slitheen.c 22 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655
  1. /* Name: slitheen.c
  2. *
  3. * Slitheen - a decoy routing system for censorship resistance
  4. * Copyright (C) 2017 Cecylia Bocovich (cbocovic@uwaterloo.ca)
  5. *
  6. * This program is free software: you can redistribute it and/or modify
  7. * it under the terms of the GNU General Public License as published by
  8. * the Free Software Foundation, version 3.
  9. *
  10. * This program is distributed in the hope that it will be useful,
  11. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  13. * GNU General Public License for more details.
  14. *
  15. * You should have received a copy of the GNU General Public License
  16. * along with this program. If not, see <http://www.gnu.org/licenses/>.
  17. *
  18. * Additional permission under GNU GPL version 3 section 7
  19. *
  20. * If you modify this Program, or any covered work, by linking or combining
  21. * it with the OpenSSL library (or a modified version of that library),
  22. * containing parts covered by the terms of the OpenSSL Licence and the
  23. * SSLeay license, the licensors of this Program grant you additional
  24. * permission to convey the resulting work. Corresponding Source for a
  25. * non-source form of such a combination shall include the source code
  26. * for the parts of the OpenSSL library used as well as that of the covered
  27. * work.
  28. */
  29. #include <pcap.h>
  30. #include <stdio.h>
  31. #include <stdlib.h>
  32. #include <unistd.h>
  33. #include <string.h>
  34. #include <pthread.h>
  35. #include <sys/ioctl.h>
  36. #include <net/if.h>
  37. #include <openssl/ssl.h>
  38. #include "util.h"
  39. #include "flow.h"
  40. #include "slitheen.h"
  41. #include "relay.h"
  42. #include "crypto.h"
  43. #include "cryptothread.h"
  44. #include "packet.h"
  45. void got_packet(uint8_t *args, const struct pcap_pkthdr *header, const uint8_t *packet);
  46. void *sniff_packets(void *);
  47. void process_packet(struct inject_args *iargs, const struct pcap_pkthdr *header, uint8_t *packet);
  48. void extract_packet_headers(uint8_t *packet, struct packet_info *info);
  49. struct packet_info *copy_packet_info(struct packet_info *src_info);
  50. void save_packet(flow *f, struct packet_info *info);
  51. void update_window_expiration(flow *f, struct packet_info *info);
  52. void retransmit(flow *f, struct packet_info *info, uint32_t data_to_fill);
  53. void usage(void){
  54. printf("Usage: slitheen [internal network interface] [NAT interface]\n");
  55. }
  56. int main(int argc, char *argv[]){
  57. pthread_t t1, t2;
  58. char *dev1 = NULL; /* Device that leads to the internal network */
  59. char *dev2 = NULL; /* Device that leads out to the world */
  60. struct sniff_args outbound;
  61. struct sniff_args inbound;
  62. if (argc != 3) {
  63. usage();
  64. return(2);
  65. }
  66. dev1 = argv[1];
  67. dev2 = argv[2];
  68. if(init_tables()){
  69. exit(1);
  70. }
  71. if(init_session_cache()){
  72. exit(1);
  73. }
  74. init_crypto_locks();
  75. /* Create threads */
  76. outbound.readdev = dev1;
  77. outbound.writedev = dev2;
  78. inbound.readdev = dev2;
  79. inbound.writedev = dev1;
  80. pthread_create(&t1, NULL, sniff_packets, (void *) &outbound);
  81. pthread_create(&t2, NULL, sniff_packets, (void *) &inbound);
  82. pthread_join(t1, NULL);
  83. pthread_join(t2, NULL);
  84. pthread_exit(NULL);
  85. crypto_locks_cleanup();
  86. return(0);
  87. }
  88. void *sniff_packets(void *args){
  89. pcap_t *rd_handle;
  90. pcap_t *wr_handle;
  91. char rd_errbuf[BUFSIZ];
  92. char wr_errbuf[BUFSIZ];
  93. uint8_t MAC[ETHER_ADDR_LEN];
  94. bpf_u_int32 mask;
  95. bpf_u_int32 net;
  96. char *readdev, *writedev;
  97. struct sniff_args *arg_st = (struct sniff_args *) args;
  98. readdev = arg_st->readdev;
  99. writedev = arg_st->writedev;
  100. //Find MAC address of each interface
  101. struct ifreq ifr;
  102. int s = socket(AF_INET, SOCK_DGRAM, 0);
  103. strcpy(ifr.ifr_name, writedev);
  104. ioctl(s, SIOCGIFHWADDR, &ifr);
  105. memcpy(MAC, ifr.ifr_hwaddr.sa_data, ETHER_ADDR_LEN);
  106. close(s);
  107. if (pcap_lookupnet(readdev, &net, &mask, rd_errbuf) == -1){
  108. fprintf(stderr, "Can't get netmask for device %s\n", readdev);
  109. exit(2);
  110. }
  111. rd_handle = pcap_open_live(readdev, BUFSIZ, 0, 0, rd_errbuf);
  112. if (rd_handle == NULL){
  113. fprintf(stderr, "Couldn't open device %s: %s\n", readdev, rd_errbuf);
  114. }
  115. if(pcap_datalink(rd_handle) != DLT_EN10MB) {
  116. fprintf(stderr, "Device %s does not provide Ethernet headers - not supported\n", readdev);
  117. exit(2);
  118. }
  119. if(pcap_setdirection(rd_handle, PCAP_D_IN)){
  120. fprintf(stderr, "Platform does not support write direction. Update filters with MAC address\n");
  121. exit(2);
  122. }
  123. wr_handle = pcap_open_live(writedev, BUFSIZ, 0, 0, wr_errbuf);
  124. if (wr_handle == NULL){
  125. fprintf(stderr, "Couldn't open device %s: %s\n", writedev, wr_errbuf);
  126. }
  127. struct inject_args iargs;
  128. iargs.mac_addr = MAC;
  129. iargs.write_dev = wr_handle;
  130. /*callback function*/
  131. pcap_loop(rd_handle, -1, got_packet, (unsigned char *) &iargs);
  132. /*Sniff a packet*/
  133. pcap_close(rd_handle);
  134. return NULL;
  135. }
  136. /**
  137. * Runs when pcap_loop receives a packet from the specified interface
  138. * If the received packet is a tcp packet, processes it and then writes it back out
  139. * to the interface
  140. *
  141. */
  142. void got_packet(uint8_t *args, const struct pcap_pkthdr *header, const uint8_t *packet){
  143. struct inject_args *iargs = (struct inject_args *) args;
  144. uint8_t *tmp_packet = emalloc(header->len);
  145. memcpy(tmp_packet, packet, header->len);
  146. process_packet(iargs, header, tmp_packet);
  147. }
  148. /* This function receives a full ip packet and then:
  149. * 1) identifies the flow
  150. * 2) adds the packet to the flow's data chain
  151. * 3) updates the flow's state
  152. */
  153. void process_packet(struct inject_args *iargs, const struct pcap_pkthdr *header, uint8_t *packet){
  154. struct packet_info *info = emalloc(sizeof(struct packet_info));
  155. extract_packet_headers(packet, info);
  156. //Ignore non-TCP packets (shouldn't actually get any)
  157. if((info->ip_hdr == NULL) || (info->tcp_hdr == NULL)){
  158. //free(info);
  159. //free(packet);
  160. //return;
  161. goto err;
  162. }
  163. /* Checks to see if this is a possibly tagged hello msg */
  164. if ((info->record_hdr != NULL) && (info->record_hdr->type == HS)){ /* This is a TLS handshake */
  165. check_handshake(info);
  166. }
  167. /* Now if flow is in table, update state */
  168. flow *observed;
  169. if((observed = check_flow(info)) != NULL){
  170. #ifdef DEBUG
  171. /*Check sequence number and replay application data if necessary*/
  172. fprintf(stdout,"Flow: %x:%d > %x:%d (%s)\n", info->ip_hdr->src.s_addr, ntohs(info->tcp_hdr->src_port), info->ip_hdr->dst.s_addr, ntohs(info->tcp_hdr->dst_port), (info->ip_hdr->src.s_addr != observed->src_ip.s_addr)? "incoming":"outgoing");
  173. fprintf(stdout,"ID number: %u\n", htonl(info->ip_hdr->id));
  174. fprintf(stdout,"Sequence number: %u\n", htonl(info->tcp_hdr->sequence_num));
  175. fprintf(stdout,"Acknowledgement number: %u\n", htonl(info->tcp_hdr->ack_num));
  176. #endif
  177. uint8_t incoming = (info->ip_hdr->src.s_addr != observed->src_ip.s_addr)? 1 : 0;
  178. uint32_t seq_num = htonl(info->tcp_hdr->sequence_num);
  179. uint32_t expected_seq = (incoming)? observed->downstream_seq_num : observed->upstream_seq_num;
  180. #ifdef DEBUG
  181. fprintf(stdout,"Expected sequence number: %u\n", expected_seq);
  182. #endif
  183. /* Remove acknowledged data from queue after TCP window is exceeded */
  184. update_window_expiration(observed, info);
  185. /* fill with retransmit data, process new data */
  186. uint32_t data_to_fill;
  187. uint32_t data_to_process;
  188. if(seq_num > expected_seq){
  189. data_to_process = info->app_data_len;
  190. data_to_fill = 0;
  191. } else if (seq_num + info->app_data_len > expected_seq){
  192. data_to_fill = expected_seq - seq_num;
  193. data_to_process = seq_num + info->app_data_len - expected_seq;
  194. } else {
  195. data_to_fill = info->app_data_len;
  196. data_to_process = 0;
  197. }
  198. uint8_t *p = info->app_data;
  199. if(data_to_fill){ //retransmit
  200. printf("Retransmiting data (%u:%u)\n", seq_num, seq_num + info->app_data_len);
  201. retransmit(observed, info, data_to_fill);
  202. }
  203. p += data_to_fill;
  204. if(data_to_process){
  205. if(p != info->app_data){
  206. printf("UH OH something weird might happen\n");
  207. }
  208. if(observed->application){
  209. if(seq_num > expected_seq){
  210. //For now, enters into FORFEIT state
  211. //TODO: change upstream behaviour to try to mask slitheen hdr
  212. //printf("ERROR: future packet in app data, forfeiting flow\n");
  213. remove_flow(observed);
  214. goto err;
  215. }
  216. replace_packet(observed, info);
  217. } else {
  218. //We're still in the TLS handshake; hold packets misordered packets
  219. if(seq_num > expected_seq){
  220. //Delay and process later
  221. frame *new_frame = ecalloc(1, sizeof(frame));
  222. new_frame->iargs = iargs;
  223. new_frame->packet = packet;
  224. new_frame->header = header;
  225. new_frame->seq_num = seq_num;
  226. new_frame->next = NULL;
  227. frame_queue *queue = (incoming) ? observed->ds_frame_queue : observed->us_frame_queue;
  228. printf("Delay processing of frame (seq = %u )\n", seq_num);
  229. //add to end of list
  230. if(queue->first_frame == NULL){
  231. queue->first_frame = new_frame;
  232. } else {
  233. frame *last = queue->first_frame;
  234. while(last->next != NULL){
  235. last = last->next;
  236. }
  237. last->next = new_frame;
  238. }
  239. free(info);
  240. observed->ref_ctr--;
  241. printf("Misordered packet. %p ref_ctr %d\n", observed, observed->ref_ctr);
  242. return; //TODO: fix terrible spaghetti returns
  243. }
  244. /* Pass data to packet chain */
  245. if(observed->stall){
  246. }
  247. if(add_packet(observed, info)){//removed_flow
  248. goto err;
  249. }
  250. }
  251. /* Update TCP state */
  252. if(info->tcp_hdr->flags & (FIN | RST) ){
  253. /* Remove flow from table, connection ended */
  254. remove_flow(observed);
  255. goto err;
  256. }
  257. /* add packet to application data queue */
  258. save_packet(observed, info);
  259. }
  260. /*process and release held frames with current sequence numbers*/
  261. frame_queue *queue = (incoming) ? observed->ds_frame_queue : observed->us_frame_queue;
  262. frame *first = queue->first_frame;
  263. frame *prev = queue->first_frame;
  264. expected_seq = (incoming)? observed->downstream_seq_num : observed->upstream_seq_num;
  265. while (first != NULL){
  266. if(first->seq_num <= expected_seq){
  267. //remove from queue and process
  268. if(first == queue->first_frame) {
  269. queue->first_frame = first->next;
  270. } else {
  271. prev->next = first->next;
  272. }
  273. printf("Now processing frame (seq = %u )\n", first->seq_num);
  274. process_packet(iargs, first->header, first->packet);
  275. free(first);
  276. first = queue->first_frame;
  277. prev = queue->first_frame;
  278. } else {
  279. prev = first;
  280. first = first->next;
  281. }
  282. }
  283. observed->ref_ctr--;
  284. }
  285. //TODO: figure out how to not need this
  286. tcp_checksum(info);//update checksum
  287. err:
  288. free(info);//Note: don't free this while a thread is using it
  289. inject_packet(iargs, header, packet);
  290. return;
  291. }
  292. //TODO: rewrite this function to remove bloat
  293. void save_packet(flow *f, struct packet_info *info){
  294. uint8_t incoming = (info->ip_hdr->src.s_addr != f->src_ip.s_addr)? 1 : 0;
  295. uint32_t seq_num = htonl(info->tcp_hdr->sequence_num);
  296. //add new app block
  297. packet *new_block = ecalloc(1, sizeof(packet));
  298. new_block->seq_num = htonl(info->tcp_hdr->sequence_num);
  299. new_block->data = ecalloc(1, info->app_data_len);
  300. memcpy(new_block->data, info->app_data, info->app_data_len);
  301. new_block->len = info->app_data_len;
  302. new_block->next = NULL;
  303. new_block->expiration = 0;
  304. packet *saved_data = (incoming)? f->downstream_app_data->first_packet :
  305. f->upstream_app_data->first_packet;
  306. //put app data block in queue
  307. if(saved_data == NULL){
  308. if(incoming){
  309. f->downstream_app_data->first_packet = new_block;
  310. if(new_block->seq_num ==
  311. f->downstream_seq_num){
  312. f->downstream_seq_num += new_block->len;
  313. #ifdef DEBUG
  314. printf("Updated downstream expected seqnum to %u\n",
  315. f->downstream_seq_num );
  316. #endif
  317. }
  318. } else {
  319. f->upstream_app_data->first_packet = new_block;
  320. if(new_block->seq_num ==
  321. f->upstream_seq_num){
  322. f->upstream_seq_num += new_block->len;
  323. #ifdef DEBUG
  324. printf("Updated upstream expected seqnum to %u\n",
  325. f->upstream_seq_num );
  326. #endif
  327. }
  328. }
  329. } else {
  330. uint8_t saved = 0;
  331. while(saved_data->next != NULL){
  332. if(!saved && (saved_data->next->seq_num > seq_num)){
  333. new_block->next = saved_data->next;
  334. saved_data->next = new_block;
  335. saved = 1;
  336. }
  337. //update expected sequence number
  338. if(incoming){
  339. if(saved_data->next->seq_num ==
  340. f->downstream_seq_num){
  341. f->downstream_seq_num += saved_data->next->len;
  342. #ifdef DEBUG
  343. printf("Updated downstream expected seqnum to %u\n",
  344. f->downstream_seq_num );
  345. #endif
  346. }
  347. } else {//outgoing
  348. if(saved_data->next->seq_num ==
  349. f->upstream_seq_num){
  350. f->upstream_seq_num += saved_data->next->len;
  351. #ifdef DEBUG
  352. printf("Updated upstream expected seqnum to %u\n",
  353. f->upstream_seq_num );
  354. #endif
  355. }
  356. }
  357. saved_data = saved_data->next;
  358. }
  359. if(!saved){
  360. saved_data->next = new_block;
  361. //update expected sequence number
  362. if(incoming){
  363. if(saved_data->next->seq_num ==
  364. f->downstream_seq_num){
  365. f->downstream_seq_num += saved_data->next->len;
  366. #ifdef DEBUG
  367. printf("Updated downstream expected seqnum to %u\n",
  368. f->downstream_seq_num );
  369. #endif
  370. }
  371. } else {//outgoing
  372. if(saved_data->next->seq_num ==
  373. f->upstream_seq_num){
  374. f->upstream_seq_num += saved_data->next->len;
  375. #ifdef DEBUG
  376. printf("Updated upstream expected seqnum to %u\n",
  377. f->upstream_seq_num );
  378. #endif
  379. }
  380. }
  381. }
  382. }
  383. }
  384. /**
  385. * This function cleans up data that has been acked, after the TCP window of the recipient has been
  386. * exceeded. This ensures that a retransmisson of the data will no longer occur.
  387. *
  388. * Sets the expiration for recent data base on the TCP window
  389. */
  390. void update_window_expiration(flow *f, struct packet_info *info){
  391. uint8_t incoming = (info->ip_hdr->src.s_addr != f->src_ip.s_addr)? 1 : 0;
  392. uint32_t ack_num = htonl(info->tcp_hdr->ack_num);
  393. uint32_t end_seq = htonl(info->tcp_hdr->sequence_num) + info->app_data_len - 1;
  394. uint32_t window = ack_num + htons(info->tcp_hdr->win_size);
  395. #ifdef DEBUG
  396. printf("Received sequence number %u\n", htonl(info->tcp_hdr->sequence_num));
  397. printf("Acknowledged up to %u with window expiring at %u\n", ack_num, window);
  398. printf("Removing all packets up to %u\n", end_seq);
  399. #endif
  400. packet *saved_data = (incoming)? f->downstream_app_data->first_packet :
  401. f->upstream_app_data->first_packet;
  402. while((saved_data != NULL) && (saved_data->expiration != 0) && (end_seq > saved_data->expiration)){
  403. //remove entire block
  404. if(incoming){
  405. f->downstream_app_data->first_packet = saved_data->next;
  406. } else {
  407. f->upstream_app_data->first_packet = saved_data->next;
  408. }
  409. free(saved_data->data);
  410. free(saved_data);
  411. saved_data = (incoming)? f->downstream_app_data->first_packet :
  412. f->upstream_app_data->first_packet;
  413. #ifdef DEBUG
  414. if(saved_data != NULL){
  415. printf("Currently saved seq_num is now %u\n", saved_data->seq_num);
  416. } else {
  417. printf("Acked all data, queue is empty\n");
  418. }
  419. #endif
  420. }
  421. /* Update expiration for packets based on TCP window size */
  422. saved_data = (incoming)? f->upstream_app_data->first_packet :
  423. f->downstream_app_data->first_packet;
  424. while((saved_data != NULL) && (ack_num > saved_data->seq_num)){
  425. //update window
  426. if(ack_num >= saved_data->seq_num + saved_data->len){
  427. //remove entire block
  428. saved_data->expiration = window;
  429. }
  430. saved_data = saved_data->next;
  431. }
  432. }
  433. /**
  434. * This function retransmits previously sent (and possibly modified) data
  435. *
  436. */
  437. void retransmit(flow *f, struct packet_info *info, uint32_t data_to_fill){
  438. uint8_t *p = info->app_data;
  439. uint32_t seq_num = htonl(info->tcp_hdr->sequence_num);
  440. uint8_t incoming = (info->ip_hdr->src.s_addr != f->src_ip.s_addr)? 1 : 0;
  441. packet *saved_data = (incoming)? f->downstream_app_data->first_packet :
  442. f->upstream_app_data->first_packet;
  443. while(data_to_fill > 0){
  444. if(saved_data == NULL){
  445. //have already acked all data
  446. p += data_to_fill;
  447. seq_num += data_to_fill;
  448. data_to_fill -= data_to_fill;
  449. continue;
  450. }
  451. if(seq_num < saved_data->seq_num){
  452. //we are missing a block. Use what was given
  453. if(saved_data->seq_num - seq_num > data_to_fill){
  454. //skip the rest
  455. p += data_to_fill;
  456. seq_num += data_to_fill;
  457. data_to_fill -= data_to_fill;
  458. } else {
  459. p += saved_data->seq_num - seq_num;
  460. data_to_fill -= saved_data->seq_num - seq_num;
  461. seq_num += saved_data->seq_num - seq_num;
  462. }
  463. } else if ( seq_num == saved_data->seq_num) {
  464. if(data_to_fill >= saved_data->len){
  465. //exhaust this block and move onto next one
  466. memcpy(p, saved_data->data, saved_data->len);
  467. p += saved_data->len;
  468. seq_num += saved_data->len;
  469. data_to_fill -= saved_data->len;
  470. saved_data = saved_data->next;
  471. } else {
  472. //fill with partial block
  473. memcpy(p, saved_data->data, data_to_fill);
  474. p += data_to_fill;
  475. seq_num += data_to_fill;
  476. data_to_fill -= data_to_fill;
  477. }
  478. } else { //seq_num > saved_data->seq_num
  479. uint32_t offset = seq_num - saved_data->seq_num;
  480. if(offset > saved_data->len){
  481. saved_data = saved_data->next;
  482. offset -= saved_data->len;
  483. } else {
  484. if(data_to_fill > saved_data->len - offset){
  485. memcpy(p, saved_data->data + offset, saved_data->len - offset);
  486. p += saved_data->len - offset;
  487. seq_num += saved_data->len - offset;
  488. data_to_fill -= saved_data->len - offset;
  489. saved_data = saved_data->next;
  490. } else {
  491. memcpy(p, saved_data->data + offset, data_to_fill);
  492. p += data_to_fill;
  493. seq_num += data_to_fill;
  494. data_to_fill -= data_to_fill;
  495. }
  496. }
  497. }
  498. }
  499. tcp_checksum(info);//update checksum
  500. }
  501. /** This function extracts the ip, tcp, and tls record headers
  502. * from a received packet (if they exist), and put them in
  503. * a packet_info struct
  504. *
  505. */
  506. void extract_packet_headers(uint8_t *packet, struct packet_info *info){
  507. /* First fill in IP header */
  508. uint8_t *p = packet;
  509. p += ETHER_HEADER_LEN; //skip ethernet header
  510. info->ip_hdr = (struct ip_header*) p;
  511. info->size_ip_hdr = IP_HEADER_LEN(info->ip_hdr);
  512. /* Verify this is an IP packet */
  513. if( (info->ip_hdr->versionihl >>4) != 4){
  514. info->ip_hdr = NULL;
  515. info->size_ip_hdr = 0;
  516. info->tcp_hdr = NULL;
  517. info->size_tcp_hdr = 0;
  518. info->record_hdr = NULL;
  519. return;
  520. }
  521. /* If this is a TCP segment, fill in TCP header */
  522. if (info->ip_hdr->proto == IPPROTO_TCP){
  523. p += info->size_ip_hdr; //skip IP header
  524. info->tcp_hdr = (struct tcp_header*) p;
  525. info->size_tcp_hdr = TCP_HEADER_LEN(info->tcp_hdr);
  526. p += info->size_tcp_hdr;
  527. } else {
  528. info->tcp_hdr = NULL;
  529. info->size_tcp_hdr = 0;
  530. info->record_hdr = NULL;
  531. return;
  532. }
  533. /* If the application data contains a TLS record, fill in hdr */
  534. info->app_data_len = htons(info->ip_hdr->len) - (info->size_ip_hdr + info->size_tcp_hdr);
  535. if(info->app_data_len > 0){
  536. info->app_data = p;
  537. info->record_hdr = (struct tls_header*) p;
  538. //check to see if this is a valid record
  539. if((info->record_hdr->type < 0x14) || (info->record_hdr->type > 0x18)){
  540. info->record_hdr = NULL;
  541. }
  542. } else {
  543. info->record_hdr = NULL;
  544. info->app_data = NULL;
  545. }
  546. return;
  547. }