TCP重组process_tcp

作者: LiHui 分类: TCP/IP 发布时间: 2015-02-21 15:47

nids_run调用了pcap_loop,无止境地循环抓包,抓到的包传给回调函数nids_pcap_handle来处理,而回调函数最终都会调用gen_ip_proc来根据不同类型协议的包进行处理重组,process_tcp,process_udp等等

首先是IP和TCP的结构体,可能不同的linux操作系统定义不同,下面头文件CentOS6.4里的定义

IP结构体:/usr/include/netinet/ip.h

107 struct ip
108   {
109 #if __BYTE_ORDER == __LITTLE_ENDIAN
110     unsigned int ip_hl:4;               /* header length */
111     unsigned int ip_v:4;                /* version */
112 #endif
113 #if __BYTE_ORDER == __BIG_ENDIAN
114     unsigned int ip_v:4;                /* version */
115     unsigned int ip_hl:4;               /* header length */
116 #endif
117     u_int8_t ip_tos;                    /* type of service */
118     u_short ip_len;                     /* total length */
119     u_short ip_id;                      /* identification */
120     u_short ip_off;                     /* fragment offset field */
121 #define IP_RF 0x8000                    /* reserved fragment flag */
122 #define IP_DF 0x4000                    /* dont fragment flag */
123 #define IP_MF 0x2000                    /* more fragments flag */
124 #define IP_OFFMASK 0x1fff               /* mask for fragmenting bits */
125     u_int8_t ip_ttl;                    /* time to live */
126     u_int8_t ip_p;                      /* protocol */
127     u_short ip_sum;                     /* checksum */
128     struct in_addr ip_src, ip_dst;      /* source and dest address */
129   };

TCP结构体:/usr/include/netinet/tcp.h

struct tcphdr
  {
    u_int16_t th_sport;         /* source port */
    u_int16_t th_dport;         /* destination port */
    tcp_seq th_seq;             /* sequence number */
    tcp_seq th_ack;             /* acknowledgement number */
#  if __BYTE_ORDER == __LITTLE_ENDIAN
    u_int8_t th_x2:4;           /* (unused) */
    u_int8_t th_off:4;          /* data offset */
#  endif
#  if __BYTE_ORDER == __BIG_ENDIAN
    u_int8_t th_off:4;          /* data offset */
    u_int8_t th_x2:4;           /* (unused) */
#  endif
    u_int8_t th_flags;
#  define TH_FIN        0x01
#  define TH_SYN        0x02
#  define TH_RST        0x04
#  define TH_PUSH       0x08
#  define TH_ACK        0x10
#  define TH_URG        0x20
    u_int16_t th_win;           /* window */
    u_int16_t th_sum;           /* checksum */
    u_int16_t th_urp;           /* urgent pointer */
};

下面就是process_tcp,在libnids里tcp.c里面:

void
process_tcp(u_char * data, int skblen)  //数据和长度
{
  struct ip *this_iphdr = (struct ip *)data;
  struct tcphdr *this_tcphdr = (struct tcphdr *)(data + 4 * this_iphdr->ip_hl);
  //通过IP部分偏移,指到了TCP头部的位置
  int datalen, iplen;   //TCP数据部分的长度,IP包的长度
  int from_client = 1;
  unsigned int tmp_ts;
  struct tcp_stream *a_tcp;     //TCP流全部信息
  struct half_stream *snd, *rcv;        //每个方向的TCP流

  ugly_iphdr = this_iphdr;
  iplen = ntohs(this_iphdr->ip_len);
  if ((unsigned)iplen < 4 * this_iphdr->ip_hl + sizeof(struct tcphdr)) {
    nids_params.syslog(NIDS_WARN_TCP, NIDS_WARN_TCP_HDR, this_iphdr,
                       this_tcphdr);
    return;
  } // ktos sie bawi

  datalen = iplen - 4 * this_iphdr->ip_hl - 4 * this_tcphdr->th_off;
  //TCP数据部分的长度:IP包长度减去IP头部长度减去TCP头部长度
  if (datalen < 0) {
    nids_params.syslog(NIDS_WARN_TCP, NIDS_WARN_TCP_HDR, this_iphdr,
                       this_tcphdr);
    return;
  } // ktos sie bawi

  if ((this_iphdr->ip_src.s_addr | this_iphdr->ip_dst.s_addr) == 0) {
    nids_params.syslog(NIDS_WARN_TCP, NIDS_WARN_TCP_HDR, this_iphdr,
                       this_tcphdr);
    return;
  }
  if (!(this_tcphdr->th_flags & TH_ACK))
          //检测TCP中的ACk信息,是否是攻击
    detect_scan(this_iphdr);
        //下面都是检查数据包是否是没用的包
  if (!nids_params.n_tcp_streams) return;
  if (my_tcp_check(this_tcphdr, iplen - 4 * this_iphdr->ip_hl,
                   this_iphdr->ip_src.s_addr, this_iphdr->ip_dst.s_addr)) {
    nids_params.syslog(NIDS_WARN_TCP, NIDS_WARN_TCP_HDR, this_iphdr,
                       this_tcphdr);
    return;
  }
#if 0
  check_flags(this_iphdr, this_tcphdr);
//ECN
#endif
//经过了上面的一些检查,认为TCP数据包正常,首先对数据包的状态进行判断
//是否是崭新的TCP连接,是否是三次握手的第一个包
  if (!(a_tcp = find_stream(this_tcphdr, this_iphdr, &from_client))) {
    if ((this_tcphdr->th_flags & TH_SYN) &&
        !(this_tcphdr->th_flags & TH_ACK) &&
        !(this_tcphdr->th_flags & TH_RST))
      add_new_tcp(this_tcphdr, this_iphdr);     //结点加入到链表中
        //如果TCP流不存在,而且是第一个SYN包,非ACK非RST,添加新的TCP流
    return;
  }//第一个握手包结束
  //判定TCP流的方向,发送端和接收端,而find stream里已经指定了方向
  if (from_client) {
    snd = &a_tcp->client;
    rcv = &a_tcp->server;
  }
  else {
    rcv = &a_tcp->client;
    snd = &a_tcp->server;
  }
  //此时经过了上面的if find_stream,可见已经找到了存在的TCP流
  if ((this_tcphdr->th_flags & TH_SYN)) {
          //又来一个SYN包,这里只能来自服务器,因为走到了这里,肯定不是建立
          //TCP连接的(前面已经处理),肯定来自服务器带ACK的,检查状态ing
    if (from_client || a_tcp->client.state != TCP_SYN_SENT ||
      a_tcp->server.state != TCP_CLOSE || !(this_tcphdr->th_flags & TH_ACK))
      return;
          //SEQ和ACK对不上的包,当作是错误的包
    if (a_tcp->client.seq != ntohl(this_tcphdr->th_ack))
      return;
  //第二个握手包,服务器端赋值
    a_tcp->server.state = TCP_SYN_RECV;
    a_tcp->server.seq = ntohl(this_tcphdr->th_seq) + 1;
    a_tcp->server.first_data_seq = a_tcp->server.seq;
    a_tcp->server.ack_seq = ntohl(this_tcphdr->th_ack);
    a_tcp->server.window = ntohs(this_tcphdr->th_win);

        //TCP选项的赋值,初始化client和server的timestamp
    if (a_tcp->client.ts_on) {
        a_tcp->server.ts_on = get_ts(this_tcphdr, &a_tcp->server.curr_ts);
        if (!a_tcp->server.ts_on)
                a_tcp->client.ts_on = 0;
    } else a_tcp->server.ts_on = 0;             //初始化窗口大小
    if (a_tcp->client.wscale_on) {
        a_tcp->server.wscale_on = get_wscale(this_tcphdr, &a_tcp->server.wscale);
        if (!a_tcp->server.wscale_on) {
                a_tcp->client.wscale_on = 0;
                a_tcp->client.wscale  = 1;
                a_tcp->server.wscale = 1;
        }
    } else {
        a_tcp->server.wscale_on = 0;
        a_tcp->server.wscale = 1;
    }
    return;
        //第二个握手包结束,返回
  }

  //假如有存在SEQ和ACK不等,并且SEQ还在窗口之外或者已经确认过的序号
  if (
        ! (  !datalen && ntohl(this_tcphdr->th_seq) == rcv->ack_seq  )
        &&
        ( !before(ntohl(this_tcphdr->th_seq), rcv->ack_seq + rcv->window*rcv->wscale) ||
          before(ntohl(this_tcphdr->th_seq) + datalen, rcv->ack_seq)
        )
     )
     return;    //发送th_rst,重新建立一个连接

         //如果是rst包,直接关闭连接,将数据还给注册的回调方,销毁连接
  if ((this_tcphdr->th_flags & TH_RST)) {
    if (a_tcp->nids_state == NIDS_DATA) {
                //如果是TCP数据
      struct lurker_node *i;

      a_tcp->nids_state = NIDS_RESET;
          //又到了回调那群处理函数的链表地方了
      for (i = a_tcp->listeners; i; i = i->next)
        (i->item) (a_tcp, &i->data);
    }
    nids_free_tcp_stream(a_tcp);
    return;
  }

  /* PAWS check */
  //这里是检查重复包,检查timestamp
  if (rcv->ts_on && get_ts(this_tcphdr, &tmp_ts) &&
        before(tmp_ts, snd->curr_ts))
  return;

  //来一个ACK包
  if ((this_tcphdr->th_flags & TH_ACK)) {
          //从client来的包,而且两边的接收和发送状态统一
    if (from_client && a_tcp->client.state == TCP_SYN_SENT &&
        a_tcp->server.state == TCP_SYN_RECV) {
                //如果序号也能对得上,那么这是第三个握手包,连接建立成功
      if (ntohl(this_tcphdr->th_ack) == a_tcp->server.seq) {
        a_tcp->client.state = TCP_ESTABLISHED;  //更新客户端状态
        a_tcp->client.ack_seq = ntohl(this_tcphdr->th_ack);
        //更新序号
        {
          struct proc_node *i;
          struct lurker_node *j;
          void *data;

          a_tcp->server.state = TCP_ESTABLISHED;
          a_tcp->nids_state = NIDS_JUST_EST;
          //全双工传输,client和server连接已经建立起来了
          //这样TCP三次握手建立连接

          for (i = tcp_procs; i; i = i->next) {
                  //根据调用者设定来判断哪些数据需要回调返回
            char whatto = 0;
            char cc = a_tcp->client.collect;
            char sc = a_tcp->server.collect;
            char ccu = a_tcp->client.collect_urg;
            char scu = a_tcp->server.collect_urg;
            //进入回调函数来处理

            (i->item) (a_tcp, &data);
            if (cc < a_tcp->client.collect)
              whatto |= COLLECT_cc;
            if (ccu < a_tcp->client.collect_urg)
              whatto |= COLLECT_ccu;
            if (sc < a_tcp->server.collect)
              whatto |= COLLECT_sc;
            if (scu < a_tcp->server.collect_urg)
              whatto |= COLLECT_scu;
            if (nids_params.one_loop_less) {
                        if (a_tcp->client.collect >=2) {
                                a_tcp->client.collect=cc;
                                whatto&=~COLLECT_cc;
                        }
                        if (a_tcp->server.collect >=2 ) {
                                a_tcp->server.collect=sc;
                                whatto&=~COLLECT_sc;
                        }
            }
                //加入监听队列,开始数据接收
            if (whatto) {
              j = mknew(struct lurker_node);
              j->item = i->item;
              j->data = data;
              j->whatto = whatto;
              j->next = a_tcp->listeners;
              a_tcp->listeners = j;
            }
          }
          if (!a_tcp->listeners) {
                  //没有监听者
            nids_free_tcp_stream(a_tcp);
            return;
          }
          a_tcp->nids_state = NIDS_DATA;
        }
      }
      // return;
    }
  }
  //下面是四次结束过程
  //数据传输过程中不停更新client和server的seq和ack
  //直到接收到了FIN包,数据传输结束
  if ((this_tcphdr->th_flags & TH_ACK)) {
          //调用handle_ack更新ack序号
    handle_ack(snd, ntohl(this_tcphdr->th_ack));
    if (rcv->state == FIN_SENT)
                //来了FIN包,更新状态
      rcv->state = FIN_CONFIRMED;
    if (rcv->state == FIN_CONFIRMED && snd->state == FIN_CONFIRMED) {
                //回调告知连接关闭,释放连接
      struct lurker_node *i;

      a_tcp->nids_state = NIDS_CLOSE;
      for (i = a_tcp->listeners; i; i = i->next)
        (i->item) (a_tcp, &i->data);
      nids_free_tcp_stream(a_tcp);
      return;
    }
  }

  //数据处理部分
  if (datalen + (this_tcphdr->th_flags & TH_FIN) > 0)
          //将数据更新到接收方缓冲区
    tcp_queue(a_tcp, this_tcphdr, snd, rcv,
              (char *) (this_tcphdr) + 4 * this_tcphdr->th_off,
              datalen, skblen);
        //更新窗口大小
  snd->window = ntohs(this_tcphdr->th_win);
  //如果缓存溢出,除了故障,释放掉连接
  if (rcv->rmem_alloc > 65535)
    prune_queue(rcv, this_tcphdr);
  if (!a_tcp->listeners)
    nids_free_tcp_stream(a_tcp);
}

在此过程中,还有两个关键的调用查找TCP的find_stream和添加新的TCP的add_new_tcp两个函数

新版本的find_stream里,哈希操作放到了一个新的函数nids_find_tcp_stream中进行

 635 struct tcp_stream *
 636 find_stream(struct tcphdr * this_tcphdr, struct ip * this_iphdr,
 637             int *from_client)
 638 {
 639   struct tuple4 this_addr, reversed;
 640   struct tcp_stream *a_tcp;
 641
 642   this_addr.source = ntohs(this_tcphdr->th_sport);
 643   this_addr.dest = ntohs(this_tcphdr->th_dport);
 644   this_addr.saddr = this_iphdr->ip_src.s_addr;
 645   this_addr.daddr = this_iphdr->ip_dst.s_addr;
 646   a_tcp = nids_find_tcp_stream(&this_addr);
 647   if (a_tcp) {//如果找到,设为1,否则一直找到最后
 //看是否为同一个TCP流主要看其地址是否一样
 648     *from_client = 1;
 649     return a_tcp;
 650   }
 651   reversed.source = ntohs(this_tcphdr->th_dport);
 652   reversed.dest = ntohs(this_tcphdr->th_sport);
 653   reversed.saddr = this_iphdr->ip_dst.s_addr;
 654   reversed.daddr = this_iphdr->ip_src.s_addr;
 655   a_tcp = nids_find_tcp_stream(&reversed);
 656   if (a_tcp) {
 657     *from_client = 0;
 658     return a_tcp;
 659   }
 660   return 0;
 661 }

  663 struct tcp_stream *
 664 nids_find_tcp_stream(struct tuple4 *addr)
 665 {
 666   int hash_index;
 667   struct tcp_stream *a_tcp;
 668
 669   hash_index = mk_hash_index(*addr);       //找到传入数据的哈希地址
 670   for (a_tcp = tcp_stream_table[hash_index];
 671        a_tcp && memcmp(&a_tcp->addr, addr, sizeof (struct tuple4));
 672        a_tcp = a_tcp->next_node);
 //如果此地址开始就是空,表明没有与这个包对应的TCP流;如果地址不为空,则
 //看地址值是否一样
 673   return a_tcp ? a_tcp : 0;
 674 }

add_new_tcp还是没有变化

static void
add_new_tcp(struct tcphdr * this_tcphdr, struct ip * this_iphdr)
{
  struct tcp_stream *tolink;
  struct tcp_stream *a_tcp;
  int hash_index;
  struct tuple4 addr;

  addr.source = ntohs(this_tcphdr->th_sport);
  addr.dest = ntohs(this_tcphdr->th_dport);
  addr.saddr = this_iphdr->ip_src.s_addr;
  addr.daddr = this_iphdr->ip_dst.s_addr;
  hash_index = mk_hash_index(addr);             //计算新的TCP流哈希地址

  if (tcp_num > max_stream) {   //TCP流大小超过了阀值,线释放空间
    struct lurker_node *i;
    int orig_client_state=tcp_oldest->client.state;
    tcp_oldest->nids_state = NIDS_TIMED_OUT;
    for (i = tcp_oldest->listeners; i; i = i->next)
      (i->item) (tcp_oldest, &i->data);
    nids_free_tcp_stream(tcp_oldest);
    if (orig_client_state!=TCP_SYN_SENT)
      nids_params.syslog(NIDS_WARN_TCP, NIDS_WARN_TCP_TOOMUCH, ugly_iphdr, this_tcphdr);
  }
  a_tcp = free_streams;
  if (!a_tcp) {
    fprintf(stderr, "gdb me ...\n");
    pause();
  }
  free_streams = a_tcp->next_free;

  tcp_num++;    //TCP流总数
  tolink = tcp_stream_table[hash_index];
  memset(a_tcp, 0, sizeof(struct tcp_stream));
  a_tcp->hash_index = hash_index;
  a_tcp->addr = addr;
  a_tcp->client.state = TCP_SYN_SENT;
  a_tcp->client.seq = ntohl(this_tcphdr->th_seq) + 1;
  a_tcp->client.first_data_seq = a_tcp->client.seq;
  a_tcp->client.window = ntohs(this_tcphdr->th_win);
  a_tcp->client.ts_on = get_ts(this_tcphdr, &a_tcp->client.curr_ts);
  a_tcp->client.wscale_on = get_wscale(this_tcphdr, &a_tcp->client.wscale);
  a_tcp->server.state = TCP_CLOSE;
  a_tcp->next_node = tolink;
  a_tcp->prev_node = 0;
  if (tolink)
    tolink->prev_node = a_tcp;
  tcp_stream_table[hash_index] = a_tcp;
  a_tcp->next_time = tcp_latest;
  a_tcp->prev_time = 0;
  if (!tcp_oldest)
    tcp_oldest = a_tcp;
  if (tcp_latest)
    tcp_latest->prev_time = a_tcp;
  tcp_latest = a_tcp;
}

纯属恶搞

浙ICP备16024533号

浙公网安备 33010802007459号