gnutella.c

#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
#include <stdlib.h>
#include <stdio.h>
#include <sys/shm.h>
#include <string.h>
#include <errno.h>
#include "mapidflib.h"
#include "mapidlib.h"
#include "mapidevices.h"
#include "mapid.h"
#include "fhelp.h"
#include "debug.h"
#include "mapiipc.h"
#include "mstring.h"
#include <stdio.h>
#include <stdlib.h>
#include <netinet/in.h>
#include <net/ethernet.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>
#include <netinet/udp.h>
#include <unistd.h>
#include <string.h>
#include <errno.h>
#include <pthread.h>

#include <sys/types.h>
#include <sys/mman.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <sys/wait.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <sys/time.h>
#include <time.h>

#include "log.h"
#include "trackflib.h"

struct filters {
	int protocol;
	unsigned int saddr;
	unsigned int daddr;
	uint16_t sp;
	uint16_t dp;
	struct timeval ts;
	struct filters *next;
};

struct list{
	struct filters *head;
	struct filters *tail;
};

#define HASHTABLESIZE 1024
#define GNUTELLA_STRING_NO 4

char *gnutella_strings[GNUTELLA_STRING_NO]={"GET /uri-res/N2R?urn:sha1:","GNUTELLA CONNECT/","GNUTELLA/", "Server: LimeWire/"};//,"GET /get/"};

struct mapid_gnutella {
	int *shift[GNUTELLA_STRING_NO];
	int *skip[GNUTELLA_STRING_NO];
	struct list **gnulist;
};

int isGnutella(mapidflib_function_instance_t *,  unsigned char *, unsigned int );

static int gnutella_init(mapidflib_function_instance_t *instance, MAPI_UNUSED int fd)
{
	int i=0;

	instance->internal_data = malloc(sizeof(struct mapid_gnutella));
	((struct mapid_gnutella*)instance->internal_data)->gnulist = (struct list**)malloc(sizeof(struct list *)*HASHTABLESIZE);
	memset(((struct mapid_gnutella*)instance->internal_data)->gnulist, 0, (sizeof(struct list*)*HASHTABLESIZE));
	for(i = 0; i < HASHTABLESIZE; i ++) {
		((struct mapid_gnutella*)instance->internal_data)->gnulist[i] = (struct list*)malloc(sizeof(struct list));
		((struct mapid_gnutella*)instance->internal_data)->gnulist[i]->head = NULL;
		((struct mapid_gnutella*)instance->internal_data)->gnulist[i]->tail = NULL;
	}
	for(i=0;i<GNUTELLA_STRING_NO;i++) {
		((struct mapid_gnutella*)instance->internal_data)->shift[i] = make_shift(gnutella_strings[i],strlen(gnutella_strings[i]));
		((struct mapid_gnutella*)instance->internal_data)->skip[i] = make_skip(gnutella_strings[i], strlen(gnutella_strings[i]));
	}

	return 0;
}	

int isGnutella(mapidflib_function_instance_t *instance, unsigned char *pkt, unsigned int len)
{
	int i=0;
	
	for(i=0;i<GNUTELLA_STRING_NO;i++) {
		if(len < strlen(gnutella_strings[i]))
				continue;

		if(len < 100) {
			if(mSearch((char *)(pkt), len, gnutella_strings[i], strlen(gnutella_strings[i]),
				((struct mapid_gnutella *)instance->internal_data)->skip[i],
				((struct mapid_gnutella *)instance->internal_data)->shift[i])) {
				return i;
			}
		}
		else {
			if(mSearch((char *)(pkt), 100, gnutella_strings[i], strlen(gnutella_strings[i]),
				((struct mapid_gnutella *)instance->internal_data)->skip[i],
				((struct mapid_gnutella *)instance->internal_data)->shift[i])){
				return i;
			}
		}
	}
	return -1;

}

static int gnutella_process(mapidflib_function_instance_t *instance,
			MAPI_UNUSED  unsigned char* dev_pkt,
			 unsigned char* pkt,
			mapid_pkthdr_t* pkt_head)
{
	struct filters *temp = NULL, *prev = NULL, *new = NULL;
	int len = pkt_head->caplen;
	 unsigned char *p = NULL;
	struct timeval ts;

	struct list **gnulist = ((struct mapid_gnutella*)instance->internal_data)->gnulist;
	uint16_t ethertype;
	struct ether_header *ep = NULL;
	struct iphdr *iph = NULL;
	struct tcphdr *tcph = NULL;
	struct udphdr *udph = NULL;
	
	struct vlan_802q_header *vlan_header;

	unsigned int saddr, daddr;
	struct in_addr source, dest;

	uint16_t sp, dp;

	unsigned int hashval = 0;
	int i = 0;
	
	
	p = pkt;

	// lay the Ethernet header struct over the packet data
	ep = (struct ether_header *)p;

	// skip ethernet header
	p += sizeof(struct ether_header);
	len -= sizeof(struct ether_header);

	ethertype = ntohs(ep->ether_type);

	if(ethertype == ETHERTYPE_8021Q) {
		vlan_header = (struct vlan_802q_header*)p;
		ethertype = ntohs(vlan_header->ether_type);
		p += sizeof(struct vlan_802q_header);
	}
	
	if(ethertype != ETHERTYPE_IP) {
		return 0;
	}
	
	// IP header struct over the packet data;
	iph = (struct iphdr*)p;

	saddr = *((unsigned int *)&(iph->saddr));
	daddr = *((unsigned int *)&(iph->daddr));

	source.s_addr = (unsigned long int)iph->saddr;
	dest.s_addr = (unsigned long int)iph->daddr;

	hashval = (saddr + daddr) % HASHTABLESIZE;

	p += iph->ihl * 4;
	len -= iph->ihl * 4;

	if(iph->protocol == 6)	// TCP
	{
		tcph = (struct tcphdr *)p;
		
		sp = ntohs(tcph->source);
		dp = ntohs(tcph->dest);

		p += tcph->doff * 4;

		if((unsigned int)(p - pkt) == pkt_head->caplen) {
			return 0;
		}
		len -= tcph->doff * 4;
	}
	else if(iph->protocol == 17)	// UDP
	{
		udph = (struct udphdr *)p;

		sp = ntohs(udph->source);
		dp = ntohs(udph->dest);

		p += sizeof(struct udphdr);
		
		if((unsigned int)(p -pkt) == pkt_head->caplen) {
			return 0;
		}
		len -= sizeof(struct udphdr);
	}
	else
	{
		return 0;
	}

	gettimeofday(&ts, NULL);

	for(temp = gnulist[hashval]->head, prev = gnulist[hashval]->head; temp != NULL; prev = temp, temp = temp->next)
	{
		if(temp->protocol == iph->protocol &&
				(
				 (temp->saddr == saddr && temp->daddr == daddr && temp->sp == sp && temp->dp == dp)
				 ||
				 (temp->saddr == daddr && temp->daddr == saddr && temp->sp == dp && temp->dp == sp))
				)
		{
				gettimeofday(&(temp->ts), NULL);

				//printf("found same\n");
				if(iph->protocol == 6 && tcph->fin)	{
					if(temp == gnulist[hashval]->head) {
						gnulist[hashval]->head = temp->next;
						//printf("removing from list\n");
					}
					else {
						prev->next = temp->next;
					}
					temp->next = NULL;
					free(temp);
				}
					
			return 1;
		}
		
		if(ts.tv_sec - temp->ts.tv_sec > 60) {
			if(temp == gnulist[hashval]->head) {
				gnulist[hashval]->head = temp->next;
			}
			else {
				prev->next = temp->next;
			}
			temp->next = NULL;
			free(temp);
		}
	}

	if((i = isGnutella(instance,pkt,len)) >= 0)
	{
		//return 1;
		new = (struct filters*)malloc(sizeof(struct filters));
		if(new == NULL)
			printf("new = NULL\n");
		
		new->protocol = iph->protocol;
		new->saddr = saddr;
		new->daddr = daddr;
		new->sp = sp;
		new->dp = dp;

		write_to_log("GNUTELLA", gnutella_strings[i], iph->protocol, source, sp, dest, dp, pkt, len); 
/*	
		fprintf(fp, "%d---%s:%d -> ", new->protocol, inet_ntoa(source), sp);
		fprintf(fp, " %s:%d\t", inet_ntoa(dest), dp);
		for(i = 0; i < 100; i++) {
			fprintf(fp, "%c", p[i]);
		}
		fprintf(fp, "\n\n");

		//printf("on port %d -> %d\n", new->sp, new->dp);
*/
		for(temp = gnulist[hashval]->head; temp != NULL; temp = temp->next)
		{
			if(new->protocol == temp->protocol && (
					(new->saddr == temp->saddr && new->daddr == temp->daddr && new->sp == temp->sp && new->dp == temp->dp) 
					||
					(new->daddr == temp->saddr && new->saddr == temp->daddr && new->dp == temp->sp && new->sp == temp->dp)
					)
				)
			{
				//printf("exists do not enter\n");
				return 1;
			}
		}

		gettimeofday(&(new->ts), NULL);

		new->next = gnulist[hashval]->head;
		gnulist[hashval]->head = new;

		return 1;
	}

	return 0;
}

static int gnutella_cleanup(mapidflib_function_instance_t *instance) 
{
	struct filters *temp = NULL, *tmp = NULL;
	int i = 0;

  if(instance->internal_data != NULL){

	  for(i = 0; i < HASHTABLESIZE; i++) {
		  temp = ((struct mapid_gnutella*)instance->internal_data)->gnulist[i]->head;
		  
		  while(temp != NULL) {
			  tmp = temp;
			  temp = temp->next;
			  free(tmp);
		  }
	  }

	free(((struct mapid_gnutella*)instance->internal_data)->gnulist);
	free(instance->internal_data);
  }
  return 0;
}

static mapidflib_function_def_t finfo={
  "",
  "TRACK_GNUTELLA",
  "Searches for Gnutella packets\n",
  "",
  MAPI_DEVICE_ALL,
  MAPIRES_NONE,
  0, //shm size
  0, //modifies_pkts
  1, //filters packets
  MAPIOPT_NONE,
  NULL,
  gnutella_init,
  gnutella_process,
  NULL, //get_result
  NULL, //reset
  gnutella_cleanup,
  NULL, //client_init
  NULL, //client_read_result
  NULL  //client_cleanup
};

mapidflib_function_def_t* gnutella_get_funct_info();
mapidflib_function_def_t* gnutella_get_funct_info() {
  return &finfo;
};