path: root/support/ltsm/ltsm.c

#include <netinet/ip.h>
#include <netinet/in.h>
#include <netinet/ip6.h>
#include <netinet/tcp.h>

/*
 * The TCP state transition table needs a few words...
 *
 * We are the man in the middle. All the packets go through us
 * but might get lost in transit to the destination.
 * It is assumed that the destinations can't receive segments
 * we haven't seen.
 *
 * The checked segment is in window, but our windows are *not*
 * equivalent with the ones of the sender/receiver. We always
 * try to guess the state of the current sender.
 *
 * The meaning of the states are:
 *
 * NONE:	initial state
 * SYN_SENT:	SYN-only packet seen
 * SYN_SENT2:	SYN-only packet seen from reply dir, simultaneous open
 * SYN_RECV:	SYN-ACK packet seen
 * ESTABLISHED:	ACK packet seen
 * FIN_WAIT:	FIN packet seen
 * CLOSE_WAIT:	ACK seen (after FIN)
 * LAST_ACK:	FIN seen (after FIN)
 * TIME_WAIT:	last ACK seen
 * CLOSE:	closed connection (RST)
 *
 * Packets marked as IGNORED (sIG):
 *	if they may be either invalid or valid
 *	and the receiver may send back a connection
 *	closing RST or a SYN/ACK.
 *
 * Packets marked as INVALID (sIV):
 *	if we regard them as truly invalid packets
 */
 
#include <stdlib.h>
#include <stdio.h>
#include <netinet/tcp.h>
#include <netinet/udp.h>
#include <netinet/ip.h>
#include <assert.h>
#include <time.h>
#include <arpa/inet.h>
#include "ltsm.h"



enum tcp_conntrack {
    TCP_CONNTRACK_NONE,
    TCP_CONNTRACK_SYN_SENT,
    TCP_CONNTRACK_SYN_RECV,
    TCP_CONNTRACK_ESTABLISHED,
    TCP_CONNTRACK_FIN_WAIT,
    TCP_CONNTRACK_CLOSE_WAIT,
    TCP_CONNTRACK_LAST_ACK,
    TCP_CONNTRACK_TIME_WAIT,
    TCP_CONNTRACK_CLOSE,
    TCP_CONNTRACK_LISTEN, /* obsolete */
#define TCP_CONNTRACK_SYN_SENT2 TCP_CONNTRACK_LISTEN
    TCP_CONNTRACK_MAX,
    TCP_CONNTRACK_IGNORE
};


/* What TCP flags are set from RST/SYN/FIN/ACK. */
enum tcp_bit_set {
    TCP_SYN_SET,
    TCP_SYNACK_SET,
    TCP_FIN_SET,
    TCP_ACK_SET,
    TCP_RST_SET,
    TCP_NONE_SET,
};

#define TCP_URG_FLAG 0x20
#define TCP_ACK_FLAG 0x10
#define TCP_PSH_FLAG 0x08
#define TCP_RST_FLAG 0x04
#define TCP_SYN_FLAG 0x02
#define TCP_FIN_FLAG 0x01
#define TCP_FLAG_ALL 0x3F


#define sNO TCP_CONNTRACK_NONE
#define sSS TCP_CONNTRACK_SYN_SENT
#define sSR TCP_CONNTRACK_SYN_RECV
#define sES TCP_CONNTRACK_ESTABLISHED
#define sFW TCP_CONNTRACK_FIN_WAIT
#define sCW TCP_CONNTRACK_CLOSE_WAIT
#define sLA TCP_CONNTRACK_LAST_ACK
#define sTW TCP_CONNTRACK_TIME_WAIT
#define sCL TCP_CONNTRACK_CLOSE
#define sS2 TCP_CONNTRACK_SYN_SENT2
#define sIV TCP_CONNTRACK_MAX
#define sIG TCP_CONNTRACK_IGNORE

static const struct ltsm_result g_tsm_first_void = {FTSM_VOID, LTSM_VOID}; /* ��SYN��, ��������״̬, ����void */
static const struct ltsm_result g_tsm_first_start = {TCP_CONNTRACK_SYN_SENT, LTSM_START};


static const char *g_ftsm_string[] = 
{
	"VOID",
	"FTSM_SYN_SENT",
	"FTSM_SYN_RCVD",
	"FTSM_ESTABLISHED",
	"FTSM_FIN_WAIT",
	"FTSM_CLOSE_WAIT",
	"FTSM_LAST_ACK",
	"FTSM_TIME_WAIT",
	"FTSM_CLOSED",
	"FTSM_LISTEN",
	"__FTSM_MAX",
};

static const char *g_ltsm_string[] = 
{
	"LTSM_VOID", 
	"LTSM_START",
	"LTSM_DATA",
	"LTSM_CLOSE",
};



static const enum light_tcp_state g_ltsm_full2light_table[12] = 
{
		LTSM_VOID, /* TCP_CONNTRACK_NONE,			*/
		LTSM_START, /* TCP_CONNTRACK_SYN_SENT,		*/
		LTSM_DATA, /* TCP_CONNTRACK_SYN_RECV,		*/
		LTSM_DATA, /* TCP_CONNTRACK_ESTABLISHED,	*/
		LTSM_DATA, /* TCP_CONNTRACK_FIN_WAIT,		*/
		LTSM_DATA, /* TCP_CONNTRACK_CLOSE_WAIT,		*/
		LTSM_DATA, /* TCP_CONNTRACK_LAST_ACK,		*/
		LTSM_CLOSE, /* TCP_CONNTRACK_TIME_WAIT,		*/
		LTSM_CLOSE, /* TCP_CONNTRACK_CLOSE,			*/
		LTSM_VOID, /* TCP_CONNTRACK_LISTEN, 		*/
		LTSM_VOID, /* TCP_CONNTRACK_MAX,			*/
		LTSM_VOID, /* TCP_CONNTRACK_IGNORE			*/
};

/*
	if dir == 0, packet from client; if dir == 1, packet from service.
	
	new_tcp_state = tcp_conntracks[dir][new_tcp_flag][old_tcp_state];
*/
static const uint8_t tcp_conntracks[2][6][TCP_CONNTRACK_MAX] = {
    {/* ORIGINAL */
     /* 	         sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2
        */
     /*syn*/ {sSS, sSS, sIG, sIG, sIG, sIG, sIG, sSS, sSS, sS2},
     /*
      *	sNO -> sSS	Initialize a new connection
      *	sSS -> sSS	Retransmitted SYN
      *	sS2 -> sS2	Late retransmitted SYN
      *	sSR -> sIG
      *	sES -> sIG	Error: SYNs in window outside the SYN_SENT state
      *			are errors. Receiver will reply with RST
      *			and close the connection.
      *			Or we are not in sync and hold a dead connection.
      *	sFW -> sIG
      *	sCW -> sIG
      *	sLA -> sIG
      *	sTW -> sSS	Reopened connection (RFC 1122).
      *	sCL -> sSS
      */
     /* 	         sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2
        */
     /*synack*/ {sIV, sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG, sSR},
     /*
      *	sNO -> sIV	Too late and no reason to do anything
      *	sSS -> sIV	Client can't send SYN and then SYN/ACK
      *	sS2 -> sSR	SYN/ACK sent to SYN2 in simultaneous open
      *	sSR -> sIG
      *	sES -> sIG	Error: SYNs in window outside the SYN_SENT state
      *			are errors. Receiver will reply with RST
      *			and close the connection.
      *			Or we are not in sync and hold a dead connection.
      *	sFW -> sIG
      *	sCW -> sIG
      *	sLA -> sIG
      *	sTW -> sIG
      *	sCL -> sIG
      */
     /* 	         sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2
        */
     /*fin*/ {sIV, sIV, sFW, sFW, sLA, sLA, sLA, sTW, sCL, sIV},
     /*
      *	sNO -> sIV	Too late and no reason to do anything...
      *	sSS -> sIV	Client migth not send FIN in this state:
      *			we enforce waiting for a SYN/ACK reply first.
      *	sS2 -> sIV
      *	sSR -> sFW	Close started.
      *	sES -> sFW
      *	sFW -> sLA	FIN seen in both directions, waiting for
      *			the last ACK.
      *			Migth be a retransmitted FIN as well...
      *	sCW -> sLA
      *	sLA -> sLA	Retransmitted FIN. Remain in the same state.
      *	sTW -> sTW
      *	sCL -> sCL
      */
     /* 	         sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2
        */
     /*ack*/ {sES, sIV, sES, sES, sCW, sCW, sTW, sTW, sCL, sIV},
     /*
      *	sNO -> sES	Assumed.
      *	sSS -> sIV	ACK is invalid: we haven't seen a SYN/ACK yet.
      *	sS2 -> sIV
      *	sSR -> sES	Established state is reached.
      *	sES -> sES	:-)
      *	sFW -> sCW	Normal close request answered by ACK.
      *	sCW -> sCW
      *	sLA -> sTW	Last ACK detected.
      *	sTW -> sTW	Retransmitted last ACK. Remain in the same state.
      *	sCL -> sCL
      */
     /* 	         sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2
        */
     /*rst*/ {sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL},
     /*none*/ {sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV}},
     
    {/******************************** REPLY *******************************/
    
     /* 	         sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2
        */
     /*syn*/ {sIV, sS2, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sS2},
     /*
      *	sNO -> sIV	Never reached.
      *	sSS -> sS2	Simultaneous open
      *	sS2 -> sS2	Retransmitted simultaneous SYN
      *	sSR -> sIV	Invalid SYN packets sent by the server
      *	sES -> sIV
      *	sFW -> sIV
      *	sCW -> sIV
      *	sLA -> sIV
      *	sTW -> sIV	Reopened connection, but server may not do it.
      *	sCL -> sIV
      */
     /* 	         sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2
        */
     /*synack*/ {sIV, sSR, sSR, sIG, sIG, sIG, sIG, sIG, sIG, sSR},
     /*
      *	sSS -> sSR	Standard open.
      *	sS2 -> sSR	Simultaneous open
      *	sSR -> sSR	Retransmitted SYN/ACK.
      *	sES -> sIG	Late retransmitted SYN/ACK?
      *	sFW -> sIG	Might be SYN/ACK answering ignored SYN
      *	sCW -> sIG
      *	sLA -> sIG
      *	sTW -> sIG
      *	sCL -> sIG
      */
     /* 	         sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2
        */
     /*fin*/ {sIV, sIV, sFW, sFW, sLA, sLA, sLA, sTW, sCL, sIV},
     /*
      *	sSS -> sIV	Server might not send FIN in this state.
      *	sS2 -> sIV
      *	sSR -> sFW	Close started.
      *	sES -> sFW
      *	sFW -> sLA	FIN seen in both directions.
      *	sCW -> sLA
      *	sLA -> sLA	Retransmitted FIN.
      *	sTW -> sTW
      *	sCL -> sCL
      */
     /* 	         sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2
        */
     /*ack*/ {sIV, sIG, sSR, sES, sCW, sCW, sTW, sTW, sCL, sIG},
     /*
      *	sSS -> sIG	Might be a half-open connection.
      *	sS2 -> sIG
      *	sSR -> sSR	Might answer late resent SYN.
      *	sES -> sES	:-)
      *	sFW -> sCW	Normal close request answered by ACK.
      *	sCW -> sCW
      *	sLA -> sTW	Last ACK detected.
      *	sTW -> sTW	Retransmitted last ACK.
      *	sCL -> sCL
      */
     /* 	         sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2
        */
     /*rst*/ {sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL},
     /*none*/ {sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV}}
	};

typedef struct{
	uint32_t sip_net_order;
	uint32_t dip_net_order;
	uint16_t sport_net_order;
	uint16_t dport_net_order;
	uint8_t old_state;
	uint8_t cur_state;
	uint8_t create_dir;
}ltsm_inner_t;


const char *ltsm_fstate_ntop(enum full_tcp_state fstate)
{
	if((int)fstate < 0 || (int)fstate >= __FTSM_MAX){
		return "Invalid";
	}

	return g_ftsm_string[fstate];
}


const char *ltsm_lstate_ntop(enum light_tcp_state lstate)
{
	if((int)lstate < 0 || (int)lstate > LTSM_CLOSE){
		return "Invalid";
	}

	return g_ltsm_string[lstate];
}



static inline uint32_t ltsm_get_tcpflags(const struct ltsm_tcphdr *th) {
    if (th->th_flags & TCP_RST_FLAG)
        return TCP_RST_SET;
    else if (th->th_flags & TCP_SYN_FLAG)
        return ((th->th_flags & TCP_ACK_FLAG) ? TCP_SYNACK_SET : TCP_SYN_SET);
    else if (th->th_flags & TCP_FIN_FLAG)
        return TCP_FIN_SET;
    else if (th->th_flags & TCP_ACK_FLAG)
        return TCP_ACK_SET;
    else
        return TCP_NONE_SET;
}


static inline uint32_t ltsm_convert_tcpflags(uint8_t th_flags) {
    if (th_flags & TCP_RST_FLAG)
        return TCP_RST_SET;
    else if (th_flags & TCP_SYN_FLAG)
        return ((th_flags & TCP_ACK_FLAG) ? TCP_SYNACK_SET : TCP_SYN_SET);
    else if (th_flags & TCP_FIN_FLAG)
        return TCP_FIN_SET;
    else if (th_flags & TCP_ACK_FLAG)
        return TCP_ACK_SET;
    else
        return TCP_NONE_SET;
}


ltsm_stream_handle ltsm_create_handle(void)
{
	ltsm_inner_t *ltsm_inner;

	ltsm_inner = calloc(1, sizeof(ltsm_inner_t));

	ltsm_inner->old_state = TCP_CONNTRACK_SYN_SENT;

	return ltsm_inner;
}



ltsm_stream_handle ltsm_create_stream_handle(const struct ltsm_iphdr * iphdr)
{
	const struct ltsm_tcphdr *tcp_hdr;
	ltsm_inner_t *ltsm_inner;
	int dir = 0;
	uint32_t tcp_flags_set;

	if(IPPROTO_TCP != iphdr->ip_p){
		return NULL;
	}

	tcp_hdr = (const struct ltsm_tcphdr *)((char *)iphdr + iphdr->ip_hl*4);
	if(TH_SYN == tcp_hdr->th_flags){
		dir = 0;
	}else if(TH_SYN|TH_ACK == tcp_hdr->th_flags){
		dir = 1;
	}else{
		return NULL;
	}

	ltsm_inner = calloc(1, sizeof(ltsm_inner_t));
	ltsm_inner->old_state = TCP_CONNTRACK_NONE;
	ltsm_inner->sip_net_order = iphdr->ip_src.s_addr;
	ltsm_inner->dip_net_order = iphdr->ip_dst.s_addr;
	ltsm_inner->sport_net_order = tcp_hdr->th_sport;
	ltsm_inner->dport_net_order = tcp_hdr->th_dport;

	tcp_flags_set = ltsm_get_tcpflags(tcp_hdr);
	
	ltsm_inner->cur_state = tcp_conntracks[dir][tcp_flags_set][ltsm_inner->old_state];
	ltsm_inner->create_dir = dir;
	
	return ltsm_inner;
}


uint8_t ltsm_proc_ipv4tcppkt(ltsm_stream_handle s_ltsm, const struct ltsm_iphdr *iphdr)
{
	uint8_t tcpstate;
	ltsm_inner_t *ltsm_inner = (ltsm_inner_t *)s_ltsm;
	int dir = 0;
	uint32_t tcp_flags_set;
	const struct ltsm_tcphdr *tcp_hdr;

	if(IPPROTO_TCP != iphdr->ip_p){
		return LTSM_VOID;
	}

	tcp_hdr = (const struct ltsm_tcphdr *)((char *)iphdr + iphdr->ip_hl*4);
	tcp_flags_set = ltsm_get_tcpflags(tcp_hdr);

	if((ltsm_inner->sip_net_order == iphdr->ip_src.s_addr) 
	 && (ltsm_inner->dip_net_order == iphdr->ip_dst.s_addr)
	 && (ltsm_inner->sport_net_order == tcp_hdr->th_sport)
	 && (ltsm_inner->dport_net_order == tcp_hdr->th_dport)){
	 	dir = ltsm_inner->create_dir;
	}else{
		dir = ltsm_inner->create_dir ^ 1;
	}

	tcpstate = tcp_conntracks[dir][tcp_flags_set][ltsm_inner->old_state];

	if(tcpstate < TCP_CONNTRACK_MAX){
		ltsm_inner->old_state = tcpstate;
	}

	return tcpstate;
}

void ltsm_destroy_stream_handle(ltsm_stream_handle pltsm)
{
	free(pltsm);
}

void ltsm_destroy_handle(ltsm_stream_handle pltsm)
{
	free(pltsm);
}



struct ltsm_result ltsm_get_current_state(ltsm_stream_handle pltsm, uint8_t tcp_flags, uint8_t dir)
{
	uint8_t tcp_fstate;
	uint32_t tcp_flags_set;
	struct ltsm_result res;
	
	if(NULL == pltsm){
		if(TH_SYN != tcp_flags){
			return g_tsm_first_void;
		}

		return g_tsm_first_start;
	}

	ltsm_inner_t *ltsm_inner = (ltsm_inner_t *)pltsm;	

	tcp_flags_set = ltsm_convert_tcpflags(tcp_flags);
	tcp_fstate = tcp_conntracks[dir][tcp_flags_set][ltsm_inner->old_state];

	ltsm_inner->old_state = tcp_fstate;

	res.fstate = tcp_fstate;
	res.lstate = g_ltsm_full2light_table[tcp_fstate];

	return res;
}


uint32_t ltsm_tcp_key_generate(uint32_t sip_net_order, uint32_t dip_net_order, uint16_t sport_net_order, uint16_t dport_net_order)
{

}

int ltsm_tcp_key_verify(const struct ip * iphdr)
{

}