On Thu, 23 May 2002, Brian May wrote:
> My understanding of the code is that local vs remote connections are
> determined purely by IP numbers. I wonder how it would get this wrong?
>
> The code is:
[perl]
Please note that I'm only relaying that info - I might have confused
something.
Some of the ipaudit-web reports - not all - got confused. So he hacked
ipaudit.c to not report local 2 local at all.
Patch by Florian Reitmeir <squat@riot.org>
Index: ipaudit.c
===================================================================
RCS file: /cvsroot/ipaudit/ipaudit-web/src/ipaudit.c,v
retrieving revision 1.9
diff -u -r1.9 ipaudit.c
--- ipaudit.c 18 Feb 2002 16:10:16 -0000 1.9
+++ ipaudit.c 23 May 2002 00:24:43 -0000
@@ -1048,6 +1048,7 @@
data_t *data;
FILE *outfile_m = stdout;
int switch_mach;
+ int local_local_match;
int first_mach, last_mach;
/* Open file if outname is not - */
@@ -1069,47 +1070,55 @@
/* Get ip addresses and ports */
data = (data_t *) t->data;
- /* Re-order ip addresses if 2nd is local and first is not */
- switch_mach =
- !in_iprange (*(int*)(t->key), iplist_m, niplist_m) &&
- in_iprange (*(int*)(t->key+4), iplist_m, niplist_m);
+ /* check if the packet is from local to local */
+ local_local_match =
+ in_iprange (*(int*)(t->key), iplist_m, niplist_m) &&
+ in_iprange (*(int*)(t->key+4), iplist_m, niplist_m);
- if (switch_mach) {
+ if ( ! local_local_match ) {
- fwrite (t->key+4, 1, 4, outfile_m); /* 2nd ip */
- fwrite (t->key , 1, 4, outfile_m); /* 1st ip */
- fwrite (t->key+12,1, 1, outfile_m); /* protocol */
- fwrite (t->key+10,1, 2, outfile_m); /* 2nd port */
- fwrite (t->key+8, 1, 2, outfile_m); /* 1st port */
- fwrite (&data->nbyte2, 8, 1, outfile_m); /* 2nd ip, bytes received */
- fwrite (&data->nbyte1, 8, 1, outfile_m); /* 1st ip, bytes received */
- fwrite (&data->npkt2, 4, 1, outfile_m); /* 2nd ip, packets recevied */
- fwrite (&data->npkt1, 4, 1, outfile_m); /* 1st ip, packets received */
+ /* Re-order ip addresses if 2nd is local and first is not */
+ switch_mach =
+ !in_iprange (*(int*)(t->key), iplist_m, niplist_m) &&
+ in_iprange (*(int*)(t->key+4), iplist_m, niplist_m);
- } else {
+ if (switch_mach) {
- fwrite (t->key , 1, 4, outfile_m); /* 1st ip */
- fwrite (t->key+4, 1, 4, outfile_m); /* 2nd ip */
- fwrite (t->key+12,1, 1, outfile_m); /* protocol */
- fwrite (t->key+8, 1, 2, outfile_m); /* 1st port */
- fwrite (t->key+10,1, 2, outfile_m); /* 2nd port */
- fwrite (&data->nbyte1, 8, 1, outfile_m); /* 1st ip, bytes received */
- fwrite (&data->nbyte2, 8, 1, outfile_m); /* 2nd ip, bytes received */
- fwrite (&data->npkt1, 4, 1, outfile_m); /* 1st ip, packets received */
- fwrite (&data->npkt2, 4, 1, outfile_m); /* 2nd ip, packets recevied */
- }
+ fwrite (t->key+4, 1, 4, outfile_m); /* 2nd ip */
+ fwrite (t->key , 1, 4, outfile_m); /* 1st ip */
+ fwrite (t->key+12,1, 1, outfile_m); /* protocol */
+ fwrite (t->key+10,1, 2, outfile_m); /* 2nd port */
+ fwrite (t->key+8, 1, 2, outfile_m); /* 1st port */
+ fwrite (&data->nbyte2, 8, 1, outfile_m); /* 2nd ip, bytes received */
+ fwrite (&data->nbyte1, 8, 1, outfile_m); /* 1st ip, bytes received */
+ fwrite (&data->npkt2, 4, 1, outfile_m); /* 2nd ip, packets recevied */
+ fwrite (&data->npkt1, 4, 1, outfile_m); /* 1st ip, packets received */
- /* If switching machine order, correct first/last machine id */
- if (write_time_m) {
- if (switch_mach) {
- first_mach = 3 - data->time.first_mach;
- last_mach = 3 - data->time.last_mach;
- } else {
- first_mach = data->time.first_mach;
- last_mach = data->time.last_mach;
+ } else {
+
+ fwrite (t->key , 1, 4, outfile_m); /* 1st ip */
+ fwrite (t->key+4, 1, 4, outfile_m); /* 2nd ip */
+ fwrite (t->key+12,1, 1, outfile_m); /* protocol */
+ fwrite (t->key+8, 1, 2, outfile_m); /* 1st port */
+ fwrite (t->key+10,1, 2, outfile_m); /* 2nd port */
+ fwrite (&data->nbyte1, 8, 1, outfile_m); /* 1st ip, bytes received */
+ fwrite (&data->nbyte2, 8, 1, outfile_m); /* 2nd ip, bytes received */
+ fwrite (&data->npkt1, 4, 1, outfile_m); /* 1st ip, packets received */
+ fwrite (&data->npkt2, 4, 1, outfile_m); /* 2nd ip, packets recevied */
+ }
+
+ /* If switching machine order, correct first/last machine id */
+ if (write_time_m) {
+ if (switch_mach) {
+ first_mach = 3 - data->time.first_mach;
+ last_mach = 3 - data->time.last_mach;
+ } else {
+ first_mach = data->time.first_mach;
+ last_mach = data->time.last_mach;
+ }
+ fwrite (&first_mach, sizeof(first_mach), 1, outfile_m);
+ fwrite (&last_mach, sizeof(last_mach), 1, outfile_m);
}
- fwrite (&first_mach, sizeof(first_mach), 1, outfile_m);
- fwrite (&last_mach, sizeof(last_mach), 1, outfile_m);
}
}
@@ -1131,6 +1140,7 @@
int pt1, pt2, prot;
int hour,min,sec,msec;
int switch_mach;
+ int local_local_match;
int first_mach, last_mach;
int iconn, nconn;
helem_t **conn = NULL;
@@ -1187,144 +1197,151 @@
for (iconn=0;iconn<nconn;iconn++) {
t = conn[iconn];
- if (dbf_output)
- fprintf (outfile_m, "INSERT INTO ipaudit SET ");
+ local_local_match =
+ in_iprange (ntohl(*(int*)(t->key)), iplist_m, niplist_m) &&
+ in_iprange (ntohl(*(int*)(t->key+4)), iplist_m, niplist_m);
- /* Display probe info if requested */
- if (probename) {
+ if ( ! local_local_match ) {
+
if (dbf_output)
- fprintf (outfile_m, "probename='%s',",
- sys_info_err != 0?"unknown":hostname);
- else
- fprintf (outfile_m, "%s ",
- sys_info_err != 0?"unknown":hostname);
- }
-
- /* Get ip addresses and ports */
- if (printshort_m) {
- sprintf (ip1, "%u.%u.%u.%u",
- t->key[0], t->key[1], t->key[2], t->key[3]);
- sprintf (ip2, "%u.%u.%u.%u",
- t->key[4], t->key[5], t->key[6], t->key[7]);
- } else {
- sprintf (ip1, "%03u.%03u.%03u.%03u",
- t->key[0], t->key[1], t->key[2], t->key[3]);
- sprintf (ip2, "%03u.%03u.%03u.%03u",
- t->key[4], t->key[5], t->key[6], t->key[7]);
- }
- pt1 = (int) t->key[ 8]*256 + t->key[ 9];
- pt2 = (int) t->key[10]*256 + t->key[11];
- prot = t->key[12];
-
- /* Re-order ip addresses if 2nd is local and first is not */
- switch_mach =
- !in_iprange (ntohl(*(int*)(t->key)), iplist_m, niplist_m) &&
- in_iprange (ntohl(*(int*)(t->key+4)), iplist_m, niplist_m);
+ fprintf (outfile_m, "INSERT INTO ipaudit SET ");
- if (switch_mach) {
-
- /* Print key info */
- if (dbf_output) {
- fprintf (outfile_m, "ip2='%s',ip1='%s',protocol=%u,ipport2=%u,ipport1=%u",
- ip2, ip1, prot, pt2, pt1);
- } else {
- fprintf (outfile_m, "%s %s %u %u %u", ip2, ip1, prot, pt2, pt1);
+ /* Display probe info if requested */
+ if (probename) {
+ if (dbf_output)
+ fprintf (outfile_m, "probename='%s',",
+ sys_info_err != 0?"unknown":hostname);
+ else
+ fprintf (outfile_m, "%s ",
+ sys_info_err != 0?"unknown":hostname);
}
-
- /* Data */
- data = (data_t *) t->data;
- if (dbf_output) {
- fprintf (outfile_m, ",ip2bytes=%lu,ip1bytes=%lu,ip2pkts=%u,ip1pkts=%u",
- data->nbyte2, data->nbyte1, data->npkt2, data->npkt1);
+
+ /* Get ip addresses and ports */
+ if (printshort_m) {
+ sprintf (ip1, "%u.%u.%u.%u",
+ t->key[0], t->key[1], t->key[2], t->key[3]);
+ sprintf (ip2, "%u.%u.%u.%u",
+ t->key[4], t->key[5], t->key[6], t->key[7]);
} else {
- fprintf (outfile_m, " %lu %lu %u %u",
- data->nbyte2, data->nbyte1, data->npkt2, data->npkt1);
+ sprintf (ip1, "%03u.%03u.%03u.%03u",
+ t->key[0], t->key[1], t->key[2], t->key[3]);
+ sprintf (ip2, "%03u.%03u.%03u.%03u",
+ t->key[4], t->key[5], t->key[6], t->key[7]);
}
+ pt1 = (int) t->key[ 8]*256 + t->key[ 9];
+ pt2 = (int) t->key[10]*256 + t->key[11];
+ prot = t->key[12];
+
+ /* Re-order ip addresses if 2nd is local and first is not */
+ switch_mach =
+ !in_iprange (ntohl(*(int*)(t->key)), iplist_m, niplist_m) &&
+ in_iprange (ntohl(*(int*)(t->key+4)), iplist_m, niplist_m);
- } else {
+ if (switch_mach) {
- /* Print key info */
- if (dbf_output) {
- fprintf (outfile_m, "ip1='%s',ip2='%s',protocol=%u,ip1port=%u,ip2port=%u",
- ip1, ip2, prot, pt1, pt2);
- } else {
- fprintf (outfile_m, "%s %s %u %u %u", ip1, ip2, prot, pt1, pt2);
- }
-
- /* Data */
- data = (data_t *) t->data;
- if (dbf_output) {
- fprintf (outfile_m, ",ip1bytes=%lu,ip2bytes=%lu,ip1pkts=%u,ip2pkts=%u",
- data->nbyte1, data->nbyte2, data->npkt1, data->npkt2);
- } else {
- fprintf (outfile_m, " %lu %lu %u %u",
- data->nbyte1, data->nbyte2, data->npkt1, data->npkt2);
- }
- }
+ /* Print key info */
+ if (dbf_output) {
+ fprintf (outfile_m, "ip2='%s',ip1='%s',protocol=%u,ipport2=%u,ipport1=%u",
+ ip2, ip1, prot, pt2, pt1);
+ } else {
+ fprintf (outfile_m, "%s %s %u %u %u", ip2, ip1, prot, pt2, pt1);
+ }
- if (write_time_m) {
- /* Convert seconds from midnight to 24 hour time */
- msec = data->time.first_time;
- HMS(hour,min,sec,msec)
+ /* Data */
+ data = (data_t *) t->data;
+ if (dbf_output) {
+ fprintf (outfile_m, ",ip2bytes=%lu,ip1bytes=%lu,ip2pkts=%u,ip1pkts=%u",
+ data->nbyte2, data->nbyte1, data->npkt2, data->npkt1);
+ } else {
+ fprintf (outfile_m, " %lu %lu %u %u",
+ data->nbyte2, data->nbyte1, data->npkt2, data->npkt1);
+ }
- if (dbf_output) {
- fprintf (outfile_m, ",constart='%02d:%02d:%02d',constartmsec=%04d", hour,min,sec,msec);
} else {
- fprintf (outfile_m, " %02d:%02d:%02d.%04d", hour,min,sec,msec);
+
+ /* Print key info */
+ if (dbf_output) {
+ fprintf (outfile_m, "ip1='%s',ip2='%s',protocol=%u,ip1port=%u,ip2port=%u",
+ ip1, ip2, prot, pt1, pt2);
+ } else {
+ fprintf (outfile_m, "%s %s %u %u %u", ip1, ip2, prot, pt1, pt2);
+ }
+
+ /* Data */
+ data = (data_t *) t->data;
+ if (dbf_output) {
+ fprintf (outfile_m, ",ip1bytes=%lu,ip2bytes=%lu,ip1pkts=%u,ip2pkts=%u",
+ data->nbyte1, data->nbyte2, data->npkt1, data->npkt2);
+ } else {
+ fprintf (outfile_m, " %lu %lu %u %u",
+ data->nbyte1, data->nbyte2, data->npkt1, data->npkt2);
+ }
}
- msec = data->time.last_time;
- HMS(hour,min,sec,msec)
+ if (write_time_m) {
+ /* Convert seconds from midnight to 24 hour time */
+ msec = data->time.first_time;
+ HMS(hour,min,sec,msec)
+
+ if (dbf_output) {
+ fprintf (outfile_m, ",constart='%02d:%02d:%02d',constartmsec=%04d", hour,min,sec,msec);
+ } else {
+ fprintf (outfile_m, " %02d:%02d:%02d.%04d", hour,min,sec,msec);
+ }
- if (dbf_output) {
- fprintf (outfile_m, ",constop='%02d:%02d:%02d',constopmsec=%04d", hour,min,sec,msec);
- } else {
- fprintf (outfile_m, " %02d:%02d:%02d.%04d", hour,min,sec,msec);
- }
+ msec = data->time.last_time;
+ HMS(hour,min,sec,msec)
- /* Don't display machine order if dbf output */
- if (!dbf_output) {
- /* If switching machine order, correct first/last machine id */
- if (switch_mach) {
- first_mach = 3 - data->time.first_mach;
- last_mach = 3 - data->time.last_mach;
- } else {
- first_mach = data->time.first_mach;
- last_mach = data->time.last_mach;
+ if (dbf_output) {
+ fprintf (outfile_m, ",constop='%02d:%02d:%02d',constopmsec=%04d", hour,min,sec,msec);
+ } else {
+ fprintf (outfile_m, " %02d:%02d:%02d.%04d", hour,min,sec,msec);
}
- fprintf (outfile_m, " %1d %1d", first_mach, last_mach);
- }
- }
+ /* Don't display machine order if dbf output */
+ if (!dbf_output) {
+ /* If switching machine order, correct first/last machine id */
+ if (switch_mach) {
+ first_mach = 3 - data->time.first_mach;
+ last_mach = 3 - data->time.last_mach;
+ } else {
+ first_mach = data->time.first_mach;
+ last_mach = data->time.last_mach;
+ }
+
+ fprintf (outfile_m, " %1d %1d", first_mach, last_mach);
+ }
+ }
- /* Print optional ethernet addresses */
- if (printeth_m) {
- sprintf (eth1str, "%02x%02x%02x%02x%02x%02x",
- t->key[13], t->key[14], t->key[15],
- t->key[16], t->key[17], t->key[18]);
- sprintf (eth2str, "%02x%02x%02x%02x%02x%02x",
- t->key[19], t->key[20], t->key[21],
- t->key[22], t->key[23], t->key[24]);
+ /* Print optional ethernet addresses */
+ if (printeth_m) {
+ sprintf (eth1str, "%02x%02x%02x%02x%02x%02x",
+ t->key[13], t->key[14], t->key[15],
+ t->key[16], t->key[17], t->key[18]);
+ sprintf (eth2str, "%02x%02x%02x%02x%02x%02x",
+ t->key[19], t->key[20], t->key[21],
+ t->key[22], t->key[23], t->key[24]);
- if (switch_mach) {
- if (dbf_output)
- fprintf (outfile_m, ",eth2='%s',eth1='%s'", eth2str, eth1str);
- else
- fprintf (outfile_m, " %s %s", eth2str, eth1str);
- } else {
- if (dbf_output)
- fprintf (outfile_m, ",eth1='%s',eth2='%s'", eth1str, eth2str);
- else
- fprintf (outfile_m, " %s %s", eth1str, eth2str);
+ if (switch_mach) {
+ if (dbf_output)
+ fprintf (outfile_m, ",eth2='%s',eth1='%s'", eth2str, eth1str);
+ else
+ fprintf (outfile_m, " %s %s", eth2str, eth1str);
+ } else {
+ if (dbf_output)
+ fprintf (outfile_m, ",eth1='%s',eth2='%s'", eth1str, eth2str);
+ else
+ fprintf (outfile_m, " %s %s", eth1str, eth2str);
+ }
}
- }
- if (dbf_output)
- /* ; is line terminator for SQL */
- fprintf (outfile_m, ";\n");
- else
- fprintf (outfile_m, "\n");
+ if (dbf_output)
+ /* ; is line terminator for SQL */
+ fprintf (outfile_m, ";\n");
+ else
+ fprintf (outfile_m, "\n");
+ }
}
Attachment:
pgpRjbwY2tWLY.pgp
Description: PGP signature