| ... | ... |
@@ -232,9 +232,10 @@ void inodelist_insert_if_not_with_hashkey(uint32_t inodeval, const char *hashkey |
| 232 | 232 |
inodelist_t* inodelist_find_hashkey(const char *hashkey) {
|
| 233 | 233 |
inodelist_t* current = head; |
| 234 | 234 |
while(current != NULL) {
|
| 235 |
- if( 0 == strcmp(current->data.hashkey, hashkey) ) {
|
|
| 235 |
+ if (strcmp(current->data.hashkey, hashkey) == 0) {
|
|
| 236 | 236 |
return current; |
| 237 |
- } else if ( 0 == strcmp(current->data.hashkey2, hashkey) ) {
|
|
| 237 |
+ } |
|
| 238 |
+ if (strcmp(current->data.hashkey2, hashkey) == 0) {
|
|
| 238 | 239 |
return current; |
| 239 | 240 |
} |
| 240 | 241 |
current = current->next; |
| ... | ... |
@@ -142,45 +142,19 @@ void pcap_loop_cb(u_char *useless,const struct pcap_pkthdr* header,const u_char* |
| 142 | 142 |
str_ip_dst, |
| 143 | 143 |
ntohs(udp_header->uh_dport)); |
| 144 | 144 |
|
| 145 |
- //~ inodelist_debug_display_forward(); |
|
| 146 |
- |
|
| 147 |
- //Search packet hashkey in the inodelist |
|
| 145 |
+ // The lookup checks both the local and reverse connection keys. |
|
| 148 | 146 |
inodelist_t *result = inodelist_find_hashkey(hashkey); |
| 149 |
- if( NULL != result ) {
|
|
| 150 |
- //Dump into its own file |
|
| 151 |
- |
|
| 152 |
- //~ printf("\n\t\t%s FOR\n", result->data.cmdline);
|
|
| 153 |
- printf("\r\033[K#%" PRIu64 " %s\n", st_packet_num, result->data.cmdline);
|
|
| 147 |
+ if (result != NULL) {
|
|
| 148 |
+ bool reverse = strcmp(result->data.hashkey2, hashkey) == 0; |
|
| 149 |
+ printf("\r\033[K#%" PRIu64 " %s%s\n", st_packet_num,
|
|
| 150 |
+ result->data.cmdline, reverse ? " reverse" : ""); |
|
| 154 | 151 |
print_capture_progress(); |
| 155 |
- //~ if( NULL != result->data.dumper ) {
|
|
| 156 |
- //~ pcap_dump((uint8_t*)result->data.dumper, |
|
| 157 |
- //~ (const struct pcap_pkthdr*)header, |
|
| 158 |
- //~ (uint8_t*)packet); |
|
| 159 |
- //~ pcap_dump_flush(result->data.dumper); |
|
| 160 |
- //~ } |
|
| 161 |
- if( NULL != result->data.mydumper ) {
|
|
| 152 |
+ if (result->data.mydumper != NULL) {
|
|
| 162 | 153 |
mypcap_dump(result->data.mydumper, |
| 163 | 154 |
(const struct pcap_pkthdr*)header, |
| 164 | 155 |
(uint8_t*)packet); |
| 165 | 156 |
mypcap_flush(result->data.mydumper); |
| 166 | 157 |
} |
| 167 |
- } else {
|
|
| 168 |
- snprintf(hashkey, HASHKEYSIZE * sizeof(char), "%s:%d-%s:%d", |
|
| 169 |
- str_ip_src, |
|
| 170 |
- ntohs(udp_header->uh_sport), |
|
| 171 |
- str_ip_dst, |
|
| 172 |
- ntohs(udp_header->uh_dport)); |
|
| 173 |
- result = inodelist_find_hashkey(hashkey); |
|
| 174 |
- if( NULL != result ) {
|
|
| 175 |
- printf("\r\033[K#%" PRIu64 " %s reverse\n", st_packet_num, result->data.cmdline);
|
|
| 176 |
- print_capture_progress(); |
|
| 177 |
- if( NULL != result->data.mydumper ) {
|
|
| 178 |
- mypcap_dump(result->data.mydumper, |
|
| 179 |
- (const struct pcap_pkthdr*)header, |
|
| 180 |
- (uint8_t*)packet); |
|
| 181 |
- mypcap_flush(result->data.mydumper); |
|
| 182 |
- } |
|
| 183 |
- } |
|
| 184 | 158 |
} |
| 185 | 159 |
} |
| 186 | 160 |
|