On Thu, 23 May 2002, Brian May wrote: > My understanding of the code is that local vs remote connections are > determined purely by IP numbers. I wonder how it would get this wrong? > > The code is: [perl] Please note that I'm only relaying that info - I might have confused something. Some of the ipaudit-web reports - not all - got confused. So he hacked ipaudit.c to not report local 2 local at all. Patch by Florian Reitmeir <squat@riot.org> Index: ipaudit.c =================================================================== RCS file: /cvsroot/ipaudit/ipaudit-web/src/ipaudit.c,v retrieving revision 1.9 diff -u -r1.9 ipaudit.c --- ipaudit.c 18 Feb 2002 16:10:16 -0000 1.9 +++ ipaudit.c 23 May 2002 00:24:43 -0000 @@ -1048,6 +1048,7 @@ data_t *data; FILE *outfile_m = stdout; int switch_mach; + int local_local_match; int first_mach, last_mach; /* Open file if outname is not - */ @@ -1069,47 +1070,55 @@ /* Get ip addresses and ports */ data = (data_t *) t->data; - /* Re-order ip addresses if 2nd is local and first is not */ - switch_mach = - !in_iprange (*(int*)(t->key), iplist_m, niplist_m) && - in_iprange (*(int*)(t->key+4), iplist_m, niplist_m); + /* check if the packet is from local to local */ + local_local_match = + in_iprange (*(int*)(t->key), iplist_m, niplist_m) && + in_iprange (*(int*)(t->key+4), iplist_m, niplist_m); - if (switch_mach) { + if ( ! local_local_match ) { - fwrite (t->key+4, 1, 4, outfile_m); /* 2nd ip */ - fwrite (t->key , 1, 4, outfile_m); /* 1st ip */ - fwrite (t->key+12,1, 1, outfile_m); /* protocol */ - fwrite (t->key+10,1, 2, outfile_m); /* 2nd port */ - fwrite (t->key+8, 1, 2, outfile_m); /* 1st port */ - fwrite (&data->nbyte2, 8, 1, outfile_m); /* 2nd ip, bytes received */ - fwrite (&data->nbyte1, 8, 1, outfile_m); /* 1st ip, bytes received */ - fwrite (&data->npkt2, 4, 1, outfile_m); /* 2nd ip, packets recevied */ - fwrite (&data->npkt1, 4, 1, outfile_m); /* 1st ip, packets received */ + /* Re-order ip addresses if 2nd is local and first is not */ + switch_mach = + !in_iprange (*(int*)(t->key), iplist_m, niplist_m) && + in_iprange (*(int*)(t->key+4), iplist_m, niplist_m); - } else { + if (switch_mach) { - fwrite (t->key , 1, 4, outfile_m); /* 1st ip */ - fwrite (t->key+4, 1, 4, outfile_m); /* 2nd ip */ - fwrite (t->key+12,1, 1, outfile_m); /* protocol */ - fwrite (t->key+8, 1, 2, outfile_m); /* 1st port */ - fwrite (t->key+10,1, 2, outfile_m); /* 2nd port */ - fwrite (&data->nbyte1, 8, 1, outfile_m); /* 1st ip, bytes received */ - fwrite (&data->nbyte2, 8, 1, outfile_m); /* 2nd ip, bytes received */ - fwrite (&data->npkt1, 4, 1, outfile_m); /* 1st ip, packets received */ - fwrite (&data->npkt2, 4, 1, outfile_m); /* 2nd ip, packets recevied */ - } + fwrite (t->key+4, 1, 4, outfile_m); /* 2nd ip */ + fwrite (t->key , 1, 4, outfile_m); /* 1st ip */ + fwrite (t->key+12,1, 1, outfile_m); /* protocol */ + fwrite (t->key+10,1, 2, outfile_m); /* 2nd port */ + fwrite (t->key+8, 1, 2, outfile_m); /* 1st port */ + fwrite (&data->nbyte2, 8, 1, outfile_m); /* 2nd ip, bytes received */ + fwrite (&data->nbyte1, 8, 1, outfile_m); /* 1st ip, bytes received */ + fwrite (&data->npkt2, 4, 1, outfile_m); /* 2nd ip, packets recevied */ + fwrite (&data->npkt1, 4, 1, outfile_m); /* 1st ip, packets received */ - /* If switching machine order, correct first/last machine id */ - if (write_time_m) { - if (switch_mach) { - first_mach = 3 - data->time.first_mach; - last_mach = 3 - data->time.last_mach; - } else { - first_mach = data->time.first_mach; - last_mach = data->time.last_mach; + } else { + + fwrite (t->key , 1, 4, outfile_m); /* 1st ip */ + fwrite (t->key+4, 1, 4, outfile_m); /* 2nd ip */ + fwrite (t->key+12,1, 1, outfile_m); /* protocol */ + fwrite (t->key+8, 1, 2, outfile_m); /* 1st port */ + fwrite (t->key+10,1, 2, outfile_m); /* 2nd port */ + fwrite (&data->nbyte1, 8, 1, outfile_m); /* 1st ip, bytes received */ + fwrite (&data->nbyte2, 8, 1, outfile_m); /* 2nd ip, bytes received */ + fwrite (&data->npkt1, 4, 1, outfile_m); /* 1st ip, packets received */ + fwrite (&data->npkt2, 4, 1, outfile_m); /* 2nd ip, packets recevied */ + } + + /* If switching machine order, correct first/last machine id */ + if (write_time_m) { + if (switch_mach) { + first_mach = 3 - data->time.first_mach; + last_mach = 3 - data->time.last_mach; + } else { + first_mach = data->time.first_mach; + last_mach = data->time.last_mach; + } + fwrite (&first_mach, sizeof(first_mach), 1, outfile_m); + fwrite (&last_mach, sizeof(last_mach), 1, outfile_m); } - fwrite (&first_mach, sizeof(first_mach), 1, outfile_m); - fwrite (&last_mach, sizeof(last_mach), 1, outfile_m); } } @@ -1131,6 +1140,7 @@ int pt1, pt2, prot; int hour,min,sec,msec; int switch_mach; + int local_local_match; int first_mach, last_mach; int iconn, nconn; helem_t **conn = NULL; @@ -1187,144 +1197,151 @@ for (iconn=0;iconn<nconn;iconn++) { t = conn[iconn]; - if (dbf_output) - fprintf (outfile_m, "INSERT INTO ipaudit SET "); + local_local_match = + in_iprange (ntohl(*(int*)(t->key)), iplist_m, niplist_m) && + in_iprange (ntohl(*(int*)(t->key+4)), iplist_m, niplist_m); - /* Display probe info if requested */ - if (probename) { + if ( ! local_local_match ) { + if (dbf_output) - fprintf (outfile_m, "probename='%s',", - sys_info_err != 0?"unknown":hostname); - else - fprintf (outfile_m, "%s ", - sys_info_err != 0?"unknown":hostname); - } - - /* Get ip addresses and ports */ - if (printshort_m) { - sprintf (ip1, "%u.%u.%u.%u", - t->key[0], t->key[1], t->key[2], t->key[3]); - sprintf (ip2, "%u.%u.%u.%u", - t->key[4], t->key[5], t->key[6], t->key[7]); - } else { - sprintf (ip1, "%03u.%03u.%03u.%03u", - t->key[0], t->key[1], t->key[2], t->key[3]); - sprintf (ip2, "%03u.%03u.%03u.%03u", - t->key[4], t->key[5], t->key[6], t->key[7]); - } - pt1 = (int) t->key[ 8]*256 + t->key[ 9]; - pt2 = (int) t->key[10]*256 + t->key[11]; - prot = t->key[12]; - - /* Re-order ip addresses if 2nd is local and first is not */ - switch_mach = - !in_iprange (ntohl(*(int*)(t->key)), iplist_m, niplist_m) && - in_iprange (ntohl(*(int*)(t->key+4)), iplist_m, niplist_m); + fprintf (outfile_m, "INSERT INTO ipaudit SET "); - if (switch_mach) { - - /* Print key info */ - if (dbf_output) { - fprintf (outfile_m, "ip2='%s',ip1='%s',protocol=%u,ipport2=%u,ipport1=%u", - ip2, ip1, prot, pt2, pt1); - } else { - fprintf (outfile_m, "%s %s %u %u %u", ip2, ip1, prot, pt2, pt1); + /* Display probe info if requested */ + if (probename) { + if (dbf_output) + fprintf (outfile_m, "probename='%s',", + sys_info_err != 0?"unknown":hostname); + else + fprintf (outfile_m, "%s ", + sys_info_err != 0?"unknown":hostname); } - - /* Data */ - data = (data_t *) t->data; - if (dbf_output) { - fprintf (outfile_m, ",ip2bytes=%lu,ip1bytes=%lu,ip2pkts=%u,ip1pkts=%u", - data->nbyte2, data->nbyte1, data->npkt2, data->npkt1); + + /* Get ip addresses and ports */ + if (printshort_m) { + sprintf (ip1, "%u.%u.%u.%u", + t->key[0], t->key[1], t->key[2], t->key[3]); + sprintf (ip2, "%u.%u.%u.%u", + t->key[4], t->key[5], t->key[6], t->key[7]); } else { - fprintf (outfile_m, " %lu %lu %u %u", - data->nbyte2, data->nbyte1, data->npkt2, data->npkt1); + sprintf (ip1, "%03u.%03u.%03u.%03u", + t->key[0], t->key[1], t->key[2], t->key[3]); + sprintf (ip2, "%03u.%03u.%03u.%03u", + t->key[4], t->key[5], t->key[6], t->key[7]); } + pt1 = (int) t->key[ 8]*256 + t->key[ 9]; + pt2 = (int) t->key[10]*256 + t->key[11]; + prot = t->key[12]; + + /* Re-order ip addresses if 2nd is local and first is not */ + switch_mach = + !in_iprange (ntohl(*(int*)(t->key)), iplist_m, niplist_m) && + in_iprange (ntohl(*(int*)(t->key+4)), iplist_m, niplist_m); - } else { + if (switch_mach) { - /* Print key info */ - if (dbf_output) { - fprintf (outfile_m, "ip1='%s',ip2='%s',protocol=%u,ip1port=%u,ip2port=%u", - ip1, ip2, prot, pt1, pt2); - } else { - fprintf (outfile_m, "%s %s %u %u %u", ip1, ip2, prot, pt1, pt2); - } - - /* Data */ - data = (data_t *) t->data; - if (dbf_output) { - fprintf (outfile_m, ",ip1bytes=%lu,ip2bytes=%lu,ip1pkts=%u,ip2pkts=%u", - data->nbyte1, data->nbyte2, data->npkt1, data->npkt2); - } else { - fprintf (outfile_m, " %lu %lu %u %u", - data->nbyte1, data->nbyte2, data->npkt1, data->npkt2); - } - } + /* Print key info */ + if (dbf_output) { + fprintf (outfile_m, "ip2='%s',ip1='%s',protocol=%u,ipport2=%u,ipport1=%u", + ip2, ip1, prot, pt2, pt1); + } else { + fprintf (outfile_m, "%s %s %u %u %u", ip2, ip1, prot, pt2, pt1); + } - if (write_time_m) { - /* Convert seconds from midnight to 24 hour time */ - msec = data->time.first_time; - HMS(hour,min,sec,msec) + /* Data */ + data = (data_t *) t->data; + if (dbf_output) { + fprintf (outfile_m, ",ip2bytes=%lu,ip1bytes=%lu,ip2pkts=%u,ip1pkts=%u", + data->nbyte2, data->nbyte1, data->npkt2, data->npkt1); + } else { + fprintf (outfile_m, " %lu %lu %u %u", + data->nbyte2, data->nbyte1, data->npkt2, data->npkt1); + } - if (dbf_output) { - fprintf (outfile_m, ",constart='%02d:%02d:%02d',constartmsec=%04d", hour,min,sec,msec); } else { - fprintf (outfile_m, " %02d:%02d:%02d.%04d", hour,min,sec,msec); + + /* Print key info */ + if (dbf_output) { + fprintf (outfile_m, "ip1='%s',ip2='%s',protocol=%u,ip1port=%u,ip2port=%u", + ip1, ip2, prot, pt1, pt2); + } else { + fprintf (outfile_m, "%s %s %u %u %u", ip1, ip2, prot, pt1, pt2); + } + + /* Data */ + data = (data_t *) t->data; + if (dbf_output) { + fprintf (outfile_m, ",ip1bytes=%lu,ip2bytes=%lu,ip1pkts=%u,ip2pkts=%u", + data->nbyte1, data->nbyte2, data->npkt1, data->npkt2); + } else { + fprintf (outfile_m, " %lu %lu %u %u", + data->nbyte1, data->nbyte2, data->npkt1, data->npkt2); + } } - msec = data->time.last_time; - HMS(hour,min,sec,msec) + if (write_time_m) { + /* Convert seconds from midnight to 24 hour time */ + msec = data->time.first_time; + HMS(hour,min,sec,msec) + + if (dbf_output) { + fprintf (outfile_m, ",constart='%02d:%02d:%02d',constartmsec=%04d", hour,min,sec,msec); + } else { + fprintf (outfile_m, " %02d:%02d:%02d.%04d", hour,min,sec,msec); + } - if (dbf_output) { - fprintf (outfile_m, ",constop='%02d:%02d:%02d',constopmsec=%04d", hour,min,sec,msec); - } else { - fprintf (outfile_m, " %02d:%02d:%02d.%04d", hour,min,sec,msec); - } + msec = data->time.last_time; + HMS(hour,min,sec,msec) - /* Don't display machine order if dbf output */ - if (!dbf_output) { - /* If switching machine order, correct first/last machine id */ - if (switch_mach) { - first_mach = 3 - data->time.first_mach; - last_mach = 3 - data->time.last_mach; - } else { - first_mach = data->time.first_mach; - last_mach = data->time.last_mach; + if (dbf_output) { + fprintf (outfile_m, ",constop='%02d:%02d:%02d',constopmsec=%04d", hour,min,sec,msec); + } else { + fprintf (outfile_m, " %02d:%02d:%02d.%04d", hour,min,sec,msec); } - fprintf (outfile_m, " %1d %1d", first_mach, last_mach); - } - } + /* Don't display machine order if dbf output */ + if (!dbf_output) { + /* If switching machine order, correct first/last machine id */ + if (switch_mach) { + first_mach = 3 - data->time.first_mach; + last_mach = 3 - data->time.last_mach; + } else { + first_mach = data->time.first_mach; + last_mach = data->time.last_mach; + } + + fprintf (outfile_m, " %1d %1d", first_mach, last_mach); + } + } - /* Print optional ethernet addresses */ - if (printeth_m) { - sprintf (eth1str, "%02x%02x%02x%02x%02x%02x", - t->key[13], t->key[14], t->key[15], - t->key[16], t->key[17], t->key[18]); - sprintf (eth2str, "%02x%02x%02x%02x%02x%02x", - t->key[19], t->key[20], t->key[21], - t->key[22], t->key[23], t->key[24]); + /* Print optional ethernet addresses */ + if (printeth_m) { + sprintf (eth1str, "%02x%02x%02x%02x%02x%02x", + t->key[13], t->key[14], t->key[15], + t->key[16], t->key[17], t->key[18]); + sprintf (eth2str, "%02x%02x%02x%02x%02x%02x", + t->key[19], t->key[20], t->key[21], + t->key[22], t->key[23], t->key[24]); - if (switch_mach) { - if (dbf_output) - fprintf (outfile_m, ",eth2='%s',eth1='%s'", eth2str, eth1str); - else - fprintf (outfile_m, " %s %s", eth2str, eth1str); - } else { - if (dbf_output) - fprintf (outfile_m, ",eth1='%s',eth2='%s'", eth1str, eth2str); - else - fprintf (outfile_m, " %s %s", eth1str, eth2str); + if (switch_mach) { + if (dbf_output) + fprintf (outfile_m, ",eth2='%s',eth1='%s'", eth2str, eth1str); + else + fprintf (outfile_m, " %s %s", eth2str, eth1str); + } else { + if (dbf_output) + fprintf (outfile_m, ",eth1='%s',eth2='%s'", eth1str, eth2str); + else + fprintf (outfile_m, " %s %s", eth1str, eth2str); + } } - } - if (dbf_output) - /* ; is line terminator for SQL */ - fprintf (outfile_m, ";\n"); - else - fprintf (outfile_m, "\n"); + if (dbf_output) + /* ; is line terminator for SQL */ + fprintf (outfile_m, ";\n"); + else + fprintf (outfile_m, "\n"); + } }
Attachment:
pgpRjbwY2tWLY.pgp
Description: PGP signature