const char *get_conversation_filter(conv_item_t *conv_item, conv_direction_e direction)
{
char *sport, *dport;
const char *str = "INVALID";
sport = ct_port_to_str(conv_item->ptype, conv_item->src_port);
dport = ct_port_to_str(conv_item->ptype, conv_item->dst_port);
switch(direction){
case CONV_DIR_A_TO_FROM_B:
/* A <-> B */
str = ep_strdup_printf("%s==%s%s%s%s%s && %s==%s%s%s%s%s",
conversation_get_filter_name(conv_item, CONV_FT_ANY_ADDRESS),
ep_address_to_str(&conv_item->src_address),
sport?" && ":"",
sport?conversation_get_filter_name(conv_item, CONV_FT_ANY_PORT):"",
sport?"==":"",
sport?sport:"",
conversation_get_filter_name(conv_item, CONV_FT_ANY_ADDRESS),
ep_address_to_str(&conv_item->dst_address),
dport?" && ":"",
dport?conversation_get_filter_name(conv_item, CONV_FT_ANY_PORT):"",
dport?"==":"",
dport?dport:""
);
break;
case CONV_DIR_A_TO_B:
/* A --> B */
str = ep_strdup_printf("%s==%s%s%s%s%s && %s==%s%s%s%s%s",
conversation_get_filter_name(conv_item, CONV_FT_SRC_ADDRESS),
ep_address_to_str(&conv_item->src_address),
sport?" && ":"",
sport?conversation_get_filter_name(conv_item, CONV_FT_SRC_PORT):"",
sport?"==":"",
sport?sport:"",
conversation_get_filter_name(conv_item, CONV_FT_DST_ADDRESS),
ep_address_to_str(&conv_item->dst_address),
dport?" && ":"",
dport?conversation_get_filter_name(conv_item, CONV_FT_DST_PORT):"",
dport?"==":"",
dport?dport:""
);
break;
case CONV_DIR_A_FROM_B:
/* A <-- B */
str = ep_strdup_printf("%s==%s%s%s%s%s && %s==%s%s%s%s%s",
conversation_get_filter_name(conv_item, CONV_FT_DST_ADDRESS),
ep_address_to_str(&conv_item->src_address),
sport?" && ":"",
sport?conversation_get_filter_name(conv_item, CONV_FT_DST_PORT):"",
sport?"==":"",
sport?sport:"",
conversation_get_filter_name(conv_item, CONV_FT_SRC_ADDRESS),
ep_address_to_str(&conv_item->dst_address),
dport?" && ":"",
dport?conversation_get_filter_name(conv_item, CONV_FT_SRC_PORT):"",
dport?"==":"",
dport?dport:""
);
break;
case CONV_DIR_A_TO_FROM_ANY:
/* A <-> ANY */
str = ep_strdup_printf("%s==%s%s%s%s%s",
conversation_get_filter_name(conv_item, CONV_FT_ANY_ADDRESS),
ep_address_to_str(&conv_item->src_address),
sport?" && ":"",
sport?conversation_get_filter_name(conv_item, CONV_FT_ANY_PORT):"",
sport?"==":"",
sport?sport:""
);
break;
case CONV_DIR_A_TO_ANY:
/* A --> ANY */
str = ep_strdup_printf("%s==%s%s%s%s%s",
conversation_get_filter_name(conv_item, CONV_FT_SRC_ADDRESS),
ep_address_to_str(&conv_item->src_address),
sport?" && ":"",
sport?conversation_get_filter_name(conv_item, CONV_FT_SRC_PORT):"",
sport?"==":"",
sport?sport:""
);
break;
case CONV_DIR_A_FROM_ANY:
/* A <-- ANY */
str = ep_strdup_printf("%s==%s%s%s%s%s",
conversation_get_filter_name(conv_item, CONV_FT_DST_ADDRESS),
ep_address_to_str(&conv_item->src_address),
sport?" && ":"",
sport?conversation_get_filter_name(conv_item, CONV_FT_DST_PORT):"",
sport?"==":"",
sport?sport:""
);
break;
case CONV_DIR_ANY_TO_FROM_B:
/* ANY <-> B */
str = ep_strdup_printf("%s==%s%s%s%s%s",
conversation_get_filter_name(conv_item, CONV_FT_ANY_ADDRESS),
ep_address_to_str(&conv_item->dst_address),
dport?" && ":"",
dport?conversation_get_filter_name(conv_item, CONV_FT_ANY_PORT):"",
dport?"==":"",
dport?dport:""
);
break;
case CONV_DIR_ANY_FROM_B:
/* ANY <-- B */
str = ep_strdup_printf("%s==%s%s%s%s%s",
conversation_get_filter_name(conv_item, CONV_FT_SRC_ADDRESS),
ep_address_to_str(&conv_item->dst_address),
dport?" && ":"",
dport?conversation_get_filter_name(conv_item, CONV_FT_SRC_PORT):"",
dport?"==":"",
dport?dport:""
);
break;
case CONV_DIR_ANY_TO_B:
/* ANY --> B */
str = ep_strdup_printf("%s==%s%s%s%s%s",
conversation_get_filter_name(conv_item, CONV_FT_DST_ADDRESS),
ep_address_to_str(&conv_item->dst_address),
dport?" && ":"",
dport?conversation_get_filter_name(conv_item, CONV_FT_DST_PORT):"",
dport?"==":"",
dport?dport:""
);
break;
default:
break;
}
g_free(sport);
g_free(dport);
return str;
}
char *get_conversation_filter(conv_item_t *conv_item, conv_direction_e direction)
{
char *sport, *dport, *src_addr, *dst_addr;
char *str;
sport = ct_port_to_str(conv_item->ptype, conv_item->src_port);
dport = ct_port_to_str(conv_item->ptype, conv_item->dst_port);
src_addr = address_to_str(NULL, &conv_item->src_address);
dst_addr = address_to_str(NULL, &conv_item->dst_address);
if (conv_item->src_address.type == AT_STRINGZ || conv_item->src_address.type == AT_USB) {
char *new_addr;
new_addr = wmem_strdup_printf(NULL, "\"%s\"", src_addr);
wmem_free(NULL, src_addr);
src_addr = new_addr;
}
if (conv_item->dst_address.type == AT_STRINGZ || conv_item->dst_address.type == AT_USB) {
char *new_addr;
new_addr = wmem_strdup_printf(NULL, "\"%s\"", dst_addr);
wmem_free(NULL, dst_addr);
dst_addr = new_addr;
}
switch(direction){
case CONV_DIR_A_TO_FROM_B:
/* A <-> B */
str = wmem_strdup_printf(NULL, "%s==%s%s%s%s%s && %s==%s%s%s%s%s",
conversation_get_filter_name(conv_item, CONV_FT_ANY_ADDRESS),
src_addr,
sport?" && ":"",
sport?conversation_get_filter_name(conv_item, CONV_FT_ANY_PORT):"",
sport?"==":"",
sport?sport:"",
conversation_get_filter_name(conv_item, CONV_FT_ANY_ADDRESS),
dst_addr,
dport?" && ":"",
dport?conversation_get_filter_name(conv_item, CONV_FT_ANY_PORT):"",
dport?"==":"",
dport?dport:""
);
break;
case CONV_DIR_A_TO_B:
/* A --> B */
str = wmem_strdup_printf(NULL, "%s==%s%s%s%s%s && %s==%s%s%s%s%s",
conversation_get_filter_name(conv_item, CONV_FT_SRC_ADDRESS),
src_addr,
sport?" && ":"",
sport?conversation_get_filter_name(conv_item, CONV_FT_SRC_PORT):"",
sport?"==":"",
sport?sport:"",
conversation_get_filter_name(conv_item, CONV_FT_DST_ADDRESS),
dst_addr,
dport?" && ":"",
dport?conversation_get_filter_name(conv_item, CONV_FT_DST_PORT):"",
dport?"==":"",
dport?dport:""
);
break;
case CONV_DIR_A_FROM_B:
/* A <-- B */
str = wmem_strdup_printf(NULL, "%s==%s%s%s%s%s && %s==%s%s%s%s%s",
conversation_get_filter_name(conv_item, CONV_FT_DST_ADDRESS),
src_addr,
sport?" && ":"",
sport?conversation_get_filter_name(conv_item, CONV_FT_DST_PORT):"",
sport?"==":"",
sport?sport:"",
conversation_get_filter_name(conv_item, CONV_FT_SRC_ADDRESS),
dst_addr,
dport?" && ":"",
dport?conversation_get_filter_name(conv_item, CONV_FT_SRC_PORT):"",
dport?"==":"",
dport?dport:""
);
break;
case CONV_DIR_A_TO_FROM_ANY:
/* A <-> ANY */
str = wmem_strdup_printf(NULL, "%s==%s%s%s%s%s",
conversation_get_filter_name(conv_item, CONV_FT_ANY_ADDRESS),
src_addr,
sport?" && ":"",
sport?conversation_get_filter_name(conv_item, CONV_FT_ANY_PORT):"",
sport?"==":"",
sport?sport:""
);
break;
case CONV_DIR_A_TO_ANY:
/* A --> ANY */
str = wmem_strdup_printf(NULL, "%s==%s%s%s%s%s",
conversation_get_filter_name(conv_item, CONV_FT_SRC_ADDRESS),
src_addr,
sport?" && ":"",
sport?conversation_get_filter_name(conv_item, CONV_FT_SRC_PORT):"",
sport?"==":"",
sport?sport:""
);
break;
case CONV_DIR_A_FROM_ANY:
/* A <-- ANY */
str = wmem_strdup_printf(NULL, "%s==%s%s%s%s%s",
conversation_get_filter_name(conv_item, CONV_FT_DST_ADDRESS),
src_addr,
sport?" && ":"",
sport?conversation_get_filter_name(conv_item, CONV_FT_DST_PORT):"",
sport?"==":"",
sport?sport:""
);
break;
case CONV_DIR_ANY_TO_FROM_B:
/* ANY <-> B */
str = wmem_strdup_printf(NULL, "%s==%s%s%s%s%s",
conversation_get_filter_name(conv_item, CONV_FT_ANY_ADDRESS),
dst_addr,
dport?" && ":"",
dport?conversation_get_filter_name(conv_item, CONV_FT_ANY_PORT):"",
dport?"==":"",
dport?dport:""
);
break;
case CONV_DIR_ANY_FROM_B:
/* ANY <-- B */
str = wmem_strdup_printf(NULL, "%s==%s%s%s%s%s",
conversation_get_filter_name(conv_item, CONV_FT_SRC_ADDRESS),
dst_addr,
dport?" && ":"",
dport?conversation_get_filter_name(conv_item, CONV_FT_SRC_PORT):"",
dport?"==":"",
dport?dport:""
);
break;
case CONV_DIR_ANY_TO_B:
/* ANY --> B */
str = wmem_strdup_printf(NULL, "%s==%s%s%s%s%s",
conversation_get_filter_name(conv_item, CONV_FT_DST_ADDRESS),
dst_addr,
dport?" && ":"",
dport?conversation_get_filter_name(conv_item, CONV_FT_DST_PORT):"",
dport?"==":"",
dport?dport:""
);
break;
default:
str = wmem_strdup(NULL, "INVALID");
break;
}
g_free(sport);
g_free(dport);
wmem_free(NULL, src_addr);
wmem_free(NULL, dst_addr);
return str;
}
