|
| 1 | +/* |
| 2 | +* pibs - Passive Identification of BackScatter |
| 3 | +* |
| 4 | +* Copyright (C) 2019 Gerard Wagener |
| 5 | +* Copyright (C) 2019 CIRCL Computer Incident Response Center Luxembourg |
| 6 | +* (SMILE gie). |
| 7 | +* |
| 8 | +* This program is free software: you can redistribute it and/or modify |
| 9 | +* it under the terms of the GNU Affero General Public License as published by |
| 10 | +* the Free Software Foundation, either version 3 of the License, or |
| 11 | +* (at your option) any later version. |
| 12 | +* |
| 13 | +* This program is distributed in the hope that it will be useful, |
| 14 | +* but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 15 | +* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 16 | +* GNU Affero General Public License for more details. |
| 17 | +* |
| 18 | +* You should have received a copy of the GNU Affero General Public License |
| 19 | +* along with this program. If not, see <http://www.gnu.org/licenses/>. |
| 20 | +*/ |
| 21 | + |
| 22 | +#include "pibs.h" |
| 23 | +//TODO when attaching the next_item must be recovered if results |
| 24 | +//of previous runs need to be increased |
| 25 | +/* |
| 26 | + * Returns -1 if not found |
| 27 | + * returns last timestamp if found |
| 28 | + */ |
| 29 | +int_fast64_t get_last_timestamp(pibs_t* pibs, uint32_t ip) |
| 30 | +{ |
| 31 | + uint32_t idx; |
| 32 | + uint32_t i; |
| 33 | + //TODO explore alternative hashing functions |
| 34 | + //https://stackoverflow.com/questions/664014/what-integer-hash-function-are-good-that-accepts-an-integer-hash-key/12996028#12996028 |
| 35 | + idx = ip % NBINS; |
| 36 | + HDBG("[TS] Checking for IP %x at index = %d\n", ip, idx); |
| 37 | + i = pibs->bin_table[idx]; |
| 38 | + while (i){ |
| 39 | + if (pibs->items[i].ipaddr == ip) { |
| 40 | + HDBG("[TS] Found item %x at position %d\n", ip , i); |
| 41 | + return pibs->items[i].timestamp; |
| 42 | + } |
| 43 | + i = pibs->items[i].next_item; |
| 44 | + } |
| 45 | + HDBG("[TS] IP: %x was not found return -1\n",ip); |
| 46 | + return -1; |
| 47 | +} |
| 48 | + |
| 49 | +void insert_ip(pibs_t* pibs, uint32_t ip, uint32_t ts) |
| 50 | +{ |
| 51 | + uint32_t idx; |
| 52 | + uint32_t i; |
| 53 | + uint32_t parent; |
| 54 | + |
| 55 | + idx = ip % NBINS; |
| 56 | + HDBG("[INS] Lookup IP address %x. Hashed value: %d\n", ip, idx); |
| 57 | + parent = 0; |
| 58 | + if (pibs->bin_table[idx]){ |
| 59 | + // There is already someone in the bin |
| 60 | + i = pibs->bin_table[idx]; |
| 61 | + HDBG("[INS] Starting searching at position %d\n", i); |
| 62 | + do { |
| 63 | + HDBG("[INS] Iterating items at index %d. Current position: %d.\ |
| 64 | + Next position = %d\n", |
| 65 | + idx,i,pibs->items[i].next_item); |
| 66 | + HDBG("[INS] Checking IP at address %p\n",&pibs->items[i]); |
| 67 | + if (pibs->items[i].ipaddr == ip) { |
| 68 | + HDBG("[INS] Found item %x at position %d\n", ip , i); |
| 69 | + HDBG("[INS] New timestamp for ip %x is %d\n",ip,ts); |
| 70 | + pibs->items[i].timestamp = ts; |
| 71 | + return; |
| 72 | + } |
| 73 | + parent = i; |
| 74 | + i = pibs->items[i].next_item; |
| 75 | + } while (i != 0 ); |
| 76 | + HDBG("[INS] The IP %x was not found in the item list, last parent %d\n", |
| 77 | + ip, parent); |
| 78 | + } |
| 79 | + // The IP was not found in an item list or the hashed value wsa not present |
| 80 | + // in the bin table, so create a new item |
| 81 | + pibs->next_item++; |
| 82 | + if (pibs->next_item > pibs->max_item) { |
| 83 | + printf("FIXME run out of memory. Do something better than abort\n"); |
| 84 | + //Go through old timestamps and keep linked list of stuff that can be |
| 85 | + //reused or do kind of defragmentation |
| 86 | + abort(); |
| 87 | + } |
| 88 | + if (pibs->bin_table[idx] == 0) { |
| 89 | + pibs->bin_table[idx] = pibs->next_item; |
| 90 | + } |
| 91 | + HDBG("[INS] Insert ip %x at position %d, parent = %d\n", ip, |
| 92 | + pibs->next_item,parent); |
| 93 | + pibs->items[pibs->next_item].ipaddr = ip; |
| 94 | + pibs->items[pibs->next_item].timestamp = ts; |
| 95 | + if (parent) { |
| 96 | + pibs->items[parent].next_item = pibs->next_item; |
| 97 | + } |
| 98 | +} |
| 99 | + |
| 100 | +void pibs_dump_raw(pibs_t* pibs) |
| 101 | +{ |
| 102 | + int i; |
| 103 | + printf("#RAW table dump\n"); |
| 104 | + printf("#Index next_item\n"); |
| 105 | + printf("#BINs\n"); |
| 106 | + for (i=0; i< NBINS; i++) { |
| 107 | + printf("%d %d\n", i, pibs->bin_table[i]); |
| 108 | + } |
| 109 | + printf("#ITEMS\n"); |
| 110 | + printf("#Index next_item, timestamp, ipaddr\n"); |
| 111 | + for (i=0; i < NBINITEMS * NBINS; i++) { |
| 112 | + printf("%d %d %d %x\n", i, pibs->items[i].next_item, |
| 113 | + pibs->items[i].timestamp, |
| 114 | + pibs->items[i].ipaddr); |
| 115 | + } |
| 116 | +} |
| 117 | + |
| 118 | +void pibs_dump_stats(pibs_t* pibs) |
| 119 | +{ |
| 120 | + int i; |
| 121 | + int j; |
| 122 | + int cnt; |
| 123 | + uint64_t sum; |
| 124 | + sum = 0; |
| 125 | + printf("#Bin table\n"); |
| 126 | + printf("#Bin number, Item offset, number of items\n"); |
| 127 | + for (i=0; i < NBINS; i++) { |
| 128 | + j= pibs->bin_table[i]; |
| 129 | + cnt = 0; |
| 130 | + while (j) { |
| 131 | + cnt++; |
| 132 | + j=pibs->items[j].next_item; |
| 133 | + } |
| 134 | + sum+=cnt; |
| 135 | + printf("%d %d %d\n", i, pibs->bin_table[i], cnt); |
| 136 | + } |
| 137 | + printf("#Number of unique IP addresses: %ld\n", sum); |
| 138 | +} |
0 commit comments