1 /*
2 * ZMap Copyright 2013 Regents of the University of Michigan
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License"); you may not
5 * use this file except in compliance with the License. You may obtain a copy
6 * of the License at http://www.apache.org/licenses/LICENSE-2.0
7 */
8
9 #include <stdio.h>
10 #include <string.h>
11 #include <assert.h>
12 #include <time.h>
13 #include <sys/time.h>
14
15 #include "../../lib/includes.h"
16 #include "../../lib/logger.h"
17 #include "../../lib/xalloc.h"
18 #include "../fieldset.h"
19 #include "probe_modules.h"
20 #include "packet.h"
21
22 extern probe_module_t module_tcp_synscan;
23 extern probe_module_t module_icmp_echo;
24 extern probe_module_t module_icmp_echo_time;
25 extern probe_module_t module_udp;
26 extern probe_module_t module_ntp;
27 extern probe_module_t module_upnp;
28 // ADD YOUR MODULE HERE
29
30 probe_module_t* probe_modules[] = {
31 &module_tcp_synscan,
32 &module_icmp_echo,
33 &module_icmp_echo_time,
34 &module_udp,
35 &module_ntp,
36 &module_upnp
37 // ADD YOUR MODULE HERE
38 };
39
get_probe_module_by_name(const char * name)40 probe_module_t* get_probe_module_by_name(const char* name)
41 {
42 int len = (int) (sizeof(probe_modules)/sizeof(probe_modules[0]));
43 for (int i=0; i < len; i++) {
44 if (!strcmp(probe_modules[i]->name, name)) {
45 return probe_modules[i];
46 }
47 }
48 return NULL;
49 }
50
print_probe_modules(void)51 void print_probe_modules(void)
52 {
53 int len = (int) (sizeof(probe_modules)/sizeof(probe_modules[0]));
54 for (int i=0; i < len; i++) {
55 printf("%s\n", probe_modules[i]->name);
56 }
57 }
58
59
fs_add_ip_fields(fieldset_t * fs,struct ip * ip)60 void fs_add_ip_fields(fieldset_t *fs, struct ip *ip)
61 {
62 // WARNING: you must update fs_ip_fields_len as well
63 // as the definitions set (ip_fiels) if you
64 // change the fields added below:
65 fs_add_string(fs, "saddr", make_ip_str(ip->ip_src.s_addr), 1);
66 fs_add_uint64(fs, "saddr-raw", (uint64_t) ip->ip_src.s_addr);
67 fs_add_string(fs, "daddr", make_ip_str(ip->ip_dst.s_addr), 1);
68 fs_add_uint64(fs, "daddr-raw", (uint64_t) ip->ip_dst.s_addr);
69 fs_add_uint64(fs, "ipid", ntohs(ip->ip_id));
70 fs_add_uint64(fs, "ttl", ip->ip_ttl);
71 }
72
73 #define TIMESTR_LEN 55
74
fs_add_system_fields(fieldset_t * fs,int is_repeat,int in_cooldown)75 void fs_add_system_fields(fieldset_t *fs, int is_repeat, int in_cooldown)
76 {
77 fs_add_uint64(fs, "repeat", is_repeat);
78 fs_add_uint64(fs, "cooldown", in_cooldown);
79
80 char *timestr = xmalloc(TIMESTR_LEN+1);
81 char *timestr_ms = xmalloc(TIMESTR_LEN+1);
82 struct timeval t;
83 gettimeofday(&t, NULL);
84 struct tm *ptm = localtime(&t.tv_sec);
85 strftime(timestr, TIMESTR_LEN, "%Y-%m-%dT%H:%M:%S.%%03d%z", ptm);
86 snprintf(timestr_ms, TIMESTR_LEN, timestr, t.tv_usec/1000);
87 free(timestr);
88 fs_add_string(fs, "timestamp-str", timestr_ms, 1);
89 fs_add_uint64(fs, "timestamp-ts", (uint64_t) t.tv_sec);
90 fs_add_uint64(fs, "timestamp-us", (uint64_t) t.tv_usec);
91 }
92
93 int ip_fields_len = 6;
94 fielddef_t ip_fields[] = {
95 {.name="saddr", .type="string", .desc="source IP address of response"},
96 {.name="saddr-raw", .type="int", .desc="network order integer form of source IP address"},
97 {.name="daddr", .type="string", .desc="destination IP address of response"},
98 {.name="daddr-raw", .type="int", .desc="network order integer form of destination IP address"},
99 {.name="ipid", .type="int", .desc="IP identification number of response"},
100 {.name="ttl", .type="int", .desc="time-to-live of response packet"}
101 };
102
103 int sys_fields_len = 5;
104 fielddef_t sys_fields[] = {
105 {.name="repeat", .type="int", .desc="Is response a repeat response from host"},
106 {.name="cooldown", .type="int", .desc="Was response received during the cooldown period"},
107 {.name="timestamp-str", .type="string", .desc="timestamp of when response arrived in ISO8601 format."},
108 {.name="timestamp-ts", .type="int", .desc="timestamp of when response arrived in seconds since Epoch"},
109 {.name="timestamp-us", .type="int", .desc="microsecond part of timestamp (e.g. microseconds since 'timestamp-ts')"}
110 };
111
112