From 95763527e73c0d06d3887e4a2da22f627f13bfaa Mon Sep 17 00:00:00 2001
From: Mosder <xmosder12@gmail.com>
Date: Tue, 28 Jul 2026 11:14:01 +0200
Subject: feat: added support for streams from both server and client (uhm,
 actually, there's only one stream, since TCP streams are bidirectional, blah,
 blah, blah...)

---
 analyzer/utils/tcp.c | 11 ++++++++---
 analyzer/utils/tcp.h | 28 +++++++++++++++++-----------
 2 files changed, 25 insertions(+), 14 deletions(-)

(limited to 'analyzer/utils')

diff --git a/analyzer/utils/tcp.c b/analyzer/utils/tcp.c
index 6309e64..7a79c67 100644
--- a/analyzer/utils/tcp.c
+++ b/analyzer/utils/tcp.c
@@ -6,6 +6,7 @@
 #include <stdlib.h>
 #include <string.h>
 
+#include "headers/server.h"
 #include "utils/memory.h"
 #include "utils/tcp_seq_math.h"
 
@@ -50,6 +51,9 @@ TCPSegment get_segment_from_packet(const byte_t *packet, const struct pcap_pkthd
     const struct ip *ip_header = (const struct ip *)(packet + eth_header_len);
     int ip_header_len = ip_header->ip_hl * 4;
 
+    // get source
+    segment.src = ip_header->ip_src.s_addr == inet_addr(SERVER_IP) ? SERVER : CLIENT;
+
     // check if it's TCP
     if (ip_header->ip_p != IPPROTO_TCP)
         return segment;
@@ -58,9 +62,9 @@ TCPSegment get_segment_from_packet(const byte_t *packet, const struct pcap_pkthd
     const struct tcphdr *tcp_header = (const struct tcphdr *)(packet + eth_header_len + ip_header_len);
     int tcp_header_len = tcp_header->th_off * 4;
 
-    // get TCP sequence number and destination port
+    // get TCP sequence number and client port
     segment.seq = ntohl(tcp_header->seq);
-    segment.port = ntohs(tcp_header->th_dport);
+    segment.port = ntohs(segment.src == SERVER ? tcp_header->th_dport : tcp_header->th_sport);
 
     // get payload
     int total_header_len = eth_header_len + ip_header_len + tcp_header_len;
@@ -70,7 +74,7 @@ TCPSegment get_segment_from_packet(const byte_t *packet, const struct pcap_pkthd
     return segment;
 }
 
-TCPStream new_stream() {
+TCPStream new_stream(ConnectionSource src) {
     // clang-format off
     TCPStream stream = {
         .data = safe_malloc(INIT_STREAM_CAPACITY),
@@ -78,6 +82,7 @@ TCPStream new_stream() {
         .capacity = INIT_STREAM_CAPACITY,
         .seq = 0,
         .port = 0,
+        .src = src,
         .pending = NULL
     };
     // clang-format on
diff --git a/analyzer/utils/tcp.h b/analyzer/utils/tcp.h
index 13cbb15..382c585 100644
--- a/analyzer/utils/tcp.h
+++ b/analyzer/utils/tcp.h
@@ -10,13 +10,16 @@
 
 typedef unsigned char byte_t;
 
+typedef enum { SERVER, CLIENT } ConnectionSource;
+
 // struct to persistently store TCP segments
 // payload field is malloced and needs to be freed
 typedef struct {
-    byte_t *payload; // payload in the segment
-    size_t len;      // length of the payload
-    uint32_t seq;    // TCP sequence number of the segment
-    uint16_t port;   // destination (client) port of connection the segment was received from
+    byte_t *payload;      // payload in the segment
+    size_t len;           // length of the payload
+    uint32_t seq;         // TCP sequence number of the segment
+    uint16_t port;        // client port of connection the segment was received from
+    ConnectionSource src; // segment's source
 } TCPSegment;
 
 // get TCP segment from captured packet
@@ -29,20 +32,23 @@ extern TCPSegment get_segment_from_packet(const byte_t *packet, const struct pca
 
 // struct that stores all the information about stream
 typedef struct {
-    byte_t *data;    // bytes in the stream
-    size_t len;      // length of the stream
-    size_t capacity; // capacity of the data buffer
-    uint32_t seq;    // TCP sequence number of the first byte in the stream
-    uint16_t port;   // destination (client) port of current analyzed connection
-    Heap *pending;   // min heap of segments yet to be added to stream (sorted by TCP sequence number)
+    byte_t *data;         // bytes in the stream
+    size_t len;           // length of the stream
+    size_t capacity;      // capacity of the data buffer
+    uint32_t seq;         // TCP sequence number of the first byte in the stream
+    uint16_t port;        // client port of currently analyzed connection
+    ConnectionSource src; // stream's source
+    Heap *pending;        // min heap of segments yet to be added to stream (sorted by TCP sequence number)
 } TCPStream;
 
 #define INIT_STREAM_CAPACITY 256
 
 // initialize new stream
+// params:
+//      - src - source of the stream
 // returns:
 //      newly created TCPStream structure with initial values
-extern TCPStream new_stream();
+extern TCPStream new_stream(ConnectionSource src);
 
 // cleanup memory allocations within stream
 // params:
-- 
cgit v1.2.3