Implementing relaxed matching for layer 2 and layer 3.
[pingpong.git] / Code / Projects / PacketLevelSignatureExtractor / src / main / java / edu / uci / iotproject / util / PcapPacketUtils.java
index ba0607016023603eac155e6cd9737043b8e1dfc1..68e7defe8d0924e984191a090d0d0a942ca43ea0 100644 (file)
@@ -13,6 +13,7 @@ import org.pcap4j.packet.TcpPacket;
 import org.pcap4j.util.MacAddress;
 
 import java.io.PrintWriter;
+import java.math.BigInteger;
 import java.util.*;
 
 /**
@@ -234,7 +235,11 @@ public final class PcapPacketUtils {
         List<List<List<PcapPacket>>> copySignatures = new ArrayList<>();
         listDeepCopy(copySignatures, signatures);
         // Traverse and look into the pairs.
-        for (int first = 0; first < signatures.size(); first++) {
+        //for (int first = 0; first < signatures.size(); first++) {
+        int first = 0;
+        int signaturesSize = signatures.size();
+        while(first < signaturesSize) {
+//            System.out.println("First: " + first + " Signatures: " + signatures.get(0).size());
             List<List<PcapPacket>> firstList = signatures.get(first);
             for (int second = first+1; second < signatures.size(); second++) {
                 int maxSignatureEl = 0;
@@ -255,7 +260,9 @@ public final class PcapPacketUtils {
                         if (position == TcpConversationUtils.SignaturePosition.LEFT_ADJACENT) {
                             // Merge to the left side of the first sequence.
                             ppList.addAll(signature);
-                            signature = ppList;
+                            // Remove and then add again to keep the same reference
+                            signature.removeAll(signature);
+                            signature.addAll(ppList);
                             maxSignatureEl = signature.size() > maxSignatureEl ? signature.size() : maxSignatureEl;
                             secondList.remove(ppList); // Remove as we merge.
                             break;
@@ -268,6 +275,7 @@ public final class PcapPacketUtils {
                         } // TcpConversationUtils.SignaturePosition.NOT_ADJACENT.
                     }
                 }
+//                System.out.println("First list size: " + firstList.get(35).size());
                 // Call it a successful merging if there are only less than 5 elements from the second list that
                 // cannot be merged.
                 if (secondList.size() < SIGNATURE_MERGE_THRESHOLD) {
@@ -285,17 +293,40 @@ public final class PcapPacketUtils {
                     return copySignatures;
                 }
             }
+            if (signatures.size() < signaturesSize) {
+                // If there is a concatenation, we check again from index 0
+                signaturesSize = signatures.size();
+                first = 0;
+            } else {
+                signaturesSize = signatures.size();
+                first++;
+            }
+
         }
         return signatures;
     }
 
     /**
-     * Deep copy to create an entirely new {@link List} of {@link List} of {@link List} of {@link PcapPacket} objects.
-     * @param destList A {@link List} of {@link List} of {@link List} of
-     *          {@link PcapPacket} objects that will be the final container of the deep copy
-     * @param sourceList A {@link List} of {@link List} of {@link List} of
-     *          {@link PcapPacket} objects that will be the source of the deep copy.
+     * Clean up null values in in {@code List} of {@code List} of {@code List} of {@code PcapPacket} objects.
+     * @param signature A {@link List} of {@link List} of {@link List} of
+     *          {@link PcapPacket} objects that needs to be cleaned up from null values.
      */
+    public static void cleanSignature(List<List<List<PcapPacket>>> signature) {
+
+        for(List<List<PcapPacket>> listOfListPcap : signature) {
+            for(List<PcapPacket> listOfPcap : listOfListPcap) {
+                listOfPcap.removeIf(el -> el == null);
+            }
+        }
+    }
+
+        /**
+         * Deep copy to create an entirely new {@link List} of {@link List} of {@link List} of {@link PcapPacket} objects.
+         * @param destList A {@link List} of {@link List} of {@link List} of
+         *          {@link PcapPacket} objects that will be the final container of the deep copy
+         * @param sourceList A {@link List} of {@link List} of {@link List} of
+         *          {@link PcapPacket} objects that will be the source of the deep copy.
+         */
     private static void listDeepCopy(List<List<List<PcapPacket>>> destList, List<List<List<PcapPacket>>> sourceList) {
 
         for(List<List<PcapPacket>> llPcapPacket : sourceList) {
@@ -387,13 +418,19 @@ public final class PcapPacketUtils {
                 // E.g., 111, 222, 333 in one occassion and 222, 333, 111 in the other.
                 throw new Error("OVERLAP WARNING: " + "" +
                         "Two sequences have some overlap. Please remove one of the sequences: " +
-                        sequence1.get(0).length() + " with index " + indexSequence1 + " OR " +
-                        sequence2.get(0).length() + " with index " + indexSequence2);
+                        sequence1.get(0).length() + "... OR " +
+                        sequence2.get(0).length() + "...");
             }
         }
         // Check if p1 is longer than p2 and p2 occurs during the occurrence of p1
         int lastIndexOfSequence1 = sequence1.size() - 1;
+        // Check if the last index is null
+        while (sequence1.get(lastIndexOfSequence1) == null)
+            lastIndexOfSequence1--;
         int lastIndexOfSequence2 = sequence2.size() - 1;
+        // Check if the last index is null
+        while (sequence2.get(lastIndexOfSequence2) == null)
+            lastIndexOfSequence2--;
         int compareLast =
                 sequence1.get(lastIndexOfSequence1).getTimestamp().compareTo(sequence2.get(lastIndexOfSequence2).getTimestamp());
         // Check the signs of compare and compareLast
@@ -456,7 +493,13 @@ public final class PcapPacketUtils {
                 int packetCounter = 0;
                 for(PcapPacket pcapPacket : listPcapPacket) {
                     if(pcapPacket != null) {
-                        PrintWriterUtils.print(pcapPacket.length(), resultsWriter, printToOutput);
+                        String srcIp = pcapPacket.get(IpV4Packet.class).getHeader().getSrcAddr().getHostAddress();
+                        String dstIp = pcapPacket.get(IpV4Packet.class).getHeader().getDstAddr().getHostAddress();
+                        String direction = srcIp.startsWith("10.") || srcIp.startsWith("192.168.") ?
+                                "(C-" : "(S-";
+                        direction = dstIp.startsWith("10.") || dstIp.startsWith("192.168.") ?
+                                direction + "C)" : direction + "S)";
+                        PrintWriterUtils.print(pcapPacket.length() + direction, resultsWriter, printToOutput);
                     }
                     if(packetCounter < listPcapPacket.size() - 1) {
                         // Provide space if not last packet
@@ -628,6 +671,12 @@ public final class PcapPacketUtils {
                                                        PcapPacket lowerBound, PcapPacket upperBound) {
 
         List<PcapPacket> listBounds = new ArrayList<>();
+        // Just return the lower and upper bounds when their values are the same --- faster
+        if (lowerBound.length() == upperBound.length()) {
+            listBounds.add(0, lowerBound);
+            listBounds.add(1, upperBound);
+            return listBounds;
+        }
         // Iterate over PcapPacket one by one
         for(List<List<PcapPacket>> listOfListPcapPacket : corePointRange) {
             List<PcapPacket> listCorePointLowerBound = listOfListPcapPacket.get(0);
@@ -799,4 +848,17 @@ public final class PcapPacketUtils {
         // Sequence index starts from 0
         signatures.remove(sequenceIndex);
     }
+
+    /**
+     * Convert a String MAC address into a byte array.
+     *
+     * @param macAddress A String that contains a MAC address to be converted into byte array.
+     */
+    public static byte[] stringToByteMacAddress(String macAddress) {
+
+        BigInteger biMacAddress = new BigInteger(macAddress, 16);
+        byte[] byteMacAddress = biMacAddress.toByteArray();
+        // Return from 1 to 6 since element 0 is 0 because of using BigInteger's method.
+        return Arrays.copyOfRange(byteMacAddress, 1, 7);
+    }
 }