aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Simplify packet decoding macro's

Browse Source
remotes/origin/master-1.0.x
Gerardo Iglesias Galvan 15 years ago committed by Victor Julien
parent 9f2f2b10c1
commit cfe4f9edce
16 changed files with 135 additions and 298 deletions
Show Stats Download Patch File Download Diff File

12
src/decode-icmpv4.h
Unescape Escape View File

@ -176,11 +176,9 @@ typedef struct ICMPV4ExtHdr_
/* ICMPv4 vars */
typedef struct ICMPV4Vars_
{
uint8_t type;
uint8_t code;
/* checksum computed over the icmpv4 packet */
int32_t comp_csum;
/* checksum of the icmpv4 packet */
uint16_t csum;
uint16_t id;
uint16_t seq;
uint32_t mtu;
@ -204,9 +202,7 @@ typedef struct ICMPV4Vars_
} ICMPV4Vars;
#define CLEAR_ICMPV4_PACKET(p) do { \
(p)->icmpv4vars.type = 0; \
(p)->icmpv4vars.code = 0; \
(p)->icmpv4vars.csum = -1; \
(p)->icmpv4vars.comp_csum = -1; \
(p)->icmpv4vars.id = 0; \
(p)->icmpv4vars.seq = 0; \
(p)->icmpv4vars.mtu = 0; \
@ -287,8 +283,6 @@ typedef struct ICMPV4Vars_
ICMPV4_GET_TYPE((p)) == ICMP_PARAMETERPROB)
typedef struct ICMPV4Cache_ {
/* checksum computed over the icmpv4 packet */
int32_t comp_csum;
} ICMPV4Cache;
void DecodeICMPV4RegisterTests(void);

12
src/decode-icmpv6.c
Unescape Escape View File

@ -179,8 +179,6 @@ void DecodeICMPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
if (ICMPV6_GET_CODE(p) > ICMP6_DST_UNREACH_REJECTROUTE) {
DECODER_SET_EVENT(p, ICMPV6_UNKNOWN_CODE);
} else {
p->icmpv6vars.type = ICMPV6_GET_TYPE(p);
p->icmpv6vars.code = ICMPV6_GET_CODE(p);
DecodePartialIPV6(p, (uint8_t*) (pkt + ICMPV6_HEADER_LEN),
len - ICMPV6_HEADER_LEN );
}
@ -192,8 +190,6 @@ void DecodeICMPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
if (ICMPV6_GET_CODE(p) != 0) {
DECODER_SET_EVENT(p, ICMPV6_UNKNOWN_CODE);
} else {
p->icmpv6vars.type = ICMPV6_GET_TYPE(p);
p->icmpv6vars.code = ICMPV6_GET_CODE(p);
p->icmpv6vars.mtu = ICMPV6_GET_MTU(p);
DecodePartialIPV6(p, (uint8_t*) (pkt + ICMPV6_HEADER_LEN),
len - ICMPV6_HEADER_LEN );
@ -206,8 +202,6 @@ void DecodeICMPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
if (ICMPV6_GET_CODE(p) > ICMP6_TIME_EXCEED_REASSEMBLY) {
DECODER_SET_EVENT(p, ICMPV6_UNKNOWN_CODE);
} else {
p->icmpv6vars.type = ICMPV6_GET_TYPE(p);
p->icmpv6vars.code= ICMPV6_GET_CODE(p);
DecodePartialIPV6(p, (uint8_t*) (pkt + ICMPV6_HEADER_LEN),
len - ICMPV6_HEADER_LEN );
}
@ -219,8 +213,6 @@ void DecodeICMPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
if (ICMPV6_GET_CODE(p) > ICMP6_PARAMPROB_OPTION) {
DECODER_SET_EVENT(p, ICMPV6_UNKNOWN_CODE);
} else {
p->icmpv6vars.type = ICMPV6_GET_TYPE(p);
p->icmpv6vars.code= ICMPV6_GET_CODE(p);
p->icmpv6vars.error_ptr= ICMPV6_GET_ERROR_PTR(p);
DecodePartialIPV6(p, (uint8_t*) (pkt + ICMPV6_HEADER_LEN),
len - ICMPV6_HEADER_LEN );
@ -234,8 +226,6 @@ void DecodeICMPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
if (ICMPV6_GET_CODE(p) != 0) {
DECODER_SET_EVENT(p, ICMPV6_UNKNOWN_CODE);
} else {
p->icmpv6vars.type = ICMPV6_GET_TYPE(p);
p->icmpv6vars.code= ICMPV6_GET_CODE(p);
p->icmpv6vars.id = p->icmpv6h->icmpv6b.icmpv6i.id;
p->icmpv6vars.seq = p->icmpv6h->icmpv6b.icmpv6i.seq;
}
@ -248,8 +238,6 @@ void DecodeICMPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
if (p->icmpv6h->code != 0) {
DECODER_SET_EVENT(p, ICMPV6_UNKNOWN_CODE);
} else {
p->icmpv6vars.type = ICMPV6_GET_TYPE(p);
p->icmpv6vars.code= ICMPV6_GET_CODE(p);
p->icmpv6vars.id = p->icmpv6h->icmpv6b.icmpv6i.id;
p->icmpv6vars.seq = p->icmpv6h->icmpv6b.icmpv6i.seq;
}

20
src/decode-icmpv6.h
Unescape Escape View File

@ -109,17 +109,13 @@ typedef struct ICMPV6Info_
uint16_t seq;
} ICMPV6Info;
typedef struct ICMPV6Cache_ {
/* checksum computed over the icmpv6 packet */
int32_t comp_csum;
} ICMPV6Cache;
/** ICMPv6 header structure */
typedef struct ICMPV6Hdr_
{
uint8_t type;
uint8_t code;
uint16_t csum;
union{
ICMPV6Info icmpv6i; /** Informational message */
union
@ -127,17 +123,16 @@ typedef struct ICMPV6Hdr_
uint32_t unused; /** for types 1 and 3, should be zero */
uint32_t error_ptr; /** for type 4, pointer to the octet that originate the error */
uint32_t mtu; /** for type 2, the Maximum Transmission Unit of the next-hop link */
}icmpv6e; /** Error Message */
}icmpv6b;
} icmpv6e; /** Error Message */
} icmpv6b;
} ICMPV6Hdr;
/** Data available from the decoded packet */
typedef struct ICMPV6Vars_ {
uint8_t type;
uint8_t code;
/* checksum computed over the icmpv6 packet */
int32_t comp_csum;
/* checksum of the icmpv6 packet */
uint16_t csum;
uint16_t id;
uint16_t seq;
uint32_t mtu;
@ -161,9 +156,7 @@ typedef struct ICMPV6Vars_ {
} ICMPV6Vars;
#define CLEAR_ICMPV6_PACKET(p) do { \
(p)->icmpv6vars.type = 0; \
(p)->icmpv6vars.code = 0; \
(p)->icmpv6vars.csum = -1; \
(p)->icmpv6vars.comp_csum = -1; \
(p)->icmpv6vars.id = 0; \
(p)->icmpv6vars.seq = 0; \
(p)->icmpv6vars.mtu = 0; \
@ -181,6 +174,7 @@ typedef struct ICMPV6Vars_ {
(p)->icmpv6vars.emb_dport = 0; \
(p)->icmpv6h = NULL; \
} while(0)
void DecodeICMPV6RegisterTests(void);
/** -------- Inline functions --------- */

3
src/decode-ipv4.c
Unescape Escape View File

@ -507,9 +507,6 @@ void DecodeIPV4(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt,
SCPerfCounterIncr(dtv->counter_ipv4, tv->sc_perf_pca);
/* reset the decoder cache flags */
IPV4_CACHE_INIT(p);
SCLogDebug("pkt %p len %"PRIu16"", pkt, len);
/* do the actual decoding */

103
src/decode-ipv4.h
Unescape Escape View File

@ -104,97 +104,45 @@ typedef struct IPV4Hdr_
#define IPV4_SET_RAW_IPLEN(ip4h, value) ((ip4h)->ip_len = value)
#define IPV4_SET_RAW_IPPROTO(ip4h, value) ((ip4h)->ip_proto = value)
/* this is enough since noone will access the cache without first
* checking the flags */
#define IPV4_CACHE_INIT(p) (p)->ip4c.flags = 0
/* ONLY call these functions after making sure that:
* 1. p->ip4h is set
* 2. p->ip4h is valid (len is correct)
* 3. cache is initialized
*/
#define IPV4_GET_VER(p) \
((p)->ip4c.flags & IPV4_CACHE_VER ? \
(p)->ip4c.ver : ((p)->ip4c.flags |= IPV4_CACHE_VER, (p)->ip4c.ver = IPV4_GET_RAW_VER((p)->ip4h)))
IPV4_GET_RAW_VER((p)->ip4h)
#define IPV4_GET_HLEN(p) \
((p)->ip4c.flags & IPV4_CACHE_HLEN ? \
(p)->ip4c.hl : ((p)->ip4c.flags |= IPV4_CACHE_HLEN, (p)->ip4c.hl = IPV4_GET_RAW_HLEN((p)->ip4h) << 2))
(IPV4_GET_RAW_HLEN((p)->ip4h) << 2)
#define IPV4_GET_IPTOS(p) \
IPV4_GET_RAW_IPTOS(p)
IPV4_GET_RAW_IPTOS((p)->ip4h)
#define IPV4_GET_IPLEN(p) \
((p)->ip4c.flags & IPV4_CACHE_IPLEN ? \
(p)->ip4c.ip_len : ((p)->ip4c.flags |= IPV4_CACHE_IPLEN, (p)->ip4c.ip_len = ntohs(IPV4_GET_RAW_IPLEN((p)->ip4h))))
(ntohs(IPV4_GET_RAW_IPLEN((p)->ip4h)))
#define IPV4_GET_IPID(p) \
((p)->ip4c.flags & IPV4_CACHE_IPID ? \
(p)->ip4c.ip_id : ((p)->ip4c.flags |= IPV4_CACHE_IPID, (p)->ip4c.ip_id = ntohs(IPV4_GET_RAW_IPID((p)->ip4h))))
(ntohs(IPV4_GET_RAW_IPID((p)->ip4h)))
/* _IPV4_GET_IPOFFSET: get the content of the offset header field in host order */
#define _IPV4_GET_IPOFFSET(p) \
((p)->ip4c.flags & IPV4_CACHE__IPOFF ? \
(p)->ip4c._ip_off : ((p)->ip4c.flags |= IPV4_CACHE__IPOFF, (p)->ip4c._ip_off = ntohs(IPV4_GET_RAW_IPOFFSET((p)->ip4h))))
(ntohs(IPV4_GET_RAW_IPOFFSET((p)->ip4h)))
/* IPV4_GET_IPOFFSET: get the final offset */
#define IPV4_GET_IPOFFSET(p) \
((p)->ip4c.flags & IPV4_CACHE_IPOFF ? \
(p)->ip4c.ip_off : ((p)->ip4c.flags |= IPV4_CACHE_IPOFF, (p)->ip4c.ip_off = _IPV4_GET_IPOFFSET(p) & 0x1fff))
(_IPV4_GET_IPOFFSET(p) & 0x1fff)
/* IPV4_GET_RF: get the RF flag. Use _IPV4_GET_IPOFFSET to save a ntohs call. */
#define IPV4_GET_RF(p) \
((p)->ip4c.flags & IPV4_CACHE_RF ? \
(p)->ip4c.rf : ((p)->ip4c.flags |= IPV4_CACHE_RF, (p)->ip4c.rf = (uint8_t)((_IPV4_GET_IPOFFSET((p)) & 0x8000) >> 15)))
(uint8_t)((_IPV4_GET_IPOFFSET((p)) & 0x8000) >> 15)
/* IPV4_GET_DF: get the DF flag. Use _IPV4_GET_IPOFFSET to save a ntohs call. */
#define IPV4_GET_DF(p) \
((p)->ip4c.flags & IPV4_CACHE_DF ? \
(p)->ip4c.df : ((p)->ip4c.flags |= IPV4_CACHE_DF, (p)->ip4c.df = (uint8_t)((_IPV4_GET_IPOFFSET((p)) & 0x4000) >> 14)))
(uint8_t)((_IPV4_GET_IPOFFSET((p)) & 0x4000) >> 14)
/* IPV4_GET_MF: get the MF flag. Use _IPV4_GET_IPOFFSET to save a ntohs call. */
#define IPV4_GET_MF(p) \
((p)->ip4c.flags & IPV4_CACHE_MF ? \
(p)->ip4c.mf : ((p)->ip4c.flags |= IPV4_CACHE_MF, (p)->ip4c.mf = (uint8_t)((_IPV4_GET_IPOFFSET((p)) & 0x2000) >> 13)))
(uint8_t)((_IPV4_GET_IPOFFSET((p)) & 0x2000) >> 13)
#define IPV4_GET_IPTTL(p) \
IPV4_GET_RAW_IPTTL(p->ip4h)
IPV4_GET_RAW_IPTTL(p->ip4h)
#define IPV4_GET_IPPROTO(p) \
((p)->ip4c.flags & IPV4_CACHE_IPPROTO ? \
(p)->ip4c.ip_proto : ((p)->ip4c.flags |= IPV4_CACHE_IPPROTO, (p)->ip4c.ip_proto = IPV4_GET_RAW_IPPROTO((p)->ip4h)))
#define IPV4_CACHE_VER 0x0001 /* 1 */
#define IPV4_CACHE_HLEN 0x0002 /* 2 */
#define IPV4_CACHE_IPTOS 0x0004 /* 4 */
#define IPV4_CACHE_IPLEN 0x0008 /* 8 */
#define IPV4_CACHE_IPID 0x0010 /* 16 */
#define IPV4_CACHE_IPOFF 0x0020 /* 32 */
#define IPV4_CACHE__IPOFF 0x0040 /* 64 */
#define IPV4_CACHE_RF 0x0080 /* 128*/
#define IPV4_CACHE_DF 0x0100 /* 256 */
#define IPV4_CACHE_MF 0x0200 /* 512 */
#define IPV4_CACHE_IPTTL 0x0400 /* 1024*/
#define IPV4_CACHE_IPPROTO 0x0800 /* 2048 */
/**
* IPv4 decoder cache
*
* Used for storing parsed values.
*/
typedef struct IPV4Cache_
{
uint16_t flags;
uint8_t ver;
uint8_t hl;
uint8_t ip_tos; /* type of service */
uint16_t ip_len; /* datagram length */
uint16_t ip_id; /* identification */
uint16_t ip_off; /* fragment offset */
uint16_t _ip_off; /* fragment offset - full field value, host order*/
uint8_t rf;
uint8_t df;
uint8_t mf;
uint8_t ip_ttl; /* time to live field */
uint8_t ip_proto; /* datagram protocol */
uint16_t ip_csum; /* checksum */
int32_t comp_csum; /* checksum computed over the ipv4 packet */
uint32_t ip_src_u32; /* source IP */
uint32_t ip_dst_u32; /* dest IP */
} IPV4Cache;
IPV4_GET_RAW_IPPROTO((p)->ip4h)
#define CLEAR_IPV4_PACKET(p) do { \
(p)->ip4h = NULL; \
(p)->ip4vars.comp_csum = 0; \
(p)->ip4vars.ip_src_u32 = 0; \
(p)->ip4vars.ip_dst_u32 = 0; \
(p)->ip4vars.ip_opt_len = 0; \
(p)->ip4vars.ip_opt_cnt = 0; \
(p)->ip4vars.o_rr = NULL; \
@ -206,28 +154,15 @@ typedef struct IPV4Cache_
(p)->ip4vars.o_sid = NULL; \
(p)->ip4vars.o_ssrr = NULL; \
(p)->ip4vars.o_rtralt = NULL; \
(p)->ip4c.flags = 0; \
(p)->ip4c.ver = 0; \
(p)->ip4c.hl = 0; \
(p)->ip4c.ip_tos = 0; \
(p)->ip4c.ip_len = 0; \
(p)->ip4c.ip_id = 0; \
(p)->ip4c.ip_off = 0; \
(p)->ip4c._ip_off = 0; \
(p)->ip4c.rf = 0; \
(p)->ip4c.df = 0; \
(p)->ip4c.mf = 0; \
(p)->ip4c.ip_ttl = 0; \
(p)->ip4c.ip_proto = 0; \
(p)->ip4c.ip_csum = 0; \
(p)->ip4c.comp_csum = 0; \
(p)->ip4c.ip_src_u32 = 0; \
(p)->ip4c.ip_dst_u32 = 0; \
} while (0)
/* helper structure with parsed ipv4 info */
typedef struct IPV4Vars_
{
int32_t comp_csum; /* checksum computed over the ipv4 packet */
uint32_t ip_src_u32; /* source IP */
uint32_t ip_dst_u32; /* dest IP */
uint8_t ip_opt_len;
IPV4Opt ip_opts[IPV4_OPTMAX];
uint8_t ip_opt_cnt;

2
src/decode-ipv6.c
Unescape Escape View File

@ -411,8 +411,6 @@ void DecodeIPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt,
SCPerfCounterIncr(dtv->counter_ipv6, tv->sc_perf_pca);
IPV6_CACHE_INIT(p);
/* do the actual decoding */
ret = DecodeIPV6Packet (tv, dtv, p, pkt, len);
if (ret < 0) {

44
src/decode-ipv6.h
Unescape Escape View File

@ -61,54 +61,26 @@ typedef struct IPV6Hdr_
#define IPV6_SET_L4PROTO(p,proto) (p)->ip6vars.l4proto = proto
/* this is enough since noone will access the cache without first
* checking the flags */
#define IPV6_CACHE_INIT(p) (p)->ip6c.flags = 0
/* ONLY call these functions after making sure that:
* 1. p->ip6h is set
* 2. p->ip6h is valid (len is correct)
* 3. cache is initialized
*/
#define IPV6_GET_VER(p) \
((p)->ip6c.flags & IPV6_CACHE_VER ? \
(p)->ip6c.ver : ((p)->ip6c.flags |= IPV6_CACHE_VER, (p)->ip6c.ver = IPV6_GET_RAW_VER((p)->ip6h)))
IPV6_GET_RAW_VER((p)->ip6h)
#define IPV6_GET_CLASS(p) \
((p)->ip6c.flags & IPV6_CACHE_CLASS ? \
(p)->ip6c.cl : ((p)->ip6c.flags |= IPV6_CACHE_CLASS, (p)->ip6c.cl = IPV6_GET_RAW_CLASS((p)->ip6h)))
IPV6_GET_RAW_CLASS((p)->ip6h)
#define IPV6_GET_FLOW(p) \
((p)->ip6c.flags & IPV6_CACHE_FLOW ? \
(p)->ip6c.flow : ((p)->ip6c.flags |= IPV6_CACHE_FLOW, (p)->ip6c.flow = IPV6_GET_RAW_FLOW((p)->ip6h)))
IPV6_GET_RAW_FLOW((p)->ip6h)
#define IPV6_GET_NH(p) \
(IPV6_GET_RAW_NH((p)->ip6h))
#define IPV6_GET_PLEN(p) \
((p)->ip6c.flags & IPV6_CACHE_PLEN ? \
(p)->ip6c.plen : ((p)->ip6c.flags |= IPV6_CACHE_PLEN, (p)->ip6c.plen = IPV6_GET_RAW_PLEN((p)->ip6h)))
IPV6_GET_RAW_PLEN((p)->ip6h)
#define IPV6_GET_HLIM(p) \
(IPV6_GET_RAW_HLIM((p)->ip6h))
/* XXX */
#define IPV6_GET_L4PROTO(p) \
((p)->ip6vars.l4proto)
#define IPV6_CACHE_VER 0x0001 /* 1 */
#define IPV6_CACHE_CLASS 0x0002 /* 2 */
#define IPV6_CACHE_FLOW 0x0004 /* 4 */
#define IPV6_CACHE_NH 0x0008 /* 8 */
#define IPV6_CACHE_PLEN 0x0010 /* 16 */
#define IPV6_CACHE_HLIM 0x0020 /* 32 */
/* decoder cache */
typedef struct IPV6Cache_
{
uint16_t flags;
uint8_t ver;
uint8_t cl;
uint8_t flow;
uint8_t nh;
uint16_t plen;
uint8_t hlim;
} IPV6Cache;
/* helper structure with parsed ipv6 info */
typedef struct IPV6Vars_
{
@ -120,15 +92,9 @@ typedef struct IPV6Vars_
#define CLEAR_IPV6_PACKET(p) do { \
(p)->ip6h = NULL; \
(p)->ip6c.flags = 0; \
(p)->ip6c.ver = 0; \
(p)->ip6c.cl = 0; \
(p)->ip6c.flow = 0; \
(p)->ip6c.nh = 0; \
(p)->ip6c.plen = 0; \
(p)->ip6c.hlim = 0; \
(p)->ip6vars.ip_opts_len = 0; \
(p)->ip6vars.l4proto = 0; \
(p)->ip6eh.ip6fh = NULL; \
} while (0)
/* Fragment header */

25
src/decode-tcp.h
Unescape Escape View File

@ -78,12 +78,13 @@
/** macro for getting the first timestamp from the packet. Timestamp is in host
* order and either returned from the cache or from the packet directly. */
#define TCP_GET_TSVAL(p) ((p)->tcpc.ts1 != 0 ? \
(p)->tcpc.ts1 : (p)->tcpvars.ts ? ((p)->tcpc.ts1 = (uint32_t)ntohl((*(uint32_t *)(p)->tcpvars.ts->data))) : 0)
#define TCP_GET_TSVAL(p) \
(uint32_t)ntohl((*(uint32_t *)(p)->tcpvars.ts->data))
/** macro for getting the second timestamp from the packet. Timestamp is in
* host order and either returned from the cache or from the packet directly. */
#define TCP_GET_TSECR(p) ((p)->tcpc.ts2 != 0 ? \
(p)->tcpc.ts2 : (p)->tcpvars.ts ? ((p)->tcpc.ts2 = (uint32_t)ntohl((*(uint32_t *)((p)->tcpvars.ts->data+4)))) : 0)
#define TCP_GET_TSECR(p) \
(uint32_t)ntohl((*(uint32_t *)((p)->tcpvars.ts->data+4)))
/** macro for getting the wscale from the packet. */
#define TCP_GET_WSCALE(p) ((p)->tcpvars.ws ? (((*(uint8_t *)(p)->tcpvars.ws->data) <= TCP_WSCALE_MAX) ? (*(uint8_t *)((p)->tcpvars.ws->data)) : 0) : 0)
@ -126,6 +127,9 @@ typedef struct TCPHdr_
typedef struct TCPVars_
{
/* checksum computed over the tcp(for both ipv4 and ipv6) packet */
int32_t comp_csum;
uint8_t hlen;
uint8_t tcp_opt_len;
@ -139,25 +143,14 @@ typedef struct TCPVars_
TCPOpt *mss;
} TCPVars;
/** cache to store parsed/calculated results of the decoder */
typedef struct TCPCache_ {
/* checksum computed over the tcp(for both ipv4 and ipv6) packet */
int32_t comp_csum;
uint32_t ts1; /**< host order version of the first ts */
uint32_t ts2; /**< host order version of the second ts */
} TCPCache;
#define CLEAR_TCP_PACKET(p) { \
(p)->tcph = NULL; \
(p)->tcpvars.comp_csum = -1; \
(p)->tcpvars.tcp_opt_cnt = 0; \
(p)->tcpvars.sackok = NULL; \
(p)->tcpvars.ts = NULL; \
(p)->tcpvars.ws = NULL; \
(p)->tcpvars.mss = NULL; \
(p)->tcpc.comp_csum = -1; \
(p)->tcpc.ts1 = 0; \
(p)->tcpc.ts2 = 0; \
}
void DecodeTCPRegisterTests(void);

1
src/decode-udp.c
Unescape Escape View File

@ -54,7 +54,6 @@ static int DecodeUDPPacket(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len)
SET_UDP_SRC_PORT(p,&p->sp);
SET_UDP_DST_PORT(p,&p->dp);
p->udpvars.hlen = UDP_HEADER_LEN;
p->payload = pkt + UDP_HEADER_LEN;
p->payload_len = len - UDP_HEADER_LEN;

9
src/decode-udp.h
Unescape Escape View File

@ -46,18 +46,13 @@ typedef struct UDPHdr_
typedef struct UDPVars_
{
uint8_t hlen;
} UDPVars;
typedef struct UDPCache_ {
/* checksum computed over the udp(for both ipv4 and ipv6) packet */
int32_t comp_csum;
} UDPCache;
} UDPVars;
#define CLEAR_UDP_PACKET(p) do { \
(p)->udpvars.hlen = 0; \
(p)->udpc.comp_csum = -1; \
(p)->udph = NULL; \
(p)->udpvars.comp_csum = -1; \
} while (0)
void DecodeUDPV4RegisterTests(void);

16
src/decode.h
Unescape Escape View File

@ -311,27 +311,21 @@ typedef struct Packet_
IPV4Hdr *ip4h;
IPV4Vars ip4vars;
IPV4Cache ip4c;
IPV6Hdr *ip6h;
IPV6Vars ip6vars;
IPV6Cache ip6c;
IPV6ExtHdrs ip6eh;
TCPHdr *tcph;
TCPVars tcpvars;
TCPCache tcpc;
UDPHdr *udph;
UDPVars udpvars;
UDPCache udpc;
ICMPV4Hdr *icmpv4h;
ICMPV4Cache icmpv4c;
ICMPV4Vars icmpv4vars;
ICMPV6Hdr *icmpv6h;
ICMPV6Cache icmpv6c;
ICMPV6Vars icmpv6vars;
PPPHdr *ppph;
@ -466,11 +460,11 @@ typedef struct DecodeThreadVars_
* \brief reset these to -1(indicates that the packet is fresh from the queue)
*/
#define PACKET_RESET_CHECKSUMS(p) do { \
(p)->ip4c.comp_csum = -1; \
(p)->tcpc.comp_csum = -1; \
(p)->udpc.comp_csum = -1; \
(p)->icmpv4c.comp_csum = -1; \
(p)->icmpv6c.comp_csum = -1; \
(p)->ip4vars.comp_csum = -1; \
(p)->tcpvars.comp_csum = -1; \
(p)->udpvars.comp_csum = -1; \
(p)->icmpv4vars.comp_csum = -1; \
(p)->icmpv6vars.comp_csum = -1; \
} while (0)
/**

4
src/defrag.c
Unescape Escape View File

@ -592,7 +592,6 @@ Defrag4Reassemble(ThreadVars *tv, DefragContext *dc, DefragTracker *tracker,
rp->ip4h->ip_csum = FixChecksum(rp->ip4h->ip_csum,
old, rp->ip4h->ip_len + rp->ip4h->ip_off);
rp->pktlen = ip_hdr_offset + hlen + fragmentable_len;
IPV4_CACHE_INIT(rp);
remove_tracker:
/* Remove the frag tracker. */
@ -701,7 +700,6 @@ Defrag6Reassemble(ThreadVars *tv, DefragContext *dc, DefragTracker *tracker,
rp->ip6h->s_ip6_plen = htons(fragmentable_len);
rp->ip6h->s_ip6_nxt = next_hdr;
rp->pktlen = ip_hdr_offset + sizeof(IPV6Hdr) + fragmentable_len;
IPV6_CACHE_INIT(rp);
remove_tracker:
/* Remove the frag tracker. */
@ -1242,7 +1240,6 @@ BuildTestPacket(uint16_t id, uint16_t off, int mf, const char content,
p->ip4h->ip_csum = IPV4CalculateChecksum((uint16_t *)p->pkt, hlen);
/* Self test. */
IPV4_CACHE_INIT(p);
if (IPV4_GET_VER(p) != 4)
goto error;
if (IPV4_GET_HLEN(p) != hlen)
@ -1309,7 +1306,6 @@ IPV6BuildTestPacket(uint32_t id, uint16_t off, int mf, const char content,
SET_IPV6_DST_ADDR(p, &p->dst);
/* Self test. */
IPV6_CACHE_INIT(p);
if (IPV6_GET_VER(p) != 6)
goto error;
if (IPV6_GET_NH(p) != 44)

60
src/detect-csum.c
Unescape Escape View File

@ -223,13 +223,13 @@ int DetectIPV4CsumMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
if (p->ip4h == NULL)
return 0;
if (p->ip4c.comp_csum == -1)
p->ip4c.comp_csum = IPV4CalculateChecksum((uint16_t *)p->ip4h,
if (p->ip4vars.comp_csum == -1)
p->ip4vars.comp_csum = IPV4CalculateChecksum((uint16_t *)p->ip4h,
IPV4_GET_RAW_HLEN(p->ip4h));
if (p->ip4c.comp_csum == p->ip4h->ip_csum && cd->valid == 1)
if (p->ip4vars.comp_csum == p->ip4h->ip_csum && cd->valid == 1)
return 1;
else if (p->ip4c.comp_csum != p->ip4h->ip_csum && cd->valid == 0)
else if (p->ip4vars.comp_csum != p->ip4h->ip_csum && cd->valid == 0)
return 1;
else
return 0;
@ -313,15 +313,15 @@ int DetectTCPV4CsumMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
if (p->ip4h == NULL || p->proto != IPPROTO_TCP)
return 0;
if (p->tcpc.comp_csum == -1)
p->tcpc.comp_csum = TCPCalculateChecksum((uint16_t *)&(p->ip4h->ip_src),
if (p->tcpvars.comp_csum == -1)
p->tcpvars.comp_csum = TCPCalculateChecksum((uint16_t *)&(p->ip4h->ip_src),
(uint16_t *)p->tcph,
(p->payload_len +
p->tcpvars.hlen) );
if (p->tcpc.comp_csum == p->tcph->th_sum && cd->valid == 1)
if (p->tcpvars.comp_csum == p->tcph->th_sum && cd->valid == 1)
return 1;
else if (p->tcpc.comp_csum != p->tcph->th_sum && cd->valid == 0)
else if (p->tcpvars.comp_csum != p->tcph->th_sum && cd->valid == 0)
return 1;
else
return 0;
@ -405,15 +405,15 @@ int DetectTCPV6CsumMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
if (p->ip6h == NULL || p->proto != IPPROTO_TCP)
return 0;
if (p->tcpc.comp_csum == -1)
p->tcpc.comp_csum = TCPV6CalculateChecksum((uint16_t *)&(p->ip6h->ip6_src),
if (p->tcpvars.comp_csum == -1)
p->tcpvars.comp_csum = TCPV6CalculateChecksum((uint16_t *)&(p->ip6h->ip6_src),
(uint16_t *)p->tcph,
(p->payload_len +
p->tcpvars.hlen) );
if (p->tcpc.comp_csum == p->tcph->th_sum && cd->valid == 1)
if (p->tcpvars.comp_csum == p->tcph->th_sum && cd->valid == 1)
return 1;
else if (p->tcpc.comp_csum != p->tcph->th_sum && cd->valid == 0)
else if (p->tcpvars.comp_csum != p->tcph->th_sum && cd->valid == 0)
return 1;
else
return 0;
@ -497,15 +497,15 @@ int DetectUDPV4CsumMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
if (p->ip4h == NULL || p->proto != IPPROTO_UDP)
return 0;
if (p->udpc.comp_csum == -1)
p->udpc.comp_csum = UDPV4CalculateChecksum((uint16_t *)&(p->ip4h->ip_src),
if (p->udpvars.comp_csum == -1)
p->udpvars.comp_csum = UDPV4CalculateChecksum((uint16_t *)&(p->ip4h->ip_src),
(uint16_t *)p->udph,
(p->payload_len +
p->udpvars.hlen) );
UDP_HEADER_LEN) );
if (p->udpc.comp_csum == p->udph->uh_sum && cd->valid == 1)
if (p->udpvars.comp_csum == p->udph->uh_sum && cd->valid == 1)
return 1;
else if (p->udpc.comp_csum != p->udph->uh_sum && cd->valid == 0)
else if (p->udpvars.comp_csum != p->udph->uh_sum && cd->valid == 0)
return 1;
else
return 0;
@ -589,15 +589,15 @@ int DetectUDPV6CsumMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
if (p->ip6h == NULL || p->proto != IPPROTO_UDP)
return 0;
if (p->udpc.comp_csum == -1)
p->udpc.comp_csum = UDPV6CalculateChecksum((uint16_t *)&(p->ip6h->ip6_src),
if (p->udpvars.comp_csum == -1)
p->udpvars.comp_csum = UDPV6CalculateChecksum((uint16_t *)&(p->ip6h->ip6_src),
(uint16_t *)p->udph,
(p->payload_len +
p->udpvars.hlen) );
UDP_HEADER_LEN) );
if (p->udpc.comp_csum == p->udph->uh_sum && cd->valid == 1)
if (p->udpvars.comp_csum == p->udph->uh_sum && cd->valid == 1)
return 1;
else if (p->udpc.comp_csum != p->udph->uh_sum && cd->valid == 0)
else if (p->udpvars.comp_csum != p->udph->uh_sum && cd->valid == 0)
return 1;
else
return 0;
@ -681,14 +681,14 @@ int DetectICMPV4CsumMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
if (p->ip4h == NULL || p->proto != IPPROTO_ICMP)
return 0;
if (p->icmpv4c.comp_csum == -1)
p->icmpv4c.comp_csum = ICMPV4CalculateChecksum((uint16_t *)p->icmpv4h,
if (p->icmpv4vars.comp_csum == -1)
p->icmpv4vars.comp_csum = ICMPV4CalculateChecksum((uint16_t *)p->icmpv4h,
ntohs(IPV4_GET_RAW_IPLEN(p->ip4h)) -
IPV4_GET_RAW_HLEN(p->ip4h) * 4);
if (p->icmpv4c.comp_csum == p->icmpv4h->checksum && cd->valid == 1)
if (p->icmpv4vars.comp_csum == p->icmpv4h->checksum && cd->valid == 1)
return 1;
else if (p->icmpv4c.comp_csum != p->icmpv4h->checksum && cd->valid == 0)
else if (p->icmpv4vars.comp_csum != p->icmpv4h->checksum && cd->valid == 0)
return 1;
else
return 0;
@ -772,14 +772,14 @@ int DetectICMPV6CsumMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
if (p->ip6h == NULL || p->proto != IPPROTO_ICMPV6)
return 0;
if (p->icmpv6c.comp_csum == -1)
p->icmpv6c.comp_csum = ICMPV6CalculateChecksum((uint16_t *)&(p->ip6h->ip6_src),
if (p->icmpv6vars.comp_csum == -1)
p->icmpv6vars.comp_csum = ICMPV6CalculateChecksum((uint16_t *)&(p->ip6h->ip6_src),
(uint16_t *)p->icmpv6h,
IPV6_GET_PLEN(p));
if (p->icmpv6c.comp_csum == p->icmpv6h->csum && cd->valid == 1)
if (p->icmpv6vars.comp_csum == p->icmpv6h->csum && cd->valid == 1)
return 1;
else if (p->icmpv6c.comp_csum != p->icmpv6h->csum && cd->valid == 0)
else if (p->icmpv6vars.comp_csum != p->icmpv6h->csum && cd->valid == 0)
return 1;
else
return 0;

22
src/detect-fragbits.c
Unescape Escape View File

@ -53,6 +53,10 @@
#define MODIFIER_PLUS 2
#define MODIFIER_ANY 3
#define FRAGBITS_HAVE_MF 0x01
#define FRAGBITS_HAVE_DF 0x02
#define FRAGBITS_HAVE_RF 0x04
static pcre *parse_regex;
static pcre_extra *parse_regex_study;
@ -117,11 +121,11 @@ static int DetectFragBitsMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, P
return ret;
if(IPV4_GET_MF(p))
fragbits |= IPV4_CACHE_MF;
fragbits |= FRAGBITS_HAVE_MF;
if(IPV4_GET_DF(p))
fragbits |= IPV4_CACHE_DF;
fragbits |= FRAGBITS_HAVE_DF;
if(IPV4_GET_RF(p))
fragbits |= IPV4_CACHE_RF;
fragbits |= FRAGBITS_HAVE_RF;
switch(de->modifier) {
case MODIFIER_ANY:
@ -225,17 +229,17 @@ static DetectFragBitsData *DetectFragBitsParse (char *rawstr)
switch (*ptr) {
case 'M':
case 'm':
de->fragbits |= IPV4_CACHE_MF;
de->fragbits |= FRAGBITS_HAVE_MF;
found++;
break;
case 'D':
case 'd':
de->fragbits |= IPV4_CACHE_DF;
de->fragbits |= FRAGBITS_HAVE_DF;
found++;
break;
case 'R':
case 'r':
de->fragbits |= IPV4_CACHE_RF;
de->fragbits |= FRAGBITS_HAVE_RF;
found++;
break;
default:
@ -323,7 +327,7 @@ static void DetectFragBitsFree(void *de_ptr) {
static int FragBitsTestParse01 (void) {
DetectFragBitsData *de = NULL;
de = DetectFragBitsParse("M");
if (de && (de->fragbits == IPV4_CACHE_MF) ) {
if (de && (de->fragbits == FRAGBITS_HAVE_MF) ) {
DetectFragBitsFree(de);
return 1;
}
@ -415,7 +419,7 @@ static int FragBitsTestParse03 (void) {
de = DetectFragBitsParse("D");
if (de == NULL || (de->fragbits != IPV4_CACHE_DF))
if (de == NULL || (de->fragbits != FRAGBITS_HAVE_DF))
goto error;
sm = SigMatchAlloc();
@ -509,7 +513,7 @@ static int FragBitsTestParse04 (void) {
de = DetectFragBitsParse("!D");
if (de == NULL || (de->fragbits != IPV4_CACHE_DF) || (de->modifier != MODIFIER_NOT))
if (de == NULL || (de->fragbits != FRAGBITS_HAVE_DF) || (de->modifier != MODIFIER_NOT))
goto error;
sm = SigMatchAlloc();

88
src/detect.c
Unescape Escape View File

@ -5132,8 +5132,8 @@ int SigTest24IPV4Keyword(void)
memset(&th_v, 0, sizeof(ThreadVars));
memset(&p1, 0, sizeof(Packet));
memset(&p2, 0, sizeof(Packet));
p1.ip4c.comp_csum = -1;
p2.ip4c.comp_csum = -1;
p1.ip4vars.comp_csum = -1;
p2.ip4vars.comp_csum = -1;
p1.ip4h = (IPV4Hdr *)valid_raw_ipv4;
@ -5227,8 +5227,8 @@ int SigTest25NegativeIPV4Keyword(void)
memset(&th_v, 0, sizeof(ThreadVars));
memset(&p1, 0, sizeof(Packet));
memset(&p2, 0, sizeof(Packet));
p1.ip4c.comp_csum = -1;
p2.ip4c.comp_csum = -1;
p1.ip4vars.comp_csum = -1;
p2.ip4vars.comp_csum = -1;
p1.ip4h = (IPV4Hdr *)valid_raw_ipv4;
@ -5330,7 +5330,7 @@ int SigTest26TCPV4Keyword(void)
memset(&p1, 0, sizeof(Packet));
memset(&p2, 0, sizeof(Packet));
p1.tcpc.comp_csum = -1;
p1.tcpvars.comp_csum = -1;
p1.ip4h = (IPV4Hdr *)raw_ipv4;
p1.tcph = (TCPHdr *)valid_raw_tcp;
p1.tcpvars.hlen = 0;
@ -5340,7 +5340,7 @@ int SigTest26TCPV4Keyword(void)
p1.payload_len = buflen;
p1.proto = IPPROTO_TCP;
p2.tcpc.comp_csum = -1;
p2.tcpvars.comp_csum = -1;
p2.ip4h = (IPV4Hdr *)raw_ipv4;
p2.tcph = (TCPHdr *)invalid_raw_tcp;
p2.tcpvars.hlen = 0;
@ -5434,7 +5434,7 @@ int SigTest27NegativeTCPV4Keyword(void)
memset(&p1, 0, sizeof(Packet));
memset(&p2, 0, sizeof(Packet));
p1.tcpc.comp_csum = -1;
p1.tcpvars.comp_csum = -1;
p1.ip4h = (IPV4Hdr *)raw_ipv4;
p1.tcph = (TCPHdr *)valid_raw_tcp;
//p1.tcpvars.hlen = TCP_GET_HLEN((&p));
@ -5445,7 +5445,7 @@ int SigTest27NegativeTCPV4Keyword(void)
p1.payload_len = buflen;
p1.proto = IPPROTO_TCP;
p2.tcpc.comp_csum = -1;
p2.tcpvars.comp_csum = -1;
p2.ip4h = (IPV4Hdr *)raw_ipv4;
p2.tcph = (TCPHdr *)invalid_raw_tcp;
//p2.tcpvars.hlen = TCP_GET_HLEN((&p));
@ -5548,7 +5548,7 @@ int SigTest28TCPV6Keyword(void)
memset(&p1, 0, sizeof(Packet));
memset(&p2, 0, sizeof(Packet));
p1.tcpc.comp_csum = -1;
p1.tcpvars.comp_csum = -1;
p1.ip6h = (IPV6Hdr *)(valid_raw_ipv6 + 14);
p1.tcph = (TCPHdr *) (valid_raw_ipv6 + 54);
p1.src.family = AF_INET;
@ -5559,7 +5559,7 @@ int SigTest28TCPV6Keyword(void)
p1.tcpvars.hlen = 0;
p1.proto = IPPROTO_TCP;
p2.tcpc.comp_csum = -1;
p2.tcpvars.comp_csum = -1;
p2.ip6h = (IPV6Hdr *)(invalid_raw_ipv6 + 14);
p2.tcph = (TCPHdr *) (invalid_raw_ipv6 + 54);
p2.src.family = AF_INET;
@ -5661,7 +5661,7 @@ int SigTest29NegativeTCPV6Keyword(void)
memset(&p1, 0, sizeof(Packet));
memset(&p2, 0, sizeof(Packet));
p1.tcpc.comp_csum = -1;
p1.tcpvars.comp_csum = -1;
p1.ip6h = (IPV6Hdr *)(valid_raw_ipv6 + 14);
p1.tcph = (TCPHdr *) (valid_raw_ipv6 + 54);
p1.src.family = AF_INET;
@ -5672,7 +5672,7 @@ int SigTest29NegativeTCPV6Keyword(void)
p1.tcpvars.hlen = 0;
p1.proto = IPPROTO_TCP;
p2.tcpc.comp_csum = -1;
p2.tcpvars.comp_csum = -1;
p2.ip6h = (IPV6Hdr *)(invalid_raw_ipv6 + 14);
p2.tcph = (TCPHdr *) (invalid_raw_ipv6 + 54);
p2.src.family = AF_INET;
@ -5780,24 +5780,22 @@ int SigTest30UDPV4Keyword(void)
memset(&p1, 0, sizeof(Packet));
memset(&p2, 0, sizeof(Packet));
p1.udpc.comp_csum = -1;
p1.udpvars.comp_csum = -1;
p1.ip4h = (IPV4Hdr *)raw_ipv4;
p1.udph = (UDPHdr *)valid_raw_udp;
p1.udpvars.hlen = UDP_HEADER_LEN;
p1.src.family = AF_INET;
p1.dst.family = AF_INET;
p1.payload = buf;
p1.payload_len = sizeof(valid_raw_udp) - p1.udpvars.hlen;
p1.payload_len = sizeof(valid_raw_udp) - UDP_HEADER_LEN;
p1.proto = IPPROTO_UDP;
p2.udpc.comp_csum = -1;
p2.udpvars.comp_csum = -1;
p2.ip4h = (IPV4Hdr *)raw_ipv4;
p2.udph = (UDPHdr *)invalid_raw_udp;
p2.udpvars.hlen = UDP_HEADER_LEN;
p2.src.family = AF_INET;
p2.dst.family = AF_INET;
p2.payload = buf;
p2.payload_len = sizeof(invalid_raw_udp) - p2.udpvars.hlen;
p2.payload_len = sizeof(invalid_raw_udp) - UDP_HEADER_LEN;
p2.proto = IPPROTO_UDP;
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
@ -5897,24 +5895,22 @@ int SigTest31NegativeUDPV4Keyword(void)
memset(&p1, 0, sizeof(Packet));
memset(&p2, 0, sizeof(Packet));
p1.udpc.comp_csum = -1;
p1.udpvars.comp_csum = -1;
p1.ip4h = (IPV4Hdr *)raw_ipv4;
p1.udph = (UDPHdr *)valid_raw_udp;
p1.udpvars.hlen = UDP_HEADER_LEN;
p1.src.family = AF_INET;
p1.dst.family = AF_INET;
p1.payload = buf;
p1.payload_len = sizeof(valid_raw_udp) - p1.udpvars.hlen;
p1.payload_len = sizeof(valid_raw_udp) - UDP_HEADER_LEN;
p1.proto = IPPROTO_UDP;
p2.udpc.comp_csum = -1;
p2.udpvars.comp_csum = -1;
p2.ip4h = (IPV4Hdr *)raw_ipv4;
p2.udph = (UDPHdr *)invalid_raw_udp;
p2.udpvars.hlen = UDP_HEADER_LEN;
p2.src.family = AF_INET;
p2.dst.family = AF_INET;
p2.payload = buf;
p2.payload_len = sizeof(invalid_raw_udp) - p2.udpvars.hlen;
p2.payload_len = sizeof(invalid_raw_udp) - UDP_HEADER_LEN;
p2.proto = IPPROTO_UDP;
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
@ -6008,24 +6004,22 @@ int SigTest32UDPV6Keyword(void)
memset(&p1, 0, sizeof(Packet));
memset(&p2, 0, sizeof(Packet));
p1.udpc.comp_csum = -1;
p1.udpvars.comp_csum = -1;
p1.ip6h = (IPV6Hdr *)(valid_raw_ipv6 + 14);
p1.udph = (UDPHdr *) (valid_raw_ipv6 + 54);
p1.src.family = AF_INET;
p1.dst.family = AF_INET;
p1.udpvars.hlen = UDP_HEADER_LEN;
p1.payload = buf;
p1.payload_len = IPV6_GET_PLEN((&p1)) - p1.udpvars.hlen;
p1.payload_len = IPV6_GET_PLEN((&p1)) - UDP_HEADER_LEN;
p1.proto = IPPROTO_UDP;
p2.udpc.comp_csum = -1;
p2.udpvars.comp_csum = -1;
p2.ip6h = (IPV6Hdr *)(invalid_raw_ipv6 + 14);
p2.udph = (UDPHdr *) (invalid_raw_ipv6 + 54);
p2.src.family = AF_INET;
p2.dst.family = AF_INET;
p2.udpvars.hlen = UDP_HEADER_LEN;
p2.payload = buf;
p2.payload_len = IPV6_GET_PLEN((&p2)) - p2.udpvars.hlen;
p2.payload_len = IPV6_GET_PLEN((&p2)) - UDP_HEADER_LEN;
p2.proto = IPPROTO_UDP;
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
@ -6117,24 +6111,22 @@ int SigTest33NegativeUDPV6Keyword(void)
memset(&p1, 0, sizeof(Packet));
memset(&p2, 0, sizeof(Packet));
p1.udpc.comp_csum = -1;
p1.udpvars.comp_csum = -1;
p1.ip6h = (IPV6Hdr *)(valid_raw_ipv6 + 14);
p1.udph = (UDPHdr *) (valid_raw_ipv6 + 54);
p1.src.family = AF_INET;
p1.dst.family = AF_INET;
p1.udpvars.hlen = UDP_HEADER_LEN;
p1.payload = buf;
p1.payload_len = IPV6_GET_PLEN((&p1)) - p1.udpvars.hlen;
p1.payload_len = IPV6_GET_PLEN((&p1)) - UDP_HEADER_LEN;
p1.proto = IPPROTO_UDP;
p2.udpc.comp_csum = -1;
p2.udpvars.comp_csum = -1;
p2.ip6h = (IPV6Hdr *)(invalid_raw_ipv6 + 14);
p2.udph = (UDPHdr *) (invalid_raw_ipv6 + 54);
p2.src.family = AF_INET;
p2.dst.family = AF_INET;
p2.udpvars.hlen = UDP_HEADER_LEN;
p2.payload = buf;
p2.payload_len = IPV6_GET_PLEN((&p2)) - p2.udpvars.hlen;
p2.payload_len = IPV6_GET_PLEN((&p2)) - UDP_HEADER_LEN;
p2.proto = IPPROTO_UDP;
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
@ -6229,7 +6221,7 @@ int SigTest34ICMPV4Keyword(void)
memset(&p1, 0, sizeof(Packet));
memset(&p2, 0, sizeof(Packet));
p1.icmpv4c.comp_csum = -1;
p1.icmpv4vars.comp_csum = -1;
p1.ip4h = (IPV4Hdr *)(valid_raw_ipv4);
p1.ip4h->ip_verhl = 69;
p1.icmpv4h = (ICMPV4Hdr *) (valid_raw_ipv4 + IPV4_GET_RAW_HLEN(p1.ip4h) * 4);
@ -6239,7 +6231,7 @@ int SigTest34ICMPV4Keyword(void)
p1.payload_len = buflen;
p1.proto = IPPROTO_ICMP;
p2.icmpv4c.comp_csum = -1;
p2.icmpv4vars.comp_csum = -1;
p2.ip4h = (IPV4Hdr *)(invalid_raw_ipv4);
p2.ip4h->ip_verhl = 69;
p2.icmpv4h = (ICMPV4Hdr *) (invalid_raw_ipv4 + IPV4_GET_RAW_HLEN(p2.ip4h) * 4);
@ -6339,7 +6331,7 @@ int SigTest35NegativeICMPV4Keyword(void)
memset(&p1, 0, sizeof(Packet));
memset(&p2, 0, sizeof(Packet));
p1.icmpv4c.comp_csum = -1;
p1.icmpv4vars.comp_csum = -1;
p1.ip4h = (IPV4Hdr *)(valid_raw_ipv4);
p1.ip4h->ip_verhl = 69;
p1.icmpv4h = (ICMPV4Hdr *) (valid_raw_ipv4 + IPV4_GET_RAW_HLEN(p1.ip4h) * 4);
@ -6349,7 +6341,7 @@ int SigTest35NegativeICMPV4Keyword(void)
p1.payload_len = buflen;
p1.proto = IPPROTO_ICMP;
p2.icmpv4c.comp_csum = -1;
p2.icmpv4vars.comp_csum = -1;
p2.ip4h = (IPV4Hdr *)(invalid_raw_ipv4);
p2.ip4h->ip_verhl = 69;
p2.icmpv4h = (ICMPV4Hdr *) (invalid_raw_ipv4 + IPV4_GET_RAW_HLEN(p2.ip4h) * 4);
@ -6462,20 +6454,18 @@ int SigTest36ICMPV6Keyword(void)
memset(&p1, 0, sizeof(Packet));
memset(&p2, 0, sizeof(Packet));
p1.icmpv6c.comp_csum = -1;
p1.icmpv6vars.comp_csum = -1;
p1.ip6h = (IPV6Hdr *)(valid_raw_ipv6 + 14);
p1.icmpv6h = (ICMPV6Hdr *) (valid_raw_ipv6 + 54);
p1.ip6c.plen = IPV6_GET_PLEN(&(p1));
p1.src.family = AF_INET;
p1.dst.family = AF_INET;
p1.payload = buf;
p1.payload_len = buflen;
p1.proto = IPPROTO_ICMPV6;
p2.icmpv6c.comp_csum = -1;
p2.icmpv6vars.comp_csum = -1;
p2.ip6h = (IPV6Hdr *)(invalid_raw_ipv6 + 14);
p2.icmpv6h = (ICMPV6Hdr *) (invalid_raw_ipv6 + 54);
p2.ip6c.plen = IPV6_GET_PLEN(&(p2));
p2.src.family = AF_INET;
p2.dst.family = AF_INET;
p2.payload = buf;
@ -6584,20 +6574,18 @@ int SigTest37NegativeICMPV6Keyword(void)
memset(&p1, 0, sizeof(Packet));
memset(&p2, 0, sizeof(Packet));
p1.icmpv6c.comp_csum = -1;
p1.icmpv6vars.comp_csum = -1;
p1.ip6h = (IPV6Hdr *)(valid_raw_ipv6 + 14);
p1.icmpv6h = (ICMPV6Hdr *) (valid_raw_ipv6 + 54);
p1.ip6c.plen = IPV6_GET_PLEN(&(p1));
p1.src.family = AF_INET;
p1.dst.family = AF_INET;
p1.payload = buf;
p1.payload_len = buflen;
p1.proto = IPPROTO_ICMPV6;
p2.icmpv6c.comp_csum = -1;
p2.icmpv6vars.comp_csum = -1;
p2.ip6h = (IPV6Hdr *)(invalid_raw_ipv6 + 14);
p2.icmpv6h = (ICMPV6Hdr *) (invalid_raw_ipv6 + 54);
p2.ip6c.plen = IPV6_GET_PLEN(&(p2));
p2.src.family = AF_INET;
p2.dst.family = AF_INET;
p2.payload = buf;
@ -6705,7 +6693,7 @@ int SigTest38Real(int mpm_type)
memcpy(p1.pkt + ethlen + ipv4len + tcplen, buf, buflen);
p1.pktlen = ethlen + ipv4len + tcplen + buflen;
p1.tcpc.comp_csum = -1;
p1.tcpvars.comp_csum = -1;
p1.ethh = (EthernetHdr *)raw_eth;
p1.ip4h = (IPV4Hdr *)raw_ipv4;
p1.tcph = (TCPHdr *)raw_tcp;
@ -6832,7 +6820,7 @@ int SigTest39Real(int mpm_type)
memcpy(p1.pkt + ethlen + ipv4len + tcplen, buf, buflen);
p1.pktlen = ethlen + ipv4len + tcplen + buflen;
p1.tcpc.comp_csum = -1;
p1.tcpvars.comp_csum = -1;
p1.ethh = (EthernetHdr *)raw_eth;
p1.ip4h = (IPV4Hdr *)raw_ipv4;
p1.tcph = (TCPHdr *)raw_tcp;

12
src/stream-tcp.c
Unescape Escape View File

@ -2937,21 +2937,21 @@ int StreamTcpValidateChecksum(Packet *p)
{
int ret = 1;
if (p->tcpc.comp_csum == -1) {
if (p->tcpvars.comp_csum == -1) {
if (PKT_IS_IPV4(p)) {
p->tcpc.comp_csum = TCPCalculateChecksum((uint16_t *)&(p->ip4h->ip_src),
p->tcpvars.comp_csum = TCPCalculateChecksum((uint16_t *)&(p->ip4h->ip_src),
(uint16_t *)p->tcph,
(p->payload_len +
p->tcpvars.hlen) );
} else if (PKT_IS_IPV6(p)) {
p->tcpc.comp_csum = TCPV6CalculateChecksum((uint16_t *)&(p->ip6h->ip6_src),
p->tcpvars.comp_csum = TCPV6CalculateChecksum((uint16_t *)&(p->ip6h->ip6_src),
(uint16_t *)p->tcph,
(p->payload_len +
p->tcpvars.hlen) );
}
}
if (p->tcpc.comp_csum != p->tcph->th_sum) {
if (p->tcpvars.comp_csum != p->tcph->th_sum) {
ret = 0;
SCLogDebug("Checksum of recevied packet %p is invalid",p);
}
@ -3871,8 +3871,6 @@ static int StreamTcpTest07 (void) {
p.flowflags = FLOW_PKT_TOSERVER;
data[0] = htonl(2);
p.tcpc.ts1 = 0;
p.tcpc.ts2 = 0;
p.tcpvars.ts->data = (uint8_t *)data;
if (StreamTcpPacket(&tv, &p, &stt) == -1) {
@ -3957,8 +3955,6 @@ static int StreamTcpTest08 (void) {
p.flowflags = FLOW_PKT_TOSERVER;
data[0] = htonl(12);
p.tcpc.ts1 = 0;
p.tcpc.ts2 = 0;
p.tcpvars.ts->data = (uint8_t *)data;
if (StreamTcpPacket(&tv, &p, &stt) == -1)

Write Preview
Loading…
Cancel
Save