cooking.c

#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <time.h>
#include <errno.h>
#include <pcap.h>
#include <sys/shm.h>
#include <netinet/in.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>
#include <arpa/inet.h>
#include <assert.h>

#include "mapid.h"
#include "mapidflib.h"
#include "mapidlib.h"
#include "mapidevices.h"
#include "fhelp.h"
#include "cooking.h"
#include "list.h"
#include "pcapio.h"
#include "libnids/nids.h"

#define int_ntoa(x) inet_ntoa(*((struct in_addr *)&x))

#define SERVER 0
#define CLIENT 1
#define FRAG_BUF_SIZE 16*1024

#define CHECKED 15
#define NON_CHECKED 16

static int threshold = 0;
static unsigned int timeout = 0;
//unsigned int client_size = 0,server_size=0;

struct mapidlibflow *mod_flow = NULL;

char* to_free = NULL;
char* to_free2 = NULL;


struct headers_data *headers = NULL;
extern struct pcap_pkthdr *nids_last_pcap_header;

mapid_pkthdr_t *last_mapid_header;

int status;
unsigned char *last_dev_pkt;

struct mapidlibflow *cook_tmp_flow=NULL;
static int cooking_id=0;


static int cook_instance(mapidflib_function_instance_t* instance, flist_t *flist, mapidflib_flow_mod_t *flow_mod,function_manipulation_t* manip)
{

	flist_node_t *n;
	struct mapidlibflow *flow=NULL;
	mapidlib_instance_t *i;
	struct cooking_data* data; 


	i = flow_mod->mi;
	n = flist_head(i->flowlist);

	while(n)
	{
		flow = flist_data(n);
		if(flow->fd == instance->fd)
		{
			break;
		}
		n = flist_next(n);
	}
	
	data= (struct cooking_data*)malloc(sizeof(struct cooking_data));
	data->flow=flow;
	instance->internal_data=data;
	return 0;
}

void create_mod_pkt(unsigned char *dev_pkt,struct mapidlibflow *flow,mapid_pkthdr_t *pkt_head) {
	
	ether_header* eth = NULL;
	ip_header* ip = NULL;
	tcp_header* tcp = NULL;
	int ether_len = 0, ip_len = 0, tcp_len = 0;
	
	eth = (ether_header*)dev_pkt;
	ether_len = sizeof(ether_header);
	ip = (ip_header*)(dev_pkt + ether_len);
	ip_len = (ip->ver_ihl & 0xf) * 4;
	
	tcp = (tcp_header*)(dev_pkt + ether_len + ip_len);
	tcp_len = tcp->off * 4;
	tcp->seq = 0;
	
	ip->tlen = ntohs(flow->client_size + ip_len + tcp_len);
	
	flow->mod_pkt = malloc(sizeof(char) * (flow->client_size + ether_len + ip_len + tcp_len));
	assert(flow->mod_pkt!=NULL);
	memcpy(flow->mod_pkt, eth, ether_len);
	memcpy(&flow->mod_pkt[ether_len], ip, ip_len);
	memcpy(&flow->mod_pkt[ether_len + ip_len], tcp, tcp_len);
	
	memcpy(&flow->mod_pkt[ether_len + ip_len + tcp_len], flow->ret_client_data, flow->client_size);
	
	//server packet
	flow->server_mod_pkt = malloc(sizeof(char) * (flow->server_size + ether_len + ip_len + tcp_len));
	assert(flow->server_mod_pkt!=NULL);
	memcpy(flow->server_mod_pkt, eth, ether_len);
	memcpy(&flow->server_mod_pkt[ether_len], ip, ip_len);
	memcpy(&flow->server_mod_pkt[ether_len + ip_len], tcp, tcp_len);
	memcpy(&flow->server_mod_pkt[ether_len + ip_len + tcp_len], flow->ret_server_data, flow->server_size);
	flow->server_mod_pkt_head.caplen = flow->server_mod_pkt_head.wlen = flow->server_size + ether_len + ip_len + tcp_len;	

	flow->client_headers = flow->ret_client_headers;
	flow->server_headers = flow->ret_server_headers;

	pkt_head->caplen = pkt_head->wlen = flow->client_size + ether_len + ip_len + tcp_len;	
}

void process_flushed_data(struct mapidlibflow *flow) {
}


void tcp_callback(struct tcp_stream *ns, void **param)
{
	struct mapidlibflow *flow;

	flow=ns->flow;

	if(ns->nids_state == NIDS_JUST_EST)
	{
		//fprintf(stderr,"JUST_EST\n");
		ns->client.collect++;
		if(threshold==-1) { 
			ns->client.reassembled_data = NULL; 
			ns->client_reassembly_limit=0;
		}
		else {
			ns->client.reassembled_data = (char *)malloc(sizeof(char) * threshold+2000);
		}
		ns->client.read = 0;
		ns->client.total_read = 0;
		if(ns->client.headers==NULL) {
			fprintf(stderr,"Initing 2..\n");
			ns->client.headers = (flist_t *)malloc(sizeof(flist_t));
			flist_init(ns->client.headers);
		}
		ns->client.pkt_count = 0;
		
		// and by a server
		ns->server.collect++;
		if(threshold==-1) { 
			ns->server.reassembled_data = NULL; 
			ns->server_reassembly_limit=0;
		}
		else {
			ns->server.reassembled_data = (char *)malloc(sizeof(char) * threshold+2000);
		}
		
		ns->server.read = 0;
		ns->server.total_read = 0;
		if(ns->server.headers==NULL) {
			ns->server.headers = (flist_t *)malloc(sizeof(flist_t));
			flist_init(ns->server.headers);
		}
		ns->server.pkt_count = 0;
		ns->flow=NULL;
		return;
	}

	status = CHECKED;

	if(ns->nids_state == NIDS_EXITING) {
	    
		flow->ret_client_data = ns->client.reassembled_data;
		flow->ret_server_data = ns->server.reassembled_data;
		flow->client_size = ns->client.read;
		flow->server_size = ns->server.read;
		flow->ret_client_headers = ns->client.headers;
		flow->ret_server_headers = ns->server.headers;
		
		flow=(struct mapidlibflow *)(ns->flow);
		create_mod_pkt(last_dev_pkt,flow,&flow->mod_pkt_head);
		process_flushed_data(flow);
		return;
	}

	if(ns->nids_state == NIDS_CLOSE || ns->nids_state == NIDS_RESET || ns->nids_state == NIDS_TIMED_OUT || ns->nids_state == NIDS_EXITING)
	{
		//fprintf(stderr,"session closed %d   %d - %d\n",ns->nids_state==NIDS_CLOSE,ns->client.total_read,ns->client.count);

		if(to_free != NULL) {  free(to_free); to_free = NULL; }
		if(to_free2 != NULL) {  free(to_free2); to_free2 = NULL; }
		
		if(ns->client.total_read < ns->client.count || threshold == -1)
		{
			if(flow->ret_client_data == NULL)
			{
	           	flow->ret_client_data = ns->client.reassembled_data;
				flow->ret_server_data = ns->server.reassembled_data;
				
				to_free = flow->ret_client_data;
				to_free2 = flow->ret_server_data;
				
				flow->client_size = ns->client.read;
				flow->server_size = ns->server.read;
				
				
				flow->ret_client_headers = ns->client.headers;
				flow->ret_server_headers = ns->server.headers;
				
				//fprintf(stderr,"final data: %d %d %d\n",flow->client_size,flist_size(ns->client.headers),ns->nids_state==NIDS_EXITING);
				return;
			}
		}
		else if(ns->server.total_read < ns->server.count || threshold ==-1)
		{
			if(flow->ret_server_data == NULL)
			{
				flow->ret_server_data = ns->server.reassembled_data;
	            flow->ret_client_data = ns->client.reassembled_data;
				to_free = flow->ret_server_data;
				to_free2 = flow->ret_client_data;
				
				flow->server_size = ns->server.read;
				flow->client_size = ns->client.read;
				//fprintf(stderr,"++final data: %d %d\n",server_size,flist_size(ns->server.headers));
				
				flow->ret_server_headers = ns->server.headers;
				flow->ret_client_headers = ns->client.headers;

				return;
			}
		}
			
		return;
	}

	if(ns->nids_state == NIDS_DATA)
	{
		if(ns->client.count_new)
		{
			char *dest = NULL;
			ns->client.pkt_count++;
			
			if(threshold == -1 ) {
				if((ns->client.read + ns->client.count_new) > ns->client_reassembly_limit) {
					ns->client.reassembled_data=(unsigned char *)realloc(ns->client.reassembled_data,ns->client_reassembly_limit+INCR_SIZE);
					ns->client_reassembly_limit+=INCR_SIZE;
				}	
				
				dest = &ns->client.reassembled_data[ns->client.read];
				ns->client.total_read = ns->client.count;
				ns->client.read += (ns->client.count_new);
				memcpy(dest, ns->client.data, ns->client.count_new);
				return;
			}
			
			if((ns->client.read + ns->client.count_new) > threshold)	
			{
				dest = &ns->client.reassembled_data[ns->client.read];
			
				flow->ret_client_headers = ns->client.headers;
				flow->ret_client_data = ns->client.reassembled_data;
				flow->client_size = ns->client.read + ns->client.count_new;
				ns->client.total_read = ns->client.count;
				ns->client.read = 0;
				
				flow->ret_server_headers = ns->server.headers;
				flow->ret_server_data = ns->server.reassembled_data;
				flow->server_size=ns->server.read;
				ns->server.total_read = ns->server.count;
				ns->server.read = 0;
			
				memcpy(dest, ns->client.data, ns->client.count_new);
				return;	
			}
			else if((ns->client.count - ns->client.count_new) == 0)
			{
				dest = ns->client.reassembled_data;
			}
			else
			{
				dest = &ns->client.reassembled_data[ns->client.read];
			}
			
			memcpy(dest, ns->client.data, ns->client.count_new);
			ns->client.read += (ns->client.count_new);
		}
		
		if(ns->server.count_new)
		{
			char *dest = NULL;
			ns->server.pkt_count++;
			
			if(threshold == -1 ) {
				if((ns->server.read + ns->server.count_new) > ns->server_reassembly_limit) {
					ns->server.reassembled_data=(unsigned char *)realloc(ns->server.reassembled_data,ns->server_reassembly_limit+INCR_SIZE);
					ns->server_reassembly_limit+=INCR_SIZE;
				}	
				
				dest = &ns->server.reassembled_data[ns->server.read];
				ns->server.total_read = ns->server.count;
				ns->server.read += (ns->server.count_new);
				memcpy(dest, ns->server.data, ns->server.count_new);
				return;
			}
			
			if((ns->server.read + ns->server.count_new) > threshold)
			{
				dest = &ns->server.reassembled_data[ns->server.read];
				
				flow->ret_server_headers = ns->server.headers;
				flow->ret_server_data = ns->server.reassembled_data;
				flow->server_size = ns->server.read + ns->server.count_new;
				
				flow->ret_client_headers = ns->client.headers;
				flow->ret_client_data = ns->client.reassembled_data;
				flow->client_size = ns->client.read;
				ns->client.total_read = ns->client.count;
				ns->client.read=0;
				
				ns->server.total_read = ns->server.count;
				ns->server.read = 0;

				memcpy(dest, ns->server.data, ns->server.count_new);
				return;
			}
			else if((ns->server.count - ns->server.count_new) == 0)
			{
				dest = ns->server.reassembled_data;
			}
			else
			{
				dest = &ns->server.reassembled_data[ns->server.read];
			} 
			memcpy(dest, ns->server.data, ns->server.count_new);
			ns->server.read += ns->server.count_new;
		}
	}

	return;
}

static int cook_init(mapidflib_function_instance_t *instance,
		     flist_t *flist)
{
	mapiFunctArg* fargs;
	struct pcap desc;
	struct cooking_data *data;
	fargs=instance->args;

	data=(struct cooking_data *)(instance->internal_data);
	
	data->threshold=getargint(&fargs);
	data->timeout=getargint(&fargs);
	data->id=cooking_id;
	cooking_id++;
	
	desc.fd = 1;
	desc.linktype = instance->hwinfo->link_type;
	desc.bufsize = instance->hwinfo->cap_length;

	nids_mapi_init(&desc, instance->hwinfo->link_type,data->id);

	nids_mapi_register_tcp(tcp_callback,data->id);

	if(data->threshold <= 0)
	{
		data->threshold = -1;
	}

	return 0;
}

//////////////////////////////////////////////

// return 1 in order for processing to continue in other functions
// return 0 not to

static int cook_process(mapidflib_function_instance_t *instance,const unsigned char* dev_pkt,const unsigned char* link_pkt, mapid_pkthdr_t* pkt_head)
{
	
	struct pcap_pkthdr h;
	ether_header* eth = NULL;
	struct ip *iph;
	struct tcphdr *tcph;
	int ether_len = 0, ip_len = 0;
	struct mapidlibflow *flow;
	
	//fprintf(stderr,"I am COOKING\n");

	last_dev_pkt= link_pkt;
	last_mapid_header = pkt_head;
		
	h.caplen=pkt_head->caplen;
	h.len=pkt_head->wlen;
	h.ts.tv_sec=pkt_head->ts; //XXX 
	h.ts.tv_usec=pkt_head->ts;

	struct cooking_data* data = (struct cooking_data*)(instance->internal_data);
	threshold = data->threshold;
	timeout = data->timeout;
	flow=data->flow;
	
	status = NON_CHECKED;
	
	flow->ret_client_data = NULL;
	flow->ret_server_data = NULL;
	flow->client_size=flow->server_size=0;

	
	eth = (ether_header*)link_pkt;
	ether_len = sizeof(ether_header);
	iph = (struct ip*)(link_pkt + ether_len);
	ip_len = (iph->ip_hl & 0xf) * 4;
	if(iph->ip_p != IPPROTO_TCP)	// no TCP packet
		return 1;
	
	nids_mapi_next(&h, link_pkt,data->id);	
	
	if(status == NON_CHECKED)
	{
		//fprintf(stderr,"\tnon check report\n");
		struct tcp_stream *stream;
		int from_client;

		tcph = (struct tcphdr *)(link_pkt + ether_len + ip_len);

		//XXX replace 0 
		stream= find_stream(tcph,iph,&from_client,data->id);
		if(stream) {
			//fprintf(stderr,"\tStream found\n");
			headers = malloc(sizeof(struct headers_data));
			headers->header = malloc(pkt_head->caplen); //added 100 more bytes
			memcpy(headers->header,link_pkt,pkt_head->caplen);
			headers->caplen = pkt_head->caplen;
			headers->wlen = pkt_head->wlen;
			headers->ts.tv_sec = pkt_head->ts; //XXX
			headers->ts.tv_usec = pkt_head->ts;
			if(from_client==0) {
				if(stream->client.headers==NULL) {
					stream->client.headers = (flist_t *)malloc(sizeof(flist_t));
					flist_init(stream->client.headers);
				}
				flist_append(stream->client.headers, stream->client.pkt_count, (void *)headers);
			}
			else {
				if(stream->server.headers==NULL) {
					stream->server.headers = (flist_t *)malloc(sizeof(flist_t));
					flist_init(stream->server.headers);
				}
				flist_append(stream->server.headers, stream->server.pkt_count, (void *)headers);
			}

			stream->flow=(void *)flow;
		}
		else { //unsolicited data
			//fprintf(stderr,"Stream not found\n");
			return 1;
		}
		return 0;
	}
	else {
		struct tcp_stream *stream;
		int from_client;
		
		//fprintf(stderr,"\tcheck report %d\n",flow->client_size);
		tcph = (struct tcphdr *)(link_pkt + ether_len + ip_len);
		
		headers = malloc(sizeof(struct headers_data));
		headers->header = malloc(pkt_head->caplen); 
		memcpy(headers->header, link_pkt,pkt_head->caplen);
		headers->caplen = pkt_head->caplen;
		headers->wlen = pkt_head->wlen;
		headers->ts.tv_sec = pkt_head->ts; //XXX
		headers->ts.tv_usec = pkt_head->ts;
	
		//XXX replace 0
		stream= find_stream(tcph,iph,&from_client,data->id);
		if(stream==NULL) {
			//fprintf(stderr,"\tNULL stream %d %d\n",headers->ts.tv_sec,headers->ts.tv_usec);
			create_mod_pkt(link_pkt,flow,pkt_head);
			flist_append(flow->server_headers,0, (void *)headers);
			return 1;
		}
		
		stream->flow=(void *)flow;
		
		if(from_client==0) {
			if(stream->client.headers==NULL) {
				stream->client.headers = (flist_t *)malloc(sizeof(flist_t));
				flist_init(stream->client.headers);
			}
			flist_append(stream->client.headers, stream->client.pkt_count, (void *)headers);
		}
		else {
			if(stream->server.headers==NULL) {
				stream->server.headers = (flist_t *)malloc(sizeof(flist_t));
				flist_init(stream->server.headers);
			}
			flist_append(stream->server.headers, stream->server.pkt_count, (void *)headers);
		}
	}
	
	if(flow->ret_client_data != NULL || flow->ret_server_data!=NULL)
	{
		// Set pseudoheader and new cooked packet to return to the daemon
		create_mod_pkt(link_pkt,flow,pkt_head);
		return 1;
	}

	return 0;

}

//////////////////////////////////////////////

static int cook_cleanup(mapidflib_function_instance_t *instance)
{
	return 0;
}

//////////////////////////////////////////////

static mapidflib_function_def_t cooking_finfo =
{
	"", //libname
	"COOKING", //name
	"Cooking TCP/IP packets", //Description
	"ii", //argdescr
	MAPI_DEVICE_ALL, //Devoid
	MAPIRES_NONE,
	0, //shm size
	1, //modifies_pkts
	cook_instance, //instance
	cook_init, //init
	cook_process, //process
	NULL, //get_result,
	NULL, //change_args
	NULL, //reset
	cook_cleanup, //cleanup
	NULL, //client_init
	NULL, //client_read_result
	NULL  //client_cleanup
};

mapidflib_function_def_t* cooking_get_funct_info();

mapidflib_function_def_t* cooking_get_funct_info()
{
	return &cooking_finfo;
};