/src/decode-tcp.h
C Header | 300 lines | 191 code | 53 blank | 56 comment | 8 complexity | 585515414fa0de2e6129dffd02c555a3 MD5 | raw file
1/* Copyright (C) 2007-2010 Open Information Security Foundation 2 * 3 * You can copy, redistribute or modify this Program under the terms of 4 * the GNU General Public License version 2 as published by the Free 5 * Software Foundation. 6 * 7 * This program is distributed in the hope that it will be useful, 8 * but WITHOUT ANY WARRANTY; without even the implied warranty of 9 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 10 * GNU General Public License for more details. 11 * 12 * You should have received a copy of the GNU General Public License 13 * version 2 along with this program; if not, write to the Free Software 14 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 15 * 02110-1301, USA. 16 */ 17 18/** 19 * \file 20 * 21 * \author Victor Julien <victor@inliniac.net> 22 * \todo RAW* macro's should be returning the raw value, not the host order 23 */ 24 25#ifndef __DECODE_TCP_H__ 26#define __DECODE_TCP_H__ 27 28#define TCP_HEADER_LEN 20 29#define TCP_OPTLENMAX 40 30#define TCP_OPTMAX 20 /* every opt is at least 2 bytes 31 * (type + len), except EOL and NOP */ 32 33/* TCP flags */ 34 35#define TH_FIN 0x01 36#define TH_SYN 0x02 37#define TH_RST 0x04 38#define TH_PUSH 0x08 39#define TH_ACK 0x10 40#define TH_URG 0x20 41/** Establish a new connection reducing window */ 42#define TH_ECN 0x40 43/** Echo Congestion flag */ 44#define TH_CWR 0x80 45 46/* tcp option codes */ 47#define TCP_OPT_EOL 0x00 48#define TCP_OPT_NOP 0x01 49#define TCP_OPT_MSS 0x02 50#define TCP_OPT_WS 0x03 51#define TCP_OPT_SACKOK 0x04 52#define TCP_OPT_SACK 0x05 53#define TCP_OPT_TS 0x08 54 55#define TCP_OPT_SACKOK_LEN 2 56#define TCP_OPT_WS_LEN 3 57#define TCP_OPT_TS_LEN 10 58#define TCP_OPT_MSS_LEN 4 59#define TCP_OPT_SACK_MIN_LEN 10 /* hdr 2, 1 pair 8 = 10 */ 60#define TCP_OPT_SACK_MAX_LEN 34 /* hdr 2, 4 pair 32= 34 */ 61 62/** Max valid wscale value. */ 63#define TCP_WSCALE_MAX 14 64 65#define TCP_OPTS tcpvars.tcp_opts 66#define TCP_OPTS_CNT tcpvars.tcp_opt_cnt 67 68#define TCP_GET_RAW_OFFSET(tcph) (((tcph)->th_offx2 & 0xf0) >> 4) 69#define TCP_GET_RAW_X2(tcph) ((tcph)->th_offx2 & 0x0f) 70#define TCP_GET_RAW_SRC_PORT(tcph) ntohs((tcph)->th_sport) 71#define TCP_GET_RAW_DST_PORT(tcph) ntohs((tcph)->th_dport) 72 73#define TCP_SET_RAW_TCP_OFFSET(tcph, value) ((tcph)->th_offx2 = (unsigned char)(((tcph)->th_offx2 & 0x0f) | (value << 4))) 74#define TCP_SET_RAW_TCP_X2(tcph, value) ((tcph)->th_offx2 = (unsigned char)(((tcph)->th_offx2 & 0xf0) | (value & 0x0f))) 75 76#define TCP_GET_RAW_SEQ(tcph) ntohl((tcph)->th_seq) 77#define TCP_GET_RAW_ACK(tcph) ntohl((tcph)->th_ack) 78 79#define TCP_GET_RAW_WINDOW(tcph) ntohs((tcph)->th_win) 80#define TCP_GET_RAW_URG_POINTER(tcph) ntohs((tcph)->th_urp) 81 82/** macro for getting the first timestamp from the packet. Timestamp is in host 83 * order and either returned from the cache or from the packet directly. */ 84#define TCP_GET_TSVAL(p) \ 85 (uint32_t)ntohl((*(uint32_t *)(p)->tcpvars.ts->data)) 86 87/** macro for getting the second timestamp from the packet. Timestamp is in 88 * host order and either returned from the cache or from the packet directly. */ 89#define TCP_GET_TSECR(p) \ 90 (uint32_t)ntohl((*(uint32_t *)((p)->tcpvars.ts->data+4))) 91 92/** macro for getting the wscale from the packet. */ 93#define TCP_GET_WSCALE(p) ((p)->tcpvars.ws ? (((*(uint8_t *)(p)->tcpvars.ws->data) <= TCP_WSCALE_MAX) ? (*(uint8_t *)((p)->tcpvars.ws->data)) : 0) : 0) 94 95#define TCP_GET_SACKOK(p) ((p)->tcpvars.sackok ? 1 : 0) 96#define TCP_GET_SACK_PTR(p) (p)->tcpvars.sack ? (p)->tcpvars.sack->data : NULL 97#define TCP_GET_SACK_CNT(p) ((p)->tcpvars.sack ? (((p)->tcpvars.sack->len - 2) / 8) : 0) 98 99#define TCP_GET_OFFSET(p) TCP_GET_RAW_OFFSET((p)->tcph) 100#define TCP_GET_HLEN(p) (TCP_GET_OFFSET((p)) << 2) 101#define TCP_GET_SRC_PORT(p) TCP_GET_RAW_SRC_PORT((p)->tcph) 102#define TCP_GET_DST_PORT(p) TCP_GET_RAW_DST_PORT((p)->tcph) 103#define TCP_GET_SEQ(p) TCP_GET_RAW_SEQ((p)->tcph) 104#define TCP_GET_ACK(p) TCP_GET_RAW_ACK((p)->tcph) 105#define TCP_GET_WINDOW(p) TCP_GET_RAW_WINDOW((p)->tcph) 106#define TCP_GET_URG_POINTER(p) TCP_GET_RAW_URG_POINTER((p)->tcph) 107 108#define TCP_ISSET_FLAG_FIN(p) ((p)->tcph->th_flags & TH_FIN) 109#define TCP_ISSET_FLAG_SYN(p) ((p)->tcph->th_flags & TH_SYN) 110#define TCP_ISSET_FLAG_RST(p) ((p)->tcph->th_flags & TH_RST) 111#define TCP_ISSET_FLAG_PUSH(p) ((p)->tcph->th_flags & TH_PUSH) 112#define TCP_ISSET_FLAG_ACK(p) ((p)->tcph->th_flags & TH_ACK) 113#define TCP_ISSET_FLAG_URG(p) ((p)->tcph->th_flags & TH_URG) 114#define TCP_ISSET_FLAG_RES2(p) ((p)->tcph->th_flags & TH_RES2) 115#define TCP_ISSET_FLAG_RES1(p) ((p)->tcph->th_flags & TH_RES1) 116 117typedef struct TCPOpt_ { 118 uint8_t type; 119 uint8_t len; 120 uint8_t *data; 121} TCPOpt; 122 123typedef struct TCPOptSackRecord_ { 124 uint32_t le; /**< left edge, network order */ 125 uint32_t re; /**< right edge, network order */ 126} TCPOptSackRecord; 127 128typedef struct TCPHdr_ 129{ 130 uint16_t th_sport; /**< source port */ 131 uint16_t th_dport; /**< destination port */ 132 uint32_t th_seq; /**< sequence number */ 133 uint32_t th_ack; /**< acknowledgement number */ 134 uint8_t th_offx2; /**< offset and reserved */ 135 uint8_t th_flags; /**< pkt flags */ 136 uint16_t th_win; /**< pkt window */ 137 uint16_t th_sum; /**< checksum */ 138 uint16_t th_urp; /**< urgent pointer */ 139} TCPHdr; 140 141typedef struct TCPVars_ 142{ 143 /* checksum computed over the tcp(for both ipv4 and ipv6) packet */ 144 int32_t comp_csum; 145 146 uint8_t tcp_opt_cnt; 147 TCPOpt tcp_opts[TCP_OPTMAX]; 148 149 /* ptrs to commonly used and needed opts */ 150 TCPOpt *ts; 151 TCPOpt *sack; 152 TCPOpt *sackok; 153 TCPOpt *ws; 154 TCPOpt *mss; 155} TCPVars; 156 157#define CLEAR_TCP_PACKET(p) { \ 158 (p)->tcph = NULL; \ 159 (p)->tcpvars.comp_csum = -1; \ 160 (p)->tcpvars.tcp_opt_cnt = 0; \ 161 (p)->tcpvars.ts = NULL; \ 162 (p)->tcpvars.sack = NULL; \ 163 (p)->tcpvars.sackok = NULL; \ 164 (p)->tcpvars.ws = NULL; \ 165 (p)->tcpvars.mss = NULL; \ 166} 167 168void DecodeTCPRegisterTests(void); 169 170/** -------- Inline functions ------- */ 171static inline uint16_t TCPCalculateChecksum(uint16_t *, uint16_t *, uint16_t); 172static inline uint16_t TCPV6CalculateChecksum(uint16_t *, uint16_t *, uint16_t); 173 174/** 175 * \brief Calculates the checksum for the TCP packet 176 * 177 * \param shdr Pointer to source address field from the IP packet. Used as a 178 * part of the pseudoheader for computing the checksum 179 * \param pkt Pointer to the start of the TCP packet 180 * \param tlen Total length of the TCP packet(header + payload) 181 * 182 * \retval csum Checksum for the TCP packet 183 */ 184static inline uint16_t TCPCalculateChecksum(uint16_t *shdr, uint16_t *pkt, 185 uint16_t tlen) 186{ 187 uint16_t pad = 0; 188 uint32_t csum = shdr[0]; 189 190 csum += shdr[1] + shdr[2] + shdr[3] + htons(6) + htons(tlen); 191 192 csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + 193 pkt[7] + pkt[9]; 194 195 tlen -= 20; 196 pkt += 10; 197 198 while (tlen >= 32) { 199 csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + 200 pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] + 201 pkt[14] + pkt[15]; 202 tlen -= 32; 203 pkt += 16; 204 } 205 206 while(tlen >= 8) { 207 csum += pkt[0] + pkt[1] + pkt[2] + pkt[3]; 208 tlen -= 8; 209 pkt += 4; 210 } 211 212 while(tlen >= 4) { 213 csum += pkt[0] + pkt[1]; 214 tlen -= 4; 215 pkt += 2; 216 } 217 218 while (tlen > 1) { 219 csum += pkt[0]; 220 pkt += 1; 221 tlen -= 2; 222 } 223 224 if (tlen == 1) { 225 *(uint8_t *)(&pad) = (*(uint8_t *)pkt); 226 csum += pad; 227 } 228 229 csum = (csum >> 16) + (csum & 0x0000FFFF); 230 csum += (csum >> 16); 231 232 return (uint16_t)~csum; 233} 234 235/** 236 * \brief Calculates the checksum for the TCP packet 237 * 238 * \param shdr Pointer to source address field from the IPV6 packet. Used as a 239 * part of the psuedoheader for computing the checksum 240 * \param pkt Pointer to the start of the TCP packet 241 * \param tlen Total length of the TCP packet(header + payload) 242 * 243 * \retval csum Checksum for the TCP packet 244 */ 245static inline uint16_t TCPV6CalculateChecksum(uint16_t *shdr, uint16_t *pkt, 246 uint16_t tlen) 247{ 248 uint16_t pad = 0; 249 uint32_t csum = shdr[0]; 250 251 csum += shdr[1] + shdr[2] + shdr[3] + shdr[4] + shdr[5] + shdr[6] + 252 shdr[7] + shdr[8] + shdr[9] + shdr[10] + shdr[11] + shdr[12] + 253 shdr[13] + shdr[14] + shdr[15] + htons(6) + htons(tlen); 254 255 csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + 256 pkt[7] + pkt[9]; 257 258 tlen -= 20; 259 pkt += 10; 260 261 while (tlen >= 32) { 262 csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + 263 pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] + 264 pkt[14] + pkt[15]; 265 tlen -= 32; 266 pkt += 16; 267 } 268 269 while(tlen >= 8) { 270 csum += pkt[0] + pkt[1] + pkt[2] + pkt[3]; 271 tlen -= 8; 272 pkt += 4; 273 } 274 275 while(tlen >= 4) { 276 csum += pkt[0] + pkt[1]; 277 tlen -= 4; 278 pkt += 2; 279 } 280 281 while (tlen > 1) { 282 csum += pkt[0]; 283 pkt += 1; 284 tlen -= 2; 285 } 286 287 if (tlen == 1) { 288 *(uint8_t *)(&pad) = (*(uint8_t *)pkt); 289 csum += pad; 290 } 291 292 csum = (csum >> 16) + (csum & 0x0000FFFF); 293 csum += (csum >> 16); 294 295 return (uint16_t)~csum; 296} 297 298 299#endif /* __DECODE_TCP_H__ */ 300