diff --git a/src/detection/localip/localip_linux.c b/src/detection/localip/localip_linux.c index 52a5ef573..ad9645229 100644 --- a/src/detection/localip/localip_linux.c +++ b/src/detection/localip/localip_linux.c @@ -302,12 +302,6 @@ const char* ffDetectLocalIps(const FFLocalIpOptions* options, FFlist* results) FF_DEBUG("Successfully retrieved interface addresses"); - const FFNetifDefaultRouteResult* defaultRouteV4 = ffNetifGetDefaultRouteV4(); - const FFNetifDefaultRouteResult* defaultRouteV6 = ffNetifGetDefaultRouteV6(); - - FF_DEBUG("Default routes - IPv4: %s, IPv6: %s", - defaultRouteV4->ifName, defaultRouteV6->ifName); - FF_LIST_AUTO_DESTROY adapters = ffListCreate(sizeof(FFAdapter)); for (struct ifaddrs* ifa = ifAddrStruct; ifa; ifa = ifa->ifa_next) @@ -349,8 +343,9 @@ const char* ffDetectLocalIps(const FFLocalIpOptions* options, FFlist* results) if (options->showType & FF_LOCALIP_TYPE_DEFAULT_ROUTE_ONLY_BIT) { - if (!ffStrEquals(defaultRouteV4->ifName, ifa->ifa_name) && - !ffStrEquals(defaultRouteV6->ifName, ifa->ifa_name)) + // If the interface is not the default route for either IPv4 or IPv6, skip it + if (!((options->showType & FF_LOCALIP_TYPE_IPV4_BIT) && ffStrEquals(ffNetifGetDefaultRouteV4()->ifName, ifa->ifa_name)) && + !((options->showType & FF_LOCALIP_TYPE_IPV6_BIT) && ffStrEquals(ffNetifGetDefaultRouteV6()->ifName, ifa->ifa_name))) { FF_DEBUG("Skipping interface %s (not default route interface)", ifa->ifa_name); continue; @@ -435,6 +430,7 @@ const char* ffDetectLocalIps(const FFLocalIpOptions* options, FFlist* results) if ((options->showType & FF_LOCALIP_TYPE_IPV4_BIT)) { + const FFNetifDefaultRouteResult* defaultRouteV4 = ffNetifGetDefaultRouteV4(); bool isDefaultRouteIf = ffStrEquals(defaultRouteV4->ifName, adapter->mac->ifa_name); if (isDefaultRouteIf) @@ -486,6 +482,7 @@ const char* ffDetectLocalIps(const FFLocalIpOptions* options, FFlist* results) v6: if ((options->showType & FF_LOCALIP_TYPE_IPV6_BIT)) { + const FFNetifDefaultRouteResult* defaultRouteV6 = ffNetifGetDefaultRouteV6(); bool isDefaultRouteIf = ffStrEquals(defaultRouteV6->ifName, adapter->mac->ifa_name); if (isDefaultRouteIf) diff --git a/src/detection/localip/localip_windows.c b/src/detection/localip/localip_windows.c index 9a86bd027..0fe103853 100644 --- a/src/detection/localip/localip_windows.c +++ b/src/detection/localip/localip_windows.c @@ -4,6 +4,7 @@ #include "common/netif/netif.h" #include "util/mallocHelper.h" #include "util/windows/unicode.h" +#include "util/debug.h" #include "localip.h" #define FF_LOCALIP_NIFLAG(name) { IP_ADAPTER_##name, #name } @@ -23,42 +24,11 @@ static const FFLocalIpNIFlag niFlagOptions[] = { {}, }; -static void addNewIp(FFlist* list, const char* name, const char* addr, int type, bool newIp, bool defaultRoute) -{ - FFLocalIpResult* ip = NULL; - - if (newIp) - { - ip = (FFLocalIpResult*) ffListAdd(list); - ffStrbufInitS(&ip->name, name); - ffStrbufInit(&ip->ipv4); - ffStrbufInit(&ip->ipv6); - ffStrbufInit(&ip->mac); - ffStrbufInit(&ip->flags); - ip->defaultRoute = defaultRoute; - ip->speed = -1; - ip->mtu = -1; - } - else - { - ip = FF_LIST_GET(FFLocalIpResult, *list, list->length - 1); - } - - switch (type) - { - case AF_INET: - if (ip->ipv4.length) ffStrbufAppendC(&ip->ipv4, ','); - ffStrbufAppendS(&ip->ipv4, addr); - break; - case AF_INET6: - if (ip->ipv6.length) ffStrbufAppendC(&ip->ipv6, ','); - ffStrbufAppendS(&ip->ipv6, addr); - break; - } -} - const char* ffDetectLocalIps(const FFLocalIpOptions* options, FFlist* results) { + FF_DEBUG("Starting local IP detection with showType=0x%X, namePrefix='%.*s'", + options->showType, (int)options->namePrefix.length, options->namePrefix.chars); + IP_ADAPTER_ADDRESSES* FF_AUTO_FREE adapter_addresses = NULL; // Multiple attempts in case interfaces change while @@ -66,60 +36,134 @@ const char* ffDetectLocalIps(const FFLocalIpOptions* options, FFlist* results) DWORD adapter_addresses_buffer_size = 0; for (int attempts = 0;; ++attempts) { + FF_DEBUG("Attempt %d to get adapter addresses, buffer size: %lu", attempts + 1, adapter_addresses_buffer_size); + if (adapter_addresses_buffer_size) { adapter_addresses = (IP_ADAPTER_ADDRESSES*)realloc(adapter_addresses, adapter_addresses_buffer_size); assert(adapter_addresses); } + DWORD family = options->showType & FF_LOCALIP_TYPE_IPV4_BIT + ? options->showType & FF_LOCALIP_TYPE_IPV6_BIT ? AF_UNSPEC : AF_INET + : AF_INET6; + FF_DEBUG("Calling GetAdaptersAddresses with family=%u, flags=0x%X", (unsigned)family, + GAA_FLAG_SKIP_ANYCAST | GAA_FLAG_SKIP_MULTICAST | GAA_FLAG_SKIP_DNS_SERVER); + DWORD error = GetAdaptersAddresses( - options->showType & FF_LOCALIP_TYPE_IPV4_BIT - ? options->showType & FF_LOCALIP_TYPE_IPV6_BIT ? AF_UNSPEC : AF_INET - : AF_INET6, + family, GAA_FLAG_SKIP_ANYCAST | GAA_FLAG_SKIP_MULTICAST | GAA_FLAG_SKIP_DNS_SERVER, NULL, adapter_addresses, &adapter_addresses_buffer_size); if (error == ERROR_SUCCESS) + { + FF_DEBUG("GetAdaptersAddresses succeeded on attempt %d", attempts + 1); break; + } else if (ERROR_BUFFER_OVERFLOW == error && attempts < 4) + { + FF_DEBUG("Buffer overflow, need %lu bytes, retrying", adapter_addresses_buffer_size); continue; + } else + { + FF_DEBUG("GetAdaptersAddresses failed with error %lu after %d attempts", error, attempts + 1); return "GetAdaptersAddresses() failed"; + } } + int adapterCount = 0; + int processedCount = 0; + // Iterate through all of the adapters for (IP_ADAPTER_ADDRESSES* adapter = adapter_addresses; adapter; adapter = adapter->Next) { + adapterCount++; + + FF_DEBUG("Processing adapter %d: IfIndex=%u, IfType=%u, OperStatus=%u", + adapterCount, (unsigned)adapter->IfIndex, (unsigned)adapter->IfType, (unsigned)adapter->OperStatus); + if (adapter->OperStatus != IfOperStatusUp) + { + FF_DEBUG("Skipping adapter %u (not operational, status=%d)", (unsigned)adapter->IfIndex, adapter->OperStatus); continue; + } bool isLoop = adapter->IfType == IF_TYPE_SOFTWARE_LOOPBACK; - if (isLoop && !(options->showType & FF_LOCALIP_TYPE_LOOP_BIT)) - continue; + FF_DEBUG("Adapter %u: isLoopback=%s", (unsigned)adapter->IfIndex, isLoop ? "true" : "false"); - bool newIp = true; + if (isLoop && !(options->showType & FF_LOCALIP_TYPE_LOOP_BIT)) + { + FF_DEBUG("Skipping loopback adapter %u (loopback not requested)", (unsigned)adapter->IfIndex); + continue; + } char name[128]; WideCharToMultiByte(CP_UTF8, 0, adapter->FriendlyName, -1, name, ARRAY_SIZE(name), NULL, NULL); + FF_DEBUG("Adapter %u name: '%s'", (unsigned)adapter->IfIndex, name); + if (options->namePrefix.length && strncmp(name, options->namePrefix.chars, options->namePrefix.length) != 0) + { + FF_DEBUG("Skipping adapter %u (name doesn't match prefix '%.*s')", + (unsigned)adapter->IfIndex, (int)options->namePrefix.length, options->namePrefix.chars); continue; + } + + if (options->showType & FF_LOCALIP_TYPE_DEFAULT_ROUTE_ONLY_BIT) + { + if (!((options->showType & FF_LOCALIP_TYPE_IPV4_BIT) && ffNetifGetDefaultRouteV4()->ifIndex == adapter->IfIndex) && + !((options->showType & FF_LOCALIP_TYPE_IPV6_BIT) && ffNetifGetDefaultRouteV6()->ifIndex == adapter->IfIndex)) + { + FF_DEBUG("Skipping interface %u (not default route interface)", (unsigned)adapter->IfIndex); + continue; + } + } + + processedCount++; + FF_DEBUG("Creating result item for adapter %u ('%s')", (unsigned)adapter->IfIndex, name); + + FFLocalIpResult* item = (FFLocalIpResult*) ffListAdd(results); + ffStrbufInitS(&item->name, name); + ffStrbufInit(&item->ipv4); + ffStrbufInit(&item->ipv6); + ffStrbufInit(&item->mac); + ffStrbufInit(&item->flags); + item->defaultRoute = FF_LOCALIP_TYPE_NONE; + item->speed = -1; + item->mtu = -1; uint32_t typesToAdd = options->showType & (FF_LOCALIP_TYPE_IPV4_BIT | FF_LOCALIP_TYPE_IPV6_BIT | FF_LOCALIP_TYPE_ALL_IPS_BIT); + FF_DEBUG("Types to add for adapter %u: 0x%X", (unsigned)adapter->IfIndex, typesToAdd); + + int ipv4Count = 0, ipv6Count = 0; for (IP_ADAPTER_UNICAST_ADDRESS* ifa = adapter->FirstUnicastAddress; ifa; ifa = ifa->Next) { + FF_DEBUG("Processing unicast address: family=%d, DadState=%d", + ifa->Address.lpSockaddr->sa_family, ifa->DadState); + if (!(options->showType & FF_LOCALIP_TYPE_ALL_IPS_BIT) && ifa->DadState != IpDadStatePreferred) + { + FF_DEBUG("Skipping address (DadState=%d, not preferred)", ifa->DadState); continue; + } if (ifa->Address.lpSockaddr->sa_family == AF_INET) { - if (!(typesToAdd & (FF_LOCALIP_TYPE_IPV4_BIT | FF_LOCALIP_TYPE_ALL_IPS_BIT))) continue; + if (!(typesToAdd & (FF_LOCALIP_TYPE_IPV4_BIT | FF_LOCALIP_TYPE_ALL_IPS_BIT))) + { + FF_DEBUG("Skipping IPv4 address (not requested in typesToAdd=0x%X)", typesToAdd); + continue; + } bool isDefaultRoute = ((options->showType & FF_LOCALIP_TYPE_IPV4_BIT) && ffNetifGetDefaultRouteV4()->ifIndex == adapter->IfIndex); if ((options->showType & FF_LOCALIP_TYPE_DEFAULT_ROUTE_ONLY_BIT) && !isDefaultRoute) + { + FF_DEBUG("Skipping IPv4 address (not on default route interface)"); continue; + } SOCKADDR_IN* ipv4 = (SOCKADDR_IN*) ifa->Address.lpSockaddr; char addressBuffer[INET_ADDRSTRLEN + 6]; @@ -131,19 +175,30 @@ const char* ffDetectLocalIps(const FFLocalIpOptions* options, FFlist* results) snprintf(addressBuffer + len, 6, "/%u", (unsigned) ifa->OnLinkPrefixLength); } - addNewIp(results, name, addressBuffer, AF_INET, newIp, isDefaultRoute); - newIp = false; + FF_DEBUG("Adding IPv4 address: %s (isDefaultRoute=%s)", addressBuffer, isDefaultRoute ? "true" : "false"); + if (item->ipv4.length) ffStrbufAppendC(&item->ipv4, ','); + ffStrbufAppendS(&item->ipv4, addressBuffer); + if (isDefaultRoute) item->defaultRoute |= FF_LOCALIP_TYPE_IPV4_BIT; + + ipv4Count++; typesToAdd &= ~(unsigned) FF_LOCALIP_TYPE_IPV4_BIT; if (typesToAdd == 0) break; } else if (ifa->Address.lpSockaddr->sa_family == AF_INET6) { - if (!(typesToAdd & (FF_LOCALIP_TYPE_IPV6_BIT | FF_LOCALIP_TYPE_ALL_IPS_BIT))) continue; + if (!(typesToAdd & (FF_LOCALIP_TYPE_IPV6_BIT | FF_LOCALIP_TYPE_ALL_IPS_BIT))) + { + FF_DEBUG("Skipping IPv6 address (not requested in typesToAdd=0x%X)", typesToAdd); + continue; + } bool isDefaultRoute = ((options->showType & FF_LOCALIP_TYPE_IPV6_BIT) && ffNetifGetDefaultRouteV6()->ifIndex == adapter->IfIndex); if ((options->showType & FF_LOCALIP_TYPE_DEFAULT_ROUTE_ONLY_BIT) && !isDefaultRoute) + { + FF_DEBUG("Skipping IPv6 address (not on default route interface)"); continue; + } SOCKADDR_IN6* ipv6 = (SOCKADDR_IN6*) ifa->Address.lpSockaddr; char addressBuffer[INET6_ADDRSTRLEN + 6]; @@ -155,30 +210,45 @@ const char* ffDetectLocalIps(const FFLocalIpOptions* options, FFlist* results) snprintf(addressBuffer + len, 6, "/%u", (unsigned) ifa->OnLinkPrefixLength); } - addNewIp(results, name, addressBuffer, AF_INET6, newIp, isDefaultRoute); - newIp = false; + FF_DEBUG("Adding IPv6 address: %s (isDefaultRoute=%s)", addressBuffer, isDefaultRoute ? "true" : "false"); + if (item->ipv6.length) ffStrbufAppendC(&item->ipv6, ','); + ffStrbufAppendS(&item->ipv6, addressBuffer); + if (isDefaultRoute) item->defaultRoute |= FF_LOCALIP_TYPE_IPV6_BIT; + + ipv6Count++; typesToAdd &= ~(unsigned) FF_LOCALIP_TYPE_IPV6_BIT; if (typesToAdd == 0) break; } } - if (!newIp) + FF_DEBUG("Adapter %u: collected %d IPv4 and %d IPv6 addresses", (unsigned)adapter->IfIndex, ipv4Count, ipv6Count); + + if (options->showType & FF_LOCALIP_TYPE_SPEED_BIT) { - FFLocalIpResult* result = FF_LIST_GET(FFLocalIpResult, *results, results->length - 1); - if (options->showType & FF_LOCALIP_TYPE_SPEED_BIT) - result->speed = (int32_t) (adapter->ReceiveLinkSpeed / 1000000); - if (options->showType & FF_LOCALIP_TYPE_MTU_BIT) - result->mtu = (int32_t) adapter->Mtu; - if (options->showType & FF_LOCALIP_TYPE_FLAGS_BIT) - ffLocalIpFillNIFlags(&result->flags, adapter->Flags, niFlagOptions); - if (options->showType & FF_LOCALIP_TYPE_MAC_BIT && adapter->PhysicalAddressLength == 6) - { - uint8_t* ptr = adapter->PhysicalAddress; - ffStrbufSetF(&result->mac, "%02x:%02x:%02x:%02x:%02x:%02x", ptr[0], ptr[1], ptr[2], ptr[3], ptr[4], ptr[5]); - } + item->speed = (int32_t) (adapter->ReceiveLinkSpeed / 1000000); + FF_DEBUG("Adapter %u speed: %d Mbps (raw: %llu)", (unsigned)adapter->IfIndex, item->speed, adapter->ReceiveLinkSpeed); + } + if (options->showType & FF_LOCALIP_TYPE_MTU_BIT) + { + item->mtu = (int32_t) adapter->Mtu; + FF_DEBUG("Adapter %u MTU: %d", (unsigned)adapter->IfIndex, item->mtu); + } + if (options->showType & FF_LOCALIP_TYPE_FLAGS_BIT) + { + ffLocalIpFillNIFlags(&item->flags, adapter->Flags, niFlagOptions); + FF_DEBUG("Adapter %u flags: 0x%lX -> '%s'", (unsigned)adapter->IfIndex, adapter->Flags, item->flags.chars); + } + if (options->showType & FF_LOCALIP_TYPE_MAC_BIT && adapter->PhysicalAddressLength == 6) + { + uint8_t* ptr = adapter->PhysicalAddress; + ffStrbufSetF(&item->mac, "%02x:%02x:%02x:%02x:%02x:%02x", ptr[0], ptr[1], ptr[2], ptr[3], ptr[4], ptr[5]); + FF_DEBUG("Adapter %u MAC: %s", (unsigned)adapter->IfIndex, item->mac.chars); } } + FF_DEBUG("Local IP detection completed: scanned %d adapters, processed %d, results count: %u", + adapterCount, processedCount, results->length); + return NULL; } diff --git a/src/modules/localip/localip.c b/src/modules/localip/localip.c index 84b860dc4..6892305ec 100644 --- a/src/modules/localip/localip.c +++ b/src/modules/localip/localip.c @@ -344,7 +344,14 @@ void ffGenerateLocalIpJsonResult(FF_MAYBE_UNUSED FFLocalIpOptions* options, yyjs { yyjson_mut_val* obj = yyjson_mut_arr_add_obj(doc, arr); yyjson_mut_obj_add_strbuf(doc, obj, "name", &ip->name); - yyjson_mut_obj_add_bool(doc, obj, "defaultRoute", ip->defaultRoute); + if (options->showType & (FF_LOCALIP_TYPE_IPV4_BIT | FF_LOCALIP_TYPE_IPV6_BIT)) + { + yyjson_mut_val* defaultRoute = yyjson_mut_obj_add_obj(doc, obj, "defaultRoute"); + if (options->showType & FF_LOCALIP_TYPE_IPV4_BIT) + yyjson_mut_obj_add_bool(doc, defaultRoute, "ipv4", !!(ip->defaultRoute & FF_LOCALIP_TYPE_IPV4_BIT)); + if (options->showType & FF_LOCALIP_TYPE_IPV6_BIT) + yyjson_mut_obj_add_bool(doc, defaultRoute, "ipv6", !!(ip->defaultRoute & FF_LOCALIP_TYPE_IPV6_BIT)); + } if (options->showType & FF_LOCALIP_TYPE_IPV4_BIT) yyjson_mut_obj_add_strbuf(doc, obj, "ipv4", &ip->ipv4); if (options->showType & FF_LOCALIP_TYPE_IPV6_BIT)