slitheen-proxy.c 6.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248
  1. #include <pcap.h>
  2. #include <stdio.h>
  3. #include <stdlib.h>
  4. #include <unistd.h>
  5. #include <string.h>
  6. #include <pthread.h>
  7. #include <openssl/ssl.h>
  8. #include "flow.h"
  9. #include "slitheen.h"
  10. #include "relay.h"
  11. #include "crypto.h"
  12. void usage(void){
  13. printf("Usage: slitheen-proxy [internal network interface] [NAT interface]\n");
  14. }
  15. int main(int argc, char *argv[]){
  16. pthread_t t1, t2;
  17. char filter1[33] = "ether src host 08:00:27:0e:89:ea";
  18. char filter2[33] = "ether src host 08:00:27:0e:89:ea";
  19. char *dev1 = NULL; /* Device that leads to the internal network */
  20. char *dev2 = NULL; /* Device that leads out to the world */
  21. struct sniff_args outbound;
  22. struct sniff_args inbound;
  23. if (argc != 3) {
  24. usage();
  25. return(2);
  26. }
  27. dev1 = argv[1];
  28. dev2 = argv[2];
  29. snprintf(filter1, 33, "ether src host %s", macaddr);
  30. snprintf(filter2, 33, "ether dst host %s", macaddr);
  31. init_flow_table();
  32. init_session_cache();
  33. /* Create threads */
  34. outbound.readdev = dev1;
  35. outbound.writedev = dev2;
  36. outbound.filter = filter1;
  37. inbound.readdev = dev2;
  38. inbound.writedev = dev1;
  39. inbound.filter = filter2;
  40. pthread_create(&t1, NULL, sniff_packets, (void *) &outbound);
  41. pthread_create(&t2, NULL, sniff_packets, (void *) &inbound);
  42. pthread_join(t1, NULL);
  43. pthread_join(t2, NULL);
  44. return(0);
  45. }
  46. void *sniff_packets(void *args){
  47. pcap_t *rd_handle;
  48. pcap_t *wr_handle;
  49. char rd_errbuf[BUFSIZ];
  50. char wr_errbuf[BUFSIZ];
  51. struct bpf_program fp;
  52. bpf_u_int32 mask;
  53. bpf_u_int32 net;
  54. char *readdev, *writedev, *filter;
  55. struct sniff_args *arg_st = (struct sniff_args *) args;
  56. readdev = arg_st->readdev;
  57. writedev = arg_st->writedev;
  58. filter = arg_st->filter;
  59. if (pcap_lookupnet(readdev, &net, &mask, rd_errbuf) == -1){
  60. fprintf(stderr, "Can't get netmask for device %s\n", readdev);
  61. exit(2);
  62. }
  63. rd_handle = pcap_open_live(readdev, BUFSIZ, 1, 0, rd_errbuf);
  64. if (rd_handle == NULL){
  65. fprintf(stderr, "Couldn't open device %s: %s\n", readdev, rd_errbuf);
  66. }
  67. if(pcap_datalink(rd_handle) != DLT_EN10MB) {
  68. fprintf(stderr, "Device %s does not provide Ethernet headers - not supported\n", readdev);
  69. exit(2);
  70. }
  71. if(pcap_compile(rd_handle, &fp, filter, 0 , net) == -1){
  72. fprintf(stderr, "Couldn't parse filter %s: %s\n", filter, pcap_geterr(rd_handle));
  73. exit(2);
  74. }
  75. if (pcap_setfilter(rd_handle, &fp) == -1) {
  76. fprintf(stderr, "Couldn't install filter %s: %s\n", filter, pcap_geterr(rd_handle));
  77. exit(2);
  78. }
  79. wr_handle = pcap_open_live(writedev, BUFSIZ, 1, 0, wr_errbuf);
  80. if (wr_handle == NULL){
  81. fprintf(stderr, "Couldn't open device %s: %s\n", writedev, wr_errbuf);
  82. }
  83. /*callback function*/
  84. pcap_loop(rd_handle, -1, got_packet, (unsigned char *) wr_handle);
  85. /*Sniff a packet*/
  86. pcap_close(rd_handle);
  87. return NULL;
  88. }
  89. void got_packet(uint8_t *args, const struct pcap_pkthdr *header, const uint8_t *packet){
  90. pcap_t *handle = (pcap_t *) args;
  91. struct packet_info *info = calloc(1, sizeof(struct packet_info));
  92. uint8_t *tmp_packet = calloc(1, header->len);
  93. memcpy(tmp_packet, packet, header->len);
  94. extract_packet_headers(tmp_packet, info);
  95. // Check to make sure it is an IP packet
  96. if(info->ip_hdr == NULL)
  97. goto end;
  98. process_packet(info);
  99. end:
  100. if((pcap_inject(handle, tmp_packet, header->len)) < 0 ){
  101. fprintf(stderr, "Error: %s\n", pcap_geterr(handle));
  102. }
  103. free(info);//Note: don't free this while a thread is using it
  104. #ifdef DEBUG
  105. fprintf(stderr, "injected the following packet:\n");
  106. for(int i=0; i< header->len; i++){
  107. fprintf(stderr, "%02x ", packet[i]);
  108. }
  109. fprintf(stderr, "\n");
  110. #endif
  111. }
  112. /* This function receives a full ip packet and then:
  113. * 1) identifies the flow
  114. * 2) adds the packet to the flow's data chain
  115. * 3) updates the flow's state
  116. */
  117. void process_packet(struct packet_info *info){
  118. int index;
  119. flow newFlow;
  120. if (info->tcp_hdr != NULL){
  121. newFlow.src_ip = info->ip_hdr->src;
  122. newFlow.dst_ip = info->ip_hdr->dst;
  123. newFlow.src_port = info->tcp_hdr->src_port;
  124. newFlow.dst_port = info->tcp_hdr->dst_port;
  125. newFlow.seq_num = info->tcp_hdr->sequence_num;
  126. /* Checks to see if this is a possibly tagged hello msg */
  127. if ((info->record_hdr != NULL) && (info->record_hdr->type == HS)){ /* This is a TLS handshake */
  128. check_handshake(info, newFlow);
  129. }
  130. }
  131. /* Now if flow is in table, update state */
  132. if((index = check_flow(newFlow))){
  133. flow *observed = get_flow(index-1);
  134. if(observed->application){
  135. replace_packet(observed, info);
  136. } else {
  137. /* Pass data to packet chain */
  138. add_packet(observed, info);
  139. /* Update flow state */
  140. if(observed->packet_chain != NULL){
  141. update_flow(observed);
  142. }
  143. }
  144. /* Update TCP state */
  145. if(info->tcp_hdr->flags & (FIN | RST) ){
  146. /* Remove flow from table, connection ended */
  147. remove_flow(index);
  148. }
  149. }
  150. }
  151. /** This function extracts the ip, tcp, and tls record headers
  152. * from a received packet (if they exist), and put them in
  153. * a packet_info struct
  154. *
  155. */
  156. void extract_packet_headers(uint8_t *packet, struct packet_info *info){
  157. /* First fill in IP header */
  158. uint8_t *p = packet;
  159. p += ETHER_HEADER_LEN; //skip ethernet header
  160. info->ip_hdr = (struct ip_header*) p;
  161. info->size_ip_hdr = IP_HEADER_LEN(info->ip_hdr);
  162. /* Verify this is an IP packet */
  163. if( (info->ip_hdr->versionihl >>4) != 4){
  164. info->ip_hdr = NULL;
  165. info->size_ip_hdr = 0;
  166. info->tcp_hdr = NULL;
  167. info->size_tcp_hdr = 0;
  168. info->record_hdr = NULL;
  169. return;
  170. }
  171. /* If this is a TCP segment, fill in TCP header */
  172. if (info->ip_hdr->proto == IPPROTO_TCP){
  173. p += info->size_ip_hdr; //skip IP header
  174. info->tcp_hdr = (struct tcp_header*) p;
  175. info->size_tcp_hdr = TCP_HEADER_LEN(info->tcp_hdr);
  176. p += info->size_tcp_hdr;
  177. } else {
  178. info->tcp_hdr = NULL;
  179. info->size_tcp_hdr = 0;
  180. info->record_hdr = NULL;
  181. return;
  182. }
  183. /* If the application data contains a TLS record, fill in hdr */
  184. info->app_data_len = htons(info->ip_hdr->len) - (info->size_ip_hdr + info->size_tcp_hdr);
  185. if(info->app_data_len > 0){
  186. info->app_data = p;
  187. info->record_hdr = (struct tls_header*) p;
  188. //check to see if this is a valid record
  189. if((info->record_hdr->type < 0x14) || (info->record_hdr->type > 0x18)){
  190. info->record_hdr = NULL;
  191. }
  192. } else {
  193. info->record_hdr = NULL;
  194. info->app_data = NULL;
  195. }
  196. return;
  197. }