serv.c

一个网络流量分析的完整的程序

/***

serv.c  - TCP/UDP port statistics module
Written by Gerard Paul Java
Copyright (c) Gerard Paul Java 1997, 1998

This software is open source; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.

This program is distributed WITHOUT ANY WARRANTY; without even the
implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
See the GNU General Public License in the included COPYING file for
details.

***/

#include <curses.h>
#include <panel.h>
#include <stdlib.h>
#include <unistd.h>
#include <fcntl.h>
#include <signal.h>
#include <time.h>
#include <sys/time.h>
#include <netdb.h>
#include <ctype.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netinet/ip.h>
#include <netinet/udp.h>
#include <linux/if_packet.h>
#include <linux/if_ether.h>
#include <listbox.h>
#include <labels.h>
#include <winops.h>
#include <input.h>
#include <msgboxes.h>
#include "tcphdr.h"
#include "dirs.h"
#include "ipcsum.h"
#include "deskman.h"
#include "isdntab.h"
#include "fltdefs.h"
#include "utfilter.h"
#include "fltselect.h"
#include "packet.h"
#include "ipfrag.h"
#include "ifaces.h"
#include "attrs.h"
#include "serv.h"
#include "servname.h"
#include "log.h"
#include "timer.h"
#include "promisc.h"
#include "options.h"
#include "instances.h"
#include "packet.h"
#include "logvars.h"
#include "error.h"
#include "bar.h"
#include "mode.h"

#define SCROLLUP 0
#define SCROLLDOWN 1

#define LEFT 0
#define RIGHT 1

extern int exitloop;
extern int daemonized;

extern void writeutslog(struct portlistent *list, unsigned long nsecs,
			int unit, FILE * logfile);

/*
 * SIGUSR1 logfile rotation signal handler
 */

void rotate_serv_log()
{
    rotate_flag = 1;
    strcpy(target_logname, current_logfile);
    signal(SIGUSR1, rotate_serv_log);
}

void initportlist(struct portlist *list)
{
    float screen_scale = ((float) COLS / 80 + 1) / 2;
    int scratchx;
    
    list->head = list->tail = list->barptr = NULL;
    list->firstvisible = list->lastvisible = NULL;
    list->count = 0;
    list->baridx = 0;
    
    list->borderwin = newwin(LINES - 3, COLS, 1, 0);
    list->borderpanel = new_panel(list->borderwin);
    wattrset(list->borderwin, BOXATTR);
    box(list->borderwin, ACS_VLINE, ACS_HLINE);

    wmove(list->borderwin, 0, 1 * screen_scale);
    wprintw(list->borderwin, " Proto/Port ");
    wmove(list->borderwin, 0, 22 * screen_scale);
    wprintw(list->borderwin, " Pkts ");
    wmove(list->borderwin, 0, 31 * screen_scale);
    wprintw(list->borderwin, " Bytes ");
    wmove(list->borderwin, 0, 40 * screen_scale);
    wprintw(list->borderwin, " PktsTo ");
    wmove(list->borderwin, 0, 49 * screen_scale);
    wprintw(list->borderwin, " BytesTo ");
    wmove(list->borderwin, 0, 58 * screen_scale);
    wprintw(list->borderwin, " PktsFrom ");
    wmove(list->borderwin, 0, 67 * screen_scale);
    wprintw(list->borderwin, " BytesFrom ");

    list->win = newwin(LINES - 5, COLS - 2, 2, 1);
    list->panel = new_panel(list->win);
    getmaxyx(list->win, list->imaxy, scratchx);

    tx_stdwinset(list->win);
    wtimeout(list->win, -1);
    wattrset(list->win, STDATTR);
    tx_colorwin(list->win);
    update_panels();
    doupdate();
}

struct portlistent *addtoportlist(struct portlist *list,
				  unsigned int protocol, unsigned int port,
				  int *nomem, int servnames)
{
    struct portlistent *ptemp;

    ptemp = malloc(sizeof(struct portlistent));

    if (ptemp == NULL) {
	printnomem();
	*nomem = 1;
	return NULL;
    }
    if (list->head == NULL) {
	ptemp->prev_entry = NULL;
	list->head = ptemp;
	list->firstvisible = ptemp;
    }
    
    if (list->tail != NULL) {
	list->tail->next_entry = ptemp;
	ptemp->prev_entry = list->tail;
    }
    list->tail = ptemp;
    ptemp->next_entry = NULL;

    ptemp->protocol = protocol;
    ptemp->port = port;		/* This is used in checks later. */

    /* 
     * Obtain appropriate service name
     */

    servlook(servnames, htons(port), protocol, ptemp->servname, 10);

    ptemp->count = ptemp->bcount = 0;
    ptemp->icount = ptemp->ibcount = 0;
    ptemp->ocount = ptemp->obcount = 0;

    list->count++;
    ptemp->idx = list->count;

    ptemp->proto_starttime = time(NULL);
    
    if (list->count <= LINES - 5)
	list->lastvisible = ptemp;

    wmove(list->borderwin, LINES - 4, 1);
    wprintw(list->borderwin, " %u entries ", list->count);

    return ptemp;
}

int portinlist(struct porttab *table, unsigned int port)
{
    struct porttab *ptmp = table;

    while (ptmp != NULL) {
	if (((ptmp->port_max == 0) && (ptmp->port_min == port)) ||
	    ((port >= ptmp->port_min) && (port <= ptmp->port_max)))
	    return 1;

	ptmp = ptmp->next_entry;
    }

    return 0;
}

int goodport(unsigned int port, struct porttab *table)
{
    return ((port < 1024) || (portinlist(table, port)));
}

struct portlistent *inportlist(struct portlist *list,
			       unsigned int protocol, unsigned int port)
{
    struct portlistent *ptmp = list->head;

    while (ptmp != NULL) {
	if ((ptmp->port == port) && (ptmp->protocol == protocol))
	    return ptmp;

	ptmp = ptmp->next_entry;
    }

    return NULL;
}

void printportent(struct portlist *list, struct portlistent *entry,
		  unsigned int idx)
{
    unsigned int target_row;
    float screen_scale = ((float) COLS / 80 + 1) / 2;
    int tcplabelattr;
    int udplabelattr;
    int highattr;
    char sp_buf[10];
    
    if ((entry->idx < idx) || (entry->idx > idx + (LINES - 6)))
	return;

    target_row = entry->idx - idx;
    
    if (entry == list->barptr) {
        tcplabelattr = BARSTDATTR;
        udplabelattr = BARPTRATTR;
        highattr = BARHIGHATTR;
    } else {
        tcplabelattr = STDATTR;
        udplabelattr = PTRATTR;
        highattr = HIGHATTR;
    }
    
    wattrset(list->win, tcplabelattr);
    sprintf(sp_buf, "%%%dc", COLS - 2);
    scrollok(list->win, 0);
    mvwprintw(list->win, target_row, 0, sp_buf, ' ');
    scrollok(list->win, 1);
    
    wmove(list->win, target_row, 1);
    if (entry->protocol == IPPROTO_TCP) {
	wattrset(list->win, tcplabelattr);
	wprintw(list->win, "TCP");
    } else if (entry->protocol == IPPROTO_UDP) {
	wattrset(list->win, udplabelattr);
	wprintw(list->win, "UDP");
    }
    
    wprintw(list->win, "/%s          ", entry->servname);
    wattrset(list->win, highattr);
    wmove(list->win, target_row, 17 * screen_scale);
    printlargenum(entry->count, list->win);
    wmove(list->win, target_row, 27 * screen_scale);
    printlargenum(entry->bcount, list->win);
    wmove(list->win, target_row, 37 * screen_scale);
    printlargenum(entry->icount, list->win);
    wmove(list->win, target_row, 47 * screen_scale);
    printlargenum(entry->ibcount, list->win);
    wmove(list->win, target_row, 57 * screen_scale);
    printlargenum(entry->ocount, list->win);
    wmove(list->win, target_row, 67 * screen_scale);
    printlargenum(entry->obcount, list->win);
}

void destroyportlist(struct portlist *list)
{
    struct portlistent *ptmp = list->head;
    struct portlistent *ctmp = NULL;

    if (list->head != NULL)
	ctmp = list->head->next_entry;

    while (ptmp != NULL) {
	free(ptmp);
	ptmp = ctmp;

	if (ctmp != NULL)
	    ctmp = ctmp->next_entry;
    }
}

void printport(struct portlist *list, unsigned int protocol,
	       unsigned int port, int br, unsigned int idx, int fromto,
	       struct porttab *ports, int servnames)
{
    struct portlistent *listent;
    int nomem = 0;

    if (goodport(port, ports)) {
	listent = inportlist(list, protocol, port);

	if ((listent == NULL) && (!nomem))
	    listent =
		addtoportlist(list, protocol, port, &nomem, servnames);

	if (listent == NULL)
	    return;

	listent->count++;
	listent->bcount += br;
        listent->spans.spanbr += br;
        
	if (fromto == 0) {	/* from */
	    listent->obcount += br;
	    listent->spans.spanbr_out += br;
	    listent->ocount++;
	} else {		/* to */
	    listent->ibcount += br;
	    listent->spans.spanbr_in += br;
	    listent->icount++;
	}

	printportent(list, listent, idx);
    }
}

/*
 * Swap two port list entries.  p1 must be previous to p2.
 */
 
void swapportents(struct portlist *list,
		  struct portlistent *p1, struct portlistent *p2)
{
    register unsigned int tmp;
    struct portlistent *p1prevsaved;
    struct portlistent *p2nextsaved;

    if (p1 == p2)
	return;

    tmp = p1->idx;
    p1->idx = p2->idx;
    p2->idx = tmp;

    if (p1->prev_entry != NULL)
	p1->prev_entry->next_entry = p2;
    else
	list->head = p2;

    if (p2->next_entry != NULL)
	p2->next_entry->prev_entry = p1;
    else
	list->tail = p1;

    p2nextsaved = p2->next_entry;
    p1prevsaved = p1->prev_entry;

    if (p1->next_entry == p2) {
	p2->next_entry = p1;
	p1->prev_entry = p2;
    } else {
	p2->next_entry = p1->next_entry;
	p1->prev_entry = p2->prev_entry;
	p2->prev_entry->next_entry = p1;
	p1->next_entry->prev_entry = p2;
    }

    p2->prev_entry = p1prevsaved;
    p1->next_entry = p2nextsaved;
}

/*
 * Retrieve the appropriate sort criterion based on keystroke.
 */
unsigned long long qp_getkey(struct portlistent *entry, int ch)
{
    unsigned long long result = 0;
    
    switch(ch) {
    case 'R':
        result = entry->port;
        break;
    case 'B':
        result = entry->bcount;
        break;
    case 'O':
        result = entry->ibcount;
        break;
    case 'M':
        result = entry->obcount;
        break;
    case 'P':
        result = entry->count;
        break;
    case 'T':
        result = entry->icount;
        break;
    case 'F':
        result = entry->ocount;
        break;
    }
    
    return result;
}

/*
 * Refresh TCP/UDP service screen.
 */
 
void refresh_serv_screen(struct portlist *table, int idx)
{
    struct portlistent *ptmp = table->firstvisible;

    wattrset(table->win, STDATTR);    
    tx_colorwin(table->win);
    
    while ((ptmp != NULL) && (ptmp->prev_entry != table->lastvisible)) {
        printportent(table, ptmp, idx);
        ptmp = ptmp->next_entry;
    }
    update_panels();
    doupdate();
}
      

/*
 * Compare the sort criterion with the pivot value.  Receives a parameter
 * specifying whether the criterion is left or right of the pivot value.
 *
 * If criterion is the port number: return true if criterion is less than or
 *     equal to the pivot when the SIDE is left.  If SIDE is right, return
 *     true if the value is greater than the pivot.  This results in an
 *     ascending sort.
 *
 * If the criterion is a count: return true when the criterion is greater than
 *     or equal to the pivot when the SIDE is left, otherwise, when SIDE is
 *     right, return true if the value is less than the pivot.  This results
 *     in a descending sort. 
 */