#include #include #include #include #include "byteorder.h" #include "bpf.h" #include "bpf_filter.rts.h" #ifndef Linux2 #define Linux2 #endif int (*spec) (char *,u_int,u_int); /* prototype de la fonction specialisee test0 */ extern unsigned int _Gtop_1_0_0(unsigned char *, unsigned int, unsigned int); /* static struct bpf_insn dummy_program[] = {{BPF_LD|BPF_H|BPF_ABS / 40 = 0x28 /, 0, 0, 12}, {BPF_JMP|BPF_JEQ|BPF_K / 21 = 0x15 /, 1, 0, 0x800}, {BPF_LD|BPF_B|BPF_ABS , 0, 0, 23}, {BPF_JMP|BPF_JEQ|BPF_K , 0, 0, 0x11}, {BPF_LD|BPF_W|BPF_ABS , 0, 0, 26}, {BPF_JMP|BPF_JEQ|BPF_K , 0, 2, 0x281a}, {BPF_LD|BPF_W|BPF_ABS , 0, 0, 30}, {BPF_JMP|BPF_JEQ|BPF_K , 3, 4, 0x322c}, {BPF_JMP|BPF_JEQ|BPF_K , 0, 3, 0x322c}, {BPF_LD|BPF_W|BPF_ABS , 0, 0, 30}, {BPF_JMP|BPF_JEQ|BPF_K , 0, 1, 0x281a}, {BPF_RET|BPF_K 6 = 0x06 /, 0, 0, 68}, {BPF_RET|BPF_K 6 = 0x06 /, 0, 0, 0} };*/ /* Filtre de recherche des adresses IP : Source : 131.254.50.18 = 0x83.FE.32.12 Dest : 131.254.50.11 = 0x83.FE.32.0B */ static struct bpf_insn dummy_program2[] = {{BPF_LD|BPF_H|BPF_ABS , 0, 0, 12}, /* A <-P[12:2] */ {BPF_JMP|BPF_JEQ|BPF_K , 0, 7, 0x83FE}, /* pc+=(A==0x83FE)?0:3 */ {BPF_LD|BPF_H|BPF_ABS , 0, 0, 14}, /* A <-P[12:2] */ {BPF_JMP|BPF_JEQ|BPF_K , 0, 5, 0x3212}, /* pc+=(A==3212)?0:3 */ {BPF_LD|BPF_H|BPF_ABS , 0, 0, 16}, /* A <-P[16:2] */ {BPF_JMP|BPF_JEQ|BPF_K , 0, 3, 0x83FE}, /* pc+=(A==0x83FE)?0:1 */ {BPF_LD|BPF_H|BPF_ABS , 0, 0, 18}, /* A <-P[18:2] */ {BPF_JMP|BPF_JEQ|BPF_K , 0, 1, 0x320B}, /* pc+=(A==0x320B)?0:1 */ {BPF_RET|BPF_K , 0, 0, 1}, /* RET 1 */ {BPF_RET|BPF_K , 0, 0, 0} /* RET 0 */ }; /* Filtre de recherche des adresses IP : Source : 131.254.50.11 = 0x83.FE.32.12 */ static struct bpf_insn dummy_program3[] = {{BPF_LD|BPF_H|BPF_ABS , 0, 0, 12}, /* A <-P[12:2] */ {BPF_JMP|BPF_JEQ|BPF_K , 0, 3, 0x83FE}, /* pc+=(A==0x83FE)?0:3 */ {BPF_LD|BPF_H|BPF_ABS , 0, 0, 14}, /* A <-P[14:2] */ {BPF_JMP|BPF_JEQ|BPF_K , 0, 1, 0x320B}, /* pc+=(A==3212)?0:3 */ {BPF_RET|BPF_K , 0, 0, 1}, /* RET 1 */ {BPF_RET|BPF_K , 0, 0, 0} /* RET 0 */ }; /* Filtre de recherche des adresses IP : Source : 131.254.50.11 = 0x83.FE.32.12 */ static struct bpf_insn dummy_program[] = {{BPF_LD|BPF_H|BPF_ABS , 0, 0, 14}, /* A <-P[14:2] */ {BPF_JMP|BPF_JEQ|BPF_K , 0, 1, 0x320B}, /* pc+=(A==3212)?0:3 */ {BPF_RET|BPF_K , 0, 0, 1}, /* RET 1 */ {BPF_RET|BPF_K , 0, 0, 0} /* RET 0 */ }; u_int top_0(u_char *p, u_int wirelen, u_int buflen) { return _bpf_filter(dummy_program,p,wirelen,buflen); } void dump_code(char *pt_code,int size) { FILE *pt_file; pt_file=fopen("DumpCode.o","w"); fwrite(pt_code,size,1,pt_file); fclose(pt_file); } void DecodeIP(char *buf) { printf ("%d.%d.%d.%d \n", * (unsigned char *) buf, * (unsigned char *) buf+1, * (unsigned char *) buf+2, * (unsigned char *) buf+3); } struct sb_hdr { u_int sbh_origlen; u_int sbh_msglen; u_int sbh_totlen; u_int sbh_drops; struct timeval sbh_timestamp; }; void main() { FILE *pf; int cnt,sz,i; struct sb_hdr nhdr; char buf[10000]; /* Specialisation de la fonction test5 */ /*spec=(u_int (*)(u_char *,u_int,u_int)) (rts_top_1());*/ u_int (*spec) (u_char *,u_int,u_int); spec=rts_top_1(); dump_code((char *)spec,1000); /* Lecture d'une trame internet */ pf=fopen("packets","rb"); if (pf!=NULL) { cnt=fread(&nhdr,sizeof(nhdr),1,pf); while (cnt==1) { sz=ntohl(nhdr.sbh_msglen); fread(buf,1,sz,pf); printf ("Orig =%u CTspec=%u RTspec=%u\n", top_0(buf+14,sz-14,sz-14), _Gtop_1_0_0(buf+14,sz-14,sz-14), (*spec)(buf+14,sz-14,sz-14)); if ((ntohl(nhdr.sbh_totlen)-(sz+sizeof(nhdr)))>0) /* skip padding */ fread(buf,1,ntohl(nhdr.sbh_totlen)-(sz+sizeof(nhdr)),pf); cnt=fread(&nhdr,sizeof(nhdr),1,pf); } } fclose(pf); }