diff options
author | cy <cy@FreeBSD.org> | 2013-07-19 05:41:57 +0000 |
---|---|---|
committer | cy <cy@FreeBSD.org> | 2013-07-19 05:41:57 +0000 |
commit | 672af8808c0e7c15f330b401482f9271c2eb3fa6 (patch) | |
tree | 225b5acf68c01bc6a260b386c2b2dbf4fa2839e3 /contrib/ipfilter/ipsd | |
parent | 71e82d94e82560b20789833f60056506de34de8b (diff) | |
download | FreeBSD-src-672af8808c0e7c15f330b401482f9271c2eb3fa6.zip FreeBSD-src-672af8808c0e7c15f330b401482f9271c2eb3fa6.tar.gz |
As per the developers handbook (5.3.1 step 1), prepare the vendor trees for
import of new ipfilter vendor sources by flattening them.
To keep the tags consistent with dist, the tags are also flattened.
Approved by: glebius (Mentor)
Diffstat (limited to 'contrib/ipfilter/ipsd')
-rw-r--r-- | contrib/ipfilter/ipsd/Celler/ip_compat.h | 201 | ||||
-rw-r--r-- | contrib/ipfilter/ipsd/Makefile | 61 | ||||
-rw-r--r-- | contrib/ipfilter/ipsd/README | 32 | ||||
-rw-r--r-- | contrib/ipfilter/ipsd/ip_compat.h | 201 | ||||
-rw-r--r-- | contrib/ipfilter/ipsd/ipsd.c | 294 | ||||
-rw-r--r-- | contrib/ipfilter/ipsd/ipsd.h | 26 | ||||
-rw-r--r-- | contrib/ipfilter/ipsd/ipsd.sed | 0 | ||||
-rw-r--r-- | contrib/ipfilter/ipsd/ipsdr.c | 312 | ||||
-rw-r--r-- | contrib/ipfilter/ipsd/linux.h | 15 | ||||
-rw-r--r-- | contrib/ipfilter/ipsd/sbpf.c | 208 | ||||
-rw-r--r-- | contrib/ipfilter/ipsd/sdlpi.c | 259 | ||||
-rw-r--r-- | contrib/ipfilter/ipsd/slinux.c | 116 | ||||
-rw-r--r-- | contrib/ipfilter/ipsd/snit.c | 226 |
13 files changed, 0 insertions, 1951 deletions
diff --git a/contrib/ipfilter/ipsd/Celler/ip_compat.h b/contrib/ipfilter/ipsd/Celler/ip_compat.h deleted file mode 100644 index a911fd8..0000000 --- a/contrib/ipfilter/ipsd/Celler/ip_compat.h +++ /dev/null @@ -1,201 +0,0 @@ -/* - * (C)opyright 1995 by Darren Reed. - * - * This code may be freely distributed as long as it retains this notice - * and is not changed in any way. The author accepts no responsibility - * for the use of this software. I hate legaleese, don't you ? - * - * @(#)ip_compat.h 1.1 9/14/95 - */ - -/* - * These #ifdef's are here mainly for linux, but who knows, they may - * not be in other places or maybe one day linux will grow up and some - * of these will turn up there too. - */ -#ifndef ICMP_UNREACH -# define ICMP_UNREACH ICMP_DEST_UNREACH -#endif -#ifndef ICMP_SOURCEQUENCH -# define ICMP_SOURCEQUENCH ICMP_SOURCE_QUENCH -#endif -#ifndef ICMP_TIMXCEED -# define ICMP_TIMXCEED ICMP_TIME_EXCEEDED -#endif -#ifndef ICMP_PARAMPROB -# define ICMP_PARAMPROB ICMP_PARAMETERPROB -#endif -#ifndef IPVERSION -# define IPVERSION 4 -#endif -#ifndef IPOPT_MINOFF -# define IPOPT_MINOFF 4 -#endif -#ifndef IPOPT_COPIED -# define IPOPT_COPIED(x) ((x)&0x80) -#endif -#ifndef IPOPT_EOL -# define IPOPT_EOL 0 -#endif -#ifndef IPOPT_NOP -# define IPOPT_NOP 1 -#endif -#ifndef IP_MF -# define IP_MF ((u_short)0x2000) -#endif -#ifndef ETHERTYPE_IP -# define ETHERTYPE_IP ((u_short)0x0800) -#endif -#ifndef TH_FIN -# define TH_FIN 0x01 -#endif -#ifndef TH_SYN -# define TH_SYN 0x02 -#endif -#ifndef TH_RST -# define TH_RST 0x04 -#endif -#ifndef TH_PUSH -# define TH_PUSH 0x08 -#endif -#ifndef TH_ACK -# define TH_ACK 0x10 -#endif -#ifndef TH_URG -# define TH_URG 0x20 -#endif -#ifndef IPOPT_EOL -# define IPOPT_EOL 0 -#endif -#ifndef IPOPT_NOP -# define IPOPT_NOP 1 -#endif -#ifndef IPOPT_RR -# define IPOPT_RR 7 -#endif -#ifndef IPOPT_TS -# define IPOPT_TS 68 -#endif -#ifndef IPOPT_SECURITY -# define IPOPT_SECURITY 130 -#endif -#ifndef IPOPT_LSRR -# define IPOPT_LSRR 131 -#endif -#ifndef IPOPT_SATID -# define IPOPT_SATID 136 -#endif -#ifndef IPOPT_SSRR -# define IPOPT_SSRR 137 -#endif -#ifndef IPOPT_SECUR_UNCLASS -# define IPOPT_SECUR_UNCLASS ((u_short)0x0000) -#endif -#ifndef IPOPT_SECUR_CONFID -# define IPOPT_SECUR_CONFID ((u_short)0xf135) -#endif -#ifndef IPOPT_SECUR_EFTO -# define IPOPT_SECUR_EFTO ((u_short)0x789a) -#endif -#ifndef IPOPT_SECUR_MMMM -# define IPOPT_SECUR_MMMM ((u_short)0xbc4d) -#endif -#ifndef IPOPT_SECUR_RESTR -# define IPOPT_SECUR_RESTR ((u_short)0xaf13) -#endif -#ifndef IPOPT_SECUR_SECRET -# define IPOPT_SECUR_SECRET ((u_short)0xd788) -#endif -#ifndef IPOPT_SECUR_TOPSECRET -# define IPOPT_SECUR_TOPSECRET ((u_short)0x6bc5) -#endif - -#ifdef linux -# define icmp icmphdr -# define icmp_type type -# define icmp_code code - -/* - * From /usr/include/netinet/ip_var.h - * !%@#!$@# linux... - */ -struct ipovly { - caddr_t ih_next, ih_prev; /* for protocol sequence q's */ - u_char ih_x1; /* (unused) */ - u_char ih_pr; /* protocol */ - short ih_len; /* protocol length */ - struct in_addr ih_src; /* source internet address */ - struct in_addr ih_dst; /* destination internet address */ -}; - -typedef struct { - __u16 th_sport; - __u16 th_dport; - __u32 th_seq; - __u32 th_ack; -# if defined(__i386__) || defined(__MIPSEL__) || defined(__alpha__) ||\ - defined(vax) - __u8 th_res:4; - __u8 th_off:4; -#else - __u8 th_off:4; - __u8 th_res:4; -#endif - __u8 th_flags; - __u16 th_win; - __u16 th_sum; - __u16 th_urp; -} tcphdr_t; - -typedef struct { - __u16 uh_sport; - __u16 uh_dport; - __s16 uh_ulen; - __u16 uh_sum; -} udphdr_t; - -typedef struct { -# if defined(__i386__) || defined(__MIPSEL__) || defined(__alpha__) ||\ - defined(vax) - __u8 ip_hl:4; - __u8 ip_v:4; -# else - __u8 ip_hl:4; - __u8 ip_v:4; -# endif - __u8 ip_tos; - __u16 ip_len; - __u16 ip_id; - __u16 ip_off; - __u8 ip_ttl; - __u8 ip_p; - __u16 ip_sum; - struct in_addr ip_src; - struct in_addr ip_dst; -} ip_t; - -typedef struct { - __u8 ether_dhost[6]; - __u8 ether_shost[6]; - __u16 ether_type; -} ether_header_t; - -# define bcopy(a,b,c) memmove(b,a,c) -# define bcmp(a,b,c) memcmp(a,b,c) - -# define ifnet device - -#else - -typedef struct udphdr udphdr_t; -typedef struct tcphdr tcphdr_t; -typedef struct ip ip_t; -typedef struct ether_header ether_header_t; - -#endif - -#ifdef solaris -# define bcopy(a,b,c) memmove(b,a,c) -# define bcmp(a,b,c) memcmp(a,b,c) -# define bzero(a,b) memset(a,0,b) -#endif diff --git a/contrib/ipfilter/ipsd/Makefile b/contrib/ipfilter/ipsd/Makefile deleted file mode 100644 index 0f3ce08..0000000 --- a/contrib/ipfilter/ipsd/Makefile +++ /dev/null @@ -1,61 +0,0 @@ -# -# Copyright (C) 1993-1998 by Darren Reed. -# -# See the IPFILTER.LICENCE file for details on licencing. -# -OBJS=ipsd.o -BINDEST=/usr/local/bin -SBINDEST=/sbin -MANDIR=/usr/share/man -BPF=sbpf.o -NIT=snit.o -SUNOS4= -BSD= -LINUX=slinux.o -SUNOS5=dlcommon.o sdlpi.o - -CC=gcc -CFLAGS=-g -I.. -I../ipsend - -all: - @echo "Use one of these targets:" - @echo " sunos4-nit (standard SunOS 4.1.x)" - @echo " sunos4-bpf (SunOS4.1.x with BPF in the kernel)" - @echo " bsd-bpf (4.4BSD variant with BPF in the kernel)" - @echo " linux (Linux kernels)" - @echo " sunos5 (Solaris 2.x)" - -.c.o: - $(CC) $(CFLAGS) -c $< -o $@ - -ipsdr: ipsdr.o - $(CC) ipsdr.o -o $@ $(LIBS) - -bpf sunos4-bpf : - make ipsd "OBJS=$(OBJS)" "UNIXOBJS=$(BPF) $(SUNOS4)" "CC=$(CC)" \ - "CFLAGS=$(CFLAGS)" - -nit sunos4 sunos4-nit : - make ipsd "OBJS=$(OBJS)" "UNIXOBJS=$(NIT) $(SUNOS4)" "CC=$(CC)" \ - "CFLAGS=$(CFLAGS)" - -sunos5 : - make ipsd "OBJS=$(OBJS)" "UNIXOBJS=$(SUNOS5)" "CC=$(CC)" \ - CFLAGS="$(CFLAGS) -Dsolaris" "LIBS=-lsocket -lnsl" - -bsd-bpf : - make ipsd "OBJS=$(OBJS)" "UNIXOBJS=$(BPF) $(BSD)" "CC=$(CC)" \ - "CFLAGS=$(CFLAGS)" - -linux : - make ipsd "OBJS=$(OBJS)" "UNIXOBJS=$(LINUX)" "CC=$(CC)" \ - CFLAGS="$(CFLAGS) -I /usr/src/linux" - -ipsd: $(OBJS) $(UNIXOBJS) - $(CC) $(OBJS) $(UNIXOBJS) -o $@ $(LIBS) - -../ipft_sn.o ../ipft_pc.o: - (cd ..; make $(@:../%=%)) - -clean: - rm -rf *.o core a.out ipsd ipsdr diff --git a/contrib/ipfilter/ipsd/README b/contrib/ipfilter/ipsd/README deleted file mode 100644 index eb6b798..0000000 --- a/contrib/ipfilter/ipsd/README +++ /dev/null @@ -1,32 +0,0 @@ - -IP Scan Detetor. ----------------- - -This program is designed to be a passive listener for TCP packets sent to -the host. It does not exercise the promiscous mode of interfaces. For -routing Unix boxes (and firewalls which route/proxy) this is sufficient to -detect all packets going to/through them. - -Upon compiling, a predefined set of "sensitive" ports are configured into -the program. Any TCP packets which are seen sent to these ports are counted -and the IP# of the sending host recorded, along with the time of the first -packet to that port for that IP#. - -After a given number of "hits", it will write the current table of packets -out to disk. This number defaults to 10,000. - -To analyze the information written to disk, a sample program called "ipsdr" -is used (should but doesn't implement a tree algorithm for storing data) -which reads all log files it recognises and totals up the number of ports -each host hit. By default, all ports have the same weighting (1). Another -group of passes is then made over this table using a netmask of 0xfffffffe, -grouping all results which fall under the same resulting IP#. This netmask -is then shrunk back to 0, with a output for each level given. This is aimed -at detecting port scans done from different hosts on the same subnet (although -I've not seen this done, if one was trying to do it obscurely...) - -Lastly, being passive means that no action is taken to stop port scans being -done or discourage them. - -Darren -darrenr@pobox.com diff --git a/contrib/ipfilter/ipsd/ip_compat.h b/contrib/ipfilter/ipsd/ip_compat.h deleted file mode 100644 index a911fd8..0000000 --- a/contrib/ipfilter/ipsd/ip_compat.h +++ /dev/null @@ -1,201 +0,0 @@ -/* - * (C)opyright 1995 by Darren Reed. - * - * This code may be freely distributed as long as it retains this notice - * and is not changed in any way. The author accepts no responsibility - * for the use of this software. I hate legaleese, don't you ? - * - * @(#)ip_compat.h 1.1 9/14/95 - */ - -/* - * These #ifdef's are here mainly for linux, but who knows, they may - * not be in other places or maybe one day linux will grow up and some - * of these will turn up there too. - */ -#ifndef ICMP_UNREACH -# define ICMP_UNREACH ICMP_DEST_UNREACH -#endif -#ifndef ICMP_SOURCEQUENCH -# define ICMP_SOURCEQUENCH ICMP_SOURCE_QUENCH -#endif -#ifndef ICMP_TIMXCEED -# define ICMP_TIMXCEED ICMP_TIME_EXCEEDED -#endif -#ifndef ICMP_PARAMPROB -# define ICMP_PARAMPROB ICMP_PARAMETERPROB -#endif -#ifndef IPVERSION -# define IPVERSION 4 -#endif -#ifndef IPOPT_MINOFF -# define IPOPT_MINOFF 4 -#endif -#ifndef IPOPT_COPIED -# define IPOPT_COPIED(x) ((x)&0x80) -#endif -#ifndef IPOPT_EOL -# define IPOPT_EOL 0 -#endif -#ifndef IPOPT_NOP -# define IPOPT_NOP 1 -#endif -#ifndef IP_MF -# define IP_MF ((u_short)0x2000) -#endif -#ifndef ETHERTYPE_IP -# define ETHERTYPE_IP ((u_short)0x0800) -#endif -#ifndef TH_FIN -# define TH_FIN 0x01 -#endif -#ifndef TH_SYN -# define TH_SYN 0x02 -#endif -#ifndef TH_RST -# define TH_RST 0x04 -#endif -#ifndef TH_PUSH -# define TH_PUSH 0x08 -#endif -#ifndef TH_ACK -# define TH_ACK 0x10 -#endif -#ifndef TH_URG -# define TH_URG 0x20 -#endif -#ifndef IPOPT_EOL -# define IPOPT_EOL 0 -#endif -#ifndef IPOPT_NOP -# define IPOPT_NOP 1 -#endif -#ifndef IPOPT_RR -# define IPOPT_RR 7 -#endif -#ifndef IPOPT_TS -# define IPOPT_TS 68 -#endif -#ifndef IPOPT_SECURITY -# define IPOPT_SECURITY 130 -#endif -#ifndef IPOPT_LSRR -# define IPOPT_LSRR 131 -#endif -#ifndef IPOPT_SATID -# define IPOPT_SATID 136 -#endif -#ifndef IPOPT_SSRR -# define IPOPT_SSRR 137 -#endif -#ifndef IPOPT_SECUR_UNCLASS -# define IPOPT_SECUR_UNCLASS ((u_short)0x0000) -#endif -#ifndef IPOPT_SECUR_CONFID -# define IPOPT_SECUR_CONFID ((u_short)0xf135) -#endif -#ifndef IPOPT_SECUR_EFTO -# define IPOPT_SECUR_EFTO ((u_short)0x789a) -#endif -#ifndef IPOPT_SECUR_MMMM -# define IPOPT_SECUR_MMMM ((u_short)0xbc4d) -#endif -#ifndef IPOPT_SECUR_RESTR -# define IPOPT_SECUR_RESTR ((u_short)0xaf13) -#endif -#ifndef IPOPT_SECUR_SECRET -# define IPOPT_SECUR_SECRET ((u_short)0xd788) -#endif -#ifndef IPOPT_SECUR_TOPSECRET -# define IPOPT_SECUR_TOPSECRET ((u_short)0x6bc5) -#endif - -#ifdef linux -# define icmp icmphdr -# define icmp_type type -# define icmp_code code - -/* - * From /usr/include/netinet/ip_var.h - * !%@#!$@# linux... - */ -struct ipovly { - caddr_t ih_next, ih_prev; /* for protocol sequence q's */ - u_char ih_x1; /* (unused) */ - u_char ih_pr; /* protocol */ - short ih_len; /* protocol length */ - struct in_addr ih_src; /* source internet address */ - struct in_addr ih_dst; /* destination internet address */ -}; - -typedef struct { - __u16 th_sport; - __u16 th_dport; - __u32 th_seq; - __u32 th_ack; -# if defined(__i386__) || defined(__MIPSEL__) || defined(__alpha__) ||\ - defined(vax) - __u8 th_res:4; - __u8 th_off:4; -#else - __u8 th_off:4; - __u8 th_res:4; -#endif - __u8 th_flags; - __u16 th_win; - __u16 th_sum; - __u16 th_urp; -} tcphdr_t; - -typedef struct { - __u16 uh_sport; - __u16 uh_dport; - __s16 uh_ulen; - __u16 uh_sum; -} udphdr_t; - -typedef struct { -# if defined(__i386__) || defined(__MIPSEL__) || defined(__alpha__) ||\ - defined(vax) - __u8 ip_hl:4; - __u8 ip_v:4; -# else - __u8 ip_hl:4; - __u8 ip_v:4; -# endif - __u8 ip_tos; - __u16 ip_len; - __u16 ip_id; - __u16 ip_off; - __u8 ip_ttl; - __u8 ip_p; - __u16 ip_sum; - struct in_addr ip_src; - struct in_addr ip_dst; -} ip_t; - -typedef struct { - __u8 ether_dhost[6]; - __u8 ether_shost[6]; - __u16 ether_type; -} ether_header_t; - -# define bcopy(a,b,c) memmove(b,a,c) -# define bcmp(a,b,c) memcmp(a,b,c) - -# define ifnet device - -#else - -typedef struct udphdr udphdr_t; -typedef struct tcphdr tcphdr_t; -typedef struct ip ip_t; -typedef struct ether_header ether_header_t; - -#endif - -#ifdef solaris -# define bcopy(a,b,c) memmove(b,a,c) -# define bcmp(a,b,c) memcmp(a,b,c) -# define bzero(a,b) memset(a,0,b) -#endif diff --git a/contrib/ipfilter/ipsd/ipsd.c b/contrib/ipfilter/ipsd/ipsd.c deleted file mode 100644 index 51d0a14..0000000 --- a/contrib/ipfilter/ipsd/ipsd.c +++ /dev/null @@ -1,294 +0,0 @@ -/* - * (C)opyright 1995-1998 Darren Reed. - * - * See the IPFILTER.LICENCE file for details on licencing. - * - */ -#include <stdio.h> -#include <fcntl.h> -#include <signal.h> -#include <stdlib.h> -#include <netdb.h> -#include <string.h> -#include <sys/types.h> -#include <sys/time.h> -#include <sys/socket.h> -#include <netinet/in.h> -#include <netinet/in_systm.h> -#include <netinet/ip.h> -#include <netinet/tcp.h> -#include <netinet/udp.h> -#include <netinet/ip_icmp.h> -#ifndef linux -#include <netinet/ip_var.h> -#include <netinet/tcpip.h> -#endif -#include "ip_compat.h" -#ifdef linux -#include <linux/sockios.h> -#include "tcpip.h" -#endif -#include "ipsd.h" - -#ifndef lint -static const char sccsid[] = "@(#)ipsd.c 1.3 12/3/95 (C)1995 Darren Reed"; -static const char rcsid[] = "@(#)$Id: ipsd.c,v 2.2 2001/06/09 17:09:25 darrenr Exp $"; -#endif - -extern char *optarg; -extern int optind; - -#ifdef linux -char default_device[] = "eth0"; -#else -# ifdef sun -char default_device[] = "le0"; -# else -# ifdef ultrix -char default_device[] = "ln0"; -# else -char default_device[] = "lan0"; -# endif -# endif -#endif - -#define NPORTS 21 - -u_short defports[NPORTS] = { - 7, 9, 20, 21, 23, 25, 53, 69, 79, 111, - 123, 161, 162, 512, 513, 514, 515, 520, 540, 6000, 0 - }; - -ipsd_t *iphits[NPORTS]; -int writes = 0; - - -int ipcmp(sh1, sh2) -sdhit_t *sh1, *sh2; -{ - return sh1->sh_ip.s_addr - sh2->sh_ip.s_addr; -} - - -/* - * Check to see if we've already received a packet from this host for this - * port. - */ -int findhit(ihp, src, dport) -ipsd_t *ihp; -struct in_addr src; -u_short dport; -{ - int i, j, k; - sdhit_t *sh; - - sh = NULL; - - if (ihp->sd_sz == 4) { - for (i = 0, sh = ihp->sd_hit; i < ihp->sd_cnt; i++, sh++) - if (src.s_addr == sh->sh_ip.s_addr) - return 1; - } else { - for (i = ihp->sd_cnt / 2, j = (i / 2) - 1; j >= 0; j--) { - k = ihp->sd_hit[i].sh_ip.s_addr - src.s_addr; - if (!k) - return 1; - else if (k < 0) - i -= j; - else - i += j; - } - } - return 0; -} - - -/* - * Search for port number amongst the sorted array of targets we're - * interested in. - */ -int detect(ip, tcp) -ip_t *ip; -tcphdr_t *tcp; -{ - ipsd_t *ihp; - sdhit_t *sh; - int i, j, k; - - for (i = 10, j = 4; j >= 0; j--) { - k = tcp->th_dport - defports[i]; - if (!k) { - ihp = iphits[i]; - if (findhit(ihp, ip->ip_src, tcp->th_dport)) - return 0; - sh = ihp->sd_hit + ihp->sd_cnt; - sh->sh_date = time(NULL); - sh->sh_ip.s_addr = ip->ip_src.s_addr; - if (++ihp->sd_cnt == ihp->sd_sz) - { - ihp->sd_sz += 8; - sh = realloc(sh, ihp->sd_sz * sizeof(*sh)); - ihp->sd_hit = sh; - } - qsort(sh, ihp->sd_cnt, sizeof(*sh), ipcmp); - return 0; - } - if (k < 0) - i -= j; - else - i += j; - } - return -1; -} - - -/* - * Allocate initial storage for hosts - */ -setuphits() -{ - int i; - - for (i = 0; i < NPORTS; i++) { - if (iphits[i]) { - if (iphits[i]->sd_hit) - free(iphits[i]->sd_hit); - free(iphits[i]); - } - iphits[i] = (ipsd_t *)malloc(sizeof(ipsd_t)); - iphits[i]->sd_port = defports[i]; - iphits[i]->sd_cnt = 0; - iphits[i]->sd_sz = 4; - iphits[i]->sd_hit = (sdhit_t *)malloc(sizeof(sdhit_t) * 4); - } -} - - -/* - * cleanup exits - */ -waiter() -{ - wait(0); -} - - -/* - * Write statistics out to a file - */ -writestats(nwrites) -int nwrites; -{ - ipsd_t **ipsd, *ips; - char fname[32]; - int i, fd; - - (void) sprintf(fname, "/var/log/ipsd/ipsd-hits.%d", nwrites); - fd = open(fname, O_RDWR|O_CREAT|O_TRUNC|O_EXCL, 0644); - for (i = 0, ipsd = iphits; i < NPORTS; i++, ipsd++) { - ips = *ipsd; - if (ips->sd_cnt) { - write(fd, ips, sizeof(ipsd_t)); - write(fd, ips->sd_hit, sizeof(sdhit_t) * ips->sd_sz); - } - } - (void) close(fd); - exit(0); -} - - -void writenow() -{ - signal(SIGCHLD, waiter); - switch (fork()) - { - case 0 : - writestats(writes); - exit(0); - case -1 : - perror("vfork"); - break; - default : - writes++; - setuphits(); - break; - } -} - - -void usage(prog) -char *prog; -{ - fprintf(stderr, "Usage: %s [-d device]\n", prog); - exit(1); -} - - -void detecthits(fd, writecount) -int fd, writecount; -{ - struct in_addr ip; - int hits = 0; - - while (1) { - hits += readloop(fd, ip); - if (hits > writecount) { - writenow(); - hits = 0; - } - } -} - - -main(argc, argv) -int argc; -char *argv[]; -{ - char *name = argv[0], *dev = NULL; - int fd, writeafter = 10000, angelic = 0, c; - - while ((c = getopt(argc, argv, "ad:n:")) != -1) - switch (c) - { - case 'a' : - angelic = 1; - break; - case 'd' : - dev = optarg; - break; - case 'n' : - writeafter = atoi(optarg); - break; - default : - fprintf(stderr, "Unknown option \"%c\"\n", c); - usage(name); - } - - bzero(iphits, sizeof(iphits)); - setuphits(); - - if (!dev) - dev = default_device; - printf("Device: %s\n", dev); - fd = initdevice(dev, 60); - - if (!angelic) { - switch (fork()) - { - case 0 : - (void) close(0); - (void) close(1); - (void) close(2); - (void) setpgrp(0, getpgrp()); - (void) setsid(); - break; - case -1: - perror("fork"); - exit(-1); - default: - exit(0); - } - } - signal(SIGUSR1, writenow); - detecthits(fd, writeafter); -} diff --git a/contrib/ipfilter/ipsd/ipsd.h b/contrib/ipfilter/ipsd/ipsd.h deleted file mode 100644 index 3726b84..0000000 --- a/contrib/ipfilter/ipsd/ipsd.h +++ /dev/null @@ -1,26 +0,0 @@ -/* - * (C)opyright 1995-1998 Darren Reed. - * - * See the IPFILTER.LICENCE file for details on licencing. - * - * @(#)ipsd.h 1.3 12/3/95 - */ - -typedef struct { - time_t sh_date; - struct in_addr sh_ip; -} sdhit_t; - -typedef struct { - u_int sd_sz; - u_int sd_cnt; - u_short sd_port; - sdhit_t *sd_hit; -} ipsd_t; - -typedef struct { - struct in_addr ss_ip; - int ss_hits; - u_long ss_ports; -} ipss_t; - diff --git a/contrib/ipfilter/ipsd/ipsd.sed b/contrib/ipfilter/ipsd/ipsd.sed deleted file mode 100644 index e69de29..0000000 --- a/contrib/ipfilter/ipsd/ipsd.sed +++ /dev/null diff --git a/contrib/ipfilter/ipsd/ipsdr.c b/contrib/ipfilter/ipsd/ipsdr.c deleted file mode 100644 index af007e4..0000000 --- a/contrib/ipfilter/ipsd/ipsdr.c +++ /dev/null @@ -1,312 +0,0 @@ -/* - * (C)opyright 1995-1998 Darren Reed. - * - * See the IPFILTER.LICENCE file for details on licencing. - * - */ -#include <stdio.h> -#include <fcntl.h> -#include <signal.h> -#include <malloc.h> -#include <netdb.h> -#include <string.h> -#include <sys/dir.h> -#include <sys/types.h> -#include <sys/time.h> -#include <sys/socket.h> -#include <netinet/in.h> -#include <netinet/in_systm.h> -#include <netinet/ip.h> -#include <netinet/tcp.h> -#include <netinet/udp.h> -#include <netinet/ip_icmp.h> -#ifndef linux -#include <netinet/ip_var.h> -#include <netinet/tcpip.h> -#endif -#include "ip_compat.h" -#ifdef linux -#include <linux/sockios.h> -#include "tcpip.h" -#endif -#include "ipsd.h" - -#ifndef lint -static const char sccsid[] = "@(#)ipsdr.c 1.3 12/3/95 (C)1995 Darren Reed"; -static const char rcsid[] = "@(#)$Id: ipsdr.c,v 2.2 2001/06/09 17:09:25 darrenr Exp $"; -#endif - -extern char *optarg; -extern int optind; - -#define NPORTS 21 - -u_short defports[NPORTS] = { - 7, 9, 20, 21, 23, 25, 53, 69, 79, 111, - 123, 161, 162, 512, 513, 513, 515, 520, 540, 6000, 0 - }; -u_short pweights[NPORTS] = { - 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, - 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1 - }; - -ipsd_t *iphits[NPORTS]; -int pkts; - - -int ipcmp(sh1, sh2) -sdhit_t *sh1, *sh2; -{ - return sh1->sh_ip.s_addr - sh2->sh_ip.s_addr; -} - - -int ssipcmp(sh1, sh2) -ipss_t *sh1, *sh2; -{ - return sh1->ss_ip.s_addr - sh2->ss_ip.s_addr; -} - - -int countpbits(num) -u_long num; -{ - int i, j; - - for (i = 1, j = 0; i; i <<= 1) - if (num & i) - j++; - return j; -} - - -/* - * Check to see if we've already received a packet from this host for this - * port. - */ -int findhit(ihp, src, dport) -ipsd_t *ihp; -struct in_addr src; -u_short dport; -{ - int i, j, k; - sdhit_t *sh; - - sh = NULL; - - if (ihp->sd_sz == 4) { - for (i = 0, sh = ihp->sd_hit; i < ihp->sd_cnt; i++, sh++) - if (src.s_addr == sh->sh_ip.s_addr) - return 1; - } else { - for (i = ihp->sd_cnt / 2, j = (i / 2) - 1; j >= 0; j--) { - k = ihp->sd_hit[i].sh_ip.s_addr - src.s_addr; - if (!k) - return 1; - else if (k < 0) - i -= j; - else - i += j; - } - } - return 0; -} - - -/* - * Search for port number amongst the sorted array of targets we're - * interested in. - */ -int detect(srcip, dport, date) -struct in_addr srcip; -u_short dport; -time_t date; -{ - ipsd_t *ihp; - sdhit_t *sh; - int i, j, k; - - for (i = 10, j = 4; j >= 0; j--) { - k = dport - defports[i]; - if (!k) { - ihp = iphits[i]; - if (findhit(ihp, srcip, dport)) - return 0; - sh = ihp->sd_hit + ihp->sd_cnt; - sh->sh_date = date; - sh->sh_ip = srcip; - if (++ihp->sd_cnt == ihp->sd_sz) - { - ihp->sd_sz += 8; - sh = realloc(sh, ihp->sd_sz * sizeof(*sh)); - ihp->sd_hit = sh; - } - qsort(sh, ihp->sd_cnt, sizeof(*sh), ipcmp); - return 0; - } - if (k < 0) - i -= j; - else - i += j; - } - return -1; -} - - -/* - * Allocate initial storage for hosts - */ -setuphits() -{ - int i; - - for (i = 0; i < NPORTS; i++) { - if (iphits[i]) { - if (iphits[i]->sd_hit) - free(iphits[i]->sd_hit); - free(iphits[i]); - } - iphits[i] = (ipsd_t *)malloc(sizeof(ipsd_t)); - iphits[i]->sd_port = defports[i]; - iphits[i]->sd_cnt = 0; - iphits[i]->sd_sz = 4; - iphits[i]->sd_hit = (sdhit_t *)malloc(sizeof(sdhit_t) * 4); - } -} - - -/* - * Write statistics out to a file - */ -addfile(file) -char *file; -{ - ipsd_t ipsd, *ips = &ipsd; - sdhit_t hit, *hp; - char fname[32]; - int i, fd, sz; - - if ((fd = open(file, O_RDONLY)) == -1) { - perror("open"); - return; - } - - printf("opened %s\n", file); - do { - if (read(fd, ips, sizeof(*ips)) != sizeof(*ips)) - break; - sz = ips->sd_sz * sizeof(*hp); - hp = (sdhit_t *)malloc(sz); - if (read(fd, hp, sz) != sz) - break; - for (i = 0; i < ips->sd_cnt; i++) - detect(hp[i].sh_ip, ips->sd_port, hp[i].sh_date); - } while (1); - (void) close(fd); -} - - -readfiles(dir) -char *dir; -{ - struct direct **d; - int i, j; - - d = NULL; - i = scandir(dir, &d, NULL, NULL); - - for (j = 0; j < i; j++) { - if (strncmp(d[j]->d_name, "ipsd-hits.", 10)) - continue; - addfile(d[j]->d_name); - } -} - - -void printreport(ss, num) -ipss_t *ss; -int num; -{ - struct in_addr ip; - ipss_t *sp; - int i, j, mask; - u_long ports; - - printf("Hosts detected: %d\n", num); - if (!num) - return; - for (i = 0; i < num; i++) - printf("%s %d %d\n", inet_ntoa(ss[i].ss_ip), ss[i].ss_hits, - countpbits(ss[i].ss_ports)); - - printf("--------------------------\n"); - for (mask = 0xfffffffe, j = 32; j; j--, mask <<= 1) { - ip.s_addr = ss[0].ss_ip.s_addr & mask; - ports = ss[0].ss_ports; - for (i = 1; i < num; i++) { - sp = ss + i; - if (ip.s_addr != (sp->ss_ip.s_addr & mask)) { - printf("Netmask: 0x%08x\n", mask); - printf("%s %d\n", inet_ntoa(ip), - countpbits(ports)); - ip.s_addr = sp->ss_ip.s_addr & mask; - ports = 0; - } - ports |= sp->ss_ports; - } - if (ports) { - printf("Netmask: 0x%08x\n", mask); - printf("%s %d\n", inet_ntoa(ip), countpbits(ports)); - } - } -} - - -collectips() -{ - ipsd_t *ips; - ipss_t *ss; - int i, num, nip, in, j, k; - - for (i = 0; i < NPORTS; i++) - nip += iphits[i]->sd_cnt; - - ss = (ipss_t *)malloc(sizeof(ipss_t) * nip); - - for (in = 0, i = 0, num = 0; i < NPORTS; i++) { - ips = iphits[i]; - for (j = 0; j < ips->sd_cnt; j++) { - for (k = 0; k < num; k++) - if (!bcmp(&ss[k].ss_ip, &ips->sd_hit[j].sh_ip, - sizeof(struct in_addr))) { - ss[k].ss_hits += pweights[i]; - ss[k].ss_ports |= (1 << i); - break; - } - if (k == num) { - ss[num].ss_ip = ips->sd_hit[j].sh_ip; - ss[num].ss_hits = pweights[i]; - ss[k].ss_ports |= (1 << i); - num++; - } - } - } - - qsort(ss, num, sizeof(*ss), ssipcmp); - - printreport(ss, num); -} - - -main(argc, argv) -int argc; -char *argv[]; -{ - char c, *name = argv[0], *dir = NULL; - int fd; - - setuphits(); - dir = dir ? dir : "."; - readfiles(dir); - collectips(); -} diff --git a/contrib/ipfilter/ipsd/linux.h b/contrib/ipfilter/ipsd/linux.h deleted file mode 100644 index d9606cb..0000000 --- a/contrib/ipfilter/ipsd/linux.h +++ /dev/null @@ -1,15 +0,0 @@ -/* - * Copyright (C) 1997-1998 by Darren Reed. - * - * See the IPFILTER.LICENCE file for details on licencing. - * - * @(#)linux.h 1.1 8/19/95 - */ - -#include <linux/config.h> -#ifdef MODULE -#include <linux/module.h> -#include <linux/version.h> -#endif /* MODULE */ - -#include "ip_compat.h" diff --git a/contrib/ipfilter/ipsd/sbpf.c b/contrib/ipfilter/ipsd/sbpf.c deleted file mode 100644 index 457891b..0000000 --- a/contrib/ipfilter/ipsd/sbpf.c +++ /dev/null @@ -1,208 +0,0 @@ -/* - * (C)opyright 1995-1998 Darren Reed. (from tcplog) - * - * See the IPFILTER.LICENCE file for details on licencing. - * - */ -#include <stdio.h> -#include <netdb.h> -#include <ctype.h> -#include <signal.h> -#include <errno.h> -#ifdef __NetBSD__ -# include <paths.h> -#endif -#include <sys/types.h> -#include <sys/param.h> -#include <sys/mbuf.h> -#include <sys/time.h> -#include <sys/timeb.h> -#include <sys/socket.h> -#include <sys/file.h> -#include <sys/ioctl.h> -#if BSD < 199103 -#include <sys/fcntlcom.h> -#endif -#include <sys/dir.h> -#include <net/bpf.h> - -#include <net/if.h> -#include <netinet/in.h> -#include <netinet/in_systm.h> -#include <netinet/ip.h> -#include <netinet/if_ether.h> -#include <netinet/ip_var.h> -#include <netinet/udp.h> -#include <netinet/udp_var.h> -#include <netinet/tcp.h> -#include <netinet/tcpip.h> -#include "ip_compat.h" - -#ifndef lint -static char sbpf[] = "@(#)sbpf.c 1.2 12/3/95 (C)1995 Darren Reed"; -#endif - -/* -(000) ldh [12] -(001) jeq #0x800 jt 2 jf 5 -(002) ldb [23] -(003) jeq #0x6 jt 4 jf 5 -(004) ret #68 -(005) ret #0 -*/ -struct bpf_insn filter[] = { -/* 0. */ { BPF_LD|BPF_H|BPF_ABS, 0, 0, 12 }, -/* 1. */ { BPF_JMP|BPF_JEQ, 0, 3, 0x0800 }, -/* 2. */ { BPF_LD|BPF_B|BPF_ABS, 0, 0, 23 }, -/* 3. */ { BPF_JMP|BPF_JEQ, 0, 1, 0x06 }, -/* 4. */ { BPF_RET, 0, 0, 68 }, -/* 5. */ { BPF_RET, 0, 0, 0 } -}; -/* - * the code herein is dervied from libpcap. - */ -static u_char *buf = NULL; -static u_int bufsize = 32768, timeout = 1; - - -int ack_recv(ep) -char *ep; -{ - struct tcpiphdr tip; - tcphdr_t *tcp; - ip_t *ip; - - ip = (ip_t *)&tip; - tcp = (tcphdr_t *)(ip + 1); - bcopy(ep + 14, (char *)ip, sizeof(*ip)); - bcopy(ep + 14 + (ip->ip_hl << 2), (char *)tcp, sizeof(*tcp)); - if (ip->ip_p != IPPROTO_TCP && ip->ip_p != IPPROTO_UDP) - return -1; - if (ip->ip_p & 0x1fff != 0) - return 0; - if (0 == detect(ip, tcp)) - return 1; - return 0; -} - - -int readloop(fd, port, dst) -int fd, port; -struct in_addr dst; -{ - register u_char *bp, *cp, *bufend; - register struct bpf_hdr *bh; - register int cc; - time_t in = time(NULL); - int done = 0; - - while ((cc = read(fd, buf, bufsize)) >= 0) { - if (!cc && (time(NULL) - in) > timeout) - return done; - bp = buf; - bufend = buf + cc; - /* - * loop through each snapshot in the chunk - */ - while (bp < bufend) { - bh = (struct bpf_hdr *)bp; - cp = bp + bh->bh_hdrlen; - done += ack_recv(cp); - bp += BPF_WORDALIGN(bh->bh_caplen + bh->bh_hdrlen); - } - return done; - } - perror("read"); - exit(-1); -} - -int initdevice(device, tout) -char *device; -int tout; -{ - struct bpf_program prog; - struct bpf_version bv; - struct timeval to; - struct ifreq ifr; -#ifdef _PATH_BPF - char *bpfname = _PATH_BPF; - int fd; - - if ((fd = open(bpfname, O_RDWR)) < 0) - { - fprintf(stderr, "no bpf devices available as /dev/bpfxx\n"); - return -1; - } -#else - char bpfname[16]; - int fd = -1, i; - - for (i = 0; i < 16; i++) - { - (void) sprintf(bpfname, "/dev/bpf%d", i); - if ((fd = open(bpfname, O_RDWR)) >= 0) - break; - } - if (i == 16) - { - fprintf(stderr, "no bpf devices available as /dev/bpfxx\n"); - return -1; - } -#endif - - if (ioctl(fd, BIOCVERSION, (caddr_t)&bv) < 0) - { - perror("BIOCVERSION"); - return -1; - } - if (bv.bv_major != BPF_MAJOR_VERSION || - bv.bv_minor < BPF_MINOR_VERSION) - { - fprintf(stderr, "kernel bpf (v%d.%d) filter out of date:\n", - bv.bv_major, bv.bv_minor); - fprintf(stderr, "current version: %d.%d\n", - BPF_MAJOR_VERSION, BPF_MINOR_VERSION); - return -1; - } - - (void) strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name)); - if (ioctl(fd, BIOCSETIF, &ifr) == -1) - { - fprintf(stderr, "%s(%d):", ifr.ifr_name, fd); - perror("BIOCSETIF"); - exit(1); - } - /* - * set the timeout - */ - timeout = tout; - to.tv_sec = 1; - to.tv_usec = 0; - if (ioctl(fd, BIOCSRTIMEOUT, (caddr_t)&to) == -1) - { - perror("BIOCSRTIMEOUT"); - exit(-1); - } - /* - * get kernel buffer size - */ - if (ioctl(fd, BIOCSBLEN, &bufsize) == -1) - perror("BIOCSBLEN"); - if (ioctl(fd, BIOCGBLEN, &bufsize) == -1) - { - perror("BIOCGBLEN"); - exit(-1); - } - printf("BPF buffer size: %d\n", bufsize); - buf = (u_char*)malloc(bufsize); - - prog.bf_len = sizeof(filter) / sizeof(struct bpf_insn); - prog.bf_insns = filter; - if (ioctl(fd, BIOCSETF, (caddr_t)&prog) == -1) - { - perror("BIOCSETF"); - exit(-1); - } - (void) ioctl(fd, BIOCFLUSH, 0); - return fd; -} diff --git a/contrib/ipfilter/ipsd/sdlpi.c b/contrib/ipfilter/ipsd/sdlpi.c deleted file mode 100644 index baede7c..0000000 --- a/contrib/ipfilter/ipsd/sdlpi.c +++ /dev/null @@ -1,259 +0,0 @@ -/* - * (C)opyright 1992-1998 Darren Reed. (from tcplog) - * - * See the IPFILTER.LICENCE file for details on licencing. - * - */ - -#include <stdio.h> -#include <netdb.h> -#include <ctype.h> -#include <fcntl.h> -#include <signal.h> -#include <errno.h> -#include <sys/types.h> -#include <sys/time.h> -#include <sys/timeb.h> -#include <sys/socket.h> -#include <sys/file.h> -#include <sys/ioctl.h> -#include <sys/stropts.h> - -#include <sys/pfmod.h> -#include <sys/bufmod.h> -#include <sys/dlpi.h> - -#include <net/if.h> -#include <netinet/in.h> -#include <netinet/in_systm.h> -#include <netinet/ip.h> -#include <netinet/if_ether.h> -#include <netinet/ip_var.h> -#include <netinet/udp.h> -#include <netinet/udp_var.h> -#include <netinet/tcp.h> -#include <netinet/tcpip.h> - -#include "ip_compat.h" - -#ifndef lint -static char snitid[] = "%W% %G% (C)1995 Darren Reed"; -#endif - -#define BUFSPACE 32768 - -static int solfd; - -/* - * Be careful to only include those defined in the flags option for the - * interface are included in the header size. - */ -static int timeout; - - -void nullbell() -{ - return 0; -} - - -int ack_recv(ep) -char *ep; -{ - struct tcpiphdr tip; - tcphdr_t *tcp; - ip_t *ip; - - ip = (ip_t *)&tip; - tcp = (tcphdr_t *)(ip + 1); - bcopy(ep, (char *)ip, sizeof(*ip)); - bcopy(ep + (ip->ip_hl << 2), (char *)tcp, sizeof(*tcp)); - - if (ip->ip_off & 0x1fff != 0) - return 0; - if (0 == detect(ip, tcp)) - return 1; - return 0; -} - - -int readloop(fd, port, dst) -int fd, port; -struct in_addr dst; -{ - static u_char buf[BUFSPACE]; - register u_char *bp, *cp, *bufend; - register struct sb_hdr *hp; - register int cc; - struct strbuf dbuf; - ether_header_t eh; - time_t now = time(NULL); - int flags = 0, i, done = 0; - - fd = solfd; - dbuf.len = 0; - dbuf.buf = buf; - dbuf.maxlen = sizeof(buf); - /* - * no control data buffer... - */ - while (1) { - (void) signal(SIGALRM, nullbell); - alarm(1); - i = getmsg(fd, NULL, &dbuf, &flags); - alarm(0); - (void) signal(SIGALRM, nullbell); - - cc = dbuf.len; - if ((time(NULL) - now) > timeout) - return done; - if (i == -1) - if (errno == EINTR) - continue; - else - break; - bp = buf; - bufend = buf + cc; - /* - * loop through each snapshot in the chunk - */ - while (bp < bufend) { - /* - * get past bufmod header - */ - hp = (struct sb_hdr *)bp; - cp = (u_char *)((char *)bp + sizeof(*hp)); - bcopy(cp, (char *)&eh, sizeof(eh)); - /* - * next snapshot - */ - bp += hp->sbh_totlen; - cc -= hp->sbh_totlen; - - if (eh.ether_type != ETHERTYPE_IP) - continue; - - cp += sizeof(eh); - done += ack_recv(cp); - } - alarm(1); - } - perror("getmsg"); - exit(-1); -} - -int initdevice(device, tout) -char *device; -int tout; -{ - struct strioctl si; - struct timeval to; - struct ifreq ifr; - struct packetfilt pfil; - u_long if_flags; - u_short *fwp = pfil.Pf_Filter; - char devname[16], *s, buf[256]; - int i, offset, fd, snaplen= 58, chunksize = BUFSPACE; - - (void) sprintf(devname, "/dev/%s", device); - - s = devname + 5; - while (*s && !ISDIGIT(*s)) - s++; - if (!*s) - { - fprintf(stderr, "bad device name %s\n", devname); - exit(-1); - } - i = atoi(s); - *s = '\0'; - /* - * For reading - */ - if ((fd = open(devname, O_RDWR)) < 0) - { - fprintf(stderr, "O_RDWR(0) "); - perror(devname); - exit(-1); - } - if (dlattachreq(fd, i) == -1 || dlokack(fd, buf) == -1) - { - fprintf(stderr, "DLPI error\n"); - exit(-1); - } - dlbindreq(fd, ETHERTYPE_IP, 0, DL_CLDLS, 0, 0); - dlbindack(fd, buf); - /* - * read full headers - */ - if (strioctl(fd, DLIOCRAW, -1, 0, NULL) == -1) - { - fprintf(stderr, "DLIOCRAW error\n"); - exit(-1); - } - /* - * Create some filter rules for our TCP watcher. We only want ethernet - * pacets which are IP protocol and only the TCP packets from IP. - */ - offset = 6; - *fwp++ = ENF_PUSHWORD + offset; - *fwp++ = ENF_PUSHLIT | ENF_CAND; - *fwp++ = htons(ETHERTYPE_IP); - *fwp++ = ENF_PUSHWORD + sizeof(struct ether_header)/sizeof(short)+4; - *fwp++ = ENF_PUSHLIT | ENF_AND; - *fwp++ = htons(0x00ff); - *fwp++ = ENF_PUSHLIT | ENF_COR; - *fwp++ = htons(IPPROTO_TCP); - *fwp++ = ENF_PUSHWORD + sizeof(struct ether_header)/sizeof(short)+4; - *fwp++ = ENF_PUSHLIT | ENF_AND; - *fwp++ = htons(0x00ff); - *fwp++ = ENF_PUSHLIT | ENF_CAND; - *fwp++ = htons(IPPROTO_UDP); - pfil.Pf_FilterLen = (fwp - &pfil.Pf_Filter[0]); - /* - * put filter in place. - */ - - if (ioctl(fd, I_PUSH, "pfmod") == -1) - { - perror("ioctl: I_PUSH pf"); - exit(1); - } - if (strioctl(fd, PFIOCSETF, -1, sizeof(pfil), (char *)&pfil) == -1) - { - perror("ioctl: PFIOCSETF"); - exit(1); - } - - /* - * arrange to get messages from the NIT STREAM and use NIT_BUF option - */ - if (ioctl(fd, I_PUSH, "bufmod") == -1) - { - perror("ioctl: I_PUSH bufmod"); - exit(1); - } - i = 128; - strioctl(fd, SBIOCSSNAP, -1, sizeof(i), (char *)&i); - /* - * set the timeout - */ - to.tv_sec = 1; - to.tv_usec = 0; - if (strioctl(fd, SBIOCSTIME, -1, sizeof(to), (char *)&to) == -1) - { - perror("strioctl(SBIOCSTIME)"); - exit(-1); - } - /* - * flush read queue - */ - if (ioctl(fd, I_FLUSH, FLUSHR) == -1) - { - perror("I_FLUSHR"); - exit(-1); - } - timeout = tout; - solfd = fd; - return fd; -} diff --git a/contrib/ipfilter/ipsd/slinux.c b/contrib/ipfilter/ipsd/slinux.c deleted file mode 100644 index 6372a60..0000000 --- a/contrib/ipfilter/ipsd/slinux.c +++ /dev/null @@ -1,116 +0,0 @@ -/* - * (C)opyright 1992-1998 Darren Reed. (from tcplog) - * - * See the IPFILTER.LICENCE file for details on licencing. - * - */ - -#include <stdio.h> -#include <netdb.h> -#include <ctype.h> -#include <signal.h> -#include <errno.h> -#include <sys/types.h> -#include <sys/time.h> -#include <sys/timeb.h> -#include <sys/socket.h> -#include <sys/file.h> -#include <sys/ioctl.h> -#include <sys/dir.h> -#include <linux/netdevice.h> -#include <net/if.h> -#include <netinet/in.h> -#include <netinet/ip.h> -#include <netinet/tcp.h> -#include "ip_compat.h" -#include "tcpip.h" - -#ifndef lint -static const char sccsid[] = "@(#)slinux.c 1.1 12/3/95 (C) 1995 Darren Reed"; -#endif - -#define BUFSPACE 32768 - -/* - * Be careful to only include those defined in the flags option for the - * interface are included in the header size. - */ - -static int timeout; -static char *eth_dev = NULL; - - -int ack_recv(bp) -char *bp; -{ - struct tcpip tip; - tcphdr_t *tcp; - ip_t *ip; - - ip = (struct ip *)&tip; - tcp = (tcphdr_t *)(ip + 1); - - bcopy(bp, (char *)&tip, sizeof(tip)); - bcopy(bp + (ip.ip_hl << 2), (char *)tcp, sizeof(*tcp)); - if (0 == detect(ip, tcp)) - return 1; - return 0; -} - - -void readloop(fd, port, dst) -int fd, port; -struct in_addr dst; -{ - static u_char buf[BUFSPACE]; - struct sockaddr dest; - register u_char *bp = buf; - register int cc; - int dlen, done = 0; - time_t now = time(NULL); - - do { - fflush(stdout); - dlen = sizeof(dest); - bzero((char *)&dest, dlen); - cc = recvfrom(fd, buf, BUFSPACE, 0, &dest, &dlen); - if (!cc) - if ((time(NULL) - now) > timeout) - return done; - else - continue; - - if (bp[12] != 0x8 || bp[13] != 0) - continue; /* not ip */ - - /* - * get rid of non-tcp or fragmented packets here. - */ - if (cc >= sizeof(struct tcpiphdr)) - { - if (((bp[14+9] != IPPROTO_TCP) && - (bp[14+9] != IPPROTO_UDP)) || - (bp[14+6] & 0x1f) || (bp[14+6] & 0xff)) - continue; - done += ack_recv(bp + 14); - } - } while (cc >= 0); - perror("read"); - exit(-1); -} - -int initdevice(dev, tout) -char *dev; -int tout; -{ - int fd; - - eth_dev = strdup(dev); - if ((fd = socket(AF_INET, SOCK_PACKET, htons(ETHERTYPE_IP))) == -1) - { - perror("socket(SOCK_PACKET)"); - exit(-1); - } - - return fd; -} diff --git a/contrib/ipfilter/ipsd/snit.c b/contrib/ipfilter/ipsd/snit.c deleted file mode 100644 index e78c591..0000000 --- a/contrib/ipfilter/ipsd/snit.c +++ /dev/null @@ -1,226 +0,0 @@ -/* - * (C)opyright 1992-1998 Darren Reed. (from tcplog) - * - * See the IPFILTER.LICENCE file for details on licencing. - * - */ - -#include <stdio.h> -#include <netdb.h> -#include <ctype.h> -#include <signal.h> -#include <errno.h> -#include <sys/types.h> -#include <sys/time.h> -#include <sys/timeb.h> -#include <sys/socket.h> -#include <sys/file.h> -#include <sys/ioctl.h> -#include <net/nit.h> -#include <sys/fcntlcom.h> -#include <sys/dir.h> -#include <net/nit_if.h> -#include <net/nit_pf.h> -#include <net/nit_buf.h> -#include <net/packetfilt.h> -#include <sys/stropts.h> - -#include <net/if.h> -#include <netinet/in.h> -#include <netinet/in_systm.h> -#include <netinet/ip.h> -#include <netinet/if_ether.h> -#include <netinet/ip_var.h> -#include <netinet/udp.h> -#include <netinet/udp_var.h> -#include <netinet/tcp.h> -#include <netinet/tcpip.h> - -#ifndef lint -static char snitid[] = "@(#)snit.c 1.2 12/3/95 (C)1995 Darren Reed"; -#endif - -#define BUFSPACE 32768 - -/* - * Be careful to only include those defined in the flags option for the - * interface are included in the header size. - */ -#define BUFHDR_SIZE (sizeof(struct nit_bufhdr)) -#define NIT_HDRSIZE (BUFHDR_SIZE) - -static int timeout; - - -int ack_recv(ep) -char *ep; -{ - struct tcpiphdr tip; - struct tcphdr *tcp; - struct ip *ip; - - ip = (struct ip *)&tip; - tcp = (struct tcphdr *)(ip + 1); - bcopy(ep + 14, (char *)ip, sizeof(*ip)); - bcopy(ep + 14 + (ip->ip_hl << 2), (char *)tcp, sizeof(*tcp)); - if (ip->ip_off & 0x1fff != 0) - return 0; - if (0 == detect(ip, tcp)) - return 1; - return 0; -} - - -int readloop(fd, dst) -int fd; -struct in_addr dst; -{ - static u_char buf[BUFSPACE]; - register u_char *bp, *cp, *bufend; - register struct nit_bufhdr *hp; - register int cc; - time_t now = time(NULL); - int done = 0; - - while ((cc = read(fd, buf, BUFSPACE-1)) >= 0) { - if (!cc) - if ((time(NULL) - now) > timeout) - return done; - else - continue; - bp = buf; - bufend = buf + cc; - /* - * loop through each snapshot in the chunk - */ - while (bp < bufend) { - cp = (u_char *)((char *)bp + NIT_HDRSIZE); - /* - * get past NIT buffer - */ - hp = (struct nit_bufhdr *)bp; - /* - * next snapshot - */ - bp += hp->nhb_totlen; - done += ack_recv(cp); - } - return done; - } - perror("read"); - exit(-1); -} - -int initdevice(device, tout) -char *device; -int tout; -{ - struct strioctl si; - struct timeval to; - struct ifreq ifr; - struct packetfilt pfil; - u_long if_flags; - u_short *fwp = pfil.Pf_Filter; - int ret, offset, fd, snaplen= 76, chunksize = BUFSPACE; - - if ((fd = open("/dev/nit", O_RDWR)) < 0) - { - perror("/dev/nit"); - exit(-1); - } - - /* - * Create some filter rules for our TCP watcher. We only want ethernet - * pacets which are IP protocol and only the TCP packets from IP. - */ - offset = 6; - *fwp++ = ENF_PUSHWORD + offset; - *fwp++ = ENF_PUSHLIT | ENF_CAND; - *fwp++ = htons(ETHERTYPE_IP); - *fwp++ = ENF_PUSHWORD + sizeof(struct ether_header)/sizeof(short)+4; - *fwp++ = ENF_PUSHLIT | ENF_AND; - *fwp++ = htons(0x00ff); - *fwp++ = ENF_PUSHLIT | ENF_COR; - *fwp++ = htons(IPPROTO_TCP); - *fwp++ = ENF_PUSHWORD + sizeof(struct ether_header)/sizeof(short)+4; - *fwp++ = ENF_PUSHLIT | ENF_AND; - *fwp++ = htons(0x00ff); - *fwp++ = ENF_PUSHLIT | ENF_CAND; - *fwp++ = htons(IPPROTO_UDP); - pfil.Pf_FilterLen = fwp - &pfil.Pf_Filter[0]; - /* - * put filter in place. - */ - if (ioctl(fd, I_PUSH, "pf") == -1) - { - perror("ioctl: I_PUSH pf"); - exit(1); - } - if (ioctl(fd, NIOCSETF, &pfil) == -1) - { - perror("ioctl: NIOCSETF"); - exit(1); - } - /* - * arrange to get messages from the NIT STREAM and use NIT_BUF option - */ - ioctl(fd, I_SRDOPT, (char*)RMSGD); - ioctl(fd, I_PUSH, "nbuf"); - /* - * set the timeout - */ - timeout = tout; - si.ic_timout = 1; - to.tv_sec = 1; - to.tv_usec = 0; - si.ic_cmd = NIOCSTIME; - si.ic_len = sizeof(to); - si.ic_dp = (char*)&to; - if (ioctl(fd, I_STR, (char*)&si) == -1) - { - perror("ioctl: NIT timeout"); - exit(-1); - } - /* - * set the chunksize - */ - si.ic_cmd = NIOCSCHUNK; - si.ic_len = sizeof(chunksize); - si.ic_dp = (char*)&chunksize; - if (ioctl(fd, I_STR, (char*)&si) == -1) - perror("ioctl: NIT chunksize"); - if (ioctl(fd, NIOCGCHUNK, (char*)&chunksize) == -1) - { - perror("ioctl: NIT chunksize"); - exit(-1); - } - printf("NIT buffer size: %d\n", chunksize); - - /* - * request the interface - */ - strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name)); - ifr.ifr_name[sizeof(ifr.ifr_name) - 1] = ' '; - si.ic_cmd = NIOCBIND; - si.ic_len = sizeof(ifr); - si.ic_dp = (char*)𝔦 - if (ioctl(fd, I_STR, (char*)&si) == -1) - { - perror(ifr.ifr_name); - exit(1); - } - - /* - * set the snapshot length - */ - si.ic_cmd = NIOCSSNAP; - si.ic_len = sizeof(snaplen); - si.ic_dp = (char*)&snaplen; - if (ioctl(fd, I_STR, (char*)&si) == -1) - { - perror("ioctl: NIT snaplen"); - exit(1); - } - (void) ioctl(fd, I_FLUSH, (char*)FLUSHR); - return fd; -} |