chg: [pibs-isn] apply isn matching rule on all packets

bin/Makefile

@@ -1,4 +1,4 @@
-all:	pibs pibs-stat pibs-BGP-Ranking
+all:	pibs pibs-stat pibs-BGP-Ranking pibs-isn
 
 pibs-stat:	pibs-stat.o libpibs.o memutils.o synseen.o
 	gcc -Wall -o pibs-stat pibs-stat.o libpibs.o memutils.o synseen.o -lwiretap `pkg-config --libs glib-2.0` -lpcap -lhiredis -ggdb
@@ -7,6 +7,12 @@ pibs-stat:	pibs-stat.o libpibs.o memutils.o synseen.o
 pibs-stat.o:	pibs-stat.c
 	gcc -D HASHDEBUG=0 -Wall -c pibs-stat.c  `pkg-config --cflags glib-2.0` -I /usr/include/wireshark/wiretap -I /usr/include/wireshark/wsutil -I /usr/include/wireshark `pkg-config --libs glib-2.0` -I /usr/local/include/hiredis -ggdb
 
+pibs-isn:	pibs-isn.o libpibs.o memutils.o synseen.o
+	gcc -Wall -o pibs-isn pibs-isn.o libpibs.o memutils.o synseen.o -lwiretap `pkg-config --libs glib-2.0` -lpcap -lhiredis -ggdb
+
+pibs-stat.o:	pibs-isn.c
+	gcc -D HASHDEBUG=0 -Wall -c pibs-isn.c  `pkg-config --cflags glib-2.0` -I /usr/include/wireshark/wiretap -I /usr/include/wireshark/wsutil -I /usr/include/wireshark `pkg-config --libs glib-2.0` -I /usr/local/include/hiredis -ggdb
+
 pibs-BGP-Ranking:	pibs pibs-BGP-Ranking.o libpibs.o memutils.o synseen.o
 	gcc -Wall -o pibs-BGP-Ranking pibs-BGP-Ranking.o libpibs.o memutils.o synseen.o -lwiretap `pkg-config --libs glib-2.0` -lpcap -lhiredis -ggdb
 

bin/pibs-isn.c

@@ -0,0 +1,76 @@
+/*
+* pibs - Create lists of isn having the same value than ip address
+*
+* Copyright (C) 2020 Gerard Wagener
+* Copyright (C) 2020 CIRCL Computer Incident Response Center Luxembourg
+* (SMILE gie).
+*
+* This program is free software: you can redistribute it and/or modify
+* it under the terms of the GNU Affero General Public License as published by
+* the Free Software Foundation, either version 3 of the License, or
+* (at your option) any later version.
+*
+* This program is distributed in the hope that it will be useful,
+* but WITHOUT ANY WARRANTY; without even the implied warranty of
+* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+* GNU Affero General Public License for more details.
+*
+* You should have received a copy of the GNU Affero General Public License
+* along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+#include <stdio.h>
+#define __USE_XOPEN
+#include <time.h>
+#include "pibs.h"
+
+void usage(void)
+{
+    printf("Create lists of targets under SYN floods for BGP Ranking\n");
+    printf("\n");
+    printf("OPTIONS\n");
+    printf("    -h Shows this screen\n");
+    printf("    -r inputfile\n");
+    printf("       Read pcap file from inputfile\n");
+    printf("\n");
+    printf("DIRECTORY STRUCTURE\n");
+    printf("<directory>/port/year/month/year-month-day.txt\n");
+}
+
+void process(pibs_t* pibs, wtap *wth, uint8_t* eth,
+struct ip* ipv4, struct tcphdr* tcp)
+{
+    if (ipv4->ip_dst.s_addr == tcp->seq) {
+        printf("%x\n",ntohl(tcp->seq));
+    }
+}
+
+int main(int argc, char* argv[])
+{
+    pibs_t* pibs;
+    int opt;
+    pibs  = init();
+
+    while ((opt = getopt(argc, argv, "hr:d:")) != -1) {
+        printf("%d\n", opt);
+        switch (opt) {
+            case 'h':
+                usage();
+                break;
+            case 'r':
+                strncpy(pibs->filename, optarg, FILENAME_MAX);
+                pibs->filename[FILENAME_MAX-1] = '\0';
+                break;
+        }
+    }
+
+    //Bypass synseen logic to get all TCP packets
+    pibs->bypass = 1;
+    //Set call back function
+    pibs->synseen_callback = &process;
+
+    if (pibs->filename[0]) {
+        process_file(pibs);
+    }
+
+    return EXIT_SUCCESS;
+}

bin/pibs.h

@@ -112,6 +112,7 @@ typedef struct pibs_s {
     pcap_t* outcap;
     uint32_t redisdb;
     void* synseen_callback;
+    int bypass;
 } pibs_t;
 
 int load_shmid_file(pibs_t* pibs);

bin/synseen.c

@@ -145,6 +145,7 @@ void synseen_process_frame(pibs_t *pibs, wtap *wth, uint8_t* eth,
     uint32_t ip;
     struct pcap_pkthdr pchdr;
     memcpy(&ip, &ipv4->ip_src, 4);
+    if (!pibs->bypass) {
         // Record only source ips where syn flag is set
         // TODO check other connection establishment alternatives
         if (tcp->th_flags  == 2 ){
@@ -175,6 +176,7 @@ void synseen_process_frame(pibs_t *pibs, wtap *wth, uint8_t* eth,
             pchdr.len =  wth->rec.rec_header.packet_header.len;
             pcap_dump((u_char*)pibs->dumper, &pchdr, eth);
         }
+    }
     if (pibs->synseen_callback) {
         synseen_callback = pibs->synseen_callback;
         synseen_callback(pibs, wth, eth, ipv4, tcp);