blob: 382c585345a1ee0f6f1673fec27a28b2f408d9a0 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
|
// utils/tcp.h
// functions for handling TCP streams/segments
#include <pcap.h>
#include "structures/heap.h"
#ifndef TCP_H
#define TCP_H
typedef unsigned char byte_t;
typedef enum { SERVER, CLIENT } ConnectionSource;
// struct to persistently store TCP segments
// payload field is malloced and needs to be freed
typedef struct {
byte_t *payload; // payload in the segment
size_t len; // length of the payload
uint32_t seq; // TCP sequence number of the segment
uint16_t port; // client port of connection the segment was received from
ConnectionSource src; // segment's source
} TCPSegment;
// get TCP segment from captured packet
// params:
// - packet - captured packet
// - packet_data - metadata about packet
// returns:
// TCPSegment from packet, payload is NULL if the received packet was incorrect
extern TCPSegment get_segment_from_packet(const byte_t *packet, const struct pcap_pkthdr *packet_data);
// struct that stores all the information about stream
typedef struct {
byte_t *data; // bytes in the stream
size_t len; // length of the stream
size_t capacity; // capacity of the data buffer
uint32_t seq; // TCP sequence number of the first byte in the stream
uint16_t port; // client port of currently analyzed connection
ConnectionSource src; // stream's source
Heap *pending; // min heap of segments yet to be added to stream (sorted by TCP sequence number)
} TCPStream;
#define INIT_STREAM_CAPACITY 256
// initialize new stream
// params:
// - src - source of the stream
// returns:
// newly created TCPStream structure with initial values
extern TCPStream new_stream(ConnectionSource src);
// cleanup memory allocations within stream
// params:
// stream - stream to destroy
extern void destroy_stream(TCPStream stream);
// remove parsed data from the stream
// params:
// - stream - pointer to the stream to remove a part of
// - parsed_len - count of n first bytes of the stream that were parsed
extern void remove_parsed_data(TCPStream *stream, size_t parsed_len);
// max difference between expected TCP seq and received TCP seq to still accept it into pending
#define MAX_SEQ_OFFSET 100000
// add TCP segment to stream, pending or completely discard it
// params:
// - stream - pointer to the current stream
// - segment - segment to handle
// returns:
// 1 if the segment was added to the stream, 0 if it was discarded or saved to pending
extern int handle_segment(TCPStream *stream, TCPSegment segment);
#endif
|
