From 55d0d1e7a1405313e76d44650f7d50c59d212175 Mon Sep 17 00:00:00 2001
From: Ondrej Slanina <oslanina@kerio.com>
Date: Thu, 20 May 2010 11:29:43 +0200
Subject: [PATCH] added support for finding pcap device via it's IP.

---
 src/source-pcap.c | 60 +++++++++++++++++++++++++++++++++++++++++++++++
 src/source-pcap.h |  1 +
 src/suricata.c    |  8 ++++---
 3 files changed, 66 insertions(+), 3 deletions(-)

diff --git a/src/source-pcap.c b/src/source-pcap.c
index 77f40a884a..dde1739eee 100644
--- a/src/source-pcap.c
+++ b/src/source-pcap.c
@@ -431,5 +431,65 @@ TmEcode DecodePcapThreadInit(ThreadVars *tv, void *initdata, void **data)
     SCReturnInt(TM_ECODE_OK);
 }
 
+void TranslateIPToPcapDev(char *pcap_dev, int len)
+{
+	char errbuf[PCAP_ERRBUF_SIZE];
+	pcap_if_t *alldevsp = NULL;
+	pcap_if_t *devsp = NULL;
+
+	struct addrinfo aiHints;
+	struct addrinfo *aiList = NULL;
+	int retVal = 0;
+
+	memset(&aiHints, 0, sizeof(aiHints));
+	aiHints.ai_family = AF_UNSPEC;
+	aiHints.ai_flags = AI_NUMERICHOST;
+
+	/* try to translate IP */
+	if ((retVal = getaddrinfo(pcap_dev, NULL, &aiHints, &aiList)) != 0) {
+		return;
+	}
+
+	if (pcap_findalldevs(&alldevsp, errbuf)) {
+		freeaddrinfo(aiList);
+		return;
+	}
+
+	for (devsp = alldevsp; devsp ; devsp = devsp->next) {
+		pcap_addr_t *ip = NULL;
+
+		for (ip = devsp->addresses; ip ; ip = ip->next) {
+
+			if (aiList->ai_family != ip->addr->sa_family) {
+				continue;
+			}
+
+			if (ip->addr->sa_family == AF_INET) {
+				if (memcmp(&((struct sockaddr_in*)aiList->ai_addr)->sin_addr, &((struct sockaddr_in*)ip->addr)->sin_addr, sizeof(struct in_addr))) {
+					continue;
+				}
+			} else if (ip->addr->sa_family == AF_INET6) {
+				if (memcmp(&((struct sockaddr_in6*)aiList->ai_addr)->sin6_addr, &((struct sockaddr_in6*)ip->addr)->sin6_addr, sizeof(struct in6_addr))) {
+					continue;
+				}
+			} else {
+				continue;
+			}
+
+			freeaddrinfo(aiList);
+
+			memset(pcap_dev, 0, len);
+			strncpy(pcap_dev, devsp->name, ((strlen(devsp->name) < len) ? (strlen(devsp->name)) : (len-1)));
+
+			pcap_freealldevs(alldevsp);
+			return;
+		}
+	}
+
+	freeaddrinfo(aiList);
+
+	pcap_freealldevs(alldevsp);
+}
+
 /* eof */
 
diff --git a/src/source-pcap.h b/src/source-pcap.h
index 67a683d3e6..745fc62d62 100644
--- a/src/source-pcap.h
+++ b/src/source-pcap.h
@@ -26,6 +26,7 @@
 
 void TmModuleReceivePcapRegister (void);
 void TmModuleDecodePcapRegister (void);
+void TranslateIPToPcapDev(char *pcap_dev, int len);
 
 /* XXX replace with user configurable options */
 #define LIBPCAP_SNAPLEN     1518
diff --git a/src/suricata.c b/src/suricata.c
index b82df17266..4d0a2b822b 100644
--- a/src/suricata.c
+++ b/src/suricata.c
@@ -272,7 +272,7 @@ void usage(const char *progname)
     printf("%s %s\n", PROG_NAME, PROG_VER);
     printf("USAGE: %s\n\n", progname);
     printf("\t-c <path>                    : path to configuration file\n");
-    printf("\t-i <dev>                     : run in pcap live mode\n");
+    printf("\t-i <dev or ip>               : run in pcap live mode\n");
     printf("\t-r <path>                    : run in pcap file/offline mode\n");
 #ifdef NFQ
     printf("\t-q <qid>                     : run in inline nfqueue mode\n");
@@ -312,7 +312,7 @@ int main(int argc, char **argv)
 {
     int opt;
     char *pcap_file = NULL;
-    char *pcap_dev = NULL;
+    char pcap_dev[128];
     char *pfring_dev = NULL;
     char *sig_file = NULL;
     char *nfq_id = NULL;
@@ -478,7 +478,8 @@ int main(int argc, char **argv)
                 usage(argv[0]);
                 exit(EXIT_FAILURE);
             }
-            pcap_dev = optarg;
+			memset(pcap_dev, 0, sizeof(pcap_dev));
+			      strncpy(pcap_dev, optarg, ((strlen(optarg) < sizeof(pcap_dev)) ? (strlen(optarg)) : (sizeof(pcap_dev)-1)));
             break;
         case 'l':
             if (ConfSet("default-log-dir", optarg, 0) != 1) {
@@ -897,6 +898,7 @@ int main(int argc, char **argv)
         //RunModeIdsPcap3(de_ctx, pcap_dev);
         //RunModeIdsPcap2(de_ctx, pcap_dev);
         //RunModeIdsPcap(de_ctx, pcap_dev);
+        TranslateIPToPcapDev(pcap_dev, sizeof(pcap_dev));
         RunModeIdsPcapAuto(de_ctx, pcap_dev);
     }
     else if (run_mode == MODE_PCAP_FILE) {