/src/decode-tcp.h

https://github.com/decanio/suricata-tilera · C Header · 300 lines · 191 code · 53 blank · 56 comment · 12 complexity · 585515414fa0de2e6129dffd02c555a3 MD5 · raw file

  1. /* Copyright (C) 2007-2010 Open Information Security Foundation
  2. *
  3. * You can copy, redistribute or modify this Program under the terms of
  4. * the GNU General Public License version 2 as published by the Free
  5. * Software Foundation.
  6. *
  7. * This program is distributed in the hope that it will be useful,
  8. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  9. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  10. * GNU General Public License for more details.
  11. *
  12. * You should have received a copy of the GNU General Public License
  13. * version 2 along with this program; if not, write to the Free Software
  14. * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
  15. * 02110-1301, USA.
  16. */
  17. /**
  18. * \file
  19. *
  20. * \author Victor Julien <victor@inliniac.net>
  21. * \todo RAW* macro's should be returning the raw value, not the host order
  22. */
  23. #ifndef __DECODE_TCP_H__
  24. #define __DECODE_TCP_H__
  25. #define TCP_HEADER_LEN 20
  26. #define TCP_OPTLENMAX 40
  27. #define TCP_OPTMAX 20 /* every opt is at least 2 bytes
  28. * (type + len), except EOL and NOP */
  29. /* TCP flags */
  30. #define TH_FIN 0x01
  31. #define TH_SYN 0x02
  32. #define TH_RST 0x04
  33. #define TH_PUSH 0x08
  34. #define TH_ACK 0x10
  35. #define TH_URG 0x20
  36. /** Establish a new connection reducing window */
  37. #define TH_ECN 0x40
  38. /** Echo Congestion flag */
  39. #define TH_CWR 0x80
  40. /* tcp option codes */
  41. #define TCP_OPT_EOL 0x00
  42. #define TCP_OPT_NOP 0x01
  43. #define TCP_OPT_MSS 0x02
  44. #define TCP_OPT_WS 0x03
  45. #define TCP_OPT_SACKOK 0x04
  46. #define TCP_OPT_SACK 0x05
  47. #define TCP_OPT_TS 0x08
  48. #define TCP_OPT_SACKOK_LEN 2
  49. #define TCP_OPT_WS_LEN 3
  50. #define TCP_OPT_TS_LEN 10
  51. #define TCP_OPT_MSS_LEN 4
  52. #define TCP_OPT_SACK_MIN_LEN 10 /* hdr 2, 1 pair 8 = 10 */
  53. #define TCP_OPT_SACK_MAX_LEN 34 /* hdr 2, 4 pair 32= 34 */
  54. /** Max valid wscale value. */
  55. #define TCP_WSCALE_MAX 14
  56. #define TCP_OPTS tcpvars.tcp_opts
  57. #define TCP_OPTS_CNT tcpvars.tcp_opt_cnt
  58. #define TCP_GET_RAW_OFFSET(tcph) (((tcph)->th_offx2 & 0xf0) >> 4)
  59. #define TCP_GET_RAW_X2(tcph) ((tcph)->th_offx2 & 0x0f)
  60. #define TCP_GET_RAW_SRC_PORT(tcph) ntohs((tcph)->th_sport)
  61. #define TCP_GET_RAW_DST_PORT(tcph) ntohs((tcph)->th_dport)
  62. #define TCP_SET_RAW_TCP_OFFSET(tcph, value) ((tcph)->th_offx2 = (unsigned char)(((tcph)->th_offx2 & 0x0f) | (value << 4)))
  63. #define TCP_SET_RAW_TCP_X2(tcph, value) ((tcph)->th_offx2 = (unsigned char)(((tcph)->th_offx2 & 0xf0) | (value & 0x0f)))
  64. #define TCP_GET_RAW_SEQ(tcph) ntohl((tcph)->th_seq)
  65. #define TCP_GET_RAW_ACK(tcph) ntohl((tcph)->th_ack)
  66. #define TCP_GET_RAW_WINDOW(tcph) ntohs((tcph)->th_win)
  67. #define TCP_GET_RAW_URG_POINTER(tcph) ntohs((tcph)->th_urp)
  68. /** macro for getting the first timestamp from the packet. Timestamp is in host
  69. * order and either returned from the cache or from the packet directly. */
  70. #define TCP_GET_TSVAL(p) \
  71. (uint32_t)ntohl((*(uint32_t *)(p)->tcpvars.ts->data))
  72. /** macro for getting the second timestamp from the packet. Timestamp is in
  73. * host order and either returned from the cache or from the packet directly. */
  74. #define TCP_GET_TSECR(p) \
  75. (uint32_t)ntohl((*(uint32_t *)((p)->tcpvars.ts->data+4)))
  76. /** macro for getting the wscale from the packet. */
  77. #define TCP_GET_WSCALE(p) ((p)->tcpvars.ws ? (((*(uint8_t *)(p)->tcpvars.ws->data) <= TCP_WSCALE_MAX) ? (*(uint8_t *)((p)->tcpvars.ws->data)) : 0) : 0)
  78. #define TCP_GET_SACKOK(p) ((p)->tcpvars.sackok ? 1 : 0)
  79. #define TCP_GET_SACK_PTR(p) (p)->tcpvars.sack ? (p)->tcpvars.sack->data : NULL
  80. #define TCP_GET_SACK_CNT(p) ((p)->tcpvars.sack ? (((p)->tcpvars.sack->len - 2) / 8) : 0)
  81. #define TCP_GET_OFFSET(p) TCP_GET_RAW_OFFSET((p)->tcph)
  82. #define TCP_GET_HLEN(p) (TCP_GET_OFFSET((p)) << 2)
  83. #define TCP_GET_SRC_PORT(p) TCP_GET_RAW_SRC_PORT((p)->tcph)
  84. #define TCP_GET_DST_PORT(p) TCP_GET_RAW_DST_PORT((p)->tcph)
  85. #define TCP_GET_SEQ(p) TCP_GET_RAW_SEQ((p)->tcph)
  86. #define TCP_GET_ACK(p) TCP_GET_RAW_ACK((p)->tcph)
  87. #define TCP_GET_WINDOW(p) TCP_GET_RAW_WINDOW((p)->tcph)
  88. #define TCP_GET_URG_POINTER(p) TCP_GET_RAW_URG_POINTER((p)->tcph)
  89. #define TCP_ISSET_FLAG_FIN(p) ((p)->tcph->th_flags & TH_FIN)
  90. #define TCP_ISSET_FLAG_SYN(p) ((p)->tcph->th_flags & TH_SYN)
  91. #define TCP_ISSET_FLAG_RST(p) ((p)->tcph->th_flags & TH_RST)
  92. #define TCP_ISSET_FLAG_PUSH(p) ((p)->tcph->th_flags & TH_PUSH)
  93. #define TCP_ISSET_FLAG_ACK(p) ((p)->tcph->th_flags & TH_ACK)
  94. #define TCP_ISSET_FLAG_URG(p) ((p)->tcph->th_flags & TH_URG)
  95. #define TCP_ISSET_FLAG_RES2(p) ((p)->tcph->th_flags & TH_RES2)
  96. #define TCP_ISSET_FLAG_RES1(p) ((p)->tcph->th_flags & TH_RES1)
  97. typedef struct TCPOpt_ {
  98. uint8_t type;
  99. uint8_t len;
  100. uint8_t *data;
  101. } TCPOpt;
  102. typedef struct TCPOptSackRecord_ {
  103. uint32_t le; /**< left edge, network order */
  104. uint32_t re; /**< right edge, network order */
  105. } TCPOptSackRecord;
  106. typedef struct TCPHdr_
  107. {
  108. uint16_t th_sport; /**< source port */
  109. uint16_t th_dport; /**< destination port */
  110. uint32_t th_seq; /**< sequence number */
  111. uint32_t th_ack; /**< acknowledgement number */
  112. uint8_t th_offx2; /**< offset and reserved */
  113. uint8_t th_flags; /**< pkt flags */
  114. uint16_t th_win; /**< pkt window */
  115. uint16_t th_sum; /**< checksum */
  116. uint16_t th_urp; /**< urgent pointer */
  117. } TCPHdr;
  118. typedef struct TCPVars_
  119. {
  120. /* checksum computed over the tcp(for both ipv4 and ipv6) packet */
  121. int32_t comp_csum;
  122. uint8_t tcp_opt_cnt;
  123. TCPOpt tcp_opts[TCP_OPTMAX];
  124. /* ptrs to commonly used and needed opts */
  125. TCPOpt *ts;
  126. TCPOpt *sack;
  127. TCPOpt *sackok;
  128. TCPOpt *ws;
  129. TCPOpt *mss;
  130. } TCPVars;
  131. #define CLEAR_TCP_PACKET(p) { \
  132. (p)->tcph = NULL; \
  133. (p)->tcpvars.comp_csum = -1; \
  134. (p)->tcpvars.tcp_opt_cnt = 0; \
  135. (p)->tcpvars.ts = NULL; \
  136. (p)->tcpvars.sack = NULL; \
  137. (p)->tcpvars.sackok = NULL; \
  138. (p)->tcpvars.ws = NULL; \
  139. (p)->tcpvars.mss = NULL; \
  140. }
  141. void DecodeTCPRegisterTests(void);
  142. /** -------- Inline functions ------- */
  143. static inline uint16_t TCPCalculateChecksum(uint16_t *, uint16_t *, uint16_t);
  144. static inline uint16_t TCPV6CalculateChecksum(uint16_t *, uint16_t *, uint16_t);
  145. /**
  146. * \brief Calculates the checksum for the TCP packet
  147. *
  148. * \param shdr Pointer to source address field from the IP packet. Used as a
  149. * part of the pseudoheader for computing the checksum
  150. * \param pkt Pointer to the start of the TCP packet
  151. * \param tlen Total length of the TCP packet(header + payload)
  152. *
  153. * \retval csum Checksum for the TCP packet
  154. */
  155. static inline uint16_t TCPCalculateChecksum(uint16_t *shdr, uint16_t *pkt,
  156. uint16_t tlen)
  157. {
  158. uint16_t pad = 0;
  159. uint32_t csum = shdr[0];
  160. csum += shdr[1] + shdr[2] + shdr[3] + htons(6) + htons(tlen);
  161. csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
  162. pkt[7] + pkt[9];
  163. tlen -= 20;
  164. pkt += 10;
  165. while (tlen >= 32) {
  166. csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
  167. pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] +
  168. pkt[14] + pkt[15];
  169. tlen -= 32;
  170. pkt += 16;
  171. }
  172. while(tlen >= 8) {
  173. csum += pkt[0] + pkt[1] + pkt[2] + pkt[3];
  174. tlen -= 8;
  175. pkt += 4;
  176. }
  177. while(tlen >= 4) {
  178. csum += pkt[0] + pkt[1];
  179. tlen -= 4;
  180. pkt += 2;
  181. }
  182. while (tlen > 1) {
  183. csum += pkt[0];
  184. pkt += 1;
  185. tlen -= 2;
  186. }
  187. if (tlen == 1) {
  188. *(uint8_t *)(&pad) = (*(uint8_t *)pkt);
  189. csum += pad;
  190. }
  191. csum = (csum >> 16) + (csum & 0x0000FFFF);
  192. csum += (csum >> 16);
  193. return (uint16_t)~csum;
  194. }
  195. /**
  196. * \brief Calculates the checksum for the TCP packet
  197. *
  198. * \param shdr Pointer to source address field from the IPV6 packet. Used as a
  199. * part of the psuedoheader for computing the checksum
  200. * \param pkt Pointer to the start of the TCP packet
  201. * \param tlen Total length of the TCP packet(header + payload)
  202. *
  203. * \retval csum Checksum for the TCP packet
  204. */
  205. static inline uint16_t TCPV6CalculateChecksum(uint16_t *shdr, uint16_t *pkt,
  206. uint16_t tlen)
  207. {
  208. uint16_t pad = 0;
  209. uint32_t csum = shdr[0];
  210. csum += shdr[1] + shdr[2] + shdr[3] + shdr[4] + shdr[5] + shdr[6] +
  211. shdr[7] + shdr[8] + shdr[9] + shdr[10] + shdr[11] + shdr[12] +
  212. shdr[13] + shdr[14] + shdr[15] + htons(6) + htons(tlen);
  213. csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
  214. pkt[7] + pkt[9];
  215. tlen -= 20;
  216. pkt += 10;
  217. while (tlen >= 32) {
  218. csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
  219. pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] +
  220. pkt[14] + pkt[15];
  221. tlen -= 32;
  222. pkt += 16;
  223. }
  224. while(tlen >= 8) {
  225. csum += pkt[0] + pkt[1] + pkt[2] + pkt[3];
  226. tlen -= 8;
  227. pkt += 4;
  228. }
  229. while(tlen >= 4) {
  230. csum += pkt[0] + pkt[1];
  231. tlen -= 4;
  232. pkt += 2;
  233. }
  234. while (tlen > 1) {
  235. csum += pkt[0];
  236. pkt += 1;
  237. tlen -= 2;
  238. }
  239. if (tlen == 1) {
  240. *(uint8_t *)(&pad) = (*(uint8_t *)pkt);
  241. csum += pad;
  242. }
  243. csum = (csum >> 16) + (csum & 0x0000FFFF);
  244. csum += (csum >> 16);
  245. return (uint16_t)~csum;
  246. }
  247. #endif /* __DECODE_TCP_H__ */