50 static int DecodePartialIPV4(
Packet* p, uint8_t* partial_packet, uint16_t
len)
54 SCLogDebug(
"DecodePartialIPV4: ICMPV4_IPV4_TRUNC_PKT");
64 SCLogDebug(
"DecodePartialIPV4: ICMPv4 contains Unknown IPV4 version " 65 "ICMPV4_IPV4_UNKNOWN_VER");
87 SCLogDebug(
"DecodePartialIPV4: ICMPV4->IPV4->TCP header sport: " 98 SCLogDebug(
"DecodePartialIPV4: ICMPV4->IPV4->TCP partial header sport: " 102 SCLogDebug(
"DecodePartialIPV4: Warning, ICMPV4->IPV4->TCP " 103 "header Didn't fit in the packet!");
116 SCLogDebug(
"DecodePartialIPV4: ICMPV4->IPV4->UDP header sport: " 120 SCLogDebug(
"DecodePartialIPV4: Warning, ICMPV4->IPV4->UDP " 121 "header Didn't fit in the packet!");
134 SCLogDebug(
"DecodePartialIPV4: ICMPV4->IPV4->ICMP header");
145 SCLogDebug(
"ICMPv4 embedding IPV4 %s->%s - PROTO: %" PRIu32
" ID: %" PRIu32
"", s,d,
168 p->
proto = IPPROTO_ICMP;
176 p->
icmp_d.type = (uint8_t)ctype;
191 case ICMP_DEST_UNREACH:
192 if (p->
icmpv4h->code > NR_ICMP_UNREACH) {
203 case ICMP_SOURCE_QUENCH:
218 if (p->
icmpv4h->code>ICMP_REDIR_HOSTTOS) {
239 case ICMP_TIME_EXCEEDED:
240 if (p->
icmpv4h->code>ICMP_EXC_FRAGTIME) {
253 case ICMP_PARAMETERPROB:
275 case ICMP_TIMESTAMPREPLY:
283 case ICMP_INFO_REQUEST:
291 case ICMP_INFO_REPLY:
307 case ICMP_ADDRESSREPLY:
327 #define CASE_CODE(t,r) case (t): return r; case (r): return t; 330 CASE_CODE(ICMP_TIMESTAMP, ICMP_TIMESTAMPREPLY);
331 CASE_CODE(ICMP_INFO_REQUEST, ICMP_INFO_REPLY);
332 CASE_CODE(ICMP_ROUTERSOLICIT, ICMP_ROUTERADVERT);
333 CASE_CODE(ICMP_ADDRESS, ICMP_ADDRESSREPLY);
346 static int DecodeICMPV4test01(
void)
348 uint8_t raw_icmpv4[] = {
349 0x08, 0x00, 0x78, 0x47, 0xfc, 0x55, 0x00, 0x04,
350 0x52, 0xab, 0x86, 0x4a, 0x84, 0x50, 0x0e, 0x00,
351 0xab, 0xab, 0xab, 0xab, 0xab, 0xab, 0xab, 0xab,
352 0xab, 0xab, 0xab, 0xab, 0xab, 0xab, 0xab, 0xab,
353 0xab, 0xab, 0xab, 0xab, 0xab, 0xab, 0xab, 0xab,
354 0xab, 0xab, 0xab, 0xab, 0xab, 0xab, 0xab, 0xab,
364 memset(&ip4h, 0,
sizeof(
IPV4Hdr));
367 memset(&ip4h, 0,
sizeof(
IPV4Hdr));
377 ip4h.s_ip_src.s_addr = p->
src.addr_data32[0];
378 ip4h.s_ip_dst.s_addr = p->
dst.addr_data32[0];
381 DecodeICMPV4(&tv, &dtv, p, raw_icmpv4,
sizeof(raw_icmpv4), NULL);
398 static int DecodeICMPV4test02(
void)
400 uint8_t raw_icmpv4[] = {
401 0x00, 0x00, 0x57, 0x64, 0xfb, 0x55, 0x00, 0x03,
402 0x43, 0xab, 0x86, 0x4a, 0xf6, 0x49, 0x02, 0x00,
403 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
404 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
405 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
406 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27,
407 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f };
416 memset(&ip4h, 0,
sizeof(
IPV4Hdr));
428 ip4h.s_ip_src.s_addr = p->
src.addr_data32[0];
429 ip4h.s_ip_dst.s_addr = p->
dst.addr_data32[0];
432 DecodeICMPV4(&tv, &dtv, p, raw_icmpv4,
sizeof(raw_icmpv4), NULL);
449 static int DecodeICMPV4test03(
void)
451 uint8_t raw_icmpv4[] = {
452 0x0b, 0x00, 0x6a, 0x3d, 0x00, 0x00, 0x00, 0x00,
453 0x45, 0x00, 0x00, 0x3c, 0x64, 0x15, 0x00, 0x00,
454 0x01, 0x11, 0xde, 0xfd, 0xc0, 0xa8, 0x01, 0x0d,
455 0xd1, 0x55, 0xe3, 0x93, 0x8b, 0x12, 0x82, 0xaa,
456 0x00, 0x28, 0x7c, 0xdd };
465 memset(&ip4h, 0,
sizeof(
IPV4Hdr));
477 ip4h.s_ip_src.s_addr = p->
src.addr_data32[0];
478 ip4h.s_ip_dst.s_addr = p->
dst.addr_data32[0];
481 DecodeICMPV4(&tv, &dtv, p, raw_icmpv4,
sizeof(raw_icmpv4), NULL);
484 printf(
"NULL == p->icmpv4h: ");
490 printf(
"p->icmpv4h->type %u, p->icmpv4h->code %u: ",
498 printf(
"p->icmpv4vars.emb_sport %u, p->icmpv4vars.emb_dport %u: ",
510 if (strcmp(s,
"192.168.1.13") == 0 && strcmp(d,
"209.85.227.147") == 0) {
514 printf(
"s %s, d %s: ", s, d);
527 static int DecodeICMPV4test04(
void)
529 uint8_t raw_icmpv4[] = {
530 0x03, 0x0a, 0x36, 0xc3, 0x00, 0x00, 0x00, 0x00,
531 0x45, 0x00, 0x00, 0x3c, 0x62, 0xee, 0x40, 0x00,
532 0x33, 0x06, 0xb4, 0x8f, 0xc0, 0xa8, 0x01, 0x0d,
533 0x58, 0x60, 0x16, 0x29, 0xb1, 0x0a, 0x00, 0x32,
534 0x3e, 0x36, 0x38, 0x7c, 0x00, 0x00, 0x00, 0x00,
535 0xa0, 0x02, 0x16, 0xd0, 0x72, 0x04, 0x00, 0x00,
536 0x02, 0x04, 0x05, 0x8a, 0x04, 0x02, 0x08, 0x0a };
545 memset(&ip4h, 0,
sizeof(
IPV4Hdr));
557 ip4h.s_ip_src.s_addr = p->
src.addr_data32[0];
558 ip4h.s_ip_dst.s_addr = p->
dst.addr_data32[0];
561 DecodeICMPV4(&tv, &dtv, p, raw_icmpv4,
sizeof(raw_icmpv4), NULL);
585 if (strcmp(s,
"192.168.1.13") == 0 && strcmp(d,
"88.96.22.41") == 0) {
599 static int DecodeICMPV4test05(
void)
601 uint8_t raw_icmpv4[] = {
602 0x0b, 0x00, 0x5c, 0x46, 0x00, 0x00, 0x00, 0x00, 0x45,
603 0x00, 0x00, 0x30, 0x02, 0x17, 0x40, 0x00, 0x01, 0x06,
604 0xd6, 0xbd, 0xc0, 0xa8, 0x02, 0x05, 0x3d, 0x23, 0xa1,
605 0x23, 0x04, 0x18, 0x00, 0x50, 0xd2, 0x08, 0xc2, 0x48,
615 memset(&ip4h, 0,
sizeof(
IPV4Hdr));
627 ip4h.s_ip_src.s_addr = p->
src.addr_data32[0];
628 ip4h.s_ip_dst.s_addr = p->
dst.addr_data32[0];
631 DecodeICMPV4(&tv, &dtv, p, raw_icmpv4,
sizeof(raw_icmpv4), NULL);
655 if (strcmp(s,
"192.168.2.5") == 0 && strcmp(d,
"61.35.161.35") == 0) {
665 static int ICMPV4CalculateValidChecksumtest05(
void)
669 uint8_t raw_icmpv4[] = {
670 0x08, 0x00, 0xab, 0x9b, 0x7f, 0x2b, 0x05, 0x2c,
671 0x3f, 0x72, 0x93, 0x4a, 0x00, 0x4d, 0x0a, 0x00,
672 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
673 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
674 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
675 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27,
676 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
677 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37};
679 csum = *( ((uint16_t *)raw_icmpv4) + 1);
680 return (csum == ICMPV4CalculateChecksum((uint16_t *)raw_icmpv4,
sizeof(raw_icmpv4)));
683 static int ICMPV4CalculateInvalidChecksumtest06(
void)
687 uint8_t raw_icmpv4[] = {
688 0x08, 0x00, 0xab, 0x9b, 0x7f, 0x2b, 0x05, 0x2c,
689 0x3f, 0x72, 0x93, 0x4a, 0x00, 0x4d, 0x0a, 0x00,
690 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
691 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
692 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
693 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27,
694 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
695 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x38};
697 csum = *( ((uint16_t *)raw_icmpv4) + 1);
698 return (csum != ICMPV4CalculateChecksum((uint16_t *)raw_icmpv4,
sizeof(raw_icmpv4)));
701 static int ICMPV4InvalidType07(
void)
704 uint8_t raw_icmpv4[] = {
705 0xff, 0x00, 0xab, 0x9b, 0x7f, 0x2b, 0x05, 0x2c,
706 0x3f, 0x72, 0x93, 0x4a, 0x00, 0x4d, 0x0a, 0x00,
707 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
708 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
709 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
710 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27,
711 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
712 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x38};
722 memset(&ip4h, 0,
sizeof(
IPV4Hdr));
734 ip4h.s_ip_src.s_addr = p->
src.addr_data32[0];
735 ip4h.s_ip_dst.s_addr = p->
dst.addr_data32[0];
738 DecodeICMPV4(&tv, &dtv, p, raw_icmpv4,
sizeof(raw_icmpv4), NULL);
753 static int DecodeICMPV4test08(
void)
755 uint8_t raw_icmpv4[] = {
756 0x08, 0x00, 0x78, 0x47, 0xfc, 0x55, 0x00, 0x00
766 memset(&ip4h, 0,
sizeof(
IPV4Hdr));
778 ip4h.s_ip_src.s_addr = p->
src.addr_data32[0];
779 ip4h.s_ip_dst.s_addr = p->
dst.addr_data32[0];
782 DecodeICMPV4(&tv, &dtv, p, raw_icmpv4,
sizeof(raw_icmpv4), NULL);
808 ICMPV4CalculateValidChecksumtest05);
810 ICMPV4CalculateInvalidChecksumtest06);
void FlowSetupPacket(Packet *p)
prepare packet for a life with flow Set PKT_WANTS_FLOW flag to incidate workers should do a flow look...
#define ENGINE_SET_EVENT(p, e)
#define ICMPV4_HEADER_PKT_OFFSET
#define ENGINE_ISSET_EVENT(p, e)
struct in_addr emb_ip4_dst
uint32_t UTHSetIPv4Address(const char *str)
return the uint32_t for a ipv4 address string
int DecodeICMPV4(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len, PacketQueue *pq)
Main ICMPv4 decoding function.
struct Packet_::@43::@52 icmp_s
#define IPV4_GET_RAW_VER(ip4h)
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Structure to hold thread specific data for all decode modules.
#define IPV4_GET_RAW_IPID(ip4h)
#define IPV4_GET_RAW_IPPROTO(ip4h)
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
struct in_addr emb_ip4_src
#define ICMPV4_HEADER_LEN
struct Packet_::@45::@53 icmp_d
int ICMPv4GetCounterpart(uint8_t type)
#define IPV4_GET_RAW_HLEN(ip4h)
#define IPV4_GET_RAW_IPDST(ip4h)
void FlowShutdown(void)
shutdown the flow engine
Per thread variable structure.
#define IPV4_GET_RAW_IPSRC(ip4h)
void DecodeICMPV4RegisterTests(void)
Registers ICMPV4 unit test.
#define ENGINE_SET_INVALID_EVENT(p, e)
void FlowInitConfig(char quiet)
initialize the configuration