1 | #define _GNU_SOURCE |
---|
2 | #include "libtrace.h" |
---|
3 | #include <stdio.h> |
---|
4 | #include <unistd.h> |
---|
5 | #include <stdlib.h> |
---|
6 | #include <getopt.h> |
---|
7 | #include <stdbool.h> |
---|
8 | #include <stddef.h> |
---|
9 | #include <string.h> |
---|
10 | #include <time.h> |
---|
11 | #include "ipenc.h" |
---|
12 | |
---|
13 | |
---|
14 | static void usage(char *argv0) |
---|
15 | { |
---|
16 | fprintf(stderr,"Usage:\n" |
---|
17 | "%s flags inputfile outputfile\n" |
---|
18 | "-s --encrypt-source Encrypt the source addresses\n" |
---|
19 | "-d --encrypt-dest Encrypt the destination addresses\n" |
---|
20 | "-c --cryptopan=key Encrypt the addresses with the cryptopan\n" |
---|
21 | " prefix preserving\n" |
---|
22 | "-f --keyfile=file A file containing the cryptopan key\n" |
---|
23 | "-p --prefix=C.I.D.R/bits Substitute the prefix of the address\n" |
---|
24 | "-H --libtrace-help Print libtrace runtime documentation\n" |
---|
25 | "-z --compress-level Compress the output trace at the specified level\n" |
---|
26 | "-Z --compress-type Compress the output trace using the specified" |
---|
27 | " compression algorithm\n" |
---|
28 | ,argv0); |
---|
29 | exit(1); |
---|
30 | } |
---|
31 | |
---|
32 | /* Incrementally update a checksum */ |
---|
33 | static void update_in_cksum(uint16_t *csum, uint16_t old, uint16_t new) |
---|
34 | { |
---|
35 | uint32_t sum = (~htons(*csum) & 0xFFFF) |
---|
36 | + (~htons(old) & 0xFFFF) |
---|
37 | + htons(new); |
---|
38 | sum = (sum & 0xFFFF) + (sum >> 16); |
---|
39 | *csum = htons(~(sum + (sum >> 16))); |
---|
40 | } |
---|
41 | |
---|
42 | static void update_in_cksum32(uint16_t *csum, uint32_t old, uint32_t new) |
---|
43 | { |
---|
44 | update_in_cksum(csum,(uint16_t)(old>>16),(uint16_t)(new>>16)); |
---|
45 | update_in_cksum(csum,(uint16_t)(old&0xFFFF),(uint16_t)(new&0xFFFF)); |
---|
46 | } |
---|
47 | |
---|
48 | /* Ok this is remarkably complicated |
---|
49 | * |
---|
50 | * We want to change one, or the other IP address, while preserving |
---|
51 | * the checksum. TCP and UDP both include the faux header in their |
---|
52 | * checksum calculations, so you have to update them too. ICMP is |
---|
53 | * even worse -- it can include the original IP packet that caused the |
---|
54 | * error! So anonymise that too, but remember that it's travelling in |
---|
55 | * the opposite direction so we need to encrypt the destination and |
---|
56 | * source instead of the source and destination! |
---|
57 | */ |
---|
58 | static void encrypt_ips(struct libtrace_ip *ip,bool enc_source,bool enc_dest) |
---|
59 | { |
---|
60 | struct libtrace_tcp *tcp; |
---|
61 | struct libtrace_udp *udp; |
---|
62 | struct libtrace_icmp *icmp; |
---|
63 | |
---|
64 | tcp=trace_get_tcp_from_ip(ip,NULL); |
---|
65 | udp=trace_get_udp_from_ip(ip,NULL); |
---|
66 | icmp=trace_get_icmp_from_ip(ip,NULL); |
---|
67 | |
---|
68 | if (enc_source) { |
---|
69 | uint32_t old_ip=ip->ip_src.s_addr; |
---|
70 | uint32_t new_ip=htonl(enc_ip( |
---|
71 | htonl(ip->ip_src.s_addr) |
---|
72 | )); |
---|
73 | update_in_cksum32(&ip->ip_sum,old_ip,new_ip); |
---|
74 | if (tcp) update_in_cksum32(&tcp->check,old_ip,new_ip); |
---|
75 | if (udp) update_in_cksum32(&udp->check,old_ip,new_ip); |
---|
76 | ip->ip_src.s_addr = new_ip; |
---|
77 | } |
---|
78 | |
---|
79 | if (enc_dest) { |
---|
80 | uint32_t old_ip=ip->ip_dst.s_addr; |
---|
81 | uint32_t new_ip=htonl(enc_ip( |
---|
82 | htonl(ip->ip_dst.s_addr) |
---|
83 | )); |
---|
84 | update_in_cksum32(&ip->ip_sum,old_ip,new_ip); |
---|
85 | if (tcp) update_in_cksum32(&tcp->check,old_ip,new_ip); |
---|
86 | if (udp) update_in_cksum32(&udp->check,old_ip,new_ip); |
---|
87 | ip->ip_dst.s_addr = new_ip; |
---|
88 | } |
---|
89 | |
---|
90 | if (icmp) { |
---|
91 | /* These are error codes that return the IP packet |
---|
92 | * internally |
---|
93 | */ |
---|
94 | |
---|
95 | if (icmp->type == 3 |
---|
96 | || icmp->type == 5 |
---|
97 | || icmp->type == 11) { |
---|
98 | char *ptr = (char *)icmp; |
---|
99 | encrypt_ips( |
---|
100 | (struct libtrace_ip*)(ptr+ |
---|
101 | sizeof(struct libtrace_icmp)), |
---|
102 | enc_dest, |
---|
103 | enc_source); |
---|
104 | } |
---|
105 | |
---|
106 | if (enc_source || enc_dest) |
---|
107 | icmp->checksum = 0; |
---|
108 | } |
---|
109 | } |
---|
110 | |
---|
111 | int main(int argc, char *argv[]) |
---|
112 | { |
---|
113 | enum enc_type_t enc_type = ENC_NONE; |
---|
114 | char *key = NULL; |
---|
115 | struct libtrace_t *trace = 0; |
---|
116 | struct libtrace_packet_t *packet = trace_create_packet(); |
---|
117 | struct libtrace_out_t *writer = 0; |
---|
118 | bool enc_source = false; |
---|
119 | bool enc_dest = false; |
---|
120 | char *output = 0; |
---|
121 | int level = -1; |
---|
122 | char *compress_type_str=NULL; |
---|
123 | trace_option_compresstype_t compress_type = TRACE_OPTION_COMPRESSTYPE_NONE; |
---|
124 | |
---|
125 | |
---|
126 | if (argc<2) |
---|
127 | usage(argv[0]); |
---|
128 | |
---|
129 | while (1) { |
---|
130 | int option_index; |
---|
131 | struct option long_options[] = { |
---|
132 | { "encrypt-source", 0, 0, 's' }, |
---|
133 | { "encrypt-dest", 0, 0, 'd' }, |
---|
134 | { "cryptopan", 1, 0, 'c' }, |
---|
135 | { "cryptopan-file", 1, 0, 'f' }, |
---|
136 | { "prefix", 1, 0, 'p' }, |
---|
137 | { "compress-level", 1, 0, 'z' }, |
---|
138 | { "compress-type", 1, 0, 'Z' }, |
---|
139 | { "libtrace-help", 0, 0, 'H' }, |
---|
140 | { NULL, 0, 0, 0 }, |
---|
141 | }; |
---|
142 | |
---|
143 | int c=getopt_long(argc, argv, "Z:z:sc:f:dp:H", |
---|
144 | long_options, &option_index); |
---|
145 | |
---|
146 | if (c==-1) |
---|
147 | break; |
---|
148 | |
---|
149 | switch (c) { |
---|
150 | case 'Z': compress_type_str=optarg; break; |
---|
151 | case 'z': level = atoi(optarg); break; |
---|
152 | case 's': enc_source=true; break; |
---|
153 | case 'd': enc_dest =true; break; |
---|
154 | case 'c': |
---|
155 | if (key!=NULL) { |
---|
156 | fprintf(stderr,"You can only have one encryption type and one key\n"); |
---|
157 | usage(argv[0]); |
---|
158 | } |
---|
159 | key=strdup(optarg); |
---|
160 | enc_type = ENC_CRYPTOPAN; |
---|
161 | break; |
---|
162 | case 'f': |
---|
163 | if(key != NULL) { |
---|
164 | fprintf(stderr,"You can only have one encryption type and one key\n"); |
---|
165 | usage(argv[0]); |
---|
166 | } |
---|
167 | FILE * infile = fopen(optarg,"rb"); |
---|
168 | if(infile == NULL) { |
---|
169 | perror("Failed to open cryptopan keyfile"); |
---|
170 | return 1; |
---|
171 | } |
---|
172 | key = (char *) malloc(sizeof(char *) * 32); |
---|
173 | if(fread(key,1,32,infile) != 32) { |
---|
174 | if(ferror(infile)) { |
---|
175 | perror("Failed while reading cryptopan keyfile"); |
---|
176 | } |
---|
177 | } |
---|
178 | fclose(infile); |
---|
179 | enc_type = ENC_CRYPTOPAN; |
---|
180 | break; |
---|
181 | case 'p': |
---|
182 | if (key!=NULL) { |
---|
183 | fprintf(stderr,"You can only have one encryption type and one key\n"); |
---|
184 | usage(argv[0]); |
---|
185 | } |
---|
186 | key=strdup(optarg); |
---|
187 | enc_type = ENC_PREFIX_SUBSTITUTION; |
---|
188 | break; |
---|
189 | case 'H': |
---|
190 | trace_help(); |
---|
191 | exit(1); |
---|
192 | break; |
---|
193 | default: |
---|
194 | fprintf(stderr,"unknown option: %c\n",c); |
---|
195 | usage(argv[0]); |
---|
196 | |
---|
197 | } |
---|
198 | |
---|
199 | } |
---|
200 | |
---|
201 | if (compress_type_str == NULL && level >= 0) { |
---|
202 | fprintf(stderr, "Compression level set, but no compression type was defined, setting to gzip\n"); |
---|
203 | compress_type = TRACE_OPTION_COMPRESSTYPE_ZLIB; |
---|
204 | } |
---|
205 | |
---|
206 | else if (compress_type_str == NULL) { |
---|
207 | /* If a level or type is not specified, use the "none" |
---|
208 | * compression module */ |
---|
209 | compress_type = TRACE_OPTION_COMPRESSTYPE_NONE; |
---|
210 | } |
---|
211 | |
---|
212 | /* I decided to be fairly generous in what I accept for the |
---|
213 | * compression type string */ |
---|
214 | else if (strncmp(compress_type_str, "gz", 2) == 0 || |
---|
215 | strncmp(compress_type_str, "zlib", 4) == 0) { |
---|
216 | compress_type = TRACE_OPTION_COMPRESSTYPE_ZLIB; |
---|
217 | } else if (strncmp(compress_type_str, "bz", 2) == 0) { |
---|
218 | compress_type = TRACE_OPTION_COMPRESSTYPE_BZ2; |
---|
219 | } else if (strncmp(compress_type_str, "lzo", 3) == 0) { |
---|
220 | compress_type = TRACE_OPTION_COMPRESSTYPE_LZO; |
---|
221 | } else if (strncmp(compress_type_str, "no", 2) == 0) { |
---|
222 | compress_type = TRACE_OPTION_COMPRESSTYPE_NONE; |
---|
223 | } else { |
---|
224 | fprintf(stderr, "Unknown compression type: %s\n", |
---|
225 | compress_type_str); |
---|
226 | return 1; |
---|
227 | } |
---|
228 | |
---|
229 | |
---|
230 | enc_init(enc_type,key); |
---|
231 | |
---|
232 | /* open input uri */ |
---|
233 | trace = trace_create(argv[optind]); |
---|
234 | if (trace_is_err(trace)) { |
---|
235 | trace_perror(trace,"trace_create"); |
---|
236 | trace_destroy(trace); |
---|
237 | return 1; |
---|
238 | } |
---|
239 | |
---|
240 | if (optind +1>= argc) { |
---|
241 | /* no output specified, output in same format to |
---|
242 | * stdout |
---|
243 | */ |
---|
244 | output = strdup("erf:-"); |
---|
245 | writer = trace_create_output(output); |
---|
246 | } else { |
---|
247 | writer = trace_create_output(argv[optind +1]); |
---|
248 | } |
---|
249 | if (trace_is_err_output(writer)) { |
---|
250 | trace_perror_output(writer,"trace_create_output"); |
---|
251 | trace_destroy_output(writer); |
---|
252 | trace_destroy(trace); |
---|
253 | return 1; |
---|
254 | } |
---|
255 | |
---|
256 | /* Hopefully this will deal nicely with people who want to crank the |
---|
257 | * compression level up to 11 :) */ |
---|
258 | if (level > 9) { |
---|
259 | fprintf(stderr, "WARNING: Compression level > 9 specified, setting to 9 instead\n"); |
---|
260 | level = 9; |
---|
261 | } |
---|
262 | |
---|
263 | if (level >= 0 && trace_config_output(writer, |
---|
264 | TRACE_OPTION_OUTPUT_COMPRESS, &level) == -1) { |
---|
265 | trace_perror_output(writer, "Configuring compression level"); |
---|
266 | trace_destroy_output(writer); |
---|
267 | trace_destroy(trace); |
---|
268 | return 1; |
---|
269 | } |
---|
270 | |
---|
271 | if (trace_config_output(writer, TRACE_OPTION_OUTPUT_COMPRESSTYPE, |
---|
272 | &compress_type) == -1) { |
---|
273 | trace_perror_output(writer, "Configuring compression type"); |
---|
274 | trace_destroy_output(writer); |
---|
275 | trace_destroy(trace); |
---|
276 | return 1; |
---|
277 | } |
---|
278 | |
---|
279 | if (trace_start(trace)==-1) { |
---|
280 | trace_perror(trace,"trace_start"); |
---|
281 | trace_destroy_output(writer); |
---|
282 | trace_destroy(trace); |
---|
283 | return 1; |
---|
284 | } |
---|
285 | if (trace_start_output(writer)==-1) { |
---|
286 | trace_perror_output(writer,"trace_start_output"); |
---|
287 | trace_destroy_output(writer); |
---|
288 | trace_destroy(trace); |
---|
289 | return 1; |
---|
290 | } |
---|
291 | for(;;) { |
---|
292 | struct libtrace_ip *ipptr; |
---|
293 | libtrace_udp_t *udp = NULL; |
---|
294 | libtrace_tcp_t *tcp = NULL; |
---|
295 | |
---|
296 | int psize; |
---|
297 | psize = trace_read_packet(trace, packet); |
---|
298 | if (psize == 0) { |
---|
299 | break; |
---|
300 | } |
---|
301 | if (psize < 0) { |
---|
302 | trace_perror(trace,"read_packet"); |
---|
303 | break; |
---|
304 | } |
---|
305 | |
---|
306 | ipptr = trace_get_ip(packet); |
---|
307 | |
---|
308 | if (ipptr && (enc_source || enc_dest)) { |
---|
309 | encrypt_ips(ipptr,enc_source,enc_dest); |
---|
310 | ipptr->ip_sum = 0; |
---|
311 | } |
---|
312 | |
---|
313 | /* Replace checksums so that IP encryption cannot be |
---|
314 | * reversed */ |
---|
315 | |
---|
316 | /* XXX replace with nice use of trace_get_transport() */ |
---|
317 | |
---|
318 | udp = trace_get_udp(packet); |
---|
319 | if (udp && (enc_source || enc_dest)) { |
---|
320 | udp->check = 0; |
---|
321 | } |
---|
322 | |
---|
323 | tcp = trace_get_tcp(packet); |
---|
324 | if (tcp && (enc_source || enc_dest)) { |
---|
325 | tcp->check = 0; |
---|
326 | } |
---|
327 | |
---|
328 | /* TODO: Encrypt IP's in ARP packets */ |
---|
329 | |
---|
330 | if (trace_write_packet(writer,packet)==-1) { |
---|
331 | trace_perror_output(writer,"writer"); |
---|
332 | break; |
---|
333 | } |
---|
334 | } |
---|
335 | trace_destroy_packet(packet); |
---|
336 | trace_destroy(trace); |
---|
337 | trace_destroy_output(writer); |
---|
338 | return 0; |
---|
339 | } |
---|