80 Commits (9d54a8361d07213b6201f3466e790b1aa4be07d7)

Author	SHA1	Message	Date
Victor Julien	11be9bd971	mingw: add SCNtohl and SCNtohs macro's ... On MinGW the result of ntohl needs to be casted to uint32_t and the result of ntohs to uint16_t. To avoid doing this everywhere add SCNtohl and SCNtohs macros.	7 years ago
Victor Julien	b77d307272	ipv6: simplify ext hdr parsing	9 years ago
Victor Julien	abb0a31aed	defrag: work around packet creation issues ... Defrag tests set up packets but don't call Decode on them. Work around failing IPv6 tests.	9 years ago
Victor Julien	68c7fae79f	ipv6: simplify ext hdr parsing and storage ... This reduces size of the IPV6ExtHdr structure part of every packet significantly. Clean up macro's in the ipv6 header.	9 years ago
Jason Ish	796dd5223b	tests: no longer necessary to provide successful return code ... 1 pass, 0 is fail.	9 years ago
Victor Julien	aa6b24f814	decode: clean up tunnel decode logic ... Don't use mix of existing and custom types to indicate the next layer.	10 years ago
Victor Julien	1c0b4ee0ae	counters: s/SCPerfCounterIncr/StatsIncr/g	10 years ago
Victor Julien	e9b067c1eb	counters: make increment call take threadvars ... This hides the implementation from the caller.	10 years ago
Victor Julien	9a8bff7d96	counters: threadvars s/sc_perf_pca/perf_private_ctx/g	10 years ago
Victor Julien	5f4a23deb9	ipv6: RH extension header parsing issue ... A logic error in the IPv6 Routing header parsing caused accidental updating of the original packet buffer. The calculated extension header lenght was set to the length field of the routing header, causing it to be wrong. This has 2 consequences: 1. defrag failure. As the now modified payload was used in defrag, the decoding of the reassembled packet now contained a broken length field for the routing header. This would lead to decoding failure. The potential here is evasion, although it would trigger: [1:2200014:1] SURICATA IPv6 truncated extension header 2. in IPS mode, especially the AF_PACKET mode, the modified and now broken packet would be transmitted on the wire. It's likely that end hosts and/or routers would reject this packet. NFQ based IPS mode would be less affected, as it 'verdicts' based on the packet handle. In case of replacing the packet (replace keyword or stream normalization) it could broadcast the bad packet. Additionally, the RH Type 0 address parsing was also broken. It too would modify the original packet. As the result of this code was not used anywhere else in the engine, this code is now disabled. Reported-By: Rafael Schaefer <rschaefer@ernw.de>	11 years ago
Victor Julien	7cc63918c3	ipv6: fix dst/hop header option parsing ... The extension header option parsing used a uint8_t internally. However much bigger option sizes are valid.	11 years ago
Victor Julien	7c05685421	ipv6: set event on unsupported nh ... If a next header / protocol is encountered that we can't handle (yet) set an event. Disabled the rule by default. decode-event:ipv6.unknown_next_header;	11 years ago
Victor Julien	bbcdb657da	ipv6: more robust ipv6 exthdr handling ... Skip past Shim6, HIP and Mobility header. Detect data after 'none' header. decode-event:ipv6.data_after_none_header;	11 years ago
Victor Julien	938602c55e	ipv6: detect frag header reserved field non-zero ... Frag Header length field is reserved, and should be set to 0. decode-event:ipv6.fh_non_zero_reserved_field;	11 years ago
Victor Julien	8c19e5ff63	ipv6: make exthdr parsing more robust ... Improve data length checks. Detect PadN option with 0 length.	11 years ago
Victor Julien	abee95ca4f	ipv6: set flag on type 0 routing header ... Type 0 Routing headers are deprecated per RFC 5095. This patch sets an decode event flag that can be matched on through: decode-event:ipv6.rh_type_0;	11 years ago
Ken Steele	8f1d75039a	Enforce function coding standard ... Functions should be defined as: int foo(void) { } Rather than: int food(void) { } All functions where changed by a script to match this standard.	11 years ago
Victor Julien	1195f882b9	ipv6: add support for PAD1 ... Support PAD1 in IPv6 HOP options header and DST options header.	11 years ago
Eric Leblond	b2c58b8d14	Set packet invalid flag during decoding. ... This patch set a new value in pkt->flag to signal that a packet is invalid during decoding. The patch has been obtained via a coccinelle transformation.	11 years ago
Eric Leblond	3fdf52239d	defrag: don't modify packet if defrag fails ... If defrag fails dur to an invalid decoding, we are not modifying the origin packet anymore.	11 years ago
Eric Leblond	c611b258a5	decode: PacketTunnelPktSetup replaces PacketPseudoPktSetup ... This patch replaces PacketPseudoPktSetup by a better named PacketTunnelPktSetup function which is also in charge of doing the decoding of the tunneled packet. This allow to clean the code. But it also fixes an issue. Previously, if the DecodeTunnel function was failling (cause of an invalid packet mainly), the result was that the original packet to be considered as a tunnel packet (and not inspected by payload detection).	11 years ago
Eric Leblond	d4b7ecfbe3	decode: update API to return error ... In some cases, the decoding is not possible and some really invalid packet can be created. This is in particular the case of tunnel. In that case, it is more interesting to forget about the tunneled packet and only consider the original packet. DecodeTunnel function is maked as warn_unused_result because it is meaningful for the decoder to know if the underlying data were not correct. And in this case, only focus detection on the content.	11 years ago
Victor Julien	49087f21e4	Optimizations to reduce branch misses	12 years ago
Eric Leblond	3dbf6c6fee	solaris: fix compilation failure ... This patch fixes a compilation failure on Solaris. Compiler does not support when a function returning void is used in return of an other function returning void.	12 years ago
Anoop Saldanha	e68d44b051	fix for #932. ... ipv6 tunnel decoder wrongly treats the tunneled ipv6 packets as an ipv4 packet.	12 years ago
Eric Leblond	c5bd04f102	unittest: recycle packet before exit ... To avoid an issue with flow validation, we need to recycle the packet before cleaning the flow.	12 years ago
Victor Julien	04f3f14541	ipv6: fix parsing of malformed ext hdr. Bug #908.	12 years ago
Victor Julien	f4dcba6de3	In case of fragments, don't consider ports. Bug #847.	12 years ago
Ken Steele	9c7b411a5d	More PacketGetFromMalloc() to allocate packets.	12 years ago
Victor Julien	1eed3f2233	ipv6: add event for ipv6 packet with icmpv4 header	12 years ago
Victor Julien	150b0c5ae0	ipv6: add option to detect HOP/DST headers with only padding. Detect unknown DST/HOP opts.	12 years ago
Anoop Saldanha	b33986c887	Add a packet src for every packet generated inside suricata.	13 years ago
Eric Leblond	e176be6fcc	Use unlikely for error treatment. ... When handling error case on SCMallog, SCCalloc or SCStrdup we are in an unlikely case. This patch adds the unlikely() expression to indicate this to gcc. This patch has been obtained via coccinelle. The transformation is the following: @istested@ identifier x; statement S1; identifier func =~ "(SCMalloc|SCStrdup|SCCalloc)"; @@ x = func(...) ... when != x - if (x == NULL) S1 + if (unlikely(x == NULL)) S1	13 years ago
Victor Julien	7a044a99ee	Defrag engine ... Big rewrite of defrag engine to make it more scalable and fix some locking logic flaws. Now uses a hash of trackers similar to Flow and Host hashes.	13 years ago
Eric Leblond	5ffe7e21c3	decode: use pointer inside packet area as param ... DecodeTeredo, DecodeIPv6InIPv6 and DecodeIPv4inIPv6 were calling DecodeTunnel with packet being a pseudo packet and data being data from initial packet: DecodeTunnel(tv, dtv, tp, start, blen, pq, IPPROTO_IPV6); In decoding functions, arithmetic was done on pkt to set some values? It was resulting in field of packet pointing outside of the scope of packet data. This patch switch to what has been done in DecodeGre(), I mean: DecodeTunnel(tv, dtv, tp, GET_PKT_DATA(tp), GET_PKT_LEN(tp), pq, IPPROTO_IP); Data buffer is then relative to the packet and the arithmetic is correct.	13 years ago
Eric Leblond	e6e339aacf	Add counters for IPv4 in IPv6 and IPv6 in IPv6	13 years ago
Eric Leblond	def0270de7	decode: decode IPv6-in-IPv6 ... This patch adds decoding of IPv6-in-IPv6. It also adds some events for invalid packets. This patch should fix #514.	13 years ago
Eric Leblond	09fa0b9542	Add support for IPv4-in-IPv6 ... This patch adds support for IPv4-in-IPv6 and should fix #462.	13 years ago
Victor Julien	b976ff228a	ipv6: fix an AH header parsing issue. Add decoder event for non-null reserved fields.	13 years ago
Victor Julien	98c30be2db	ipv6: improve handling of packets with duplicate (or more) ipv6 extension headers.	13 years ago
Victor Julien	07945f04ce	ipv6: make sure we pass the defragged packet from the ipv6 layer to the decoder.	13 years ago
Victor Julien	40fcae3aa0	Minor unittest fixes to make Coverity happy.	13 years ago
Victor Julien	a39529db5d	ipv6: fix routing header parsing leading to rejection of valid packets.	13 years ago
Victor Julien	374947c354	ipv6: properly deal with packets containing a FH header that has offset 0 and no more frags flag set.	13 years ago
Anoop Saldanha	a19a249230	Set the packet protocol only if it can parsed without error	13 years ago
Anoop Saldanha	b8997b415c	bug #403 - fix setting ip proto for ipv6 packets	13 years ago
Victor Julien	c4b34e6ef7	Fix various minor clang/scan-build warnings.	13 years ago
Victor Julien	34450b9b57	Don't parse layers / ext headers above ipv6 frag header. This is taken care of by defrag.	13 years ago
Eileen Donlon	1adf4b868c	set layer4 protocol when no ipv6 extension headers	14 years ago
Eric Leblond	acf10525f6	doc: add decode group and related documentation.	14 years ago