"Fossies" - the Fresh Open Source Software Archive 
Member "ettercap-0.8.3.1/src/ec_sniff_unified.c" (1 Aug 2020, 5128 Bytes) of package /linux/privat/ettercap-0.8.3.1.tar.gz:
As a special service "Fossies" has tried to format the requested source page into HTML format using (guessed) C and C++ source code syntax highlighting (style:
standard) with prefixed line numbers and
code folding option.
Alternatively you can here
view or
download the uninterpreted source code file.
For more information about "ec_sniff_unified.c" see the
Fossies "Dox" file reference documentation and the latest
Fossies "Diffs" side-by-side code changes report:
0.8.3_vs_0.8.3.1.
1 /*
2 ettercap -- unified sniffing method module
3
4 Copyright (C) ALoR & NaGA
5
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 2 of the License, or
9 (at your option) any later version.
10
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
15
16 You should have received a copy of the GNU General Public License
17 along with this program; if not, write to the Free Software
18 Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
19
20 */
21
22 #include <ec.h>
23 #include <ec_capture.h>
24 #include <ec_send.h>
25 #include <ec_threads.h>
26 #include <ec_inject.h>
27 #include <ec_conntrack.h>
28 #include <ec_sslwrap.h>
29
30 /* proto */
31 void start_unified_sniff(void);
32 void stop_unified_sniff(void);
33 void forward_unified_sniff(struct packet_object *po);
34 void unified_check_forwarded(struct packet_object *po);
35 void unified_set_forwardable(struct packet_object *po);
36
37 /*******************************************/
38
39 /*
40 * creates the threads for capturing
41 */
42 void start_unified_sniff(void)
43 {
44 DEBUG_MSG("start_unified_sniff");
45 if (EC_GBL_SNIFF->active == 1) {
46 USER_MSG("Unified sniffing already started...\n");
47 return;
48 }
49
50 USER_MSG("Starting Unified sniffing...\n\n");
51
52 /* create the timeouter thread */
53 if (!EC_GBL_OPTIONS->read) {
54 pthread_t pid;
55
56 pid = ec_thread_getpid("timer");
57 if (pthread_equal(pid, ec_thread_getpid(NULL)))
58 ec_thread_new("timer", "conntrack timeouter", &conntrack_timeouter, NULL);
59 }
60
61 /* create the thread for packet capture */
62 capture_start(EC_GBL_IFACE);
63
64 if(EC_GBL_OPTIONS->secondary)
65 secondary_sources_foreach(capture_start);
66
67 /* start ssl_wrapper thread */
68 if (!EC_GBL_OPTIONS->read && !EC_GBL_OPTIONS->unoffensive && !EC_GBL_OPTIONS->only_mitm && EC_GBL_OPTIONS->ssl_mitm)
69 ec_thread_new("sslwrap", "wrapper for ssl connections", &sslw_start, NULL);
70
71 EC_GBL_SNIFF->active = 1;
72 }
73
74
75 /*
76 * kill the capturing threads, but leave untouched the others
77 */
78 void stop_unified_sniff(void)
79 {
80 pthread_t pid;
81
82 DEBUG_MSG("stop_unified_sniff");
83
84 if (EC_GBL_SNIFF->active == 0) {
85 USER_MSG("Unified sniffing is not running...\n");
86 return;
87 }
88
89 /* kill it */
90 capture_stop(EC_GBL_IFACE);
91
92 if(EC_GBL_OPTIONS->secondary)
93 secondary_sources_foreach(capture_stop);
94
95 pid = ec_thread_getpid("sslwrap");
96 if (!pthread_equal(pid, ec_thread_getpid(NULL)))
97 ec_thread_destroy(pid);
98
99 USER_MSG("Unified sniffing was stopped.\n");
100
101 EC_GBL_SNIFF->active = 0;
102 }
103
104
105 void forward_unified_sniff(struct packet_object *po)
106 {
107 /* if it was not initialized, no packet are forwardable */
108 switch(ntohs(po->L3.proto)) {
109 case LL_TYPE_IP:
110 if(!EC_GBL_LNET->lnet_IP4)
111 return;
112 if(!(EC_GBL_IFACE->has_ipv4))
113 return;
114 break;
115 case LL_TYPE_IP6:
116 if(!EC_GBL_LNET->lnet_IP6)
117 return;
118 if(!(EC_GBL_IFACE->has_ipv6))
119 return;
120 break;
121 }
122
123 /* if unoffensive is set, don't forward any packet */
124 if (EC_GBL_OPTIONS->unoffensive || EC_GBL_OPTIONS->read)
125 return;
126
127 /*
128 * forward the packet to Layer 3, the kernel
129 * will route them to the correct destination (host or gw)
130 */
131
132 /* don't forward dropped packets */
133 if ((po->flags & PO_DROPPED) == 0)
134 send_to_L3(po);
135
136 /*
137 * if the packet was modified and it exceeded the mtu,
138 * we have to inject the exceeded data
139 */
140 if (po->DATA.inject)
141 inject_buffer(po);
142 }
143
144 /*
145 * check if the packet has been forwarded by us
146 * the source mac address is our, but the ip address is different
147 */
148 void unified_check_forwarded(struct packet_object *po)
149 {
150 /* the interface was not configured, the packets are not forwardable */
151 if (!EC_GBL_IFACE->is_ready)
152 return;
153
154 /*
155 * dont sniff forwarded packets (equal mac, different ip)
156 * but only if we are on live connections
157 */
158 if (EC_GBL_CONF->skip_forwarded && !EC_GBL_OPTIONS->read &&
159 !memcmp(EC_GBL_IFACE->mac, po->L2.src, MEDIA_ADDR_LEN) &&
160 ip_addr_is_ours(&po->L3.src) != E_FOUND) {
161 po->flags |= PO_FORWARDED;
162 }
163 }
164
165 /*
166 * if the dest mac address of the packet is
167 * the same of EC_GBL_IFACE->mac but the dest ip is
168 * not the same as EC_GBL_IFACE->ip, the packet is not
169 * for us and we can do mitm on it before forwarding.
170 */
171 void unified_set_forwardable(struct packet_object *po)
172 {
173 /*
174 * if the mac is our, but the ip is not...
175 * it has to be forwarded
176 */
177 if (!memcmp(EC_GBL_IFACE->mac, po->L2.dst, MEDIA_ADDR_LEN) &&
178 memcmp(EC_GBL_IFACE->mac, po->L2.src, MEDIA_ADDR_LEN) &&
179 ip_addr_is_ours(&po->L3.dst) != E_FOUND) {
180 po->flags |= PO_FORWARDABLE;
181 }
182
183 }
184
185
186 /* EOF */
187
188 // vim:ts=3:expandtab
189