2 * Routines for network object lookup
6 * Laurent Deniel <laurent.deniel@free.fr>
8 * Ethereal - Network traffic analyzer
9 * By Gerald Combs <gerald@ethereal.com>
10 * Copyright 1998 Gerald Combs
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation; either version 2
15 * of the License, or (at your option) any later version.
17 * This program is distributed in the hope that it will be useful,
18 * but WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 * GNU General Public License for more details.
22 * You should have received a copy of the GNU General Public License
23 * along with this program; if not, write to the Free Software
24 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
37 * Win32 doesn't have SIGALRM.
39 * Mac OS X does, but if you longjmp() out of a name resolution call in
40 * a signal handler, you might crash, because the state of the resolution
41 * code that sends messages to lookupd might be inconsistent if you jump
42 * out of it in middle of a call.
44 * There's no guarantee that longjmp()ing out of name resolution calls
45 * will work on *any* platform; OpenBSD got rid of the alarm/longjmp
46 * code in tcpdump, to avoid those sorts of problems, and that was
47 * picked up by tcpdump.org tcpdump.
49 #if !defined(_WIN32) && !defined(__APPLE__)
50 #ifndef AVOID_DNS_TIMEOUT
51 #define AVOID_DNS_TIMEOUT
59 #ifdef HAVE_NETINET_IN_H
60 # include <netinet/in.h>
67 #ifdef HAVE_ARPA_INET_H
68 #include <arpa/inet.h>
73 #ifdef HAVE_SYS_SOCKET_H
74 #include <sys/socket.h> /* needed to define AF_ values on UNIX */
77 #ifdef HAVE_WINSOCK2_H
78 #include <winsock2.h> /* needed to define AF_ values on Windows */
81 #ifdef AVOID_DNS_TIMEOUT
85 #ifdef NEED_INET_ATON_H
86 # include "inet_aton.h"
89 #ifdef NEED_INET_V6DEFS_H
90 # include "inet_v6defs.h"
98 #if defined(_WIN32) && defined(INET6)
99 # include <ws2tcpip.h>
103 #include "ipv6-utils.h"
104 #include "addr_resolv.h"
105 #include "filesystem.h"
106 #include <epan/prefs.h>
108 #define ENAME_ETHERS "ethers"
109 #define ENAME_IPXNETS "ipxnets"
110 #define ENAME_MANUF "manuf"
112 #define MAXMANUFLEN 9 /* max vendor name length with ending '\0' */
113 #define HASHETHSIZE 1024
114 #define HASHHOSTSIZE 1024
115 #define HASHIPXNETSIZE 256
116 #define HASHMANUFSIZE 256
117 #define HASHPORTSIZE 256
119 /* hash table used for host and port lookup */
121 #define HASH_IPV4_ADDRESS(addr) ((addr) & (HASHHOSTSIZE - 1))
123 #define HASH_PORT(port) ((port) & (HASHPORTSIZE - 1))
125 typedef struct hashname {
127 gchar name[MAXNAMELEN];
128 gboolean is_dummy_entry; /* name is IP address in dot format */
129 struct hashname *next;
132 /* hash table used for IPX network lookup */
134 /* XXX - check goodness of hash function */
136 #define HASH_IPX_NET(net) ((net) & (HASHIPXNETSIZE - 1))
138 typedef struct hashname hashipxnet_t;
140 /* hash tables used for ethernet and manufacturer lookup */
142 #define HASH_ETH_ADDRESS(addr) \
143 (((((addr)[2] << 8) | (addr)[3]) ^ (((addr)[4] << 8) | (addr)[5])) & \
146 #define HASH_ETH_MANUF(addr) (((int)(addr)[2]) & (HASHMANUFSIZE - 1))
148 typedef struct hashmanuf {
150 char name[MAXMANUFLEN];
151 struct hashmanuf *next;
154 typedef struct hashether {
156 char name[MAXNAMELEN];
157 gboolean is_dummy_entry; /* not a complete entry */
158 struct hashether *next;
161 /* internal ethernet type */
163 typedef struct _ether
166 char name[MAXNAMELEN];
169 /* internal ipxnet type */
171 typedef struct _ipxnet
174 char name[MAXNAMELEN];
177 static hashname_t *host_table[HASHHOSTSIZE];
178 static hashname_t *udp_port_table[HASHPORTSIZE];
179 static hashname_t *tcp_port_table[HASHPORTSIZE];
180 static hashname_t *sctp_port_table[HASHPORTSIZE];
181 static hashether_t *eth_table[HASHETHSIZE];
182 static hashmanuf_t *manuf_table[HASHMANUFSIZE];
183 static hashether_t *(*wka_table[48])[HASHETHSIZE];
184 static hashipxnet_t *ipxnet_table[HASHIPXNETSIZE];
186 static int eth_resolution_initialized = 0;
187 static int ipxnet_resolution_initialized = 0;
189 static hashether_t *add_eth_name(const guint8 *addr, const gchar *name);
192 * Flag controlling what names to resolve.
194 guint32 g_resolv_flags;
197 * Global variables (can be changed in GUI sections)
198 * XXX - they could be changed in GUI code, but there's currently no
199 * GUI code to change them.
202 gchar *g_ethers_path = NULL; /* global ethers file */
203 gchar *g_pethers_path = NULL; /* personal ethers file */
204 gchar *g_ipxnets_path = NULL; /* global ipxnets file */
205 gchar *g_pipxnets_path = NULL; /* personal ipxnets file */
206 /* first resolving call */
214 int adns_currently_queued = 0;
216 typedef struct _adns_queue_msg
220 struct e_in6_addr ip6_addr;
225 GList *adns_queue_head = NULL;
227 #endif /* HAVE_GNU_ADNS */
230 * Local function definitions
233 static gchar *serv_name_lookup(guint port, port_type proto)
238 char *serv_proto = NULL;
239 struct servent *servp;
243 table = udp_port_table;
247 table = tcp_port_table;
251 table = sctp_port_table;
255 /* not yet implemented */
261 hash_idx = HASH_PORT(port);
262 tp = table[hash_idx];
265 tp = table[hash_idx] = (hashname_t *)g_malloc(sizeof(hashname_t));
268 if( tp->addr == port ) {
271 if (tp->next == NULL) {
272 tp->next = (hashname_t *)g_malloc(sizeof(hashname_t));
280 /* fill in a new entry */
284 if (!(g_resolv_flags & RESOLV_TRANSPORT) ||
285 (servp = getservbyport(g_htons(port), serv_proto)) == NULL) {
287 sprintf(tp->name, "%d", port);
289 strncpy(tp->name, servp->s_name, MAXNAMELEN);
290 tp->name[MAXNAMELEN-1] = '\0';
295 } /* serv_name_lookup */
298 #ifdef AVOID_DNS_TIMEOUT
300 #define DNS_TIMEOUT 2 /* max sec per call */
302 jmp_buf hostname_env;
304 static void abort_network_query(int sig _U_)
306 longjmp(hostname_env, 1);
308 #endif /* AVOID_DNS_TIMEOUT */
310 static gchar *host_name_lookup(guint addr, gboolean *found)
313 hashname_t * volatile tp;
314 struct hostent *hostp;
316 adns_queue_msg_t *qmsg;
321 hash_idx = HASH_IPV4_ADDRESS(addr);
323 tp = host_table[hash_idx];
326 tp = host_table[hash_idx] = (hashname_t *)g_malloc(sizeof(hashname_t));
329 if( tp->addr == addr ) {
330 if (tp->is_dummy_entry)
334 if (tp->next == NULL) {
335 tp->next = (hashname_t *)g_malloc(sizeof(hashname_t));
343 /* fill in a new entry */
348 if ((g_resolv_flags & RESOLV_CONCURRENT) &&
349 prefs.name_resolve_concurrency > 0) {
350 qmsg = g_malloc(sizeof(adns_queue_msg_t));
351 qmsg->type = AF_INET;
352 qmsg->ip4_addr = addr;
353 qmsg->submitted = FALSE;
354 adns_queue_head = g_list_append(adns_queue_head, (gpointer) qmsg);
356 tp->is_dummy_entry = TRUE;
357 ip_to_str_buf((guint8 *)&addr, tp->name);
360 #endif /* HAVE_GNU_ADNS */
363 * The Windows "gethostbyaddr()" insists on translating 0.0.0.0 to
364 * the name of the host on which it's running; to work around that
365 * botch, we don't try to translate an all-zero IP address to a host
368 if (addr != 0 && (g_resolv_flags & RESOLV_NETWORK)) {
369 /* Use async DNS if possible, else fall back to timeouts,
370 * else call gethostbyaddr and hope for the best
373 # ifdef AVOID_DNS_TIMEOUT
375 /* Quick hack to avoid DNS/YP timeout */
377 if (!setjmp(hostname_env)) {
378 signal(SIGALRM, abort_network_query);
380 # endif /* AVOID_DNS_TIMEOUT */
382 hostp = gethostbyaddr((char *)&addr, 4, AF_INET);
384 # ifdef AVOID_DNS_TIMEOUT
386 # endif /* AVOID_DNS_TIMEOUT */
389 strncpy(tp->name, hostp->h_name, MAXNAMELEN);
390 tp->name[MAXNAMELEN-1] = '\0';
391 tp->is_dummy_entry = FALSE;
395 # ifdef AVOID_DNS_TIMEOUT
397 # endif /* AVOID_DNS_TIMEOUT */
401 /* unknown host or DNS timeout */
403 ip_to_str_buf((guint8 *)&addr, tp->name);
404 tp->is_dummy_entry = TRUE;
409 } /* host_name_lookup */
411 static gchar *host_name_lookup6(struct e_in6_addr *addr, gboolean *found)
413 static gchar name[MAXNAMELEN];
415 struct hostent *hostp;
417 if (g_resolv_flags & RESOLV_NETWORK) {
418 #ifdef AVOID_DNS_TIMEOUT
420 /* Quick hack to avoid DNS/YP timeout */
422 if (!setjmp(hostname_env)) {
423 signal(SIGALRM, abort_network_query);
425 #endif /* AVOID_DNS_TIMEOUT */
426 hostp = gethostbyaddr((char *)addr, sizeof(*addr), AF_INET6);
427 #ifdef AVOID_DNS_TIMEOUT
431 strncpy(name, hostp->h_name, MAXNAMELEN);
432 name[MAXNAMELEN-1] = '\0';
436 #ifdef AVOID_DNS_TIMEOUT
441 /* unknown host or DNS timeout */
444 ip6_to_str_buf(addr, name);
449 * Miscellaneous functions
452 static int fgetline(char **buf, int *size, FILE *fp)
464 if ((*buf = g_malloc(*size)) == NULL)
472 while ((c = getc(fp)) != EOF && c != '\n') {
473 if (len+1 >= *size) {
474 if ((*buf = g_realloc(*buf, *size += BUFSIZ)) == NULL)
480 if (len == 0 && c == EOF)
491 * Ethernet / manufacturer resolution
493 * The following functions implement ethernet address resolution and
494 * ethers files parsing (see ethers(4)).
496 * The manuf file has the same format as ethers(4) except that names are
497 * truncated to MAXMANUFLEN-1 characters and that an address contains
498 * only 3 bytes (instead of 6).
502 * I decide to not use the existing functions (see ethers(3) on some
503 * operating systems) for the following reasons:
504 * - performance gains (use of hash tables and some other enhancements),
505 * - use of two ethers files (system-wide and per user),
506 * - avoid the use of NIS maps,
507 * - lack of these functions on some systems.
509 * So the following functions do _not_ behave as the standard ones.
516 * If "manuf_file" is FALSE, parse a 6-byte MAC address.
517 * If "manuf_file" is TRUE, parse an up-to-6-byte sequence with an optional
521 parse_ether_address(const char *cp, ether_t *eth, unsigned int *mask,
529 for (i = 0; i < 6; i++) {
530 /* Get a hex number, 1 or 2 digits, no sign characters allowed. */
531 if (!isxdigit((unsigned char)*cp))
533 num = strtoul(cp, &p, 16);
535 return FALSE; /* failed */
537 return FALSE; /* not a valid octet */
538 eth->addr[i] = (guint8) num;
539 cp = p; /* skip past the number */
541 /* OK, what character terminated the octet? */
543 /* "/" - this has a mask. */
545 /* Entries with masks are allowed only in the "manuf" files. */
548 cp++; /* skip past the '/' to get to the mask */
549 if (!isdigit((unsigned char)*cp))
550 return FALSE; /* no sign allowed */
551 num = strtoul(cp, &p, 10);
553 return FALSE; /* failed */
554 cp = p; /* skip past the number */
555 if (*cp != '\0' && !isspace((unsigned char)*cp))
556 return FALSE; /* bogus terminator */
557 if (num == 0 || num >= 48)
558 return FALSE; /* bogus mask */
559 /* Mask out the bits not covered by the mask */
561 for (i = 0; num >= 8; i++, num -= 8)
562 ; /* skip octets entirely covered by the mask */
563 /* Mask out the first masked octet */
564 eth->addr[i] &= (0xFF << (8 - num));
566 /* Mask out completely-masked-out octets */
572 /* We're at the end of the address, and there's no mask. */
574 /* We got 3 bytes, so this is a manufacturer ID. */
576 /* Manufacturer IDs are only allowed in the "manuf"
580 /* Indicate that this is a manufacturer ID (0 is not allowed
587 /* We got 6 bytes, so this is a MAC address.
588 If we're reading one of the "manuf" files, indicate that
589 this is a MAC address (48 is not allowed as a mask). */
595 /* We didn't get 3 or 6 bytes, and there's no mask; this is
600 /* We don't know the separator used in this number; it can either
601 be ':', '-', or '.'. */
602 if (*cp != ':' && *cp != '-' && *cp != '.')
604 sep = *cp; /* subsequent separators must be the same */
606 /* It has to be the same as the first separator */
617 static int parse_ether_line(char *line, ether_t *eth, unsigned int *mask,
621 * See man ethers(4) for ethers file format
622 * (not available on all systems).
623 * We allow both ethernet address separators (':' and '-'),
624 * as well as Ethereal's '.' separator.
629 if ((cp = strchr(line, '#')))
632 if ((cp = strtok(line, " \t\n")) == NULL)
635 if (!parse_ether_address(cp, eth, mask, manuf_file))
638 if ((cp = strtok(NULL, " \t\n")) == NULL)
641 strncpy(eth->name, cp, MAXNAMELEN);
642 eth->name[MAXNAMELEN-1] = '\0';
646 } /* parse_ether_line */
648 static FILE *eth_p = NULL;
650 static void set_ethent(char *path)
655 eth_p = fopen(path, "r");
658 static void end_ethent(void)
666 static ether_t *get_ethent(unsigned int *mask, gboolean manuf_file)
671 static char *buf = NULL;
676 while (fgetline(&buf, &size, eth_p) >= 0) {
677 if (parse_ether_line(buf, ð, mask, manuf_file) == 0) {
686 static ether_t *get_ethbyname(const gchar *name)
690 set_ethent(g_ethers_path);
692 while ((eth = get_ethent(NULL, FALSE)) && strncmp(name, eth->name, MAXNAMELEN) != 0)
698 set_ethent(g_pethers_path);
700 while ((eth = get_ethent(NULL, FALSE)) && strncmp(name, eth->name, MAXNAMELEN) != 0)
708 } /* get_ethbyname */
710 static ether_t *get_ethbyaddr(const guint8 *addr)
715 set_ethent(g_ethers_path);
717 while ((eth = get_ethent(NULL, FALSE)) && memcmp(addr, eth->addr, 6) != 0)
723 set_ethent(g_pethers_path);
725 while ((eth = get_ethent(NULL, FALSE)) && memcmp(addr, eth->addr, 6) != 0)
733 } /* get_ethbyaddr */
735 static int hash_eth_wka(const guint8 *addr, unsigned int mask)
738 /* All but the topmost byte is masked out */
739 return (addr[0] & (0xFF << (8 - mask))) & (HASHETHSIZE - 1);
743 /* All but the topmost 2 bytes are masked out */
744 return ((addr[0] << 8) | (addr[1] & (0xFF << (8 - mask)))) &
749 /* All but the topmost 3 bytes are masked out */
750 return ((addr[0] << 16) | (addr[1] << 8) | (addr[2] & (0xFF << (8 - mask))))
755 /* All but the topmost 4 bytes are masked out */
756 return ((((addr[0] << 8) | addr[1]) ^
757 ((addr[2] << 8) | (addr[3] & (0xFF << (8 - mask)))))) &
762 /* All but the topmost 5 bytes are masked out */
763 return ((((addr[1] << 8) | addr[2]) ^
764 ((addr[3] << 8) | (addr[4] & (0xFF << (8 - mask)))))) &
768 /* No bytes are fully masked out */
769 return ((((addr[1] << 8) | addr[2]) ^
770 ((addr[3] << 8) | (addr[4] & (0xFF << (8 - mask)))))) &
774 static void add_manuf_name(guint8 *addr, unsigned int mask, gchar *name)
778 hashether_t *(*wka_tp)[HASHETHSIZE], *etp;
781 /* This is a well-known MAC address; just add this to the Ethernet
783 add_eth_name(addr, name);
788 /* This is a manufacturer ID; add it to the manufacturer ID hash table */
790 hash_idx = HASH_ETH_MANUF(addr);
792 tp = manuf_table[hash_idx];
795 tp = manuf_table[hash_idx] = (hashmanuf_t *)g_malloc(sizeof(hashmanuf_t));
798 if (tp->next == NULL) {
799 tp->next = (hashmanuf_t *)g_malloc(sizeof(hashmanuf_t));
807 memcpy(tp->addr, addr, sizeof(tp->addr));
808 strncpy(tp->name, name, MAXMANUFLEN);
809 tp->name[MAXMANUFLEN-1] = '\0';
814 /* This is a range of well-known addresses; add it to the appropriate
815 well-known-address table, creating that table if necessary. */
816 wka_tp = wka_table[mask];
818 wka_tp = wka_table[mask] = g_malloc0(sizeof *wka_table[mask]);
820 hash_idx = hash_eth_wka(addr, mask);
822 etp = (*wka_tp)[hash_idx];
825 etp = (*wka_tp)[hash_idx] = (hashether_t *)g_malloc(sizeof(hashether_t));
828 if (memcmp(etp->addr, addr, sizeof(etp->addr)) == 0) {
829 /* address already known */
832 if (etp->next == NULL) {
833 etp->next = (hashether_t *)g_malloc(sizeof(hashether_t));
841 memcpy(etp->addr, addr, sizeof(etp->addr));
842 strncpy(etp->name, name, MAXNAMELEN);
843 etp->name[MAXNAMELEN-1] = '\0';
845 etp->is_dummy_entry = FALSE;
847 } /* add_manuf_name */
849 static hashmanuf_t *manuf_name_lookup(const guint8 *addr)
854 hash_idx = HASH_ETH_MANUF(addr);
856 tp = manuf_table[hash_idx];
859 if (memcmp(tp->addr, addr, sizeof(tp->addr)) == 0) {
867 } /* manuf_name_lookup */
869 static hashether_t *wka_name_lookup(const guint8 *addr, unsigned int mask)
872 hashether_t *(*wka_tp)[HASHETHSIZE];
874 guint8 masked_addr[6];
878 wka_tp = wka_table[mask];
879 if (wka_tp == NULL) {
880 /* There are no entries in the table for that mask value, as there is
881 no table for that mask value. */
885 /* Get the part of the address covered by the mask. */
886 for (i = 0, num = mask; num >= 8; i++, num -= 8)
887 masked_addr[i] = addr[i]; /* copy octets entirely covered by the mask */
888 /* Mask out the first masked octet */
889 masked_addr[i] = addr[i] & (0xFF << (8 - num));
891 /* Zero out completely-masked-out octets */
895 hash_idx = hash_eth_wka(masked_addr, mask);
897 tp = (*wka_tp)[hash_idx];
900 if (memcmp(tp->addr, masked_addr, sizeof(tp->addr)) == 0) {
908 } /* wka_name_lookup */
910 static void initialize_ethers(void)
916 /* Compute the pathname of the ethers file. */
917 if (g_ethers_path == NULL) {
918 g_ethers_path = g_strdup_printf("%s" G_DIR_SEPARATOR_S "%s",
919 get_systemfile_dir(), ENAME_ETHERS);
922 /* Set g_pethers_path here, but don't actually do anything
923 * with it. It's used in get_ethbyname() and get_ethbyaddr()
925 if (g_pethers_path == NULL)
926 g_pethers_path = get_persconffile_path(ENAME_ETHERS, FALSE);
928 /* manuf hash table initialization */
930 /* Compute the pathname of the manuf file */
931 manuf_path = get_datafile_path(ENAME_MANUF);
933 /* Read it and initialize the hash table */
934 set_ethent(manuf_path);
936 while ((eth = get_ethent(&mask, TRUE))) {
937 add_manuf_name(eth->addr, mask, eth->name);
944 } /* initialize_ethers */
946 static hashether_t *add_eth_name(const guint8 *addr, const gchar *name)
951 hash_idx = HASH_ETH_ADDRESS(addr);
953 tp = eth_table[hash_idx];
956 tp = eth_table[hash_idx] = (hashether_t *)g_malloc(sizeof(hashether_t));
959 if (memcmp(tp->addr, addr, sizeof(tp->addr)) == 0) {
960 /* address already known */
961 if (!tp->is_dummy_entry) {
964 /* replace this dummy (manuf) entry with a real name */
968 if (tp->next == NULL) {
969 tp->next = (hashether_t *)g_malloc(sizeof(hashether_t));
977 memcpy(tp->addr, addr, sizeof(tp->addr));
978 strncpy(tp->name, name, MAXNAMELEN);
979 tp->name[MAXNAMELEN-1] = '\0';
981 tp->is_dummy_entry = FALSE;
987 static gchar *eth_name_lookup(const guint8 *addr)
996 hash_idx = HASH_ETH_ADDRESS(addr);
998 tp = eth_table[hash_idx];
1001 tp = eth_table[hash_idx] = (hashether_t *)g_malloc(sizeof(hashether_t));
1004 if (memcmp(tp->addr, addr, sizeof(tp->addr)) == 0) {
1007 if (tp->next == NULL) {
1008 tp->next = (hashether_t *)g_malloc(sizeof(hashether_t));
1016 /* fill in a new entry */
1018 memcpy(tp->addr, addr, sizeof(tp->addr));
1021 if ( (eth = get_ethbyaddr(addr)) == NULL) {
1022 /* Unknown name. Try looking for it in the well-known-address
1023 tables for well-known address ranges smaller than 2^24. */
1026 /* Only the topmost 5 bytes participate fully */
1027 if ((etp = wka_name_lookup(addr, mask+40)) != NULL) {
1028 sprintf(tp->name, "%s_%02x",
1029 etp->name, addr[5] & (0xFF >> mask));
1030 tp->is_dummy_entry = TRUE;
1040 /* Only the topmost 4 bytes participate fully */
1041 if ((etp = wka_name_lookup(addr, mask+32)) != NULL) {
1042 sprintf(tp->name, "%s_%02x:%02x",
1043 etp->name, addr[4] & (0xFF >> mask), addr[5]);
1044 tp->is_dummy_entry = TRUE;
1054 /* Only the topmost 3 bytes participate fully */
1055 if ((etp = wka_name_lookup(addr, mask+24)) != NULL) {
1056 sprintf(tp->name, "%s_%02x:%02x:%02x",
1057 etp->name, addr[3] & (0xFF >> mask), addr[4], addr[5]);
1058 tp->is_dummy_entry = TRUE;
1066 /* Now try looking in the manufacturer table. */
1067 if ((manufp = manuf_name_lookup(addr)) != NULL) {
1068 sprintf(tp->name, "%s_%02x:%02x:%02x",
1069 manufp->name, addr[3], addr[4], addr[5]);
1070 tp->is_dummy_entry = TRUE;
1074 /* Now try looking for it in the well-known-address
1075 tables for well-known address ranges larger than 2^24. */
1078 /* Only the topmost 2 bytes participate fully */
1079 if ((etp = wka_name_lookup(addr, mask+16)) != NULL) {
1080 sprintf(tp->name, "%s_%02x:%02x:%02x:%02x",
1081 etp->name, addr[2] & (0xFF >> mask), addr[3], addr[4],
1083 tp->is_dummy_entry = TRUE;
1093 /* Only the topmost byte participates fully */
1094 if ((etp = wka_name_lookup(addr, mask+8)) != NULL) {
1095 sprintf(tp->name, "%s_%02x:%02x:%02x:%02x:%02x",
1096 etp->name, addr[1] & (0xFF >> mask), addr[2], addr[3],
1098 tp->is_dummy_entry = TRUE;
1106 for (mask = 7; mask > 0; mask--) {
1107 /* Not even the topmost byte participates fully */
1108 if ((etp = wka_name_lookup(addr, mask)) != NULL) {
1109 sprintf(tp->name, "%s_%02x:%02x:%02x:%02x:%02x:%02x",
1110 etp->name, addr[0] & (0xFF >> mask), addr[1], addr[2],
1111 addr[3], addr[4], addr[5]);
1112 tp->is_dummy_entry = TRUE;
1117 /* No match whatsoever. */
1118 sprintf(tp->name, "%s", ether_to_str(addr));
1119 tp->is_dummy_entry = TRUE;
1122 strncpy(tp->name, eth->name, MAXNAMELEN);
1123 tp->name[MAXNAMELEN-1] = '\0';
1124 tp->is_dummy_entry = FALSE;
1129 } /* eth_name_lookup */
1131 static guint8 *eth_addr_lookup(const gchar *name)
1135 hashether_t **table = eth_table;
1138 /* to be optimized (hash table from name to addr) */
1139 for (i = 0; i < HASHETHSIZE; i++) {
1142 if (strcmp(tp->name, name) == 0)
1148 /* not in hash table : performs a file lookup */
1150 if ((eth = get_ethbyname(name)) == NULL)
1153 /* add new entry in hash table */
1155 tp = add_eth_name(eth->addr, name);
1159 } /* eth_addr_lookup */
1163 static int parse_ipxnets_line(char *line, ipxnet_t *ipxnet)
1166 * We allow three address separators (':', '-', and '.'),
1167 * as well as no separators
1171 guint32 a, a0, a1, a2, a3;
1172 gboolean found_single_number = FALSE;
1174 if ((cp = strchr(line, '#')))
1177 if ((cp = strtok(line, " \t\n")) == NULL)
1180 /* Either fill a0,a1,a2,a3 and found_single_number is FALSE,
1181 * fill a and found_single_number is TRUE,
1184 if (sscanf(cp, "%x:%x:%x:%x", &a0, &a1, &a2, &a3) != 4) {
1185 if (sscanf(cp, "%x-%x-%x-%x", &a0, &a1, &a2, &a3) != 4) {
1186 if (sscanf(cp, "%x.%x.%x.%x", &a0, &a1, &a2, &a3) != 4) {
1187 if (sscanf(cp, "%x", &a) == 1) {
1188 found_single_number = TRUE;
1197 if ((cp = strtok(NULL, " \t\n")) == NULL)
1200 if (found_single_number) {
1204 ipxnet->addr = (a0 << 24) | (a1 << 16) | (a2 << 8) | a3;
1207 strncpy(ipxnet->name, cp, MAXNAMELEN);
1208 ipxnet->name[MAXNAMELEN-1] = '\0';
1212 } /* parse_ipxnets_line */
1214 static FILE *ipxnet_p = NULL;
1216 static void set_ipxnetent(char *path)
1221 ipxnet_p = fopen(path, "r");
1224 static void end_ipxnetent(void)
1232 static ipxnet_t *get_ipxnetent(void)
1235 static ipxnet_t ipxnet;
1236 static int size = 0;
1237 static char *buf = NULL;
1239 if (ipxnet_p == NULL)
1242 while (fgetline(&buf, &size, ipxnet_p) >= 0) {
1243 if (parse_ipxnets_line(buf, &ipxnet) == 0) {
1250 } /* get_ipxnetent */
1252 static ipxnet_t *get_ipxnetbyname(const gchar *name)
1256 set_ipxnetent(g_ipxnets_path);
1258 while ((ipxnet = get_ipxnetent()) && strncmp(name, ipxnet->name, MAXNAMELEN) != 0)
1261 if (ipxnet == NULL) {
1264 set_ipxnetent(g_pipxnets_path);
1266 while ((ipxnet = get_ipxnetent()) && strncmp(name, ipxnet->name, MAXNAMELEN) != 0)
1274 } /* get_ipxnetbyname */
1276 static ipxnet_t *get_ipxnetbyaddr(guint32 addr)
1281 set_ipxnetent(g_ipxnets_path);
1283 while ((ipxnet = get_ipxnetent()) && (addr != ipxnet->addr) ) ;
1285 if (ipxnet == NULL) {
1288 set_ipxnetent(g_pipxnets_path);
1290 while ((ipxnet = get_ipxnetent()) && (addr != ipxnet->addr) )
1298 } /* get_ipxnetbyaddr */
1300 static void initialize_ipxnets(void)
1302 /* Compute the pathname of the ipxnets file.
1304 * XXX - is there a notion of an "ipxnets file" in any flavor of
1305 * UNIX, or with any add-on Netware package for UNIX? If not,
1306 * should the UNIX version of the ipxnets file be in the datafile
1307 * directory as well?
1309 if (g_ipxnets_path == NULL) {
1310 g_ipxnets_path = g_malloc(strlen(get_systemfile_dir()) +
1311 strlen(ENAME_IPXNETS) + 2);
1312 sprintf(g_ipxnets_path, "%s" G_DIR_SEPARATOR_S "%s",
1313 get_systemfile_dir(), ENAME_IPXNETS);
1316 /* Set g_pipxnets_path here, but don't actually do anything
1317 * with it. It's used in get_ipxnetbyname() and get_ipxnetbyaddr()
1319 if (g_pipxnets_path == NULL)
1320 g_pipxnets_path = get_persconffile_path(ENAME_IPXNETS, FALSE);
1322 } /* initialize_ipxnets */
1324 static hashipxnet_t *add_ipxnet_name(guint addr, const gchar *name)
1329 hash_idx = HASH_IPX_NET(addr);
1331 tp = ipxnet_table[hash_idx];
1334 tp = ipxnet_table[hash_idx] = (hashipxnet_t *)g_malloc(sizeof(hashipxnet_t));
1337 if (tp->next == NULL) {
1338 tp->next = (hashipxnet_t *)g_malloc(sizeof(hashipxnet_t));
1347 strncpy(tp->name, name, MAXNAMELEN);
1348 tp->name[MAXNAMELEN-1] = '\0';
1353 } /* add_ipxnet_name */
1355 static gchar *ipxnet_name_lookup(const guint addr)
1361 hash_idx = HASH_IPX_NET(addr);
1363 tp = ipxnet_table[hash_idx];
1366 tp = ipxnet_table[hash_idx] = (hashipxnet_t *)g_malloc(sizeof(hashipxnet_t));
1369 if (tp->addr == addr) {
1372 if (tp->next == NULL) {
1373 tp->next = (hashipxnet_t *)g_malloc(sizeof(hashipxnet_t));
1381 /* fill in a new entry */
1386 if ( (ipxnet = get_ipxnetbyaddr(addr)) == NULL) {
1388 sprintf(tp->name, "%X", addr);
1391 strncpy(tp->name, ipxnet->name, MAXNAMELEN);
1392 tp->name[MAXNAMELEN-1] = '\0';
1397 } /* ipxnet_name_lookup */
1399 static guint ipxnet_addr_lookup(const gchar *name, gboolean *success)
1403 hashipxnet_t **table = ipxnet_table;
1406 /* to be optimized (hash table from name to addr) */
1407 for (i = 0; i < HASHIPXNETSIZE; i++) {
1410 if (strcmp(tp->name, name) == 0)
1416 /* not in hash table : performs a file lookup */
1418 if ((ipxnet = get_ipxnetbyname(name)) == NULL) {
1423 /* add new entry in hash table */
1425 tp = add_ipxnet_name(ipxnet->addr, name);
1430 } /* ipxnet_addr_lookup */
1434 * External Functions
1437 #ifdef HAVE_GNU_ADNS
1440 host_name_lookup_init(void) {
1441 /* XXX - Any flags we should be using? */
1442 /* XXX - We could provide config settings for DNS servers, and
1443 pass them to ADNS with adns_init_strcfg */
1444 adns_init(&ads, 0, 0 /*0=>stderr*/);
1445 adns_currently_queued = 0;
1448 /* XXX - The ADNS "documentation" isn't very clear:
1449 * - Do we need to keep our query structures around?
1452 host_name_lookup_process(gpointer data _U_) {
1453 adns_queue_msg_t *almsg;
1455 char addr_str[] = "111.222.333.444.in-addr.arpa.";
1461 adns_queue_head = g_list_first(adns_queue_head);
1463 cur = adns_queue_head;
1464 while (cur && adns_currently_queued <= prefs.name_resolve_concurrency) {
1465 almsg = (adns_queue_msg_t *) cur->data;
1466 if (! almsg->submitted && almsg->type == AF_INET) {
1467 addr_bytes = (guint8 *) &almsg->ip4_addr;
1468 sprintf(addr_str, "%u.%u.%u.%u.in-addr.arpa.", addr_bytes[3],
1469 addr_bytes[2], addr_bytes[1], addr_bytes[0]);
1470 adns_submit (ads, addr_str, adns_r_ptr, 0, NULL, &almsg->query);
1471 almsg->submitted = TRUE;
1472 adns_currently_queued++;
1477 cur = adns_queue_head;
1480 almsg = (adns_queue_msg_t *) cur->data;
1481 if (almsg->submitted) {
1482 ret = adns_check(ads, &almsg->query, &ans, NULL);
1484 if (ans->status == adns_s_ok) {
1485 add_host_name(almsg->ip4_addr, *ans->rrs.str);
1492 adns_queue_head = g_list_remove(adns_queue_head, (void *) almsg);
1494 adns_currently_queued--;
1498 /* Keep the timeout in place */
1503 host_name_lookup_cleanup(void) {
1506 adns_queue_head = g_list_first(adns_queue_head);
1507 while (adns_queue_head) {
1508 qdata = adns_queue_head->data;
1509 adns_queue_head = g_list_remove(adns_queue_head, qdata);
1519 host_name_lookup_init(void) {
1523 host_name_lookup_process(gpointer data _U_) {
1524 /* Kill the timeout, as there's nothing for it to do */
1529 host_name_lookup_cleanup(void) {
1532 #endif /* HAVE_GNU_ADNS */
1534 extern gchar *get_hostname(guint addr)
1538 if (!(g_resolv_flags & RESOLV_NETWORK))
1539 return ip_to_str((guint8 *)&addr);
1541 return host_name_lookup(addr, &found);
1544 extern const gchar *get_hostname6(struct e_in6_addr *addr)
1549 if (!(g_resolv_flags & RESOLV_NETWORK))
1550 return ip6_to_str(addr);
1551 #ifdef SOLARIS8_INET6
1552 if (IN6_IS_ADDR_LINKLOCAL((struct in6_addr*)addr) || IN6_IS_ADDR_MULTICAST((struct in6_addr*)addr))
1554 if (IN6_IS_ADDR_LINKLOCAL(addr) || IN6_IS_ADDR_MULTICAST(addr))
1556 return ip6_to_str(addr);
1559 return host_name_lookup6(addr, &found);
1562 extern void add_host_name(guint addr, const gchar *name)
1567 hash_idx = HASH_IPV4_ADDRESS(addr);
1569 tp = host_table[hash_idx];
1572 tp = host_table[hash_idx] = (hashname_t *)g_malloc(sizeof(hashname_t));
1575 if (tp->addr == addr) {
1576 /* address already known */
1577 if (!tp->is_dummy_entry) {
1580 /* replace this dummy entry with the new one */
1584 if (tp->next == NULL) {
1585 tp->next = (hashname_t *)g_malloc(sizeof(hashname_t));
1593 strncpy(tp->name, name, MAXNAMELEN);
1594 tp->name[MAXNAMELEN-1] = '\0';
1597 tp->is_dummy_entry = FALSE;
1599 } /* add_host_name */
1601 extern gchar *get_udp_port(guint port)
1603 static gchar str[3][MAXNAMELEN];
1606 if (!(g_resolv_flags & RESOLV_TRANSPORT)) {
1607 if (cur == &str[0][0]) {
1609 } else if (cur == &str[1][0]) {
1614 sprintf(cur, "%u", port);
1618 return serv_name_lookup(port, PT_UDP);
1620 } /* get_udp_port */
1622 extern gchar *get_tcp_port(guint port)
1624 static gchar str[3][MAXNAMELEN];
1627 if (!(g_resolv_flags & RESOLV_TRANSPORT)) {
1628 if (cur == &str[0][0]) {
1630 } else if (cur == &str[1][0]) {
1635 sprintf(cur, "%u", port);
1639 return serv_name_lookup(port, PT_TCP);
1641 } /* get_tcp_port */
1643 extern gchar *get_sctp_port(guint port)
1645 static gchar str[3][MAXNAMELEN];
1648 if (!(g_resolv_flags & RESOLV_TRANSPORT)) {
1649 if (cur == &str[0][0]) {
1651 } else if (cur == &str[1][0]) {
1656 sprintf(cur, "%u", port);
1660 return serv_name_lookup(port, PT_SCTP);
1662 } /* get_sctp_port */
1664 extern gchar *get_ether_name(const guint8 *addr)
1666 if (!(g_resolv_flags & RESOLV_MAC))
1667 return ether_to_str(addr);
1669 if (!eth_resolution_initialized) {
1670 initialize_ethers();
1671 eth_resolution_initialized = 1;
1674 return eth_name_lookup(addr);
1676 } /* get_ether_name */
1678 /* Look for an ether name in the hash, and return it if found.
1679 * If it's not found, simply return NULL. We DO NOT make a new
1680 * hash entry for it with the hex digits turned into a string.
1682 gchar *get_ether_name_if_known(const guint8 *addr)
1687 /* Initialize ether structs if we're the first
1688 * ether-related function called */
1689 if (!(g_resolv_flags & RESOLV_MAC))
1692 if (!eth_resolution_initialized) {
1693 initialize_ethers();
1694 eth_resolution_initialized = 1;
1697 hash_idx = HASH_ETH_ADDRESS(addr);
1699 tp = eth_table[hash_idx];
1702 /* Hash key not found in table.
1703 * Force a lookup (and a hash entry) for addr, then call
1704 * myself. I plan on not getting into an infinite loop because
1705 * eth_name_lookup() is guaranteed to make a hashtable entry,
1706 * so when I call myself again, I can never get into this
1707 * block of code again. Knock on wood...
1709 (void) eth_name_lookup(addr);
1710 return get_ether_name_if_known(addr); /* a well-placed goto would suffice */
1714 if (memcmp(tp->addr, addr, sizeof(tp->addr)) == 0) {
1715 if (!tp->is_dummy_entry) {
1716 /* A name was found, and its origin is an ethers file */
1720 /* A name was found, but it was created, not found in a file */
1724 if (tp->next == NULL) {
1725 /* Read my reason above for why I'm sure I can't get into an infinite loop */
1726 (void) eth_name_lookup(addr);
1727 return get_ether_name_if_known(addr); /* a well-placed goto would suffice */
1732 g_assert_not_reached();
1737 extern guint8 *get_ether_addr(const gchar *name)
1740 /* force resolution (do not check g_resolv_flags) */
1742 if (!eth_resolution_initialized) {
1743 initialize_ethers();
1744 eth_resolution_initialized = 1;
1747 return eth_addr_lookup(name);
1749 } /* get_ether_addr */
1751 extern void add_ether_byip(guint ip, const guint8 *eth)
1757 /* first check that IP address can be resolved */
1759 if ((host = host_name_lookup(ip, &found)) == NULL)
1762 /* ok, we can add this entry in the ethers hashtable */
1765 add_eth_name(eth, host);
1767 } /* add_ether_byip */
1769 extern const gchar *get_ipxnet_name(const guint32 addr)
1772 if (!(g_resolv_flags & RESOLV_NETWORK)) {
1773 return ipxnet_to_str_punct(addr, '\0');
1776 if (!ipxnet_resolution_initialized) {
1777 initialize_ipxnets();
1778 ipxnet_resolution_initialized = 1;
1781 return ipxnet_name_lookup(addr);
1783 } /* get_ipxnet_name */
1785 extern guint32 get_ipxnet_addr(const gchar *name, gboolean *known)
1790 /* force resolution (do not check g_resolv_flags) */
1792 if (!ipxnet_resolution_initialized) {
1793 initialize_ipxnets();
1794 ipxnet_resolution_initialized = 1;
1797 addr = ipxnet_addr_lookup(name, &success);
1802 } /* get_ipxnet_addr */
1804 extern const gchar *get_manuf_name(const guint8 *addr)
1806 static gchar str[3][MAXMANUFLEN];
1808 hashmanuf_t *manufp;
1810 if ((g_resolv_flags & RESOLV_MAC) && !eth_resolution_initialized) {
1811 initialize_ethers();
1812 eth_resolution_initialized = 1;
1815 if (!(g_resolv_flags & RESOLV_MAC) || ((manufp = manuf_name_lookup(addr)) == NULL)) {
1816 if (cur == &str[0][0]) {
1818 } else if (cur == &str[1][0]) {
1823 sprintf(cur, "%02x:%02x:%02x", addr[0], addr[1], addr[2]);
1827 return manufp->name;
1829 } /* get_manuf_name */
1833 /* Translate a string, assumed either to be a dotted-quad IP address or
1834 * a host name, to a numeric IP address. Return TRUE if we succeed and
1835 * set "*addrp" to that numeric IP address; return FALSE if we fail.
1836 * Used more in the dfilter parser rather than in packet dissectors */
1837 gboolean get_host_ipaddr(const char *host, guint32 *addrp)
1839 struct in_addr ipaddr;
1843 * don't change it to inet_pton(AF_INET), they are not 100% compatible.
1844 * inet_pton(AF_INET) does not support hexadecimal notation nor
1845 * less-than-4 octet notation.
1847 if (!inet_aton(host, &ipaddr)) {
1848 /* It's not a valid dotted-quad IP address; is it a valid
1850 hp = gethostbyname(host);
1854 /* Apparently, some versions of gethostbyaddr can
1855 * return IPv6 addresses. */
1856 } else if (hp->h_length <= (int) sizeof (struct in_addr)) {
1857 memcpy(&ipaddr, hp->h_addr, hp->h_length);
1862 /* Does the string really contain dotted-quad IP?
1863 * Check against inet_atons that accept strings such as
1864 * "130.230" as valid addresses and try to convert them
1865 * to some form of a classful (host.net) notation.
1867 unsigned int a0, a1, a2, a3;
1868 if (sscanf(host, "%u.%u.%u.%u", &a0, &a1, &a2, &a3) != 4)
1872 *addrp = g_ntohl(ipaddr.s_addr);
1877 * Translate IPv6 numeric address or FQDN hostname, into binary IPv6 address.
1878 * Return TRUE if we succeed and set "*addrp" to that numeric IP address;
1879 * return FALSE if we fail.
1881 gboolean get_host_ipaddr6(const char *host, struct e_in6_addr *addrp)
1885 if (inet_pton(AF_INET6, host, addrp) == 1)
1889 #ifdef HAVE_GETHOSTBYNAME2
1890 hp = gethostbyname2(host, AF_INET6);
1894 if (hp != NULL && hp->h_length == sizeof(struct e_in6_addr)) {
1895 memcpy(addrp, hp->h_addr, hp->h_length);
1903 * Find out whether a hostname resolves to an ip or ipv6 address
1904 * Return "ip6" if it is IPv6, "ip" otherwise (including the case
1905 * that we don't know)
1907 const char* host_ip_af(const char *host)
1909 #ifdef HAVE_GETHOSTBYNAME2
1911 return (h = gethostbyname2(host, AF_INET6)) && h->h_addrtype == AF_INET6 ? "ip6" : "ip";