TSG-8098,TSG-8099,修改icmp_unreachable和tamper_actionv5.4.12

3 files changed, 64 insertions, 126 deletions

diff --git a/src/tsg_action.cpp b/src/tsg_action.cpp
index 53fcfd4..9156973 100644
--- a/src/tsg_action.cpp
+++ b/src/tsg_action.cpp
@@ -552,9 +552,11 @@ static unsigned char do_action_reset(const struct streaminfo *a_stream, Maat_rul
 
 static unsigned char do_action_drop(const struct streaminfo *a_stream, Maat_rule_t *p_result, struct compile_user_region *user_region, tsg_protocol_t protocol, const void *a_packet)
 {
-    if(user_region-> drop_para != NULL){
-        if(user_region->drop_para->send_icmp_unreachable_enable){
-            send_icmp_unreachable(a_stream, a_packet);
+    if(user_region != NULL){
+        if(user_region->drop_para != NULL){
+            if(user_region->drop_para->send_icmp_unreachable_enable){
+                send_icmp_unreachable(a_stream, a_packet);
+            }
         }
     }
 
diff --git a/src/tsg_icmp.cpp b/src/tsg_icmp.cpp
index 7d977ec..80b9813 100644
--- a/src/tsg_icmp.cpp
+++ b/src/tsg_icmp.cpp
@@ -23,6 +23,11 @@
 #define ETH_IP_TYPE_LEN 2
 #define ETH_LEN ((MAC_LEN_2)+(ETH_IP_TYPE_LEN))
 
+
+#define TCP_MAX_LEN             60
+#define ICMP_IPV4_TCP_MAX_LEN   44 //64-20 = 44       
+#define IPV4_SHAM_FIXED_LEN     12   
+
 #define IPV4_LEN        20
 #define IPV4_IP_LEN     4
 #define IPV4_IP_LEN_INDEX   2   //eth_len(14)+ ip_len_index(2)
@@ -36,9 +41,9 @@
 #define IPV6_PESUDO_HEAD_LEN  40
 
 //icmpv6的srcPacket len需要再确认
-#define ICMP_MAX_LEN   190       //eth_len(14) + ipv6_len(40) + ICMP_MAX_LEN(8+128)
-#define ICMP_SRCPACKET_MAX_LEN    64
-#define ICMPV6_SRCPACKET_MAX_LEN  128
+#define ICMP_MAX_LEN   65535       //eth_len(14) + ipv6_len(40) + ICMP_MAX_LEN(8+128)
+#define ICMP_SRCPACKET_MAX_LEN    548  // 548 == ipv4(max_len 576)-ip_len(20)-icmp_head_len(8)
+#define ICMPV6_SRCPACKET_MAX_LEN  1232 // 1232 == ipv6(max_len 1280)-ipv6_len(40)-icmp_head_len(8)
 
 typedef struct icmpv4{
     char type;
@@ -87,7 +92,7 @@ static void format_icmpv4(const char *raw_pkt, char *buf, int *len){
     short ipv4_checksum = 0;             
     short sip_len = 12;                 //skip sip start index
     short dip_len = 16;                 //skip dip start index
-    
+
     memcpy(&src_ipv4_total_len, &raw_pkt[IPV4_IP_LEN_INDEX], sizeof(short));
     src_ipv4_total_len = htons(src_ipv4_total_len);
 
@@ -106,7 +111,7 @@ static void format_icmpv4(const char *raw_pkt, char *buf, int *len){
     memset(&icmpst, 0, sizeof(icmpv4_st));
     memcpy(icmpst.srcPacket, raw_pkt, icmp_srcpacket_len); //
     icmpst.type = ICMPV4_UNREACHABLE;
-    icmpst.type = ICMPV4_PORT_UNREACHABLE;
+    icmpst.code = ICMPV4_PORT_UNREACHABLE;
     icmpst.checksum = in_checksum((void*)&icmpst, icmp_len);
 
     //format ipv4
@@ -128,8 +133,8 @@ static void format_icmpv4(const char *raw_pkt, char *buf, int *len){
     return;
 }
 
-
 //int format_icmpv6(char *icmp, short icmp_len, char *eth, const char *data){
+#if 0
 static void format_icmpv6(const char *data, char *buf, int *len){
     char checksum_str[ICMPV6_SRCPACKET_MAX_LEN] = {0}; 
     char ipv6[IPV6_LEN] = {0};
@@ -144,7 +149,9 @@ static void format_icmpv6(const char *data, char *buf, int *len){
     short dip_len = 24; //skip dip start index, 16+8 == 24
     short ipv6_ip2 = IPV6_IP_LEN + IPV6_IP_LEN;
     short payload_len = 0;
-    
+    short fill_icmp_len = 0;       
+    int checksum_payload_len = 0;  
+
     memcpy(&src_ipv6_total_len, &data[IPV6_IP_PAYLOAD_INDEX], sizeof(short));  //get ipv6_payload_len 
     src_ipv6_total_len = htons(src_ipv6_total_len) + IPV6_LEN;
 
@@ -172,10 +179,18 @@ static void format_icmpv6(const char *data, char *buf, int *len){
     icmpst.code = ICMPV6_PORT_UNREACHABLE;
     memcpy(icmpst.srcPacket, data, icmp_srcpacket_len);
 
+    //补充为4字节
+    checksum_payload_len = htonl((int)icmp_len);            
+    fill_icmp_len = icmp_len % 4;                           
+    if( fill_icmp_len > 0){                                 
+        icmp_len = icmp_len + (4-fill_icmp_len);            
+        checksum_len = checksum_len + (4-fill_icmp_len);    
+    }                                                       
+
     //calc icmpv6 checksum
     memcpy(checksum_str, &icmpst, icmp_len);  
     memcpy(&checksum_str[icmp_len], &ipv6[8], ipv6_ip2);
-    memcpy(&checksum_str[icmp_len+ipv6_ip2+2], &ipv6[4], sizeof(short));
+    memcpy(&checksum_str[icmp_len+ipv6_ip2], &checksum_payload_len, sizeof(int)); 
     checksum_str[icmp_len+ipv6_ip2+7] = ICMPV6_PROTOCAL_TYPE;
     icmpst.checksum = in_checksum(checksum_str, checksum_len);
 
@@ -186,13 +201,15 @@ static void format_icmpv6(const char *data, char *buf, int *len){
 
     return;
 }
+#endif
 
 static void format_icmp(const char *raw_pkt, char *icmp_buf, int *icmp_len, int ip_type){
     if(IPV4_TYPE == ip_type) {
         format_icmpv4(raw_pkt, icmp_buf, icmp_len);
-    }else{ //IPV6_TYPE
-        format_icmpv6(raw_pkt, icmp_buf, icmp_len);
     }
+    //else{ //IPV6_TYPE
+    //    format_icmpv6(raw_pkt, icmp_buf, icmp_len);
+    //}
     return;
 }
 
@@ -200,13 +217,20 @@ static void format_icmp(const char *raw_pkt, char *icmp_buf, int *icmp_len, int
 unsigned char send_icmp_unreachable(const struct streaminfo *a_stream, const void *raw_pkt)
 {
     char icmp_buf[ICMP_MAX_LEN]; 
+    unsigned char raw_route_dir = 0;
     int  icmp_len = 0;
 
-    if(a_stream->curdir==DIR_S2C || raw_pkt == NULL){
-        return 0;
+    if(a_stream == NULL){
+	    return STATE_DROPPKT;
+    }
+
+    if((a_stream->curdir==DIR_S2C)||(raw_pkt==NULL)||(a_stream->addr.addrtype!=IPV4_TYPE)){
+	    return STATE_DROPPKT;
     }
 
     format_icmp((char *)raw_pkt, icmp_buf, &icmp_len, a_stream->addr.addrtype);
-    return tsg_send_inject_packet(a_stream, SIO_EXCLUDE_THIS_LAYER_HDR, icmp_buf, icmp_len, DIR_S2C); 
+    raw_route_dir = (a_stream->curdir==DIR_C2S) ? MESA_dir_reverse(a_stream->routedir) : a_stream->routedir;
+
+    return tsg_send_inject_packet(a_stream, SIO_EXCLUDE_THIS_LAYER_HDR, icmp_buf, icmp_len, raw_route_dir); 
 }
 
diff --git a/src/tsg_tamper.cpp b/src/tsg_tamper.cpp
index b3d100c..b12c4b8 100644
--- a/src/tsg_tamper.cpp
+++ b/src/tsg_tamper.cpp
@@ -31,6 +31,7 @@
 #define IPV6_UDP_PALYLOAD_START_INDEX 48  //ipv6_len(40) + udp_len(8)
 #define IPV6_IP_PAYLOAD_INDEX  4         //ipv6_payload_index(4)
 
+
 int tamper_calc(char *str, int startlen, int endlen)
 {
     int i = 0;
@@ -39,136 +40,47 @@ int tamper_calc(char *str, int startlen, int endlen)
 
     //最小交换paythod的第2个字节和第四个字节，否则不处理
     if ((endlen - startlen) < 4){
-        return STATE_DROPPKT;
+        return -1;
     }
 
     //start_len+1 : 因为计算校验和是16bit为单位，这里调换16bit的低8bit。
-    for(i = startlen+1; i < endlen; i++){
-        for (j = i+2; j < endlen; j++){
+    for(i=startlen+1; i<endlen; i=i+2){
+        for (j=i+2; j<endlen; j=j+2){
             if(str[i] != str[j]){
                 temp = str[i];
                 str[i] = str[j];
                 str[j] = temp;
-                return STATE_GIVEME;
+                return 0;
             }
         }
     }
-    return STATE_DROPPKT;
-}
-
-int stamp_calc2(char *str, int startlen, int endlen)
-{               
-    int i = 0;
-    char temp;
-
-    if(endlen - startlen < 4){
-        return STATE_DROPPKT;
-    }
-
-    for(i = startlen; (i < endlen) && (i+3 < endlen); i=i+4){
-        printf("ii = %d \n", i);
-        if(str[i+1] != str[i+3]){
-            temp = str[i+1];
-            str[i+1] = str[i+3];
-            str[i+3] = temp;
-            return STATE_GIVEME;
-        }
-    }
-    return STATE_DROPPKT;
-}
-
-int tamper_ipv4(const char *packet, char *ret_packet, int *ret_len){
-    int packet_len = 0;
-    int src_ipv4_total_len = 0;
-    char tcp_head_len;
-    char protocol_type = packet[IPV4_PROTOCOL_INDEX]; 
-    int  payload_start_index = 0; 
-    int  tcp_head_all_len = 0;
-
-    //get packet_len
-    memcpy(&src_ipv4_total_len, &packet[IPV4_IP_LEN_INDEX], sizeof(short));
-    packet_len = htons(src_ipv4_total_len);
-
-    if(protocol_type == TCP_TYPE){
-        tcp_head_len = ret_packet[IPV4_TCP_HEAD_LEN_INDEX];
-        tcp_head_len = ((tcp_head_len>>4)&0x0f)*4;
-        tcp_head_all_len = tcp_head_len + IPV4_LEN;
-        if(packet_len == tcp_head_all_len){
-            return -1;
-        }
-        payload_start_index = IPV4_LEN + tcp_head_len;
-    }else if(protocol_type == UDP_TYPE){
-        if(ETH_IPV4_IP_UPD_LEN == packet_len){
-            return -1;
-        }
-        payload_start_index = ETH_IPV4_IP_UPD_LEN;
-    }
-
-    *ret_len = packet_len-payload_start_index+1;
-    memcpy(ret_packet, &packet[payload_start_index], *ret_len);
-    return tamper_calc(ret_packet, payload_start_index, packet_len);
-}
-
-//int tamper_ipv6(char *packet, int packet_len){
-int tamper_ipv6(const char *packet, char *ret_packet, int *ret_len){
-    int packet_len = 0;
-    short src_ipv6_total_len = 0;
-    char tcp_head_len;
-    char protocol_type = packet[IPV6_PROTOCOL_INDEX]; 
-    int  payload_start_index = 0; 
-    int  packet_all_len = 0;
-
-    memcpy(&src_ipv6_total_len, &packet[IPV6_IP_PAYLOAD_INDEX], sizeof(short));  //get ipv6_payload_len 
-    packet_len = htons(src_ipv6_total_len) + IPV6_LEN;
-    *ret_len =  packet_len;
-
-    if(protocol_type == TCP_TYPE){
-        tcp_head_len = ret_packet[IPV6_TCP_OPTION_LEN_INDEX];
-        tcp_head_len = ((tcp_head_len>>4)&0x0f)*4;
-        packet_all_len =  tcp_head_len + IPV6_LEN;
-        if(packet_len == packet_all_len){
-            return -1;
-        }
-        payload_start_index = IPV6_LEN + tcp_head_len;
-    }else if(protocol_type == UDP_TYPE){
-        if(IPV6_UDP_PALYLOAD_START_INDEX == packet_len){
-            return -1;
-        }
-        payload_start_index = IPV6_UDP_PALYLOAD_START_INDEX;
-    }
-
-    *ret_len = packet_len-payload_start_index+1;
-    memcpy(ret_packet, &packet[payload_start_index], *ret_len);
-    return tamper_calc(ret_packet, payload_start_index, packet_len);
-}
-
-static int format_tamper(const char *packet, char *tamper_buf, int *tamper_len, int ip_type){
-    int ret = 0;
-
-    if(IPV4_TYPE == ip_type) {
-        ret = tamper_ipv4((char *)packet, tamper_buf, tamper_len);
-    }else{
-        ret = tamper_ipv6((char *)packet, tamper_buf, tamper_len);
-    }
-
-    return ret;
+    return -1;
 }
 
 unsigned char send_tamper_xxx(const struct streaminfo *a_stream, const void *raw_pkt)
 {
+    const char *p_trans_payload = (char *)a_stream->ptcpdetail->pdata;
+    int trans_layload_len = a_stream->ptcpdetail->datalen;
     char tamper_buf[MTU_LEN] = {0}; 
     unsigned char raw_route_dir = 0;
-    int  tamper_len = 0;
     int  ret = 0;
+    
+    if(a_stream == NULL){
+        return STATE_DROPPKT;   
+    }
 
-    ret = format_tamper((char *)raw_pkt, tamper_buf, &tamper_len, a_stream->addr.addrtype);
-    if (ret < 0){
+    if((p_trans_payload==NULL)||(trans_layload_len<=0)||(a_stream->curdir== DIR_S2C)){
         return STATE_DROPPKT;   
     }
 
-    raw_route_dir=(a_stream->curdir==DIR_C2S) ? a_stream->routedir : MESA_dir_reverse(a_stream->routedir);
-    tsg_send_inject_packet(a_stream, SIO_DEFAULT, tamper_buf, tamper_len, raw_route_dir); 
+    memcpy(tamper_buf, p_trans_payload, trans_layload_len);
+    ret = tamper_calc(tamper_buf, 0, trans_layload_len);
+    if (ret < 0){
+        return STATE_DROPPKT; 
+    }
 
-    return STATE_DROPPKT|STATE_DROPME;
-}
+    raw_route_dir = (a_stream->curdir==DIR_C2S) ? a_stream->routedir : MESA_dir_reverse(a_stream->routedir);
+    tsg_send_inject_packet(a_stream, SIO_DEFAULT, tamper_buf, trans_layload_len, raw_route_dir); 
 
+    return STATE_DROPPKT;
+}