serv.c

一个网络流量分析的完整的程序

		        refresh_serv_screen(&list, idx);
		    }
		    break;
		case KEY_NPAGE:
		case ' ':
		    if (list.barptr != NULL) {
		        pageservwin(&list, SCROLLUP, &idx);
		        
		        set_barptr((char **) &(list.barptr), (char *) (list.firstvisible),
		            &(list.firstvisible->starttime),
		            (char *) &(list.firstvisible->spans),
		            sizeof(struct serv_spans), statwin, &statcleared, statx);
		        list.baridx = 1;
		        
		        refresh_serv_screen(&list, idx);
		    }
		    break;
		case 12:
		case 'l':
		case 'L':
		    tx_refresh_screen();
		    break;
		case 's':
		case 'S':
		    show_portsort_keywin(&sortwin, &sortpanel);
		    keymode = 1;
		    break;
		case 'q':
		case 'Q':
		case 'x':
		case 'X':
		case 27:
		case 24:
		    exitloop = 1;
		}
	    } else if (keymode == 1) {
		del_panel(sortpanel);
		delwin(sortwin);
		sortportents(&list, &idx, ch);
		keymode = 0;
		if (list.barptr != NULL) {
		    set_barptr((char **) &(list.barptr), (char *) list.firstvisible,
		        &(list.firstvisible->starttime),
		        (char *) &(list.firstvisible->spans),
		        sizeof(struct serv_spans), statwin, &statcleared, statx);
		    list.baridx = 1;
		}
		refresh_serv_screen(&list, idx);
		update_panels();
		doupdate();
	    }
	}

	if (br > 0) {
            pkt_result = processpacket(buf, &ipacket, &br, &tot_br,
                    &sport, &dport, &fromaddr, &linktype,
                    ofilter, iface, ifname);
                    
            if (pkt_result != PACKET_OK)
		    continue;

            if ((((struct iphdr *) ipacket)->protocol == IPPROTO_TCP)
		    || (((struct iphdr *) ipacket)->protocol ==
			IPPROTO_UDP)) {
		printport(&list, ((struct iphdr *) ipacket)->protocol,
			      ntohs(sport),
			      ntohs(((struct iphdr *) ipacket)->tot_len),
			      idx, 0, ports, options->servnames);
		printport(&list, ((struct iphdr *) ipacket)->protocol,
			      ntohs(dport),
			      ntohs(((struct iphdr *) ipacket)->tot_len),
			      idx, 1, ports, options->servnames);
                    
                if ((list.barptr == NULL) && (list.head != NULL)) {
                    set_barptr((char **) &(list.barptr), (char *) list.head,
                            &(list.head->starttime), (char *) &(list.head->spans),
                            sizeof(struct serv_spans), statwin, &statcleared, statx);
                    list.baridx = 1;
                }        
	    }
	}
	gettimeofday(&tv, NULL);
	now = tv.tv_sec;
	unow = tv.tv_sec * 1e+6 + tv.tv_usec;

	if (now - timeint >= 5) {
	    printelapsedtime(starttime, now, LINES - 4, 20,
			     list.borderwin);
	    timeint = now;
	}
	if (((now - startlog) >= options->logspan) && (logging)) {
	    writeutslog(list.head, now - starttime, options->actmode,
	        logfile);
	    startlog = now;
	}
        
        if (list.barptr != NULL) {
            if ((now - list.barptr->starttime) >= 5) {
                update_serv_rates(&list, statwin, options->actmode, &statcleared);
            }
        }
        
	if (((options->updrate != 0)
	     && (now - updtime >= options->updrate))
	    || ((options->updrate == 0)
		&& (unow - updtime_usec >= DEFAULT_UPDATE_DELAY))) {
	    update_panels();
	    doupdate();
	    updtime = now;
	    updtime_usec = unow;
	}
	check_rotate_flag(&logfile, logging);

	if ((facilitytime != 0)
	    && (((now - starttime) / 60) >= facilitytime))
	    exitloop = 1;
    }

    if (logging) {
	signal(SIGUSR1, SIG_DFL);
	writeutslog(list.head, time((time_t *) NULL) - starttime, options->actmode,
	    logfile);
	writelog(logging, logfile,
		 "******** TCP/UDP service monitor stopped ********");
	fclose(logfile);
    }
    if (options->servnames)
	endservent();

    if ((options->promisc) && (is_last_instance())) {
	load_promisc_list(&promisc_list);
	srpromisc(0, promisc_list);
	destroy_promisc_list(&promisc_list);
    }

    adjust_instance_count(PROCCOUNTFILE, -1);

    del_panel(list.panel);
    delwin(list.win);
    del_panel(list.borderpanel);
    delwin(list.borderwin);
    del_panel(statpanel);
    delwin(statwin);
    unmark_facility(TCPUDPIDFILE, ifname);
    update_panels();
    doupdate();
    destroyportlist(&list);
    pkt_cleanup();
    strcpy(current_logfile, "");
}

void portdlg(unsigned int *port_min, int *port_max, int *aborted, int mode)
{
    WINDOW *bw;
    PANEL *bp;
    WINDOW *win;
    PANEL *panel;

    struct FIELDLIST list;

    bw = newwin(14, 50, (LINES - 14) / 2, (COLS - 50) / 2 - 10);
    bp = new_panel(bw);

    win = newwin(12, 48, (LINES - 14) / 2 + 1, (COLS - 50) / 2 - 9);
    panel = new_panel(win);

    wattrset(bw, DLGBOXATTR);
    box(bw, ACS_VLINE, ACS_HLINE);

    wattrset(win, DLGTEXTATTR);
    tx_colorwin(win);
    tx_stdwinset(win);
    wtimeout(win, -1);

    mvwprintw(win, 1, 1, "Port numbers below 1024 are reserved for");
    mvwprintw(win, 2, 1, "TCP/IP services, and are normally the only");
    mvwprintw(win, 3, 1, "ones monitored by the TCP/UDP statistics");
    mvwprintw(win, 4, 1, "module.  If you wish to monitor a higher-");
    mvwprintw(win, 5, 1, "numbered port or range of ports, enter it");
    mvwprintw(win, 6, 1, "here.  Fill just the first field for a");
    mvwprintw(win, 7, 1, "single port, or both fields for a range.");

    wmove(win, 11, 1);
    tabkeyhelp(win);
    stdkeyhelp(win);

    tx_initfields(&list, 1, 20, (LINES - 14) / 2 + 10, (COLS - 50) / 2 - 8,
        DLGTEXTATTR, FIELDATTR);
    mvwprintw(list.fieldwin, 0, 6, "to");

    tx_addfield(&list, 5, 0, 0, "");
    tx_addfield(&list, 5, 0, 9, "");

    tx_fillfields(&list, aborted);

    if (!(*aborted)) {
	*port_min = atoi(list.list->buf);
	*port_max = atoi(list.list->nextfield->buf);
    }
    del_panel(bp);
    delwin(bw);
    del_panel(panel);
    delwin(win);
    tx_destroyfields(&list);
}

void saveportlist(struct porttab *table)
{
    struct porttab *ptmp = table;
    int fd;
    int bw;
    int resp;

    fd = open(PORTFILE, O_WRONLY | O_TRUNC | O_CREAT, S_IRUSR | S_IWUSR);

    if (fd < 0) {
	tx_errbox("Unable to open port list file", ANYKEY_MSG, &resp);
	return;
    }
    while (ptmp != NULL) {
	bw = write(fd, &(ptmp->port_min), sizeof(unsigned int));
	bw = write(fd, &(ptmp->port_max), sizeof(unsigned int));

	if (bw < 0) {
	    tx_errbox("Unable to write port/range entry", ANYKEY_MSG, &resp);
	    destroyporttab(table);
	    close(fd);
	    return;
	}
	ptmp = ptmp->next_entry;
    }

    close(fd);
}

int dup_portentry(struct porttab *table, unsigned int min,
		  unsigned int max)
{
    struct porttab *ptmp = table;

    while (ptmp != NULL) {
	if ((ptmp->port_min == min) && (ptmp->port_max == max))
	    return 1;

	ptmp = ptmp->next_entry;
    }

    return 0;
}

void addmoreports(struct porttab **table)
{
    unsigned int port_min, port_max;
    int aborted;
    int resp;
    struct porttab *ptmp;

    portdlg(&port_min, &port_max, &aborted, 0);

    if (!aborted) {
	if (dup_portentry(*table, port_min, port_max))
	    tx_errbox("Duplicate port/range entry", ANYKEY_MSG, &resp);
	else {
	    ptmp = malloc(sizeof(struct porttab));

	    ptmp->port_min = port_min;
	    ptmp->port_max = port_max;
	    ptmp->prev_entry = NULL;
	    ptmp->next_entry = *table;

	    if (*table != NULL)
		(*table)->prev_entry = ptmp;

	    *table = ptmp;
	    saveportlist(*table);
	}
    }
    update_panels();
    doupdate();
}

void loadaddports(struct porttab **table)
{
    int fd;
    struct porttab *ptemp;
    struct porttab *tail = NULL;
    int br;
    int resp;

    *table = NULL;

    fd = open(PORTFILE, O_RDONLY);
    if (fd < 0)
	return;

    do {
	ptemp = malloc(sizeof(struct porttab));

	br = read(fd, &(ptemp->port_min), sizeof(unsigned int));
	br = read(fd, &(ptemp->port_max), sizeof(unsigned int));

	if (br < 0) {
	    tx_errbox("Error reading port list", ANYKEY_MSG, &resp);
	    close(fd);
	    destroyporttab(*table);
	    return;
	}
	if (br > 0) {
	    if (*table == NULL) {
		*table = ptemp;
		ptemp->prev_entry = NULL;
	    }
	    if (tail != NULL) {
		tail->next_entry = ptemp;
		ptemp->prev_entry = tail;
	    }
	    tail = ptemp;
	    ptemp->next_entry = NULL;
	} else
	    free(ptemp);

    } while (br > 0);

    close(fd);
}

void displayportentry(struct porttab *ptmp, WINDOW * win)
{
    wprintw(win, "%u", ptmp->port_min);
    if (ptmp->port_max != 0)
	wprintw(win, " to %u", ptmp->port_max);
}

void displayports(struct porttab **table, WINDOW * win)
{
    struct porttab *ptmp = *table;
    short i = 0;

    do {
	wmove(win, i, 2);
	displayportentry(ptmp, win);

	i++;
	ptmp = ptmp->next_entry;
    } while ((i < 18) && (ptmp != NULL));

    update_panels();
    doupdate();
}

void operate_portselect(struct porttab **table, struct porttab **node,
			int *aborted)
{
    int ch = 0;
    struct scroll_list list;
    char listtext[20];

    tx_init_listbox(&list, 25, 22, (COLS - 25) / 2, (LINES - 22) / 2,
        STDATTR, BOXATTR, BARSTDATTR, HIGHATTR);

    tx_set_listbox_title(&list, "Select Port/Range", 1);
    
    *node = *table;    
    while (*node != NULL) {
        snprintf(listtext, 20, "%d to %d", (*node)->port_min, (*node)->port_max);
        tx_add_list_entry(&list, (char *) *node, listtext);
        *node = (*node)->next_entry;
    }
    
    tx_show_listbox(&list);
    tx_operate_listbox(&list, &ch, aborted);
    
    if (!(*aborted))
        *node = (struct porttab *) list.textptr->nodeptr;    

    tx_close_listbox(&list);
    tx_destroy_list(&list);
}

void selectport(struct porttab **table, struct porttab **node,
		int *aborted)
{
    int resp;
    
    if (*table == NULL) {
	tx_errbox("No custom ports", ANYKEY_MSG, &resp);
	return;
    }

    operate_portselect(table, node, aborted);
}

void delport(struct porttab **table, struct porttab *ptmp)
{
    if (ptmp != NULL) {
	if (ptmp == *table) {
	    *table = (*table)->next_entry;
	    if (*table != NULL)
		(*table)->prev_entry = NULL;
	} else {
	    ptmp->prev_entry->next_entry = ptmp->next_entry;

	    if (ptmp->next_entry != NULL)
		ptmp->next_entry->prev_entry = ptmp->prev_entry;
	}

	free(ptmp);
    }
}

void removeaport(struct porttab **table)
{
    unsigned int aborted;
    struct porttab *ptmp;

    selectport(table, &ptmp, &aborted);

    if (!aborted) {
	delport(table, ptmp);
	saveportlist(*table);
    }
}

void destroyporttab(struct porttab *table)
{
    struct porttab *ptemp = table;
    struct porttab *ctemp = NULL;

    if (ptemp != NULL)
	ctemp = ptemp->next_entry;

    while (ptemp != NULL) {
	free(ptemp);
	ptemp = ctemp;

	if (ctemp != NULL)
	    ctemp = ctemp->next_entry;
    }
}