void parse_packet(u_char *mode, const struct pcap_pkthdr *header, const u_char *packet) { // IP header data struct ip *ip4; #ifdef WITH_IPV6 // IPv6 header data struct ip6_hdr *ip6; #endif // IP version uint32_t ip_ver; // IP protocol uint8_t ip_proto; // IP header size uint32_t ip_hl = 0; // Fragment offset uint32_t ip_off = 0; // Fragmentation flag uint8_t ip_frag = 0; // Fragmentation offset uint16_t ip_frag_off = 0; //! Source Address char ip_src[ADDRESSLEN]; //! Destination Address char ip_dst[ADDRESSLEN]; // Source and Destination Ports u_short sport, dport; // UDP header data struct udphdr *udp; // UDP header size uint16_t udp_off; // TCP header data struct tcphdr *tcp; // TCP header size uint16_t tcp_off; // Packet payload data u_char *payload = NULL; // Packet payload size uint32_t size_payload = header->caplen; // SIP message transport int transport; // Media structure for RTP packets rtp_stream_t *stream; // Captured packet info capture_packet_t *pkt; // Ignore packets while capture is paused if (capture_is_paused()) return; // Check if we have reached capture limit if (capinfo.limit && sip_calls_count() >= capinfo.limit) return; // Get IP header ip4 = (struct ip *) (packet + capinfo.link_hl); #ifdef WITH_IPV6 // Get IPv6 header ip6 = (struct ip6_hdr *) (packet + capinfo.link_hl); #endif // Get IP version ip_ver = ip4->ip_v; switch (ip_ver) { case 4: ip_hl = ip4->ip_hl * 4; ip_proto = ip4->ip_p; ip_off = ntohs(ip4->ip_off); ip_frag = ip_off & (IP_MF | IP_OFFMASK); ip_frag_off = (ip_frag) ? (ip_off & IP_OFFMASK) * 8 : 0; // TODO Get fragment information inet_ntop(AF_INET, &ip4->ip_src, ip_src, sizeof(ip_src)); inet_ntop(AF_INET, &ip4->ip_dst, ip_dst, sizeof(ip_dst)); break; #ifdef WITH_IPV6 case 6: ip_hl = sizeof(struct ip6_hdr); ip_proto = ip6->ip6_nxt; if (ip_proto == IPPROTO_FRAGMENT) { struct ip6_frag *ip6f = (struct ip6_frag *) (ip6 + ip_hl); ip_frag_off = ntohs(ip6f->ip6f_offlg & IP6F_OFF_MASK); // TODO Get fragment information } inet_ntop(AF_INET6, &ip6->ip6_src, ip_src, sizeof(ip_src)); inet_ntop(AF_INET6, &ip6->ip6_dst, ip_dst, sizeof(ip_dst)); break; #endif default: return; } // Only interested in UDP packets if (ip_proto == IPPROTO_UDP) { // Get UDP header udp = (struct udphdr *)((u_char *)(ip4) + ip_hl); udp_off = (ip_frag_off) ? 0 : sizeof(struct udphdr); // Set packet ports sport = htons(udp->uh_sport); dport = htons(udp->uh_dport); // Get actual payload size size_payload -= capinfo.link_hl + ip_hl + udp_off; #ifdef WITH_IPV6 if (ip_ver == 6) size_payload -= ntohs(ip6->ip6_ctlun.ip6_un1.ip6_un1_plen); #endif // Get payload start payload = (u_char *) (udp) + udp_off; // Set transport UDP transport = CAPTURE_PACKET_SIP_UDP; } else if (ip_proto == IPPROTO_TCP) { // Get TCP header tcp = (struct tcphdr *)((u_char *)(ip4 )+ ip_hl); tcp_off = (ip_frag_off) ? 0 : (tcp->th_off * 4); // Set packet ports sport = htons(tcp->th_sport); dport = htons(tcp->th_dport); // Get actual payload size size_payload -= capinfo.link_hl + ip_hl + tcp_off; #ifdef WITH_IPV6 if (ip_ver == 6) size_payload -= ntohs(ip6->ip6_ctlun.ip6_un1.ip6_un1_plen); #endif // Get payload start payload = (u_char *)(tcp) + tcp_off; // Set transport TCP transport = CAPTURE_PACKET_SIP_TCP; } else { // Not handled protocol return; } if ((int32_t)size_payload < 0) size_payload = 0; // Create a structure for this captured packet pkt = capture_packet_create(header, packet, header->caplen); capture_packet_set_type(pkt, transport); // For TCP and UDP, use payload directly from the packet capture_packet_set_payload(pkt, NULL, size_payload); #ifdef WITH_OPENSSL // Check if packet is TLS if (capinfo.keyfile && transport == CAPTURE_PACKET_SIP_TCP) tls_process_segment(ip4, pkt); #endif // Check if packet is WS or WSS if (transport == CAPTURE_PACKET_SIP_TCP) capture_ws_check_packet(pkt); // We're only interested in packets with payload if (capture_packet_get_payload_len(pkt)) { // Parse this header and payload if (sip_load_message(pkt, ip_src, sport, ip_dst, dport)) { // Store this packets in output file dump_packet(capinfo.pd, header, packet); return; } // Check if this packet belongs to a RTP stream // TODO Store this packet in the stream if ((stream = rtp_check_stream(pkt, ip_src, sport, ip_dst, dport))) { // We have an RTP packet! capture_packet_set_type(pkt, CAPTURE_PACKET_RTP); // Store this pacekt if capture rtp is enabled if (capinfo.rtp_capture) { call_add_rtp_packet(stream_get_call(stream), pkt); } else { capture_packet_destroy(pkt); } // Store this packets in output file dump_packet(capinfo.pd, header, packet); return; } } // Not an interesting packet ... capture_packet_destroy(pkt); }
void parse_packet(u_char *info, const struct pcap_pkthdr *header, const u_char *packet) { // Capture info capture_info_t *capinfo = (capture_info_t *) info; // UDP header data struct udphdr *udp; // UDP header size uint16_t udp_off; // TCP header data struct tcphdr *tcp; // TCP header size uint16_t tcp_off; // Packet data u_char data[MAX_CAPTURE_LEN]; // Packet payload data u_char *payload = NULL; // Whole packet size uint32_t size_capture = header->caplen; // Packet payload size uint32_t size_payload = size_capture - capinfo->link_hl; // Captured packet info packet_t *pkt; // Ignore packets while capture is paused if (capture_paused()) return; // Check if we have reached capture limit if (capture_cfg.limit && sip_calls_count() >= capture_cfg.limit) return; // Check maximum capture length if (header->caplen > MAX_CAPTURE_LEN) return; // Copy packet payload memcpy(data, packet, header->caplen); // Check if we have a complete IP packet if (!(pkt = capture_packet_reasm_ip(capinfo, header, data, &size_payload, &size_capture))) return; // Only interested in UDP packets if (pkt->proto == IPPROTO_UDP) { // Get UDP header udp = (struct udphdr *)((u_char *)(data) + (size_capture - size_payload)); udp_off = sizeof(struct udphdr); // Set packet ports pkt->src.port = htons(udp->uh_sport); pkt->dst.port = htons(udp->uh_dport); // Remove UDP Header from payload size_payload -= udp_off; if ((int32_t)size_payload < 0) size_payload = 0; // Remove TCP Header from payload payload = (u_char *) (udp) + udp_off; // Complete packet with Transport information packet_set_type(pkt, PACKET_SIP_UDP); packet_set_payload(pkt, payload, size_payload); } else if (pkt->proto == IPPROTO_TCP) { // Get TCP header tcp = (struct tcphdr *)((u_char *)(data) + (size_capture - size_payload)); tcp_off = (tcp->th_off * 4); // Set packet ports pkt->src.port = htons(tcp->th_sport); pkt->dst.port = htons(tcp->th_dport); // Get actual payload size size_payload -= tcp_off; if ((int32_t)size_payload < 0) size_payload = 0; // Get payload start payload = (u_char *)(tcp) + tcp_off; // Complete packet with Transport information packet_set_type(pkt, PACKET_SIP_TCP); packet_set_payload(pkt, payload, size_payload); // Create a structure for this captured packet if (!(pkt = capture_packet_reasm_tcp(pkt, tcp, payload, size_payload))) return; #if defined(WITH_GNUTLS) || defined(WITH_OPENSSL) // Check if packet is TLS if (capture_cfg.keyfile) { tls_process_segment(pkt, tcp); } #endif // Check if packet is WS or WSS capture_ws_check_packet(pkt); } else { // Not handled protocol packet_destroy(pkt); return; } // Avoid parsing from multiples sources. // Avoid parsing while screen in being redrawn capture_lock(); // Check if we can handle this packet if (capture_packet_parse(pkt) == 0) { #ifdef USE_EEP // Send this packet through eep capture_eep_send(pkt); #endif // Store this packets in output file dump_packet(capture_cfg.pd, pkt); // If storage is disabled, delete frames payload if (capture_cfg.storage == 0) { packet_free_frames(pkt); } // Allow Interface refresh and user input actions capture_unlock(); return; } // Not an interesting packet ... packet_destroy(pkt); // Allow Interface refresh and user input actions capture_unlock(); }