slitheen-proxy.c 22 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690
  1. /* Name: slitheen-proxy.c
  2. *
  3. * Slitheen - a decoy routing system for censorship resistance
  4. * Copyright (C) 2017 Cecylia Bocovich (cbocovic@uwaterloo.ca)
  5. *
  6. * This program is free software: you can redistribute it and/or modify
  7. * it under the terms of the GNU General Public License as published by
  8. * the Free Software Foundation, version 3.
  9. *
  10. * This program is distributed in the hope that it will be useful,
  11. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  13. * GNU General Public License for more details.
  14. *
  15. * You should have received a copy of the GNU General Public License
  16. * along with this program. If not, see <http://www.gnu.org/licenses/>.
  17. *
  18. * Additional permission under GNU GPL version 3 section 7
  19. *
  20. * If you modify this Program, or any covered work, by linking or combining
  21. * it with the OpenSSL library (or a modified version of that library),
  22. * containing parts covered by the terms of the OpenSSL Licence and the
  23. * SSLeay license, the licensors of this Program grant you additional
  24. * permission to convey the resulting work. Corresponding Source for a
  25. * non-source form of such a combination shall include the source code
  26. * for the parts of the OpenSSL library used as well as that of the covered
  27. * work.
  28. */
  29. #include <pcap.h>
  30. #include <stdio.h>
  31. #include <stdlib.h>
  32. #include <unistd.h>
  33. #include <string.h>
  34. #include <pthread.h>
  35. #include <sys/ioctl.h>
  36. #include <net/if.h>
  37. #include <openssl/ssl.h>
  38. #include "util.h"
  39. #include "flow.h"
  40. #include "slitheen.h"
  41. #include "relay.h"
  42. #include "crypto.h"
  43. #include "cryptothread.h"
  44. void save_packet(flow *f, struct packet_info *info);
  45. void update_window_expiration(flow *f, struct packet_info *info);
  46. void retransmit(flow *f, struct packet_info *info, uint32_t data_to_fill);
  47. void usage(void){
  48. printf("Usage: slitheen-proxy [internal network interface] [NAT interface]\n");
  49. }
  50. int main(int argc, char *argv[]){
  51. pthread_t t1, t2;
  52. char *dev1 = NULL; /* Device that leads to the internal network */
  53. char *dev2 = NULL; /* Device that leads out to the world */
  54. struct sniff_args outbound;
  55. struct sniff_args inbound;
  56. if (argc != 3) {
  57. usage();
  58. return(2);
  59. }
  60. dev1 = argv[1];
  61. dev2 = argv[2];
  62. if(init_tables()){
  63. exit(1);
  64. }
  65. if(init_session_cache()){
  66. exit(1);
  67. }
  68. init_crypto_locks();
  69. /* Create threads */
  70. outbound.readdev = dev1;
  71. outbound.writedev = dev2;
  72. inbound.readdev = dev2;
  73. inbound.writedev = dev1;
  74. pthread_create(&t1, NULL, sniff_packets, (void *) &outbound);
  75. pthread_create(&t2, NULL, sniff_packets, (void *) &inbound);
  76. pthread_join(t1, NULL);
  77. pthread_join(t2, NULL);
  78. pthread_exit(NULL);
  79. crypto_locks_cleanup();
  80. return(0);
  81. }
  82. void *sniff_packets(void *args){
  83. pcap_t *rd_handle;
  84. pcap_t *wr_handle;
  85. char rd_errbuf[BUFSIZ];
  86. char wr_errbuf[BUFSIZ];
  87. uint8_t MAC[ETHER_ADDR_LEN];
  88. bpf_u_int32 mask;
  89. bpf_u_int32 net;
  90. char *readdev, *writedev;
  91. struct sniff_args *arg_st = (struct sniff_args *) args;
  92. readdev = arg_st->readdev;
  93. writedev = arg_st->writedev;
  94. //Find MAC address of each interface
  95. struct ifreq ifr;
  96. int s = socket(AF_INET, SOCK_DGRAM, 0);
  97. strcpy(ifr.ifr_name, writedev);
  98. ioctl(s, SIOCGIFHWADDR, &ifr);
  99. memcpy(MAC, ifr.ifr_hwaddr.sa_data, ETHER_ADDR_LEN);
  100. close(s);
  101. if (pcap_lookupnet(readdev, &net, &mask, rd_errbuf) == -1){
  102. fprintf(stderr, "Can't get netmask for device %s\n", readdev);
  103. exit(2);
  104. }
  105. rd_handle = pcap_open_live(readdev, BUFSIZ, 0, 0, rd_errbuf);
  106. if (rd_handle == NULL){
  107. fprintf(stderr, "Couldn't open device %s: %s\n", readdev, rd_errbuf);
  108. }
  109. if(pcap_datalink(rd_handle) != DLT_EN10MB) {
  110. fprintf(stderr, "Device %s does not provide Ethernet headers - not supported\n", readdev);
  111. exit(2);
  112. }
  113. if(pcap_setdirection(rd_handle, PCAP_D_IN)){
  114. fprintf(stderr, "Platform does not support write direction. Update filters with MAC address\n");
  115. exit(2);
  116. }
  117. wr_handle = pcap_open_live(writedev, BUFSIZ, 0, 0, wr_errbuf);
  118. if (wr_handle == NULL){
  119. fprintf(stderr, "Couldn't open device %s: %s\n", writedev, wr_errbuf);
  120. }
  121. struct inject_args iargs;
  122. iargs.mac_addr = MAC;
  123. iargs.write_dev = wr_handle;
  124. /*callback function*/
  125. pcap_loop(rd_handle, -1, got_packet, (unsigned char *) &iargs);
  126. /*Sniff a packet*/
  127. pcap_close(rd_handle);
  128. return NULL;
  129. }
  130. /*
  131. * Injects a packet back out the opposite interface
  132. */
  133. void inject_packet(struct inject_args *iargs, const struct pcap_pkthdr *header, uint8_t *packet){
  134. pcap_t *handle = iargs->write_dev;
  135. //write back out to the MAC ADDR it came in on
  136. //memmove(packet, packet+ETHER_ADDR_LEN, ETHER_ADDR_LEN);
  137. //memcpy(packet+ETHER_ADDR_LEN, iargs->mac_addr, ETHER_ADDR_LEN);
  138. if((pcap_inject(handle, packet, header->len)) < 0 ){
  139. fprintf(stderr, "Error: %s\n", pcap_geterr(handle));
  140. printf("Length: %d\n", header->len);
  141. }
  142. #ifdef DEBUG_EXTRA
  143. fprintf(stderr, "injected the following packet:\n");
  144. for(int i=0; i< header->len; i++){
  145. fprintf(stderr, "%02x ", packet[i]);
  146. }
  147. fprintf(stderr, "\n");
  148. #endif
  149. free(packet);
  150. }
  151. /**
  152. * Runs when pcap_loop receives a packet from the specified interface
  153. * If the received packet is a tcp packet, processes it and then writes it back out
  154. * to the interface
  155. *
  156. */
  157. void got_packet(uint8_t *args, const struct pcap_pkthdr *header, const uint8_t *packet){
  158. struct inject_args *iargs = (struct inject_args *) args;
  159. uint8_t *tmp_packet = emalloc(header->len);
  160. memcpy(tmp_packet, packet, header->len);
  161. process_packet(iargs, header, tmp_packet);
  162. }
  163. /* This function receives a full ip packet and then:
  164. * 1) identifies the flow
  165. * 2) adds the packet to the flow's data chain
  166. * 3) updates the flow's state
  167. */
  168. void process_packet(struct inject_args *iargs, const struct pcap_pkthdr *header, uint8_t *packet){
  169. struct packet_info *info = emalloc(sizeof(struct packet_info));
  170. extract_packet_headers(packet, info);
  171. //Ignore non-TCP packets (shouldn't actually get any)
  172. if((info->ip_hdr == NULL) || (info->tcp_hdr == NULL)){
  173. //free(info);
  174. //free(packet);
  175. //return;
  176. goto err;
  177. }
  178. /* Checks to see if this is a possibly tagged hello msg */
  179. if ((info->record_hdr != NULL) && (info->record_hdr->type == HS)){ /* This is a TLS handshake */
  180. check_handshake(info);
  181. }
  182. /* Now if flow is in table, update state */
  183. flow *observed;
  184. if((observed = check_flow(info)) != NULL){
  185. #ifdef DEBUG
  186. /*Check sequence number and replay application data if necessary*/
  187. fprintf(stdout,"Flow: %x:%d > %x:%d (%s)\n", info->ip_hdr->src.s_addr, ntohs(info->tcp_hdr->src_port), info->ip_hdr->dst.s_addr, ntohs(info->tcp_hdr->dst_port), (info->ip_hdr->src.s_addr != observed->src_ip.s_addr)? "incoming":"outgoing");
  188. fprintf(stdout,"ID number: %u\n", htonl(info->ip_hdr->id));
  189. fprintf(stdout,"Sequence number: %u\n", htonl(info->tcp_hdr->sequence_num));
  190. fprintf(stdout,"Acknowledgement number: %u\n", htonl(info->tcp_hdr->ack_num));
  191. #endif
  192. uint8_t incoming = (info->ip_hdr->src.s_addr != observed->src_ip.s_addr)? 1 : 0;
  193. uint32_t seq_num = htonl(info->tcp_hdr->sequence_num);
  194. uint32_t expected_seq = (incoming)? observed->downstream_seq_num : observed->upstream_seq_num;
  195. #ifdef DEBUG
  196. fprintf(stdout,"Expected sequence number: %u\n", expected_seq);
  197. #endif
  198. /* Remove acknowledged data from queue after TCP window is exceeded */
  199. update_window_expiration(observed, info);
  200. /* fill with retransmit data, process new data */
  201. uint32_t data_to_fill;
  202. uint32_t data_to_process;
  203. if(seq_num > expected_seq){
  204. data_to_process = info->app_data_len;
  205. data_to_fill = 0;
  206. } else if (seq_num + info->app_data_len > expected_seq){
  207. data_to_fill = expected_seq - seq_num;
  208. data_to_process = seq_num + info->app_data_len - expected_seq;
  209. } else {
  210. data_to_fill = info->app_data_len;
  211. data_to_process = 0;
  212. }
  213. uint8_t *p = info->app_data;
  214. if(data_to_fill){ //retransmit
  215. printf("Retransmiting data (%u:%u)\n", seq_num, seq_num + info->app_data_len);
  216. retransmit(observed, info, data_to_fill);
  217. }
  218. p += data_to_fill;
  219. if(data_to_process){
  220. if(p != info->app_data){
  221. printf("UH OH something weird might happen\n");
  222. }
  223. if(observed->application){
  224. if(seq_num > expected_seq){
  225. //For now, enters into FORFEIT state
  226. //TODO: change upstream behaviour to try to mask slitheen hdr
  227. //printf("ERROR: future packet in app data, forfeiting flow\n");
  228. remove_flow(observed);
  229. goto err;
  230. }
  231. replace_packet(observed, info);
  232. } else {
  233. //We're still in the TLS handshake; hold packets misordered packets
  234. if(seq_num > expected_seq){
  235. //Delay and process later
  236. frame *new_frame = ecalloc(1, sizeof(frame));
  237. new_frame->iargs = iargs;
  238. new_frame->packet = packet;
  239. new_frame->header = header;
  240. new_frame->seq_num = seq_num;
  241. new_frame->next = NULL;
  242. frame_queue *queue = (incoming) ? observed->ds_frame_queue : observed->us_frame_queue;
  243. printf("Delay processing of frame (seq = %u )\n", seq_num);
  244. //add to end of list
  245. if(queue->first_frame == NULL){
  246. queue->first_frame = new_frame;
  247. } else {
  248. frame *last = queue->first_frame;
  249. while(last->next != NULL){
  250. last = last->next;
  251. }
  252. last->next = new_frame;
  253. }
  254. free(info);
  255. observed->ref_ctr--;
  256. printf("Misordered packet. %p ref_ctr %d\n", observed, observed->ref_ctr);
  257. return; //TODO: fix terrible spaghetti returns
  258. }
  259. /* Pass data to packet chain */
  260. if(observed->stall){
  261. }
  262. if(add_packet(observed, info)){//removed_flow
  263. goto err;
  264. }
  265. }
  266. /* Update TCP state */
  267. if(info->tcp_hdr->flags & (FIN | RST) ){
  268. /* Remove flow from table, connection ended */
  269. remove_flow(observed);
  270. goto err;
  271. }
  272. /* add packet to application data queue */
  273. save_packet(observed, info);
  274. }
  275. /*process and release held frames with current sequence numbers*/
  276. frame_queue *queue = (incoming) ? observed->ds_frame_queue : observed->us_frame_queue;
  277. frame *first = queue->first_frame;
  278. frame *prev = queue->first_frame;
  279. expected_seq = (incoming)? observed->downstream_seq_num : observed->upstream_seq_num;
  280. while (first != NULL){
  281. if(first->seq_num <= expected_seq){
  282. //remove from queue and process
  283. if(first == queue->first_frame) {
  284. queue->first_frame = first->next;
  285. } else {
  286. prev->next = first->next;
  287. }
  288. printf("Now processing frame (seq = %u )\n", first->seq_num);
  289. process_packet(iargs, first->header, first->packet);
  290. free(first);
  291. first = queue->first_frame;
  292. prev = queue->first_frame;
  293. } else {
  294. prev = first;
  295. first = first->next;
  296. }
  297. }
  298. observed->ref_ctr--;
  299. }
  300. //TODO: figure out how to not need this
  301. tcp_checksum(info);//update checksum
  302. err:
  303. free(info);//Note: don't free this while a thread is using it
  304. inject_packet(iargs, header, packet);
  305. return;
  306. }
  307. //TODO: rewrite this function to remove bloat
  308. void save_packet(flow *f, struct packet_info *info){
  309. uint8_t incoming = (info->ip_hdr->src.s_addr != f->src_ip.s_addr)? 1 : 0;
  310. uint32_t seq_num = htonl(info->tcp_hdr->sequence_num);
  311. //add new app block
  312. packet *new_block = ecalloc(1, sizeof(packet));
  313. new_block->seq_num = htonl(info->tcp_hdr->sequence_num);
  314. new_block->data = ecalloc(1, info->app_data_len);
  315. memcpy(new_block->data, info->app_data, info->app_data_len);
  316. new_block->len = info->app_data_len;
  317. new_block->next = NULL;
  318. new_block->expiration = 0;
  319. packet *saved_data = (incoming)? f->downstream_app_data->first_packet :
  320. f->upstream_app_data->first_packet;
  321. //put app data block in queue
  322. if(saved_data == NULL){
  323. if(incoming){
  324. f->downstream_app_data->first_packet = new_block;
  325. if(new_block->seq_num ==
  326. f->downstream_seq_num){
  327. f->downstream_seq_num += new_block->len;
  328. #ifdef DEBUG
  329. printf("Updated downstream expected seqnum to %u\n",
  330. f->downstream_seq_num );
  331. #endif
  332. }
  333. } else {
  334. f->upstream_app_data->first_packet = new_block;
  335. if(new_block->seq_num ==
  336. f->upstream_seq_num){
  337. f->upstream_seq_num += new_block->len;
  338. #ifdef DEBUG
  339. printf("Updated upstream expected seqnum to %u\n",
  340. f->upstream_seq_num );
  341. #endif
  342. }
  343. }
  344. } else {
  345. uint8_t saved = 0;
  346. while(saved_data->next != NULL){
  347. if(!saved && (saved_data->next->seq_num > seq_num)){
  348. new_block->next = saved_data->next;
  349. saved_data->next = new_block;
  350. saved = 1;
  351. }
  352. //update expected sequence number
  353. if(incoming){
  354. if(saved_data->next->seq_num ==
  355. f->downstream_seq_num){
  356. f->downstream_seq_num += saved_data->next->len;
  357. #ifdef DEBUG
  358. printf("Updated downstream expected seqnum to %u\n",
  359. f->downstream_seq_num );
  360. #endif
  361. }
  362. } else {//outgoing
  363. if(saved_data->next->seq_num ==
  364. f->upstream_seq_num){
  365. f->upstream_seq_num += saved_data->next->len;
  366. #ifdef DEBUG
  367. printf("Updated upstream expected seqnum to %u\n",
  368. f->upstream_seq_num );
  369. #endif
  370. }
  371. }
  372. saved_data = saved_data->next;
  373. }
  374. if(!saved){
  375. saved_data->next = new_block;
  376. //update expected sequence number
  377. if(incoming){
  378. if(saved_data->next->seq_num ==
  379. f->downstream_seq_num){
  380. f->downstream_seq_num += saved_data->next->len;
  381. #ifdef DEBUG
  382. printf("Updated downstream expected seqnum to %u\n",
  383. f->downstream_seq_num );
  384. #endif
  385. }
  386. } else {//outgoing
  387. if(saved_data->next->seq_num ==
  388. f->upstream_seq_num){
  389. f->upstream_seq_num += saved_data->next->len;
  390. #ifdef DEBUG
  391. printf("Updated upstream expected seqnum to %u\n",
  392. f->upstream_seq_num );
  393. #endif
  394. }
  395. }
  396. }
  397. }
  398. }
  399. /**
  400. * This function cleans up data that has been acked, after the TCP window of the recipient has been
  401. * exceeded. This ensures that a retransmisson of the data will no longer occur.
  402. *
  403. * Sets the expiration for recent data base on the TCP window
  404. */
  405. void update_window_expiration(flow *f, struct packet_info *info){
  406. uint8_t incoming = (info->ip_hdr->src.s_addr != f->src_ip.s_addr)? 1 : 0;
  407. uint32_t ack_num = htonl(info->tcp_hdr->ack_num);
  408. uint32_t end_seq = htonl(info->tcp_hdr->sequence_num) + info->app_data_len - 1;
  409. uint32_t window = ack_num + htons(info->tcp_hdr->win_size);
  410. #ifdef DEBUG
  411. printf("Received sequence number %u\n", htonl(info->tcp_hdr->sequence_num));
  412. printf("Acknowledged up to %u with window expiring at %u\n", ack_num, window);
  413. printf("Removing all packets up to %u\n", end_seq);
  414. #endif
  415. packet *saved_data = (incoming)? f->downstream_app_data->first_packet :
  416. f->upstream_app_data->first_packet;
  417. while((saved_data != NULL) && (saved_data->expiration != 0) && (end_seq > saved_data->expiration)){
  418. //remove entire block
  419. if(incoming){
  420. f->downstream_app_data->first_packet = saved_data->next;
  421. } else {
  422. f->upstream_app_data->first_packet = saved_data->next;
  423. }
  424. free(saved_data->data);
  425. free(saved_data);
  426. saved_data = (incoming)? f->downstream_app_data->first_packet :
  427. f->upstream_app_data->first_packet;
  428. #ifdef DEBUG
  429. if(saved_data != NULL){
  430. printf("Currently saved seq_num is now %u\n", saved_data->seq_num);
  431. } else {
  432. printf("Acked all data, queue is empty\n");
  433. }
  434. #endif
  435. }
  436. /* Update expiration for packets based on TCP window size */
  437. saved_data = (incoming)? f->upstream_app_data->first_packet :
  438. f->downstream_app_data->first_packet;
  439. while((saved_data != NULL) && (ack_num > saved_data->seq_num)){
  440. //update window
  441. if(ack_num >= saved_data->seq_num + saved_data->len){
  442. //remove entire block
  443. saved_data->expiration = window;
  444. }
  445. saved_data = saved_data->next;
  446. }
  447. }
  448. /**
  449. * This function retransmits previously sent (and possibly modified) data
  450. *
  451. */
  452. void retransmit(flow *f, struct packet_info *info, uint32_t data_to_fill){
  453. uint8_t *p = info->app_data;
  454. uint32_t seq_num = htonl(info->tcp_hdr->sequence_num);
  455. uint8_t incoming = (info->ip_hdr->src.s_addr != f->src_ip.s_addr)? 1 : 0;
  456. packet *saved_data = (incoming)? f->downstream_app_data->first_packet :
  457. f->upstream_app_data->first_packet;
  458. while(data_to_fill > 0){
  459. if(saved_data == NULL){
  460. //have already acked all data
  461. p += data_to_fill;
  462. seq_num += data_to_fill;
  463. data_to_fill -= data_to_fill;
  464. continue;
  465. }
  466. if(seq_num < saved_data->seq_num){
  467. //we are missing a block. Use what was given
  468. if(saved_data->seq_num - seq_num > data_to_fill){
  469. //skip the rest
  470. p += data_to_fill;
  471. seq_num += data_to_fill;
  472. data_to_fill -= data_to_fill;
  473. } else {
  474. p += saved_data->seq_num - seq_num;
  475. data_to_fill -= saved_data->seq_num - seq_num;
  476. seq_num += saved_data->seq_num - seq_num;
  477. }
  478. } else if ( seq_num == saved_data->seq_num) {
  479. if(data_to_fill >= saved_data->len){
  480. //exhaust this block and move onto next one
  481. memcpy(p, saved_data->data, saved_data->len);
  482. p += saved_data->len;
  483. seq_num += saved_data->len;
  484. data_to_fill -= saved_data->len;
  485. saved_data = saved_data->next;
  486. } else {
  487. //fill with partial block
  488. memcpy(p, saved_data->data, data_to_fill);
  489. p += data_to_fill;
  490. seq_num += data_to_fill;
  491. data_to_fill -= data_to_fill;
  492. }
  493. } else { //seq_num > saved_data->seq_num
  494. uint32_t offset = seq_num - saved_data->seq_num;
  495. if(offset > saved_data->len){
  496. saved_data = saved_data->next;
  497. offset -= saved_data->len;
  498. } else {
  499. if(data_to_fill > saved_data->len - offset){
  500. memcpy(p, saved_data->data + offset, saved_data->len - offset);
  501. p += saved_data->len - offset;
  502. seq_num += saved_data->len - offset;
  503. data_to_fill -= saved_data->len - offset;
  504. saved_data = saved_data->next;
  505. } else {
  506. memcpy(p, saved_data->data + offset, data_to_fill);
  507. p += data_to_fill;
  508. seq_num += data_to_fill;
  509. data_to_fill -= data_to_fill;
  510. }
  511. }
  512. }
  513. }
  514. tcp_checksum(info);//update checksum
  515. }
  516. /** This function extracts the ip, tcp, and tls record headers
  517. * from a received packet (if they exist), and put them in
  518. * a packet_info struct
  519. *
  520. */
  521. void extract_packet_headers(uint8_t *packet, struct packet_info *info){
  522. /* First fill in IP header */
  523. uint8_t *p = packet;
  524. p += ETHER_HEADER_LEN; //skip ethernet header
  525. info->ip_hdr = (struct ip_header*) p;
  526. info->size_ip_hdr = IP_HEADER_LEN(info->ip_hdr);
  527. /* Verify this is an IP packet */
  528. if( (info->ip_hdr->versionihl >>4) != 4){
  529. info->ip_hdr = NULL;
  530. info->size_ip_hdr = 0;
  531. info->tcp_hdr = NULL;
  532. info->size_tcp_hdr = 0;
  533. info->record_hdr = NULL;
  534. return;
  535. }
  536. /* If this is a TCP segment, fill in TCP header */
  537. if (info->ip_hdr->proto == IPPROTO_TCP){
  538. p += info->size_ip_hdr; //skip IP header
  539. info->tcp_hdr = (struct tcp_header*) p;
  540. info->size_tcp_hdr = TCP_HEADER_LEN(info->tcp_hdr);
  541. p += info->size_tcp_hdr;
  542. } else {
  543. info->tcp_hdr = NULL;
  544. info->size_tcp_hdr = 0;
  545. info->record_hdr = NULL;
  546. return;
  547. }
  548. /* If the application data contains a TLS record, fill in hdr */
  549. info->app_data_len = htons(info->ip_hdr->len) - (info->size_ip_hdr + info->size_tcp_hdr);
  550. if(info->app_data_len > 0){
  551. info->app_data = p;
  552. info->record_hdr = (struct tls_header*) p;
  553. //check to see if this is a valid record
  554. if((info->record_hdr->type < 0x14) || (info->record_hdr->type > 0x18)){
  555. info->record_hdr = NULL;
  556. }
  557. } else {
  558. info->record_hdr = NULL;
  559. info->app_data = NULL;
  560. }
  561. return;
  562. }
  563. /** Copies a packet_info structure and returns a pointer to the duplicate.
  564. */
  565. struct packet_info *copy_packet_info(struct packet_info *src_info){
  566. struct packet_info *dst_info = emalloc(sizeof(struct packet_info));
  567. dst_info->ip_hdr = src_info->ip_hdr;
  568. dst_info->tcp_hdr = src_info->tcp_hdr;
  569. dst_info->size_tcp_hdr = src_info->size_tcp_hdr;
  570. dst_info->size_ip_hdr = src_info->size_ip_hdr;
  571. dst_info->app_data = src_info->app_data;
  572. dst_info->app_data_len = src_info->app_data_len;
  573. return dst_info;
  574. }