aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Simplify packet decoding macro's.

Browse Source
remotes/origin/master-1.1.x
Victor Julien 15 years ago
parent c3bb04f609
commit e1d4e16645
16 changed files with 134 additions and 300 deletions
Show Stats Download Patch File Download Diff File

12
src/decode-icmpv4.h
Unescape Escape View File

@ -177,11 +177,9 @@ typedef struct ICMPV4ExtHdr_
/* ICMPv4 vars */
typedef struct ICMPV4Vars_
{
uint8_t type;
uint8_t code;
/* checksum computed over the icmpv4 packet */
int32_t comp_csum;
/* checksum of the icmpv4 packet */
uint16_t csum;
uint16_t id;
uint16_t seq;
uint32_t mtu;
@ -205,9 +203,7 @@ typedef struct ICMPV4Vars_
} ICMPV4Vars;
#define CLEAR_ICMPV4_PACKET(p) do { \
(p)->icmpv4vars.type = 0; \
(p)->icmpv4vars.code = 0; \
(p)->icmpv4vars.csum = -1; \
(p)->icmpv4vars.comp_csum = -1; \
(p)->icmpv4vars.id = 0; \
(p)->icmpv4vars.seq = 0; \
(p)->icmpv4vars.mtu = 0; \
@ -288,8 +284,6 @@ typedef struct ICMPV4Vars_
ICMPV4_GET_TYPE((p)) == ICMP_PARAMETERPROB)
typedef struct ICMPV4Cache_ {
/* checksum computed over the icmpv4 packet */
int32_t comp_csum;
} ICMPV4Cache;
void DecodeICMPV4RegisterTests(void);

12
src/decode-icmpv6.c
Unescape Escape View File

@ -180,8 +180,6 @@ void DecodeICMPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
if (ICMPV6_GET_CODE(p) > ICMP6_DST_UNREACH_REJECTROUTE) {
DECODER_SET_EVENT(p, ICMPV6_UNKNOWN_CODE);
} else {
p->icmpv6vars.type = ICMPV6_GET_TYPE(p);
p->icmpv6vars.code = ICMPV6_GET_CODE(p);
DecodePartialIPV6(p, (uint8_t*) (pkt + ICMPV6_HEADER_LEN),
len - ICMPV6_HEADER_LEN );
}
@ -193,8 +191,6 @@ void DecodeICMPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
if (ICMPV6_GET_CODE(p) != 0) {
DECODER_SET_EVENT(p, ICMPV6_UNKNOWN_CODE);
} else {
p->icmpv6vars.type = ICMPV6_GET_TYPE(p);
p->icmpv6vars.code = ICMPV6_GET_CODE(p);
p->icmpv6vars.mtu = ICMPV6_GET_MTU(p);
DecodePartialIPV6(p, (uint8_t*) (pkt + ICMPV6_HEADER_LEN),
len - ICMPV6_HEADER_LEN );
@ -207,8 +203,6 @@ void DecodeICMPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
if (ICMPV6_GET_CODE(p) > ICMP6_TIME_EXCEED_REASSEMBLY) {
DECODER_SET_EVENT(p, ICMPV6_UNKNOWN_CODE);
} else {
p->icmpv6vars.type = ICMPV6_GET_TYPE(p);
p->icmpv6vars.code= ICMPV6_GET_CODE(p);
DecodePartialIPV6(p, (uint8_t*) (pkt + ICMPV6_HEADER_LEN),
len - ICMPV6_HEADER_LEN );
}
@ -220,8 +214,6 @@ void DecodeICMPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
if (ICMPV6_GET_CODE(p) > ICMP6_PARAMPROB_OPTION) {
DECODER_SET_EVENT(p, ICMPV6_UNKNOWN_CODE);
} else {
p->icmpv6vars.type = ICMPV6_GET_TYPE(p);
p->icmpv6vars.code= ICMPV6_GET_CODE(p);
p->icmpv6vars.error_ptr= ICMPV6_GET_ERROR_PTR(p);
DecodePartialIPV6(p, (uint8_t*) (pkt + ICMPV6_HEADER_LEN),
len - ICMPV6_HEADER_LEN );
@ -235,8 +227,6 @@ void DecodeICMPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
if (ICMPV6_GET_CODE(p) != 0) {
DECODER_SET_EVENT(p, ICMPV6_UNKNOWN_CODE);
} else {
p->icmpv6vars.type = ICMPV6_GET_TYPE(p);
p->icmpv6vars.code= ICMPV6_GET_CODE(p);
p->icmpv6vars.id = p->icmpv6h->icmpv6b.icmpv6i.id;
p->icmpv6vars.seq = p->icmpv6h->icmpv6b.icmpv6i.seq;
}
@ -249,8 +239,6 @@ void DecodeICMPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
if (p->icmpv6h->code != 0) {
DECODER_SET_EVENT(p, ICMPV6_UNKNOWN_CODE);
} else {
p->icmpv6vars.type = ICMPV6_GET_TYPE(p);
p->icmpv6vars.code= ICMPV6_GET_CODE(p);
p->icmpv6vars.id = p->icmpv6h->icmpv6b.icmpv6i.id;
p->icmpv6vars.seq = p->icmpv6h->icmpv6b.icmpv6i.seq;
}

23
src/decode-icmpv6.h
Unescape Escape View File

@ -108,35 +108,30 @@ typedef struct ICMPV6Info_
uint16_t seq;
} ICMPV6Info;
typedef struct ICMPV6Cache_ {
/* checksum computed over the icmpv6 packet */
int32_t comp_csum;
} ICMPV6Cache;
/** ICMPv6 header structure */
typedef struct ICMPV6Hdr_
{
uint8_t type;
uint8_t code;
uint16_t csum;
union{
union {
ICMPV6Info icmpv6i; /** Informational message */
union
{
uint32_t unused; /** for types 1 and 3, should be zero */
uint32_t error_ptr; /** for type 4, pointer to the octet that originate the error */
uint32_t mtu; /** for type 2, the Maximum Transmission Unit of the next-hop link */
}icmpv6e; /** Error Message */
}icmpv6b;
} icmpv6e; /** Error Message */
} icmpv6b;
} ICMPV6Hdr;
/** Data available from the decoded packet */
typedef struct ICMPV6Vars_ {
uint8_t type;
uint8_t code;
/* checksum computed over the icmpv6 packet */
int32_t comp_csum;
/* checksum of the icmpv6 packet */
uint16_t csum;
uint16_t id;
uint16_t seq;
uint32_t mtu;
@ -159,10 +154,9 @@ typedef struct ICMPV6Vars_ {
} ICMPV6Vars;
#define CLEAR_ICMPV6_PACKET(p) do { \
(p)->icmpv6vars.type = 0; \
(p)->icmpv6vars.code = 0; \
(p)->icmpv6vars.csum = -1; \
(p)->icmpv6vars.comp_csum = -1; \
(p)->icmpv6vars.id = 0; \
(p)->icmpv6vars.seq = 0; \
(p)->icmpv6vars.mtu = 0; \
@ -180,6 +174,7 @@ typedef struct ICMPV6Vars_ {
(p)->icmpv6vars.emb_dport = 0; \
(p)->icmpv6h = NULL; \
} while(0)
void DecodeICMPV6RegisterTests(void);
/** -------- Inline functions --------- */

3
src/decode-ipv4.c
Unescape Escape View File

@ -507,9 +507,6 @@ void DecodeIPV4(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt,
{
SCPerfCounterIncr(dtv->counter_ipv4, tv->sc_perf_pca);
/* reset the decoder cache flags */
IPV4_CACHE_INIT(p);
SCLogDebug("pkt %p len %"PRIu16"", pkt, len);
/* do the actual decoding */

101
src/decode-ipv4.h
Unescape Escape View File

@ -104,97 +104,45 @@ typedef struct IPV4Hdr_
#define IPV4_SET_RAW_IPLEN(ip4h, value) ((ip4h)->ip_len = value)
#define IPV4_SET_RAW_IPPROTO(ip4h, value) ((ip4h)->ip_proto = value)
/* this is enough since noone will access the cache without first
* checking the flags */
#define IPV4_CACHE_INIT(p) (p)->ip4c.flags = 0
/* ONLY call these functions after making sure that:
* 1. p->ip4h is set
* 2. p->ip4h is valid (len is correct)
* 3. cache is initialized
*/
#define IPV4_GET_VER(p) \
((p)->ip4c.flags & IPV4_CACHE_VER ? \
(p)->ip4c.ver : ((p)->ip4c.flags |= IPV4_CACHE_VER, (p)->ip4c.ver = IPV4_GET_RAW_VER((p)->ip4h)))
IPV4_GET_RAW_VER((p)->ip4h)
#define IPV4_GET_HLEN(p) \
((p)->ip4c.flags & IPV4_CACHE_HLEN ? \
(p)->ip4c.hl : ((p)->ip4c.flags |= IPV4_CACHE_HLEN, (p)->ip4c.hl = IPV4_GET_RAW_HLEN((p)->ip4h) << 2))
(IPV4_GET_RAW_HLEN((p)->ip4h) << 2)
#define IPV4_GET_IPTOS(p) \
IPV4_GET_RAW_IPTOS((p)->ip4h)
IPV4_GET_RAW_IPTOS((p)->ip4h)
#define IPV4_GET_IPLEN(p) \
((p)->ip4c.flags & IPV4_CACHE_IPLEN ? \
(p)->ip4c.ip_len : ((p)->ip4c.flags |= IPV4_CACHE_IPLEN, (p)->ip4c.ip_len = ntohs(IPV4_GET_RAW_IPLEN((p)->ip4h))))
(ntohs(IPV4_GET_RAW_IPLEN((p)->ip4h)))
#define IPV4_GET_IPID(p) \
((p)->ip4c.flags & IPV4_CACHE_IPID ? \
(p)->ip4c.ip_id : ((p)->ip4c.flags |= IPV4_CACHE_IPID, (p)->ip4c.ip_id = ntohs(IPV4_GET_RAW_IPID((p)->ip4h))))
(ntohs(IPV4_GET_RAW_IPID((p)->ip4h)))
/* _IPV4_GET_IPOFFSET: get the content of the offset header field in host order */
#define _IPV4_GET_IPOFFSET(p) \
((p)->ip4c.flags & IPV4_CACHE__IPOFF ? \
(p)->ip4c._ip_off : ((p)->ip4c.flags |= IPV4_CACHE__IPOFF, (p)->ip4c._ip_off = ntohs(IPV4_GET_RAW_IPOFFSET((p)->ip4h))))
(ntohs(IPV4_GET_RAW_IPOFFSET((p)->ip4h)))
/* IPV4_GET_IPOFFSET: get the final offset */
#define IPV4_GET_IPOFFSET(p) \
((p)->ip4c.flags & IPV4_CACHE_IPOFF ? \
(p)->ip4c.ip_off : ((p)->ip4c.flags |= IPV4_CACHE_IPOFF, (p)->ip4c.ip_off = _IPV4_GET_IPOFFSET(p) & 0x1fff))
(_IPV4_GET_IPOFFSET(p) & 0x1fff)
/* IPV4_GET_RF: get the RF flag. Use _IPV4_GET_IPOFFSET to save a ntohs call. */
#define IPV4_GET_RF(p) \
((p)->ip4c.flags & IPV4_CACHE_RF ? \
(p)->ip4c.rf : ((p)->ip4c.flags |= IPV4_CACHE_RF, (p)->ip4c.rf = (uint8_t)((_IPV4_GET_IPOFFSET((p)) & 0x8000) >> 15)))
(uint8_t)((_IPV4_GET_IPOFFSET((p)) & 0x8000) >> 15)
/* IPV4_GET_DF: get the DF flag. Use _IPV4_GET_IPOFFSET to save a ntohs call. */
#define IPV4_GET_DF(p) \
((p)->ip4c.flags & IPV4_CACHE_DF ? \
(p)->ip4c.df : ((p)->ip4c.flags |= IPV4_CACHE_DF, (p)->ip4c.df = (uint8_t)((_IPV4_GET_IPOFFSET((p)) & 0x4000) >> 14)))
(uint8_t)((_IPV4_GET_IPOFFSET((p)) & 0x4000) >> 14)
/* IPV4_GET_MF: get the MF flag. Use _IPV4_GET_IPOFFSET to save a ntohs call. */
#define IPV4_GET_MF(p) \
((p)->ip4c.flags & IPV4_CACHE_MF ? \
(p)->ip4c.mf : ((p)->ip4c.flags |= IPV4_CACHE_MF, (p)->ip4c.mf = (uint8_t)((_IPV4_GET_IPOFFSET((p)) & 0x2000) >> 13)))
(uint8_t)((_IPV4_GET_IPOFFSET((p)) & 0x2000) >> 13)
#define IPV4_GET_IPTTL(p) \
IPV4_GET_RAW_IPTTL(p->ip4h)
#define IPV4_GET_IPPROTO(p) \
((p)->ip4c.flags & IPV4_CACHE_IPPROTO ? \
(p)->ip4c.ip_proto : ((p)->ip4c.flags |= IPV4_CACHE_IPPROTO, (p)->ip4c.ip_proto = IPV4_GET_RAW_IPPROTO((p)->ip4h)))
#define IPV4_CACHE_VER 0x0001 /* 1 */
#define IPV4_CACHE_HLEN 0x0002 /* 2 */
#define IPV4_CACHE_IPTOS 0x0004 /* 4 */
#define IPV4_CACHE_IPLEN 0x0008 /* 8 */
#define IPV4_CACHE_IPID 0x0010 /* 16 */
#define IPV4_CACHE_IPOFF 0x0020 /* 32 */
#define IPV4_CACHE__IPOFF 0x0040 /* 64 */
#define IPV4_CACHE_RF 0x0080 /* 128*/
#define IPV4_CACHE_DF 0x0100 /* 256 */
#define IPV4_CACHE_MF 0x0200 /* 512 */
#define IPV4_CACHE_IPTTL 0x0400 /* 1024*/
#define IPV4_CACHE_IPPROTO 0x0800 /* 2048 */
/**
* IPv4 decoder cache
*
* Used for storing parsed values.
*/
typedef struct IPV4Cache_
{
uint16_t flags;
uint8_t ver;
uint8_t hl;
uint8_t ip_tos; /* type of service */
uint16_t ip_len; /* datagram length */
uint16_t ip_id; /* identification */
uint16_t ip_off; /* fragment offset */
uint16_t _ip_off; /* fragment offset - full field value, host order*/
uint8_t rf;
uint8_t df;
uint8_t mf;
uint8_t ip_ttl; /* time to live field */
uint8_t ip_proto; /* datagram protocol */
uint16_t ip_csum; /* checksum */
int32_t comp_csum; /* checksum computed over the ipv4 packet */
uint32_t ip_src_u32; /* source IP */
uint32_t ip_dst_u32; /* dest IP */
} IPV4Cache;
IPV4_GET_RAW_IPPROTO((p)->ip4h)
#define CLEAR_IPV4_PACKET(p) do { \
(p)->ip4h = NULL; \
(p)->ip4vars.comp_csum = 0; \
(p)->ip4vars.ip_src_u32 = 0; \
(p)->ip4vars.ip_dst_u32 = 0; \
(p)->ip4vars.ip_opt_cnt = 0; \
(p)->ip4vars.o_rr = NULL; \
(p)->ip4vars.o_qs = NULL; \
@ -205,28 +153,15 @@ typedef struct IPV4Cache_
(p)->ip4vars.o_sid = NULL; \
(p)->ip4vars.o_ssrr = NULL; \
(p)->ip4vars.o_rtralt = NULL; \
(p)->ip4c.flags = 0; \
(p)->ip4c.ver = 0; \
(p)->ip4c.hl = 0; \
(p)->ip4c.ip_tos = 0; \
(p)->ip4c.ip_len = 0; \
(p)->ip4c.ip_id = 0; \
(p)->ip4c.ip_off = 0; \
(p)->ip4c._ip_off = 0; \
(p)->ip4c.rf = 0; \
(p)->ip4c.df = 0; \
(p)->ip4c.mf = 0; \
(p)->ip4c.ip_ttl = 0; \
(p)->ip4c.ip_proto = 0; \
(p)->ip4c.ip_csum = 0; \
(p)->ip4c.comp_csum = 0; \
(p)->ip4c.ip_src_u32 = 0; \
(p)->ip4c.ip_dst_u32 = 0; \
} while (0)
/* helper structure with parsed ipv4 info */
typedef struct IPV4Vars_
{
int32_t comp_csum; /* checksum computed over the ipv4 packet */
uint32_t ip_src_u32; /* source IP */
uint32_t ip_dst_u32; /* dest IP */
IPV4Opt ip_opts[IPV4_OPTMAX];
uint8_t ip_opt_cnt;

2
src/decode-ipv6.c
Unescape Escape View File

@ -416,8 +416,6 @@ void DecodeIPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt,
SCPerfCounterIncr(dtv->counter_ipv6, tv->sc_perf_pca);
IPV6_CACHE_INIT(p);
/* do the actual decoding */
ret = DecodeIPV6Packet (tv, dtv, p, pkt, len);
if (ret < 0) {

43
src/decode-ipv6.h
Unescape Escape View File

@ -61,54 +61,26 @@ typedef struct IPV6Hdr_
#define IPV6_SET_L4PROTO(p,proto) (p)->ip6vars.l4proto = proto
/* this is enough since noone will access the cache without first
* checking the flags */
#define IPV6_CACHE_INIT(p) (p)->ip6c.flags = 0
/* ONLY call these functions after making sure that:
* 1. p->ip6h is set
* 2. p->ip6h is valid (len is correct)
* 3. cache is initialized
*/
#define IPV6_GET_VER(p) \
((p)->ip6c.flags & IPV6_CACHE_VER ? \
(p)->ip6c.ver : ((p)->ip6c.flags |= IPV6_CACHE_VER, (p)->ip6c.ver = IPV6_GET_RAW_VER((p)->ip6h)))
IPV6_GET_RAW_VER((p)->ip6h)
#define IPV6_GET_CLASS(p) \
((p)->ip6c.flags & IPV6_CACHE_CLASS ? \
(p)->ip6c.cl : ((p)->ip6c.flags |= IPV6_CACHE_CLASS, (p)->ip6c.cl = IPV6_GET_RAW_CLASS((p)->ip6h)))
IPV6_GET_RAW_CLASS((p)->ip6h)
#define IPV6_GET_FLOW(p) \
((p)->ip6c.flags & IPV6_CACHE_FLOW ? \
(p)->ip6c.flow : ((p)->ip6c.flags |= IPV6_CACHE_FLOW, (p)->ip6c.flow = IPV6_GET_RAW_FLOW((p)->ip6h)))
IPV6_GET_RAW_FLOW((p)->ip6h)
#define IPV6_GET_NH(p) \
(IPV6_GET_RAW_NH((p)->ip6h))
#define IPV6_GET_PLEN(p) \
((p)->ip6c.flags & IPV6_CACHE_PLEN ? \
(p)->ip6c.plen : ((p)->ip6c.flags |= IPV6_CACHE_PLEN, (p)->ip6c.plen = IPV6_GET_RAW_PLEN((p)->ip6h)))
IPV6_GET_RAW_PLEN((p)->ip6h)
#define IPV6_GET_HLIM(p) \
(IPV6_GET_RAW_HLIM((p)->ip6h))
/* XXX */
#define IPV6_GET_L4PROTO(p) \
((p)->ip6vars.l4proto)
#define IPV6_CACHE_VER 0x0001 /* 1 */
#define IPV6_CACHE_CLASS 0x0002 /* 2 */
#define IPV6_CACHE_FLOW 0x0004 /* 4 */
#define IPV6_CACHE_NH 0x0008 /* 8 */
#define IPV6_CACHE_PLEN 0x0010 /* 16 */
#define IPV6_CACHE_HLIM 0x0020 /* 32 */
/* decoder cache */
typedef struct IPV6Cache_
{
uint16_t flags;
uint8_t ver;
uint8_t cl;
uint8_t flow;
uint8_t nh;
uint16_t plen;
uint8_t hlim;
} IPV6Cache;
/* helper structure with parsed ipv6 info */
typedef struct IPV6Vars_
{
@ -120,13 +92,6 @@ typedef struct IPV6Vars_
#define CLEAR_IPV6_PACKET(p) do { \
(p)->ip6h = NULL; \
(p)->ip6c.flags = 0; \
(p)->ip6c.ver = 0; \
(p)->ip6c.cl = 0; \
(p)->ip6c.flow = 0; \
(p)->ip6c.nh = 0; \
(p)->ip6c.plen = 0; \
(p)->ip6c.hlim = 0; \
(p)->ip6vars.ip_opts_len = 0; \
(p)->ip6vars.l4proto = 0; \
(p)->ip6eh.ip6fh = NULL; \

26
src/decode-tcp.h
Unescape Escape View File

@ -81,15 +81,13 @@
/** macro for getting the first timestamp from the packet. Timestamp is in host
* order and either returned from the cache or from the packet directly. */
#define TCP_GET_TSVAL(p) ((p)->tcpc.ts1 != 0 ? \
(p)->tcpc.ts1 : (p)->tcpvars.ts ? \
((p)->tcpc.ts1 = (uint32_t)ntohl((*(uint32_t *)(p)->tcpvars.ts->data))) : 0)
#define TCP_GET_TSVAL(p) \
(uint32_t)ntohl((*(uint32_t *)(p)->tcpvars.ts->data))
/** macro for getting the second timestamp from the packet. Timestamp is in
* host order and either returned from the cache or from the packet directly. */
#define TCP_GET_TSECR(p) ((p)->tcpc.ts2 != 0 ? \
(p)->tcpc.ts2 : (p)->tcpvars.ts ? \
((p)->tcpc.ts2 = (uint32_t)ntohl((*(uint32_t *)((p)->tcpvars.ts->data+4)))) : 0)
#define TCP_GET_TSECR(p) \
(uint32_t)ntohl((*(uint32_t *)((p)->tcpvars.ts->data+4)))
/** macro for getting the wscale from the packet. */
#define TCP_GET_WSCALE(p) ((p)->tcpvars.ws ? (((*(uint8_t *)(p)->tcpvars.ws->data) <= TCP_WSCALE_MAX) ? (*(uint8_t *)((p)->tcpvars.ws->data)) : 0) : 0)
@ -142,6 +140,9 @@ typedef struct TCPHdr_
typedef struct TCPVars_
{
/* checksum computed over the tcp(for both ipv4 and ipv6) packet */
int32_t comp_csum;
uint8_t tcp_opt_cnt;
TCPOpt tcp_opts[TCP_OPTMAX];
@ -153,26 +154,15 @@ typedef struct TCPVars_
TCPOpt *mss;
} TCPVars;
/** cache to store parsed/calculated results of the decoder */
typedef struct TCPCache_ {
/* checksum computed over the tcp(for both ipv4 and ipv6) packet */
int32_t comp_csum;
uint32_t ts1; /**< host order version of the first ts */
uint32_t ts2; /**< host order version of the second ts */
} TCPCache;
#define CLEAR_TCP_PACKET(p) { \
(p)->tcph = NULL; \
(p)->tcpvars.comp_csum = -1; \
(p)->tcpvars.tcp_opt_cnt = 0; \
(p)->tcpvars.ts = NULL; \
(p)->tcpvars.sack = NULL; \
(p)->tcpvars.sackok = NULL; \
(p)->tcpvars.ws = NULL; \
(p)->tcpvars.mss = NULL; \
(p)->tcpc.comp_csum = -1; \
(p)->tcpc.ts1 = 0; \
(p)->tcpc.ts2 = 0; \
}
void DecodeTCPRegisterTests(void);

1
src/decode-udp.c
Unescape Escape View File

@ -54,7 +54,6 @@ static int DecodeUDPPacket(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len)
SET_UDP_SRC_PORT(p,&p->sp);
SET_UDP_DST_PORT(p,&p->dp);
p->udpvars.hlen = UDP_HEADER_LEN;
p->payload = pkt + UDP_HEADER_LEN;
p->payload_len = len - UDP_HEADER_LEN;

9
src/decode-udp.h
Unescape Escape View File

@ -46,18 +46,13 @@ typedef struct UDPHdr_
typedef struct UDPVars_
{
uint8_t hlen;
} UDPVars;
typedef struct UDPCache_ {
/* checksum computed over the udp(for both ipv4 and ipv6) packet */
int32_t comp_csum;
} UDPCache;
} UDPVars;
#define CLEAR_UDP_PACKET(p) do { \
(p)->udpvars.hlen = 0; \
(p)->udpc.comp_csum = -1; \
(p)->udph = NULL; \
(p)->udpvars.comp_csum = -1; \
} while (0)
void DecodeUDPV4RegisterTests(void);

16
src/decode.h
Unescape Escape View File

@ -333,29 +333,23 @@ typedef struct Packet_
IPV4Hdr *ip4h;
IPV4Vars ip4vars;
IPV4Cache ip4c;
IPV6Hdr *ip6h;
IPV6Vars ip6vars;
IPV6Cache ip6c;
IPV6ExtHdrs ip6eh;
TCPHdr *tcph;
TCPVars tcpvars;
TCPCache tcpc;
UDPHdr *udph;
UDPVars udpvars;
UDPCache udpc;
SCTPHdr *sctph;
ICMPV4Hdr *icmpv4h;
ICMPV4Cache icmpv4c;
ICMPV4Vars icmpv4vars;
ICMPV6Hdr *icmpv6h;
ICMPV6Cache icmpv6c;
ICMPV6Vars icmpv6vars;
PPPHdr *ppph;
@ -491,11 +485,11 @@ typedef struct DecodeThreadVars_
* \brief reset these to -1(indicates that the packet is fresh from the queue)
*/
#define PACKET_RESET_CHECKSUMS(p) do { \
(p)->ip4c.comp_csum = -1; \
(p)->tcpc.comp_csum = -1; \
(p)->udpc.comp_csum = -1; \
(p)->icmpv4c.comp_csum = -1; \
(p)->icmpv6c.comp_csum = -1; \
(p)->ip4vars.comp_csum = -1; \
(p)->tcpvars.comp_csum = -1; \
(p)->udpvars.comp_csum = -1; \
(p)->icmpv4vars.comp_csum = -1; \
(p)->icmpv6vars.comp_csum = -1; \
} while (0)
/**

4
src/defrag.c
Unescape Escape View File

@ -610,7 +610,6 @@ Defrag4Reassemble(ThreadVars *tv, DefragContext *dc, DefragTracker *tracker,
rp->ip4h->ip_csum = FixChecksum(rp->ip4h->ip_csum,
old, rp->ip4h->ip_len + rp->ip4h->ip_off);
SET_PKT_LEN(rp, ip_hdr_offset + hlen + fragmentable_len);
IPV4_CACHE_INIT(rp);
remove_tracker:
/* Remove the frag tracker. */
@ -722,7 +721,6 @@ Defrag6Reassemble(ThreadVars *tv, DefragContext *dc, DefragTracker *tracker,
rp->ip6h->s_ip6_plen = htons(fragmentable_len);
rp->ip6h->s_ip6_nxt = next_hdr;
SET_PKT_LEN(rp, ip_hdr_offset + sizeof(IPV6Hdr) + fragmentable_len);
IPV6_CACHE_INIT(rp);
remove_tracker:
/* Remove the frag tracker. */
@ -1310,7 +1308,6 @@ BuildTestPacket(uint16_t id, uint16_t off, int mf, const char content,
p->ip4h->ip_csum = IPV4CalculateChecksum((uint16_t *)GET_PKT_DATA(p), hlen);
/* Self test. */
IPV4_CACHE_INIT(p);
if (IPV4_GET_VER(p) != 4)
goto error;
if (IPV4_GET_HLEN(p) != hlen)
@ -1387,7 +1384,6 @@ IPV6BuildTestPacket(uint32_t id, uint16_t off, int mf, const char content,
SET_IPV6_DST_ADDR(p, &p->dst);
/* Self test. */
IPV6_CACHE_INIT(p);
if (IPV6_GET_VER(p) != 6)
goto error;
if (IPV6_GET_NH(p) != 44)

60
src/detect-csum.c
Unescape Escape View File

@ -233,13 +233,13 @@ int DetectIPV4CsumMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
if (p->ip4h == NULL)
return 0;
if (p->ip4c.comp_csum == -1)
p->ip4c.comp_csum = IPV4CalculateChecksum((uint16_t *)p->ip4h,
if (p->ip4vars.comp_csum == -1)
p->ip4vars.comp_csum = IPV4CalculateChecksum((uint16_t *)p->ip4h,
IPV4_GET_RAW_HLEN(p->ip4h));
if (p->ip4c.comp_csum == p->ip4h->ip_csum && cd->valid == 1)
if (p->ip4vars.comp_csum == p->ip4h->ip_csum && cd->valid == 1)
return 1;
else if (p->ip4c.comp_csum != p->ip4h->ip_csum && cd->valid == 0)
else if (p->ip4vars.comp_csum != p->ip4h->ip_csum && cd->valid == 0)
return 1;
else
return 0;
@ -323,14 +323,14 @@ int DetectTCPV4CsumMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
if (p->ip4h == NULL || p->proto != IPPROTO_TCP || PKT_IS_PSEUDOPKT(p))
return 0;
if (p->tcpc.comp_csum == -1)
p->tcpc.comp_csum = TCPCalculateChecksum((uint16_t *)&(p->ip4h->ip_src),
if (p->tcpvars.comp_csum == -1)
p->tcpvars.comp_csum = TCPCalculateChecksum((uint16_t *)&(p->ip4h->ip_src),
(uint16_t *)p->tcph,
(p->payload_len + TCP_GET_HLEN(p)));
if (p->tcpc.comp_csum == p->tcph->th_sum && cd->valid == 1)
if (p->tcpvars.comp_csum == p->tcph->th_sum && cd->valid == 1)
return 1;
else if (p->tcpc.comp_csum != p->tcph->th_sum && cd->valid == 0)
else if (p->tcpvars.comp_csum != p->tcph->th_sum && cd->valid == 0)
return 1;
else
return 0;
@ -414,14 +414,14 @@ int DetectTCPV6CsumMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
if (p->ip6h == NULL || p->proto != IPPROTO_TCP || PKT_IS_PSEUDOPKT(p))
return 0;
if (p->tcpc.comp_csum == -1)
p->tcpc.comp_csum = TCPV6CalculateChecksum((uint16_t *)&(p->ip6h->ip6_src),
if (p->tcpvars.comp_csum == -1)
p->tcpvars.comp_csum = TCPV6CalculateChecksum((uint16_t *)&(p->ip6h->ip6_src),
(uint16_t *)p->tcph,
(p->payload_len + TCP_GET_HLEN(p)));
if (p->tcpc.comp_csum == p->tcph->th_sum && cd->valid == 1)
if (p->tcpvars.comp_csum == p->tcph->th_sum && cd->valid == 1)
return 1;
else if (p->tcpc.comp_csum != p->tcph->th_sum && cd->valid == 0)
else if (p->tcpvars.comp_csum != p->tcph->th_sum && cd->valid == 0)
return 1;
else
return 0;
@ -505,15 +505,15 @@ int DetectUDPV4CsumMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
if (p->ip4h == NULL || p->proto != IPPROTO_UDP || PKT_IS_PSEUDOPKT(p))
return 0;
if (p->udpc.comp_csum == -1)
p->udpc.comp_csum = UDPV4CalculateChecksum((uint16_t *)&(p->ip4h->ip_src),
if (p->udpvars.comp_csum == -1)
p->udpvars.comp_csum = UDPV4CalculateChecksum((uint16_t *)&(p->ip4h->ip_src),
(uint16_t *)p->udph,
(p->payload_len +
p->udpvars.hlen) );
UDP_HEADER_LEN) );
if (p->udpc.comp_csum == p->udph->uh_sum && cd->valid == 1)
if (p->udpvars.comp_csum == p->udph->uh_sum && cd->valid == 1)
return 1;
else if (p->udpc.comp_csum != p->udph->uh_sum && cd->valid == 0)
else if (p->udpvars.comp_csum != p->udph->uh_sum && cd->valid == 0)
return 1;
else
return 0;
@ -597,15 +597,15 @@ int DetectUDPV6CsumMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
if (p->ip6h == NULL || p->proto != IPPROTO_UDP || PKT_IS_PSEUDOPKT(p))
return 0;
if (p->udpc.comp_csum == -1)
p->udpc.comp_csum = UDPV6CalculateChecksum((uint16_t *)&(p->ip6h->ip6_src),
if (p->udpvars.comp_csum == -1)
p->udpvars.comp_csum = UDPV6CalculateChecksum((uint16_t *)&(p->ip6h->ip6_src),
(uint16_t *)p->udph,
(p->payload_len +
p->udpvars.hlen) );
UDP_HEADER_LEN) );
if (p->udpc.comp_csum == p->udph->uh_sum && cd->valid == 1)
if (p->udpvars.comp_csum == p->udph->uh_sum && cd->valid == 1)
return 1;
else if (p->udpc.comp_csum != p->udph->uh_sum && cd->valid == 0)
else if (p->udpvars.comp_csum != p->udph->uh_sum && cd->valid == 0)
return 1;
else
return 0;
@ -689,14 +689,14 @@ int DetectICMPV4CsumMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
if (p->ip4h == NULL || p->proto != IPPROTO_ICMP || PKT_IS_PSEUDOPKT(p))
return 0;
if (p->icmpv4c.comp_csum == -1)
p->icmpv4c.comp_csum = ICMPV4CalculateChecksum((uint16_t *)p->icmpv4h,
if (p->icmpv4vars.comp_csum == -1)
p->icmpv4vars.comp_csum = ICMPV4CalculateChecksum((uint16_t *)p->icmpv4h,
ntohs(IPV4_GET_RAW_IPLEN(p->ip4h)) -
IPV4_GET_RAW_HLEN(p->ip4h) * 4);
if (p->icmpv4c.comp_csum == p->icmpv4h->checksum && cd->valid == 1)
if (p->icmpv4vars.comp_csum == p->icmpv4h->checksum && cd->valid == 1)
return 1;
else if (p->icmpv4c.comp_csum != p->icmpv4h->checksum && cd->valid == 0)
else if (p->icmpv4vars.comp_csum != p->icmpv4h->checksum && cd->valid == 0)
return 1;
else
return 0;
@ -780,14 +780,14 @@ int DetectICMPV6CsumMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
if (p->ip6h == NULL || p->proto != IPPROTO_ICMPV6 || PKT_IS_PSEUDOPKT(p))
return 0;
if (p->icmpv6c.comp_csum == -1)
p->icmpv6c.comp_csum = ICMPV6CalculateChecksum((uint16_t *)&(p->ip6h->ip6_src),
if (p->icmpv6vars.comp_csum == -1)
p->icmpv6vars.comp_csum = ICMPV6CalculateChecksum((uint16_t *)&(p->ip6h->ip6_src),
(uint16_t *)p->icmpv6h,
IPV6_GET_PLEN(p));
if (p->icmpv6c.comp_csum == p->icmpv6h->csum && cd->valid == 1)
if (p->icmpv6vars.comp_csum == p->icmpv6h->csum && cd->valid == 1)
return 1;
else if (p->icmpv6c.comp_csum != p->icmpv6h->csum && cd->valid == 0)
else if (p->icmpv6vars.comp_csum != p->icmpv6h->csum && cd->valid == 0)
return 1;
else
return 0;

22
src/detect-fragbits.c
Unescape Escape View File

@ -53,6 +53,10 @@
#define MODIFIER_PLUS 2
#define MODIFIER_ANY 3
#define FRAGBITS_HAVE_MF 0x01
#define FRAGBITS_HAVE_DF 0x02
#define FRAGBITS_HAVE_RF 0x04
static pcre *parse_regex;
static pcre_extra *parse_regex_study;
@ -117,11 +121,11 @@ static int DetectFragBitsMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, P
return ret;
if(IPV4_GET_MF(p))
fragbits |= IPV4_CACHE_MF;
fragbits |= FRAGBITS_HAVE_MF;
if(IPV4_GET_DF(p))
fragbits |= IPV4_CACHE_DF;
fragbits |= FRAGBITS_HAVE_DF;
if(IPV4_GET_RF(p))
fragbits |= IPV4_CACHE_RF;
fragbits |= FRAGBITS_HAVE_RF;
switch(de->modifier) {
case MODIFIER_ANY:
@ -225,17 +229,17 @@ static DetectFragBitsData *DetectFragBitsParse (char *rawstr)
switch (*ptr) {
case 'M':
case 'm':
de->fragbits |= IPV4_CACHE_MF;
de->fragbits |= FRAGBITS_HAVE_MF;
found++;
break;
case 'D':
case 'd':
de->fragbits |= IPV4_CACHE_DF;
de->fragbits |= FRAGBITS_HAVE_DF;
found++;
break;
case 'R':
case 'r':
de->fragbits |= IPV4_CACHE_RF;
de->fragbits |= FRAGBITS_HAVE_RF;
found++;
break;
default:
@ -326,7 +330,7 @@ static void DetectFragBitsFree(void *de_ptr) {
static int FragBitsTestParse01 (void) {
DetectFragBitsData *de = NULL;
de = DetectFragBitsParse("M");
if (de && (de->fragbits == IPV4_CACHE_MF) ) {
if (de && (de->fragbits == FRAGBITS_HAVE_MF) ) {
DetectFragBitsFree(de);
return 1;
}
@ -421,7 +425,7 @@ static int FragBitsTestParse03 (void) {
de = DetectFragBitsParse("D");
if (de == NULL || (de->fragbits != IPV4_CACHE_DF))
if (de == NULL || (de->fragbits != FRAGBITS_HAVE_DF))
goto error;
sm = SigMatchAlloc();
@ -520,7 +524,7 @@ static int FragBitsTestParse04 (void) {
de = DetectFragBitsParse("!D");
if (de == NULL || (de->fragbits != IPV4_CACHE_DF) || (de->modifier != MODIFIER_NOT))
if (de == NULL || (de->fragbits != FRAGBITS_HAVE_DF) || (de->modifier != MODIFIER_NOT))
goto error;
sm = SigMatchAlloc();

88
src/detect.c
Unescape Escape View File

@ -5816,8 +5816,8 @@ int SigTest24IPV4Keyword(void)
p1->pkt = (uint8_t *)(p1 + 1);
memset(p2, 0, SIZE_OF_PACKET);
p2->pkt = (uint8_t *)(p2 + 1);
p1->ip4c.comp_csum = -1;
p2->ip4c.comp_csum = -1;
p1->ip4vars.comp_csum = -1;
p2->ip4vars.comp_csum = -1;
p1->ip4h = (IPV4Hdr *)valid_raw_ipv4;
@ -5920,8 +5920,8 @@ int SigTest25NegativeIPV4Keyword(void)
p1->pkt = (uint8_t *)(p1 + 1);
memset(p2, 0, SIZE_OF_PACKET);
p2->pkt = (uint8_t *)(p2 + 1);
p1->ip4c.comp_csum = -1;
p2->ip4c.comp_csum = -1;
p1->ip4vars.comp_csum = -1;
p2->ip4vars.comp_csum = -1;
p1->ip4h = (IPV4Hdr *)valid_raw_ipv4;
@ -6039,7 +6039,7 @@ int SigTest26TCPV4Keyword(void)
memcpy(p2->pkt + p2->pktlen, invalid_raw_tcp, sizeof(invalid_raw_tcp));
p2->pktlen += sizeof(invalid_raw_tcp);
p1->tcpc.comp_csum = -1;
p1->tcpvars.comp_csum = -1;
p1->ip4h = (IPV4Hdr *)p1->pkt;
p1->tcph = (TCPHdr *)(p1->pkt + sizeof(raw_ipv4));
p1->src.family = AF_INET;
@ -6048,7 +6048,7 @@ int SigTest26TCPV4Keyword(void)
p1->payload_len = 20;
p1->proto = IPPROTO_TCP;
p2->tcpc.comp_csum = -1;
p2->tcpvars.comp_csum = -1;
p2->ip4h = (IPV4Hdr *)p2->pkt;
p2->tcph = (TCPHdr *)(p2->pkt + sizeof(raw_ipv4));
p2->src.family = AF_INET;
@ -6155,7 +6155,7 @@ int SigTest27NegativeTCPV4Keyword(void)
memcpy(p2->pkt + p2->pktlen, invalid_raw_tcp, sizeof(invalid_raw_tcp));
p2->pktlen += sizeof(invalid_raw_tcp);
p1->tcpc.comp_csum = -1;
p1->tcpvars.comp_csum = -1;
p1->ip4h = (IPV4Hdr *)p1->pkt;
p1->tcph = (TCPHdr *)(p1->pkt + sizeof(raw_ipv4));
p1->src.family = AF_INET;
@ -6164,7 +6164,7 @@ int SigTest27NegativeTCPV4Keyword(void)
p1->payload_len = 20;
p1->proto = IPPROTO_TCP;
p2->tcpc.comp_csum = -1;
p2->tcpvars.comp_csum = -1;
p2->ip4h = (IPV4Hdr *)p2->pkt;
p2->tcph = (TCPHdr *)(p2->pkt + sizeof(raw_ipv4));
p2->src.family = AF_INET;
@ -6273,7 +6273,7 @@ int SigTest28TCPV6Keyword(void)
memset(p2, 0, SIZE_OF_PACKET);
p2->pkt = (uint8_t *)(p2 + 1);
p1->tcpc.comp_csum = -1;
p1->tcpvars.comp_csum = -1;
p1->ip6h = (IPV6Hdr *)(valid_raw_ipv6 + 14);
p1->tcph = (TCPHdr *) (valid_raw_ipv6 + 54);
p1->src.family = AF_INET;
@ -6286,7 +6286,7 @@ int SigTest28TCPV6Keyword(void)
BUG_ON(1);
}
p2->tcpc.comp_csum = -1;
p2->tcpvars.comp_csum = -1;
p2->ip6h = (IPV6Hdr *)(invalid_raw_ipv6 + 14);
p2->tcph = (TCPHdr *) (invalid_raw_ipv6 + 54);
p2->src.family = AF_INET;
@ -6397,7 +6397,7 @@ int SigTest29NegativeTCPV6Keyword(void)
memset(p2, 0, SIZE_OF_PACKET);
p2->pkt = (uint8_t *)(p2 + 1);
p1->tcpc.comp_csum = -1;
p1->tcpvars.comp_csum = -1;
p1->ip6h = (IPV6Hdr *)(valid_raw_ipv6 + 14);
p1->tcph = (TCPHdr *) (valid_raw_ipv6 + 54);
p1->src.family = AF_INET;
@ -6410,7 +6410,7 @@ int SigTest29NegativeTCPV6Keyword(void)
BUG_ON(1);
}
p2->tcpc.comp_csum = -1;
p2->tcpvars.comp_csum = -1;
p2->ip6h = (IPV6Hdr *)(invalid_raw_ipv6 + 14);
p2->tcph = (TCPHdr *) (invalid_raw_ipv6 + 54);
p2->src.family = AF_INET;
@ -6522,24 +6522,22 @@ int SigTest30UDPV4Keyword(void)
memset(p2, 0, SIZE_OF_PACKET);
p2->pkt = (uint8_t *)(p2 + 1);
p1->udpc.comp_csum = -1;
p1->udpvars.comp_csum = -1;
p1->ip4h = (IPV4Hdr *)raw_ipv4;
p1->udph = (UDPHdr *)valid_raw_udp;
p1->udpvars.hlen = UDP_HEADER_LEN;
p1->src.family = AF_INET;
p1->dst.family = AF_INET;
p1->payload = buf;
p1->payload_len = sizeof(valid_raw_udp) - p1->udpvars.hlen;
p1->payload_len = sizeof(valid_raw_udp) - UDP_HEADER_LEN;
p1->proto = IPPROTO_UDP;
p2->udpc.comp_csum = -1;
p2->udpvars.comp_csum = -1;
p2->ip4h = (IPV4Hdr *)raw_ipv4;
p2->udph = (UDPHdr *)invalid_raw_udp;
p2->udpvars.hlen = UDP_HEADER_LEN;
p2->src.family = AF_INET;
p2->dst.family = AF_INET;
p2->payload = buf;
p2->payload_len = sizeof(invalid_raw_udp) - p2->udpvars.hlen;
p2->payload_len = sizeof(invalid_raw_udp) - UDP_HEADER_LEN;
p2->proto = IPPROTO_UDP;
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
@ -6648,24 +6646,22 @@ int SigTest31NegativeUDPV4Keyword(void)
memset(p2, 0, SIZE_OF_PACKET);
p2->pkt = (uint8_t *)(p2 + 1);
p1->udpc.comp_csum = -1;
p1->udpvars.comp_csum = -1;
p1->ip4h = (IPV4Hdr *)raw_ipv4;
p1->udph = (UDPHdr *)valid_raw_udp;
p1->udpvars.hlen = UDP_HEADER_LEN;
p1->src.family = AF_INET;
p1->dst.family = AF_INET;
p1->payload = buf;
p1->payload_len = sizeof(valid_raw_udp) - p1->udpvars.hlen;
p1->payload_len = sizeof(valid_raw_udp) - UDP_HEADER_LEN;
p1->proto = IPPROTO_UDP;
p2->udpc.comp_csum = -1;
p2->udpvars.comp_csum = -1;
p2->ip4h = (IPV4Hdr *)raw_ipv4;
p2->udph = (UDPHdr *)invalid_raw_udp;
p2->udpvars.hlen = UDP_HEADER_LEN;
p2->src.family = AF_INET;
p2->dst.family = AF_INET;
p2->payload = buf;
p2->payload_len = sizeof(invalid_raw_udp) - p2->udpvars.hlen;
p2->payload_len = sizeof(invalid_raw_udp) - UDP_HEADER_LEN;
p2->proto = IPPROTO_UDP;
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
@ -6768,24 +6764,22 @@ int SigTest32UDPV6Keyword(void)
memset(p2, 0, SIZE_OF_PACKET);
p2->pkt = (uint8_t *)(p2 + 1);
p1->udpc.comp_csum = -1;
p1->udpvars.comp_csum = -1;
p1->ip6h = (IPV6Hdr *)(valid_raw_ipv6 + 14);
p1->udph = (UDPHdr *) (valid_raw_ipv6 + 54);
p1->src.family = AF_INET;
p1->dst.family = AF_INET;
p1->udpvars.hlen = UDP_HEADER_LEN;
p1->payload = buf;
p1->payload_len = IPV6_GET_PLEN((p1)) - p1->udpvars.hlen;
p1->payload_len = IPV6_GET_PLEN((p1)) - UDP_HEADER_LEN;
p1->proto = IPPROTO_UDP;
p2->udpc.comp_csum = -1;
p2->udpvars.comp_csum = -1;
p2->ip6h = (IPV6Hdr *)(invalid_raw_ipv6 + 14);
p2->udph = (UDPHdr *) (invalid_raw_ipv6 + 54);
p2->src.family = AF_INET;
p2->dst.family = AF_INET;
p2->udpvars.hlen = UDP_HEADER_LEN;
p2->payload = buf;
p2->payload_len = IPV6_GET_PLEN((p2)) - p2->udpvars.hlen;
p2->payload_len = IPV6_GET_PLEN((p2)) - UDP_HEADER_LEN;
p2->proto = IPPROTO_UDP;
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
@ -6886,24 +6880,22 @@ int SigTest33NegativeUDPV6Keyword(void)
memset(p2, 0, SIZE_OF_PACKET);
p2->pkt = (uint8_t *)(p2 + 1);
p1->udpc.comp_csum = -1;
p1->udpvars.comp_csum = -1;
p1->ip6h = (IPV6Hdr *)(valid_raw_ipv6 + 14);
p1->udph = (UDPHdr *) (valid_raw_ipv6 + 54);
p1->src.family = AF_INET;
p1->dst.family = AF_INET;
p1->udpvars.hlen = UDP_HEADER_LEN;
p1->payload = buf;
p1->payload_len = IPV6_GET_PLEN((p1)) - p1->udpvars.hlen;
p1->payload_len = IPV6_GET_PLEN((p1)) - UDP_HEADER_LEN;
p1->proto = IPPROTO_UDP;
p2->udpc.comp_csum = -1;
p2->udpvars.comp_csum = -1;
p2->ip6h = (IPV6Hdr *)(invalid_raw_ipv6 + 14);
p2->udph = (UDPHdr *) (invalid_raw_ipv6 + 54);
p2->src.family = AF_INET;
p2->dst.family = AF_INET;
p2->udpvars.hlen = UDP_HEADER_LEN;
p2->payload = buf;
p2->payload_len = IPV6_GET_PLEN((p2)) - p2->udpvars.hlen;
p2->payload_len = IPV6_GET_PLEN((p2)) - UDP_HEADER_LEN;
p2->proto = IPPROTO_UDP;
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
@ -7007,7 +6999,7 @@ int SigTest34ICMPV4Keyword(void)
memset(p2, 0, SIZE_OF_PACKET);
p2->pkt = (uint8_t *)(p2 + 1);
p1->icmpv4c.comp_csum = -1;
p1->icmpv4vars.comp_csum = -1;
p1->ip4h = (IPV4Hdr *)(valid_raw_ipv4);
p1->ip4h->ip_verhl = 69;
p1->icmpv4h = (ICMPV4Hdr *) (valid_raw_ipv4 + IPV4_GET_RAW_HLEN(p1->ip4h) * 4);
@ -7017,7 +7009,7 @@ int SigTest34ICMPV4Keyword(void)
p1->payload_len = buflen;
p1->proto = IPPROTO_ICMP;
p2->icmpv4c.comp_csum = -1;
p2->icmpv4vars.comp_csum = -1;
p2->ip4h = (IPV4Hdr *)(invalid_raw_ipv4);
p2->ip4h->ip_verhl = 69;
p2->icmpv4h = (ICMPV4Hdr *) (invalid_raw_ipv4 + IPV4_GET_RAW_HLEN(p2->ip4h) * 4);
@ -7126,7 +7118,7 @@ int SigTest35NegativeICMPV4Keyword(void)
memset(p2, 0, SIZE_OF_PACKET);
p2->pkt = (uint8_t *)(p2 + 1);
p1->icmpv4c.comp_csum = -1;
p1->icmpv4vars.comp_csum = -1;
p1->ip4h = (IPV4Hdr *)(valid_raw_ipv4);
p1->ip4h->ip_verhl = 69;
p1->icmpv4h = (ICMPV4Hdr *) (valid_raw_ipv4 + IPV4_GET_RAW_HLEN(p1->ip4h) * 4);
@ -7136,7 +7128,7 @@ int SigTest35NegativeICMPV4Keyword(void)
p1->payload_len = buflen;
p1->proto = IPPROTO_ICMP;
p2->icmpv4c.comp_csum = -1;
p2->icmpv4vars.comp_csum = -1;
p2->ip4h = (IPV4Hdr *)(invalid_raw_ipv4);
p2->ip4h->ip_verhl = 69;
p2->icmpv4h = (ICMPV4Hdr *) (invalid_raw_ipv4 + IPV4_GET_RAW_HLEN(p2->ip4h) * 4);
@ -7258,20 +7250,18 @@ int SigTest36ICMPV6Keyword(void)
memset(p2, 0, SIZE_OF_PACKET);
p2->pkt = (uint8_t *)(p2 + 1);
p1->icmpv6c.comp_csum = -1;
p1->icmpv6vars.comp_csum = -1;
p1->ip6h = (IPV6Hdr *)(valid_raw_ipv6 + 14);
p1->icmpv6h = (ICMPV6Hdr *) (valid_raw_ipv6 + 54);
p1->ip6c.plen = IPV6_GET_PLEN(p1);
p1->src.family = AF_INET;
p1->dst.family = AF_INET;
p1->payload = buf;
p1->payload_len = buflen;
p1->proto = IPPROTO_ICMPV6;
p2->icmpv6c.comp_csum = -1;
p2->icmpv6vars.comp_csum = -1;
p2->ip6h = (IPV6Hdr *)(invalid_raw_ipv6 + 14);
p2->icmpv6h = (ICMPV6Hdr *) (invalid_raw_ipv6 + 54);
p2->ip6c.plen = IPV6_GET_PLEN(p2);
p2->src.family = AF_INET;
p2->dst.family = AF_INET;
p2->payload = buf;
@ -7389,20 +7379,18 @@ int SigTest37NegativeICMPV6Keyword(void)
memset(p2, 0, SIZE_OF_PACKET);
p2->pkt = (uint8_t *)(p2 + 1);
p1->icmpv6c.comp_csum = -1;
p1->icmpv6vars.comp_csum = -1;
p1->ip6h = (IPV6Hdr *)(valid_raw_ipv6 + 14);
p1->icmpv6h = (ICMPV6Hdr *) (valid_raw_ipv6 + 54);
p1->ip6c.plen = IPV6_GET_PLEN(p1);
p1->src.family = AF_INET;
p1->dst.family = AF_INET;
p1->payload = buf;
p1->payload_len = buflen;
p1->proto = IPPROTO_ICMPV6;
p2->icmpv6c.comp_csum = -1;
p2->icmpv6vars.comp_csum = -1;
p2->ip6h = (IPV6Hdr *)(invalid_raw_ipv6 + 14);
p2->icmpv6h = (ICMPV6Hdr *) (invalid_raw_ipv6 + 54);
p2->ip6c.plen = IPV6_GET_PLEN(p2);
p2->src.family = AF_INET;
p2->dst.family = AF_INET;
p2->payload = buf;
@ -7527,7 +7515,7 @@ int SigTest38Real(int mpm_type)
}
SET_PKT_LEN(p1, ethlen + ipv4len + tcplen + buflen);
p1->tcpc.comp_csum = -1;
p1->tcpvars.comp_csum = -1;
p1->ethh = (EthernetHdr *)raw_eth;
p1->ip4h = (IPV4Hdr *)raw_ipv4;
p1->tcph = (TCPHdr *)raw_tcp;
@ -7669,7 +7657,7 @@ int SigTest39Real(int mpm_type)
}
SET_PKT_LEN(p1, ethlen + ipv4len + tcplen + buflen);
p1->tcpc.comp_csum = -1;
p1->tcpvars.comp_csum = -1;
p1->ethh = (EthernetHdr *)raw_eth;
p1->ip4h = (IPV4Hdr *)raw_ipv4;
p1->tcph = (TCPHdr *)raw_tcp;

12
src/stream-tcp.c
Unescape Escape View File

@ -3709,21 +3709,21 @@ int StreamTcpValidateChecksum(Packet *p)
{
int ret = 1;
if (p->tcpc.comp_csum == -1) {
if (p->tcpvars.comp_csum == -1) {
if (PKT_IS_IPV4(p)) {
p->tcpc.comp_csum = TCPCalculateChecksum((uint16_t *)&(p->ip4h->ip_src),
p->tcpvars.comp_csum = TCPCalculateChecksum((uint16_t *)&(p->ip4h->ip_src),
(uint16_t *)p->tcph,
(p->payload_len +
TCP_GET_HLEN(p)));
} else if (PKT_IS_IPV6(p)) {
p->tcpc.comp_csum = TCPV6CalculateChecksum((uint16_t *)&(p->ip6h->ip6_src),
p->tcpvars.comp_csum = TCPV6CalculateChecksum((uint16_t *)&(p->ip6h->ip6_src),
(uint16_t *)p->tcph,
(p->payload_len +
TCP_GET_HLEN(p)));
}
}
if (p->tcpc.comp_csum != p->tcph->th_sum) {
if (p->tcpvars.comp_csum != p->tcph->th_sum) {
ret = 0;
SCLogDebug("Checksum of received packet %p is invalid",p);
}
@ -5088,8 +5088,6 @@ static int StreamTcpTest07 (void) {
p->flowflags = FLOW_PKT_TOSERVER;
data[0] = htonl(2);
p->tcpc.ts1 = 0;
p->tcpc.ts2 = 0;
p->tcpvars.ts->data = (uint8_t *)data;
if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) {
@ -5178,8 +5176,6 @@ static int StreamTcpTest08 (void) {
p->flowflags = FLOW_PKT_TOSERVER;
data[0] = htonl(12);
p->tcpc.ts1 = 0;
p->tcpc.ts2 = 0;
p->tcpvars.ts->data = (uint8_t *)data;
if (StreamTcpPacket(&tv, p, &stt, &pq) == -1)

Write Preview
Loading…
Cancel
Save