slitheen-proxy.c 22 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689
  1. /* Name: slitheen-proxy.c
  2. *
  3. * Slitheen - a decoy routing system for censorship resistance
  4. * Copyright (C) 2017 Cecylia Bocovich (cbocovic@uwaterloo.ca)
  5. *
  6. * This program is free software: you can redistribute it and/or modify
  7. * it under the terms of the GNU General Public License as published by
  8. * the Free Software Foundation, version 3.
  9. *
  10. * This program is distributed in the hope that it will be useful,
  11. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  13. * GNU General Public License for more details.
  14. *
  15. * You should have received a copy of the GNU General Public License
  16. * along with this program. If not, see <http://www.gnu.org/licenses/>.
  17. *
  18. * Additional permission under GNU GPL version 3 section 7
  19. *
  20. * If you modify this Program, or any covered work, by linking or combining
  21. * it with the OpenSSL library (or a modified version of that library),
  22. * containing parts covered by the terms of the OpenSSL Licence and the
  23. * SSLeay license, the licensors of this Program grant you additional
  24. * permission to convey the resulting work. Corresponding Source for a
  25. * non-source form of such a combination shall include the source code
  26. * for the parts of the OpenSSL library used as well as that of the covered
  27. * work.
  28. */
  29. #include <pcap.h>
  30. #include <stdio.h>
  31. #include <stdlib.h>
  32. #include <unistd.h>
  33. #include <string.h>
  34. #include <pthread.h>
  35. #include <sys/ioctl.h>
  36. #include <net/if.h>
  37. #include <openssl/ssl.h>
  38. #include "util.h"
  39. #include "flow.h"
  40. #include "slitheen.h"
  41. #include "relay.h"
  42. #include "crypto.h"
  43. #include "cryptothread.h"
  44. void save_packet(flow *f, struct packet_info *info);
  45. void update_window_expiration(flow *f, struct packet_info *info);
  46. void retransmit(flow *f, struct packet_info *info, uint32_t data_to_fill);
  47. void usage(void){
  48. printf("Usage: slitheen-proxy [internal network interface] [NAT interface]\n");
  49. }
  50. int main(int argc, char *argv[]){
  51. pthread_t t1, t2;
  52. char *dev1 = NULL; /* Device that leads to the internal network */
  53. char *dev2 = NULL; /* Device that leads out to the world */
  54. struct sniff_args outbound;
  55. struct sniff_args inbound;
  56. if (argc != 3) {
  57. usage();
  58. return(2);
  59. }
  60. dev1 = argv[1];
  61. dev2 = argv[2];
  62. if(init_tables()){
  63. exit(1);
  64. }
  65. if(init_session_cache()){
  66. exit(1);
  67. }
  68. init_crypto_locks();
  69. /* Create threads */
  70. outbound.readdev = dev1;
  71. outbound.writedev = dev2;
  72. inbound.readdev = dev2;
  73. inbound.writedev = dev1;
  74. pthread_create(&t1, NULL, sniff_packets, (void *) &outbound);
  75. pthread_create(&t2, NULL, sniff_packets, (void *) &inbound);
  76. pthread_join(t1, NULL);
  77. pthread_join(t2, NULL);
  78. pthread_exit(NULL);
  79. crypto_locks_cleanup();
  80. return(0);
  81. }
  82. void *sniff_packets(void *args){
  83. pcap_t *rd_handle;
  84. pcap_t *wr_handle;
  85. char rd_errbuf[BUFSIZ];
  86. char wr_errbuf[BUFSIZ];
  87. uint8_t MAC[ETHER_ADDR_LEN];
  88. bpf_u_int32 mask;
  89. bpf_u_int32 net;
  90. char *readdev, *writedev;
  91. struct sniff_args *arg_st = (struct sniff_args *) args;
  92. readdev = arg_st->readdev;
  93. writedev = arg_st->writedev;
  94. //Find MAC address of each interface
  95. struct ifreq ifr;
  96. int s = socket(AF_INET, SOCK_DGRAM, 0);
  97. strcpy(ifr.ifr_name, writedev);
  98. ioctl(s, SIOCGIFHWADDR, &ifr);
  99. memcpy(MAC, ifr.ifr_hwaddr.sa_data, ETHER_ADDR_LEN);
  100. close(s);
  101. if (pcap_lookupnet(readdev, &net, &mask, rd_errbuf) == -1){
  102. fprintf(stderr, "Can't get netmask for device %s\n", readdev);
  103. exit(2);
  104. }
  105. rd_handle = pcap_open_live(readdev, BUFSIZ, 0, 0, rd_errbuf);
  106. if (rd_handle == NULL){
  107. fprintf(stderr, "Couldn't open device %s: %s\n", readdev, rd_errbuf);
  108. }
  109. if(pcap_datalink(rd_handle) != DLT_EN10MB) {
  110. fprintf(stderr, "Device %s does not provide Ethernet headers - not supported\n", readdev);
  111. exit(2);
  112. }
  113. if(pcap_setdirection(rd_handle, PCAP_D_IN)){
  114. fprintf(stderr, "Platform does not support write direction. Update filters with MAC address\n");
  115. exit(2);
  116. }
  117. wr_handle = pcap_open_live(writedev, BUFSIZ, 0, 0, wr_errbuf);
  118. if (wr_handle == NULL){
  119. fprintf(stderr, "Couldn't open device %s: %s\n", writedev, wr_errbuf);
  120. }
  121. struct inject_args iargs;
  122. iargs.mac_addr = MAC;
  123. iargs.write_dev = wr_handle;
  124. /*callback function*/
  125. pcap_loop(rd_handle, -1, got_packet, (unsigned char *) &iargs);
  126. /*Sniff a packet*/
  127. pcap_close(rd_handle);
  128. return NULL;
  129. }
  130. /*
  131. * Injects a packet back out the opposite interface
  132. */
  133. void inject_packet(struct inject_args *iargs, const struct pcap_pkthdr *header, uint8_t *packet){
  134. pcap_t *handle = iargs->write_dev;
  135. //write back out to the MAC ADDR it came in on
  136. //memmove(packet, packet+ETHER_ADDR_LEN, ETHER_ADDR_LEN);
  137. //memcpy(packet+ETHER_ADDR_LEN, iargs->mac_addr, ETHER_ADDR_LEN);
  138. if((pcap_inject(handle, packet, header->len)) < 0 ){
  139. fprintf(stderr, "Error: %s\n", pcap_geterr(handle));
  140. printf("Length: %d\n", header->len);
  141. }
  142. #ifdef DEBUG
  143. fprintf(stderr, "injected the following packet:\n");
  144. for(int i=0; i< header->len; i++){
  145. fprintf(stderr, "%02x ", packet[i]);
  146. }
  147. fprintf(stderr, "\n");
  148. #endif
  149. free(packet);
  150. }
  151. /**
  152. * Runs when pcap_loop receives a packet from the specified interface
  153. * If the received packet is a tcp packet, processes it and then writes it back out
  154. * to the interface
  155. *
  156. */
  157. void got_packet(uint8_t *args, const struct pcap_pkthdr *header, const uint8_t *packet){
  158. struct inject_args *iargs = (struct inject_args *) args;
  159. uint8_t *tmp_packet = emalloc(header->len);
  160. memcpy(tmp_packet, packet, header->len);
  161. process_packet(iargs, header, tmp_packet);
  162. }
  163. /* This function receives a full ip packet and then:
  164. * 1) identifies the flow
  165. * 2) adds the packet to the flow's data chain
  166. * 3) updates the flow's state
  167. */
  168. void process_packet(struct inject_args *iargs, const struct pcap_pkthdr *header, uint8_t *packet){
  169. struct packet_info *info = emalloc(sizeof(struct packet_info));
  170. extract_packet_headers(packet, info);
  171. //Ignore non-TCP packets (shouldn't actually get any)
  172. if((info->ip_hdr == NULL) || (info->tcp_hdr == NULL)){
  173. //free(info);
  174. //free(packet);
  175. //return;
  176. goto err;
  177. }
  178. /* Checks to see if this is a possibly tagged hello msg */
  179. if ((info->record_hdr != NULL) && (info->record_hdr->type == HS)){ /* This is a TLS handshake */
  180. check_handshake(info);
  181. }
  182. /* Now if flow is in table, update state */
  183. flow *observed;
  184. if((observed = check_flow(info)) != NULL){
  185. #ifdef DEBUG
  186. /*Check sequence number and replay application data if necessary*/
  187. fprintf(stdout,"Flow: %x:%d > %x:%d (%s)\n", info->ip_hdr->src.s_addr, ntohs(info->tcp_hdr->src_port), info->ip_hdr->dst.s_addr, ntohs(info->tcp_hdr->dst_port), (info->ip_hdr->src.s_addr != observed->src_ip.s_addr)? "incoming":"outgoing");
  188. fprintf(stdout,"ID number: %u\n", htonl(info->ip_hdr->id));
  189. fprintf(stdout,"Sequence number: %u\n", htonl(info->tcp_hdr->sequence_num));
  190. fprintf(stdout,"Acknowledgement number: %u\n", htonl(info->tcp_hdr->ack_num));
  191. #endif
  192. uint8_t incoming = (info->ip_hdr->src.s_addr != observed->src_ip.s_addr)? 1 : 0;
  193. uint32_t seq_num = htonl(info->tcp_hdr->sequence_num);
  194. uint32_t expected_seq = (incoming)? observed->downstream_seq_num : observed->upstream_seq_num;
  195. #ifdef DEBUG
  196. fprintf(stdout,"Expected sequence number: %u\n", expected_seq);
  197. #endif
  198. /* Remove acknowledged data from queue after TCP window is exceeded */
  199. update_window_expiration(observed, info);
  200. /* fill with retransmit data, process new data */
  201. uint32_t data_to_fill;
  202. uint32_t data_to_process;
  203. if(seq_num > expected_seq){
  204. data_to_process = info->app_data_len;
  205. data_to_fill = 0;
  206. } else if (seq_num + info->app_data_len > expected_seq){
  207. data_to_fill = expected_seq - seq_num;
  208. data_to_process = seq_num + info->app_data_len - expected_seq;
  209. } else {
  210. data_to_fill = info->app_data_len;
  211. data_to_process = 0;
  212. }
  213. uint8_t *p = info->app_data;
  214. if(data_to_fill){ //retransmit
  215. printf("Retransmiting data (%u:%u)\n", seq_num, seq_num + info->app_data_len);
  216. retransmit(observed, info, data_to_fill);
  217. }
  218. p += data_to_fill;
  219. if(data_to_process){
  220. if(p != info->app_data){
  221. printf("UH OH something weird might happen\n");
  222. }
  223. if(observed->application){
  224. if(seq_num > expected_seq){
  225. //For now, enters into FORFEIT state
  226. //TODO: change upstream behaviour to try to mask slitheen hdr
  227. //printf("ERROR: future packet in app data, forfeiting flow\n");
  228. remove_flow(observed);
  229. goto err;
  230. }
  231. replace_packet(observed, info);
  232. } else {
  233. //We're still in the TLS handshake; hold packets misordered packets
  234. if(seq_num > expected_seq){
  235. //Delay and process later
  236. frame *new_frame = ecalloc(1, sizeof(frame));
  237. new_frame->iargs = iargs;
  238. new_frame->packet = packet;
  239. new_frame->header = header;
  240. new_frame->seq_num = seq_num;
  241. new_frame->next = NULL;
  242. frame_queue *queue = (incoming) ? observed->ds_frame_queue : observed->us_frame_queue;
  243. printf("Delay processing of frame (seq = %u )\n", seq_num);
  244. //add to end of list
  245. if(queue->first_frame == NULL){
  246. queue->first_frame = new_frame;
  247. } else {
  248. frame *last = queue->first_frame;
  249. while(last->next != NULL){
  250. last = last->next;
  251. }
  252. last->next = new_frame;
  253. }
  254. free(info);
  255. observed->ref_ctr--;
  256. printf("Misordered packet. %p ref_ctr %d\n", observed, observed->ref_ctr);
  257. return; //TODO: fix terrible spaghetti returns
  258. }
  259. /* Pass data to packet chain */
  260. if(observed->stall){
  261. }
  262. if(add_packet(observed, info)){//removed_flow
  263. goto err;
  264. }
  265. }
  266. /* Update TCP state */
  267. if(info->tcp_hdr->flags & (FIN | RST) ){
  268. /* Remove flow from table, connection ended */
  269. remove_flow(observed);
  270. goto err;
  271. }
  272. /* add packet to application data queue */
  273. save_packet(observed, info);
  274. }
  275. /*process and release held frames with current sequence numbers*/
  276. frame_queue *queue = (incoming) ? observed->ds_frame_queue : observed->us_frame_queue;
  277. frame *first = queue->first_frame;
  278. frame *prev = queue->first_frame;
  279. expected_seq = (incoming)? observed->downstream_seq_num : observed->upstream_seq_num;
  280. while (first != NULL){
  281. if(first->seq_num <= expected_seq){
  282. //remove from queue and process
  283. if(first == queue->first_frame) {
  284. queue->first_frame = first->next;
  285. } else {
  286. prev->next = first->next;
  287. }
  288. printf("Now processing frame (seq = %u )\n", first->seq_num);
  289. process_packet(iargs, first->header, first->packet);
  290. free(first);
  291. first = queue->first_frame;
  292. prev = queue->first_frame;
  293. } else {
  294. prev = first;
  295. first = first->next;
  296. }
  297. }
  298. observed->ref_ctr--;
  299. printf("Finished processing packet. %p ref_ctr %d\n", observed, observed->ref_ctr);
  300. }
  301. err:
  302. free(info);//Note: don't free this while a thread is using it
  303. inject_packet(iargs, header, packet);
  304. return;
  305. }
  306. //TODO: rewrite this function to remove bloat
  307. void save_packet(flow *f, struct packet_info *info){
  308. uint8_t incoming = (info->ip_hdr->src.s_addr != f->src_ip.s_addr)? 1 : 0;
  309. uint32_t seq_num = htonl(info->tcp_hdr->sequence_num);
  310. //add new app block
  311. packet *new_block = ecalloc(1, sizeof(packet));
  312. new_block->seq_num = htonl(info->tcp_hdr->sequence_num);
  313. new_block->data = ecalloc(1, info->app_data_len);
  314. memcpy(new_block->data, info->app_data, info->app_data_len);
  315. new_block->len = info->app_data_len;
  316. new_block->next = NULL;
  317. new_block->expiration = 0;
  318. packet *saved_data = (incoming)? f->downstream_app_data->first_packet :
  319. f->upstream_app_data->first_packet;
  320. //put app data block in queue
  321. if(saved_data == NULL){
  322. if(incoming){
  323. f->downstream_app_data->first_packet = new_block;
  324. if(new_block->seq_num ==
  325. f->downstream_seq_num){
  326. f->downstream_seq_num += new_block->len;
  327. #ifdef DEBUG
  328. printf("Updated downstream expected seqnum to %u\n",
  329. f->downstream_seq_num );
  330. #endif
  331. }
  332. } else {
  333. f->upstream_app_data->first_packet = new_block;
  334. if(new_block->seq_num ==
  335. f->upstream_seq_num){
  336. f->upstream_seq_num += new_block->len;
  337. #ifdef DEBUG
  338. printf("Updated upstream expected seqnum to %u\n",
  339. f->upstream_seq_num );
  340. #endif
  341. }
  342. }
  343. } else {
  344. uint8_t saved = 0;
  345. while(saved_data->next != NULL){
  346. if(!saved && (saved_data->next->seq_num > seq_num)){
  347. new_block->next = saved_data->next;
  348. saved_data->next = new_block;
  349. saved = 1;
  350. }
  351. //update expected sequence number
  352. if(incoming){
  353. if(saved_data->next->seq_num ==
  354. f->downstream_seq_num){
  355. f->downstream_seq_num += saved_data->next->len;
  356. #ifdef DEBUG
  357. printf("Updated downstream expected seqnum to %u\n",
  358. f->downstream_seq_num );
  359. #endif
  360. }
  361. } else {//outgoing
  362. if(saved_data->next->seq_num ==
  363. f->upstream_seq_num){
  364. f->upstream_seq_num += saved_data->next->len;
  365. #ifdef DEBUG
  366. printf("Updated upstream expected seqnum to %u\n",
  367. f->upstream_seq_num );
  368. #endif
  369. }
  370. }
  371. saved_data = saved_data->next;
  372. }
  373. if(!saved){
  374. saved_data->next = new_block;
  375. //update expected sequence number
  376. if(incoming){
  377. if(saved_data->next->seq_num ==
  378. f->downstream_seq_num){
  379. f->downstream_seq_num += saved_data->next->len;
  380. #ifdef DEBUG
  381. printf("Updated downstream expected seqnum to %u\n",
  382. f->downstream_seq_num );
  383. #endif
  384. }
  385. } else {//outgoing
  386. if(saved_data->next->seq_num ==
  387. f->upstream_seq_num){
  388. f->upstream_seq_num += saved_data->next->len;
  389. #ifdef DEBUG
  390. printf("Updated upstream expected seqnum to %u\n",
  391. f->upstream_seq_num );
  392. #endif
  393. }
  394. }
  395. }
  396. }
  397. }
  398. /**
  399. * This function cleans up data that has been acked, after the TCP window of the recipient has been
  400. * exceeded. This ensures that a retransmisson of the data will no longer occur.
  401. *
  402. * Sets the expiration for recent data base on the TCP window
  403. */
  404. void update_window_expiration(flow *f, struct packet_info *info){
  405. uint8_t incoming = (info->ip_hdr->src.s_addr != f->src_ip.s_addr)? 1 : 0;
  406. uint32_t ack_num = htonl(info->tcp_hdr->ack_num);
  407. uint32_t end_seq = htonl(info->tcp_hdr->sequence_num) + info->app_data_len - 1;
  408. uint32_t window = ack_num + htons(info->tcp_hdr->win_size);
  409. #ifdef DEBUG
  410. printf("Received sequence number %u\n", htonl(info->tcp_hdr->sequence_num));
  411. printf("Acknowledged up to %u with window expiring at %u\n", ack_num, window);
  412. printf("Removing all packets up to %u\n", end_seq);
  413. #endif
  414. packet *saved_data = (incoming)? f->downstream_app_data->first_packet :
  415. f->upstream_app_data->first_packet;
  416. while((saved_data != NULL) && (saved_data->expiration != 0) && (end_seq > saved_data->expiration)){
  417. //remove entire block
  418. if(incoming){
  419. f->downstream_app_data->first_packet = saved_data->next;
  420. } else {
  421. f->upstream_app_data->first_packet = saved_data->next;
  422. }
  423. free(saved_data->data);
  424. free(saved_data);
  425. saved_data = (incoming)? f->downstream_app_data->first_packet :
  426. f->upstream_app_data->first_packet;
  427. #ifdef DEBUG
  428. if(saved_data != NULL){
  429. printf("Currently saved seq_num is now %u\n", saved_data->seq_num);
  430. } else {
  431. printf("Acked all data, queue is empty\n");
  432. }
  433. #endif
  434. }
  435. /* Update expiration for packets based on TCP window size */
  436. saved_data = (incoming)? f->upstream_app_data->first_packet :
  437. f->downstream_app_data->first_packet;
  438. while((saved_data != NULL) && (ack_num > saved_data->seq_num)){
  439. //update window
  440. if(ack_num >= saved_data->seq_num + saved_data->len){
  441. //remove entire block
  442. saved_data->expiration = window;
  443. }
  444. saved_data = saved_data->next;
  445. }
  446. }
  447. /**
  448. * This function retransmits previously sent (and possibly modified) data
  449. *
  450. */
  451. void retransmit(flow *f, struct packet_info *info, uint32_t data_to_fill){
  452. uint8_t *p = info->app_data;
  453. uint32_t seq_num = htonl(info->tcp_hdr->sequence_num);
  454. uint8_t incoming = (info->ip_hdr->src.s_addr != f->src_ip.s_addr)? 1 : 0;
  455. packet *saved_data = (incoming)? f->downstream_app_data->first_packet :
  456. f->upstream_app_data->first_packet;
  457. while(data_to_fill > 0){
  458. if(saved_data == NULL){
  459. //have already acked all data
  460. p += data_to_fill;
  461. seq_num += data_to_fill;
  462. data_to_fill -= data_to_fill;
  463. continue;
  464. }
  465. if(seq_num < saved_data->seq_num){
  466. //we are missing a block. Use what was given
  467. if(saved_data->seq_num - seq_num > data_to_fill){
  468. //skip the rest
  469. p += data_to_fill;
  470. seq_num += data_to_fill;
  471. data_to_fill -= data_to_fill;
  472. } else {
  473. p += saved_data->seq_num - seq_num;
  474. data_to_fill -= saved_data->seq_num - seq_num;
  475. seq_num += saved_data->seq_num - seq_num;
  476. }
  477. } else if ( seq_num == saved_data->seq_num) {
  478. if(data_to_fill >= saved_data->len){
  479. //exhaust this block and move onto next one
  480. memcpy(p, saved_data->data, saved_data->len);
  481. p += saved_data->len;
  482. seq_num += saved_data->len;
  483. data_to_fill -= saved_data->len;
  484. saved_data = saved_data->next;
  485. } else {
  486. //fill with partial block
  487. memcpy(p, saved_data->data, data_to_fill);
  488. p += data_to_fill;
  489. seq_num += data_to_fill;
  490. data_to_fill -= data_to_fill;
  491. }
  492. } else { //seq_num > saved_data->seq_num
  493. uint32_t offset = seq_num - saved_data->seq_num;
  494. if(offset > saved_data->len){
  495. saved_data = saved_data->next;
  496. offset -= saved_data->len;
  497. } else {
  498. if(data_to_fill > saved_data->len - offset){
  499. memcpy(p, saved_data->data + offset, saved_data->len - offset);
  500. p += saved_data->len - offset;
  501. seq_num += saved_data->len - offset;
  502. data_to_fill -= saved_data->len - offset;
  503. saved_data = saved_data->next;
  504. } else {
  505. memcpy(p, saved_data->data + offset, data_to_fill);
  506. p += data_to_fill;
  507. seq_num += data_to_fill;
  508. data_to_fill -= data_to_fill;
  509. }
  510. }
  511. }
  512. }
  513. tcp_checksum(info);//update checksum
  514. }
  515. /** This function extracts the ip, tcp, and tls record headers
  516. * from a received packet (if they exist), and put them in
  517. * a packet_info struct
  518. *
  519. */
  520. void extract_packet_headers(uint8_t *packet, struct packet_info *info){
  521. /* First fill in IP header */
  522. uint8_t *p = packet;
  523. p += ETHER_HEADER_LEN; //skip ethernet header
  524. info->ip_hdr = (struct ip_header*) p;
  525. info->size_ip_hdr = IP_HEADER_LEN(info->ip_hdr);
  526. /* Verify this is an IP packet */
  527. if( (info->ip_hdr->versionihl >>4) != 4){
  528. info->ip_hdr = NULL;
  529. info->size_ip_hdr = 0;
  530. info->tcp_hdr = NULL;
  531. info->size_tcp_hdr = 0;
  532. info->record_hdr = NULL;
  533. return;
  534. }
  535. /* If this is a TCP segment, fill in TCP header */
  536. if (info->ip_hdr->proto == IPPROTO_TCP){
  537. p += info->size_ip_hdr; //skip IP header
  538. info->tcp_hdr = (struct tcp_header*) p;
  539. info->size_tcp_hdr = TCP_HEADER_LEN(info->tcp_hdr);
  540. p += info->size_tcp_hdr;
  541. } else {
  542. info->tcp_hdr = NULL;
  543. info->size_tcp_hdr = 0;
  544. info->record_hdr = NULL;
  545. return;
  546. }
  547. /* If the application data contains a TLS record, fill in hdr */
  548. info->app_data_len = htons(info->ip_hdr->len) - (info->size_ip_hdr + info->size_tcp_hdr);
  549. if(info->app_data_len > 0){
  550. info->app_data = p;
  551. info->record_hdr = (struct tls_header*) p;
  552. //check to see if this is a valid record
  553. if((info->record_hdr->type < 0x14) || (info->record_hdr->type > 0x18)){
  554. info->record_hdr = NULL;
  555. }
  556. } else {
  557. info->record_hdr = NULL;
  558. info->app_data = NULL;
  559. }
  560. return;
  561. }
  562. /** Copies a packet_info structure and returns a pointer to the duplicate.
  563. */
  564. struct packet_info *copy_packet_info(struct packet_info *src_info){
  565. struct packet_info *dst_info = emalloc(sizeof(struct packet_info));
  566. dst_info->ip_hdr = src_info->ip_hdr;
  567. dst_info->tcp_hdr = src_info->tcp_hdr;
  568. dst_info->size_tcp_hdr = src_info->size_tcp_hdr;
  569. dst_info->size_ip_hdr = src_info->size_ip_hdr;
  570. dst_info->app_data = src_info->app_data;
  571. dst_info->app_data_len = src_info->app_data_len;
  572. return dst_info;
  573. }