  1496.  
  1497.     for(i=0;i<ETH_DEV_NR;i++)
  1498.         {
  1499.         if(strstr(dev,ETH_DEV[i]))                /* For expansion */
  1500.             {PROTO_HEAD=ETHERHEAD;
  1501.             printf("Supported ethernet device found. (%s)\n",dev); 
  1502.             SUPPORTED=1;
  1503.             break;}
  1504.         };
  1505.  
  1506.     for(i=0;i<PPP_DEV_NR;i++)
  1507.         {
  1508.             if(strstr(dev,PPP_DEV[i]))               
  1509.             {PROTO_HEAD=PPPHEAD;
  1510.             printf("Supported PPP device found. (%s)\n",dev); 
  1511.             SUPPORTED=1;
  1512.             break;}
  1513.         };
  1514.  
  1515.     if((SUPPORTED==0)&&(FORCE_DEV==0)) /* not supported & not forced */
  1516.         {
  1517.         printf("Network device found... BUT not known by Sniffit, use '-F <netw device>' option!\n");
  1518.         printf("Read the README.FIRST on how to force network devices.\n");
  1519.         exit(1);
  1520.         }
  1521.  
  1522.     if((dev_desc=pcap_open_live(dev,SNAPLEN,1,MSDELAY,NULL))==NULL)
  1523.         {printf("Couldn't open device.\n");
  1524.         exit(0);}
  1525.  
  1526. #ifdef INCLUDE_INTERFACE
  1527.         if (SNIFMODE==INTERACTIVE)
  1528.          {
  1529.         memsize=sizeof(int)+sizeof(int)+LENGTH_OF_INTERPROC_DATA+
  1530.             sizeof(int)+sizeof(struct snif_mask)+
  1531.             sizeof(struct shared_logged_conn)+
  1532.             (CONNECTION_CAPACITY*sizeof(struct shared_conn_data))+
  1533.             sizeof(int)+
  1534.             sizeof(long)+sizeof(int)+sizeof(int)+sizeof(long)+
  1535.             sizeof(int);
  1536.         memory_id = shmget(0,memsize,0700);
  1537.         if(memory_id<0)
  1538.               {perror("Interactive Sniffer Hartattack (No Shared mem avail!)");
  1539.             exit(0);}
  1540.         exit_func(mem_exit);
  1541.         if((SHARED=shmat(memory_id,0,SHM_RND))==NULL)
  1542.               {perror("Interactive Sniffer Hartattack (Wow something is wrong here)");
  1543.                exit(0);};
  1544.                 printf("Entering Shared memory at %p\n",SHARED);
  1545.           printf("Shared %d\n",memsize);
  1546.  
  1547.         timing = SHARED;                    /* set all pointers */
  1548.         DATAlength = timing + sizeof(int);
  1549.         connection_data = DATAlength + sizeof(int);
  1550.         LISTlength = connection_data + LENGTH_OF_INTERPROC_DATA;
  1551.         mask = LISTlength + sizeof(int);
  1552.         logged_connections = mask + sizeof(struct snif_mask);
  1553.         log_conn=(struct shared_logged_conn *)logged_connections;
  1554.         running_connections = logged_connections + sizeof(struct shared_logged_conn);
  1555.         TCP_nr_of_packets= running_connections+(sizeof(struct shared_conn_data)*CONNECTION_CAPACITY);
  1556.         TCP_bytes_in_packets= TCP_nr_of_packets+sizeof(int); 
  1557.         ICMP_nr_of_packets= TCP_bytes_in_packets+sizeof(long); 
  1558.         UDP_nr_of_packets= ICMP_nr_of_packets+sizeof(int); 
  1559.         UDP_bytes_in_packets= UDP_nr_of_packets+sizeof(int); 
  1560.         IP_nr_of_packets= UDP_bytes_in_packets+sizeof(long); 
  1561.         clear_shared_mem(0);
  1562.  
  1563.         if ((Pid=fork())<0)
  1564.               {perror("Interactive Sniffer Hartattack (Couldn't fork)");
  1565.                exit(0);};
  1566.         if(Pid==0)
  1567.             {
  1568.             sleep(4);
  1569.             while(1)
  1570.                 if(pcap_dispatch(dev_desc,PACKETS,
  1571.                     interactive_packethandler,NULL)<0)
  1572.                     printf("Capturing Packets Failed\n"), exit(0);
  1573.             }
  1574.         else    {
  1575.                         exit_func(child_exit);
  1576.             signal(SIGCHLD,SIG_IGN);
  1577.             if(logging_device != NULL)
  1578.                 {
  1579.                 if(stat(logging_device,&log_dev_stat)<0)
  1580.                     perror("\'-D\' option error"),exit(0);
  1581.                 if((log_dev_stream=fopen(logging_device,"a")) 
  1582.                                     == NULL)
  1583.                     printf("Couldn't open device for logging output\n"),exit(0);
  1584.                 }
  1585.             run_interface();
  1586.             }
  1587.         }
  1588.      else     {
  1589. #endif
  1590.         if(CFG_FILE==0)
  1591.           printf("Sniffit.%s is up and running.... (%s)\n\n",VERSION,IP);
  1592.         else 
  1593.           printf("Sniffit.%s is up and running.... (Config File Used)\n\n",VERSION);
  1594.         while(1)
  1595.             if(pcap_dispatch(dev_desc,PACKETS,packethandler,(unsigned char *)&ipaddr)<0)
  1596.                 printf("Capturing Packets Failed\n"), exit(0);
  1597. #ifdef INCLUDE_INTERFACE
  1598.         }
  1599. #endif    
  1600. /* Close device?  Nahhh.... fuck it! we don't get here anyway!*/
  1601. }
  1602.  
  1603.