@@ -50,120 +50,120 @@ static void exitCleanup() { #ifdef MYMALLOC _mdebug_dump(); #endif /* MYMALLOC */ - exit(0); + exit(0); } static void setupSignals(int refreshTime) { - sigset_t sigBlockSet; - struct sigaction saShutdown, saCleanup, saExpunge; - struct itimerval ival; - - sigemptyset(&sigBlockSet); - sigaddset(&sigBlockSet, SIGHUP); - if(sigprocmask(SIG_BLOCK, &sigBlockSet, NULL) < 0) { - perror("sigprocmask"); - exit(1); - } + sigset_t sigBlockSet; + struct sigaction saShutdown, saCleanup, saExpunge; + struct itimerval ival; + + sigemptyset(&sigBlockSet); + sigaddset(&sigBlockSet, SIGHUP); + if(sigprocmask(SIG_BLOCK, &sigBlockSet, NULL) < 0) { + perror("sigprocmask"); + exit(1); + } - saShutdown.sa_handler=signalShutdown; - saShutdown.sa_flags=0; - sigemptyset(&saShutdown.sa_mask); + saShutdown.sa_handler=signalShutdown; + saShutdown.sa_flags=0; + sigemptyset(&saShutdown.sa_mask); - if(sigaction(SIGINT, &saShutdown, NULL) < 0) { - perror("sigaction(INT)"); - exit(1); - } - if(sigaction(SIGTERM, &saShutdown, NULL) < 0) { - perror("sigaction(TERM)"); - exit(1); - } + if(sigaction(SIGINT, &saShutdown, NULL) < 0) { + perror("sigaction(INT)"); + exit(1); + } + if(sigaction(SIGTERM, &saShutdown, NULL) < 0) { + perror("sigaction(TERM)"); + exit(1); + } - saCleanup.sa_handler=signalCleanup; - saCleanup.sa_flags=0; - sigemptyset(&saCleanup.sa_mask); + saCleanup.sa_handler=signalCleanup; + saCleanup.sa_flags=0; + sigemptyset(&saCleanup.sa_mask); - if(sigaction(SIGALRM,&saCleanup, NULL) < 0) { - perror("sigaction(QUIT)"); - exit(1); - } + if(sigaction(SIGALRM,&saCleanup, NULL) < 0) { + perror("sigaction(QUIT)"); + exit(1); + } - saExpunge.sa_handler=signalExpunge; - saExpunge.sa_flags=0; - sigemptyset(&saExpunge.sa_mask); + saExpunge.sa_handler=signalExpunge; + saExpunge.sa_flags=0; + sigemptyset(&saExpunge.sa_mask); - if(sigaction(SIGQUIT, &saExpunge, NULL) < 0) { - perror("sigaction(QUIT)"); - exit(1); - } + if(sigaction(SIGQUIT, &saExpunge, NULL) < 0) { + perror("sigaction(QUIT)"); + exit(1); + } - ival.it_interval.tv_usec=0; - ival.it_value.tv_usec=0; - ival.it_interval.tv_sec=refreshTime; - ival.it_value.tv_sec=refreshTime; - if(setitimer(ITIMER_REAL, &ival, NULL) < 0) { - perror("setitimer"); - exit(1); - } + ival.it_interval.tv_usec=0; + ival.it_value.tv_usec=0; + ival.it_interval.tv_sec=refreshTime; + ival.it_value.tv_sec=refreshTime; + if(setitimer(ITIMER_REAL, &ival, NULL) < 0) { + perror("setitimer"); + exit(1); + } } static void openMisc() -{ - char misc_filename[FILENAME_MAXLEN]; - time_t now=0; - - now=time(NULL); - if(strftime(misc_filename, sizeof(misc_filename), - "%Y%m%d-%H%M%S_misc.pcap", localtime(&now)) >= sizeof(misc_filename)) { - fprintf(stderr, - "Warning: not enough space for full filename, using %s\n", - misc_filename); - } +{ + char misc_filename[FILENAME_MAXLEN]; + time_t now=0; + + now=time(NULL); + if(strftime(misc_filename, sizeof(misc_filename), + "%Y%m%d-%H%M%S_misc.pcap", localtime(&now)) >= sizeof(misc_filename)) { + fprintf(stderr, + "Warning: not enough space for full filename, using %s\n", + misc_filename); + } - assert(misc_packets == NULL); - misc_packets=pcap_dump_open(pcap_socket, misc_filename); + assert(misc_packets == NULL); + misc_packets=pcap_dump_open(pcap_socket, misc_filename); - if(misc_packets == NULL) { - fprintf(stderr, "Error opening dump file %s: %s\n", - misc_filename, pcap_geterr(pcap_socket)); - exit(1); - } else { - printf("+ Created %s\n", misc_filename); - } + if(misc_packets == NULL) { + fprintf(stderr, "Error opening dump file %s: %s\n", + misc_filename, pcap_geterr(pcap_socket)); + exit(1); + } else { + printf("+ Created %s\n", misc_filename); + } } static void expunge() { - printf("# Cleaning up open pcap files\n"); - hash_destroy(hash); - hash=hash_init(HASH_SIZE); - if(misc_packets != NULL) { - printf("# Closing misc_packets\n"); - pcap_dump_close(misc_packets); - misc_packets=NULL; - } - shouldExpunge=0; + printf("# Cleaning up open pcap files\n"); + hash_destroy(hash); + hash=hash_init(HASH_SIZE); + if(misc_packets != NULL) { + printf("# Closing misc_packets\n"); + pcap_dump_close(misc_packets); + misc_packets=NULL; + } + shouldExpunge=0; } void process(int flags, const char *intf, struct cleanupConfig conf, - const char *outdir, char *filter) + const char *outdir, char *filter) { - char errbuf[PCAP_ERRBUF_SIZE]; - struct bpf_program prog; - bpf_u_int32 netmask=0; - int flagdef; + char errbuf[PCAP_ERRBUF_SIZE]; + struct bpf_program prog; + bpf_u_int32 netmask=0; + int flagdef; - setupSignals(conf.refreshTime); + setupSignals(conf.refreshTime); - if (flags & FLAG_BIT(FLAG_PROMISC)) { - flagdef = 1; - } else { - flagdef = 0; - } + if (flags & FLAG_BIT(FLAG_PROMISC)) { + flagdef = 1; + } else { + flagdef = 0; + } if (intf[0] == '/') { pcap_socket = pcap_open_offline(intf, errbuf); @@ -171,143 +171,143 @@ process(int flags, const char *intf, struct cleanupConfig conf, pcap_socket = pcap_open_live(intf, 65535, flagdef, 1000, errbuf); } - if (pcap_socket == NULL) { - fprintf(stderr, "pcap_open_live: %s\n", errbuf); - exit(-1); - } - switch (pcap_datalink(pcap_socket)) { - case DLT_EN10MB: - dlt_len = 14; - break; - case DLT_SLIP: - dlt_len = 16; - break; - case DLT_PPP: - dlt_len = 4; - break; - case DLT_FDDI: - fprintf(stderr, "Sorry, can't do FDDI\n"); - exit(1); - break; - default: - dlt_len = 4; - } + if (pcap_socket == NULL) { + fprintf(stderr, "pcap_open_live: %s\n", errbuf); + exit(-1); + } + switch (pcap_datalink(pcap_socket)) { + case DLT_EN10MB: + dlt_len = 14; + break; + case DLT_SLIP: + dlt_len = 16; + break; + case DLT_PPP: + dlt_len = 4; + break; + case DLT_FDDI: + fprintf(stderr, "Sorry, can't do FDDI\n"); + exit(1); + break; + default: + dlt_len = 4; + } - if (pcap_compile(pcap_socket, &prog, filter, 1, netmask) < 0) { - fprintf(stderr, "pcap_compile: %s\n", pcap_geterr(pcap_socket)); - exit(1); - } - if (pcap_setfilter(pcap_socket, &prog) < 0) { - fprintf(stderr, "pcap_setfilter: %s\n", pcap_geterr(pcap_socket)); - exit(1); - } + if (pcap_compile(pcap_socket, &prog, filter, 1, netmask) < 0) { + fprintf(stderr, "pcap_compile: %s\n", pcap_geterr(pcap_socket)); + exit(1); + } + if (pcap_setfilter(pcap_socket, &prog) < 0) { + fprintf(stderr, "pcap_setfilter: %s\n", pcap_geterr(pcap_socket)); + exit(1); + } - hash=hash_init(HASH_SIZE); + hash=hash_init(HASH_SIZE); - fprintf(stderr, - "interface: %s, filter: ``%s'', %spromiscuous\n", - intf, filter, (flags & FLAG_BIT(FLAG_PROMISC)) ? "" : "NOT "); - fflush(stderr); + fprintf(stderr, + "interface: %s, filter: ``%s'', %spromiscuous\n", + intf, filter, (flags & FLAG_BIT(FLAG_PROMISC)) ? "" : "NOT "); + fflush(stderr); - if(chdir(outdir) < 0) { - perror("chdir"); - exit(1); - } + if(chdir(outdir) < 0) { + perror("chdir"); + exit(1); + } - while (!shuttingDown) { - int r = pcap_dispatch(pcap_socket, -1, (pcap_handler)filter_packet, NULL); + while (!shuttingDown) { + int r = pcap_dispatch(pcap_socket, -1, (pcap_handler)filter_packet, NULL); if (r < 1) { shuttingDown = 1; } - if(shouldExpunge) { - expunge(); - } - if(shouldCleanup) { - cleanup(flags & FLAG_BIT(FLAG_FLUSH), conf.maxAge); - } - } + if(shouldExpunge) { + expunge(); + } + if(shouldCleanup) { + cleanup(flags & FLAG_BIT(FLAG_FLUSH), conf.maxAge); + } + } - exitCleanup(); + exitCleanup(); } static void cleanup(int shouldFlush, int maxAge) { - static unsigned int last_pcount=0, last_dropcount=0, relative_counts=0; - struct pcap_stat stats; - struct hash_container *p; - int i=0, watched=0, cleaned=0, maxDepth=0, empty=0; - struct timeval now; + static unsigned int last_pcount=0, last_dropcount=0, relative_counts=0; + struct pcap_stat stats; + struct hash_container *p; + int i=0, watched=0, cleaned=0, maxDepth=0, empty=0; + struct timeval now; shouldCleanup = 0; - if(gettimeofday(&now, NULL) < 0) { - perror("gettimeofday"); - exit(1); - } + if(gettimeofday(&now, NULL) < 0) { + perror("gettimeofday"); + exit(1); + } - /* Look for anything old enough to get cleaned up */ - for(i=0; i<hash->hashsize; i++) { - p=hash->buckets[i]; - if(p) { - int ci=0, depth=0; - int toClose[1024]; - int closeOffset=0; - - for(; p; p=p->next) { - depth++; - maxDepth=depth > maxDepth ? depth : maxDepth; - #ifdef HAVE_PCAP_DUMP_FLUSH - if(shouldFlush) { - pcap_dump_flush(p->pcap_dumper); - } - #endif - watched++; - if(p->last_addition.tv_sec + maxAge < now.tv_sec) { - toClose[closeOffset++]=p->key; - assert(closeOffset < sizeof(toClose)); - } - } - - for(ci=0; ci<closeOffset; ci++) { - p=hash_find(hash, toClose[ci]); - assert(p != NULL); - printf("- Closing %s (too old)\n", p->filename); - p=NULL; /* Can't use this anymore */ - hash_delete(hash, toClose[ci]); - cleaned++; - } - } else { - empty++; - } - } + /* Look for anything old enough to get cleaned up */ + for(i=0; i<hash->hashsize; i++) { + p=hash->buckets[i]; + if(p) { + int ci=0, depth=0; + int toClose[1024]; + int closeOffset=0; + + for(; p; p=p->next) { + depth++; + maxDepth=depth > maxDepth ? depth : maxDepth; +#ifdef HAVE_PCAP_DUMP_FLUSH + if(shouldFlush) { + pcap_dump_flush(p->pcap_dumper); + } +#endif + watched++; + if(p->last_addition.tv_sec + maxAge < now.tv_sec) { + toClose[closeOffset++]=p->key; + assert(closeOffset < sizeof(toClose)); + } + } + + for(ci=0; ci<closeOffset; ci++) { + p=hash_find(hash, toClose[ci]); + assert(p != NULL); + printf("- Closing %s (too old)\n", p->filename); + p=NULL; /* Can't use this anymore */ + hash_delete(hash, toClose[ci]); + cleaned++; + } + } else { + empty++; + } + } - #ifdef HAVE_PCAP_DUMP_FLUSH - if(shouldFlush && misc_packets != NULL) { - pcap_dump_flush(misc_packets); - } - #endif - - if (pcap_stats(pcap_socket, &stats) == 0) { - int processed=stats.ps_recv-last_pcount; - int dropped=stats.ps_drop-last_dropcount; - if(relative_counts == 0 && (processed < 0 || dropped < 0)) { - printf("! pcap bug, counts went negative. Compensating\n"); - relative_counts=1; - } - if(relative_counts) { - processed=stats.ps_recv; - dropped=stats.ps_drop; - } - printf("# Processed %d pkts, dropped %d, watched %d, cleaned %d," - " max depth %d, empty %d\n", - processed, dropped, watched, cleaned, maxDepth, empty); - last_pcount=stats.ps_recv; - last_dropcount=stats.ps_drop; - } else { - printf("# Error getting pcap statistics: %s. watched=%d, cleaned=%d\n", - pcap_geterr(pcap_socket), watched, cleaned); - } +#ifdef HAVE_PCAP_DUMP_FLUSH + if(shouldFlush && misc_packets != NULL) { + pcap_dump_flush(misc_packets); + } +#endif + + if (pcap_stats(pcap_socket, &stats) == 0) { + int processed=stats.ps_recv-last_pcount; + int dropped=stats.ps_drop-last_dropcount; + if(relative_counts == 0 && (processed < 0 || dropped < 0)) { + printf("! pcap bug, counts went negative. Compensating\n"); + relative_counts=1; + } + if(relative_counts) { + processed=stats.ps_recv; + dropped=stats.ps_drop; + } + printf("# Processed %d pkts, dropped %d, watched %d, cleaned %d," + " max depth %d, empty %d\n", + processed, dropped, watched, cleaned, maxDepth, empty); + last_pcount=stats.ps_recv; + last_dropcount=stats.ps_drop; + } else { + printf("# Error getting pcap statistics: %s. watched=%d, cleaned=%d\n", + pcap_geterr(pcap_socket), watched, cleaned); + } } /* this is the function that's called when pcap reads a packet */ @@ -317,65 +317,65 @@ filter_packet(u_char * u, struct pcap_pkthdr * p, u_char * packet) #define IP_SIZE 20 #define TCP_SIZE 20 - struct ip *ip; - struct ether_header *eth; - - eth=(struct ether_header *)packet; - - if(ntohs(eth->ether_type) == ETHERTYPE_IP) { - /* p->len should never be smaller than the smallest possible packet */ - if (p->len < (dlt_len + IP_SIZE + TCP_SIZE)) { - fprintf(stderr, "! Skipping packet that's too small.\n"); - return; - } - - /* cast an ip pointer */ - ip = (struct ip *) (packet + dlt_len); - - hash_add(hash, pcap_socket, ntohl(ip->ip_src.s_addr), p, packet); - hash_add(hash, pcap_socket, ntohl(ip->ip_dst.s_addr), p, packet); - } else { - /* - printf("! Non-IP packet received (ether type 0x%x)\n", - ntohs(eth->ether_type)); - */ - if(misc_packets == NULL) { - openMisc(); - } - pcap_dump((u_char *)misc_packets, p, packet); - } + struct ip *ip; + struct ether_header *eth; + + eth=(struct ether_header *)packet; + + if(ntohs(eth->ether_type) == ETHERTYPE_IP) { + /* p->len should never be smaller than the smallest possible packet */ + if (p->len < (dlt_len + IP_SIZE + TCP_SIZE)) { + fprintf(stderr, "! Skipping packet that's too small.\n"); + return; + } + + /* cast an ip pointer */ + ip = (struct ip *) (packet + dlt_len); + + hash_add(hash, pcap_socket, ntohl(ip->ip_src.s_addr), p, packet); + hash_add(hash, pcap_socket, ntohl(ip->ip_dst.s_addr), p, packet); + } else { + /* + printf("! Non-IP packet received (ether type 0x%x)\n", + ntohs(eth->ether_type)); + */ + if(misc_packets == NULL) { + openMisc(); + } + pcap_dump((u_char *)misc_packets, p, packet); + } } char * ntoa(int a) { - static char ret[40]; - int written=0; + static char ret[40]; + int written=0; - written=snprintf(ret, sizeof(ret)-1, "%d.%d.%d.%d", - ((a & 0xff000000) >> 24), ((a & 0x00ff0000) >> 16), - ((a & 0x0000ff00) >> 8), (a & 0x000000ff)); + written=snprintf(ret, sizeof(ret)-1, "%d.%d.%d.%d", + ((a & 0xff000000) >> 24), ((a & 0x00ff0000) >> 16), + ((a & 0x0000ff00) >> 8), (a & 0x000000ff)); - assert(written < sizeof(ret)); + assert(written < sizeof(ret)); - return(ret); + return(ret); } /* shut down in a controlled way, close log file, close socket, and exit */ static void signalShutdown(int s) { - shuttingDown=1; + shuttingDown=1; } static void signalExpunge(int s) { - shouldExpunge=1; + shouldExpunge=1; } static void signalCleanup(int s) { - shouldCleanup=1; + shouldCleanup=1; } filter.c @@ -23,7 +23,7 @@ hash_init(int size) assert(size > 0); hash = calloc(1, sizeof(struct hashtable) - + (size * sizeof(struct hash_container *))); + + (size * sizeof(struct hash_container *))); assert(hash); hash->hashsize = size; @@ -50,17 +50,17 @@ hash_store(struct hashtable *hash, pcap_t *pcap_thing, unsigned int key) c->filename=calloc(1, FILENAME_MAXLEN); strftime(time_buf, sizeof(time_buf), "%Y%m%d-%H%M%S", localtime(&now)); if(snprintf(c->filename, FILENAME_MAXLEN, "%s_%s.pcap", - time_buf, ntoa(key)) >= FILENAME_MAXLEN) { + time_buf, ntoa(key)) >= FILENAME_MAXLEN) { fprintf(stderr, - "Warning: Not enough space for full filename, using %s\n", - c->filename); + "Warning: Not enough space for full filename, using %s\n", + c->filename); } assert(strlen(c->filename) < FILENAME_MAXLEN); c->pcap_dumper = pcap_dump_open(pcap_thing, c->filename); if(c->pcap_dumper == NULL) { fprintf(stderr, "Error opening dump file %s: %s\n", c->filename, - pcap_geterr(pcap_thing)); + pcap_geterr(pcap_thing)); exit(1); } if(gettimeofday(&c->last_addition, NULL) < 0) { @@ -79,7 +79,7 @@ hash_store(struct hashtable *hash, pcap_t *pcap_thing, unsigned int key) } struct hash_container *hash_add(struct hashtable *hash, pcap_t *pcap_thing, - unsigned int key, struct pcap_pkthdr *h, u_char *sp) + unsigned int key, struct pcap_pkthdr *h, u_char *sp) { struct hash_container *c; @@ -179,45 +179,45 @@ struct hash_keylist hash_keys(struct hashtable *hash) list.entries= (int *) malloc(size * sizeof(int)); assert(list.entries); -#define LAPPEND(a) if(list.nentries == size-1) { \ +#define LAPPEND(a) if(list.nentries == size-1) { \ list.entries=realloc(list.entries, (size<<=1)*sizeof(int)); \ - assert(list.entries); \ - } \ + assert(list.entries); \ + } \ list.entries[list.nentries++]=a; - for (i = 0; i < hash->hashsize; i++) { - p = hash->buckets[i]; - if (p) { - for (; p; p = p->next) { - LAPPEND(p->key); - } - } - } - return (list); + for (i = 0; i < hash->hashsize; i++) { + p = hash->buckets[i]; + if (p) { + for (; p; p = p->next) { + LAPPEND(p->key); + } + } + } + return (list); } /* debug stuff, dump the hash */ void _hash_dump(struct hashtable *hash) { - struct hash_container *p; - int i; + struct hash_container *p; + int i; - printf("Hash dump for hash at %p, size is %d:\n", hash, hash->hashsize); + printf("Hash dump for hash at %p, size is %d:\n", hash, hash->hashsize); - for (i = 0; i < hash->hashsize; i++) { - p = hash->buckets[i]; - if (p) { - printf("\tMatches at %d\n", i); - for (; p; p = p->next) { + for (i = 0; i < hash->hashsize; i++) { + p = hash->buckets[i]; + if (p) { + printf("\tMatches at %d\n", i); + for (; p; p = p->next) { #ifdef MYMALLOC - if (_lookup_mem(p) == NULL) { - printf("MEMORY IS INVALID!!! (%p)\n", p); - _mdebug_dump(); - } + if (_lookup_mem(p) == NULL) { + printf("MEMORY IS INVALID!!! (%p)\n", p); + _mdebug_dump(); + } #endif - printf("\t\t%s -> d=%p\n", ntoa(p->key), p->pcap_dumper); - } - } - } + printf("\t\t%s -> d=%p\n", ntoa(p->key), p->pcap_dumper); + } + } + } } hash.c @@ -11,28 +11,28 @@ #include <pcap.h> struct hash_container { - unsigned int key; - char *filename; - struct timeval last_addition; - pcap_dumper_t *pcap_dumper; - struct hash_container *next; + unsigned int key; + char *filename; + struct timeval last_addition; + pcap_dumper_t *pcap_dumper; + struct hash_container *next; }; struct hash_keylist { - int nentries; - int *entries; + int nentries; + int *entries; }; struct hashtable { - int hashsize; - struct hash_container *buckets[0]; + int hashsize; + struct hash_container *buckets[0]; }; struct hashtable *hash_init(int size); struct hash_container *hash_store(struct hashtable *hash, - pcap_t *pcap_thing, unsigned int key); + pcap_t *pcap_thing, unsigned int key); struct hash_container *hash_add(struct hashtable *hash, pcap_t *pcap_thing, - unsigned int key, struct pcap_pkthdr *h, u_char *sp); + unsigned int key, struct pcap_pkthdr *h, u_char *sp); struct hash_container *hash_find(struct hashtable *hash, unsigned int key); void hash_delete(struct hashtable *hash, unsigned int key); void hash_destroy(struct hashtable *hash); hash.h @@ -9,7 +9,7 @@ #include <ctype.h> #include <assert.h> /* -#include <getopt.h> + #include <getopt.h> */ #include "mymalloc.h" #include "multisniff.h" @@ -18,17 +18,17 @@ void usage(char *name) { fprintf(stderr, "Usage: %s -i <intf> " - #ifdef HAVE_PCAP_DUMP_FLUSH - "[-f] " - #endif - "[-p] [-d <outdir>] " - "[-m seconds] [-c seconds] [-F <filterfile>] [<filter>]\n", - name); +#ifdef HAVE_PCAP_DUMP_FLUSH + "[-f] " +#endif + "[-p] [-d <outdir>] " + "[-m seconds] [-c seconds] [-F <filterfile>] [<filter>]\n", + name); fprintf(stderr, " -i specifies the interface to sniff (required).\n"); fprintf(stderr, " -d specifies the output directory.\n"); - #ifdef HAVE_PCAP_DUMP_FLUSH - fprintf(stderr, " -F get a filter from a file.\n"); - #endif +#ifdef HAVE_PCAP_DUMP_FLUSH + fprintf(stderr, " -F get a filter from a file.\n"); +#endif fprintf(stderr, " -f flush pcap files on each cleanup run.\n"); fprintf(stderr, " -p turns on promiscious sniffing.\n"); fprintf(stderr, " -m maximum age before closing file [60s].\n"); @@ -112,34 +112,34 @@ main(int argc, char **argv) } } - if (optind >= argc) { - if(filter == NULL) { - filter = ""; - } - } else { - int i=0; - int size=0; - for(i=optind; i<argc; i++) { - size+=strlen(argv[i]); - size+=1; - } - size+=1; - filter=calloc(1, size); - assert(filter); - for(i=optind; i<argc; i++) { - strcat(filter, argv[i]); - strcat(filter, " "); - assert(strlen(filter) < size); - } - /* Trim the trailing space */ - assert(filter[strlen(filter)-1] == ' '); - filter[strlen(filter)-1]=0x00; - } + if (optind >= argc) { + if(filter == NULL) { + filter = ""; + } + } else { + int i=0; + int size=0; + for(i=optind; i<argc; i++) { + size+=strlen(argv[i]); + size+=1; + } + size+=1; + filter=calloc(1, size); + assert(filter); + for(i=optind; i<argc; i++) { + strcat(filter, argv[i]); + strcat(filter, " "); + assert(strlen(filter) < size); + } + /* Trim the trailing space */ + assert(filter[strlen(filter)-1] == ' '); + filter[strlen(filter)-1]=0x00; + } - if (intf == NULL) { - fprintf(stderr, "Must supply an interface\n"); - usage(argv[0]); - } - process(flags, intf, conf, outdir, filter); - return (0); + if (intf == NULL) { + fprintf(stderr, "Must supply an interface\n"); + usage(argv[0]); + } + process(flags, intf, conf, outdir, filter); + return (0); } main.c @@ -5,7 +5,7 @@ #ifndef MULTISNIFF_H #define MULTISNIFF_H 1 -#define FLAG_BIT(a) (1<<a) +#define FLAG_BIT(a) (1<<a) #define FLAG_PROMISC 0 #define FLAG_FLUSH 1 @@ -19,20 +19,20 @@ #define HASH_SIZE 637 struct cleanupConfig { - int maxAge; - int refreshTime; + int maxAge; + int refreshTime; }; void process(int flags, const char *intf, - struct cleanupConfig conf, const char *outdir, char *filter); + struct cleanupConfig conf, const char *outdir, char *filter); char *ntoa(int); /* This stuff was basically stolen from tcpdump */ #define ETHER_ADDR_LEN 6 struct ether_header { - u_int8_t ether_dhost[ETHER_ADDR_LEN]; - u_int8_t ether_shost[ETHER_ADDR_LEN]; - u_int16_t ether_type; + u_int8_t ether_dhost[ETHER_ADDR_LEN]; + u_int8_t ether_shost[ETHER_ADDR_LEN]; + u_int16_t ether_type; }; /* We primarily care about IP. Everything else goes into a common bucket */ multisniff.h @@ -15,202 +15,202 @@ #ifdef MYMALLOC static struct memories { - char *p; - size_t size; - struct memories *next; - char *file; - int line; + char *p; + size_t size; + struct memories *next; + char *file; + int line; } **memories = NULL; static int *_mem_stats = NULL; void _mdebug_dump(void); -static int +static int _getmemindex(void *p) { - return ((int) p % NUM_MEMBUCKETS); + return ((int) p % NUM_MEMBUCKETS); } -static void +static void _register_mem(void *p, size_t size, char *file, int line) { - struct memories *m, *c; - int index; - - assert(p); - m = malloc(sizeof(struct memories)); - assert(m); - m->p = p; - m->size = size; - m->next = NULL; - m->file = file; - m->line = line; - - if (memories == NULL) { - memories = calloc(NUM_MEMBUCKETS, sizeof(struct memories *)); - assert(memories); - _mem_stats = calloc(NUM_MEMBUCKETS, sizeof(int)); - assert(_mem_stats); - } - index = _getmemindex(p); - - /* Gather statistics */ - _mem_stats[index]++; - - c = memories[index]; - - if (c == NULL) { - memories[index] = m; - } else { - for (; c->next != NULL; c = c->next); - c->next = m; - } + struct memories *m, *c; + int index; + + assert(p); + m = malloc(sizeof(struct memories)); + assert(m); + m->p = p; + m->size = size; + m->next = NULL; + m->file = file; + m->line = line; + + if (memories == NULL) { + memories = calloc(NUM_MEMBUCKETS, sizeof(struct memories *)); + assert(memories); + _mem_stats = calloc(NUM_MEMBUCKETS, sizeof(int)); + assert(_mem_stats); + } + index = _getmemindex(p); + + /* Gather statistics */ + _mem_stats[index]++; + + c = memories[index]; + + if (c == NULL) { + memories[index] = m; + } else { + for (; c->next != NULL; c = c->next); + c->next = m; + } } void * _lookup_mem(void *p) { - struct memories *c; - int index; - index = _getmemindex(p); - for (c = memories[index]; c && c->p != p; c = c->next); - return (c); + struct memories *c; + int index; + index = _getmemindex(p); + for (c = memories[index]; c && c->p != p; c = c->next); + return (c); } -static void +static void _unregister_mem(void *p) { - struct memories *c, *tmp; - int index; - - index = _getmemindex(p); - - /* Special case for first thingy */ - if (memories[index]->p == p) { - if (memories[index]->next) { - tmp = memories[index]->next; - free(memories[index]); - memories[index] = tmp; - } else { - free(memories[index]); - memories[index] = NULL; - } - } else { - for (c = memories[index]; c && c->next->p != p; c = c->next); - assert(c); - tmp = c->next; - c->next = c->next->next; - free(tmp); - } + struct memories *c, *tmp; + int index; + + index = _getmemindex(p); + + /* Special case for first thingy */ + if (memories[index]->p == p) { + if (memories[index]->next) { + tmp = memories[index]->next; + free(memories[index]); + memories[index] = tmp; + } else { + free(memories[index]); + memories[index] = NULL; + } + } else { + for (c = memories[index]; c && c->next->p != p; c = c->next); + assert(c); + tmp = c->next; + c->next = c->next->next; + free(tmp); + } } -void +void _mdebug_dump(void) { - struct memories *c; - int i, count = 0, min, max, avg, empty; - - for (i = 0; i < NUM_MEMBUCKETS; i++) { - for (c = memories[i]; c; c = c->next) { - printf("Found memory at %d (%p)\n", i, (void *) c); - count++; - printf("MEM: %p is %d bytes (%p)\n", (void *) c->p, (int)c->size, - (void *) c->p); - printf("\t%s line %d\n", c->file, c->line); - } - } - - if (count == 0) - printf("No registered memory\n"); - - max = 0; - min = INT_MAX; - avg = 0; - empty = 0; - for (i = 0; i < NUM_MEMBUCKETS; i++) { - if (_mem_stats[i] == 0) - empty++; - if (_mem_stats[i] > max) - max = _mem_stats[i]; - if (_mem_stats[i] < min) - min = _mem_stats[i]; - avg += _mem_stats[i]; - } - - printf("Hash size was %d buckets\n" - "Highest: %d\n" - "Lowest: %d\n" - "Average: %d\n" - "Empty: %d\n", - NUM_MEMBUCKETS, max, min, avg / NUM_MEMBUCKETS, empty); + struct memories *c; + int i, count = 0, min, max, avg, empty; + + for (i = 0; i < NUM_MEMBUCKETS; i++) { + for (c = memories[i]; c; c = c->next) { + printf("Found memory at %d (%p)\n", i, (void *) c); + count++; + printf("MEM: %p is %d bytes (%p)\n", (void *) c->p, (int)c->size, + (void *) c->p); + printf("\t%s line %d\n", c->file, c->line); + } + } + + if (count == 0) + printf("No registered memory\n"); + + max = 0; + min = INT_MAX; + avg = 0; + empty = 0; + for (i = 0; i < NUM_MEMBUCKETS; i++) { + if (_mem_stats[i] == 0) + empty++; + if (_mem_stats[i] > max) + max = _mem_stats[i]; + if (_mem_stats[i] < min) + min = _mem_stats[i]; + avg += _mem_stats[i]; + } + + printf("Hash size was %d buckets\n" + "Highest: %d\n" + "Lowest: %d\n" + "Average: %d\n" + "Empty: %d\n", + NUM_MEMBUCKETS, max, min, avg / NUM_MEMBUCKETS, empty); } -void +void _mdebug_long_stats(void) { - int i; - for (i = 0; i < NUM_MEMBUCKETS; i++) { - if (_mem_stats[i] > 0) - printf("MEM: %d got %d hits\n", i, _mem_stats[i]); - } + int i; + for (i = 0; i < NUM_MEMBUCKETS; i++) { + if (_mem_stats[i] > 0) + printf("MEM: %d got %d hits\n", i, _mem_stats[i]); + } } void * _my_malloc(size_t size, char *file, int line) { - void *p; - p = malloc(size); - assert(p); - _register_mem(p, size, file, line); - return (p); + void *p; + p = malloc(size); + assert(p); + _register_mem(p, size, file, line); + return (p); } void * _my_calloc(size_t n, size_t size, char *file, int line) { - void *p; - p = calloc(n, size); - assert(p); - _register_mem(p, size * n, file, line); - return (p); + void *p; + p = calloc(n, size); + assert(p); + _register_mem(p, size * n, file, line); + return (p); } char * _my_strdup(char *str, char *file, int line) { - char *p; - p = strdup(str); - _register_mem(p, strlen(p), file, line); - return (p); + char *p; + p = strdup(str); + _register_mem(p, strlen(p), file, line); + return (p); } void * _my_realloc(void *p, size_t size, char *file, int line) { - void *ret; - assert(_lookup_mem(p)); - _unregister_mem(p); - ret = realloc(p, size); - assert(ret); - _register_mem(ret, size, file, line); - return (ret); + void *ret; + assert(_lookup_mem(p)); + _unregister_mem(p); + ret = realloc(p, size); + assert(ret); + _register_mem(ret, size, file, line); + return (ret); } -void +void _my_free(void *p, char *file, int line) { - void *tmp; - tmp = _lookup_mem(p); - if (tmp == NULL) { - printf("Trying to free something that isn't mine: %p (%s) (%s:%d)\n", - p, (char *) p, - file, line); - _mdebug_dump(); - abort(); - } - _unregister_mem(p); - free(p); + void *tmp; + tmp = _lookup_mem(p); + if (tmp == NULL) { + printf("Trying to free something that isn't mine: %p (%s) (%s:%d)\n", + p, (char *) p, + file, line); + _mdebug_dump(); + abort(); + } + _unregister_mem(p); + free(p); } #endif /* MYMALLOC */ mymalloc.c d91114c401c2ed4ad5b22997a8c7ddb29cefb2aa Dustin Sallings dustin@spy.net http://github.com/dustin/multisniff/commit/387ec4672be35c938898683f910a18b5d38b9738 387ec4672be35c938898683f910a18b5d38b9738 2009-04-16T08:39:46-07:00 2009-04-16T08:39:46-07:00 Reformatted code. 787a8dcd91dc50482914276058c83b51ed75fed1 Dustin Sallings dustin@spy.net