pktFile.c

Go to the documentation of this file.

/** \file  pktFile.c

 \brief Routines for reading and writing packets to file, as well
 as creating packets
*/

#include "pkt.h"

/*AutomaticStart*************************************************************/

/*---------------------------------------------------------------------------*/
/* Static function prototypes                                                */
/*---------------------------------------------------------------------------*/

static Pkt_EthernetHdr_t *createPacketFromAttribValArray (array_t *
                              attribValueArray);
static util_byte_array_t *createIpPktFromAttribValueArray (array_t *
                               attribValueArray,
                               util_byte_array_t *
                               l4Packet,
                               int l4Protocol);
static util_byte_array_t *createIcmpPktFromAttribValueArray (array_t *
                                 attribValueArray);
static util_byte_array_t *createUdpPktFromAttribValueArray (array_t *
                                attribValueArray);
static util_byte_array_t *createTcpPktFromAttribValueArray (array_t *
                                attribValueArray);
static Pkt_L4ProtType_t getL4Prot (array_t * attribValueArray);
static Pkt_L3ProtType_t getL3Prot (array_t * attribValueArray);
static st_table *parseIpOptions (char *value);

/*AutomaticEnd***************************************************************/


/*---------------------------------------------------------------------------*/
/* Definition of exported functions                                          */
/*---------------------------------------------------------------------------*/

/**
  * \brief  Write an ethernet frame to file.
  * File is assumed to be open  and writable.  
  * Format: length followed by sequence of bytes.
  * 
  * If we used fprintf, we would need both the FILE * fp  AND 
  * the int fd as there's no simple way to go from one to the other.  
  * (We don't wan't to pass in the file name as the we'd have to 
  * keep opening and closing the file.)
  * 
  * The alternative is to write the length using write itself,
  * but then we need to worry about the byte order. (Or perhaps
  * not, as we can just read back without worrying about the order,
  * its the same in both cases.
  */

int
Pkt_EthPacketWriteToFile (int fd,
              Pkt_EthernetHdr_t * anEthPkt, unsigned int length)
{

  char *lengthPtr = (char *) &length;

  if ((sizeof (char *) != write (fd, lengthPtr, sizeof (char *))) ||
      (length != (unsigned int) write (fd, anEthPkt, length)))
    {
      printf ("Write failed in Pkt_EthPacketWriteToFile\n");
      return -1;
    }
  return 0;

}


/**
  * \brief  Read an Ethernet frame from a file
  * Returns NIL if the file is empty, and otherwise a pointer to the
  * frame. Caller is responsible for freeing the memory
  * allocated for the frame.
  */

int
Pkt_EthPacketReadFromFile (int fd, Pkt_EthernetHdr_t ** anEthPktPtr)
{
  int length;
  char *packet;

  if (sizeof (int) != read (fd, &length, sizeof (int)))
    {
      return 0;
    }

  if (length < (int) sizeof (Pkt_EthernetHdr_t))
    {
      // clear sign something is wrong
      printf ("Corrupt file in Pkt_EthPacketReadFromFile, bailing\n");
      assert (0);
    }

  packet = (char *) malloc (length);
  if (length != read (fd, packet, length))
    {
      printf ("Corrupt file in Pkt_EthPacketReadFromFile, bailing\n");
      assert (0);
    }
  *anEthPktPtr = (Pkt_EthernetHdr_t *) packet;

  return length;
}


/** \brief Create a packets from a textual description
  
\sa Pkt_CreateRandIpPkt

Format
<pre>
  protocol: ip, udp, tcp, icmp
  offset is from 0 to 2^13 - 1
  ttl is from 0 to 255
  ipflag:RB,DF,MF (one of)
  tcpflag:fin,syn,rst,psh,ack,urg,ece,cwr  (one of)
  ipoptions:EOOL,NOP,SEC,LSR,TS,E-SEC,CIPSO,RR,SID,SSR,ZSU,
        MTUP,MTUR,FINN,VISA,ENCODE,IMITD,EIP,TR,ADDEXT,RTRALT,SDB,NSAPA,DPS,UMP 
  size is size of ENTIRE packet, including header (but not ethernet part)
  content:"foo"  --- use escapes, etc. appropriately

  Ex. 
  srcip:192.168.1.1; destip:1.2.3.4; ipflags:MF; ipoptions:EOOL; offset:1234; id:100; ttl:255; protocol:tcp; srcport:80; 
  destport:80; seq:100; ack:100; tcpflag:fin; size:100; content:"foo"; 
</pre>

*/

array_t *
Pkt_CreatePktsFromString (char *pktFile)
{
  array_t *result = array_alloc (Pkt_EthernetHdr_t *, 0);
  array_t *rawPktsAndMacrosArray = util_process_file (pktFile);
  st_table *defineTable = Hash_InitTable ( ( int(*)() ) strcmp,  ( int(*)() ) st_strhash);
  int i;

  for (i = 0; i < array_n (rawPktsAndMacrosArray); i++)
    {
      char *anEntry = array_fetch (char *, rawPktsAndMacrosArray, i);
      if (util_strequalN (anEntry, "var", 3))
    {
      Rlp_UpdateDefineTable (defineTable, anEntry);
    }
      else
    {
      array_t *attribValueArray = Rlp_L7StringParse (anEntry);
      /* useful for debugging
         int j;
         for ( j = 0 ; j < array_n( attribValueArray ); j++ ) {
         util_attrib_val_t *aComponent = array_fetch( util_attrib_val_t *, attribValueArray, j );
         printf("%d - %s, %s\n", j,  aComponent->rawAttribute, aComponent->rawValue );
         }
       */
      Pkt_EthernetHdr_t *pkt =
        createPacketFromAttribValArray (attribValueArray);
      array_insert_last (Pkt_EthernetHdr_t *, result, pkt);
    }
    }
  return result;
}


/**
  * \brief Create single packet from string.
  *
  *     Just calls Pkt_CreatePktsFromString and makes sure there is just one entry
  * in the returned array, and returns that entry.
  */

Pkt_EthernetHdr_t *
Pkt_CreatePktFromString (char *pktString)
{
  array_t *pkts = Pkt_CreatePktsFromString (pktString);
  if (array_n (pkts) != 1)
    {
      fprintf (stderr, "Error, called Pkt_CreatePktFromString "
           "on a string that resulted in %d pkts", array_n (pkts));
      assert (0);
    }
  Pkt_EthernetHdr_t *result = array_fetch (Pkt_EthernetHdr_t *, pkts, 0);
  array_free (pkts);
  return result;
}


/**
  * \brief  Produce a packet based on the entries in the attrib-val array
  *
  *     \sa Pkt_CreateFromFile
  */

static Pkt_EthernetHdr_t *
createPacketFromAttribValArray (array_t * attribValueArray)
{
  Pkt_L4ProtType_t l4Prot = getL4Prot (attribValueArray);
  util_byte_array_t *l4Packet;
  switch (l4Prot)
    {
    case Pkt_L4ProtTcp_c:
      l4Packet = createTcpPktFromAttribValueArray (attribValueArray);
      break;
    case Pkt_L4ProtUdp_c:
      l4Packet = createUdpPktFromAttribValueArray (attribValueArray);
      break;
    case Pkt_L4ProtIcmp_c:
      l4Packet = createIcmpPktFromAttribValueArray (attribValueArray);
      break;
    default:
      printf ("Error: no l4 protocol specified\n");
      assert (0);
    }

  Pkt_L3ProtType_t l3Prot = getL3Prot (attribValueArray);
  util_byte_array_t *l3Packet;
  switch (l3Prot)
    {
    case Pkt_L3ProtIp_c:
      l3Packet =
    createIpPktFromAttribValueArray (attribValueArray, l4Packet, l4Prot);
      break;
    case Pkt_L3ProtArp_c:
      /// \todo implement ARP generation
      // l3Packet = createArpPktFromAttribValueArray( attribValueArray, l4Packet, l4Prot );
      break;
    default:
      printf ("Error: no l3 protocol specified\n");
      assert (0);
    }
  Pkt_EthernetHdr_t *result =
    Pkt_CreateEthPkt ("000000", "111111", l3Packet, Pkt_L3ProtIp_c);

  return result;
}


/**
  * \brief Make an ip packet out from textual description and passed in l4 packet
  */

static util_byte_array_t *
createIpPktFromAttribValueArray (array_t * attribValueArray,
                 util_byte_array_t * l4Packet, int l4Protocol)
{
  array_t *srcIps = array_alloc (u_int32_t, 0);
  array_t *destIps = array_alloc (u_int32_t, 0);

  array_t *offsets = array_alloc (u_int16_t, 0);
  array_t *ids = array_alloc (u_int16_t, 0);
  array_t *ttls = array_alloc (u_int8_t, 0);

  st_table *ipFlags = Hash_InitTable ( ( int(*)() ) strcmp,  ( int(*)() ) st_strhash);
  st_table *ipOptions = Hash_InitTable ( ( int(*)() ) strcmp,  ( int(*)() ) st_strhash);

  int i;
  for (i = 0; i < array_n (attribValueArray); i++)
    {
      util_attrib_val_t *avPair =
    array_fetch (util_attrib_val_t *, attribValueArray, i);
      char *attribute = avPair->rawAttribute;
      char *value = avPair->rawValue;
      if (util_strequal (attribute, "srcip"))
    {
      u_int32_t srcip = (u_int32_t) Rlp_DotToInt (value);
      array_insert_last (u_int32_t, srcIps, srcip);
    }
      else if (util_strequal (attribute, "destip"))
    {
      u_int32_t destip = Rlp_DotToInt (value);
      array_insert_last (u_int32_t, destIps, destip);
    }
      else if (util_strequal (attribute, "ttl"))
    {
      u_int32_t ttlDummy;
      sscanf (value, "%u", &ttlDummy);
      u_int8_t ttl = (u_int8_t) ttlDummy;
      array_insert_last (u_int8_t, ttls, ttl);
    }
      else if (util_strequal (attribute, "offset"))
    {
      u_int16_t offset;
      sscanf (value, "%hu", &offset);
      assert (offset < (2 << 13));
      array_insert_last (u_int16_t, offsets, offset);
    }
      else if (util_strequal (attribute, "id"))
    {
      u_int16_t id;
      sscanf (value, "%hu", &id);
      array_insert_last (u_int16_t, ids, id);
    }
      else if (util_strequal (attribute, "ipflags"))
    {
      assert (util_strequal (value, "DF") ||
          util_strequal (value, "RB") ||
          util_strequal (value, "MF") ||
          util_strequal (value, "!DF") ||
          util_strequal (value, "!RB") ||
          util_strequal (value, "!MF"));
      if (value[0] != '!')
        {
          Hash_Insert (ipFlags, strdup (value), (char *) 1);
        }
      else
        {
          Hash_Insert (ipFlags, strdup (value + 1), 0);
        }
    }
      else if (util_strequal (attribute, "ipopts"))
    {
      ipOptions = parseIpOptions (value);
    }
    }
  util_byte_array_t *l3Packet =
    Pkt_CreateIpPkt (srcIps, destIps, ipFlags, offsets, ids, ipOptions, ttls,
             l4Packet, l4Protocol);

  return l3Packet;
}


/** \brief Put together an icmp packet from attributes */

static util_byte_array_t *
createIcmpPktFromAttribValueArray (array_t * attribValueArray)
{
  array_t *typeArray = array_alloc (u_int8_t, 0);
  array_t *codeArray = array_alloc (u_int8_t, 0);

  array_t *idArray = array_alloc (u_int16_t, 0);
  array_t *seqArray = array_alloc (u_int16_t, 0);

  int i;
  for (i = 0; i < array_n (attribValueArray); i++)
    {
      util_attrib_val_t *avPair =
    array_fetch (util_attrib_val_t *, attribValueArray, i);
      char *attribute = avPair->rawAttribute;
      char *value = avPair->rawValue;
      if (util_strequal (attribute, "itype"))
    {
      u_int32_t itypeDummy;
      u_int8_t itype;
      sscanf (value, "%u", &itypeDummy);
      itype = (u_int8_t) itypeDummy;
      array_insert_last (u_int8_t, typeArray, itype);
    }
      else if (util_strequal (attribute, "icmp_id"))
    {
      int icmpid;
      sscanf (value, "%u", &icmpid);
      array_insert_last (u_int16_t, idArray, icmpid);
    }
      else if (util_strequal (attribute, "icmp_seq"))
    {
      u_int16_t icmpseq;
      sscanf (value, "%hu", &icmpseq);
      array_insert_last (u_int16_t, seqArray, icmpseq);
    }
      else if (util_strequal (attribute, "icode"))
    {
      u_int8_t icodeDummy;
      u_int8_t icode;
      sscanf (value, "%u", &icodeDummy);
      icode = (u_int8_t) icodeDummy;
      array_insert_last (u_int8_t, codeArray, icode);
    }
    }
  util_byte_array_t *l4Packet =
    Pkt_CreateIcmpPkt (typeArray, codeArray, idArray, seqArray);

  return l4Packet;
}


/** \brief Put together a tcp packet from attributes */

static util_byte_array_t *
createUdpPktFromAttribValueArray (array_t * attribValueArray)
{
  array_t *srcPorts = array_alloc (u_int16_t, 0);
  array_t *destPorts = array_alloc (u_int16_t, 0);

  array_t *sizes = array_alloc (u_int16_t, 0);
  array_t *byteStrings = array_alloc (util_byte_array_t *, 0);

  int i;
  for (i = 0; i < array_n (attribValueArray); i++)
    {
      util_attrib_val_t *avPair =
    array_fetch (util_attrib_val_t *, attribValueArray, i);
      char *attribute = avPair->rawAttribute;
      char *value = avPair->rawValue;
      if (util_strequal (attribute, "srcport"))
    {
      u_int16_t srcport;
      sscanf (value, "%hu", &srcport);
      array_insert_last (u_int16_t, srcPorts, srcport);
    }
      else if (util_strequal (attribute, "destport"))
    {
      u_int16_t destport;
      sscanf (value, "%hu", &destport);
      array_insert_last (u_int16_t, destPorts, destport);
    }
      else if (util_strequal (attribute, "size"))
    {
      u_int16_t size;
      sscanf (value, "%hu", &size);
      array_insert_last (u_int16_t, sizes, size);
    }
      else if (util_strequal (attribute, "content"))
    {
      array_insert_last (util_byte_array_t *, byteStrings,
                 util_byte_array_create (strdup (value),
                             strlen (value)));
    }
    }
  util_byte_array_t *l4Packet =
    Pkt_CreateUdpPkt (srcPorts, destPorts, sizes, byteStrings);

  return l4Packet;
}


/** \brief Put together a tcp packet from attributes */

static util_byte_array_t *
createTcpPktFromAttribValueArray (array_t * attribValueArray)
{
  array_t *srcPorts = array_alloc (u_int16_t, 0);
  array_t *destPorts = array_alloc (u_int16_t, 0);

  array_t *seqNums = array_alloc (u_int32_t, 0);
  array_t *ackNums = array_alloc (u_int32_t, 0);

  st_table *tcpFlags = Hash_InitTable ( ( int(*)() ) strcmp,  ( int(*)() ) st_strhash);

  array_t *sizes = array_alloc (u_int16_t, 0);
  array_t *byteStrings = array_alloc (util_byte_array_t *, 0);

  int i;
  for (i = 0; i < array_n (attribValueArray); i++)
    {
      util_attrib_val_t *avPair =
    array_fetch (util_attrib_val_t *, attribValueArray, i);
      char *attribute = avPair->rawAttribute;
      char *value = avPair->rawValue;
      if (util_strequal (attribute, "srcport"))
    {
      u_int16_t srcport;
      sscanf (value, "%hu", &srcport);
      array_insert_last (u_int16_t, srcPorts, srcport);
    }
      else if (util_strequal (attribute, "destport"))
    {
      u_int16_t destport;
      sscanf (value, "%hu", &destport);
      array_insert_last (u_int16_t, destPorts, destport);
    }
      else if (util_strequal (attribute, "seq"))
    {
      u_int32_t seqnum;
      sscanf (value, "%u", &seqnum);
      array_insert_last (u_int32_t, seqNums, seqnum);
    }
      else if (util_strequal (attribute, "ack"))
    {
      u_int32_t acknum;
      sscanf (value, "%u", &acknum);
      array_insert_last (u_int32_t, ackNums, acknum);
    }
      else if (util_strequal (attribute, "size"))
    {
      u_int16_t size;
      sscanf (value, "%hu", &size);
      array_insert_last (u_int16_t, sizes, size);
    }
      else if (util_strequal (attribute, "tcpflags"))
    {
      assert (util_strequal (value, "F") ||
          util_strequal (value, "S") ||
          util_strequal (value, "R") ||
          util_strequal (value, "P") ||
          util_strequal (value, "A") ||
          util_strequal (value, "U") ||
          util_strequal (value, "E") ||
          util_strequal (value, "C") ||
          util_strequal (value, "!F") ||
          util_strequal (value, "!S") ||
          util_strequal (value, "!R") ||
          util_strequal (value, "!P") ||
          util_strequal (value, "!A") ||
          util_strequal (value, "!U") ||
          util_strequal (value, "!E") || util_strequal (value, "!C"));
      if (value[0] == '!')
        {
          Hash_Insert (tcpFlags, strdup (value + 1), 0);
        }
      else
        {
          Hash_Insert (tcpFlags, strdup (value), (char *) 1);
        }
    }
      else if (util_strequal (attribute, "content"))
    {
      array_insert_last (util_byte_array_t *, byteStrings,
                 util_byte_array_create (strdup (value),
                             strlen (value)));
    }
    }
  util_byte_array_t *l4Packet =
    Pkt_CreateTcpPkt (srcPorts, destPorts, seqNums, ackNums, tcpFlags, sizes,
              byteStrings);

  return l4Packet;
}


/** \brief Figure out what the layer 4 protocol is from the attributes passed in */

static Pkt_L4ProtType_t
getL4Prot (array_t * attribValueArray)
{
  int i;
  for (i = 0; i < array_n (attribValueArray); i++)
    {
      util_attrib_val_t *avPair =
    array_fetch (util_attrib_val_t *, attribValueArray, i);
      char *attribute = avPair->rawAttribute;
      if (util_strequal (attribute, "protocol"))
    {
      char *value = avPair->rawValue;
      if (util_strequal (value, "tcp"))
        {
          return Pkt_L4ProtTcp_c;
        }
      else if (util_strequal (value, "icmp"))
        {
          return Pkt_L4ProtIcmp_c;
        }
      else if (util_strequal (value, "udp"))
        {
          return Pkt_L4ProtUdp_c;
        }
    }
    }
  return Pkt_L4ProtUndef_c;
}


/** \brief Figure out what the layer 3 protocol is from the attributes passed in */

static Pkt_L3ProtType_t
getL3Prot (array_t * attribValueArray)
{
  int i;
  for (i = 0; i < array_n (attribValueArray); i++)
    {
      util_attrib_val_t *avPair =
    array_fetch (util_attrib_val_t *, attribValueArray, i);
      char *attribute = avPair->rawAttribute;
      if (util_strequal (attribute, "protocol"))
    {
      char *value = avPair->rawValue;
      if (util_strequal (value, "tcp") ||
          util_strequal (value, "udp") ||
          util_strequal (value, "icmp") || util_strequal (value, "ip"))
        {
          return Pkt_L3ProtIp_c;
        }
      else if (util_strequal (value, "arp"))
        {
          return Pkt_L3ProtArp_c;
        }
    }
    }
  return Pkt_L3ProtUndef_c;
}


/**
  * \brief Create a hash table containing all the ip options and their lengths
  *
  * Value is in the form "eol,nop,rr,rs,sec,lsrr,ssrr,satid"
  */

static st_table *
parseIpOptions (char *value)
{
  st_table *result = Hash_InitTable ( ( int(*)() ) strcmp,  ( int(*)() ) st_strhash);

  char *comma;
  char *string = strdup (value);
  char *origstring = string;
  while (NIL (char) != (comma = strchr (string, ',')))
    {
      *comma = '\0';
      char *entry = strdup (string);
      Hash_Insert (result, entry, NIL (char));
      string = comma + 1;
    }
  char *lastentry = strdup (string);
  Hash_Insert (result, lastentry, NIL (char));
  free (origstring);

  return result;
}