path: root/libssh/pcap.c

/*
 * This file is part of the SSH Library
 *
 * Copyright (c) 2009 by Aris Adamantiadis
 *
 * The SSH Library is free software; you can redistribute it and/or modify
 * it under the terms of the GNU Lesser General Public License as published by
 * the Free Software Foundation; either version 2.1 of the License, or (at your
 * option) any later version.
 *
 * The SSH Library is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public
 * License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * along with the SSH Library; see the file COPYING.  If not, write to
 * the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
 * MA 02111-1307, USA.
 */

/* pcap.c */
/** \defgroup ssh_pcap SSH-pcap
 * \brief libssh pcap file generation
 *
 * \addtogroup ssh_pcap
 * @{ */

#include <stdio.h>
#include <sys/time.h>

#include "config.h"
#include "libssh/libssh.h"
#include "libssh/pcap.h"
#include "libssh/session.h"
#include "libssh/buffer.h"

#ifdef WITH_PCAP
/* The header of a pcap file is the following. We are not going to make it
 * very complicated.
 * Just for information.
 */
struct pcap_hdr_s {
	u_int32_t magic_number;   /* magic number */
	u_int16_t version_major;  /* major version number */
	u_int16_t version_minor;  /* minor version number */
	int32_t   thiszone;       /* GMT to local correction */
	u_int32_t sigfigs;        /* accuracy of timestamps */
	u_int32_t snaplen;        /* max length of captured packets, in octets */
	u_int32_t network;        /* data link type */
};

#define PCAP_MAGIC 0xa1b2c3d4
#define PCAP_VERSION_MAJOR 2
#define PCAP_VERSION_MINOR 4

#define DLT_RAW         12      /* raw IP */

/* TCP flags */
#define TH_FIN        0x01
#define TH_SYN        0x02
#define TH_RST        0x04
#define TH_PUSH       0x08
#define TH_ACK        0x10
#define TH_URG        0x20

/* The header of a pcap packet.
 * Just for information.
 */
struct pcaprec_hdr_s {
	u_int32_t ts_sec;         /* timestamp seconds */
	u_int32_t ts_usec;        /* timestamp microseconds */
	u_int32_t incl_len;       /* number of octets of packet saved in file */
	u_int32_t orig_len;       /* actual length of packet */
};

/** @private
 * @brief a pcap context expresses the state of a pcap dump
 * in a SSH session only. Multiple pcap contexts may be used into
 * a single pcap file.
 */

struct ssh_pcap_context_struct {
	ssh_session session;
	ssh_pcap_file file;
	/* All of these informations are useful to generate
	 * the dummy IP and TCP packets
	 */
	u_int32_t ipsource;
	u_int32_t ipdest;
	u_int16_t portsource;
	u_int16_t portdest;
	u_int32_t outsequence;
	u_int32_t insequence;
};

/** @private
 * @brief a pcap file expresses the state of a pcap file which may
 * contain several streams.
 */
struct ssh_pcap_file_struct {
	FILE *output;
};

/**
 * @brief create a new ssh_pcap_file object
 */
ssh_pcap_file ssh_pcap_file_new(){
	return malloc(sizeof(struct ssh_pcap_file_struct));
}

/** @internal
 * @brief writes a packet on file
 */
static int ssh_pcap_file_write(ssh_pcap_file pcap, ssh_buffer packet){
	int err;
	uint32_t len;
	if(pcap == NULL || pcap->output==NULL)
		return SSH_ERROR;
	len=buffer_get_len(packet);
	err=fwrite(buffer_get(packet),len,1,pcap->output);
	if(err<0)
		return SSH_ERROR;
	else
		return SSH_OK;
}

/** @internal
 * @brief prepends a packet with the pcap header and writes packet
 * on file
 */
int ssh_pcap_file_write_packet(ssh_pcap_file pcap, ssh_buffer packet, u_int32_t original_len){
	ssh_buffer header=buffer_new();
	struct timeval now;
	int err;
	if(header == NULL)
		return SSH_ERROR;
	gettimeofday(&now,NULL);
	buffer_add_u32(header,htonl(now.tv_sec));
	buffer_add_u32(header,htonl(now.tv_usec));
	buffer_add_u32(header,htonl(buffer_get_len(packet)));
	buffer_add_u32(header,htonl(original_len));
	buffer_add_buffer(header,packet);
	err=ssh_pcap_file_write(pcap,header);
	buffer_free(header);
	return err;
}

/**
 * @brief opens a new pcap file and create header
 */
int ssh_pcap_file_open(ssh_pcap_file pcap, const char *filename){
	ssh_buffer header;
	int err;
	if(pcap == NULL)
		return SSH_ERROR;
	if(pcap->output){
		fclose(pcap->output);
		pcap->output=NULL;
	}
	pcap->output=fopen(filename,"wb");
	if(pcap->output==NULL)
		return SSH_ERROR;
	header=buffer_new();
	if(header==NULL)
		return SSH_ERROR;
	buffer_add_u32(header,htonl(PCAP_MAGIC));
	buffer_add_u16(header,htons(PCAP_VERSION_MAJOR));
	buffer_add_u16(header,htons(PCAP_VERSION_MINOR));
	/* currently hardcode GMT to 0 */
	buffer_add_u32(header,htonl(0));
	/* accuracy */
	buffer_add_u32(header,htonl(0));
	/* size of the biggest packet */
	buffer_add_u32(header,htonl(MAX_PACKET_LEN));
	/* we will write sort-of IP */
	buffer_add_u32(header,htonl(DLT_RAW));
	err=ssh_pcap_file_write(pcap,header);
	buffer_free(header);
	return err;
}

int ssh_pcap_file_close(ssh_pcap_file pcap){
	int err;
	if(pcap ==NULL || pcap->output==NULL)
		return SSH_ERROR;
	err=fclose(pcap->output);
	pcap->output=NULL;
	if(err != 0)
		return SSH_ERROR;
	else
		return SSH_OK;
}

void ssh_pcap_free(ssh_pcap_file pcap){
	ssh_pcap_file_close(pcap);
	SAFE_FREE(pcap);
}


/** @internal
 * @brief allocates a new ssh_pcap_context object
 */

ssh_pcap_context ssh_pcap_context_new(ssh_session session){
	ssh_pcap_context ctx=malloc(sizeof(struct ssh_pcap_context_struct));
	if(ctx==NULL){
		ssh_set_error_oom(session);
		return NULL;
	}
	ZERO_STRUCTP(ctx);
	ctx->session=session;
	return ctx;
}

void ssh_pcap_context_set_file(ssh_pcap_context ctx, ssh_pcap_file pcap){
	ctx->file=pcap;
}

int ssh_pcap_context_write(ssh_pcap_context ctx,enum ssh_pcap_direction direction
		, void *data, u_int32_t len, u_int32_t origlen){
	ssh_buffer ip=buffer_new();
	int err;
	if(ip==NULL){
		ssh_set_error_oom(ctx->session);
		return SSH_ERROR;
	}
	/* build an IP packet */
	/* V4, 20 bytes */
	buffer_add_u8(ip,4 << 4 | 5);
	/* tos */
	buffer_add_u8(ip,0);
	/* total len */
	buffer_add_u16(ip,htons(origlen + 40));
	/* id */
	buffer_add_u16(ip,htons(1));
	/* fragment offset */
	buffer_add_u16(ip,htons(0));
	/* TTL */
	buffer_add_u8(ip,64);
	/* protocol TCP=6 */
	buffer_add_u8(ip,6);
	/* checksum */
	buffer_add_u16(ip,0);
	if(direction==SSH_PCAP_DIR_OUT){
		buffer_add_u32(ip,ctx->ipsource);
		buffer_add_u32(ip,ctx->ipdest);
	} else {
		buffer_add_u32(ip,ctx->ipdest);
		buffer_add_u32(ip,ctx->ipsource);
	}
	/* TCP */
	if(direction==SSH_PCAP_DIR_OUT){
		buffer_add_u16(ip,ntohs(ctx->portsource));
		buffer_add_u16(ip,ntohs(ctx->portdest));
	} else {
		buffer_add_u16(ip,ntohs(ctx->portdest));
		buffer_add_u16(ip,ntohs(ctx->portsource));
	}
	/* sequence number */
	if(direction==SSH_PCAP_DIR_OUT){
		buffer_add_u32(ip,ntohl(ctx->outsequence));
	} else {
		buffer_add_u32(ip,ntohl(ctx->insequence));
	}
	/* ack number */
	if(direction==SSH_PCAP_DIR_OUT){
		buffer_add_u32(ip,ntohl(ctx->insequence));
	} else {
		buffer_add_u32(ip,ntohl(ctx->outsequence));
	}
	/* header len */
	buffer_add_u8(ip,5 << 4);
	/* flags */
	buffer_add_u8(ip,TH_PUSH | TH_ACK);
	/* window */
	buffer_add_u16(ip,htons(65535));
	/* checksum */
	buffer_add_u16(ip,htons(0));
	/* urgent data ptr */
	buffer_add_u16(ip,0);
	/* actual data */
	buffer_add_data(ip,data,len);
	err=ssh_pcap_file_write_packet(ctx->file,ip,origlen + 40);
	buffer_free(ip);
	return err;
}

#endif /* WITH_PCAP */
/** @} */
/* vim: set ts=2 sw=2 et cindent: */