From 44faa3aa8405ab1b6c53ad5a615252d860bc6232 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9D=8E=E9=80=9A=E6=B4=B2?= <zhangsongcui3371@sina.com>
Date: Mon, 17 Jul 2023 10:41:53 +0800
Subject: [PATCH] LocalIP (Linux): test default route

---
 src/detection/localip/localip.h         |  1 +
 src/detection/localip/localip_linux.c   | 27 +++++++++++++++++++++++++
 src/detection/localip/localip_windows.c |  1 +
 src/modules/localip/localip.c           |  9 ++++++---
 4 files changed, 35 insertions(+), 3 deletions(-)

diff --git a/src/detection/localip/localip.h b/src/detection/localip/localip.h
index 4c9a91539..8d0fe84bf 100644
--- a/src/detection/localip/localip.h
+++ b/src/detection/localip/localip.h
@@ -11,6 +11,7 @@ typedef struct FFLocalIpResult
     FFstrbuf ipv4;
     FFstrbuf ipv6;
     FFstrbuf mac;
+    bool defaultRoute;
 } FFLocalIpResult;
 
 const char* ffDetectLocalIps(const FFLocalIpOptions* options, FFlist* results);
diff --git a/src/detection/localip/localip_linux.c b/src/detection/localip/localip_linux.c
index 8ee01f7af..17fa2651b 100644
--- a/src/detection/localip/localip_linux.c
+++ b/src/detection/localip/localip_linux.c
@@ -1,4 +1,5 @@
 #include "localip.h"
+#include "common/io/io.h"
 
 #include <string.h>
 #include <ctype.h>
@@ -6,6 +7,7 @@
 #include <ifaddrs.h>
 #include <netinet/in.h>
 #include <arpa/inet.h>
+#include <stdio.h>
 
 #if defined(__FreeBSD__) || defined(__APPLE__)
 #include <net/if_dl.h>
@@ -13,6 +15,23 @@
 #include <netpacket/packet.h>
 #endif
 
+static bool getDefaultRoute(char iface[16 /*IF_NAMESIZE*/ + 1])
+{
+    FILE* FF_AUTO_CLOSE_FILE netRoute = fopen("/proc/net/route", "r");
+    // skip first line
+    flockfile(netRoute);
+    while (fgetc_unlocked(netRoute) != '\n');
+    funlockfile(netRoute);
+    unsigned long long destination; //, gateway, flags, refCount, use, metric, mask, mtu,
+
+    while (fscanf(netRoute, "%16s%llx%*[^\n]", iface, &destination) == 2)
+    {
+        if (destination == 0)
+            return true;
+    }
+    return false;
+}
+
 static void addNewIp(FFlist* list, const char* name, const char* addr, int type)
 {
     FFLocalIpResult* ip = NULL;
@@ -30,6 +49,7 @@ static void addNewIp(FFlist* list, const char* name, const char* addr, int type)
         ffStrbufInit(&ip->ipv4);
         ffStrbufInit(&ip->ipv6);
         ffStrbufInit(&ip->mac);
+        ip->defaultRoute = false;
     }
 
     switch (type)
@@ -111,5 +131,12 @@ const char* ffDetectLocalIps(const FFLocalIpOptions* options, FFlist* results)
     }
 
     if (ifAddrStruct) freeifaddrs(ifAddrStruct);
+
+    char iface[16 /*IF_NAMESIZE*/ + 1];
+    if (getDefaultRoute(iface))
+    {
+        FF_LIST_FOR_EACH(FFLocalIpResult, ip, *results)
+            ip->defaultRoute = ffStrbufEqualS(&ip->name, iface);
+    }
     return NULL;
 }
diff --git a/src/detection/localip/localip_windows.c b/src/detection/localip/localip_windows.c
index d1295afb0..0f7c8b805 100644
--- a/src/detection/localip/localip_windows.c
+++ b/src/detection/localip/localip_windows.c
@@ -17,6 +17,7 @@ static void addNewIp(FFlist* list, const char* name, const char* value, int type
         ffStrbufInit(&ip->ipv4);
         ffStrbufInit(&ip->ipv6);
         ffStrbufInit(&ip->mac);
+        ip->defaultRoute = false;
     }
     else
     {
diff --git a/src/modules/localip/localip.c b/src/modules/localip/localip.c
index ecd07a5de..1ae61b4cc 100644
--- a/src/modules/localip/localip.c
+++ b/src/modules/localip/localip.c
@@ -31,7 +31,7 @@ static void formatKey(const FFLocalIpOptions* options, const FFLocalIpResult* ip
     }
 }
 
-static void printIp(FFLocalIpResult* ip)
+static void printIp(FFLocalIpResult* ip, bool markDefaultRoute)
 {
     bool flag = false;
     if (ip->ipv4.length)
@@ -52,6 +52,8 @@ static void printIp(FFLocalIpResult* ip)
         else
             ffStrbufWriteTo(&ip->mac, stdout);
     }
+    if (markDefaultRoute && flag && ip->defaultRoute)
+        fputs(" *", stdout);
 }
 
 void ffPrintLocalIp(FFLocalIpOptions* options)
@@ -82,7 +84,7 @@ void ffPrintLocalIp(FFLocalIpOptions* options)
         {
             if ((void*) ip != (void*) results.data)
                 fputs(" - ", stdout);
-            printIp(ip);
+            printIp(ip, false);
         }
         putchar('\n');
     }
@@ -96,7 +98,7 @@ void ffPrintLocalIp(FFLocalIpOptions* options)
             if(options->moduleArgs.outputFormat.length == 0)
             {
                 ffPrintLogoAndKey(key.chars, 0, NULL, &options->moduleArgs.keyColor);
-                printIp(ip);
+                printIp(ip, results.length > 1);
                 putchar('\n');
             }
             else
@@ -106,6 +108,7 @@ void ffPrintLocalIp(FFLocalIpOptions* options)
                     {FF_FORMAT_ARG_TYPE_STRBUF, &ip->ipv6},
                     {FF_FORMAT_ARG_TYPE_STRBUF, &ip->mac},
                     {FF_FORMAT_ARG_TYPE_STRBUF, &ip->name},
+                    {FF_FORMAT_ARG_TYPE_BOOL, &ip->defaultRoute},
                 });
             }
         }