1 /*
2 * collectd - src/utils_dns.c
3 * Copyright (C) 2006 Florian octo Forster
4 * Copyright (C) 2002 The Measurement Factory, Inc.
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions are met:
9 *
10 * 1. Redistributions of source code must retain the above copyright notice,
11 * this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright notice,
13 * this list of conditions and the following disclaimer in the documentation
14 * and/or other materials provided with the distribution.
15 * 3. Neither the name of The Measurement Factory nor the names of its
16 * contributors may be used to endorse or promote products derived from this
17 * software without specific prior written permission.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
20 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
23 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29 * POSSIBILITY OF SUCH DAMAGE.
30 *
31 * Authors:
32 * The Measurement Factory, Inc. <http://www.measurement-factory.com/>
33 * Florian octo Forster <octo at collectd.org>
34 */
36 #define _DEFAULT_SOURCE
37 #define _BSD_SOURCE
39 #include "collectd.h"
40 #include "plugin.h"
41 #include "common.h"
43 #if HAVE_SYS_SOCKET_H
44 # include <sys/socket.h>
45 #endif
47 #if HAVE_NET_IF_ARP_H
48 # include <net/if_arp.h>
49 #endif
50 #if HAVE_NET_IF_H
51 # include <net/if.h>
52 #endif
53 #if HAVE_NET_PPP_DEFS_H
54 # include <net/ppp_defs.h>
55 #endif
56 #if HAVE_NET_IF_PPP_H
57 # include <net/if_ppp.h>
58 #endif
60 #if HAVE_NETINET_IN_SYSTM_H
61 # include <netinet/in_systm.h>
62 #endif
63 #if HAVE_NETINET_IN_H
64 # include <netinet/in.h>
65 #endif
66 #if HAVE_NETINET_IP6_H
67 # include <netinet/ip6.h>
68 #endif
69 #if HAVE_NETINET_IP_COMPAT_H
70 # include <netinet/ip_compat.h>
71 #endif
72 #if HAVE_NETINET_IF_ETHER_H
73 # include <netinet/if_ether.h>
74 #endif
75 #if HAVE_NETINET_IP_H
76 # include <netinet/ip.h>
77 #endif
78 #ifdef HAVE_NETINET_IP_VAR_H
79 # include <netinet/ip_var.h>
80 #endif
81 #if HAVE_NETINET_UDP_H
82 # include <netinet/udp.h>
83 #endif
85 #if HAVE_ARPA_INET_H
86 # include <arpa/inet.h>
87 #endif
88 #if HAVE_ARPA_NAMESER_H
89 # include <arpa/nameser.h>
90 #endif
91 #if HAVE_ARPA_NAMESER_COMPAT_H
92 # include <arpa/nameser_compat.h>
93 #endif
95 #if HAVE_NETDB_H
96 # include <netdb.h>
97 #endif
99 #if HAVE_PCAP_H
100 # include <pcap.h>
101 #endif
103 #define PCAP_SNAPLEN 1460
104 #ifndef ETHER_HDR_LEN
105 #define ETHER_ADDR_LEN 6
106 #define ETHER_TYPE_LEN 2
107 #define ETHER_HDR_LEN (ETHER_ADDR_LEN * 2 + ETHER_TYPE_LEN)
108 #endif
109 #ifndef ETHERTYPE_8021Q
110 # define ETHERTYPE_8021Q 0x8100
111 #endif
112 #ifndef ETHERTYPE_IPV6
113 # define ETHERTYPE_IPV6 0x86DD
114 #endif
116 #ifndef PPP_ADDRESS_VAL
117 # define PPP_ADDRESS_VAL 0xff /* The address byte value */
118 #endif
119 #ifndef PPP_CONTROL_VAL
120 # define PPP_CONTROL_VAL 0x03 /* The control byte value */
121 #endif
123 #if HAVE_STRUCT_UDPHDR_UH_DPORT && HAVE_STRUCT_UDPHDR_UH_SPORT
124 # define UDP_DEST uh_dport
125 # define UDP_SRC uh_sport
126 #elif HAVE_STRUCT_UDPHDR_DEST && HAVE_STRUCT_UDPHDR_SOURCE
127 # define UDP_DEST dest
128 # define UDP_SRC source
129 #else
130 # error "`struct udphdr' is unusable."
131 #endif
133 #include "utils_dns.h"
135 /*
136 * Type definitions
137 */
138 struct ip_list_s
139 {
140 struct in6_addr addr;
141 void *data;
142 struct ip_list_s *next;
143 };
144 typedef struct ip_list_s ip_list_t;
146 typedef int (printer)(const char *, ...);
148 /*
149 * flags/features for non-interactive mode
150 */
152 #ifndef T_A6
153 #define T_A6 38
154 #endif
155 #ifndef T_SRV
156 #define T_SRV 33
157 #endif
159 /*
160 * Global variables
161 */
162 int qtype_counts[T_MAX];
163 int opcode_counts[OP_MAX];
164 int qclass_counts[C_MAX];
166 #if HAVE_PCAP_H
167 static pcap_t *pcap_obj = NULL;
168 #endif
170 static ip_list_t *IgnoreList = NULL;
172 #if HAVE_PCAP_H
173 static void (*Callback) (const rfc1035_header_t *) = NULL;
175 static int query_count_intvl = 0;
176 static int query_count_total = 0;
177 # ifdef __OpenBSD__
178 static struct bpf_timeval last_ts;
179 # else
180 static struct timeval last_ts;
181 # endif /* __OpenBSD__ */
182 #endif /* HAVE_PCAP_H */
184 static int cmp_in6_addr (const struct in6_addr *a,
185 const struct in6_addr *b)
186 {
187 int i;
189 assert (sizeof (struct in6_addr) == 16);
191 for (i = 0; i < 16; i++)
192 if (a->s6_addr[i] != b->s6_addr[i])
193 break;
195 if (i >= 16)
196 return (0);
198 return (a->s6_addr[i] > b->s6_addr[i] ? 1 : -1);
199 } /* int cmp_addrinfo */
201 static inline int ignore_list_match (const struct in6_addr *addr)
202 {
203 ip_list_t *ptr;
205 for (ptr = IgnoreList; ptr != NULL; ptr = ptr->next)
206 if (cmp_in6_addr (addr, &ptr->addr) == 0)
207 return (1);
208 return (0);
209 } /* int ignore_list_match */
211 static void ignore_list_add (const struct in6_addr *addr)
212 {
213 ip_list_t *new;
215 if (ignore_list_match (addr) != 0)
216 return;
218 new = malloc (sizeof (ip_list_t));
219 if (new == NULL)
220 {
221 perror ("malloc");
222 return;
223 }
225 memcpy (&new->addr, addr, sizeof (struct in6_addr));
226 new->next = IgnoreList;
228 IgnoreList = new;
229 } /* void ignore_list_add */
231 void ignore_list_add_name (const char *name)
232 {
233 struct addrinfo *ai_list;
234 struct addrinfo *ai_ptr;
235 struct in6_addr addr;
236 int status;
238 status = getaddrinfo (name, NULL, NULL, &ai_list);
239 if (status != 0)
240 return;
242 for (ai_ptr = ai_list; ai_ptr != NULL; ai_ptr = ai_ptr->ai_next)
243 {
244 if (ai_ptr->ai_family == AF_INET)
245 {
246 memset (&addr, '\0', sizeof (addr));
247 addr.s6_addr[10] = 0xFF;
248 addr.s6_addr[11] = 0xFF;
249 memcpy (addr.s6_addr + 12, &((struct sockaddr_in *) ai_ptr->ai_addr)->sin_addr, 4);
251 ignore_list_add (&addr);
252 }
253 else
254 {
255 ignore_list_add (&((struct sockaddr_in6 *) ai_ptr->ai_addr)->sin6_addr);
256 }
257 } /* for */
259 freeaddrinfo (ai_list);
260 }
262 #if HAVE_PCAP_H
263 static void in6_addr_from_buffer (struct in6_addr *ia,
264 const void *buf, size_t buf_len,
265 int family)
266 {
267 memset (ia, 0, sizeof (struct in6_addr));
268 if ((AF_INET == family) && (sizeof (uint32_t) == buf_len))
269 {
270 ia->s6_addr[10] = 0xFF;
271 ia->s6_addr[11] = 0xFF;
272 memcpy (ia->s6_addr + 12, buf, buf_len);
273 }
274 else if ((AF_INET6 == family) && (sizeof (struct in6_addr) == buf_len))
275 {
276 memcpy (ia, buf, buf_len);
277 }
278 } /* void in6_addr_from_buffer */
280 void dnstop_set_pcap_obj (pcap_t *po)
281 {
282 pcap_obj = po;
283 }
285 void dnstop_set_callback (void (*cb) (const rfc1035_header_t *))
286 {
287 Callback = cb;
288 }
290 #define RFC1035_MAXLABELSZ 63
291 static int
292 rfc1035NameUnpack(const char *buf, size_t sz, off_t * off, char *name, size_t ns
293 )
294 {
295 off_t no = 0;
296 unsigned char c;
297 size_t len;
298 static int loop_detect = 0;
299 if (loop_detect > 2)
300 return 4; /* compression loop */
301 if (ns <= 0)
302 return 4; /* probably compression loop */
303 do {
304 if ((*off) >= sz)
305 break;
306 c = *(buf + (*off));
307 if (c > 191) {
308 /* blasted compression */
309 int rc;
310 unsigned short s;
311 off_t ptr;
312 memcpy(&s, buf + (*off), sizeof(s));
313 s = ntohs(s);
314 (*off) += sizeof(s);
315 /* Sanity check */
316 if ((*off) >= sz)
317 return 1; /* message too short */
318 ptr = s & 0x3FFF;
319 /* Make sure the pointer is inside this message */
320 if (ptr >= sz)
321 return 2; /* bad compression ptr */
322 if (ptr < DNS_MSG_HDR_SZ)
323 return 2; /* bad compression ptr */
324 loop_detect++;
325 rc = rfc1035NameUnpack(buf, sz, &ptr, name + no, ns - no);
326 loop_detect--;
327 return rc;
328 } else if (c > RFC1035_MAXLABELSZ) {
329 /*
330 * "(The 10 and 01 combinations are reserved for future use.)"
331 */
332 return 3; /* reserved label/compression flags */
333 break;
334 } else {
335 (*off)++;
336 len = (size_t) c;
337 if (len == 0)
338 break;
339 if (len > (ns - 1))
340 len = ns - 1;
341 if ((*off) + len > sz)
342 return 4; /* message is too short */
343 if (no + len + 1 > ns)
344 return 5; /* qname would overflow name buffer */
345 memcpy(name + no, buf + (*off), len);
346 (*off) += len;
347 no += len;
348 *(name + (no++)) = '.';
349 }
350 } while (c > 0);
351 if (no > 0)
352 *(name + no - 1) = '\0';
353 /* make sure we didn't allow someone to overflow the name buffer */
354 assert(no <= ns);
355 return 0;
356 }
358 static int
359 handle_dns(const char *buf, int len)
360 {
361 rfc1035_header_t qh;
362 uint16_t us;
363 off_t offset;
364 char *t;
365 int status;
367 /* The DNS header is 12 bytes long */
368 if (len < DNS_MSG_HDR_SZ)
369 return 0;
371 memcpy(&us, buf + 0, 2);
372 qh.id = ntohs(us);
374 memcpy(&us, buf + 2, 2);
375 us = ntohs(us);
376 qh.qr = (us >> 15) & 0x01;
377 qh.opcode = (us >> 11) & 0x0F;
378 qh.aa = (us >> 10) & 0x01;
379 qh.tc = (us >> 9) & 0x01;
380 qh.rd = (us >> 8) & 0x01;
381 qh.ra = (us >> 7) & 0x01;
382 qh.z = (us >> 6) & 0x01;
383 qh.ad = (us >> 5) & 0x01;
384 qh.cd = (us >> 4) & 0x01;
385 qh.rcode = us & 0x0F;
387 memcpy(&us, buf + 4, 2);
388 qh.qdcount = ntohs(us);
390 memcpy(&us, buf + 6, 2);
391 qh.ancount = ntohs(us);
393 memcpy(&us, buf + 8, 2);
394 qh.nscount = ntohs(us);
396 memcpy(&us, buf + 10, 2);
397 qh.arcount = ntohs(us);
399 offset = DNS_MSG_HDR_SZ;
400 memset(qh.qname, '\0', MAX_QNAME_SZ);
401 status = rfc1035NameUnpack(buf, len, &offset, qh.qname, MAX_QNAME_SZ);
402 if (status != 0)
403 {
404 INFO ("utils_dns: handle_dns: rfc1035NameUnpack failed "
405 "with status %i.", status);
406 return 0;
407 }
408 if ('\0' == qh.qname[0])
409 sstrncpy (qh.qname, ".", sizeof (qh.qname));
410 while ((t = strchr(qh.qname, '\n')))
411 *t = ' ';
412 while ((t = strchr(qh.qname, '\r')))
413 *t = ' ';
414 for (t = qh.qname; *t; t++)
415 *t = tolower((int) *t);
417 memcpy(&us, buf + offset, 2);
418 qh.qtype = ntohs(us);
419 memcpy(&us, buf + offset + 2, 2);
420 qh.qclass = ntohs(us);
422 qh.length = (uint16_t) len;
424 /* gather stats */
425 qtype_counts[qh.qtype]++;
426 qclass_counts[qh.qclass]++;
427 opcode_counts[qh.opcode]++;
429 if (Callback != NULL)
430 Callback (&qh);
432 return 1;
433 }
435 static int
436 handle_udp(const struct udphdr *udp, int len)
437 {
438 char buf[PCAP_SNAPLEN];
439 if ((ntohs (udp->UDP_DEST) != 53)
440 && (ntohs (udp->UDP_SRC) != 53))
441 return 0;
442 memcpy(buf, udp + 1, len - sizeof(*udp));
443 if (0 == handle_dns(buf, len - sizeof(*udp)))
444 return 0;
445 return 1;
446 }
448 #if HAVE_NETINET_IP6_H
449 static int
450 handle_ipv6 (struct ip6_hdr *ipv6, int len)
451 {
452 char buf[PCAP_SNAPLEN];
453 unsigned int offset;
454 int nexthdr;
456 struct in6_addr c_src_addr;
457 uint16_t payload_len;
459 if (0 > len)
460 return (0);
462 offset = sizeof (struct ip6_hdr);
463 nexthdr = ipv6->ip6_nxt;
464 c_src_addr = ipv6->ip6_src;
465 payload_len = ntohs (ipv6->ip6_plen);
467 if (ignore_list_match (&c_src_addr))
468 return (0);
470 /* Parse extension headers. This only handles the standard headers, as
471 * defined in RFC 2460, correctly. Fragments are discarded. */
472 while ((IPPROTO_ROUTING == nexthdr) /* routing header */
473 || (IPPROTO_HOPOPTS == nexthdr) /* Hop-by-Hop options. */
474 || (IPPROTO_FRAGMENT == nexthdr) /* fragmentation header. */
475 || (IPPROTO_DSTOPTS == nexthdr) /* destination options. */
476 || (IPPROTO_AH == nexthdr) /* destination options. */
477 || (IPPROTO_ESP == nexthdr)) /* encapsulating security payload. */
478 {
479 struct ip6_ext ext_hdr;
480 uint16_t ext_hdr_len;
482 /* Catch broken packets */
483 if ((offset + sizeof (struct ip6_ext)) > (unsigned int)len)
484 return (0);
486 /* Cannot handle fragments. */
487 if (IPPROTO_FRAGMENT == nexthdr)
488 return (0);
490 memcpy (&ext_hdr, (char *) ipv6 + offset, sizeof (struct ip6_ext));
491 nexthdr = ext_hdr.ip6e_nxt;
492 ext_hdr_len = (8 * (ntohs (ext_hdr.ip6e_len) + 1));
494 /* This header is longer than the packets payload.. WTF? */
495 if (ext_hdr_len > payload_len)
496 return (0);
498 offset += ext_hdr_len;
499 payload_len -= ext_hdr_len;
500 } /* while */
502 /* Catch broken and empty packets */
503 if (((offset + payload_len) > (unsigned int)len)
504 || (payload_len == 0)
505 || (payload_len > PCAP_SNAPLEN))
506 return (0);
508 if (IPPROTO_UDP != nexthdr)
509 return (0);
511 memcpy (buf, (char *) ipv6 + offset, payload_len);
512 if (handle_udp ((struct udphdr *) buf, payload_len) == 0)
513 return (0);
515 return (1); /* Success */
516 } /* int handle_ipv6 */
517 /* #endif HAVE_NETINET_IP6_H */
519 #else /* if !HAVE_NETINET_IP6_H */
520 static int
521 handle_ipv6 (__attribute__((unused)) void *pkg,
522 __attribute__((unused)) int len)
523 {
524 return (0);
525 }
526 #endif /* !HAVE_NETINET_IP6_H */
528 static int
529 handle_ip(const struct ip *ip, int len)
530 {
531 char buf[PCAP_SNAPLEN];
532 int offset = ip->ip_hl << 2;
533 struct in6_addr c_src_addr;
534 struct in6_addr c_dst_addr;
536 if (ip->ip_v == 6)
537 return (handle_ipv6 ((void *) ip, len));
539 in6_addr_from_buffer (&c_src_addr, &ip->ip_src.s_addr, sizeof (ip->ip_src.s_addr), AF_INET);
540 in6_addr_from_buffer (&c_dst_addr, &ip->ip_dst.s_addr, sizeof (ip->ip_dst.s_addr), AF_INET);
541 if (ignore_list_match (&c_src_addr))
542 return (0);
543 if (IPPROTO_UDP != ip->ip_p)
544 return 0;
545 memcpy(buf, (void *) ip + offset, len - offset);
546 if (0 == handle_udp((struct udphdr *) buf, len - offset))
547 return 0;
548 return 1;
549 }
551 #if HAVE_NET_IF_PPP_H
552 static int
553 handle_ppp(const u_char * pkt, int len)
554 {
555 char buf[PCAP_SNAPLEN];
556 unsigned short us;
557 unsigned short proto;
558 if (len < 2)
559 return 0;
560 if (*pkt == PPP_ADDRESS_VAL && *(pkt + 1) == PPP_CONTROL_VAL) {
561 pkt += 2; /* ACFC not used */
562 len -= 2;
563 }
564 if (len < 2)
565 return 0;
566 if (*pkt % 2) {
567 proto = *pkt; /* PFC is used */
568 pkt++;
569 len--;
570 } else {
571 memcpy(&us, pkt, sizeof(us));
572 proto = ntohs(us);
573 pkt += 2;
574 len -= 2;
575 }
576 if (ETHERTYPE_IP != proto && PPP_IP != proto)
577 return 0;
578 memcpy(buf, pkt, len);
579 return handle_ip((struct ip *) buf, len);
580 }
581 #endif /* HAVE_NET_IF_PPP_H */
583 static int
584 handle_null(const u_char * pkt, int len)
585 {
586 unsigned int family;
587 memcpy(&family, pkt, sizeof(family));
588 if (AF_INET != family)
589 return 0;
590 return handle_ip((struct ip *) (pkt + 4), len - 4);
591 }
593 #ifdef DLT_LOOP
594 static int
595 handle_loop(const u_char * pkt, int len)
596 {
597 unsigned int family;
598 memcpy(&family, pkt, sizeof(family));
599 if (AF_INET != ntohl(family))
600 return 0;
601 return handle_ip((struct ip *) (pkt + 4), len - 4);
602 }
604 #endif
606 #ifdef DLT_RAW
607 static int
608 handle_raw(const u_char * pkt, int len)
609 {
610 return handle_ip((struct ip *) pkt, len);
611 }
613 #endif
615 static int
616 handle_ether(const u_char * pkt, int len)
617 {
618 char buf[PCAP_SNAPLEN];
619 struct ether_header *e = (void *) pkt;
620 unsigned short etype = ntohs(e->ether_type);
621 if (len < ETHER_HDR_LEN)
622 return 0;
623 pkt += ETHER_HDR_LEN;
624 len -= ETHER_HDR_LEN;
625 if (ETHERTYPE_8021Q == etype) {
626 etype = ntohs(*(unsigned short *) (pkt + 2));
627 pkt += 4;
628 len -= 4;
629 }
630 if ((ETHERTYPE_IP != etype)
631 && (ETHERTYPE_IPV6 != etype))
632 return 0;
633 memcpy(buf, pkt, len);
634 if (ETHERTYPE_IPV6 == etype)
635 return (handle_ipv6 ((void *) buf, len));
636 else
637 return handle_ip((struct ip *) buf, len);
638 }
640 #ifdef DLT_LINUX_SLL
641 static int
642 handle_linux_sll (const u_char *pkt, int len)
643 {
644 struct sll_header
645 {
646 uint16_t pkt_type;
647 uint16_t dev_type;
648 uint16_t addr_len;
649 uint8_t addr[8];
650 uint16_t proto_type;
651 } *hdr;
652 uint16_t etype;
654 if ((0 > len) || ((unsigned int)len < sizeof (struct sll_header)))
655 return (0);
657 hdr = (struct sll_header *) pkt;
658 pkt = (u_char *) (hdr + 1);
659 len -= sizeof (struct sll_header);
661 etype = ntohs (hdr->proto_type);
663 if ((ETHERTYPE_IP != etype)
664 && (ETHERTYPE_IPV6 != etype))
665 return 0;
667 if (ETHERTYPE_IPV6 == etype)
668 return (handle_ipv6 ((void *) pkt, len));
669 else
670 return handle_ip((struct ip *) pkt, len);
671 }
672 #endif /* DLT_LINUX_SLL */
674 /* public function */
675 void handle_pcap(u_char *udata, const struct pcap_pkthdr *hdr, const u_char *pkt)
676 {
677 int status;
679 if (hdr->caplen < ETHER_HDR_LEN)
680 return;
682 switch (pcap_datalink (pcap_obj))
683 {
684 case DLT_EN10MB:
685 status = handle_ether (pkt, hdr->caplen);
686 break;
687 #if HAVE_NET_IF_PPP_H
688 case DLT_PPP:
689 status = handle_ppp (pkt, hdr->caplen);
690 break;
691 #endif
692 #ifdef DLT_LOOP
693 case DLT_LOOP:
694 status = handle_loop (pkt, hdr->caplen);
695 break;
696 #endif
697 #ifdef DLT_RAW
698 case DLT_RAW:
699 status = handle_raw (pkt, hdr->caplen);
700 break;
701 #endif
702 #ifdef DLT_LINUX_SLL
703 case DLT_LINUX_SLL:
704 status = handle_linux_sll (pkt, hdr->caplen);
705 break;
706 #endif
707 case DLT_NULL:
708 status = handle_null (pkt, hdr->caplen);
709 break;
711 default:
712 ERROR ("handle_pcap: unsupported data link type %d",
713 pcap_datalink(pcap_obj));
714 status = 0;
715 break;
716 } /* switch (pcap_datalink(pcap_obj)) */
718 if (0 == status)
719 return;
721 query_count_intvl++;
722 query_count_total++;
723 last_ts = hdr->ts;
724 }
725 #endif /* HAVE_PCAP_H */
727 const char *qtype_str(int t)
728 {
729 static char buf[32];
730 switch (t) {
731 #if (defined (__NAMESER)) && (__NAMESER >= 19991001)
732 case ns_t_a: return ("A");
733 case ns_t_ns: return ("NS");
734 case ns_t_md: return ("MD");
735 case ns_t_mf: return ("MF");
736 case ns_t_cname: return ("CNAME");
737 case ns_t_soa: return ("SOA");
738 case ns_t_mb: return ("MB");
739 case ns_t_mg: return ("MG");
740 case ns_t_mr: return ("MR");
741 case ns_t_null: return ("NULL");
742 case ns_t_wks: return ("WKS");
743 case ns_t_ptr: return ("PTR");
744 case ns_t_hinfo: return ("HINFO");
745 case ns_t_minfo: return ("MINFO");
746 case ns_t_mx: return ("MX");
747 case ns_t_txt: return ("TXT");
748 case ns_t_rp: return ("RP");
749 case ns_t_afsdb: return ("AFSDB");
750 case ns_t_x25: return ("X25");
751 case ns_t_isdn: return ("ISDN");
752 case ns_t_rt: return ("RT");
753 case ns_t_nsap: return ("NSAP");
754 case ns_t_nsap_ptr: return ("NSAP-PTR");
755 case ns_t_sig: return ("SIG");
756 case ns_t_key: return ("KEY");
757 case ns_t_px: return ("PX");
758 case ns_t_gpos: return ("GPOS");
759 case ns_t_aaaa: return ("AAAA");
760 case ns_t_loc: return ("LOC");
761 case ns_t_nxt: return ("NXT");
762 case ns_t_eid: return ("EID");
763 case ns_t_nimloc: return ("NIMLOC");
764 case ns_t_srv: return ("SRV");
765 case ns_t_atma: return ("ATMA");
766 case ns_t_naptr: return ("NAPTR");
767 case ns_t_kx: return ("KX");
768 case ns_t_cert: return ("CERT");
769 case ns_t_a6: return ("A6");
770 case ns_t_dname: return ("DNAME");
771 case ns_t_sink: return ("SINK");
772 case ns_t_opt: return ("OPT");
773 # if __NAMESER >= 19991006
774 case ns_t_tsig: return ("TSIG");
775 # endif
776 case ns_t_ixfr: return ("IXFR");
777 case ns_t_axfr: return ("AXFR");
778 case ns_t_mailb: return ("MAILB");
779 case ns_t_maila: return ("MAILA");
780 case ns_t_any: return ("ANY");
781 case ns_t_zxfr: return ("ZXFR");
782 /* #endif __NAMESER >= 19991006 */
783 #elif (defined (__BIND)) && (__BIND >= 19950621)
784 case T_A: return ("A"); /* 1 ... */
785 case T_NS: return ("NS");
786 case T_MD: return ("MD");
787 case T_MF: return ("MF");
788 case T_CNAME: return ("CNAME");
789 case T_SOA: return ("SOA");
790 case T_MB: return ("MB");
791 case T_MG: return ("MG");
792 case T_MR: return ("MR");
793 case T_NULL: return ("NULL");
794 case T_WKS: return ("WKS");
795 case T_PTR: return ("PTR");
796 case T_HINFO: return ("HINFO");
797 case T_MINFO: return ("MINFO");
798 case T_MX: return ("MX");
799 case T_TXT: return ("TXT");
800 case T_RP: return ("RP");
801 case T_AFSDB: return ("AFSDB");
802 case T_X25: return ("X25");
803 case T_ISDN: return ("ISDN");
804 case T_RT: return ("RT");
805 case T_NSAP: return ("NSAP");
806 case T_NSAP_PTR: return ("NSAP_PTR");
807 case T_SIG: return ("SIG");
808 case T_KEY: return ("KEY");
809 case T_PX: return ("PX");
810 case T_GPOS: return ("GPOS");
811 case T_AAAA: return ("AAAA");
812 case T_LOC: return ("LOC");
813 case T_NXT: return ("NXT");
814 case T_EID: return ("EID");
815 case T_NIMLOC: return ("NIMLOC");
816 case T_SRV: return ("SRV");
817 case T_ATMA: return ("ATMA");
818 case T_NAPTR: return ("NAPTR"); /* ... 35 */
819 #if (__BIND >= 19960801)
820 case T_KX: return ("KX"); /* 36 ... */
821 case T_CERT: return ("CERT");
822 case T_A6: return ("A6");
823 case T_DNAME: return ("DNAME");
824 case T_SINK: return ("SINK");
825 case T_OPT: return ("OPT");
826 case T_APL: return ("APL");
827 case T_DS: return ("DS");
828 case T_SSHFP: return ("SSHFP");
829 case T_RRSIG: return ("RRSIG");
830 case T_NSEC: return ("NSEC");
831 case T_DNSKEY: return ("DNSKEY"); /* ... 48 */
832 case T_TKEY: return ("TKEY"); /* 249 */
833 #endif /* __BIND >= 19960801 */
834 case T_TSIG: return ("TSIG"); /* 250 ... */
835 case T_IXFR: return ("IXFR");
836 case T_AXFR: return ("AXFR");
837 case T_MAILB: return ("MAILB");
838 case T_MAILA: return ("MAILA");
839 case T_ANY: return ("ANY"); /* ... 255 */
840 #endif /* __BIND >= 19950621 */
841 default:
842 ssnprintf (buf, sizeof (buf), "#%i", t);
843 return (buf);
844 }; /* switch (t) */
845 /* NOTREACHED */
846 return (NULL);
847 }
849 const char *opcode_str (int o)
850 {
851 static char buf[30];
852 switch (o) {
853 case 0:
854 return "Query";
855 break;
856 case 1:
857 return "Iquery";
858 break;
859 case 2:
860 return "Status";
861 break;
862 case 4:
863 return "Notify";
864 break;
865 case 5:
866 return "Update";
867 break;
868 default:
869 ssnprintf(buf, sizeof (buf), "Opcode%d", o);
870 return buf;
871 }
872 /* NOTREACHED */
873 }
875 const char *rcode_str (int rcode)
876 {
877 static char buf[32];
878 switch (rcode)
879 {
880 #if (defined (__NAMESER)) && (__NAMESER >= 19991006)
881 case ns_r_noerror: return ("NOERROR");
882 case ns_r_formerr: return ("FORMERR");
883 case ns_r_servfail: return ("SERVFAIL");
884 case ns_r_nxdomain: return ("NXDOMAIN");
885 case ns_r_notimpl: return ("NOTIMPL");
886 case ns_r_refused: return ("REFUSED");
887 case ns_r_yxdomain: return ("YXDOMAIN");
888 case ns_r_yxrrset: return ("YXRRSET");
889 case ns_r_nxrrset: return ("NXRRSET");
890 case ns_r_notauth: return ("NOTAUTH");
891 case ns_r_notzone: return ("NOTZONE");
892 case ns_r_max: return ("MAX");
893 case ns_r_badsig: return ("BADSIG");
894 case ns_r_badkey: return ("BADKEY");
895 case ns_r_badtime: return ("BADTIME");
896 /* #endif __NAMESER >= 19991006 */
897 #elif (defined (__BIND)) && (__BIND >= 19950621)
898 case NOERROR: return ("NOERROR");
899 case FORMERR: return ("FORMERR");
900 case SERVFAIL: return ("SERVFAIL");
901 case NXDOMAIN: return ("NXDOMAIN");
902 case NOTIMP: return ("NOTIMP");
903 case REFUSED: return ("REFUSED");
904 #if defined (YXDOMAIN) && defined (NXRRSET)
905 case YXDOMAIN: return ("YXDOMAIN");
906 case YXRRSET: return ("YXRRSET");
907 case NXRRSET: return ("NXRRSET");
908 case NOTAUTH: return ("NOTAUTH");
909 case NOTZONE: return ("NOTZONE");
910 #endif /* RFC2136 rcodes */
911 #endif /* __BIND >= 19950621 */
912 default:
913 ssnprintf (buf, sizeof (buf), "RCode%i", rcode);
914 return (buf);
915 }
916 /* Never reached */
917 return (NULL);
918 } /* const char *rcode_str (int rcode) */
920 #if 0
921 static int
922 main(int argc, char *argv[])
923 {
924 char errbuf[PCAP_ERRBUF_SIZE];
925 int x;
926 struct stat sb;
927 int readfile_state = 0;
928 struct bpf_program fp;
930 port53 = htons(53);
931 SubReport = Sources_report;
932 ignore_addr.s_addr = 0;
933 progname = strdup(strrchr(argv[0], '/') ? strchr(argv[0], '/') + 1 : argv[0]);
934 srandom(time(NULL));
935 ResetCounters();
937 while ((x = getopt(argc, argv, "ab:f:i:pst")) != -1) {
938 switch (x) {
939 case 'a':
940 anon_flag = 1;
941 break;
942 case 's':
943 sld_flag = 1;
944 break;
945 case 't':
946 nld_flag = 1;
947 break;
948 case 'p':
949 promisc_flag = 0;
950 break;
951 case 'b':
952 bpf_program_str = strdup(optarg);
953 break;
954 case 'i':
955 ignore_addr.s_addr = inet_addr(optarg);
956 break;
957 case 'f':
958 set_filter(optarg);
959 break;
960 default:
961 usage();
962 break;
963 }
964 }
965 argc -= optind;
966 argv += optind;
968 if (argc < 1)
969 usage();
970 device = strdup(argv[0]);
972 if (0 == stat(device, &sb))
973 readfile_state = 1;
974 if (readfile_state) {
975 pcap_obj = pcap_open_offline(device, errbuf);
976 } else {
977 pcap_obj = pcap_open_live(device, PCAP_SNAPLEN, promisc_flag, 1000, errbuf);
978 }
979 if (NULL == pcap_obj) {
980 fprintf(stderr, "pcap_open_*: %s\n", errbuf);
981 exit(1);
982 }
984 if (0 == isatty(1)) {
985 if (0 == readfile_state) {
986 fprintf(stderr, "Non-interactive mode requires savefile argument\n");
987 exit(1);
988 }
989 interactive = 0;
990 print_func = printf;
991 }
993 memset(&fp, '\0', sizeof(fp));
994 x = pcap_compile(pcap_obj, &fp, bpf_program_str, 1, 0);
995 if (x < 0) {
996 fprintf(stderr, "pcap_compile failed\n");
997 exit(1);
998 }
999 x = pcap_setfilter(pcap_obj, &fp);
1000 if (x < 0) {
1001 fprintf(stderr, "pcap_setfilter failed\n");
1002 exit(1);
1003 }
1005 /*
1006 * non-blocking call added for Mac OS X bugfix. Sent by Max Horn.
1007 * ref http://www.tcpdump.org/lists/workers/2002/09/msg00033.html
1008 */
1009 x = pcap_setnonblock(pcap_obj, 1, errbuf);
1010 if (x < 0) {
1011 fprintf(stderr, "pcap_setnonblock failed: %s\n", errbuf);
1012 exit(1);
1013 }
1015 switch (pcap_datalink(pcap_obj)) {
1016 case DLT_EN10MB:
1017 handle_datalink = handle_ether;
1018 break;
1019 #if HAVE_NET_IF_PPP_H
1020 case DLT_PPP:
1021 handle_datalink = handle_ppp;
1022 break;
1023 #endif
1024 #ifdef DLT_LOOP
1025 case DLT_LOOP:
1026 handle_datalink = handle_loop;
1027 break;
1028 #endif
1029 #ifdef DLT_RAW
1030 case DLT_RAW:
1031 handle_datalink = handle_raw;
1032 break;
1033 #endif
1034 case DLT_NULL:
1035 handle_datalink = handle_null;
1036 break;
1037 default:
1038 fprintf(stderr, "unsupported data link type %d\n",
1039 pcap_datalink(pcap_obj));
1040 return 1;
1041 break;
1042 }
1043 if (interactive) {
1044 init_curses();
1045 while (0 == Quit) {
1046 if (readfile_state < 2) {
1047 /*
1048 * On some OSes select() might return 0 even when
1049 * there are packets to process. Thus, we always
1050 * ignore its return value and just call pcap_dispatch()
1051 * anyway.
1052 */
1053 if (0 == readfile_state) /* interactive */
1054 pcap_select(pcap_obj, 1, 0);
1055 x = pcap_dispatch(pcap_obj, 50, handle_pcap, NULL);
1056 }
1057 if (0 == x && 1 == readfile_state) {
1058 /* block on keyboard until user quits */
1059 readfile_state++;
1060 nodelay(w, 0);
1061 }
1062 keyboard();
1063 cron_pre();
1064 report();
1065 cron_post();
1066 }
1067 endwin(); /* klin, Thu Nov 28 08:56:51 2002 */
1068 } else {
1069 while (pcap_dispatch(pcap_obj, 50, handle_pcap, NULL))
1070 (void) 0;
1071 cron_pre();
1072 Sources_report(); print_func("\n");
1073 Destinatioreport(); print_func("\n");
1074 Qtypes_report(); print_func("\n");
1075 Opcodes_report(); print_func("\n");
1076 Tld_report(); print_func("\n");
1077 Sld_report(); print_func("\n");
1078 Nld_report(); print_func("\n");
1079 SldBySource_report();
1080 }
1082 pcap_close(pcap_obj);
1083 return 0;
1084 } /* static int main(int argc, char *argv[]) */
1085 #endif
1086 /*
1087 * vim:shiftwidth=4:tabstop=8:softtabstop=4
1088 */