/*
* This file is part of the SSH Library
*
* Copyright (c) 2009 by Aris Adamantiadis
*
* The SSH Library is free software; you can redistribute it and/or modify
* it under the terms of the GNU Lesser General Public License as published by
* the Free Software Foundation; either version 2.1 of the License, or (at your
* option) any later version.
*
* The SSH Library is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public
* License for more details.
*
* You should have received a copy of the GNU Lesser General Public License
* along with the SSH Library; see the file COPYING. If not, write to
* the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
* MA 02111-1307, USA.
*/
/* pcap.c */
#include "config.h"
#ifdef WITH_PCAP
#include <stdio.h>
#ifdef _WIN32
#include <winsock2.h>
#include <ws2tcpip.h>
#else
#include <netinet/in.h>
#include <sys/socket.h>
#endif
#ifdef HAVE_SYS_TIME_H
#include <sys/time.h>
#endif /* HAVE_SYS_TIME_H */
#include <errno.h>
#include <stdlib.h>
#include "libssh/libssh.h"
#include "libssh/pcap.h"
#include "libssh/session.h"
#include "libssh/buffer.h"
#include "libssh/socket.h"
/**
* @internal
*
* @defgroup libssh_pcap The libssh pcap functions
* @ingroup libssh
*
* The pcap file generation
*
*
* @{
*/
/* The header of a pcap file is the following. We are not going to make it
* very complicated.
* Just for information.
*/
struct pcap_hdr_s {
uint32_t magic_number; /* magic number */
uint16_t version_major; /* major version number */
uint16_t version_minor; /* minor version number */
int32_t thiszone; /* GMT to local correction */
uint32_t sigfigs; /* accuracy of timestamps */
uint32_t snaplen; /* max length of captured packets, in octets */
uint32_t network; /* data link type */
};
#define PCAP_MAGIC 0xa1b2c3d4
#define PCAP_VERSION_MAJOR 2
#define PCAP_VERSION_MINOR 4
#define DLT_RAW 12 /* raw IP */
/* TCP flags */
#define TH_FIN 0x01
#define TH_SYN 0x02
#define TH_RST 0x04
#define TH_PUSH 0x08
#define TH_ACK 0x10
#define TH_URG 0x20
/* The header of a pcap packet.
* Just for information.
*/
struct pcaprec_hdr_s {
uint32_t ts_sec; /* timestamp seconds */
uint32_t ts_usec; /* timestamp microseconds */
uint32_t incl_len; /* number of octets of packet saved in file */
uint32_t orig_len; /* actual length of packet */
};
/** @private
* @brief a pcap context expresses the state of a pcap dump
* in a SSH session only. Multiple pcap contexts may be used into
* a single pcap file.
*/
struct ssh_pcap_context_struct {
ssh_session session;
ssh_pcap_file file;
int connected;
/* All of these information are useful to generate
* the dummy IP and TCP packets
*/
uint32_t ipsource;
uint32_t ipdest;
uint16_t portsource;
uint16_t portdest;
uint32_t outsequence;
uint32_t insequence;
};
/** @private
* @brief a pcap file expresses the state of a pcap file which may
* contain several streams.
*/
struct ssh_pcap_file_struct {
FILE *output;
uint16_t ipsequence;
};
/**
* @brief create a new ssh_pcap_file object
*/
ssh_pcap_file ssh_pcap_file_new(void) {
struct ssh_pcap_file_struct *pcap;
pcap = (struct ssh_pcap_file_struct *) malloc(sizeof(struct ssh_pcap_file_struct));
if (pcap == NULL) {
return NULL;
}
ZERO_STRUCTP(pcap);
return pcap;
}
/** @internal
* @brief writes a packet on file
*/
static int ssh_pcap_file_write(ssh_pcap_file pcap, ssh_buffer packet){
int err;
uint32_t len;
if(pcap == NULL || pcap->output==NULL)
return SSH_ERROR;
len=ssh_buffer_get_len(packet);
err=fwrite(ssh_buffer_get(packet),len,1,pcap->output);
if(err<0)
return SSH_ERROR;
else
return SSH_OK;
}
/** @internal
* @brief prepends a packet with the pcap header and writes packet
* on file
*/
int ssh_pcap_file_write_packet(ssh_pcap_file pcap, ssh_buffer packet, uint32_t original_len){
ssh_buffer header=ssh_buffer_new();
struct timeval now;
int err;
if(header == NULL)
return SSH_ERROR;
gettimeofday(&now,NULL);
err = ssh_buffer_allocate_size(header,
sizeof(uint32_t) * 4 +
ssh_buffer_get_len(packet));
if (err < 0) {
goto error;
}
err = ssh_buffer_add_u32(header,htonl(now.tv_sec));
if (err < 0) {
goto error;
}
err = ssh_buffer_add_u32(header,htonl(now.tv_usec));
if (err < 0) {
goto error;
}
err = ssh_buffer_add_u32(header,htonl(ssh_buffer_get_len(packet)));
if (err < 0) {
goto error;
}
err = ssh_buffer_add_u32(header,htonl(original_len));
if (err < 0) {
goto error;
}
err = ssh_buffer_add_buffer(header,packet);
if (err < 0) {
goto error;
}
err=ssh_pcap_file_write(pcap,header);
error:
SSH_BUFFER_FREE(header);
return err;
}
/**
* @brief opens a new pcap file and create header
*/
int ssh_pcap_file_open(ssh_pcap_file pcap, const char *filename){
ssh_buffer header;
int err;
if(pcap == NULL)
return SSH_ERROR;
if(pcap->output){
fclose(pcap->output);
pcap->output=NULL;
}
pcap->output=fopen(filename,"wb");
if(pcap->output==NULL)
return SSH_ERROR;
header=ssh_buffer_new();
if(header==NULL)
return SSH_ERROR;
err = ssh_buffer_allocate_size(header,
sizeof(uint32_t) * 5 +
sizeof(uint16_t) * 2);
if (err < 0) {
goto error;
}
err = ssh_buffer_add_u32(header,htonl(PCAP_MAGIC));
if (err < 0) {
goto error;
}
err = ssh_buffer_add_u16(header,htons(PCAP_VERSION_MAJOR));
if (err < 0) {
goto error;
}
err = ssh_buffer_add_u16(header,htons(PCAP_VERSION_MINOR));
if (err < 0) {
goto error;
}
/* currently hardcode GMT to 0 */
err = ssh_buffer_add_u32(header,htonl(0));
if (err < 0) {
goto error;
}
/* accuracy */
err = ssh_buffer_add_u32(header,htonl(0));
if (err < 0) {
goto error;
}
/* size of the biggest packet */
err = ssh_buffer_add_u32(header,htonl(MAX_PACKET_LEN));
if (err < 0) {
goto error;
}
/* we will write sort-of IP */
err = ssh_buffer_add_u32(header,htonl(DLT_RAW));
if (err < 0) {
goto error;
}
err=ssh_pcap_file_write(pcap,header);
error:
SSH_BUFFER_FREE(header);
return err;
}
int ssh_pcap_file_close(ssh_pcap_file pcap){
int err;
if(pcap ==NULL || pcap->output==NULL)
return SSH_ERROR;
err=fclose(pcap->output);
pcap->output=NULL;
if(err != 0)
return SSH_ERROR;
else
return SSH_OK;
}
void ssh_pcap_file_free(ssh_pcap_file pcap){
ssh_pcap_file_close(pcap);
SAFE_FREE(pcap);
}
/** @internal
* @brief allocates a new ssh_pcap_context object
*/
ssh_pcap_context ssh_pcap_context_new(ssh_session session){
ssh_pcap_context ctx = (struct ssh_pcap_context_struct *) malloc(sizeof(struct ssh_pcap_context_struct));
if(ctx==NULL){
ssh_set_error_oom(session);
return NULL;
}
ZERO_STRUCTP(ctx);
ctx->session=session;
return ctx;
}
void ssh_pcap_context_free(ssh_pcap_context ctx){
SAFE_FREE(ctx);
}
void ssh_pcap_context_set_file(ssh_pcap_context ctx, ssh_pcap_file pcap){
ctx->file=pcap;
}
/** @internal
* @brief sets the IP and port parameters in the connection
*/
static int ssh_pcap_context_connect(ssh_pcap_context ctx)
{
ssh_session session=ctx->session;
struct sockaddr_in local = {
.sin_family = AF_UNSPEC,
};
struct sockaddr_in remote = {
.sin_family = AF_UNSPEC,
};
socket_t fd;
socklen_t len;
int rc;
if (session == NULL) {
return SSH_ERROR;
}
if (session->socket == NULL) {
return SSH_ERROR;
}
fd = ssh_socket_get_fd(session->socket);
/* TODO: adapt for windows */
if (fd < 0) {
return SSH_ERROR;
}
len = sizeof(local);
rc = getsockname(fd, (struct sockaddr *)&local, &len);
if (rc < 0) {
ssh_set_error(session,
SSH_REQUEST_DENIED,
"Getting local IP address: %s",
strerror(errno));
return SSH_ERROR;
}
len = sizeof(remote);
rc = getpeername(fd, (struct sockaddr *)&remote, &len);
if (rc < 0) {
ssh_set_error(session,
SSH_REQUEST_DENIED,
"Getting remote IP address: %s",
strerror(errno));
return SSH_ERROR;
}
if (local.sin_family != AF_INET) {
ssh_set_error(session,
SSH_REQUEST_DENIED,
"Only IPv4 supported for pcap logging");
return SSH_ERROR;
}
memcpy(&ctx->ipsource, &local.sin_addr, sizeof(ctx->ipsource));
memcpy(&ctx->ipdest, &remote.sin_addr, sizeof(ctx->ipdest));
memcpy(&ctx->portsource, &local.sin_port, sizeof(ctx->portsource));
memcpy(&ctx->portdest, &remote.sin_port, sizeof(ctx->portdest));
ctx->connected = 1;
return SSH_OK;
}
#define IPHDR_LEN 20
#define TCPHDR_LEN 20
#define TCPIPHDR_LEN (IPHDR_LEN + TCPHDR_LEN)
/** @internal
* @brief write a SSH packet as a TCP over IP in a pcap file
* @param ctx open pcap context
* @param direction SSH_PCAP_DIRECTION_IN if the packet has been received
* @param direction SSH_PCAP_DIRECTION_OUT if the packet has been emitted
* @param data pointer to the data to write
* @param len data to write in the pcap file. May be smaller than origlen.
* @param origlen number of bytes of complete data.
* @returns SSH_OK write is successful
* @returns SSH_ERROR an error happened.
*/
int ssh_pcap_context_write(ssh_pcap_context ctx,
enum ssh_pcap_direction direction,
void *data,
uint32_t len,
uint32_t origlen)
{
ssh_buffer ip;
int rc;
if (ctx == NULL || ctx->file == NULL) {
return SSH_ERROR;
}
if (ctx->connected == 0) {
if (ssh_pcap_context_connect(ctx) == SSH_ERROR) {
return SSH_ERROR;
}
}
ip = ssh_buffer_new();
if (ip == NULL) {
ssh_set_error_oom(ctx->session);
return SSH_ERROR;
}
/* build an IP packet */
rc = ssh_buffer_pack(ip,
"bbwwwbbw",
4 << 4 | 5, /* V4, 20 bytes */
0, /* tos */
origlen + TCPIPHDR_LEN, /* total len */
ctx->file->ipsequence, /* IP id number */
0, /* fragment offset */
64, /* TTL */
6, /* protocol TCP=6 */
0); /* checksum */
ctx->file->ipsequence++;
if (rc != SSH_OK){
goto error;
}
if (direction == SSH_PCAP_DIR_OUT) {
rc = ssh_buffer_add_u32(ip, ctx->ipsource);
if (rc < 0) {
goto error;
}
rc = ssh_buffer_add_u32(ip, ctx->ipdest);
if (rc < 0) {
goto error;
}
} else {
rc = ssh_buffer_add_u32(ip, ctx->ipdest);
if (rc < 0) {
goto error;
}
rc = ssh_buffer_add_u32(ip, ctx->ipsource);
if (rc < 0) {
goto error;
}
}
/* TCP */
if (direction == SSH_PCAP_DIR_OUT) {
rc = ssh_buffer_add_u16(ip, ctx->portsource);
if (rc < 0) {
goto error;
}
rc = ssh_buffer_add_u16(ip, ctx->portdest);
if (rc < 0) {
goto error;
}
} else {
rc = ssh_buffer_add_u16(ip, ctx->portdest);
if (rc < 0) {
goto error;
}
rc = ssh_buffer_add_u16(ip, ctx->portsource);
if (rc < 0) {
goto error;
}
}
/* sequence number */
if (direction == SSH_PCAP_DIR_OUT) {
rc = ssh_buffer_pack(ip, "d", ctx->outsequence);
if (rc != SSH_OK) {
goto error;
}
ctx->outsequence += origlen;
} else {
rc = ssh_buffer_pack(ip, "d", ctx->insequence);
if (rc != SSH_OK) {
goto error;
}
ctx->insequence += origlen;
}
/* ack number */
if (direction == SSH_PCAP_DIR_OUT) {
rc = ssh_buffer_pack(ip, "d", ctx->insequence);
if (rc != SSH_OK) {
goto error;
}
} else {
rc = ssh_buffer_pack(ip, "d", ctx->outsequence);
if (rc != SSH_OK) {
goto error;
}
}
rc = ssh_buffer_pack(ip,
"bbwwwP",
5 << 4, /* header len = 20 = 5 * 32 bits, at offset 4*/
TH_PUSH | TH_ACK, /* flags */
65535, /* window */
0, /* checksum */
0, /* urgent data ptr */
(size_t)len, data); /* actual data */
if (rc != SSH_OK) {
goto error;
}
rc = ssh_pcap_file_write_packet(ctx->file, ip, origlen + TCPIPHDR_LEN);
error:
SSH_BUFFER_FREE(ip);
return rc;
}
/** @brief sets the pcap file used to trace the session
* @param current session
* @param pcap an handler to a pcap file. A pcap file may be used in several
* sessions.
* @returns SSH_ERROR in case of error, SSH_OK otherwise.
*/
int ssh_set_pcap_file(ssh_session session, ssh_pcap_file pcap){
ssh_pcap_context ctx=ssh_pcap_context_new(session);
if(ctx==NULL){
ssh_set_error_oom(session);
return SSH_ERROR;
}
ctx->file=pcap;
if(session->pcap_ctx)
ssh_pcap_context_free(session->pcap_ctx);
session->pcap_ctx=ctx;
return SSH_OK;
}
#else /* WITH_PCAP */
/* Simple stub returning errors when no pcap compiled in */
#include "libssh/libssh.h"
#include "libssh/priv.h"
int ssh_pcap_file_close(ssh_pcap_file pcap){
(void) pcap;
return SSH_ERROR;
}
void ssh_pcap_file_free(ssh_pcap_file pcap){
(void) pcap;
}
ssh_pcap_file ssh_pcap_file_new(void){
return NULL;
}
int ssh_pcap_file_open(ssh_pcap_file pcap, const char *filename){
(void) pcap;
(void) filename;
return SSH_ERROR;
}
int ssh_set_pcap_file(ssh_session session, ssh_pcap_file pcapfile){
(void) pcapfile;
ssh_set_error(session,SSH_REQUEST_DENIED,"Pcap support not compiled in");
return SSH_ERROR;
}
#endif
/** @} */