diff options
| -rw-r--r-- | trafgen/Makefile | 1 | ||||
| -rw-r--r-- | trafgen_l4.c | 32 | ||||
| -rw-r--r-- | trafgen_l7.c | 170 | ||||
| -rw-r--r-- | trafgen_l7.h | 45 | ||||
| -rw-r--r-- | trafgen_proto.c | 127 | ||||
| -rw-r--r-- | trafgen_proto.h | 19 |
6 files changed, 392 insertions, 2 deletions
diff --git a/trafgen/Makefile b/trafgen/Makefile index 3369d4a..d38f0b0 100644 --- a/trafgen/Makefile +++ b/trafgen/Makefile @@ -29,6 +29,7 @@ trafgen-objs = xmalloc.o \ trafgen_l2.o \ trafgen_l3.o \ trafgen_l4.o \ + trafgen_l7.o \ trafgen_lexer.yy.o \ trafgen_parser.tab.o \ trafgen.o diff --git a/trafgen_l4.c b/trafgen_l4.c index 5a694b3..198d622 100644 --- a/trafgen_l4.c +++ b/trafgen_l4.c @@ -80,6 +80,21 @@ static void udp_packet_finish(struct proto_hdr *hdr) udp_csum_update(hdr); } +static void udp_set_next_proto(struct proto_hdr *hdr, enum proto_id pid) +{ + uint16_t dport; + + switch (pid) { + case PROTO_DNS: + dport = 53; + break; + default: + bug(); + } + + proto_hdr_field_set_default_be16(hdr, UDP_DPORT, dport); +} + static const struct proto_ops udp_proto_ops = { .id = PROTO_UDP, .layer = PROTO_L4, @@ -87,6 +102,7 @@ static const struct proto_ops udp_proto_ops = { .packet_update = udp_csum_update, .packet_finish = udp_packet_finish, .field_changed = udp_field_changed, + .set_next_proto = udp_set_next_proto, }; static struct proto_field tcp_fields[] = { @@ -160,6 +176,21 @@ static void tcp_csum_update(struct proto_hdr *hdr) hdr->is_csum_valid = true; } +static void tcp_set_next_proto(struct proto_hdr *hdr, enum proto_id pid) +{ + uint16_t dport; + + switch (pid) { + case PROTO_DNS: + dport = 53; + break; + default: + bug(); + } + + proto_hdr_field_set_default_be16(hdr, TCP_DPORT, dport); +} + static const struct proto_ops tcp_proto_ops = { .id = PROTO_TCP, .layer = PROTO_L4, @@ -167,6 +198,7 @@ static const struct proto_ops tcp_proto_ops = { .packet_update = tcp_csum_update, .packet_finish = tcp_csum_update, .field_changed = tcp_field_changed, + .set_next_proto = tcp_set_next_proto, }; static struct proto_field icmpv4_fields[] = { diff --git a/trafgen_l7.c b/trafgen_l7.c new file mode 100644 index 0000000..f801677 --- /dev/null +++ b/trafgen_l7.c @@ -0,0 +1,170 @@ +/* + * netsniff-ng - the packet sniffing beast + * Subject to the GPL, version 2. + */ + +#include <string.h> + +#include "str.h" +#include "xmalloc.h" +#include "built_in.h" +#include "trafgen_l7.h" +#include "trafgen_proto.h" + +static struct proto_field dns_fields[] = { + { .id = DNS_ID, .len = 2, .offset = 0 }, + { .id = DNS_QR, .len = 2, .offset = 2, .shift = 15, .mask = 0x8000 }, + { .id = DNS_OPCODE, .len = 2, .offset = 2, .shift = 11, .mask = 0x7800 }, + { .id = DNS_AA, .len = 2, .offset = 2, .shift = 10, .mask = 0x0400 }, + { .id = DNS_TC, .len = 2, .offset = 2, .shift = 9, .mask = 0x0200 }, + { .id = DNS_RD, .len = 2, .offset = 2, .shift = 8, .mask = 0x0100 }, + { .id = DNS_RA, .len = 2, .offset = 2, .shift = 7, .mask = 0x80 }, + { .id = DNS_ZERO, .len = 2, .offset = 2, .shift = 4, .mask = 0x30 }, + { .id = DNS_RCODE, .len = 2, .offset = 2, .shift = 0, .mask = 0xf }, + { .id = DNS_QD_COUNT, .len = 2, .offset = 4, }, + { .id = DNS_AN_COUNT, .len = 2, .offset = 6, }, + { .id = DNS_NS_COUNT, .len = 2, .offset = 8, }, + { .id = DNS_AR_COUNT, .len = 2, .offset = 10, }, +}; + +static struct proto_field dns_query_fields[] = { + { .id = DNS_QUERY_NAME, .len = 0, .offset = 0 }, + { .id = DNS_QUERY_TYPE, .len = 2, .offset = 0 }, + { .id = DNS_QUERY_CLASS, .len = 2, .offset = 2 }, +}; + +static void dns_query_header_init(struct proto_hdr *hdr) +{ + proto_header_fields_add(hdr, dns_query_fields, array_size(dns_query_fields)); +} + +static void dns_query_header_finish(struct proto_hdr *hdr) +{ + proto_hdr_field_set_default_string(hdr, DNS_QUERY_NAME, "www.netsniff-ng.com"); + proto_hdr_field_set_default_be16(hdr, DNS_QUERY_CLASS, 1); + proto_hdr_field_set_default_be16(hdr, DNS_QUERY_TYPE, 1); +} + +static const struct proto_ops dns_proto_query_ops = { + .header_init = dns_query_header_init, + .header_finish = dns_query_header_finish, +}; + +static struct proto_field dns_rrecord_fields[] = { + { .id = DNS_RRECORD_NAME, .len = 0, .offset = 0 }, + { .id = DNS_RRECORD_TYPE, .len = 2, .offset = 0 }, + { .id = DNS_RRECORD_CLASS, .len = 2, .offset = 2 }, + { .id = DNS_RRECORD_TTL, .len = 4, .offset = 4 }, + { .id = DNS_RRECORD_LEN, .len = 2, .offset = 8 }, + { .id = DNS_RRECORD_DATA, .len = 0, .offset = 10 }, +}; + +static void dns_rrecord_header_init(struct proto_hdr *hdr) +{ + proto_header_fields_add(hdr, dns_rrecord_fields, array_size(dns_rrecord_fields)); +} + +static void dns_rrecord_header_finish(struct proto_hdr *hdr) +{ + struct proto_field *data = proto_hdr_field_by_id(hdr, DNS_RRECORD_DATA); + + proto_hdr_field_set_default_be32(hdr, DNS_RRECORD_TTL, 1); + proto_hdr_field_set_default_be16(hdr, DNS_RRECORD_CLASS, 1); + proto_hdr_field_set_default_be16(hdr, DNS_RRECORD_LEN, data->len); +} + +static const struct proto_ops dns_proto_rrecord_ops = { + .header_init = dns_rrecord_header_init, + .header_finish = dns_rrecord_header_finish, +}; + +static void dns_header_init(struct proto_hdr *hdr) +{ + proto_lower_default_add(hdr, PROTO_UDP); + + proto_header_fields_add(hdr, dns_fields, array_size(dns_fields)); +} + +static void dns_sort_headers(struct proto_hdr *hdr, uint32_t id, int index) +{ + int i; + + for (i = index; i < hdr->sub_headers_count; i++) { + struct proto_hdr *sub_hdr = hdr->sub_headers[i]; + + if (sub_hdr->id == id && sub_hdr->index != index) { + proto_hdr_move_sub_header(hdr, sub_hdr, hdr->sub_headers[index]); + index++; + } + } +} + +static void dns_header_finish(struct proto_hdr *hdr) +{ + size_t ar_count = 0; + size_t ns_count = 0; + size_t qd_count = 0; + size_t an_count = 0; + int i; + + for (i = 0; i < hdr->sub_headers_count; i++) { + struct proto_hdr *sub_hdr = hdr->sub_headers[i]; + + switch (sub_hdr->id) { + case DNS_QUERY_HDR: + qd_count++; + break; + case DNS_ANSWER_HDR: + an_count++; + break; + case DNS_AUTH_HDR: + ns_count++; + break; + case DNS_ADD_HDR: + ar_count++; + break; + } + } + + dns_sort_headers(hdr, DNS_QUERY_HDR, 0); + dns_sort_headers(hdr, DNS_ANSWER_HDR, qd_count); + dns_sort_headers(hdr, DNS_AUTH_HDR, qd_count + an_count); + dns_sort_headers(hdr, DNS_ADD_HDR, qd_count + an_count + ns_count); + + proto_hdr_field_set_default_be16(hdr, DNS_QD_COUNT, qd_count); + proto_hdr_field_set_default_be16(hdr, DNS_AN_COUNT, an_count); + proto_hdr_field_set_default_be16(hdr, DNS_NS_COUNT, ns_count); + proto_hdr_field_set_default_be16(hdr, DNS_AR_COUNT, ar_count); + + if (an_count) + proto_hdr_field_set_default_be16(hdr, DNS_QR, 1); +} + +static void dns_push_sub_header(struct proto_hdr *hdr, struct proto_hdr *sub_hdr) +{ + switch (sub_hdr->id) { + case DNS_QUERY_HDR: + sub_hdr->ops = &dns_proto_query_ops; + break; + case DNS_ANSWER_HDR: + case DNS_AUTH_HDR: + case DNS_ADD_HDR: + sub_hdr->ops = &dns_proto_rrecord_ops; + break; + default: + bug(); + } +} + +static const struct proto_ops dns_proto_ops = { + .id = PROTO_DNS, + .layer = PROTO_L7, + .header_init = dns_header_init, + .header_finish = dns_header_finish, + .push_sub_header = dns_push_sub_header, +}; + +void protos_l7_init(void) +{ + proto_ops_register(&dns_proto_ops); +} diff --git a/trafgen_l7.h b/trafgen_l7.h new file mode 100644 index 0000000..cf19fa4 --- /dev/null +++ b/trafgen_l7.h @@ -0,0 +1,45 @@ +#ifndef TRAFGEN_L7_H +#define TRAFGEN_L7_H + +enum dns_field { + DNS_ID, + DNS_QR, + DNS_OPCODE, + DNS_AA, + DNS_TC, + DNS_RD, + DNS_RA, + DNS_ZERO, + DNS_RCODE, + DNS_QD_COUNT, + DNS_AN_COUNT, + DNS_NS_COUNT, + DNS_AR_COUNT, +}; + +enum dns_header { + DNS_UNDEF_HDR, + DNS_QUERY_HDR, + DNS_ANSWER_HDR, + DNS_AUTH_HDR, + DNS_ADD_HDR, +}; + +enum dns_query_field { + DNS_QUERY_NAME, + DNS_QUERY_TYPE, + DNS_QUERY_CLASS, +}; + +enum dns_rrecord_field { + DNS_RRECORD_NAME, + DNS_RRECORD_TYPE, + DNS_RRECORD_CLASS, + DNS_RRECORD_TTL, + DNS_RRECORD_LEN, + DNS_RRECORD_DATA, +}; + +extern void protos_l7_init(void); + +#endif /* TRAFGEN_L7_H */ diff --git a/trafgen_proto.c b/trafgen_proto.c index 7969b77..0353d6b 100644 --- a/trafgen_proto.c +++ b/trafgen_proto.c @@ -14,6 +14,7 @@ #include "trafgen_l2.h" #include "trafgen_l3.h" #include "trafgen_l4.h" +#include "trafgen_l7.h" #include "trafgen_proto.h" #define field_shift_and_mask(f, v) (((v) << (f)->shift) & \ @@ -157,6 +158,111 @@ void proto_header_finish(struct proto_hdr *hdr) hdr->ops->header_finish(hdr); } +struct proto_hdr *proto_hdr_push_sub_header(struct proto_hdr *hdr, int id) +{ + struct proto_hdr *sub_hdr; + + sub_hdr = xzmalloc(sizeof(struct proto_hdr)); + sub_hdr->index = hdr->sub_headers_count; + sub_hdr->parent = hdr; + sub_hdr->id = id; + + hdr->sub_headers_count++; + hdr->sub_headers = xrealloc(hdr->sub_headers, + hdr->sub_headers_count * sizeof(struct proto_hdr *)); + + hdr->sub_headers[hdr->sub_headers_count - 1] = sub_hdr; + + if (hdr->ops->push_sub_header) + hdr->ops->push_sub_header(hdr, sub_hdr); + + if (sub_hdr->ops->header_init) + sub_hdr->ops->header_init(sub_hdr); + + return sub_hdr; +} + +static void __proto_hdr_set_offset(struct proto_hdr *hdr, uint16_t pkt_offset) +{ + size_t i; + + hdr->pkt_offset = pkt_offset; + + for (i = 0; i < hdr->fields_count; i++) { + struct proto_field *f = &hdr->fields[i]; + + f->pkt_offset = pkt_offset + f->offset; + } +} + +void proto_hdr_move_sub_header(struct proto_hdr *hdr, struct proto_hdr *from, + struct proto_hdr *to) +{ + struct proto_hdr *src_hdr, *dst_hdr, *tmp; + uint8_t *src_ptr, *dst_ptr; + uint16_t to_pkt_offset; + uint16_t to_index; + uint16_t pkt_offset; + int idx_shift; + size_t len = 0; + uint8_t *buf; + int i; + + if (hdr->sub_headers_count < 2) + return; + if (from->index == to->index) + return; + + buf = xmemdupz(proto_header_ptr(from), from->len); + + to_pkt_offset = to->pkt_offset; + to_index = to->index; + + if (from->index < to->index) { + src_hdr = hdr->sub_headers[from->index + 1]; + dst_hdr = to; + + src_ptr = proto_header_ptr(src_hdr); + dst_ptr = proto_header_ptr(from); + len = (to->pkt_offset + to->len) - src_hdr->pkt_offset; + + pkt_offset = from->pkt_offset; + idx_shift = 1; + } else { + src_hdr = to; + dst_hdr = hdr->sub_headers[from->index - 1]; + + src_ptr = proto_header_ptr(src_hdr); + dst_ptr = src_ptr + from->len; + len = from->pkt_offset - to->pkt_offset; + + pkt_offset = to->pkt_offset + from->len; + idx_shift = -1; + } + + hdr->sub_headers[from->index] = to; + hdr->sub_headers[to->index] = from; + + for (i = src_hdr->index; i <= dst_hdr->index; i++) { + tmp = hdr->sub_headers[i]; + + __proto_hdr_set_offset(tmp, pkt_offset); + pkt_offset += tmp->len; + } + + for (i = src_hdr->index; i <= dst_hdr->index; i++) + hdr->sub_headers[i]->index = i + idx_shift; + + memmove(dst_ptr, src_ptr, len); + + from->pkt_offset = to_pkt_offset; + from->index = to_index; + + memcpy(proto_header_ptr(from), buf, from->len); + + xfree(buf); +} + struct proto_hdr *proto_lower_default_add(struct proto_hdr *upper, enum proto_id pid) { @@ -481,6 +587,16 @@ void proto_hdr_field_set_default_dev_ipv6(struct proto_hdr *hdr, uint32_t fid) __proto_hdr_field_set_dev_ipv6(hdr, fid, true); } +void proto_hdr_field_set_string(struct proto_hdr *hdr, uint32_t fid, const char *str) +{ + proto_hdr_field_set_bytes(hdr, fid, (uint8_t *)str, strlen(str) + 1); +} + +void proto_hdr_field_set_default_string(struct proto_hdr *hdr, uint32_t fid, const char *str) +{ + proto_hdr_field_set_default_bytes(hdr, fid, (uint8_t *)str, strlen(str) + 1); +} + void proto_field_set_u8(struct proto_field *field, uint8_t val) { __proto_field_set_bytes(field, &val, 1, false, false); @@ -532,6 +648,16 @@ void proto_field_set_bytes(struct proto_field *field, const uint8_t *bytes, size __proto_field_set_bytes(field, bytes, len, false, false); } +void proto_field_set_string(struct proto_field *field, const char *str) +{ + proto_field_set_bytes(field, (uint8_t *)str, strlen(str) + 1); +} + +void proto_field_set_default_string(struct proto_field *field, const char *str) +{ + __proto_field_set_bytes(field, (uint8_t *)str, strlen(str) + 1, true, false); +} + void protos_init(const char *dev) { ctx.dev = dev; @@ -539,6 +665,7 @@ void protos_init(const char *dev) protos_l2_init(); protos_l3_init(); protos_l4_init(); + protos_l7_init(); } void proto_packet_update(uint32_t idx) diff --git a/trafgen_proto.h b/trafgen_proto.h index 94eb4e7..f3d07ba 100644 --- a/trafgen_proto.h +++ b/trafgen_proto.h @@ -19,6 +19,7 @@ enum proto_id { PROTO_ICMP6, PROTO_UDP, PROTO_TCP, + PROTO_DNS, __PROTO_MAX, }; @@ -27,6 +28,7 @@ enum proto_layer { PROTO_L2, PROTO_L3, PROTO_L4, + PROTO_L7, }; struct proto_field; @@ -38,6 +40,7 @@ struct proto_ops { void (*header_init)(struct proto_hdr *hdr); void (*header_finish)(struct proto_hdr *hdr); + void (*push_sub_header)(struct proto_hdr *hdr, struct proto_hdr *sub_hdr); void (*field_changed)(struct proto_field *field); void (*packet_finish)(struct proto_hdr *hdr); void (*packet_update)(struct proto_hdr *hdr); @@ -46,12 +49,16 @@ struct proto_ops { struct proto_hdr { const struct proto_ops *ops; + struct proto_hdr *parent; + struct proto_hdr **sub_headers; + uint32_t sub_headers_count; uint16_t pkt_offset; uint32_t pkt_id; uint32_t index; struct proto_field *fields; size_t fields_count; bool is_csum_valid; + uint32_t id; size_t len; }; @@ -95,6 +102,10 @@ extern void proto_header_finish(struct proto_hdr *hdr); extern void proto_packet_finish(void); extern void proto_packet_update(uint32_t idx); +extern struct proto_hdr *proto_hdr_push_sub_header(struct proto_hdr *hdr, int id); +extern void proto_hdr_move_sub_header(struct proto_hdr *hdr, struct proto_hdr *from, + struct proto_hdr *to); + extern struct proto_hdr *proto_lower_default_add(struct proto_hdr *hdr, enum proto_id pid); @@ -142,6 +153,9 @@ extern void proto_hdr_field_set_default_dev_ipv4(struct proto_hdr *hdr, uint32_t extern void proto_hdr_field_set_dev_ipv6(struct proto_hdr *hdr, uint32_t fid); extern void proto_hdr_field_set_default_dev_ipv6(struct proto_hdr *hdr, uint32_t fid); +extern void proto_hdr_field_set_string(struct proto_hdr *hdr, uint32_t fid, const char *str); +extern void proto_hdr_field_set_default_string(struct proto_hdr *hdr, uint32_t fid, const char *str); + extern void proto_field_dyn_apply(struct proto_field *field); extern struct proto_field *proto_hdr_field_by_id(struct proto_hdr *hdr, uint32_t fid); @@ -155,8 +169,9 @@ extern void proto_field_set_u32(struct proto_field *field, uint32_t val); extern uint32_t proto_field_get_u32(struct proto_field *field); extern void proto_field_set_be16(struct proto_field *field, uint16_t val); extern void proto_field_set_be32(struct proto_field *field, uint32_t val); -extern void proto_field_set_bytes(struct proto_field *field, const uint8_t *bytes, - size_t len); +extern void proto_field_set_bytes(struct proto_field *field, const uint8_t *bytes, size_t len); +extern void proto_field_set_string(struct proto_field *field, const char *str); +extern void proto_field_set_default_string(struct proto_field *field, const char *str); extern void proto_field_func_add(struct proto_field *field, struct proto_field_func *func); |