pkt.h

Go to the documentation of this file.

/** \file pkt.h

  \brief Packet data structures

*/

#ifndef _PKT
#define _PKT

#ifdef __cplusplus
extern "C" {
#endif

#include "nm.h"

/**
  * \brief Types of layer 3 protocols in host order
  *
  * \sa /usr/include/linux/if_eth.h
  */

typedef enum
{
  Pkt_L3ProtIp_c = 0x0008,
  Pkt_L3ProtComp_c = 0x0009,    // created our own protocol for compressed packets
  Pkt_L3ProtArp_c = 0x0608,
  Pkt_L3ProtRarp_c = 0x3580,
  Pkt_L3ProtUndef_c = 0x0000
} Pkt_L3ProtType_t;


/**
  * \brief Types of layer 4 protocols
  *
  * \sa /usr/include/linux/in.h
  */

typedef enum
{
  Pkt_L4ProtTcp_c = 6,
  Pkt_L4ProtUdp_c = 17,
  Pkt_L4ProtIcmp_c = 1,
  Pkt_L4ProtIgmp_c = 2,
  Pkt_L4ProtRsvp_c = 46,
  Pkt_L4ProtIPv6_c = 41,
  Pkt_L4ProtPIM_c = 103,
  Pkt_L4ProtRaw_c = 255,
  Pkt_L4ProtUndef_c = 0
} Pkt_L4ProtType_t;


/**
  * \brief  Ethernet Packet Header.
  * 
  * From Spurgeon page 24, 
  * and /usr/include/net/ethernet.h  sizeof( Pkt_EthernetHdr_t ) report 20 bytes.
  */

struct Pkt_EthernetHdr_t
{

  u_int8_t dhost[6];        /* destination eth addr */
  u_int8_t shost[6];        /* source ether addr    */


  /* According to Spurgeon, one 16-bit block is the packet type or length field */
  /* if it's less than 1518 (decimal) it's length, more than 1536, it's type */
  /*                               */
  /* unsigned char  typeOrLength;  */
  /*                               */
  /* However, I'm going to use a type field here, we get the length automatically from the read */

  u_int16_t type;       // IP = 0x0800  in network order

  // not sure where the crc check goes 
  // unsigned int crc; 
};

typedef struct Pkt_EthernetHdr_t Pkt_EthernetHdr_t;


/**
  * \brief use for wlan detection
  */

struct Pkt_WifiHdr_t
{
  u_int16_t frame_control;
  u_int16_t duration_id;
  u_int8_t addr1[6];
  u_int8_t addr2[6];
  u_int8_t addr3[6];
  u_int16_t seq_control;
  u_int8_t addr4[6];
};

typedef struct Pkt_WifiHdr_t Pkt_WifiHdr_t;


/**
  * \brief  IP Packet header.
  * 
  * Taken from p 252 of Peterson and and Davie, 2nd edition.
  * 
  * I've not used bit fields to avoid alignment and big/little endian issues,
  * and have set options to be a single int.  Note this is just the header field.
  */

struct Pkt_IpHdr_t
{

  /* we are assuming a little endian machine */
  /* see /usr/include/linux/ip.h for details */

  u_int8_t ihl:4,       // header measured in 32 bit words, works out to 
    // 5 when there are no options
    version:4;          // 

  u_int8_t TOS;         /* Type of Service */

  u_int16_t length;     /* length measure in bytes, INCLUDES the header bytes */

  u_int16_t id;         /* used for frag/reassembly */

  /* the next field is for fragmentation and reassembly */
  /* 4 bits for Flags, 12 bits for Offset */

  /* The 3 flag bits are the MSBs - they are reserved, must be 0 (MSB) */
  /* don't frag (next) and more fragments (third).  */
  /* the M bit in flags signifies if more fragments are to follow */

  /* Offset counts 8-byte units of data */
  /* Peterson and Davie 2nd edition page 257 gives code for reassembly */

  /* from http://www.protocols.com/pbook/tcpip2.htm : */
  /* Indicates where this fragment belongs in the datagram. The */
  /* fragment offset is measured in units of 8 bytes (64 bits). */
  /* The first fragment has offset zero. */

  u_int16_t RB:1, DF:1, MF:1, offset:13;

  u_int8_t TTL;         /* time to live, current default is 64 */

  u_int8_t protocol;        // ICMP is 1, TCP is 6, UDP is 17
  // see /usr/include/linux/in.h for details

  /* add up header as 16 bit words, using 1-s complement */
  /* take 1-s complement of result */

  u_int16_t checksum;

  u_int32_t sourceIp;
  u_int32_t destIp;

  /* the number of options fields is variable */

  /*

     From http://www.iana.org/assignments/ip-parameters

     IP OPTION NUMBERS

     (last updated 2001-06-29)

     The Internet Protocol (IP) has provision for optional header fields
     identified by an option type field.  Options 0 and 1 are exactly one
     octet which is their type field.  All other options have their one
     octet type field, followed by a one octet length field, followed by
     length-2 octets of option data.  The option type field is sub-divided
     into a one bit copied flag, a two bit class field, and a five bit
     option number.  These taken together form an eight bit value for the
     option type field.  IP options are commonly refered to by this value.


     Copy Class Number Value Name                               Reference
     ---- ----- ------ ----- ------------------------------- ---------
     0     0      0     0 EOOL   - End of Options List    [RFC791,JBP]
     0     0      1     1 NOP    - No Operation           [RFC791,JBP]
     1     0      2   130 SEC    - Security                  [RFC1108]
     1     0      3   131 LSR    - Loose Source Route     [RFC791,JBP]
     0     2      4    68 TS     - Time Stamp             [RFC791,JBP]
     1     0      5   133 E-SEC  - Extended Security         [RFC1108]
     1     0      6   134 CIPSO  - Commercial Security           [???]
     0     0      7     7 RR     - Record Route           [RFC791,JBP]
     1     0      8   136 SID    - Stream ID              [RFC791,JBP]
     1     0      9   137 SSR    - Strict Source Route    [RFC791,JBP]
     0     0     10    10 ZSU    - Experimental Measurement      [ZSu]
     0     0     11    11 MTUP   - MTU Probe                 [RFC1191]*
     0     0     12    12 MTUR   - MTU Reply                 [RFC1191]*
     1     2     13   205 FINN   - Experimental Flow Control    [Finn]
     1     0     14   142 VISA   - Expermental Access Control [Estrin]
     0     0     15    15 ENCODE - ???                      [VerSteeg]
     1     0     16   144 IMITD  - IMI Traffic Descriptor        [Lee]
     1     0     17   145 EIP    - Extended Internet Protocol[RFC1385]
     0     2     18    82 TR     - Traceroute              [RFC1393]
     1     0     19   147 ADDEXT - Address Extension    [Ullmann IPv7]  
     1     0     20   148 RTRALT - Router Alert              [RFC2113]
     1     0     21   149 SDB    - Selective Directed Broadcast[Graff]
     1     0     22   150 NSAPA  - NSAP Addresses          [Carpenter]
     1   0     23   151 DPS    - Dynamic Packet State        [Malis]
     1   0     24   152 UMP    - Upstream Multicast Pkt. [Farinacci]

     [Note, an asterisk (*) denotes an obsoleted IP Option Number.]

   */
};

typedef struct Pkt_IpHdr_t Pkt_IpHdr_t;


/**
  * \brief  Types of flows
  *
  * Missing a number of cases - e.g., udp, icmp.
  */

typedef enum
{
  Pkt_SrcIpFlow_c,
  Pkt_DestIpFlow_c,
  Pkt_SrcDestIpFlow_c,
  Pkt_SrcDestTcpIpFlow_c,
  Pkt_DestTcpIpFlow_c
} Pkt_FlowType_t;


/**
  * \brief  Types of byte-orders.
  * 
  * Only two possibilities: host or network.
  */

typedef enum
{
  Pkt_HostByteOrder_c,
  Pkt_NetworkByteOrder_c
} Pkt_ByteOrder_t;


/**
  * \brief  Types of TCP flags.
  * 
  * Their numbering is in the order they appear in the header.
  */

typedef enum
{
  Pkt_TcpFin_c,
  Pkt_TcpSyn_c,
  Pkt_TcpRst_c,
  Pkt_TcpPsh_c,
  Pkt_TcpAck_c,
  Pkt_TcpUrg_c,
  Pkt_TcpEce_c,
  Pkt_TcpCwr_c
} Pkt_TcpFlags_t;


/**
  * \brief  TCP Packet header.
  * 
  * Taken from p 377 of Peterson and and Davie, 2nd edition.
  * 
  * I've not used bit fields to avoid alignment and big/little endian issues,
  * and have set options to be a single int.  Note this is just the header field.
  */

struct Pkt_TcpHdr_t
{

  u_int16_t srcPort;
  u_int16_t destPort;

  /* seqNum, ack and advWindow are all related to the sliding window */
  /* each bye has a sequence number, and and seqNum holds the seq number for */
  /* the first byte of data carried in the segment */

  u_int32_t seqNum;
  u_int32_t ackNum;

  // using little endian format - see /usr/include/linux/tcp.h for details
  u_int16_t res1:4, doff:4, // offset, indicates number of 4 byte words in header
    // there are 5 * 4 bytes in the header without options
    /* one bit for each of fin, syn, rst, psh, ack, urg, ece, cwr */
    /*   o syn, fin are for establishing and tearing down TCP conections */
    /*   o ack set when acknowledgement field is valid, implying receiver need to look at it */
    /*   o urg set when segment contains urgent data, urgPtr is where the NONurgent data begins */
    /*   o push set when sender performs push operation */
    /*   o reset set when receiver is confused, wants to abort */
    fin:1, syn:1, rst:1, psh:1, ack:1, urg:1, ece:1, cwr:1;

  u_int16_t advWindow;

  u_int16_t checkSum;
  u_int16_t urgPtr;

  // options will begin here and continue for  ( doff - 5 ) * 4 bytes
  // padding may be needed to make the header a multiple of 4 bytes
  // in length
};

typedef struct Pkt_TcpHdr_t Pkt_TcpHdr_t;


/**
  * \brief  UDP Packet header.
  * 
  * Taken from p 370 of Peterson and and Davie, 2nd edition.
  * Fields are self evident.
  */

struct Pkt_UdpHdr_t
{

  u_int16_t srcPort;
  u_int16_t destPort;

  u_int16_t checkSum;
  u_int16_t length;     // in bytes, includes the header

};

typedef struct Pkt_UdpHdr_t Pkt_UdpHdr_t;


/**
  * \brief  ICMP packet header
  * 
  * Taken directly from 
  * /usr/include/linux/icmp.h
  */

struct Pkt_IcmpHdr_t
{
  u_int8_t type;
  u_int8_t code;
  u_int16_t checksum;
  union
  {
    struct
    {
      u_int16_t id;
      u_int16_t sequence;
    } echo;
    u_int16_t gateway;
    struct
    {
      u_int16_t unused;
      u_int16_t mtu;
    } frag;
  } un;
};

typedef struct Pkt_IcmpHdr_t Pkt_IcmpHdr_t;


/**
  * \brief  Packed bit-fields for ip frag flags, offset.
  * 
  */

typedef struct Pkt_IpFlags_t
{
  unsigned int RB:4;
  unsigned int DF:4;
  unsigned int MF:1;
  unsigned int offset:13;
} Pkt_IpFlags_t;


/**
  * \brief  Packed bit-fields for tcp flags, offset, etc.
  */

typedef struct Pkt_TcpResDoffFlags_t
{
  unsigned int res1:4;
  unsigned int doff:4;
  unsigned int fin:1;
  unsigned int syn:1;
  unsigned int rst:1;
  unsigned int psh:1;
  unsigned int ack:1;
  unsigned int urg:1;
  unsigned int ece:1;
  unsigned int cwr:1;
} Pkt_TcpResDoffFlags_t;


/**
  * \brief  Layer 4 flow captured by 4 fields - source/dest IP, source/dest TCP ports
  */

struct Pkt_L4Flow_t
{

  unsigned int srcIp;
  unsigned int destIp;

  unsigned short int srcPort;
  unsigned short int destPort;

};

typedef struct Pkt_L4Flow_t Pkt_L4Flow_t;


/**
  * \brief  An encapsulation of the libnet_t structure.
  */

struct Pkt_LibNet_t
{
  char *interfaceName;
  char *errbuf;
  libnet_t *l;
};

typedef struct Pkt_LibNet_t Pkt_LibNet_t;


/**
  * \brief  An encapsulation of the libpcap_t structure.
  */

struct Pkt_LibPcap_t
{
  pcap_t *p;
  char *interfaceName;
  struct pcap_stat ps;
  struct pcap_pkthdr hdr;
  u_int32_t localNet;
  u_int32_t netmask;
  struct bpf_program filterCode;
};

typedef struct Pkt_LibPcap_t Pkt_LibPcap_t;


/**
  * \brief Useful for passing sets of packets around.
  */

struct Pkt_VectorBuff_t
{
  int count;
  void **pktArray;
  int *pktArrayLength;
};

typedef struct Pkt_VectorBuff_t Pkt_VectorBuff_t;


/** \brief  Packet and rules that are to be applied 

  The currentRule field keeps track of the rule that is next to be applied.
*/

struct Pkt_ProcessPkt_t
{
  Pkt_EthernetHdr_t *pkt;
  int length;           // derived from capture code
  int currentRule;
  Pkt_LibPcap_t *inIf;      // marks the interface the packet came in
  Pkt_LibNet_t *outIf;      // marks the interface the packet is to go out on
  util_timing_t inTime;
  util_timing_t outTime;

  array_t *applicableRules;
};

typedef struct Pkt_ProcessPkt_t Pkt_ProcessPkt_t;


/**
  * \brief Structure encapsulating settings for Pkt_CreateRandEthPktArray
  */

struct Pkt_TfcMode_t
{
  int size;
  char *srcMac;
  char *destMac;
  int numSeeds;
  double pktGap;
};

typedef struct Pkt_TfcMode_t Pkt_TfcMode_t;


/**AutomaticStart*************************************************************/

/*---------------------------------------------------------------------------*/
/* Extern function prototypes                                                */
/*---------------------------------------------------------------------------*/

extern Pkt_IpHdr_t *Pkt_EthernetExtractIp (Pkt_EthernetHdr_t * ethPkt);
extern int Pkt_EthernetPktHdrReadLengthNetworkOrder (Pkt_EthernetHdr_t * pkt);
extern int Pkt_EthernetPktHdrReadLength (Pkt_EthernetHdr_t * pkt);
extern int Pkt_EthernetHdrFree (Pkt_EthernetHdr_t * pkt);
extern int Pkt_ProcessPktFree (Pkt_ProcessPkt_t * pp);
extern Pkt_IcmpHdr_t *Pkt_IpExtractIcmp (Pkt_IpHdr_t * anIpPkt);
extern Pkt_UdpHdr_t *Pkt_IpExtractUdp (Pkt_IpHdr_t * anIpPkt);
extern Pkt_TcpHdr_t *Pkt_IpExtractTcp (Pkt_IpHdr_t * anIpPkt);
extern char *Pkt_IpExtractPayload (Pkt_IpHdr_t * anIpPkt);
extern Pkt_UdpHdr_t *Pkt_EthernetExtractUdp (Pkt_EthernetHdr_t *
                         aEthernetPkt);
extern Pkt_TcpHdr_t *Pkt_EthernetExtractTcp (Pkt_EthernetHdr_t *
                         aEthernetPkt);
extern Pkt_IcmpHdr_t *Pkt_EthernetExtractIcmp (Pkt_EthernetHdr_t *
                           aEthernetPkt);
extern char *Pkt_UdpHdrReadPayload (Pkt_UdpHdr_t * aUdpPkt);
extern char *Pkt_TcpHdrReadPayload (Pkt_TcpHdr_t * aTcpPkt);
extern int Pkt_SrcIpFlowCmp (Pkt_EthernetHdr_t * pkt1,
                 Pkt_EthernetHdr_t * pkt2);
extern int Pkt_DestIpFlowCmp (Pkt_EthernetHdr_t * pkt1,
                  Pkt_EthernetHdr_t * pkt2);
extern int Pkt_SrcDestIpFlowCmp (Pkt_EthernetHdr_t * pkt1,
                 Pkt_EthernetHdr_t * pkt2);
extern int Pkt_DestTcpIpFlowCmp (Pkt_EthernetHdr_t * pkt1,
                 Pkt_EthernetHdr_t * pkt2);
extern int Pkt_SrcIpFlowHash (Pkt_EthernetHdr_t * pkt1, int modulus);
extern int Pkt_DestIpFlowHash (Pkt_EthernetHdr_t * pkt1, int modulus);
extern int Pkt_SrcDestIpFlowHash (Pkt_EthernetHdr_t * pkt1, int modulus);
extern int Pkt_DestTcpIpFlowHash (Pkt_EthernetHdr_t * pkt1, int modulus);
extern int Pkt_SrcDestTcpIpFlowHash (Pkt_EthernetHdr_t * pkt1, int modulus);
extern int Pkt_SrcDestTcpIpFlowCmp (Pkt_EthernetHdr_t * pkt1,
                    Pkt_EthernetHdr_t * pkt2);
extern int Pkt_L4FlowCompareForSt (Pkt_L4Flow_t * foo, Pkt_L4Flow_t * bar);
extern int Pkt_L4FlowCompare (Pkt_L4Flow_t * foo, Pkt_L4Flow_t * bar);
extern int Pkt_L4FlowHashForSt (Pkt_L4Flow_t * anL4Flow_t, int modulus);
extern unsigned int Pkt_L4FlowHash (Pkt_L4Flow_t * anL4Flow_t);
extern Pkt_L4Flow_t *Pkt_EthPktToL4Flow (Pkt_EthernetHdr_t * anEthPkt);
extern Pkt_L4Flow_t *Pkt_IpPktToL4Flow (Pkt_IpHdr_t * anIpPkt);
extern int Pkt_EthernetReadL3Type (Pkt_EthernetHdr_t * anEth);
extern int Pkt_PrintEthernet (Pkt_EthernetHdr_t * anEthPkt, int length);
extern int Pkt_PrintWifi (Pkt_WifiHdr_t * aWifiPkt);
extern int Pkt_PrintIp (Pkt_IpHdr_t * anIpPkt);
extern void Pkt_PrintIpAddressDotted (u_int32_t aNumIp);
extern void Pkt_PrintIpAddressDottedGeneral ( char *, u_int32_t aNumIp);
extern Pkt_ProcessPkt_t *Pkt_AllocateProcessPacket (Pkt_EthernetHdr_t * pkt,
                            array_t *
                            applicableRules);
extern int Pkt_DeviceSkb ();
extern Pkt_VectorBuff_t *Pkt_SocketVectorWrite (int count);
extern int Pkt_EthPacketWriteToFile (int fd, Pkt_EthernetHdr_t * anEthPkt,
                     unsigned int length);
extern int Pkt_EthPacketReadFromFile (int fd,
                      Pkt_EthernetHdr_t ** anEthPktPtr);
extern array_t *Pkt_CreatePktsFromString (char *pktFile);
extern Pkt_EthernetHdr_t *Pkt_CreatePktFromString (char *pktString);
extern int Pkt_Init (char *ifName, int numRounds, int markPoint);
extern Pkt_LibNet_t *Pkt_InitLibNet (char *interfaceName);
extern int Pkt_LibNetFinish (Pkt_LibNet_t * obj);
extern int Pkt_EthPktWrite (Pkt_EthernetHdr_t * anEth, int anEthLength,
                Pkt_LibNet_t * aNetObj);
extern array_t *Pkt_InitLibPcapArray (array_t * inArray);
extern array_t *Pkt_InitLibNetArray (array_t * outArray);
extern Pkt_LibPcap_t *Pkt_InitLibPcap (char *interfaceName);
extern int Pkt_LibPcapFinish (Pkt_LibPcap_t * obj);
extern util_byte_array_t *Pkt_CreateIcmpPkt (array_t * typeArray,
                         array_t * codeArray,
                         array_t * idArray,
                         array_t * seqArray);
extern util_byte_array_t *Pkt_CreateUdpPkt (array_t * srcPorts,
                        array_t * destPorts,
                        array_t * sizes,
                        array_t * byteStrings);
extern util_byte_array_t *Pkt_CreateTcpPkt (array_t * srcPorts,
                        array_t * destPorts,
                        array_t * seqNums,
                        array_t * ackNums,
                        st_table * flags, array_t * sizes,
                        array_t * byteStrings);
extern util_byte_array_t *Pkt_CreateIpPkt (array_t * srcIps,
                       array_t * destIps,
                       st_table * ipFlagsTable,
                       array_t * offsets, array_t * ids,
                       st_table * ipOptions,
                       array_t * ttls,
                       util_byte_array_t * l4Payload,
                       int l4Protocol);
extern Pkt_EthernetHdr_t *Pkt_CreateEthPkt (char *srcMac, char *destMac,
                        util_byte_array_t * l3Payload,
                        u_int16_t l3Protocol);
extern Pkt_EthernetHdr_t *Pkt_CreateRandEthPkt (array_t * tmpArray);
extern array_t *Pkt_SeedRandEthPktArray (Pkt_ByteOrder_t byteOrder,
                     int numSeeds,
                     Pkt_TfcMode_t * tfcMode);
extern void Pkt_HTON (Pkt_EthernetHdr_t * anEth);
extern void Pkt_NTOH (Pkt_EthernetHdr_t * anEth);

// \todo - had to keep there here to get g++ to compile
extern int Rlp_UpdateDefineTable (st_table * aTable, char *anEntry);
extern array_t *Rlp_L7StringParse (char *l7Rule);
extern u_int32_t Rlp_DotToInt (char *);


/**AutomaticEnd***************************************************************/
#ifdef __cplusplus
}
#endif

#endif /* _PKT */