home *** CD-ROM | disk | FTP | other *** search
/ Power Hacker 2003 / Power_Hacker_2003.iso / E-zine / Magazines / crh / freebsd / rootkit / sniffit.0.3.5 / sniffit.0.3.5.c.orig < prev    next >
Encoding:
Text File  |  2002-05-27  |  47.0 KB  |  1,593 lines
  1. /* Sniffit main program file                                              */
  2. /*   - by           : Brecht Claerhout                                    */
  3. /*   - getaddrbyname: Godmar Back                                         */
  4.  
  5. #include "sn_config.h"                                  /* Config header file */
  6.  
  7. #include <unistd.h>
  8. #include <signal.h>
  9. #include <stdio.h>
  10. #include <netdb.h>
  11. #include <errno.h>
  12. #include <sys/stat.h>
  13. #include <sys/types.h>
  14. #include <sys/socket.h>
  15. #include <sys/time.h>
  16. #include <netinet/in.h>
  17. #ifdef INCLUDE_INTERFACE
  18. #include <sys/ipc.h>
  19. #include <sys/shm.h>
  20. #endif                 
  21. #include "pcap.h"  
  22.  
  23. /************************ Own includes *************************************/
  24. #include "sn_defines.h"                                 /* Various defines */
  25. #include "sn_structs.h"                                  /* All structures */
  26.  
  27. #include "sn_global.h"                                 /* some global defs */
  28. #include "sn_data.h"                                          /* data defs */
  29.  
  30. #include "sn_packets.h"                           /* My own packet structs */
  31. #include "sn_logfile.h"
  32. #include "sn_cfgfile.h"                            /* Config file handling */
  33.  
  34. #include "sn_plugins.h"                            /* Sniffit Plugins file */
  35.  
  36. #ifdef INCLUDE_INTERFACE
  37. #include "sn_interface.h"                            /* all ncurses stuff  */
  38. #endif
  39. #ifdef GENERATION
  40. #include "sn_generation.h"                    /* Sniffit Packet generation */
  41. #endif
  42.  
  43. #include "sniffit.h"                           /* definition of functions  */
  44.  
  45. static char Copyright[]= 
  46.     "Sniffit - Brecht Claerhout - Copyright 1996-97";
  47.  
  48. void quit (char *prog_name)                    /* Learn to use the program */
  49. {
  50.     printf(
  51. "usage: %s [-xdabvnN] [-P proto] [-A char] [-p port]\n"
  52. "       [-l sniflen] [-L loglevel] [-F snifdevice] [-M plugin]\n"
  53. #ifdef INCLUDE_INTERFACE
  54. "       [-D tty]" 
  55. " (-t<Target IP> | -s<Source IP>)"
  56. " | -i | -c<config file>]\n",
  57. #else
  58. "       (-t<Target IP> | -s<Source IP>) | -c<config file>]\n",
  59. #endif
  60.         prog_name);
  61. printf("Plugins Available:\n"); 
  62. #ifdef PLUGIN0_NAME
  63. printf("    0 -- %s\n",PLUGIN0_NAME);
  64. #endif
  65. #ifdef PLUGIN1_NAME
  66. printf("    1 -- %s\n",PLUGIN1_NAME);
  67. #endif
  68. #ifdef PLUGIN2_NAME
  69. printf("    2 -- %s\n",PLUGIN2_NAME);
  70. #endif
  71. #ifdef PLUGIN3_NAME
  72. printf("    3 -- %s\n",PLUGIN3_NAME);
  73. #endif
  74. #ifdef PLUGIN4_NAME
  75. printf("    4 -- %s\n",PLUGIN4_NAME);
  76. #endif
  77. #ifdef PLUGIN5_NAME
  78. printf("    5 -- %s\n",PLUGIN5_NAME);
  79. #endif
  80. #ifdef PLUGIN6_NAME
  81. printf("    6 -- %s\n",PLUGIN6_NAME);
  82. #endif
  83. #ifdef PLUGIN7_NAME
  84. printf("    7 -- %s\n",PLUGIN7_NAME);
  85. #endif
  86. #ifdef PLUGIN8_NAME
  87. printf("    8 -- %s\n",PLUGIN8_NAME);
  88. #endif
  89. #ifdef PLUGIN9_NAME
  90. printf("    9 -- %s\n",PLUGIN9_NAME);
  91. #endif
  92.  
  93. exit(0); 
  94. }
  95.  
  96. void my_exit (void)    {    exit(0);};
  97.  
  98. /* DEBUGGING INFO */
  99. #ifdef DEBUG
  100. void close_debug_device (void)
  101. {
  102. fclose(debug_dev);
  103. }
  104.  
  105. void debug_msg(char *debug_text)
  106. {
  107. fprintf(debug_dev,"%s (%d)\n",debug_text,debug_cnt);
  108. debug_cnt++;
  109. }
  110. #endif
  111.  
  112. char *strlower (char *string)
  113. {
  114.     int i;
  115.  
  116.     for(i=0;i<strlen(string);i++)
  117.             *(string+i) = ( isupper(*(string+i)) ? tolower(*(string+i)) : *(string+i) ); 
  118.     return string;
  119. }
  120.  
  121. void start_plugin(int PL_nr, struct Plugin_data *PL_d)
  122. {
  123. switch(PL_nr)
  124.     {
  125. #ifdef PLUGIN0_NAME
  126.     case 0: PLUGIN0(PL_d); break;
  127. #endif    
  128. #ifdef PLUGIN1_NAME
  129.     case 1: PLUGIN1(PL_d); break;
  130. #endif    
  131. #ifdef PLUGIN2_NAME
  132.     case 2: PLUGIN2(PL_d); break;
  133. #endif    
  134. #ifdef PLUGIN3_NAME
  135.     case 3: PLUGIN3(PL_d); break;
  136. #endif    
  137. #ifdef PLUGIN4_NAME
  138.     case 4: PLUGIN4(PL_d); break;
  139. #endif    
  140. #ifdef PLUGIN5_NAME
  141.     case 5: PLUGIN5(PL_d); break;
  142. #endif    
  143. #ifdef PLUGIN5_NAME
  144.     case 5: PLUGIN5(PL_d); break;
  145. #endif    
  146. #ifdef PLUGIN6_NAME
  147.     case 6: PLUGIN6(PL_d); break;
  148. #endif    
  149. #ifdef PLUGIN7_NAME
  150.     case 7: PLUGIN7(PL_d); break;
  151. #endif    
  152. #ifdef PLUGIN8_NAME
  153.     case 8: PLUGIN8(PL_d); break;
  154. #endif    
  155. #ifdef PLUGIN9_NAME
  156.     case 9: PLUGIN9(PL_d); break;
  157. #endif    
  158.     default: fprintf(stderr,"Plugin does not exist...\n"); exit(1); break;
  159.     }
  160. }
  161.  
  162. void reset_all (void) 
  163. {
  164.     start_dynam=NULL;
  165.     dynam_len=0;
  166. }
  167.  
  168. /* if do_file == 0, then don't handle the files */
  169. /* this is for the global logfile option        */
  170. struct file_info *add_dynam (char *file, char ptype, char do_file, 
  171.                                unsigned long cur_seq, int len) 
  172. {
  173.     int i;
  174.     FILE *f;
  175.     int last_time_out=0;
  176.     struct file_info *dummy_pointer; 
  177.     struct file_info *search_pointer; 
  178.  
  179.     if(dynam_len>=MAXCOUNT)
  180.         {
  181.                                      /* remove less effective connection from list */
  182.         search_pointer=start_dynam; dummy_pointer=start_dynam;          
  183.         do
  184.             {
  185.             if(search_pointer->time_out > last_time_out)
  186.                 {last_time_out=search_pointer->time_out;
  187.                 dummy_pointer=search_pointer;}
  188.             search_pointer=search_pointer->next;
  189.             }
  190.         while(search_pointer != NULL);
  191. #ifdef DEBUG
  192.             debug_msg("Auto timeout engaged (filename follows)");
  193.             debug_msg(dummy_pointer->filename);
  194. #endif
  195.         if(dummy_pointer->f==NULL)
  196.           delete_dynam(dummy_pointer->filename,dummy_pointer->proto,0);
  197.         else
  198.           delete_dynam(dummy_pointer->filename,dummy_pointer->proto,1);
  199.         printf("Too many connections... auto timeout\n"); 
  200.         }
  201.     if( (dummy_pointer=(struct file_info *)malloc(sizeof(struct file_info))) == NULL)
  202.         {printf("Couldn't allocate memory.\n"); exit(0);};
  203.     dummy_pointer->bytes=0;
  204.     dummy_pointer->proto=ptype;
  205.     strcpy(dummy_pointer->filename,file);
  206.     if(do_file!=0)
  207.         {
  208.         f = fopen(file,"a");   
  209.             if(f==NULL)
  210.             perror("Couldn't open logfile:"),exit(0);
  211.         dummy_pointer->f=f;
  212.         }
  213.     else    {
  214.         dummy_pointer->f=NULL;
  215.         }
  216.     dummy_pointer->next=NULL;
  217.     dummy_pointer->buffer=NULL;
  218.     dummy_pointer->log=0;
  219.     dummy_pointer->exp_seq=cur_seq+len;       
  220.     for(i=0;i<SCBUF;i++)    dummy_pointer->scroll_buf[i]=' ';       
  221.     dummy_pointer->scroll_buf[SCBUF]=0;       
  222.      
  223.     if(start_dynam==NULL)
  224.         start_dynam=dummy_pointer; 
  225.     else
  226.         {
  227.          search_pointer=start_dynam;
  228.         while(search_pointer->next != NULL)
  229.             search_pointer=search_pointer->next;
  230.         search_pointer->next=dummy_pointer;
  231.         }
  232.     dynam_len++;
  233.     return dummy_pointer;
  234. }
  235.  
  236. void delete_dynam (char *file, char ptype,char do_file)
  237. {
  238.     struct file_info *search_pointer;    
  239.     struct file_info *dummy_pointer;    
  240.  
  241.     if(start_dynam==NULL) return;
  242.     search_pointer=start_dynam;
  243.     if( (strcmp(search_pointer->filename,file)==0) &&
  244.                         (search_pointer->proto==ptype))
  245.         {
  246.         if(do_file!=0)    fclose(search_pointer->f);
  247.         start_dynam=search_pointer->next;
  248.         dynam_len--;
  249.         free(search_pointer);
  250.         return;
  251.         }
  252.      search_pointer=start_dynam;
  253.     if(search_pointer->next==NULL) return;
  254.     while(search_pointer->next != NULL)
  255.         {
  256.         if( (strcmp(search_pointer->next->filename,file)==0) &&
  257.                     (search_pointer->next->proto==ptype))
  258.             {
  259.             if(do_file!=0)     fclose(search_pointer->next->f);
  260.             dummy_pointer=search_pointer->next;
  261.             search_pointer->next=search_pointer->next->next;
  262.             if(dummy_pointer->buffer!=NULL) free(dummy_pointer->buffer);
  263.             free(dummy_pointer);
  264.             dynam_len--;
  265.             return;
  266.             }
  267.         search_pointer=search_pointer->next;
  268.         }
  269. }
  270.  
  271. /* returns NULL on failure */
  272. struct file_info *search_dynam(char *file, char ptype)
  273. {
  274.     struct file_info *search_pointer;
  275.  
  276.     if(start_dynam==NULL) return NULL;
  277.  
  278.      search_pointer=start_dynam;               /* time_out add */
  279.     do
  280.         {
  281.         search_pointer->time_out += 1;
  282.         search_pointer=search_pointer->next;
  283.         }
  284.     while(search_pointer != NULL);
  285.  
  286.      search_pointer=start_dynam;              /* actual search */
  287.     do
  288.         {
  289.         if( (strcmp(search_pointer->filename,file)==0) &&
  290.                     (search_pointer->proto==ptype))
  291.             {search_pointer->time_out=0;   /* timeout reset */
  292.             return search_pointer;}
  293.         search_pointer=search_pointer->next;
  294.         }
  295.     while(search_pointer != NULL);
  296.     return NULL;
  297. }
  298.  
  299. /* Type 0: TELNET  */
  300. void record_buf(struct file_info *dummy_pointer, unsigned long cur_seq_nr, 
  301.                              char *data, int len, int type) 
  302. {
  303. int i,j,noloop=0;
  304.  
  305. if(dummy_pointer->exp_seq != cur_seq_nr) 
  306.     {return;}
  307. noloop=0;
  308. for(i=0;i<len;i++)
  309.   {
  310.   j=dummy_pointer->bytes;
  311.   switch(type)
  312.       {
  313.     case 0: if(data[i]==TELNET_ENTER)                 /* return found */
  314.             {dummy_pointer->log++;noloop=1;};
  315.         break;
  316.     default: break;
  317.     }
  318.   if(noloop==1)    break;
  319.   if(j>=LOG_PASS_BUF)    break;
  320.   if(isprint(data[i]))
  321.     {dummy_pointer->buffer[j]=data[i];}
  322.   else  {dummy_pointer->buffer[j]='~';};
  323.   dummy_pointer->buffer[j+1]=0;
  324.   dummy_pointer->bytes+=1;
  325.   }
  326. #ifdef    DEBUG_ONSCREEN
  327.     printf("Record buffer: >%s<  (%d)\n",dummy_pointer->buffer,dummy_pointer->bytes); 
  328. #endif
  329. }
  330.  
  331. void sb_shift(struct file_info *dummy_pointer)
  332. {
  333. int i,j;
  334.  
  335. for(i=1;i<SCBUF;i++)
  336.     dummy_pointer->scroll_buf[i-1]=dummy_pointer->scroll_buf[i];
  337. }
  338.  
  339. void sbuf_update(struct file_info *dummy_pointer, unsigned long cur_seq_nr, 
  340.                                   char *data, int len) 
  341. {
  342. int i;
  343.  
  344. if(dummy_pointer->exp_seq != cur_seq_nr)
  345.     {return;}
  346.  
  347. for(i=0;i<len;i++)
  348.   {
  349.   sb_shift(dummy_pointer);
  350.   if(data[i]!=0)      /* used to be 'isprint', not possible for ftp logging */
  351.       {dummy_pointer->scroll_buf[SCBUF-1]=data[i];}
  352.   else    {dummy_pointer->scroll_buf[SCBUF-1]='.';};        
  353.   }
  354. #ifdef DEBUG_ONSCREEN
  355.     printf("scr_buf: %s\n",dummy_pointer->scroll_buf);
  356. #endif
  357. }
  358.  
  359. void print_iphead (struct IP_header *iphead, char icmp_or_plain)
  360. {
  361.         int dummy;
  362.     unsigned char *so,*dest;
  363.     
  364.     if(icmp_or_plain!=0)
  365.         printf("ICMP message concerned following IP packet:\n");
  366.     so=(unsigned char *)&(iphead->source);
  367.            dest=(unsigned char *)&(iphead->destination);
  368.     printf("from %u.%u.%u.%u to %u.%u.%u.%u\n",
  369.                     so[0],so[1],so[2],so[3],
  370.                                         dest[0],dest[1],dest[2],dest[3]);
  371.         dummy=iphead->type; dummy>>=5;
  372.         printf("IP Packet precedence: %s   (%c%c%c)\n",
  373.                                     IP_TYPE_precedence[dummy],
  374.                                         (iphead->type&IP_DELAY)?'D':'-',
  375.                                         (iphead->type&IP_THROUGHPUT)?'T':'-',
  376.                                         (iphead->type&IP_RELIABILITY)?'R':'-');
  377.         dummy=ntohs(iphead->flag_offset); dummy>>=13;
  378.         printf("FLAGS: %s %s     Time to live (secs): %d\n",
  379.                                     (dummy&IP_DF)?"DF":"--",
  380.                                         (dummy&IP_MF)?"MF":"--",
  381.                                      iphead->TTL);
  382.         if(iphead->protocol < 34)
  383.                 printf("Protocol (%d): %s\n",iphead->protocol,
  384.                         IP_PROTOCOL_number[iphead->protocol]);
  385.         else    printf("Protocol (%d) not recognised\n",iphead->protocol);
  386.     printf("\n");
  387. }
  388.  
  389. int check_packet(unsigned long ipaddr,
  390.         const struct packetheader *p_header, 
  391.         const unsigned char *sp,
  392.         char *file,
  393.         char *file2,
  394.         struct unwrap *info,
  395.         char *detail,
  396.         int MODE)       
  397.                                           /* MODE 0: -t   MODE 1: -s */
  398.                                           /* MODE 2: -b              */ 
  399. {
  400.         unsigned char *so,*dest;
  401.     char wc_so[20], wc_dest[20];
  402.     struct IP_header iphead;
  403.     struct TCP_header tcphead;
  404.     struct ICMP_header icmphead;
  405.     struct UDP_header udphead;
  406.     int proto;
  407.     unsigned int prior; char selected; int i;    /* Wildcard stuff */
  408.         unsigned char *str_IP;
  409.     unsigned int n_s;           /* strlen short notation for wc bugfix */
  410.  
  411.     proto=unwrap_packet(sp, info); 
  412.     if(proto == NO_IP)    return DONT_EXAMINE; /* no use in trying */
  413.     if(proto == NO_IP_4)    return DONT_EXAMINE; /* no use in trying */
  414.  
  415.         memcpy(&iphead,(sp+PROTO_HEAD),sizeof(struct IP_header));
  416.     so=(unsigned char *)&(iphead.source);
  417.            dest=(unsigned char *)&(iphead.destination);
  418.  
  419.     if((proto==TCP)&&(PROTOCOLS&F_TCP)) 
  420.         {
  421. #ifdef DEBUG_ONSCREEN
  422. printf("TCP Packet\n");
  423. #endif
  424.         memcpy(&tcphead,(sp+PROTO_HEAD+info->IP_len),
  425.                         sizeof(struct TCP_header));
  426.         memcpy(detail,&tcphead,sizeof(struct TCP_header));
  427.  
  428.         if((WILDCARD==0)&&(CFG_FILE==0))     /* Selection criteria */
  429.           {
  430.           if (MODE == DEST && ipaddr != iphead.destination   /* -t */
  431.             ||
  432.                  MODE == SOURCE && ipaddr != iphead.source      /* -s */
  433.             ||
  434.               MODE == BOTH && ipaddr != iphead.destination   /* -b */
  435.                   && ipaddr != iphead.source
  436.                  )  return DONT_EXAMINE; /* Check destination/source IP */
  437.           }
  438.         else
  439.           {
  440.           if (WILDCARD!=0) /* Wildcards */
  441.             {   
  442. #ifdef DEBUG_ONSCREEN
  443. printf("WILDCARD\n");
  444. #endif
  445.             sprintf(wc_so,"%u.%u.%u.%u",so[0],so[1],so[2],so[3]);
  446.             sprintf(wc_dest,"%u.%u.%u.%u",dest[0],dest[1],dest[2],dest[3]);
  447.             n_s = strlen(IP);
  448.             if (MODE == DEST && (strncmp(wc_dest,IP,n_s)!=0) /* -t */
  449.                        ||
  450.                    MODE == SOURCE && (strncmp(wc_so,IP,n_s)!=0) /* -s */
  451.                     ||
  452.                 MODE == BOTH && (strncmp(wc_dest,IP,n_s)!=0) /* -b */
  453.                      && (strncmp(wc_so,IP,n_s)!=0)
  454.                    )   return DONT_EXAMINE; 
  455.                           /* Check destination/source IP */
  456.             }
  457.           else     { /* We are using the config file (4*Check) */
  458.                    prior=0; selected=0;
  459.                 sprintf(wc_so,"%u.%u.%u.%u",so[0],so[1],so[2],so[3]);
  460.                 sprintf(wc_dest,"%u.%u.%u.%u",dest[0],dest[1],dest[2],dest[3]);
  461. #ifdef DEBUG_ONSCREEN
  462. printf("CONCERNING: %s  %d - %s  %d\n",wc_so,ntohs(tcphead.source),wc_dest,ntohs(tcphead.destination));
  463. #endif
  464.                         /* Highest prior last (backward+break for speed)  */
  465.             for(i=(select_from_length-1);i>=0;i--)
  466.               {
  467.               if(prior > select_from_list[i].priority) break;
  468.               str_IP = select_from_list[i].host;
  469. #ifdef DEBUG_ONSCREEN
  470. printf("SF: %s  %d   Prior:%d\n",str_IP,select_from_list[i].port,select_from_list[i].priority);
  471. #endif
  472.                   if((select_from_list[i].port==0) || 
  473.                  (select_from_list[i].port==ntohs(tcphead.source)))
  474.                 {
  475.                 if(select_from_list[i].wildcard==0)
  476.                   {                          /* NO wildcard */ 
  477.                        if(strcmp(wc_so,str_IP)==0)
  478.                     {selected=1; 
  479.                                 prior=select_from_list[i].priority;
  480.                             break;} 
  481.                   }
  482.                 else
  483.                   {                            /* wildcard */
  484.                        if(strncmp(wc_so,str_IP,strlen(str_IP))==0)
  485.                      {selected=1; 
  486.                               prior=select_from_list[i].priority;
  487.                           break;} 
  488.                   }
  489.                     if(str_IP[0]==0)
  490.                     {selected=1; break;};
  491.                 }
  492.               }
  493.  
  494.             for(i=(select_to_length-1);i>=0;i--)
  495.               {
  496.               if(prior > select_to_list[i].priority) break;
  497.               str_IP = select_to_list[i].host;
  498. #ifdef DEBUG_ONSCREEN
  499. printf("ST: %s  %d   Prior:%d\n",str_IP,select_to_list[i].port,select_to_list[i].priority);
  500. #endif
  501.                   if((select_to_list[i].port==0) || 
  502.                  (select_to_list[i].port==ntohs(tcphead.destination)))
  503.                 {
  504.                 if(select_to_list[i].wildcard==0)
  505.                   {                          /* NO wildcard */ 
  506.                        if(strcmp(wc_dest,str_IP)==0)
  507.                     {selected=1;
  508.                                 prior=select_to_list[i].priority;
  509.                             break;} 
  510.                   }
  511.                 else
  512.                   {                            /* wildcard */
  513.                        if(strncmp(wc_dest,str_IP,strlen(str_IP))==0)
  514.                      {selected=1; 
  515.                               prior=select_to_list[i].priority;
  516.                           break;} 
  517.                   }
  518.                     if(str_IP[0]==0)
  519.                     {selected=1; break;};
  520.                     }
  521.               }
  522.  
  523.             for(i=(deselect_from_length-1);i>=0;i--)
  524.               {
  525.               if(prior > deselect_from_list[i].priority) break;
  526.               str_IP = deselect_from_list[i].host;
  527. #ifdef DEBUG_ONSCREEN
  528. printf("DF: %s  %d   Prior:%d\n",str_IP,deselect_from_list[i].port,deselect_from_list[i].priority);
  529. #endif
  530.                   if((deselect_from_list[i].port==0) || 
  531.                  (deselect_from_list[i].port==ntohs(tcphead.source)))
  532.                 {
  533.                 if(deselect_from_list[i].wildcard==0)
  534.                   {                          /* NO wildcard */ 
  535.                        if(strcmp(wc_so,str_IP)==0)
  536.                     {selected=0; 
  537.                                 prior=deselect_from_list[i].priority;
  538.                             break;} 
  539.                   }
  540.                 else
  541.                   {                            /* wildcard */
  542.                        if(strcmp(wc_so,str_IP)==0)
  543.                      {selected=0; 
  544.                               prior=deselect_from_list[i].priority;
  545.                           break;} 
  546.                   }
  547.                     if(str_IP[0]==0)
  548.                     {selected=0; break;};
  549.  
  550.                     }
  551.               }
  552.  
  553.             for(i=(deselect_to_length-1);i>=0;i--)
  554.               {
  555.               if(prior > deselect_to_list[i].priority) break;
  556.               str_IP = deselect_to_list[i].host;
  557. #ifdef DEBUG_ONSCREEN
  558. printf("DT: %s  %d   Prior:%d\n",str_IP,deselect_to_list[i].port,deselect_to_list[i].priority);
  559. #endif
  560.                   if((deselect_to_list[i].port==0) || 
  561.                  (deselect_to_list[i].port==ntohs(tcphead.destination)))
  562.                 {
  563.                 if(deselect_to_list[i].wildcard==0)
  564.                   {                          /* NO wildcard */ 
  565.                        if(strncmp(wc_dest,str_IP,strlen(str_IP))==0)
  566.                     {selected=0; 
  567.                                 prior=deselect_to_list[i].priority;
  568.                             break;} 
  569.                   }
  570.                 else
  571.                   {                            /* wildcard */
  572.                        if(strncmp(wc_dest,str_IP,strlen(str_IP))==0)
  573.                      {selected=0; 
  574.                               prior=deselect_to_list[i].priority;
  575.                           break;} 
  576.                   }
  577.                     if(str_IP[0]==0)
  578.                     {selected=0; break;};
  579.  
  580.                     }
  581.               }
  582.  
  583. #ifdef DEBUG_ONSCREEN
  584. printf("Selected: %d\n",selected);
  585. #endif
  586.                            if(selected==0) return DONT_EXAMINE; 
  587.  
  588.             }
  589.           }
  590.  
  591.         if( DEST_PORT && ntohs(tcphead.destination) != DEST_PORT) 
  592.             return DONT_EXAMINE;     /* Check dest. PORT */
  593.  
  594. #ifdef DEBUG_ONSCREEN
  595. printf("Packet accepted\n");
  596. #endif
  597.  
  598.                           /* inet_ntoa gave wrong output sometimes */
  599.         sprintf(file,"%u.%u.%u.%u.%u-%u.%u.%u.%u.%u",
  600.                     so[0],so[1],so[2],so[3],
  601.                     (unsigned short)ntohs(tcphead.source),
  602.                     dest[0],dest[1],dest[2],dest[3],
  603.                     (unsigned short)ntohs(tcphead.destination));
  604.         sprintf(file2,"%u.%u.%u.%u.%u-%u.%u.%u.%u.%u",
  605.                     dest[0],dest[1],dest[2],dest[3],
  606.                     (unsigned short)ntohs(tcphead.destination),
  607.                     so[0],so[1],so[2],so[3],
  608.                     (unsigned short)ntohs(tcphead.source));
  609.  
  610.         if ((ntohs(tcphead.offset_flag) & FIN) != 0)  
  611.                         /* check for reset conn. */
  612.             return TCP_FINISH;            /* packet is a FIN */
  613.  
  614. /* NEW TEST  */
  615.         if ((ntohs(tcphead.offset_flag) & RST) != 0)  
  616.                         /* check for reset conn. */
  617.             return TCP_FINISH;            /* packet is a FIN */
  618.  
  619.         /*
  620.         Used to be for speed, '-x' needs all info, so this too!
  621.         if (info->DATA_len == 0)
  622.               return DONT_EXAMINE;        
  623.         */
  624.  
  625.         return TCP_EXAMINE;                 /* interprete packet */
  626.         };
  627.     if((proto==ICMP)&&(PROTOCOLS&F_ICMP))      /* ICMP packet checking */
  628.         {
  629.         memcpy(&icmphead,(sp+PROTO_HEAD+info->IP_len),
  630.                         sizeof(struct ICMP_header));
  631.         memcpy(detail,&icmphead,sizeof(struct ICMP_header));
  632.         sprintf(file,"%u.%u.%u.%u > %u.%u.%u.%u",
  633.                     so[0],so[1],so[2],so[3],
  634.                     dest[0],dest[1],dest[2],dest[3]);
  635.         return ICMP_EXAMINE;
  636.         };
  637.     if((proto==UDP)&&(PROTOCOLS&F_UDP))       /* UDP packet checking */
  638.         {
  639. #ifdef DEBUG_ONSCREEN
  640. printf("UDP Packet\n");
  641. #endif
  642.         memcpy(&udphead,(sp+PROTO_HEAD+info->IP_len),
  643.                         sizeof(struct UDP_header));
  644.         memcpy(detail,&udphead,sizeof(struct UDP_header));
  645.  
  646.         if((WILDCARD==0)&&(CFG_FILE==0))     /* Selection criteria */
  647.           {
  648.           if (MODE == DEST && ipaddr != iphead.destination   /* -t */
  649.             ||
  650.                  MODE == SOURCE && ipaddr != iphead.source      /* -s */
  651.             ||
  652.               MODE == BOTH && ipaddr != iphead.destination   /* -b */
  653.                   && ipaddr != iphead.source
  654.                  )  return DONT_EXAMINE; /* Check destination/source IP */
  655.           }
  656.         else
  657.           {
  658.           if (WILDCARD!=0) /* Wildcards */
  659.             {   
  660.             sprintf(wc_so,"%u.%u.%u.%u",so[0],so[1],so[2],so[3]);
  661.             sprintf(wc_dest,"%u.%u.%u.%u",dest[0],dest[1],dest[2],dest[3]);
  662.             n_s = strlen(IP);
  663.             if (MODE == DEST && (strncmp(wc_dest,IP,n_s)!=0) /* -t */
  664.                        ||
  665.                    MODE == SOURCE && (strncmp(wc_so,IP,n_s)!=0) /* -s */
  666.                     ||
  667.                 MODE == BOTH && (strncmp(wc_dest,IP,n_s)!=0) /* -b */
  668.                      && (strncmp(wc_so,IP,n_s)!=0)
  669.                    )   return DONT_EXAMINE; 
  670.                           /* Check destination/source IP */
  671.             }
  672.           else     { /* We are using the config file (4*Check) */
  673.                    prior=0; selected=0;
  674.                 sprintf(wc_so,"%u.%u.%u.%u",so[0],so[1],so[2],so[3]);
  675.                 sprintf(wc_dest,"%u.%u.%u.%u",dest[0],dest[1],dest[2],dest[3]);
  676. #ifdef DEBUG_ONSCREEN
  677. printf("CONCERNING: %s  %d - %s  %d\n",wc_so,ntohs(udphead.source),wc_dest,ntohs(udphead.destination));
  678. #endif
  679.                         /* Highest prior last (backward+break for speed)  */
  680.             for(i=(select_from_length-1);i>=0;i--)
  681.               {
  682.               if(prior > select_from_list[i].priority) break;
  683.               str_IP = select_from_list[i].host;
  684. #ifdef DEBUG_ONSCREEN
  685. printf("SF: %s  %d   Prior:%d\n",str_IP,select_from_list[i].port,select_from_list[i].priority);
  686. #endif
  687.                   if((select_from_list[i].port==0) || 
  688.                  (select_from_list[i].port==ntohs(udphead.source)))
  689.                 {
  690.                 if(select_from_list[i].wildcard==0)
  691.                   {                          /* NO wildcard */ 
  692.                        if(strcmp(wc_so,str_IP)==0)
  693.                     {selected=1; 
  694.                                 prior=select_from_list[i].priority;
  695.                             break;} 
  696.                   }
  697.                 else
  698.                   {                            /* wildcard */
  699.                        if(strncmp(wc_so,str_IP,strlen(str_IP))==0)
  700.                      {selected=1; 
  701.                               prior=select_from_list[i].priority;
  702.                           break;} 
  703.                   }
  704.                     if(str_IP[0]==0)
  705.                     {selected=1; break;};
  706.                 }
  707.               }
  708.  
  709.             for(i=(select_to_length-1);i>=0;i--)
  710.               {
  711.               if(prior > select_to_list[i].priority) break;
  712.               str_IP = select_to_list[i].host;
  713. #ifdef DEBUG_ONSCREEN
  714. printf("ST: %s  %d   Prior:%d\n",str_IP,select_to_list[i].port,select_to_list[i].priority);
  715. #endif
  716.                   if((select_to_list[i].port==0) || 
  717.                  (select_to_list[i].port==ntohs(udphead.destination)))
  718.                 {
  719.                 if(select_to_list[i].wildcard==0)
  720.                   {                          /* NO wildcard */ 
  721.                        if(strcmp(wc_dest,str_IP)==0)
  722.                     {selected=1;
  723.                                 prior=select_to_list[i].priority;
  724.                             break;} 
  725.                   }
  726.                 else
  727.                   {                            /* wildcard */
  728.                        if(strncmp(wc_dest,str_IP,strlen(str_IP))==0)
  729.                      {selected=1; 
  730.                               prior=select_to_list[i].priority;
  731.                           break;} 
  732.                   }
  733.                     if(str_IP[0]==0)
  734.                     {selected=1; break;};
  735.                     }
  736.               }
  737.  
  738.             for(i=(deselect_from_length-1);i>=0;i--)
  739.               {
  740.               if(prior > deselect_from_list[i].priority) break;
  741.               str_IP = deselect_from_list[i].host;
  742. #ifdef DEBUG_ONSCREEN
  743. printf("DF: %s  %d   Prior:%d\n",str_IP,deselect_from_list[i].port,deselect_from_list[i].priority);
  744. #endif
  745.                   if((deselect_from_list[i].port==0) || 
  746.                  (deselect_from_list[i].port==ntohs(udphead.source)))
  747.                 {
  748.                 if(deselect_from_list[i].wildcard==0)
  749.                   {                          /* NO wildcard */ 
  750.                        if(strcmp(wc_so,str_IP)==0)
  751.                     {selected=0; 
  752.                                 prior=deselect_from_list[i].priority;
  753.                             break;} 
  754.                   }
  755.                 else
  756.                   {                            /* wildcard */
  757.                        if(strcmp(wc_so,str_IP)==0)
  758.                      {selected=0; 
  759.                               prior=deselect_from_list[i].priority;
  760.                           break;} 
  761.                   }
  762.                     if(str_IP[0]==0)
  763.                     {selected=0; break;};
  764.  
  765.                     }
  766.               }
  767.  
  768.             for(i=(deselect_to_length-1);i>=0;i--)
  769.               {
  770.               if(prior > deselect_to_list[i].priority) break;
  771.               str_IP = deselect_to_list[i].host;
  772. #ifdef DEBUG_ONSCREEN
  773. printf("DT: %s  %d   Prior:%d\n",str_IP,deselect_to_list[i].port,deselect_to_list[i].priority);
  774. #endif
  775.                   if((deselect_to_list[i].port==0) || 
  776.                  (deselect_to_list[i].port==ntohs(udphead.destination)))
  777.                 {
  778.                 if(deselect_to_list[i].wildcard==0)
  779.                   {                          /* NO wildcard */ 
  780.                        if(strncmp(wc_dest,str_IP,strlen(str_IP))==0)
  781.                     {selected=0; 
  782.                                 prior=deselect_to_list[i].priority;
  783.                             break;} 
  784.                   }
  785.                 else
  786.                   {                            /* wildcard */
  787.                        if(strncmp(wc_dest,str_IP,strlen(str_IP))==0)
  788.                      {selected=0; 
  789.                               prior=deselect_to_list[i].priority;
  790.                           break;} 
  791.                   }
  792.                     if(str_IP[0]==0)
  793.                     {selected=0; break;};
  794.  
  795.                     }
  796.               }
  797.  
  798. #ifdef DEBUG_ONSCREEN
  799. printf("Selected: %d\n",selected);
  800. #endif
  801.                            if(selected==0) return DONT_EXAMINE; 
  802.  
  803.             }
  804.           }
  805.  
  806.         if( DEST_PORT && ntohs(udphead.destination) != DEST_PORT) 
  807.             return DONT_EXAMINE;    /* Check dest. PORT */
  808.  
  809.                           /* inet_ntoa gave wrong output sometimes */
  810.         sprintf(file,"%u.%u.%u.%u.%u-%u.%u.%u.%u.%u",
  811.                     so[0],so[1],so[2],so[3],
  812.                     (unsigned short)ntohs(udphead.source),
  813.                     dest[0],dest[1],dest[2],dest[3],
  814.                     (unsigned short)ntohs(udphead.destination));
  815.         sprintf(file2,"%u.%u.%u.%u.%u-%u.%u.%u.%u.%u",
  816.                     dest[0],dest[1],dest[2],dest[3],
  817.                     (unsigned short)ntohs(udphead.destination),
  818.                     so[0],so[1],so[2],so[3],
  819.                     (unsigned short)ntohs(udphead.source));
  820.         return UDP_EXAMINE;                 /* interprete packet */
  821.         }
  822.     return DONT_EXAMINE;
  823. }
  824.  
  825. /* Default Processing of packets */
  826. pcap_handler packethandler(unsigned char *ipaddrpoint, 
  827.             const struct packetheader *p_header, 
  828.             const unsigned char *sp) 
  829. { 
  830.     char filename[50], filename2[50],header[SNAPLEN];
  831.     FILE *f;
  832.     struct file_info *dummy_pointer;
  833.     unsigned char status=0;
  834.     char *help;
  835.     int dummy,finish;                    /* look out it's signed */
  836.     unsigned long datalen, position, total_length, i, n, ipaddr;
  837.     struct unwrap info;
  838.         struct IP_header iphead;
  839.     struct TCP_header tcphead;
  840.     struct ICMP_header icmphead;
  841.     struct IP_header iphead_icmp;
  842.         struct UDP_header udphead;
  843.     struct Plugin_data PL_d, PL_dex;
  844.     
  845.     memcpy(&ipaddr,ipaddrpoint,sizeof(unsigned long));
  846.        
  847.     finish=check_packet(ipaddr,p_header,sp,filename,filename2,&info,header,SNIFMODE); 
  848.         if(PROTOCOLS & F_IP)
  849.                 memcpy(&iphead,(sp+PROTO_HEAD),sizeof(struct IP_header)),
  850.                             print_iphead(&iphead,0);
  851.         if(finish==DONT_EXAMINE) 
  852.         return;                         /* Packet is not for us */
  853.  
  854. #ifdef DEBUG_ONSCREEN
  855. printf("Processing Packet (finish: %d)\n",finish);
  856. #endif
  857.  
  858.     if((finish<10)||(finish>=20&&finish<30))         /* Start plugin */
  859.         {
  860.         /* fixing data structure */
  861.         memcpy(&(PL_d.PL_info),&info,sizeof(struct unwrap));
  862.                 memcpy(&(PL_d.PL_iphead),(sp+PROTO_HEAD),sizeof(struct IP_header));
  863.         memcpy(&(PL_d.PL_tcphead),(sp+PROTO_HEAD+info.IP_len),sizeof(struct TCP_header));
  864.         memcpy(&(PL_d.PL_udphead),(sp+PROTO_HEAD+info.IP_len),sizeof(struct UDP_header));
  865.         if(PL_d.PL_iphead.protocol == TCP)        
  866.           memcpy(PL_d.PL_data,(sp+PROTO_HEAD+info.IP_len+info.TCP_len),info.DATA_len);
  867.         if(PL_d.PL_iphead.protocol == UDP)        
  868.           memcpy(PL_d.PL_data,(sp+PROTO_HEAD+info.IP_len+info.UDP_len),info.DATA_len);
  869.         memcpy(PL_d.PL_packet,(sp+PROTO_HEAD),
  870.              info.IP_len+info.TCP_len+info.UDP_len+info.DATA_len);
  871.  
  872.         /* starting all plugins */
  873.         for(i=0;i<10;i++)
  874.             if(Plugin_Active[i]==1)
  875.                 {
  876.                 memcpy(&PL_dex,&PL_d,sizeof(struct Plugin_data));
  877.                 start_plugin(i,&PL_dex);
  878.                 }
  879.         }
  880.  
  881.     if((DUMPMODE & 32)&&(finish<10))    /* extended info TCP only */
  882.         {
  883.         memcpy(&tcphead,header,sizeof(struct TCP_header));
  884.         dummy=ntohs(tcphead.offset_flag);  
  885.         printf("\n");
  886.         printf("TCP Packet ID (from_IP.port-to_IP.port): %s\n",filename);
  887.         printf("   SEQ (hex): %lX   ",ntohl(tcphead.seq_nr));
  888.         if(dummy&ACK) printf("ACK (hex): %lX\n",ntohl(tcphead.ACK_nr));
  889.         printf("   FLAGS: %c%c%c%c%c%c",
  890.                 (dummy&URG)?'U':'-',(dummy&ACK)?'A':'-',
  891.                 (dummy&PSH)?'P':'-',(dummy&RST)?'R':'-',
  892.                 (dummy&SYN)?'S':'-',(dummy&FIN)?'F':'-');
  893.         if(dummy&ACK) 
  894.             printf("   Window: %X\n",ntohs(tcphead.window));
  895.         else     printf("\n");
  896.         };
  897.  
  898.     if((finish<10)&&(LOGLEVEL==0))              /* TCP packet */
  899.         /* I didn't use flags for later extention, and they */ 
  900.         /* don't come in pairs anyhow */
  901.         /* use return instead of else {if}, for later extention */
  902.         {
  903.         memcpy(&tcphead,header,sizeof(struct TCP_header));
  904.         switch(DUMPMODE & 223) /* without '32' bit 5 */ 
  905.           {
  906.           case 0:                     /* LOG mode */
  907.           status=0;
  908.  
  909.             dummy_pointer=search_dynam(filename, TCP);
  910.           if(dummy_pointer!=NULL) status=1; 
  911.           /* make a new entry unless it's reset */
  912.           if(status==0)               
  913.               {
  914.               if(finish==TCP_FINISH) return;      
  915.                     /* there was never data transmitted */
  916.             /* seq_nr & datalen not important here yet */
  917.             if((dummy_pointer=add_dynam(filename, TCP, 1, 0, 0))==NULL)
  918.                 return;
  919.             }
  920.           f=dummy_pointer->f;
  921.  
  922.           if(dummy_pointer->bytes<=SNIFLEN) {
  923.             const unsigned char *data = 
  924.                     sp+PROTO_HEAD+info.IP_len+info.TCP_len;
  925.             if(SNIFLEN!=0)
  926.                 dummy_pointer->bytes+=info.DATA_len;       
  927.                         /* last packet is written  */
  928.                                                 /* don't care about length */
  929.             if(ASC==0)
  930.                 {for(i=0;i<info.DATA_len;i++) 
  931.                     fprintf(f,"%c", data[i]);}
  932.             else    {
  933.                 for(i=0;i<info.DATA_len;i++)
  934.                     fprintf(f,"%c", isprint(data[i])?data[i]:non_printable);
  935.                 };
  936.               fflush(f);                                                  /* write all */
  937.             }
  938.           if(finish==TCP_FINISH) /* let's reset the connection */
  939.             delete_dynam(filename, TCP, 1);
  940.           break;
  941.         
  942.           case 1:         /* DUMP mode */
  943.             case 2:
  944.           case 3:
  945.               printf("Packet ID (from_IP.port-to_IP.port): %s\n",filename);
  946.             total_length=info.IP_len+info.TCP_len+info.DATA_len;
  947.             n = 0;
  948.             for(i=0;i<total_length;i++) {
  949.                 unsigned char c = sp[PROTO_HEAD+i];
  950.                 if(n > 75)
  951.                     n=0, printf("\n");
  952.                 if(DUMPMODE & 1)
  953.                     n += printf(" %02X",c); 
  954.                 if(DUMPMODE & 2)
  955.                     n += printf(" %c",isprint(c)?c:'.');
  956.             }
  957.             printf("\n\n");
  958.             break;
  959.     
  960.           case 128: break; /* NO LOGGING MODE */
  961.             default: 
  962.             printf("\nYou mixed incompatible options!\n");
  963.             exit(0); 
  964.           }
  965.               return;
  966.         }
  967.  
  968.     if((finish<10)&&(LOGLEVEL!=0))        /* TCP packet - logfile   */
  969.         /* This mode will grow, so I just copied the other if() */
  970.         /* instead of adding a dumpmode, I think this will keep */
  971.         /* things more simpel. Also I use the smart dynam       */ 
  972.         /* managment of connections                             */
  973.         {
  974.         memcpy(&tcphead,header,sizeof(struct TCP_header));
  975.           
  976.         dummy_pointer=search_dynam(filename, TCP);
  977.         if(dummy_pointer!=NULL) status=1; 
  978.         /* make a new entry unless it's reset */
  979.         if(status==0)               
  980.               {
  981.               if(finish!=TCP_FINISH) 
  982.                 if((dummy_pointer=add_dynam(filename, TCP, 0,ntohl(tcphead.seq_nr),info.DATA_len))==NULL)
  983.                     return;
  984.             }
  985.  
  986.         if(finish==TCP_FINISH) /* let's reset the connection */
  987.             {delete_dynam(filename, TCP, 0);}
  988.                 /*** return before using any search or pointer!!!!!!!! ***/
  989.                 /* Connections with FIN have deleted entries! */
  990.  
  991.         dummy=ntohs(tcphead.offset_flag);
  992.     
  993.         if(LOGLEVEL<10)          /* Raw logging */
  994.           {
  995.                if(dummy&SYN)    
  996.                  print_conn(filename,"Connection initiated. (SYN)");
  997.                if(dummy&FIN)   
  998.                  print_conn(filename,"Connection ending. (FIN)");
  999.                if(dummy&RST)   
  1000.                  print_conn(filename,"Connection reset. (RST)");
  1001.           return;
  1002.           }
  1003.         if(LOGLEVEL<30)          /* more sophisticated */
  1004.           {
  1005.           const unsigned char *data = sp+PROTO_HEAD+info.IP_len+info.TCP_len;
  1006.  
  1007.           if(search_dynam(filename2, TCP)==NULL)
  1008.                   {
  1009.              if(dummy&SYN)    
  1010.                      print_conn(filename,"Connection initiated.");
  1011.     
  1012.                   if(dummy&FIN)   
  1013.                      print_conn(filename2,"Connection closed.");
  1014.                 
  1015.              }
  1016.                if(dummy&FIN) return; /* needed, cauz entry don't exist  */  
  1017.           if(LOGLEVEL>=12)            /* loglevel 12 */
  1018.             {
  1019.             dummy_pointer=search_dynam(filename, TCP);
  1020.                     /* don't forget to check dummy_pointer!!! */
  1021.             
  1022.             if( (ntohs(tcphead.source) == 23) &&
  1023.                          (dummy_pointer!=NULL))/* from telnet */
  1024.               {
  1025.               sbuf_update(dummy_pointer,ntohl(tcphead.seq_nr),data,info.DATA_len);
  1026.               /* detect login */
  1027.               strlower(dummy_pointer->scroll_buf);
  1028.  
  1029.               if((dummy_pointer->log!=99)&&(strstr(dummy_pointer->scroll_buf,"login")!=NULL))
  1030.              {
  1031.             dummy_pointer->log=99;
  1032.             dummy_pointer=search_dynam(filename2, TCP);
  1033.                         if(dummy_pointer!=NULL)
  1034.                 {dummy_pointer->log=1; 
  1035.                 dummy_pointer->bytes=0;
  1036.                 dummy_pointer->buffer=malloc(LOG_PASS_BUF);
  1037.                 if(dummy_pointer->buffer==NULL) exit(1);
  1038.                 dummy_pointer->buffer[0]=0;
  1039.                 }
  1040.             else    {
  1041.                 print_conn(filename2,"Password missed due to overload.");
  1042.                 };
  1043. #ifdef DEBUG_ONSCREEN
  1044.             printf("Login detected, data initialised.\n");
  1045. #endif
  1046.             }
  1047.                }
  1048.  
  1049.             if( (ntohs(tcphead.destination) == 23) &&
  1050.                          (dummy_pointer!=NULL))/* TO telnet */
  1051.               {
  1052.               if(dummy_pointer->log==1)    /* log login */
  1053.             {
  1054.             record_buf(dummy_pointer,ntohl(tcphead.seq_nr),data,info.DATA_len,0);
  1055.                  if(dummy_pointer->log==2) /* login recorded */ 
  1056.                 {
  1057.                                 print_login(filename,dummy_pointer->buffer);
  1058.                      dummy_pointer->log=3; dummy_pointer->bytes=0;
  1059.                      dummy_pointer->buffer[0]=0;
  1060.                 }    
  1061.             }
  1062.               else
  1063.             {
  1064.                 if(dummy_pointer->log==3)    /* log pwd */
  1065.               {
  1066.               record_buf(dummy_pointer,ntohl(tcphead.seq_nr),data,info.DATA_len,0);
  1067.                    if(dummy_pointer->log==4) /* passwd recorded */ 
  1068.                 {
  1069.                                 print_pwd(filename,dummy_pointer->buffer);
  1070.                      dummy_pointer->log=0; dummy_pointer->bytes=0;
  1071.                      dummy_pointer->buffer[0]=0;
  1072.                 }    
  1073.                }
  1074.             }
  1075.                }
  1076.                     }
  1077.  
  1078.             if( (ntohs(tcphead.destination) == 21) &&
  1079.                          (dummy_pointer!=NULL))/* to FTP */
  1080.               {
  1081.               sbuf_update(dummy_pointer,ntohl(tcphead.seq_nr),data,info.DATA_len);
  1082.               /* detect USER en PASS  */
  1083.               if((help=strstr(dummy_pointer->scroll_buf,"USER"))!=NULL)
  1084.              {
  1085.             help+=strlen("USER ");
  1086.             for(i=0;i<SCBUF;i++)
  1087.                 if(dummy_pointer->scroll_buf[i]==FTP_ENTER)
  1088.                     dummy_pointer->scroll_buf[i]=0;
  1089.             print_ftp_user(filename,help);
  1090.             for(i=0;i<SCBUF;i++)    dummy_pointer->scroll_buf[i]=' ';       
  1091.             }
  1092.               if((help=strstr(dummy_pointer->scroll_buf,"PASS"))!=NULL)
  1093.              {
  1094.             help+=strlen("PASS ");
  1095.             for(i=0;i<SCBUF;i++)
  1096.                 if(dummy_pointer->scroll_buf[i]==FTP_ENTER)
  1097.                     dummy_pointer->scroll_buf[i]=0;
  1098.             print_ftp_pass(filename,help);
  1099.             for(i=0;i<SCBUF;i++)    dummy_pointer->scroll_buf[i]=' ';       
  1100.             }
  1101.  
  1102.                }
  1103.  
  1104.  
  1105.           if( (dummy_pointer=search_dynam(filename, TCP)) !=NULL)
  1106.                 {
  1107.             if(ntohl(tcphead.seq_nr)==dummy_pointer->exp_seq)
  1108.                        dummy_pointer->exp_seq+=info.DATA_len;
  1109.           /* if we miss a packet... no probs seq nr's get updated */
  1110.           /* cauz' we can't rely on ACK's from other side         */
  1111.             /* it's pretty good this way                            */
  1112.             if(ntohl(tcphead.seq_nr)>dummy_pointer->exp_seq)
  1113.                        dummy_pointer->exp_seq=ntohl(tcphead.seq_nr)+info.DATA_len;
  1114.             }
  1115.           return;
  1116.           }
  1117.         return;  /* DON'T FORGET THEM!!!! */
  1118.         }
  1119.     
  1120.     if(finish<20)            /* ICMP packet */
  1121.         {
  1122.         memcpy(&icmphead,header,sizeof(struct ICMP_header));
  1123.         memcpy(&iphead_icmp,
  1124.             (sp+PROTO_HEAD+info.IP_len+ICMP_HEADLENGTH+4),
  1125.             sizeof(struct IP_header));
  1126.         printf("ICMP message id: %s\n",filename);
  1127.         printf("  ICMP type: ");
  1128.         switch(icmphead.type)
  1129.             {
  1130.             case 0: printf("%s\n",ICMP_TYPE_0);
  1131.                 break;
  1132.             case 3: printf("%s\n",ICMP_TYPE_3);
  1133.                 printf("  Error: %s\n",
  1134.                     ICMP_type_3_code[icmphead.code]);
  1135.                 print_iphead(&iphead_icmp,1);
  1136.                 break;
  1137.             case 4: printf("%s\n",ICMP_TYPE_4);
  1138.                 print_iphead(&iphead_icmp,1);
  1139.                 break;
  1140.             case 5: printf("%s\n",ICMP_TYPE_5);
  1141.                 printf("  Error: %s\n",
  1142.                     ICMP_type_5_code[icmphead.code]);
  1143.                 print_iphead(&iphead_icmp,1);
  1144.                 break;
  1145.             case 8: printf("%s\n",ICMP_TYPE_8);
  1146.                 break;
  1147.             case 11:printf("%s\n",ICMP_TYPE_11);
  1148.                 printf("  Error: %s\n",
  1149.                     ICMP_type_11_code[icmphead.code]);
  1150.                 print_iphead(&iphead_icmp,1);
  1151.                 break;
  1152.             case 12:printf("%s\n",ICMP_TYPE_12);
  1153.                 print_iphead(&iphead_icmp,1);
  1154.                 break;
  1155.             case 13:printf("%s\n",ICMP_TYPE_13);
  1156.                 break;
  1157.             case 14: printf("%s\n",ICMP_TYPE_14);
  1158.                 break;
  1159.             case 15: printf("%s\n",ICMP_TYPE_15);
  1160.                 break;
  1161.             case 16: printf("%s\n",ICMP_TYPE_16);
  1162.                 break;
  1163.             case 17: printf("%s\n",ICMP_TYPE_17);
  1164.                 break;
  1165.             case 18: printf("%s\n",ICMP_TYPE_18);
  1166.                 break;
  1167.             default: printf("Unknown ICMP type!\n");break;
  1168.              }
  1169.         printf("\n");
  1170.         return;
  1171.         }
  1172.     if(finish<30)                   /* nothing yet */
  1173.         {
  1174.          memcpy(&udphead,header,sizeof(struct UDP_header));
  1175.         switch(DUMPMODE & 223) 
  1176.           {
  1177.           case 0: break;
  1178.           case 1:         /* DUMP mode */
  1179.             case 2:
  1180.           case 3:
  1181.               printf("UDP Packet ID (from_IP.port-to_IP.port): %s\n",filename);
  1182.             total_length=info.IP_len+info.UDP_len+info.DATA_len;
  1183.             n = 0;
  1184.             for(i=0;i<total_length;i++) 
  1185.                 {
  1186.                 unsigned char c = sp[PROTO_HEAD+i];
  1187.                 if(n > 75)
  1188.                     n=0, printf("\n");
  1189.                 if(DUMPMODE & 1)
  1190.                     n += printf(" %02X",c); 
  1191.                 if(DUMPMODE & 2)
  1192.                     n += printf(" %c",isprint(c)?c:'.');
  1193.                 }
  1194.             printf("\n\n");
  1195.             break;
  1196.             case 128: break; /* NO LOGGING MODE */
  1197.             default: 
  1198.             printf("\nImpossible error! Sniffer Hartattack!\n");
  1199.             exit(0);
  1200.           } 
  1201.         return;
  1202.         }
  1203. }
  1204.  
  1205.  
  1206. #ifdef INCLUDE_INTERFACE                         /* Interactive packethandling */ 
  1207. int check_mask (const struct packetheader *p_header, 
  1208.         const unsigned char *sp,
  1209.         char *conn_name, char *conn_name2,
  1210.         struct unwrap *info)
  1211.                                           /* return -1 : packet not for us */
  1212.                                           /* else finish value             */
  1213. {
  1214.     char helpstr1[20], helpstr2[20];
  1215.         unsigned char *so,*dest;
  1216.     struct IP_header iphead;
  1217.     struct TCP_header tcphead;
  1218.     int proto;
  1219.  
  1220.     proto=unwrap_packet(sp, info);
  1221.     if(proto == NO_IP)    return DONT_EXAMINE; /* no use in trying */
  1222.     if(proto == NO_IP_4)    return DONT_EXAMINE; /* no use in trying */
  1223.  
  1224.     (*IP_nr_of_packets)++;
  1225.     if(proto==ICMP)  
  1226.         {(*ICMP_nr_of_packets)++; return DONT_EXAMINE;}
  1227.     if(proto==UDP)  
  1228.         {(*UDP_nr_of_packets)++; 
  1229.         (*UDP_bytes_in_packets)+=(info->UDP_len+info->DATA_len+info->IP_len);
  1230.         return DONT_EXAMINE;} 
  1231.     if(proto!=TCP)  return DONT_EXAMINE;  
  1232.     /* Packet info */
  1233.     (*TCP_nr_of_packets)++;
  1234.     (*TCP_bytes_in_packets)+=(info->TCP_len+info->DATA_len+info->IP_len);
  1235.                             /* Not a TCP packet */ 
  1236.     memcpy(&iphead,(sp+PROTO_HEAD),sizeof(struct IP_header));
  1237.     memcpy(&tcphead,(sp+PROTO_HEAD+info->IP_len),sizeof(struct TCP_header));
  1238.  
  1239.         if(mask->source_ip!=0 && iphead.source!=mask->source_ip)
  1240.         return DONT_EXAMINE;
  1241.         if(mask->destination_ip!=0 && iphead.destination!=mask->destination_ip)
  1242.         return DONT_EXAMINE;
  1243.     if(mask->destination_port && ntohs(tcphead.destination) != mask->destination_port) 
  1244.         return DONT_EXAMINE; 
  1245.     if(mask->source_port && ntohs(tcphead.source) != mask->source_port) 
  1246.         return DONT_EXAMINE; 
  1247.  
  1248.                           /* inet_ntoa gave wrong output sometimes */
  1249.     so=(unsigned char *)&(iphead.source);
  1250.         dest=(unsigned char *)&(iphead.destination);
  1251.  
  1252.     sprintf(helpstr1,"%u.%u.%u.%u",so[0],so[1],so[2],so[3]);
  1253.     sprintf(helpstr2,"%u.%u.%u.%u",dest[0],dest[1],dest[2],dest[3]);
  1254.  
  1255.     sprintf(conn_name,"%16s %5u  -> %16s %5u",
  1256.                 helpstr1,
  1257.                 ntohs(tcphead.source),
  1258.                 helpstr2,
  1259.                 ntohs(tcphead.destination));
  1260.     sprintf(conn_name2,"%16s %5u  -> %16s %5u",
  1261.                 helpstr2,
  1262.                 ntohs(tcphead.destination),
  1263.                 helpstr1,
  1264.                 ntohs(tcphead.source));
  1265.  
  1266.     if ((ntohs(tcphead.offset_flag) & FIN) != 0)/* check for reset conn. */
  1267.         return TCP_FINISH;                        /* packet is a FIN */
  1268.     if ((ntohs(tcphead.offset_flag) & RST) != 0)/* check for reset conn. */
  1269.         return TCP_FINISH;                        /* packet is a RST */
  1270.     if (info->DATA_len == 0)
  1271.           return DONT_EXAMINE;                   /* packet not for us */
  1272.     return TCP_EXAMINE;                            /* interprete packet */
  1273. }
  1274.  
  1275. pcap_handler interactive_packethandler(    char *dummy, 
  1276.                  const struct packetheader *p_header, 
  1277.                 const unsigned char *sp) 
  1278. { 
  1279.     char conn_name[CONN_NAMELEN], conn_name2[CONN_NAMELEN];
  1280.     int finish;                    /* look out it's signed */
  1281.     struct unwrap info;
  1282.  
  1283.     finish=check_mask(p_header,sp,conn_name,conn_name2,&info); 
  1284.     if(finish==DONT_EXAMINE) return;         /* Packet is not for us */
  1285.  
  1286.     if(finish!=TCP_FINISH) /* finish: already logged, or to short to add */
  1287.         add_itemlist(running_connections,conn_name);
  1288.     if(strcmp(log_conn->log_enter, conn_name)==0)
  1289.         {
  1290.                 const unsigned char *data=sp+PROTO_HEAD+info.IP_len+info.TCP_len;
  1291.          if(*DATAlength+info.DATA_len < LENGTH_OF_INTERPROC_DATA)
  1292.             {
  1293.             memcpy((connection_data+*DATAlength),data,info.DATA_len);
  1294.             *DATAlength+=info.DATA_len;
  1295.             }             
  1296.         }
  1297.     if(finish==TCP_FINISH)
  1298.         {
  1299.         del_itemlist(running_connections,conn_name);
  1300.         del_itemlist(running_connections,conn_name2);
  1301.         }
  1302.     kill(getppid(),SIGUSR1);
  1303. }
  1304. #endif
  1305.  
  1306. unsigned long getaddrbyname(char *name)
  1307. {
  1308.     struct hostent *he;
  1309.  
  1310.     if(isdigit(*name))
  1311.     return inet_addr(name);
  1312.     if(!(he = gethostbyname(name)))
  1313.         {
  1314. #ifdef DEBUG
  1315.     debug_msg("GetAddr: Couldn't get host.");
  1316. #endif
  1317.     /* perror(name); */
  1318.     }
  1319.  
  1320.     return he ? *(long*)*he->h_addr_list : 0;
  1321. }
  1322.  
  1323. int main(int argc,char *argv[])
  1324. {
  1325.     char *dev, forced_dev[20], buffer[SNAPLEN];
  1326.     int c,i;
  1327.     unsigned long ipaddr, memsize;
  1328.     int flag=0, doboth=0, FORCE_DEV=0, SUPPORTED=0;
  1329.     extern char *optarg;
  1330.  
  1331.     signal (SIGINT, my_exit);       /* controled CTRL-C exit */
  1332.     SNIFLEN=300;                             /* Set defaults */
  1333.     DEST_PORT=0;                             /* Dest Port    */
  1334.     SNIFMODE=DUMPMODE=PROTOCOLS=ASC=WILDCARD=CFG_FILE=NO_CHKSUM=0;
  1335.     LOGLEVEL=0;
  1336.     Logfile[0]=0;
  1337.     logging_device=NULL;  
  1338.     IP=NULL;
  1339.         for(i=0;i<10;i++)    Plugin_Active[i]=0; /* Active plugins */
  1340.  
  1341. #ifdef DEBUG
  1342.     if((debug_dev=fopen(DEBUG_DEVICE,"a"))<0)
  1343.         {printf("Couldn't open DEBUG device!\n");exit(0);}
  1344.     else
  1345.         {
  1346.         fprintf(debug_dev,"\n\nDEVICE OPENED FOR SNIFFIT DEBUGGING\n\n");
  1347.         exit_func(close_debug_device);    
  1348.         }
  1349. #endif
  1350.  
  1351. #ifdef INCLUDE_INTERFACE        
  1352.     while((c=getopt(argc,argv,"D:A:P:idp:l:xabt:s:F:c:nvL:M:N"))!=-1) { 
  1353. #else
  1354.     while((c=getopt(argc,argv,"A:P:dp:l:xabt:s:F:c:nvL:M:N"))!=-1) { 
  1355. #endif
  1356.                                                     /* Argument treating */
  1357.           switch(c) {
  1358.             case 'v':
  1359.                 printf("Sniffit Version %s - Copyright 1996-97 Brecht Claerhout\n",VERSION); 
  1360. #ifdef __DATE__
  1361.                 printf("Binary build %s %s\n",__DATE__,__TIME__);
  1362. #endif
  1363.                 quit(argv[0]);
  1364.                 break;
  1365.             case 'd':
  1366.                 DUMPMODE|=1;
  1367.                 break;
  1368.             case 'a':
  1369.                 DUMPMODE|=2;
  1370.                 break;
  1371.             case 'x':
  1372.                 DUMPMODE|=32;
  1373.                 break;
  1374.             case 'N':
  1375.                 DUMPMODE|=128;
  1376.                 break;
  1377.             case 'p':
  1378.                 DEST_PORT=atoi(optarg);
  1379.                 break;
  1380.             case 'l':
  1381.                 SNIFLEN=atol(optarg);
  1382.                 break;
  1383.             case 'L':
  1384.                 LOGLEVEL=atoi(optarg);
  1385.                 break;
  1386.             case 'b':
  1387.                 doboth=1;
  1388.                 break;
  1389.             case 'A':
  1390.                 ASC=1;
  1391.                 non_printable=*optarg;
  1392.                 break; 
  1393.             case 'D':
  1394.                 logging_device=optarg;
  1395.                 break; 
  1396.             case 'P':
  1397.                 optarg=strlower(optarg);
  1398.                 if(strstr(optarg,"tcp")) PROTOCOLS |= F_TCP;
  1399.                 if(strstr(optarg,"icmp")) PROTOCOLS |= F_ICMP;
  1400.                 if(strstr(optarg,"udp")) PROTOCOLS |= F_UDP;
  1401.                                 if(strstr(optarg,"ip")) PROTOCOLS |= F_IP;
  1402.                         break;
  1403.             case 's':
  1404.                 flag++;
  1405.                 SNIFMODE=SOURCE;
  1406.                 IP=optarg;
  1407.                 break; 
  1408.             case 't':
  1409.                 flag++;
  1410.                 SNIFMODE=DEST;
  1411.                 IP=optarg;
  1412.                 break; 
  1413.                         case 'i':
  1414.                                 flag++;
  1415.                 SNIFMODE=INTERACTIVE;
  1416.                                 break;
  1417.                         case 'n':
  1418.                 NO_CHKSUM=1;
  1419.                                 break;
  1420.             case 'M':
  1421.                 if( (atoi(optarg)>=0) && (atoi(optarg)<=9) )
  1422.                       Plugin_Active[atoi(optarg)]=1;
  1423.                 break;
  1424.             case 'F':
  1425.                 strcpy(forced_dev,optarg);
  1426.                                 FORCE_DEV=1;
  1427.                 break;
  1428.             case 'c':
  1429.                 flag++;
  1430.                 read_cfg_file(optarg); 
  1431. #ifdef DEBUG_ONSCREEN
  1432.                 printf("FINISHED INTERPRETING\n");
  1433.                 printf("sf:%d st:%d df:%d dt:%d\n",select_from_length,select_to_length, deselect_from_length, deselect_to_length);
  1434. #endif
  1435.                                 CFG_FILE=1;
  1436.                 break;
  1437.                   default : break;
  1438.         }
  1439.     }
  1440.  
  1441. #ifdef ALLOW_SUID
  1442.     if ((getuid()!=0)&&(geteuid()!=0))
  1443.         printf("You should be root to run this program!\n"), exit(1);
  1444. #else
  1445.     if (getuid()!=0)
  1446.         printf("You should be root to run this program!\n"), exit(1);
  1447. #endif
  1448.  
  1449.     if(flag!=1)     quit(argv[0]);
  1450.     if( (LOGLEVEL!=0) && (CFG_FILE==0) )    quit(argv[0]);
  1451.  
  1452.     if(LOGLEVEL != 0)    open_logfile();
  1453.     if(PROTOCOLS==0) PROTOCOLS |= F_TCP;
  1454.     if(doboth) SNIFMODE=BOTH;
  1455.         if((SNIFMODE!=INTERACTIVE)&&(CFG_FILE==0))  
  1456.         {
  1457. /*        if(index(IP,'@')) For SunOS  */
  1458.         if(strchr(IP,'@'))
  1459.           {printf("Wildcard detected, IP nr. not checked...\n");
  1460.           WILDCARD=1;
  1461. /*          strcpy(index(IP,'@'),"\0"); */
  1462.           strcpy(strchr(IP,'@'),"\0");
  1463.           }
  1464.         else
  1465.           {
  1466.           ipaddr = getaddrbyname(IP);
  1467.           if(ipaddr==0) 
  1468.             printf("Non existing host!\n"), exit(1);
  1469.           }
  1470.         }
  1471.     reset_all();       /* just to be sure */
  1472.  
  1473.     if( (dev=pcap_lookupdev(NULL))==NULL )  
  1474.         {
  1475.         printf("No network devices found.... Sniffit giving up.\n");
  1476.         exit(1);
  1477.         }
  1478.     
  1479.     if(FORCE_DEV!=0)
  1480.         {
  1481.         strcpy(dev,forced_dev);
  1482.         printf("Forcing device to %s (user requested)...\n",dev);
  1483.         printf("Make sure you have read the docs carefully.\n");
  1484.         PROTO_HEAD=FORCED_HEAD_LENGTH;
  1485.               }
  1486.  
  1487.     for(i=0;i<ETH_DEV_NR;i++)
  1488.         {
  1489.         if(strstr(dev,ETH_DEV[i]))                /* For expansion */
  1490.             {PROTO_HEAD=ETHERHEAD;
  1491.             printf("Supported ethernet device found. (%s)\n",dev); 
  1492.             SUPPORTED=1;
  1493.             break;}
  1494.         };
  1495.  
  1496.     for(i=0;i<PPP_DEV_NR;i++)
  1497.         {
  1498.             if(strstr(dev,PPP_DEV[i]))               
  1499.             {PROTO_HEAD=PPPHEAD;
  1500.             printf("Supported PPP device found. (%s)\n",dev); 
  1501.             SUPPORTED=1;
  1502.             break;}
  1503.         };
  1504.  
  1505.     if((SUPPORTED==0)&&(FORCE_DEV==0)) /* not supported & not forced */
  1506.         {
  1507.         printf("Network device found... BUT not known by Sniffit, use '-F <netw device>' option!\n");
  1508.         printf("Read the README.FIRST on how to force network devices.\n");
  1509.         exit(1);
  1510.         }
  1511.  
  1512.     if((dev_desc=pcap_open_live(dev,SNAPLEN,1,MSDELAY,NULL))==NULL)
  1513.         {printf("Couldn't open device.\n");
  1514.         exit(0);}
  1515.  
  1516. #ifdef INCLUDE_INTERFACE
  1517.         if (SNIFMODE==INTERACTIVE)
  1518.          {
  1519.         memsize=sizeof(int)+sizeof(int)+LENGTH_OF_INTERPROC_DATA+
  1520.             sizeof(int)+sizeof(struct snif_mask)+
  1521.             sizeof(struct shared_logged_conn)+
  1522.             (CONNECTION_CAPACITY*sizeof(struct shared_conn_data))+
  1523.             sizeof(int)+
  1524.             sizeof(long)+sizeof(int)+sizeof(int)+sizeof(long)+
  1525.             sizeof(int);
  1526.         memory_id = shmget(0,memsize,0700);
  1527.         if(memory_id<0)
  1528.               {perror("Interactive Sniffer Hartattack (No Shared mem avail!)");
  1529.             exit(0);}
  1530.         exit_func(mem_exit);
  1531.         if((SHARED=shmat(memory_id,0,SHM_RND))==NULL)
  1532.               {perror("Interactive Sniffer Hartattack (Wow something is wrong here)");
  1533.                exit(0);};
  1534.                 printf("Entering Shared memory at %p\n",SHARED);
  1535.           printf("Shared %d\n",memsize);
  1536.  
  1537.         timing = SHARED;                    /* set all pointers */
  1538.         DATAlength = timing + sizeof(int);
  1539.         connection_data = DATAlength + sizeof(int);
  1540.         LISTlength = connection_data + LENGTH_OF_INTERPROC_DATA;
  1541.         mask = LISTlength + sizeof(int);
  1542.         logged_connections = mask + sizeof(struct snif_mask);
  1543.         log_conn=(struct shared_logged_conn *)logged_connections;
  1544.         running_connections = logged_connections + sizeof(struct shared_logged_conn);
  1545.         TCP_nr_of_packets= running_connections+(sizeof(struct shared_conn_data)*CONNECTION_CAPACITY);
  1546.         TCP_bytes_in_packets= TCP_nr_of_packets+sizeof(int); 
  1547.         ICMP_nr_of_packets= TCP_bytes_in_packets+sizeof(long); 
  1548.         UDP_nr_of_packets= ICMP_nr_of_packets+sizeof(int); 
  1549.         UDP_bytes_in_packets= UDP_nr_of_packets+sizeof(int); 
  1550.         IP_nr_of_packets= UDP_bytes_in_packets+sizeof(long); 
  1551.         clear_shared_mem(0);
  1552.  
  1553.         if ((Pid=fork())<0)
  1554.               {perror("Interactive Sniffer Hartattack (Couldn't fork)");
  1555.                exit(0);};
  1556.         if(Pid==0)
  1557.             {
  1558.             sleep(4);
  1559.             while(1)
  1560.                 if(pcap_dispatch(dev_desc,PACKETS,
  1561.                     interactive_packethandler,NULL)<0)
  1562.                     printf("Capturing Packets Failed\n"), exit(0);
  1563.             }
  1564.         else    {
  1565.                         exit_func(child_exit);
  1566.             signal(SIGCHLD,SIG_IGN);
  1567.             if(logging_device != NULL)
  1568.                 {
  1569.                 if(stat(logging_device,&log_dev_stat)<0)
  1570.                     perror("\'-D\' option error"),exit(0);
  1571.                 if((log_dev_stream=fopen(logging_device,"a")) 
  1572.                                     == NULL)
  1573.                     printf("Couldn't open device for logging output\n"),exit(0);
  1574.                 }
  1575.             run_interface();
  1576.             }
  1577.         }
  1578.      else     {
  1579. #endif
  1580.         if(CFG_FILE==0)
  1581.           printf("Sniffit.%s is up and running.... (%s)\n\n",VERSION,IP);
  1582.         else 
  1583.           printf("Sniffit.%s is up and running.... (Config File Used)\n\n",VERSION);
  1584.         while(1)
  1585.             if(pcap_dispatch(dev_desc,PACKETS,packethandler,(unsigned char *)&ipaddr)<0)
  1586.                 printf("Capturing Packets Failed\n"), exit(0);
  1587. #ifdef INCLUDE_INTERFACE
  1588.         }
  1589. #endif    
  1590. /* Close device?  Nahhh.... fuck it! we don't get here anyway!*/
  1591. }
  1592.  
  1593.