PageRenderTime 59ms CodeModel.GetById 31ms app.highlight 22ms RepoModel.GetById 1ms app.codeStats 0ms

/src/decode-tcp.h

https://github.com/decanio/suricata-tilera
C Header | 300 lines | 191 code | 53 blank | 56 comment | 8 complexity | 585515414fa0de2e6129dffd02c555a3 MD5 | raw file
  1/* Copyright (C) 2007-2010 Open Information Security Foundation
  2 *
  3 * You can copy, redistribute or modify this Program under the terms of
  4 * the GNU General Public License version 2 as published by the Free
  5 * Software Foundation.
  6 *
  7 * This program is distributed in the hope that it will be useful,
  8 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  9 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 10 * GNU General Public License for more details.
 11 *
 12 * You should have received a copy of the GNU General Public License
 13 * version 2 along with this program; if not, write to the Free Software
 14 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
 15 * 02110-1301, USA.
 16 */
 17
 18/**
 19 * \file
 20 *
 21 * \author Victor Julien <victor@inliniac.net>
 22 * \todo RAW* macro's should be returning the raw value, not the host order
 23 */
 24
 25#ifndef __DECODE_TCP_H__
 26#define __DECODE_TCP_H__
 27
 28#define TCP_HEADER_LEN                       20
 29#define TCP_OPTLENMAX                        40
 30#define TCP_OPTMAX                           20 /* every opt is at least 2 bytes
 31                                                 * (type + len), except EOL and NOP */
 32
 33/* TCP flags */
 34
 35#define TH_FIN                               0x01
 36#define TH_SYN                               0x02
 37#define TH_RST                               0x04
 38#define TH_PUSH                              0x08
 39#define TH_ACK                               0x10
 40#define TH_URG                               0x20
 41/** Establish a new connection reducing window */
 42#define TH_ECN                               0x40
 43/** Echo Congestion flag */
 44#define TH_CWR                               0x80
 45
 46/* tcp option codes */
 47#define TCP_OPT_EOL                          0x00
 48#define TCP_OPT_NOP                          0x01
 49#define TCP_OPT_MSS                          0x02
 50#define TCP_OPT_WS                           0x03
 51#define TCP_OPT_SACKOK                       0x04
 52#define TCP_OPT_SACK                         0x05
 53#define TCP_OPT_TS                           0x08
 54
 55#define TCP_OPT_SACKOK_LEN                   2
 56#define TCP_OPT_WS_LEN                       3
 57#define TCP_OPT_TS_LEN                       10
 58#define TCP_OPT_MSS_LEN                      4
 59#define TCP_OPT_SACK_MIN_LEN                 10 /* hdr 2, 1 pair 8 = 10 */
 60#define TCP_OPT_SACK_MAX_LEN                 34 /* hdr 2, 4 pair 32= 34 */
 61
 62/** Max valid wscale value. */
 63#define TCP_WSCALE_MAX                       14
 64
 65#define TCP_OPTS                             tcpvars.tcp_opts
 66#define TCP_OPTS_CNT                         tcpvars.tcp_opt_cnt
 67
 68#define TCP_GET_RAW_OFFSET(tcph)             (((tcph)->th_offx2 & 0xf0) >> 4)
 69#define TCP_GET_RAW_X2(tcph)                 ((tcph)->th_offx2 & 0x0f)
 70#define TCP_GET_RAW_SRC_PORT(tcph)           ntohs((tcph)->th_sport)
 71#define TCP_GET_RAW_DST_PORT(tcph)           ntohs((tcph)->th_dport)
 72
 73#define TCP_SET_RAW_TCP_OFFSET(tcph, value)  ((tcph)->th_offx2 = (unsigned char)(((tcph)->th_offx2 & 0x0f) | (value << 4)))
 74#define TCP_SET_RAW_TCP_X2(tcph, value)      ((tcph)->th_offx2 = (unsigned char)(((tcph)->th_offx2 & 0xf0) | (value & 0x0f)))
 75
 76#define TCP_GET_RAW_SEQ(tcph)                ntohl((tcph)->th_seq)
 77#define TCP_GET_RAW_ACK(tcph)                ntohl((tcph)->th_ack)
 78
 79#define TCP_GET_RAW_WINDOW(tcph)             ntohs((tcph)->th_win)
 80#define TCP_GET_RAW_URG_POINTER(tcph)        ntohs((tcph)->th_urp)
 81
 82/** macro for getting the first timestamp from the packet. Timestamp is in host
 83 *  order and either returned from the cache or from the packet directly. */
 84#define TCP_GET_TSVAL(p) \
 85    (uint32_t)ntohl((*(uint32_t *)(p)->tcpvars.ts->data))
 86
 87/** macro for getting the second timestamp from the packet. Timestamp is in
 88 *  host order and either returned from the cache or from the packet directly. */
 89#define TCP_GET_TSECR(p) \
 90    (uint32_t)ntohl((*(uint32_t *)((p)->tcpvars.ts->data+4)))
 91
 92/** macro for getting the wscale from the packet. */
 93#define TCP_GET_WSCALE(p)                    ((p)->tcpvars.ws ? (((*(uint8_t *)(p)->tcpvars.ws->data) <= TCP_WSCALE_MAX) ? (*(uint8_t *)((p)->tcpvars.ws->data)) : 0) : 0)
 94
 95#define TCP_GET_SACKOK(p)                    ((p)->tcpvars.sackok ? 1 : 0)
 96#define TCP_GET_SACK_PTR(p)                  (p)->tcpvars.sack ? (p)->tcpvars.sack->data : NULL
 97#define TCP_GET_SACK_CNT(p)                  ((p)->tcpvars.sack ? (((p)->tcpvars.sack->len - 2) / 8) : 0)
 98
 99#define TCP_GET_OFFSET(p)                    TCP_GET_RAW_OFFSET((p)->tcph)
100#define TCP_GET_HLEN(p)                      (TCP_GET_OFFSET((p)) << 2)
101#define TCP_GET_SRC_PORT(p)                  TCP_GET_RAW_SRC_PORT((p)->tcph)
102#define TCP_GET_DST_PORT(p)                  TCP_GET_RAW_DST_PORT((p)->tcph)
103#define TCP_GET_SEQ(p)                       TCP_GET_RAW_SEQ((p)->tcph)
104#define TCP_GET_ACK(p)                       TCP_GET_RAW_ACK((p)->tcph)
105#define TCP_GET_WINDOW(p)                    TCP_GET_RAW_WINDOW((p)->tcph)
106#define TCP_GET_URG_POINTER(p)               TCP_GET_RAW_URG_POINTER((p)->tcph)
107
108#define TCP_ISSET_FLAG_FIN(p)                ((p)->tcph->th_flags & TH_FIN)
109#define TCP_ISSET_FLAG_SYN(p)                ((p)->tcph->th_flags & TH_SYN)
110#define TCP_ISSET_FLAG_RST(p)                ((p)->tcph->th_flags & TH_RST)
111#define TCP_ISSET_FLAG_PUSH(p)               ((p)->tcph->th_flags & TH_PUSH)
112#define TCP_ISSET_FLAG_ACK(p)                ((p)->tcph->th_flags & TH_ACK)
113#define TCP_ISSET_FLAG_URG(p)                ((p)->tcph->th_flags & TH_URG)
114#define TCP_ISSET_FLAG_RES2(p)               ((p)->tcph->th_flags & TH_RES2)
115#define TCP_ISSET_FLAG_RES1(p)               ((p)->tcph->th_flags & TH_RES1)
116
117typedef struct TCPOpt_ {
118    uint8_t type;
119    uint8_t len;
120    uint8_t *data;
121} TCPOpt;
122
123typedef struct TCPOptSackRecord_ {
124    uint32_t le;        /**< left edge, network order */
125    uint32_t re;        /**< right edge, network order */
126} TCPOptSackRecord;
127
128typedef struct TCPHdr_
129{
130    uint16_t th_sport;  /**< source port */
131    uint16_t th_dport;  /**< destination port */
132    uint32_t th_seq;    /**< sequence number */
133    uint32_t th_ack;    /**< acknowledgement number */
134    uint8_t th_offx2;   /**< offset and reserved */
135    uint8_t th_flags;   /**< pkt flags */
136    uint16_t th_win;    /**< pkt window */
137    uint16_t th_sum;    /**< checksum */
138    uint16_t th_urp;    /**< urgent pointer */
139} TCPHdr;
140
141typedef struct TCPVars_
142{
143    /* checksum computed over the tcp(for both ipv4 and ipv6) packet */
144    int32_t comp_csum;
145
146    uint8_t tcp_opt_cnt;
147    TCPOpt tcp_opts[TCP_OPTMAX];
148
149    /* ptrs to commonly used and needed opts */
150    TCPOpt *ts;
151    TCPOpt *sack;
152    TCPOpt *sackok;
153    TCPOpt *ws;
154    TCPOpt *mss;
155} TCPVars;
156
157#define CLEAR_TCP_PACKET(p) { \
158    (p)->tcph = NULL; \
159    (p)->tcpvars.comp_csum = -1; \
160    (p)->tcpvars.tcp_opt_cnt = 0; \
161    (p)->tcpvars.ts = NULL; \
162    (p)->tcpvars.sack = NULL; \
163    (p)->tcpvars.sackok = NULL; \
164    (p)->tcpvars.ws = NULL; \
165    (p)->tcpvars.mss = NULL; \
166}
167
168void DecodeTCPRegisterTests(void);
169
170/** -------- Inline functions ------- */
171static inline uint16_t TCPCalculateChecksum(uint16_t *, uint16_t *, uint16_t);
172static inline uint16_t TCPV6CalculateChecksum(uint16_t *, uint16_t *, uint16_t);
173
174/**
175 * \brief Calculates the checksum for the TCP packet
176 *
177 * \param shdr Pointer to source address field from the IP packet.  Used as a
178 *             part of the pseudoheader for computing the checksum
179 * \param pkt  Pointer to the start of the TCP packet
180 * \param tlen Total length of the TCP packet(header + payload)
181 *
182 * \retval csum Checksum for the TCP packet
183 */
184static inline uint16_t TCPCalculateChecksum(uint16_t *shdr, uint16_t *pkt,
185                                            uint16_t tlen)
186{
187    uint16_t pad = 0;
188    uint32_t csum = shdr[0];
189
190    csum += shdr[1] + shdr[2] + shdr[3] + htons(6) + htons(tlen);
191
192    csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
193        pkt[7] + pkt[9];
194
195    tlen -= 20;
196    pkt += 10;
197
198    while (tlen >= 32) {
199        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
200            pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] +
201            pkt[14] + pkt[15];
202        tlen -= 32;
203        pkt += 16;
204    }
205
206    while(tlen >= 8) {
207        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3];
208        tlen -= 8;
209        pkt += 4;
210    }
211
212    while(tlen >= 4) {
213        csum += pkt[0] + pkt[1];
214        tlen -= 4;
215        pkt += 2;
216    }
217
218    while (tlen > 1) {
219        csum += pkt[0];
220        pkt += 1;
221        tlen -= 2;
222    }
223
224    if (tlen == 1) {
225        *(uint8_t *)(&pad) = (*(uint8_t *)pkt);
226        csum += pad;
227    }
228
229    csum = (csum >> 16) + (csum & 0x0000FFFF);
230    csum += (csum >> 16);
231
232    return (uint16_t)~csum;
233}
234
235/**
236 * \brief Calculates the checksum for the TCP packet
237 *
238 * \param shdr Pointer to source address field from the IPV6 packet.  Used as a
239 *             part of the psuedoheader for computing the checksum
240 * \param pkt  Pointer to the start of the TCP packet
241 * \param tlen Total length of the TCP packet(header + payload)
242 *
243 * \retval csum Checksum for the TCP packet
244 */
245static inline uint16_t TCPV6CalculateChecksum(uint16_t *shdr, uint16_t *pkt,
246                                       uint16_t tlen)
247{
248    uint16_t pad = 0;
249    uint32_t csum = shdr[0];
250
251    csum += shdr[1] + shdr[2] + shdr[3] + shdr[4] + shdr[5] + shdr[6] +
252        shdr[7] + shdr[8] + shdr[9] + shdr[10] + shdr[11] + shdr[12] +
253        shdr[13] + shdr[14] + shdr[15] + htons(6) + htons(tlen);
254
255    csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
256        pkt[7] + pkt[9];
257
258    tlen -= 20;
259    pkt += 10;
260
261    while (tlen >= 32) {
262        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
263            pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] +
264            pkt[14] + pkt[15];
265        tlen -= 32;
266        pkt += 16;
267    }
268
269    while(tlen >= 8) {
270        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3];
271        tlen -= 8;
272        pkt += 4;
273    }
274
275    while(tlen >= 4) {
276        csum += pkt[0] + pkt[1];
277        tlen -= 4;
278        pkt += 2;
279    }
280
281    while (tlen > 1) {
282        csum += pkt[0];
283        pkt += 1;
284        tlen -= 2;
285    }
286
287    if (tlen == 1) {
288        *(uint8_t *)(&pad) = (*(uint8_t *)pkt);
289        csum += pad;
290    }
291
292    csum = (csum >> 16) + (csum & 0x0000FFFF);
293    csum += (csum >> 16);
294
295    return (uint16_t)~csum;
296}
297
298
299#endif /* __DECODE_TCP_H__ */
300