|
|
|
|
@ -21,7 +21,6 @@
|
|
|
|
|
* @{
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* \file
|
|
|
|
|
*
|
|
|
|
|
@ -47,8 +46,8 @@
|
|
|
|
|
/**
|
|
|
|
|
* \brief Main decoding function for PPPOE Discovery packets
|
|
|
|
|
*/
|
|
|
|
|
int DecodePPPOEDiscovery(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
|
|
|
|
|
const uint8_t *pkt, uint32_t len)
|
|
|
|
|
int DecodePPPOEDiscovery(
|
|
|
|
|
ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
|
|
|
|
|
{
|
|
|
|
|
DEBUG_VALIDATE_BUG_ON(pkt == NULL);
|
|
|
|
|
|
|
|
|
|
@ -80,10 +79,9 @@ int DecodePPPOEDiscovery(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
uint32_t pppoe_length = SCNtohs(pppoedh->pppoe_length);
|
|
|
|
|
uint32_t packet_length = len - PPPOE_DISCOVERY_HEADER_MIN_LEN ;
|
|
|
|
|
uint32_t packet_length = len - PPPOE_DISCOVERY_HEADER_MIN_LEN;
|
|
|
|
|
|
|
|
|
|
SCLogDebug("pppoe_length %"PRIu32", packet_length %"PRIu32"",
|
|
|
|
|
pppoe_length, packet_length);
|
|
|
|
|
SCLogDebug("pppoe_length %" PRIu32 ", packet_length %" PRIu32 "", pppoe_length, packet_length);
|
|
|
|
|
|
|
|
|
|
if (pppoe_length > packet_length) {
|
|
|
|
|
SCLogDebug("malformed PPPOE tags");
|
|
|
|
|
@ -104,7 +102,7 @@ int DecodePPPOEDiscovery(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
|
|
|
|
|
// upgrade to u32 to avoid u16 overflow
|
|
|
|
|
tag_length = SCNtohs(pppoedt->pppoe_tag_length);
|
|
|
|
|
|
|
|
|
|
SCLogDebug ("PPPoE Tag type %x, length %"PRIu32, tag_type, tag_length);
|
|
|
|
|
SCLogDebug("PPPoE Tag type %x, length %" PRIu32, tag_type, tag_length);
|
|
|
|
|
|
|
|
|
|
if (pppoe_length >= (4 + tag_length)) {
|
|
|
|
|
pppoe_length -= (4 + tag_length);
|
|
|
|
|
@ -121,8 +119,8 @@ int DecodePPPOEDiscovery(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
|
|
|
|
|
/**
|
|
|
|
|
* \brief Main decoding function for PPPOE Session packets
|
|
|
|
|
*/
|
|
|
|
|
int DecodePPPOESession(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
|
|
|
|
|
const uint8_t *pkt, uint32_t len)
|
|
|
|
|
int DecodePPPOESession(
|
|
|
|
|
ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
|
|
|
|
|
{
|
|
|
|
|
DEBUG_VALIDATE_BUG_ON(pkt == NULL);
|
|
|
|
|
|
|
|
|
|
@ -140,7 +138,8 @@ int DecodePPPOESession(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
|
|
|
|
|
PPPOE_SESSION_GET_VERSION(pppoesh), PPPOE_SESSION_GET_TYPE(pppoesh),
|
|
|
|
|
pppoesh->pppoe_code, SCNtohs(pppoesh->session_id), SCNtohs(pppoesh->pppoe_length));
|
|
|
|
|
|
|
|
|
|
/* can't use DecodePPP() here because we only get a single 2-byte word to indicate protocol instead of the full PPP header */
|
|
|
|
|
/* can't use DecodePPP() here because we only get a single 2-byte word to indicate protocol
|
|
|
|
|
* instead of the full PPP header */
|
|
|
|
|
if (SCNtohs(pppoesh->pppoe_length) > 0) {
|
|
|
|
|
/* decode contained PPP packet */
|
|
|
|
|
|
|
|
|
|
@ -194,7 +193,7 @@ int DecodePPPOESession(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
|
|
|
|
|
case PPP_PAP:
|
|
|
|
|
case PPP_LQM:
|
|
|
|
|
case PPP_CHAP:
|
|
|
|
|
ENGINE_SET_EVENT(p,PPP_UNSUP_PROTO);
|
|
|
|
|
ENGINE_SET_EVENT(p, PPP_UNSUP_PROTO);
|
|
|
|
|
break;
|
|
|
|
|
|
|
|
|
|
case PPP_VJ_UCOMP:
|
|
|
|
|
@ -250,7 +249,7 @@ int DecodePPPOESession(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
|
|
|
|
|
* \brief Decode malformed PPPOE packet (too short)
|
|
|
|
|
* \retval 1 Expected test value
|
|
|
|
|
*/
|
|
|
|
|
static int DecodePPPOEtest01 (void)
|
|
|
|
|
static int DecodePPPOEtest01(void)
|
|
|
|
|
{
|
|
|
|
|
|
|
|
|
|
uint8_t raw_pppoe[] = { 0x11, 0x00, 0x00, 0x00, 0x00 };
|
|
|
|
|
@ -274,19 +273,14 @@ static int DecodePPPOEtest01 (void)
|
|
|
|
|
* \brief Valid PPPOE packet - check the invalid ICMP type encapsulated is flagged
|
|
|
|
|
* \retval 0 Expected test value
|
|
|
|
|
*/
|
|
|
|
|
static int DecodePPPOEtest02 (void)
|
|
|
|
|
static int DecodePPPOEtest02(void)
|
|
|
|
|
{
|
|
|
|
|
|
|
|
|
|
uint8_t raw_pppoe[] = {
|
|
|
|
|
0x11, 0x00, 0x00, 0x01, 0x00, 0x40, 0x00, 0x21,
|
|
|
|
|
0x45, 0x00, 0x00, 0x3c, 0x05, 0x5c, 0x00, 0x00,
|
|
|
|
|
0x20, 0x01, 0xff, 0x30, 0xc0, 0xa8, 0x0a, 0x7f,
|
|
|
|
|
0xc0, 0xa8, 0x0a, 0x65, 0xab, 0xcd, 0x16, 0x5e,
|
|
|
|
|
0x02, 0x00, 0x37, 0x00, 0x41, 0x42, 0x43, 0x44,
|
|
|
|
|
0x45, 0x46, 0x47, 0x48, 0x49, 0x4a, 0x4b, 0x4c,
|
|
|
|
|
0x4d, 0x4e, 0x4f, 0x50, 0x51, 0x52, 0x53, 0x54,
|
|
|
|
|
0x55, 0x56, 0x57, 0x41, 0x42, 0x43, 0x44, 0x45,
|
|
|
|
|
0x46, 0x47, 0x48, 0x49 };
|
|
|
|
|
uint8_t raw_pppoe[] = { 0x11, 0x00, 0x00, 0x01, 0x00, 0x40, 0x00, 0x21, 0x45, 0x00, 0x00, 0x3c,
|
|
|
|
|
0x05, 0x5c, 0x00, 0x00, 0x20, 0x01, 0xff, 0x30, 0xc0, 0xa8, 0x0a, 0x7f, 0xc0, 0xa8, 0x0a,
|
|
|
|
|
0x65, 0xab, 0xcd, 0x16, 0x5e, 0x02, 0x00, 0x37, 0x00, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46,
|
|
|
|
|
0x47, 0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f, 0x50, 0x51, 0x52, 0x53, 0x54, 0x55,
|
|
|
|
|
0x56, 0x57, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48, 0x49 };
|
|
|
|
|
|
|
|
|
|
Packet *p = PacketGetFromAlloc();
|
|
|
|
|
FAIL_IF_NULL(p);
|
|
|
|
|
@ -310,21 +304,16 @@ static int DecodePPPOEtest02 (void)
|
|
|
|
|
PASS;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/** DecodePPPOEtest03
|
|
|
|
|
* \brief Valid example PADO packet PPPOE packet taken from RFC2516
|
|
|
|
|
* \retval 0 Expected test value
|
|
|
|
|
*/
|
|
|
|
|
static int DecodePPPOEtest03 (void)
|
|
|
|
|
static int DecodePPPOEtest03(void)
|
|
|
|
|
{
|
|
|
|
|
/* example PADO packet taken from RFC2516 */
|
|
|
|
|
uint8_t raw_pppoe[] = {
|
|
|
|
|
0x11, 0x07, 0x00, 0x00, 0x00, 0x20, 0x01, 0x01,
|
|
|
|
|
0x00, 0x00, 0x01, 0x02, 0x00, 0x18, 0x47, 0x6f,
|
|
|
|
|
0x20, 0x52, 0x65, 0x64, 0x42, 0x61, 0x63, 0x6b,
|
|
|
|
|
0x20, 0x2d, 0x20, 0x65, 0x73, 0x68, 0x73, 0x68,
|
|
|
|
|
0x65, 0x73, 0x68, 0x6f, 0x6f, 0x74
|
|
|
|
|
};
|
|
|
|
|
uint8_t raw_pppoe[] = { 0x11, 0x07, 0x00, 0x00, 0x00, 0x20, 0x01, 0x01, 0x00, 0x00, 0x01, 0x02,
|
|
|
|
|
0x00, 0x18, 0x47, 0x6f, 0x20, 0x52, 0x65, 0x64, 0x42, 0x61, 0x63, 0x6b, 0x20, 0x2d, 0x20,
|
|
|
|
|
0x65, 0x73, 0x68, 0x73, 0x68, 0x65, 0x73, 0x68, 0x6f, 0x6f, 0x74 };
|
|
|
|
|
|
|
|
|
|
Packet *p = PacketGetFromAlloc();
|
|
|
|
|
FAIL_IF_NULL(p);
|
|
|
|
|
@ -345,14 +334,11 @@ static int DecodePPPOEtest03 (void)
|
|
|
|
|
* \brief Valid example PPPOE packet taken from RFC2516 - but with wrong PPPOE code
|
|
|
|
|
* \retval 1 Expected test value
|
|
|
|
|
*/
|
|
|
|
|
static int DecodePPPOEtest04 (void)
|
|
|
|
|
static int DecodePPPOEtest04(void)
|
|
|
|
|
{
|
|
|
|
|
|
|
|
|
|
/* example PADI packet taken from RFC2516, but with wrong code */
|
|
|
|
|
uint8_t raw_pppoe[] = {
|
|
|
|
|
0x11, 0xbb, 0x00, 0x00, 0x00, 0x04, 0x01, 0x01,
|
|
|
|
|
0x00, 0x00
|
|
|
|
|
};
|
|
|
|
|
uint8_t raw_pppoe[] = { 0x11, 0xbb, 0x00, 0x00, 0x00, 0x04, 0x01, 0x01, 0x00, 0x00 };
|
|
|
|
|
|
|
|
|
|
Packet *p = PacketGetFromAlloc();
|
|
|
|
|
FAIL_IF_NULL(p);
|
|
|
|
|
@ -374,16 +360,13 @@ static int DecodePPPOEtest04 (void)
|
|
|
|
|
* \brief Valid example PADO PPPOE packet taken from RFC2516, but too short for given length
|
|
|
|
|
* \retval 0 Expected test value
|
|
|
|
|
*/
|
|
|
|
|
static int DecodePPPOEtest05 (void)
|
|
|
|
|
static int DecodePPPOEtest05(void)
|
|
|
|
|
{
|
|
|
|
|
|
|
|
|
|
/* example PADI packet taken from RFC2516 */
|
|
|
|
|
uint8_t raw_pppoe[] = {
|
|
|
|
|
0x11, 0x07, 0x00, 0x00, 0x00, 0x20, 0x01, 0x01,
|
|
|
|
|
0x00, 0x00, 0x01, 0x02, 0x00, 0x18, 0x47, 0x6f,
|
|
|
|
|
0x20, 0x52, 0x65, 0x64, 0x42, 0x61, 0x63, 0x6b,
|
|
|
|
|
0x20, 0x2d, 0x20, 0x65, 0x73, 0x68, 0x73, 0x68
|
|
|
|
|
};
|
|
|
|
|
uint8_t raw_pppoe[] = { 0x11, 0x07, 0x00, 0x00, 0x00, 0x20, 0x01, 0x01, 0x00, 0x00, 0x01, 0x02,
|
|
|
|
|
0x00, 0x18, 0x47, 0x6f, 0x20, 0x52, 0x65, 0x64, 0x42, 0x61, 0x63, 0x6b, 0x20, 0x2d, 0x20,
|
|
|
|
|
0x65, 0x73, 0x68, 0x73, 0x68 };
|
|
|
|
|
|
|
|
|
|
Packet *p = PacketGetFromAlloc();
|
|
|
|
|
FAIL_IF_NULL(p);
|
|
|
|
|
@ -407,7 +390,7 @@ static int DecodePPPOEtest05 (void)
|
|
|
|
|
* should extract the first 4 bits for version and the second 4 bits for type
|
|
|
|
|
* \retval 1 Expected test value
|
|
|
|
|
*/
|
|
|
|
|
static int DecodePPPOEtest06 (void)
|
|
|
|
|
static int DecodePPPOEtest06(void)
|
|
|
|
|
{
|
|
|
|
|
|
|
|
|
|
PPPOESessionHdr pppoesh;
|
|
|
|
|
|