gtk/follow_udp.c

   1 /* follow_udp.c
   2  * UDP specific routines for following traffic streams
   3  *
   4  * $Id$
   5  *
   6  * Wireshark - Network traffic analyzer
   7  * By Gerald Combs <gerald@wireshark.org>
   8  * Copyright 1998 Gerald Combs
   9  *
  10  * This program is free software; you can redistribute it and/or
  11  * modify it under the terms of the GNU General Public License
  12  * as published by the Free Software Foundation; either version 2
  13  * of the License, or (at your option) any later version.
  14  *
  15  * This program is distributed in the hope that it will be useful,
  16  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18  * GNU General Public License for more details.
  19  *
  20  * You should have received a copy of the GNU General Public License
  21  * along with this program; if not, write to the Free Software
  22  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301,
  23  * USA.
  24  */
  25
  26 #ifdef HAVE_CONFIG_H
  27 # include "config.h"
  28 #endif
  29 #include <string.h>
  30
  31 #include <gtk/gtk.h>
  32
  33 #include <epan/addr_resolv.h>
  34 #include <epan/epan_dissect.h>
  35 #include <epan/follow.h>
  36 #include <epan/ipproto.h>
  37 #include <epan/strutil.h>
  38 #include <epan/tap.h>
  39 #include <epan/tvbuff-int.h>
  40
  41 #include <../simple_dialog.h>
  42
  43 #include "gtkglobals.h"
  44 #include "gtk/follow_stream.h"
  45 #include <gtk/keys.h>
  46 #include <gtk/main.h>
  47 #include "gtk/follow_udp.h"
  48 #include "gtk/utf8_entities.h"
  49
  50 static int
  51 udp_queue_packet_data(void *tapdata, packet_info *pinfo,
  52                       epan_dissect_t *edt _U_, const void *data)
  53 {
  54         follow_record_t *follow_record;
  55         follow_info_t *follow_info = tapdata;
  56         const tvbuff_t *next_tvb = data;
  57
  58         follow_record = g_malloc(sizeof(follow_record_t));
  59
  60         follow_record->data = g_byte_array_sized_new(next_tvb->length);
  61         follow_record->data = g_byte_array_append(follow_record->data,
  62                                                   next_tvb->real_data,
  63                                                   next_tvb->length);
  64
  65         if (follow_info->client_port == 0) {
  66                 follow_info->client_port = pinfo->srcport;
  67                 COPY_ADDRESS(&follow_info->client_ip, &pinfo->src);
  68         }
  69
  70         if (ADDRESSES_EQUAL(&follow_info->client_ip, &pinfo->src) &&
  71             follow_info->client_port == pinfo->srcport)
  72                 follow_record->is_server = FALSE;
  73         else
  74                 follow_record->is_server = TRUE;
  75
  76         /* update stream counter */
  77         follow_info->bytes_written[follow_record->is_server] +=
  78                 follow_record->data->len;
  79
  80         follow_info->payload = g_list_append(follow_info->payload,
  81                                              follow_record);
  82         return 0;
  83 }
  84
  85
  86 /* Follow the UDP stream, if any, to which the last packet that we called
  87    a dissection routine on belongs (this might be the most recently
  88    selected packet, or it might be the last packet in the file). */
  89 void
  90 follow_udp_stream_cb(GtkWidget *w _U_, gpointer data _U_)
  91 {
  92         GtkWidget *filter_te, *filter_cm;
  93         gchar *follow_filter;
  94         const gchar *previous_filter;
  95         int filter_out_filter_len, previous_filter_len;
  96         const char *hostname0, *hostname1;
  97         char *port0, *port1;
  98         gchar *server_to_client_string = NULL;
  99         gchar *client_to_server_string = NULL;
 100         gchar *both_directions_string = NULL;
 101         follow_stats_t stats;
 102         follow_info_t *follow_info;
 103         GString *msg;
 104
 105         /* we got udp so we can follow */
 106         if(cfile.edt->pi.ipproto != IP_PROTO_UDP) {
 107                 simple_dialog(ESD_TYPE_ERROR, ESD_BTN_OK,
 108                               "Error following stream.  Please make\n"
 109                               "sure you have a UDP packet selected.");
 110                 return;
 111         }
 112
 113         follow_info = g_new0(follow_info_t, 1);
 114         follow_info->follow_type = FOLLOW_UDP;
 115
 116         /* Create a new filter that matches all packets in the UDP stream,
 117            and set the display filter entry accordingly */
 118         follow_filter = build_follow_filter(&cfile.edt->pi);
 119         if (!follow_filter)
 120                 {
 121                         simple_dialog(ESD_TYPE_ERROR, ESD_BTN_OK,
 122                                       "Error creating filter for this stream.\n"
 123                                       "A network layer header is needed");
 124                         g_free(follow_info);
 125                         return;
 126                 }
 127
 128         /* Set the display filter entry accordingly */
 129         filter_cm = g_object_get_data(G_OBJECT(top_level), E_DFILTER_CM_KEY);
 130         filter_te = gtk_bin_get_child(GTK_BIN(filter_cm));
 131
 132         /* needed in follow_filter_out_stream(), is there a better way? */
 133         follow_info->filter_te = filter_te;
 134
 135         /* save previous filter, const since we're not supposed to alter */
 136         previous_filter =
 137                 (const gchar *)gtk_entry_get_text(GTK_ENTRY(filter_te));
 138
 139         /* allocate our new filter. API claims g_malloc terminates program on failure */
 140         /* my calc for max alloc needed is really +10 but when did a few extra bytes hurt ? */
 141         previous_filter_len = previous_filter?(int)strlen(previous_filter):0;
 142         filter_out_filter_len = (int)strlen(follow_filter) + previous_filter_len + 16;
 143         follow_info->filter_out_filter = (gchar *)g_malloc(filter_out_filter_len);
 144
 145         /* append the negation */
 146         if(previous_filter_len) {
 147                 g_snprintf(follow_info->filter_out_filter, filter_out_filter_len,
 148                            "%s and !(%s)", previous_filter, follow_filter);
 149         } else {
 150                 g_snprintf(follow_info->filter_out_filter, filter_out_filter_len,
 151                            "!(%s)", follow_filter);
 152         }
 153
 154         /* data will be passed via tap callback*/
 155         msg = register_tap_listener("udp_follow", follow_info, follow_filter,
 156                                     0, NULL, udp_queue_packet_data, NULL);
 157         if (msg) {
 158                 simple_dialog(ESD_TYPE_ERROR, ESD_BTN_OK,
 159                               "Can't register udp_follow tap: %s\n",
 160                               msg->str);
 161                 g_free(follow_info->filter_out_filter);
 162                 g_free(follow_info);
 163                 g_free(follow_filter);
 164                 return;
 165         }
 166
 167         gtk_entry_set_text(GTK_ENTRY(filter_te), follow_filter);
 168
 169         /* Run the display filter so it goes in effect - even if it's the
 170            same as the previous display filter. */
 171         main_filter_packets(&cfile, follow_filter, TRUE);
 172
 173         /* Free the filter string, as we're done with it. */
 174         g_free(follow_filter);
 175
 176         remove_tap_listener(follow_info);
 177
 178         /* Stream to show */
 179         follow_stats(&stats);
 180
 181         if (stats.is_ipv6) {
 182                 struct e_in6_addr ipaddr;
 183                 memcpy(&ipaddr, stats.ip_address[0], 16);
 184                 hostname0 = get_hostname6(&ipaddr);
 185                 memcpy(&ipaddr, stats.ip_address[0], 16);
 186                 hostname1 = get_hostname6(&ipaddr);
 187         } else {
 188                 guint32 ipaddr;
 189                 memcpy(&ipaddr, stats.ip_address[0], 4);
 190                 hostname0 = get_hostname(ipaddr);
 191                 memcpy(&ipaddr, stats.ip_address[1], 4);
 192                 hostname1 = get_hostname(ipaddr);
 193         }
 194
 195         port0 = get_udp_port(stats.port[0]);
 196         port1 = get_udp_port(stats.port[1]);
 197
 198         follow_info->is_ipv6 = stats.is_ipv6;
 199
 200         /* Both Stream Directions */
 201         both_directions_string = g_strdup_printf("Entire conversation (%u bytes)", follow_info->bytes_written[0] + follow_info->bytes_written[1]);
 202
 203         if(follow_info->client_port == stats.port[0]) {
 204                 server_to_client_string =
 205                         g_strdup_printf("%s:%s " UTF8_RIGHTWARDS_ARROW " %s:%s (%u bytes)",
 206                                         hostname0, port0,
 207                                         hostname1, port1,
 208                                         follow_info->bytes_written[0]);
 209
 210                 client_to_server_string =
 211                         g_strdup_printf("%s:%s " UTF8_RIGHTWARDS_ARROW " %s:%s (%u bytes)",
 212                                         hostname1, port1,
 213                                         hostname0, port0,
 214                                         follow_info->bytes_written[1]);
 215         } else {
 216                 server_to_client_string =
 217                         g_strdup_printf("%s:%s " UTF8_RIGHTWARDS_ARROW " %s:%s (%u bytes)",
 218                                         hostname1, port1,
 219                                         hostname0, port0,
 220                                         follow_info->bytes_written[0]);
 221
 222                 client_to_server_string =
 223                         g_strdup_printf("%s:%s " UTF8_RIGHTWARDS_ARROW " %s:%s (%u bytes)",
 224                                         hostname0, port0,
 225                                         hostname1, port1,
 226                                         follow_info->bytes_written[1]);
 227         }
 228
 229         follow_stream("Follow UDP Stream", follow_info, both_directions_string,
 230                       server_to_client_string, client_to_server_string);
 231
 232         g_free(both_directions_string);
 233         g_free(server_to_client_string);
 234         g_free(client_to_server_string);
 235 }
 236
 237 #define FLT_BUF_SIZE 1024
 238
 239 /*
 240  * XXX - the routine pointed to by "print_line_fcn_p" doesn't get handed lines,
 241  * it gets handed bufferfuls.  That's fine for "follow_write_raw()"
 242  * and "follow_add_to_gtk_text()", but, as "follow_print_text()" calls
 243  * the "print_line()" routine from "print.c", and as that routine might
 244  * genuinely expect to be handed a line (if, for example, it's using
 245  * some OS or desktop environment's printing API, and that API expects
 246  * to be handed lines), "follow_print_text()" should probably accumulate
 247  * lines in a buffer and hand them "print_line()".  (If there's a
 248  * complete line in a buffer - i.e., there's nothing of the line in
 249  * the previous buffer or the next buffer - it can just hand that to
 250  * "print_line()" after filtering out non-printables, as an
 251  * optimization.)
 252  *
 253  * This might or might not be the reason why C arrays display
 254  * correctly but get extra blank lines very other line when printed.
 255  */
 256 frs_return_t
 257 follow_read_udp_stream(follow_info_t *follow_info,
 258                        gboolean (*print_line_fcn_p)(char *, size_t, gboolean, void *),
 259                        void *arg)
 260 {
 261         guint32 global_client_pos = 0, global_server_pos = 0;
 262         guint32 server_packet_count = 0;
 263         guint32 client_packet_count = 0;
 264         guint32 *global_pos;
 265         gboolean skip;
 266         GList* cur;
 267         frs_return_t frs_return;
 268         follow_record_t *follow_record;
 269         char *buffer;
 270
 271
 272         for (cur = follow_info->payload; cur; cur = g_list_next(cur)) {
 273                 follow_record = cur->data;
 274                 skip = FALSE;
 275                 if (!follow_record->is_server) {
 276                         global_pos = &global_client_pos;
 277                         if(follow_info->show_stream == FROM_SERVER) {
 278                                 skip = TRUE;
 279                         }
 280                 } else {
 281                         global_pos = &global_server_pos;
 282                         if (follow_info->show_stream == FROM_CLIENT) {
 283                                 skip = TRUE;
 284                         }
 285                 }
 286
 287                 if (!skip) {
 288                         buffer = g_memdup(follow_record->data->data,
 289                                           follow_record->data->len);
 290
 291                         frs_return = follow_show(follow_info, print_line_fcn_p,
 292                                                  buffer,
 293                                                  follow_record->data->len,
 294                                                  follow_record->is_server, arg,
 295                                                  global_pos,
 296                                                  &server_packet_count,
 297                                                  &client_packet_count);
 298                         g_free(buffer);
 299                         if(frs_return == FRS_PRINT_ERROR)
 300                                 return frs_return;
 301                 }
 302         }
 303
 304         return FRS_OK;
 305 }