diff -urN ngrep-1.45/ipreasm.c ngrep-1.45-reasm/ipreasm.c
--- ngrep-1.45/ipreasm.c 1970-01-01 01:00:00.000000000 +0100
+++ ngrep-1.45-reasm/ipreasm.c 2007-06-16 19:17:20.124795623 +0200
@@ -0,0 +1,717 @@
+/*
+ * ipreasm -- Routines for reassembly of fragmented IPv4 and IPv6 packets.
+ *
+ * Copyright (c) 2007 Jan Andres <jandres@gmx.net>
+ *
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stddef.h>
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif /* HAVE_CONFIG_H */
+
+#include <netinet/ip.h>
+#include <netinet/udp.h>
+#if USE_IPv6
+#include <netinet/ip6.h>
+#endif /* USE_IPv6 */
+
+#include "ipreasm.h"
+
+
+#define REASM_IP_HASH_SIZE 1021U
+
+
+enum entry_state {
+ STATE_ACTIVE,
+ STATE_INVALID,
+};
+
+
+enum reasm_proto {
+ PROTO_IPV4,
+#if USE_IPv6
+ PROTO_IPV6,
+#endif /* USE_IPv6 */
+};
+
+
+/*
+ * This tuple uniquely identifies all fragments belonging to
+ * the same IPv4 packet.
+ */
+struct reasm_id_ipv4 {
+ uint8_t ip_src[4], ip_dst[4];
+ uint16_t ip_id;
+ uint8_t ip_proto;
+};
+
+
+/*
+ * Same for IPv6.
+ */
+struct reasm_id_ipv6 {
+ uint8_t ip_src[16], ip_dst[16];
+ uint32_t ip_id;
+};
+
+
+union reasm_id {
+ struct reasm_id_ipv4 ipv4;
+ struct reasm_id_ipv6 ipv6;
+};
+
+
+struct reasm_frag_entry {
+ unsigned len; /* payload length of this fragment */
+ unsigned offset; /* offset of this fragment into the payload of the reassembled packet */
+ unsigned data_offset; /* offset to the data pointer where payload starts */
+ unsigned char *data; /* payload starts at data + data_offset */
+ struct reasm_frag_entry *next;
+};
+
+
+/*
+ * Reception of a complete packet is detected by counting the number
+ * of "holes" that remain between the cached fragments. A hole is
+ * assumed to exist at the upper end of the packet until the final
+ * fragment has been received. When the number of holes drops to 0,
+ * all fragments have been received and the packet can be reassembled.
+ */
+struct reasm_ip_entry {
+ union reasm_id id;
+ unsigned len, holes, frag_count, hash;
+ reasm_time_t timeout;
+ enum entry_state state;
+ enum reasm_proto protocol;
+ struct reasm_frag_entry *frags;
+ struct reasm_ip_entry *prev, *next;
+ struct reasm_ip_entry *time_prev, *time_next;
+};
+
+
+/*
+ * This struct contains some metadata, the main hash table, and a pointer
+ * to the first entry that will time out. A linked list is kept in the
+ * order in which packets will time out. Using a linked list for this
+ * purpose requires that packets are input in chronological order, and
+ * that a constant timeout value is used, which doesn't change even when
+ * the entry's state transitions from active to invalid.
+ */
+struct reasm_ip {
+ struct reasm_ip_entry *table[REASM_IP_HASH_SIZE];
+ struct reasm_ip_entry *time_first, *time_last;
+ unsigned waiting, max_waiting, timed_out, dropped_frags;
+ reasm_time_t timeout;
+};
+
+
+/*
+ * Hash functions.
+ */
+static unsigned reasm_ipv4_hash (const struct reasm_id_ipv4 *id);
+#if USE_IPv6
+static unsigned reasm_ipv6_hash (const struct reasm_id_ipv6 *id);
+#endif /* USE_IPv6 */
+
+/*
+ * Insert a new fragment to the correct position in the list of fragments.
+ * Check for fragment overlap and other error conditions. Update the
+ * "hole count".
+ */
+static bool add_fragment (struct reasm_ip_entry *entry, struct reasm_frag_entry *frag, bool last_frag);
+
+/*
+ * Is the entry complete, ready for reassembly?
+ */
+static bool is_complete (struct reasm_ip_entry *entry);
+
+/*
+ * Create the reassembled packet.
+ */
+static unsigned char *assemble (struct reasm_ip_entry *entry, unsigned *output_len);
+
+/*
+ * Drop and free entries.
+ */
+static void drop_entry (struct reasm_ip *reasm, struct reasm_ip_entry *entry);
+static void free_entry (struct reasm_ip_entry *entry);
+
+/*
+ * Dispose of any entries which have expired before "now".
+ */
+static void process_timeouts (struct reasm_ip *reasm, reasm_time_t now);
+
+/*
+ * Create fragment structure from IPv6 packet. Returns NULL if the input
+ * is not a fragment.
+ * This function is called by parse_packet(), don't call it directly.
+ */
+#if USE_IPv6
+static struct reasm_frag_entry *frag_from_ipv6 (unsigned char *packet, uint32_t *ip_id, bool *last_frag);
+#endif /* USE_IPv6 */
+
+/*
+ * Compare packet identification tuples for specified protocol.
+ */
+static bool reasm_id_equal (enum reasm_proto proto, const union reasm_id *left, const union reasm_id *right);
+
+/*
+ * Create fragment structure from an IPv4 or IPv6 packet. Returns NULL
+ * if the input is not a fragment.
+ */
+static struct reasm_frag_entry *parse_packet (unsigned char *packet, unsigned len, enum reasm_proto *protocol, union reasm_id *id, unsigned *hash, bool *last_frag);
+
+
+static unsigned
+reasm_ipv4_hash (const struct reasm_id_ipv4 *id)
+{
+ unsigned hash = 0;
+ int i;
+
+ for (i = 0; i < 4; i++) {
+ hash = 37U * hash + id->ip_src[i];
+ hash = 37U * hash + id->ip_dst[i];
+ }
+
+ hash = 59U * hash + id->ip_id;
+
+ hash = 47U * hash + id->ip_proto;
+
+ return hash;
+}
+
+
+#if USE_IPv6
+static unsigned
+reasm_ipv6_hash (const struct reasm_id_ipv6 *id)
+{
+ unsigned hash = 0;
+ int i;
+
+ for (i = 0; i < 16; i++) {
+ hash = 37U * hash + id->ip_src[i];
+ hash = 37U * hash + id->ip_dst[i];
+ }
+
+ hash = 59U * hash + id->ip_id;
+
+ return hash;
+}
+#endif /* USE_IPv6 */
+
+
+unsigned char *
+reasm_ip_next (struct reasm_ip *reasm, unsigned char *packet, unsigned len, reasm_time_t timestamp, unsigned *output_len)
+{
+ enum reasm_proto proto;
+ union reasm_id id;
+ unsigned hash;
+ bool last_frag;
+
+ process_timeouts (reasm, timestamp);
+
+ struct reasm_frag_entry *frag = parse_packet (packet, len, &proto, &id, &hash, &last_frag);
+ if (frag == NULL) {
+ *output_len = len;
+ return packet; /* some packet that we don't recognize as a fragment */
+ }
+
+ hash %= REASM_IP_HASH_SIZE;
+ struct reasm_ip_entry *entry = reasm->table[hash];
+ while (entry != NULL && (proto != entry->protocol || !reasm_id_equal (proto, &id, &entry->id)))
+ entry = entry->next;
+
+ if (entry == NULL) {
+ entry = malloc (sizeof (*entry));
+ if (entry == NULL) {
+ free (frag);
+ abort ();
+ }
+
+ struct reasm_frag_entry *list_head = malloc (sizeof (*list_head));
+ if (list_head == NULL) {
+ free (frag);
+ free (entry);
+ abort ();
+ }
+
+ *entry = (struct reasm_ip_entry) {
+ .id = id,
+ .len = 0,
+ .holes = 1,
+ .frags = list_head,
+ .hash = hash,
+ .protocol = proto,
+ .timeout = timestamp + reasm->timeout,
+ .state = STATE_ACTIVE,
+ .prev = NULL,
+ .next = reasm->table[hash],
+ .time_prev = reasm->time_last,
+ .time_next = NULL,
+ };
+
+ *list_head = (struct reasm_frag_entry) {
+ .len = 0,
+ .offset = 0,
+ .data_offset = 0,
+ .data = NULL,
+ };
+
+ if (entry->next != NULL)
+ entry->next->prev = entry;
+ reasm->table[hash] = entry;
+
+ if (reasm->time_last != NULL)
+ reasm->time_last->time_next = entry;
+ else
+ reasm->time_first = entry;
+ reasm->time_last = entry;
+
+ reasm->waiting++;
+ if (reasm->waiting > reasm->max_waiting)
+ reasm->max_waiting = reasm->waiting;
+ }
+
+ if (entry->state != STATE_ACTIVE) {
+ reasm->dropped_frags++;
+ return NULL;
+ }
+
+ if (!add_fragment (entry, frag, last_frag)) {
+ entry->state = STATE_INVALID;
+ reasm->dropped_frags += entry->frag_count + 1;
+ return NULL;
+ }
+
+ if (!is_complete (entry))
+ return NULL;
+
+ unsigned char *r = assemble (entry, output_len);
+ drop_entry (reasm, entry);
+ return r;
+}
+
+
+static bool
+add_fragment (struct reasm_ip_entry *entry, struct reasm_frag_entry *frag, bool last_frag)
+{
+ /*
+ * When a fragment is inserted into the list, different cases can occur
+ * concerning the number of holes.
+ * - The new fragment can be inserted in the middle of a hole, such that
+ * it will split the hole in two. The number of holes increases by 1.
+ * - The new fragment can be attached to one end of a hole, such that
+ * the rest of the hole remains at the opposite side of the fragment.
+ * The number of holes remains constant.
+ * - The new fragment can fill a hole completely. The number of holes
+ * decreases by 1.
+ */
+
+ /*
+ * If more fragments follow and the payload size is not an integer
+ * multiple of 8, the packet will never be reassembled completely.
+ */
+ if (!last_frag && (frag->len & 7) != 0)
+ return false;
+
+ if (entry->len != 0 && frag->len + frag->offset > entry->len)
+ return false; /* fragment extends past end of packet */
+
+ bool fit_left = false, fit_right = false;
+
+ if (last_frag) {
+ if (entry->len != 0) {
+ fprintf (stderr, "* ERROR: Multiple final fragments.\n");
+ return false;
+ }
+ entry->len = frag->offset + frag->len;
+ fit_right = true;
+ }
+
+ struct reasm_frag_entry *cur = entry->frags, *next = cur->next;
+
+ while (cur->next != NULL && cur->next->offset <= frag->offset)
+ cur = cur->next;
+ next = cur->next;
+
+ /* Fragment is to be inserted between cur and next; next may be NULL. */
+
+ /* Overlap checks. */
+ if (cur->offset + cur->len > frag->offset)
+ return false; /* overlaps with cur */
+ else if (cur->offset + cur->len == frag->offset)
+ fit_left = true;
+
+ if (next != NULL) {
+ if (last_frag)
+ return false; /* next extends past end of packet */
+ if (frag->offset + frag->len > next->offset)
+ return false; /* overlaps with next */
+ else if (frag->offset + frag->len == next->offset)
+ fit_right = true;
+ }
+
+ /*
+ * Everything's fine, insert it.
+ */
+ if (frag->len != 0) {
+ frag->next = cur->next;
+ cur->next = frag;
+
+ if (fit_left && fit_right)
+ entry->holes--;
+ else if (!fit_left && !fit_right)
+ entry->holes++;
+
+ entry->frag_count++;
+ } else {
+ /*
+ * If the fragment has zero size, we don't insert it into the list,
+ * but one case remains to be handled: If the zero-size fragment
+ * is the last fragment, and fits exactly with the fragment to its
+ * left, the number of holes decreases.
+ */
+ if (last_frag && fit_left)
+ entry->holes--;
+ }
+
+
+ return true;
+}
+
+
+struct reasm_ip *
+reasm_ip_new (void)
+{
+ struct reasm_ip *reasm = malloc (sizeof (*reasm));
+ if (reasm == NULL)
+ return NULL;
+
+ memset (reasm, 0, sizeof (*reasm));
+ return reasm;
+}
+
+
+void
+reasm_ip_free (struct reasm_ip *reasm)
+{
+ while (reasm->time_first != NULL)
+ drop_entry (reasm, reasm->time_first);
+ free (reasm);
+}
+
+
+static bool
+is_complete (struct reasm_ip_entry *entry)
+{
+ return entry->holes == 0;
+}
+
+
+static unsigned char *
+assemble (struct reasm_ip_entry *entry, unsigned *output_len)
+{
+ struct reasm_frag_entry *frag = entry->frags->next; /* skip list head */
+ unsigned offset0 = frag->data_offset;
+ unsigned char *p = malloc (entry->len + offset0);
+ if (p == NULL)
+ abort ();
+
+ switch (entry->protocol) {
+ case PROTO_IPV4:
+ break;
+
+#if USE_IPv6
+ case PROTO_IPV6:
+ offset0 -= 8; /* size of frag header */
+ break;
+#endif /* USE_IPv6 */
+
+ default:
+ abort ();
+ }
+
+ *output_len = entry->len + offset0;
+
+ /* copy the (unfragmentable) header from the first fragment received */
+ memcpy (p, frag->data, offset0);
+
+ /* join all the payload fragments together */
+ while (frag != NULL) {
+ memcpy (p + offset0 + frag->offset, frag->data + frag->data_offset, frag->len);
+ frag = frag->next;
+ }
+
+ /* some cleanups, e.g. update the length field of reassembled packet */
+ switch (entry->protocol) {
+ case PROTO_IPV4: {
+ struct ip *ip_header = (struct ip *) p;
+ ip_header->ip_len = htons (offset0 + entry->len);
+ ip_header->ip_off = 0;
+ // XXX recompute the checksum
+ break;
+ }
+
+#if USE_IPv6
+ case PROTO_IPV6: {
+ struct ip6_hdr *ip6_header = (struct ip6_hdr *) p;
+ ip6_header->ip6_plen = htons (offset0 + entry->len - 40);
+ break;
+ }
+#endif /* USE_IPv6 */
+
+ default:
+ abort ();
+ }
+
+ return p;
+}
+
+
+static void
+drop_entry (struct reasm_ip *reasm, struct reasm_ip_entry *entry)
+{
+ if (entry->prev != NULL)
+ entry->prev->next = entry->next;
+ else
+ reasm->table[entry->hash] = entry->next;
+
+ if (entry->next != NULL)
+ entry->next->prev = entry->prev;
+
+ if (entry->time_prev != NULL)
+ entry->time_prev->time_next = entry->time_next;
+ else
+ reasm->time_first = entry->time_next;
+
+ if (entry->time_next != NULL)
+ entry->time_next->time_prev = entry->time_prev;
+ else
+ reasm->time_last = entry->time_prev;
+
+ reasm->waiting--;
+
+ free_entry (entry);
+}
+
+
+static void
+free_entry (struct reasm_ip_entry *entry)
+{
+ struct reasm_frag_entry *frag = entry->frags, *next;
+ while (frag != NULL) {
+ next = frag->next;
+ if (frag->data != NULL)
+ free (frag->data);
+ free (frag);
+ frag = next;
+ }
+
+ free (entry);
+}
+
+
+unsigned
+reasm_ip_waiting (const struct reasm_ip *reasm)
+{
+ return reasm->waiting;
+}
+
+
+unsigned
+reasm_ip_max_waiting (const struct reasm_ip *reasm)
+{
+ return reasm->max_waiting;
+}
+
+
+unsigned
+reasm_ip_timed_out (const struct reasm_ip *reasm)
+{
+ return reasm->timed_out;
+}
+
+
+unsigned
+reasm_ip_dropped_frags (const struct reasm_ip *reasm)
+{
+ return reasm->dropped_frags;
+}
+
+
+bool
+reasm_ip_set_timeout (struct reasm_ip *reasm, reasm_time_t timeout)
+{
+ if (reasm->time_first != NULL)
+ return false;
+
+ reasm->timeout = timeout;
+ return true;
+}
+
+
+static void
+process_timeouts (struct reasm_ip *reasm, reasm_time_t now)
+{
+ while (reasm->time_first != NULL && reasm->time_first->timeout < now) {
+ reasm->timed_out++;
+ drop_entry (reasm, reasm->time_first);
+ }
+}
+
+
+#if USE_IPv6
+static struct reasm_frag_entry *
+frag_from_ipv6 (unsigned char *packet, uint32_t *ip_id, bool *last_frag)
+{
+ struct ip6_hdr *ip6_header = (struct ip6_hdr *) packet;
+ unsigned offset = 40; /* IPv6 header size */
+ uint8_t nxt = ip6_header->ip6_nxt;
+ unsigned total_len = 40 + ntohs (ip6_header->ip6_plen);
+ unsigned last_nxt = offsetof (struct ip6_hdr, ip6_nxt);
+
+ /*
+ * IPv6 extension headers from RFC 2460:
+ * 0 Hop-by-Hop Options
+ * 43 Routing
+ * 44 Fragment
+ * 60 Destination Options
+ *
+ * We look out for the Fragment header; the other 3 header
+ * types listed above are recognized and considered safe to
+ * skip over if they occur before the Fragment header.
+ * Any unrecognized header will cause processing to stop and
+ * a subsequent Fragment header to stay unrecognized.
+ */
+ while (nxt == IPPROTO_HOPOPTS || nxt == IPPROTO_ROUTING || nxt == IPPROTO_DSTOPTS) {
+ if (offset + 2 > total_len)
+ return NULL; /* header extends past end of packet */
+
+ unsigned exthdr_len = 8 + 8 * packet[offset + 1];
+ if (offset + exthdr_len > total_len)
+ return NULL; /* header extends past end of packet */
+
+ nxt = packet[offset];
+ last_nxt = offset;
+ offset += exthdr_len;
+ }
+
+ if (nxt != IPPROTO_FRAGMENT)
+ return NULL;
+
+ if (offset + 8 > total_len)
+ return NULL; /* Fragment header extends past end of packet */
+
+ struct reasm_frag_entry *frag = malloc (sizeof (*frag));
+ if (frag == NULL)
+ abort ();
+
+ struct ip6_frag *frag_header = (struct ip6_frag *) (packet + offset);
+ offset += 8;
+
+ /*
+ * The Fragment header will be removed on reassembly, so we have to
+ * replace the Next Header field of the previous header (which is
+ * currently IPPROTO_FRAGMENT), with the Next Header field of the
+ * Fragment header.
+ *
+ * XXX We really shouldn't manipulate the input packet in-place.
+ */
+ packet[last_nxt] = frag_header->ip6f_nxt;
+
+ *frag = (struct reasm_frag_entry) {
+ .len = total_len - offset,
+ .data_offset = offset,
+ .offset = ntohs (frag_header->ip6f_offlg & IP6F_OFF_MASK),
+ .data = packet,
+ };
+
+ *ip_id = ntohl (frag_header->ip6f_ident);
+ *last_frag = (frag_header->ip6f_offlg & IP6F_MORE_FRAG) == 0;
+
+ return frag;
+}
+#endif /* USE_IPv6 */
+
+
+static bool
+reasm_id_equal (enum reasm_proto proto, const union reasm_id *left, const union reasm_id *right)
+{
+ switch (proto) {
+ case PROTO_IPV4:
+ return memcmp (left->ipv4.ip_src, right->ipv4.ip_src, 4) == 0
+ && memcmp (left->ipv4.ip_dst, right->ipv4.ip_dst, 4) == 0
+ && left->ipv4.ip_id == right->ipv4.ip_id
+ && left->ipv4.ip_proto == right->ipv4.ip_proto;
+#if USE_IPv6
+ case PROTO_IPV6:
+ return memcmp (left->ipv6.ip_src, right->ipv6.ip_src, 16) == 0
+ && memcmp (left->ipv6.ip_dst, right->ipv6.ip_dst, 16) == 0
+ && left->ipv6.ip_id == right->ipv6.ip_id;
+#endif /* USE_IPv6 */
+ default:
+ abort ();
+ }
+}
+
+
+static struct reasm_frag_entry *
+parse_packet (unsigned char *packet, unsigned len, enum reasm_proto *protocol, union reasm_id *id, unsigned *hash, bool *last_frag)
+{
+ struct ip *ip_header = (struct ip *) packet;
+ struct reasm_frag_entry *frag = NULL;
+
+ switch (ip_header->ip_v) {
+ case 4: {
+ *protocol = PROTO_IPV4;
+ uint16_t offset = ntohs (ip_header->ip_off);
+ if (len >= ntohs (ip_header->ip_len) && (offset & (IP_MF | IP_OFFMASK)) != 0) {
+ frag = malloc (sizeof (*frag));
+ if (frag == NULL)
+ abort ();
+
+ *frag = (struct reasm_frag_entry) {
+ .len = ntohs (ip_header->ip_len) - ip_header->ip_hl * 4,
+ .offset = (offset & IP_OFFMASK) * 8,
+ .data_offset = ip_header->ip_hl * 4,
+ .data = packet,
+ };
+
+ *last_frag = (offset & IP_MF) == 0;
+
+ memcpy (id->ipv4.ip_src, &ip_header->ip_src, 4);
+ memcpy (id->ipv4.ip_dst, &ip_header->ip_dst, 4);
+ id->ipv4.ip_id = ntohs (ip_header->ip_id);
+ id->ipv4.ip_proto = ip_header->ip_p;
+
+ *hash = reasm_ipv4_hash (&id->ipv4);
+ }
+ break;
+ }
+
+#if USE_IPv6
+ case 6: {
+ struct ip6_hdr *ip6_header = (struct ip6_hdr *) packet;
+ *protocol = PROTO_IPV6;
+ if (len >= ntohs (ip6_header->ip6_plen) + 40)
+ frag = frag_from_ipv6 (packet, &id->ipv6.ip_id, last_frag);
+ if (frag != NULL) {
+ memcpy (id->ipv6.ip_src, &ip6_header->ip6_src, 16);
+ memcpy (id->ipv6.ip_dst, &ip6_header->ip6_dst, 16);
+ *hash = reasm_ipv6_hash (&id->ipv6);
+ }
+ break;
+ }
+#endif /* USE_IPv6 */
+
+ default:
+ break;
+ }
+
+ return frag;
+}
diff -urN ngrep-1.45/ipreasm.h ngrep-1.45-reasm/ipreasm.h
--- ngrep-1.45/ipreasm.h 1970-01-01 01:00:00.000000000 +0100
+++ ngrep-1.45-reasm/ipreasm.h 2007-06-16 19:17:20.124795623 +0200
@@ -0,0 +1,57 @@
+#ifndef _IPREASM_H
+#define _IPREASM_H
+
+#include <stdbool.h>
+
+#include <pcap.h>
+
+
+/*
+ * This is an abstract time stamp. ipreasm doesn't care whether it is
+ * in seconds, milliseconds, or nanodecades. All it does it add the
+ * configured timeout value to it, and then compare it to the timstamps
+ * of subsequent packets to decide whether a fragment has expired.
+ */
+typedef uint64_t reasm_time_t;
+
+struct reasm_ip;
+
+/*
+ * Functions to create and destroy the reassembly environment.
+ */
+struct reasm_ip *reasm_ip_new (void);
+void reasm_ip_free (struct reasm_ip *reasm);
+
+/*
+ * This is the main packet processing function. It inputs one packet,
+ * and MAY output one packet in turn. If the input was not a fragment,
+ * it is passed unmodified. If the input was a fragment that completed
+ * reassembly of a packet, the reassembled packet is output.
+ * If more fragments are required for reassembly, or the input packet
+ * is invalid for some reason, a NULL pointer is returned.
+ *
+ * The input must be a pointer allocated by malloc(). The output will
+ * be a pointer allocated by malloc().
+ *
+ * Note that in the case of an IPv6 fragment, the input buffer will be
+ * modified in-place. This is considered a bug and should be fixed in
+ * the future.
+ */
+unsigned char *reasm_ip_next (struct reasm_ip *reasm, unsigned char *packet, unsigned len, reasm_time_t timestamp, unsigned *output_len);
+
+/*
+ * Set the timeout after which a noncompleted reassembly expires, in
+ * abstract time units (see above for the definition of reasm_time_t).
+ */
+bool reasm_ip_set_timeout (struct reasm_ip *reasm, reasm_time_t timeout);
+
+/*
+ * Query certain information about the current state.
+ */
+unsigned reasm_ip_waiting (const struct reasm_ip *reasm);
+unsigned reasm_ip_max_waiting (const struct reasm_ip *reasm);
+unsigned reasm_ip_timed_out (const struct reasm_ip *reasm);
+unsigned reasm_ip_dropped_frags (const struct reasm_ip *reasm);
+
+
+#endif /* _IPREASM_H */
diff -urN ngrep-1.45/Makefile.in ngrep-1.45-reasm/Makefile.in
--- ngrep-1.45/Makefile.in 2006-11-28 14:35:37.000000000 +0100
+++ ngrep-1.45-reasm/Makefile.in 2007-06-16 15:41:22.859876074 +0200
@@ -15,8 +15,8 @@
STRIPFLAG=@STRIPFLAG@
-SRC=ngrep.c
-OBJS=ngrep.o
+SRC=ngrep.c ipreasm.c
+OBJS=ngrep.o ipreasm.o
TARGET=ngrep
MANPAGE=ngrep.8
@@ -65,7 +65,7 @@
$(REGEX_OBJS): $(REGEX_OBJS:.o=.c) $(REGEX_DIR)/*.h
$(MAKE) $(MAKEFLAGS) -C $(REGEX_DIR) $(notdir $(REGEX_OBJS))
-$(OBJS): Makefile ngrep.c ngrep.h
+$(OBJS): Makefile ngrep.c ngrep.h ipreasm.c ipreasm.h
tardist:
@( VERSION=`perl -ne '/VERSION\s+"(.*)"/ && print "$$1\n"' ngrep.h` ; \
diff -urN ngrep-1.45/ngrep.c ngrep-1.45-reasm/ngrep.c
--- ngrep-1.45/ngrep.c 2006-11-28 14:38:43.000000000 +0100
+++ ngrep-1.45-reasm/ngrep.c 2007-06-16 21:41:43.142117150 +0200
@@ -98,6 +98,7 @@
#endif
#include "ngrep.h"
+#include "ipreasm.h"
static char rcsver[] = "$Revision: 1.93 $";
@@ -156,7 +157,7 @@
uint8_t link_offset;
uint8_t radiotap_present = 0;
-pcap_t *pd = NULL;
+pcap_t *pd = NULL, *pd_dumppcap = NULL;
pcap_dumper_t *pd_dump = NULL;
struct bpf_program pcapfilter;
struct in_addr net, mask;
@@ -183,6 +184,12 @@
uint32_t ws_row, ws_col = 80, ws_col_forced = 0;
+/*
+ * Reassembly
+ */
+struct reasm_ip *reasm = NULL;
+
+
int main(int argc, char **argv) {
int32_t c;
@@ -195,7 +202,7 @@
signal(SIGWINCH, update_windowsize);
#endif
- while ((c = getopt(argc, argv, "LNhXViwqpevxlDtTRMs:n:c:d:A:I:O:S:P:F:W:")) != EOF) {
+ while ((c = getopt(argc, argv, "LNhXViwqpevxlDtTrRMs:n:c:d:A:I:O:S:P:F:W:")) != EOF) {
switch (c) {
case 'W': {
if (!strcasecmp(optarg, "normal"))
@@ -260,6 +267,10 @@
case 'M':
re_multiline_match = 0;
break;
+ case 'r':
+ reasm = reasm_ip_new ();
+ reasm_ip_set_timeout (reasm, 30000000);
+ break;
case 'R':
dont_dropprivs = 1;
break;
@@ -585,7 +596,15 @@
}
if (dump_file) {
- if (!(pd_dump = pcap_dump_open(pd, dump_file))) {
+ if (reasm != NULL) {
+ if (!(pd_dumppcap = pcap_open_dead(DLT_RAW, 65535))) {
+ fprintf(stderr, "fatal: pcap_open_dead failed\n");
+ clean_exit(-1);
+ }
+ pd_dump = pcap_dump_open(pd_dumppcap, dump_file);
+ } else
+ pd_dump = pcap_dump_open(pd, dump_file);
+ if (!pd_dump) {
fprintf(stderr, "fatal: %s\n", pcap_geterr(pd));
clean_exit(-1);
} else printf("output: %s\n", dump_file);
@@ -641,6 +660,23 @@
}
#endif
+ if (reasm != NULL) {
+ unsigned new_len;
+ u_char *new_p = malloc(len - link_offset);
+ memcpy(new_p, ip4_pkt, len - link_offset);
+ p = reasm_ip_next(reasm, new_p, len - link_offset, (reasm_time_t) 1000000UL * h->ts.tv_sec + h->ts.tv_usec, &new_len);
+ if (p == NULL)
+ return;
+ len = new_len + link_offset;
+ h->len = new_len;
+ h->caplen = new_len;
+
+ ip4_pkt = (struct ip *) p;
+#if USE_IPv6
+ ip6_pkt = (struct ip6_hdr*)p;
+#endif
+ }
+
ip_ver = ip4_pkt->ip_v;
switch (ip_ver) {
@@ -802,6 +838,9 @@
if (match_after && keep_matching)
keep_matching--;
+
+ if (reasm != NULL)
+ free(p);
}
void dump_packet(struct pcap_pkthdr *h, u_char *p, uint8_t proto, unsigned char *data, uint32_t len,
@@ -1242,6 +1281,7 @@
" -s is set the bpf caplen\n"
" -S is set the limitlen on matched packets\n"
" -W is set the dump format (normal, byline, single, none)\n"
+ " -r is reassemble any fragmented IPV4 or IPV6 packets\n"
" -c is force the column width to the specified size\n"
" -P is set the non-printable display char to what is specified\n"
" -F is read the bpf filter from the specified file\n"
@@ -1292,8 +1331,9 @@
&& pd && !pcap_stats(pd, &s))
printf("%u received, %u dropped\n", s.ps_recv, s.ps_drop);
- if (pd) pcap_close(pd);
- if (pd_dump) pcap_dump_close(pd_dump);
+ if (pd) pcap_close(pd);
+ if (pd_dumppcap) pcap_close(pd_dumppcap);
+ if (pd_dump) pcap_dump_close(pd_dump);
#if defined(_WIN32)
if (delay_socket) closesocket(delay_socket);
@@ -1301,6 +1341,9 @@
if (usedev) free(usedev);
#endif
+ if (reasm != NULL)
+ reasm_ip_free(reasm);
+
exit(sig);
}
|
