aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Added support for the csum-<protocol> rules keyword to the detection engine. Keywords added are ipv4-csum, tcpv4-csum, tcpv6-csum, udpv4-csum, udpv6-csum, icmpv4-csum and icmpv6-csum

Browse Source
remotes/origin/master-1.0.x
Anoop Saldanha 16 years ago committed by Victor Julien
parent 39724df664
commit 22c0ec2bc5
17 changed files with 3185 additions and 12 deletions
Show Stats Download Patch File Download Diff File

1
src/Makefile.am
Unescape Escape View File

@ -61,6 +61,7 @@ detect-flow.c detect-flow.h \
detect-dsize.c detect-dsize.h \
detect-decode-event.c detect-decode-event.h \
detect-noalert.c detect-noalert.h \
detect-csum.c detect-csum.h \
util-print.c util-print.h \
util-mpm.c util-mpm.h \
util-binsearch.c util-binsearch.h \

3
src/decode-icmpv4.c
Unescape Escape View File

@ -13,7 +13,7 @@
*
* \retval csum Checksum for the ICMP packet
*/
static inline uint16_t ICMPV4CalculateChecksum(uint16_t *pkt, uint16_t tlen)
inline uint16_t ICMPV4CalculateChecksum(uint16_t *pkt, uint16_t tlen)
{
uint16_t pad = 0;
uint32_t csum = pkt[0];
@ -76,6 +76,7 @@ void DecodeICMPV4(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt
#endif
p->proto = IPPROTO_ICMP;
return;
}

6
src/decode-icmpv4.h
Unescape Escape View File

@ -133,6 +133,12 @@ typedef struct ICMPV4Hdr_
/* XXX incomplete */
} ICMPV4Hdr;
typedef struct ICMPV4Cache_ {
/* checksum computed over the icmpv4 packet */
int32_t comp_csum;
} ICMPV4Cache;
inline uint16_t ICMPV4CalculateChecksum(uint16_t *, uint16_t);
void DecodeICMPV4RegisterTests(void);
#endif /* __DECODE_ICMPV4_H__ */

4
src/decode-icmpv6.c
Unescape Escape View File

@ -15,8 +15,8 @@
*
* \retval csum Checksum for the ICMPV6 packet
*/
static inline uint16_t ICMPV6CalculateChecksum(uint16_t *shdr, uint16_t *pkt,
uint16_t tlen)
inline uint16_t ICMPV6CalculateChecksum(uint16_t *shdr, uint16_t *pkt,
uint16_t tlen)
{
uint16_t pad = 0;
uint32_t csum = shdr[0];

6
src/decode-icmpv6.h
Unescape Escape View File

@ -73,6 +73,12 @@ typedef struct ICMPV6Hdr_
/* XXX incomplete */
} ICMPV6Hdr;
typedef struct ICMPV6Cache_ {
/* checksum computed over the icmpv6 packet */
int32_t comp_csum;
} ICMPV6Cache;
inline uint16_t ICMPV6CalculateChecksum(uint16_t *, uint16_t *, uint16_t);
void DecodeICMPV6RegisterTests(void);
#endif /* __DECODE_ICMPV6_H__ */

2
src/decode-ipv4.c
Unescape Escape View File

@ -19,7 +19,7 @@
*
* \retval csum Checksum for the IP packet
*/
static inline uint16_t IPV4CalculateChecksum(uint16_t *pkt, uint16_t hlen)
inline uint16_t IPV4CalculateChecksum(uint16_t *pkt, uint16_t hlen)
{
uint32_t csum = pkt[0];

2
src/decode-ipv4.h
Unescape Escape View File

@ -165,6 +165,7 @@ typedef struct IPV4Cache_
uint8_t ip_ttl; /* time to live field */
uint8_t ip_proto; /* datagram protocol */
uint16_t ip_csum; /* checksum */
int32_t comp_csum; /* checksum computed over the ipv4 packet */
uint32_t ip_src_u32; /* source IP */
uint32_t ip_dst_u32; /* dest IP */
@ -189,6 +190,7 @@ typedef struct IPV4Vars_
IPV4Opt *o_rtralt;
} IPV4Vars;
inline uint16_t IPV4CalculateChecksum(uint16_t *, uint16_t);
void DecodeIPV4RegisterTests(void);
#endif /* __DECODE_IPV4_H__ */

8
src/decode-tcp.c
Unescape Escape View File

@ -18,8 +18,8 @@
*
* \retval csum Checksum for the TCP packet
*/
static inline uint16_t TCPCalculateChecksum(uint16_t *shdr, uint16_t *pkt,
uint16_t tlen)
inline uint16_t TCPCalculateChecksum(uint16_t *shdr, uint16_t *pkt,
uint16_t tlen)
{
uint16_t pad = 0;
uint32_t csum = shdr[0];
@ -78,8 +78,8 @@ static inline uint16_t TCPCalculateChecksum(uint16_t *shdr, uint16_t *pkt,
*
* \retval csum Checksum for the TCP packet
*/
static inline uint16_t TCPV6CalculateChecksum(uint16_t *shdr, uint16_t *pkt,
uint16_t tlen)
inline uint16_t TCPV6CalculateChecksum(uint16_t *shdr, uint16_t *pkt,
uint16_t tlen)
{
uint16_t pad = 0;
uint32_t csum = shdr[0];

7
src/decode-tcp.h
Unescape Escape View File

@ -105,6 +105,11 @@ typedef struct TCPVars_
TCPOpt *mss;
} TCPVars;
typedef struct TCPCache_ {
/* checksum computed over the tcp(for both ipv4 and ipv6) packet */
int32_t comp_csum;
} TCPCache;
#define CLEAR_TCP_PACKET(p) { \
(p)->tcph = NULL; \
(p)->tcpvars.tcp_opt_cnt = 0; \
@ -114,6 +119,8 @@ typedef struct TCPVars_
(p)->tcpvars.mss = NULL; \
}
inline uint16_t TCPCalculateChecksum(uint16_t *, uint16_t *, uint16_t);
inline uint16_t TCPV6CalculateChecksum(uint16_t *, uint16_t *, uint16_t);
void DecodeTCPRegisterTests(void);
#endif /* __DECODE_TCP_H__ */

9
src/decode-udp.c
Unescape Escape View File

@ -18,8 +18,8 @@
*
* \retval csum Checksum for the UDP packet
*/
static inline uint16_t UDPV4CalculateChecksum(uint16_t *shdr, uint16_t *pkt,
uint16_t tlen)
inline uint16_t UDPV4CalculateChecksum(uint16_t *shdr, uint16_t *pkt,
uint16_t tlen)
{
uint16_t pad = 0;
uint32_t csum = shdr[0];
@ -77,8 +77,8 @@ static inline uint16_t UDPV4CalculateChecksum(uint16_t *shdr, uint16_t *pkt,
*
* \retval csum Checksum for the UDP packet
*/
static inline uint16_t UDPV6CalculateChecksum(uint16_t *shdr, uint16_t *pkt,
uint16_t tlen)
inline uint16_t UDPV6CalculateChecksum(uint16_t *shdr, uint16_t *pkt,
uint16_t tlen)
{
uint16_t pad = 0;
uint32_t csum = shdr[0];
@ -150,6 +150,7 @@ static int DecodeUDPPacket(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len)
SET_UDP_SRC_PORT(p,&p->sp);
SET_UDP_DST_PORT(p,&p->dp);
p->udpvars.hlen = UDP_HEADER_LEN;
p->payload = pkt + UDP_HEADER_LEN;
p->payload_len = len - UDP_HEADER_LEN;

7
src/decode-udp.h
Unescape Escape View File

@ -28,6 +28,13 @@ typedef struct UDPVars_
uint8_t hlen;
} UDPVars;
typedef struct UDPCache_ {
/* checksum computed over the udp(for both ipv4 and ipv6) packet */
int32_t comp_csum;
} UDPCache;
inline uint16_t UDPV4CalculateChecksum(uint16_t *, uint16_t *, uint16_t);
inline uint16_t UDPV6CalculateChecksum(uint16_t *, uint16_t *, uint16_t);
void DecodeUDPV4RegisterTests(void);
#endif /* __DECODE_UDP_H__ */

13
src/decode.h
Unescape Escape View File

@ -254,13 +254,17 @@ typedef struct Packet_
IPV6ExtHdrs ip6eh;
ICMPV4Hdr *icmpv4h;
ICMPV4Cache icmpv4c;
ICMPV6Hdr *icmpv6h;
ICMPV6Cache icmpv6c;
TCPHdr *tcph;
TCPVars tcpvars;
TCPCache tcpc;
UDPHdr *udph;
UDPVars udpvars;
UDPCache udpc;
/* ptr to the payload of the packet
* with it's length. */
@ -356,6 +360,15 @@ typedef struct DecodeThreadVars_
(p)->recursion_level = 0; \
}
/* reset these to -1(indicates that the packet is fresh from the queue) */
#define RESET_PACKET_CSUMS(p) { \
(p)->ip4c.comp_csum = -1; \
(p)->tcpc.comp_csum = -1; \
(p)->udpc.comp_csum = -1; \
(p)->icmpv4c.comp_csum = -1; \
(p)->icmpv6c.comp_csum = -1; \
}
/* macro's for setting the action
* handle the case of a root packet

1517
src/detect-csum.c
View File

File diff suppressed because it is too large Load Diff

16
src/detect-csum.h
Unescape Escape View File

@ -0,0 +1,16 @@
#ifndef __DETECT_CSUM_H__
#define __DETECT_CSUM_H__
#define DETECT_CSUM_VALID "valid"
#define DETECT_CSUM_INVALID "invalid"
typedef struct DetectCsumData_ {
/* Indicates if the csum-<protocol> keyword in a rule holds the
keyvalue "valid" or "invalid" */
int16_t valid;
} DetectCsumData;
void DetectCsumRegister(void);
#endif /* __DETECT_CSUM_H__ */

1586
src/detect.c
View File

File diff suppressed because it is too large Load Diff

7
src/detect.h
Unescape Escape View File

@ -399,6 +399,13 @@ enum {
DETECT_PKTVAR,
DETECT_NOALERT,
DETECT_FLOWBITS,
DETECT_IPV4_CSUM,
DETECT_TCPV4_CSUM,
DETECT_TCPV6_CSUM,
DETECT_UDPV4_CSUM,
DETECT_UDPV6_CSUM,
DETECT_ICMPV4_CSUM,
DETECT_ICMPV6_CSUM,
DETECT_ADDRESS,
DETECT_PROTO,

3
src/eidps.c
Unescape Escape View File

@ -156,6 +156,9 @@ Packet *SetupPkt (void)
printf("SetupPkt: allocated a new packet...\n");
}
/* reset the packet csum fields */
RESET_PACKET_CSUMS(p);
return p;
}

Write Preview
Loading…
Cancel
Save