Differential D24359 Diff 67179 plugins/process/network/helper/Packet.cpp

Changeset View

Standalone View

View Options

plugins/process/network/helper/Packet.cpp

Show All 27 Lines
28#include <netinet/ip.h> 28​#include <netinet/ip.h>
29#include <netinet/ip6.h> 29​#include <netinet/ip6.h>
30#include <netinet/tcp.h> 30​#include <netinet/tcp.h>
31#include <netinet/udp.h> 31​#include <netinet/udp.h>
32 32​
33#include <pcap/pcap.h> 33​#include <pcap/pcap.h>
34#include <pcap/sll.h> 34​#include <pcap/sll.h>
35 35​
36​uint32_t u8Tou32(uint8_t first, uint8_t second, uint8_t third, uint8_t fourth)
37​{
38​ return uint32_t(first) << 24 | uint32_t(second) << 16 | uint32_t(third) << 8 | uint32_t(fourth);
39​}
40​
36Packet::Packet() 41​Packet::Packet()
37{ 42​{
38} 43​}
39 44​
40Packet::Packet(const TimeStamp::MicroSeconds &timeStamp, const uint8_t *data, uint32_t dataLength, uint32_t packetSize) 45​Packet::Packet(const TimeStamp::MicroSeconds &timeStamp, const uint8_t *data, uint32_t dataLength, uint32_t packetSize)
41{ 46​{
42 m_timeStamp = timeStamp; 47​ m_timeStamp = timeStamp;
43 m_size = packetSize; 48​ m_size = packetSize;
44 49​
45 const sll_header *header = reinterpret_cast<const sll_header *>(data); 50​ const sll_header *header = reinterpret_cast<const sll_header *>(data);
46 switch (ntohs(header->sll_protocol)) { 51​ switch (ntohs(header->sll_protocol)) {
47 case ETHERTYPE_IP: 52​ case ETHERTYPE_IP:
48 m_networkProtocol = NetworkProtocolType::IPv4; 53​ m_networkProtocol = NetworkProtocolType::IPv4;
49 if (sizeof(sll_header) <= dataLength) { 54​ if (sizeof(sll_header) <= dataLength) {
50 parseIPv4(data + sizeof(sll_header)); 55​ parseIPv4(data + sizeof(sll_header), dataLength - sizeof(sll_header));
51 } 56​ }
52 break; 57​ break;
53 case ETHERTYPE_IPV6: 58​ case ETHERTYPE_IPV6:
54 m_networkProtocol = NetworkProtocolType::IPv6; 59​ m_networkProtocol = NetworkProtocolType::IPv6;
55 if (sizeof(sll_header) <= dataLength) { 60​ if (sizeof(sll_header) <= dataLength) {
56 parseIPv6(data + sizeof(sll_header)); 61​ parseIPv6(data + sizeof(sll_header), dataLength - sizeof(sll_header));
57 } 62​ }
58 break; 63​ break;
59 default: 64​ default:
60 m_networkProtocol = NetworkProtocolType::Unknown; 65​ m_networkProtocol = NetworkProtocolType::Unknown;
61 break; 66​ break;
62 } 67​ }
63} 68​}
64 69​
Show All 26 Lines95{
91 return m_sourceAddress; 96​ return m_sourceAddress;
92} 97​}
93 98​
94Packet::Address Packet::destinationAddress() const 99​Packet::Address Packet::destinationAddress() const
95{ 100​{
96 return m_destinationAddress; 101​ return m_destinationAddress;
97} 102​}
98 103​
99void Packet::parseIPv4(const uint8_t *data) 104​void Packet::parseIPv4(const uint8_t *data, int32_t dataLength)
100{ 105​{
106​ if (dataLength < int32_t(sizeof(ip))) {
107​ return;
108​ }
109​
101 const ip *header = reinterpret_cast<const ip *>(data); 110​ const ip *header = reinterpret_cast<const ip *>(data);
102 111​
103 m_sourceAddress.address[3] = header->ip_src.s_addr; 112​ m_sourceAddress.address[3] = header->ip_src.s_addr;
104 m_destinationAddress.address[3] = header->ip_dst.s_addr; 113​ m_destinationAddress.address[3] = header->ip_dst.s_addr;
105 114​
106 parseTransport(header->ip_p, data + sizeof(ip)); 115​ parseTransport(header->ip_p, data + sizeof(ip), dataLength - sizeof(ip));
107} 116​}
108 117​
109void Packet::parseIPv6(const uint8_t *data) 118​void Packet::parseIPv6(const uint8_t *data, int32_t dataLength)
110{ 119​{
120​ if (dataLength < int32_t(sizeof(ip6_hdr))) {
121​ return;
122​ }
123​
111 const ip6_hdr *header = reinterpret_cast<const ip6_hdr *>(data); 124​ const ip6_hdr *header = reinterpret_cast<const ip6_hdr *>(data);
112 125​
113 m_sourceAddress.address = { 126​ m_sourceAddress.address = {
114 uint32_t(header->ip6_src.s6_addr[0] << 24 & header->ip6_src.s6_addr[1] << 16 & header->ip6_src.s6_addr[2] << 8 & header->ip6_src.s6_addr[3]), 127​ u8Tou32(header->ip6_src.s6_addr[0], header->ip6_src.s6_addr[1], header->ip6_src.s6_addr[2], header->ip6_src.s6_addr[3]),
115 uint32_t(header->ip6_src.s6_addr[4] << 24 & header->ip6_src.s6_addr[5] << 16 & header->ip6_src.s6_addr[6] << 8 & header->ip6_src.s6_addr[7]), 128​ u8Tou32(header->ip6_src.s6_addr[4], header->ip6_src.s6_addr[5], header->ip6_src.s6_addr[6], header->ip6_src.s6_addr[7]),
116 uint32_t(header->ip6_src.s6_addr[8] << 24 & header->ip6_src.s6_addr[9] << 16 & header->ip6_src.s6_addr[10] << 8 & header->ip6_src.s6_addr[11]), 129​ u8Tou32(header->ip6_src.s6_addr[8], header->ip6_src.s6_addr[9], header->ip6_src.s6_addr[10], header->ip6_src.s6_addr[11]),
117 uint32_t(header->ip6_src.s6_addr[12] << 24 & header->ip6_src.s6_addr[13] << 16 & header->ip6_src.s6_addr[14] << 8 & header->ip6_src.s6_addr[15]) 130​ u8Tou32(header->ip6_src.s6_addr[12], header->ip6_src.s6_addr[13], header->ip6_src.s6_addr[14], header->ip6_src.s6_addr[15])
118 }; 131​ };
119 m_destinationAddress.address = { 132​ m_destinationAddress.address = {
120 uint32_t(header->ip6_dst.s6_addr[0] << 24 & header->ip6_dst.s6_addr[1] << 16 & header->ip6_dst.s6_addr[2] << 8 & header->ip6_dst.s6_addr[3]), 133​ u8Tou32(header->ip6_dst.s6_addr[0], header->ip6_dst.s6_addr[1], header->ip6_dst.s6_addr[2], header->ip6_dst.s6_addr[3]),
121 uint32_t(header->ip6_dst.s6_addr[4] << 24 & header->ip6_dst.s6_addr[5] << 16 & header->ip6_dst.s6_addr[6] << 8 & header->ip6_dst.s6_addr[7]), 134​ u8Tou32(header->ip6_dst.s6_addr[4], header->ip6_dst.s6_addr[5], header->ip6_dst.s6_addr[6], header->ip6_dst.s6_addr[7]),
122 uint32_t(header->ip6_dst.s6_addr[8] << 24 & header->ip6_dst.s6_addr[9] << 16 & header->ip6_dst.s6_addr[10] << 8 & header->ip6_dst.s6_addr[11]), 135​ u8Tou32(header->ip6_dst.s6_addr[8], header->ip6_dst.s6_addr[9], header->ip6_dst.s6_addr[10], header->ip6_dst.s6_addr[11]),
123 uint32_t(header->ip6_dst.s6_addr[12] << 24 & header->ip6_dst.s6_addr[13] << 16 & header->ip6_dst.s6_addr[14] << 8 & header->ip6_dst.s6_addr[15]) 136​ u8Tou32(header->ip6_dst.s6_addr[12], header->ip6_dst.s6_addr[13], header->ip6_dst.s6_addr[14], header->ip6_dst.s6_addr[15])
124 }; 137​ };
125 138​
126 parseTransport(header->ip6_nxt, data + sizeof(ip6_hdr)); 139​ parseTransport(header->ip6_nxt, data + sizeof(ip6_hdr), dataLength - sizeof(ip6_hdr));
127} 140​}
128 141​
129void Packet::parseTransport(uint8_t type, const uint8_t *data) 142​void Packet::parseTransport(uint8_t type, const uint8_t *data, int32_t dataLength)
130{ 143​{
131 switch (type) { 144​ switch (type) {
132 case IPPROTO_TCP: { 145​ case IPPROTO_TCP: {
133 m_transportProtocol = TransportProtocolType::Tcp; 146​ m_transportProtocol = TransportProtocolType::Tcp;
147​ if (dataLength >= int32_t(sizeof(tcphdr))) {
134 const tcphdr *tcpHeader = reinterpret_cast<const tcphdr *>(data); 148​ const tcphdr *tcpHeader = reinterpret_cast<const tcphdr *>(data);
135 m_sourceAddress.port = ntohs(tcpHeader->th_sport); 149​ m_sourceAddress.port = ntohs(tcpHeader->th_sport);
136 m_destinationAddress.port = ntohs(tcpHeader->th_dport); 150​ m_destinationAddress.port = ntohs(tcpHeader->th_dport);
151​ }
137 break; 152​ break;
138 } 153​ }
139 case IPPROTO_UDP: { 154​ case IPPROTO_UDP: {
140 m_transportProtocol = TransportProtocolType::Udp; 155​ m_transportProtocol = TransportProtocolType::Udp;
156​ if (dataLength >= int32_t(sizeof(udphdr))) {
141 const udphdr *udpHeader = reinterpret_cast<const udphdr *>(data); 157​ const udphdr *udpHeader = reinterpret_cast<const udphdr *>(data);
142 m_sourceAddress.port = ntohs(udpHeader->uh_sport); 158​ m_sourceAddress.port = ntohs(udpHeader->uh_sport);
143 m_destinationAddress.port = ntohs(udpHeader->uh_dport); 159​ m_destinationAddress.port = ntohs(udpHeader->uh_dport);
160​ }
144 break; 161​ break;
145 } 162​ }
146 default: 163​ default:
147 m_transportProtocol = TransportProtocolType::Unknown; 164​ m_transportProtocol = TransportProtocolType::Unknown;
148 break; 165​ break;
149 } 166​ }
150} 167​}