50 static int DecodePartialIPV4(
Packet* p, uint8_t* partial_packet, uint16_t
len)
54 SCLogDebug(
"DecodePartialIPV4: ICMPV4_IPV4_TRUNC_PKT");
64 SCLogDebug(
"DecodePartialIPV4: ICMPv4 contains Unknown IPV4 version "
65 "ICMPV4_IPV4_UNKNOWN_VER");
87 SCLogDebug(
"DecodePartialIPV4: ICMPV4->IPV4->TCP header sport: "
98 SCLogDebug(
"DecodePartialIPV4: ICMPV4->IPV4->TCP partial header sport: "
102 SCLogDebug(
"DecodePartialIPV4: Warning, ICMPV4->IPV4->TCP "
103 "header Didn't fit in the packet!");
116 SCLogDebug(
"DecodePartialIPV4: ICMPV4->IPV4->UDP header sport: "
120 SCLogDebug(
"DecodePartialIPV4: Warning, ICMPV4->IPV4->UDP "
121 "header Didn't fit in the packet!");
134 SCLogDebug(
"DecodePartialIPV4: ICMPV4->IPV4->ICMP header");
145 SCLogDebug(
"ICMPv4 embedding IPV4 %s->%s - PROTO: %" PRIu32
" ID: %" PRIu32
"", s,d,
168 p->
proto = IPPROTO_ICMP;
174 p->
icmp_d.type = (uint8_t)ctype;
190 case ICMP_DEST_UNREACH:
191 if (p->
icmpv4h->code > NR_ICMP_UNREACH) {
202 case ICMP_SOURCE_QUENCH:
217 if (p->
icmpv4h->code>ICMP_REDIR_HOSTTOS) {
238 case ICMP_TIME_EXCEEDED:
239 if (p->
icmpv4h->code>ICMP_EXC_FRAGTIME) {
252 case ICMP_PARAMETERPROB:
280 case ICMP_TIMESTAMPREPLY:
294 case ICMP_INFO_REQUEST:
302 case ICMP_INFO_REPLY:
310 case ICMP_ROUTERADVERT: {
312 ICMPV4RtrAdvert *icmpv4_router_advert = (ICMPV4RtrAdvert *)(pkt +
sizeof(ICMPV4Hdr));
313 uint32_t advert_len = icmpv4_router_advert->naddr *
314 (icmpv4_router_advert->addr_sz *
sizeof(uint32_t));
330 case ICMP_ADDRESSREPLY:
353 #define CASE_CODE(t,r) case (t): return r; case (r): return t;
356 CASE_CODE(ICMP_TIMESTAMP, ICMP_TIMESTAMPREPLY);
357 CASE_CODE(ICMP_INFO_REQUEST, ICMP_INFO_REPLY);
358 CASE_CODE(ICMP_ROUTERSOLICIT, ICMP_ROUTERADVERT);
359 CASE_CODE(ICMP_ADDRESS, ICMP_ADDRESSREPLY);
372 static int DecodeICMPV4test01(
void)
374 uint8_t raw_icmpv4[] = {
375 0x08, 0x00, 0x78, 0x47, 0xfc, 0x55, 0x00, 0x04,
376 0x52, 0xab, 0x86, 0x4a, 0x84, 0x50, 0x0e, 0x00,
377 0xab, 0xab, 0xab, 0xab, 0xab, 0xab, 0xab, 0xab,
378 0xab, 0xab, 0xab, 0xab, 0xab, 0xab, 0xab, 0xab,
379 0xab, 0xab, 0xab, 0xab, 0xab, 0xab, 0xab, 0xab,
380 0xab, 0xab, 0xab, 0xab, 0xab, 0xab, 0xab, 0xab,
390 memset(&ip4h, 0,
sizeof(
IPV4Hdr));
393 memset(&ip4h, 0,
sizeof(
IPV4Hdr));
403 ip4h.s_ip_src.s_addr = p->
src.addr_data32[0];
404 ip4h.s_ip_dst.s_addr = p->
dst.addr_data32[0];
424 static int DecodeICMPV4test02(
void)
426 uint8_t raw_icmpv4[] = {
427 0x00, 0x00, 0x57, 0x64, 0xfb, 0x55, 0x00, 0x03,
428 0x43, 0xab, 0x86, 0x4a, 0xf6, 0x49, 0x02, 0x00,
429 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
430 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
431 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
432 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27,
433 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f };
442 memset(&ip4h, 0,
sizeof(
IPV4Hdr));
454 ip4h.s_ip_src.s_addr = p->
src.addr_data32[0];
455 ip4h.s_ip_dst.s_addr = p->
dst.addr_data32[0];
475 static int DecodeICMPV4test03(
void)
477 uint8_t raw_icmpv4[] = {
478 0x0b, 0x00, 0x6a, 0x3d, 0x00, 0x00, 0x00, 0x00,
479 0x45, 0x00, 0x00, 0x3c, 0x64, 0x15, 0x00, 0x00,
480 0x01, 0x11, 0xde, 0xfd, 0xc0, 0xa8, 0x01, 0x0d,
481 0xd1, 0x55, 0xe3, 0x93, 0x8b, 0x12, 0x82, 0xaa,
482 0x00, 0x28, 0x7c, 0xdd };
491 memset(&ip4h, 0,
sizeof(
IPV4Hdr));
503 ip4h.s_ip_src.s_addr = p->
src.addr_data32[0];
504 ip4h.s_ip_dst.s_addr = p->
dst.addr_data32[0];
510 printf(
"NULL == p->icmpv4h: ");
516 printf(
"p->icmpv4h->type %u, p->icmpv4h->code %u: ",
524 printf(
"p->icmpv4vars.emb_sport %u, p->icmpv4vars.emb_dport %u: ",
536 if (strcmp(s,
"192.168.1.13") == 0 && strcmp(d,
"209.85.227.147") == 0) {
540 printf(
"s %s, d %s: ", s, d);
553 static int DecodeICMPV4test04(
void)
555 uint8_t raw_icmpv4[] = {
556 0x03, 0x0a, 0x36, 0xc3, 0x00, 0x00, 0x00, 0x00,
557 0x45, 0x00, 0x00, 0x3c, 0x62, 0xee, 0x40, 0x00,
558 0x33, 0x06, 0xb4, 0x8f, 0xc0, 0xa8, 0x01, 0x0d,
559 0x58, 0x60, 0x16, 0x29, 0xb1, 0x0a, 0x00, 0x32,
560 0x3e, 0x36, 0x38, 0x7c, 0x00, 0x00, 0x00, 0x00,
561 0xa0, 0x02, 0x16, 0xd0, 0x72, 0x04, 0x00, 0x00,
562 0x02, 0x04, 0x05, 0x8a, 0x04, 0x02, 0x08, 0x0a };
571 memset(&ip4h, 0,
sizeof(
IPV4Hdr));
583 ip4h.s_ip_src.s_addr = p->
src.addr_data32[0];
584 ip4h.s_ip_dst.s_addr = p->
dst.addr_data32[0];
611 if (strcmp(s,
"192.168.1.13") == 0 && strcmp(d,
"88.96.22.41") == 0) {
625 static int DecodeICMPV4test05(
void)
627 uint8_t raw_icmpv4[] = {
628 0x0b, 0x00, 0x5c, 0x46, 0x00, 0x00, 0x00, 0x00, 0x45,
629 0x00, 0x00, 0x30, 0x02, 0x17, 0x40, 0x00, 0x01, 0x06,
630 0xd6, 0xbd, 0xc0, 0xa8, 0x02, 0x05, 0x3d, 0x23, 0xa1,
631 0x23, 0x04, 0x18, 0x00, 0x50, 0xd2, 0x08, 0xc2, 0x48,
641 memset(&ip4h, 0,
sizeof(
IPV4Hdr));
653 ip4h.s_ip_src.s_addr = p->
src.addr_data32[0];
654 ip4h.s_ip_dst.s_addr = p->
dst.addr_data32[0];
681 if (strcmp(s,
"192.168.2.5") == 0 && strcmp(d,
"61.35.161.35") == 0) {
691 static int ICMPV4CalculateValidChecksumtest05(
void)
695 uint8_t raw_icmpv4[] = {
696 0x08, 0x00, 0xab, 0x9b, 0x7f, 0x2b, 0x05, 0x2c,
697 0x3f, 0x72, 0x93, 0x4a, 0x00, 0x4d, 0x0a, 0x00,
698 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
699 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
700 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
701 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27,
702 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
703 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37};
705 csum = *( ((uint16_t *)raw_icmpv4) + 1);
706 return (csum == ICMPV4CalculateChecksum((uint16_t *)raw_icmpv4,
sizeof(raw_icmpv4)));
709 static int ICMPV4CalculateInvalidChecksumtest06(
void)
713 uint8_t raw_icmpv4[] = {
714 0x08, 0x00, 0xab, 0x9b, 0x7f, 0x2b, 0x05, 0x2c,
715 0x3f, 0x72, 0x93, 0x4a, 0x00, 0x4d, 0x0a, 0x00,
716 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
717 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
718 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
719 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27,
720 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
721 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x38};
723 csum = *( ((uint16_t *)raw_icmpv4) + 1);
724 return (csum != ICMPV4CalculateChecksum((uint16_t *)raw_icmpv4,
sizeof(raw_icmpv4)));
727 static int ICMPV4InvalidType07(
void)
730 uint8_t raw_icmpv4[] = {
731 0xff, 0x00, 0xab, 0x9b, 0x7f, 0x2b, 0x05, 0x2c,
732 0x3f, 0x72, 0x93, 0x4a, 0x00, 0x4d, 0x0a, 0x00,
733 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
734 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
735 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
736 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27,
737 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
738 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x38};
748 memset(&ip4h, 0,
sizeof(
IPV4Hdr));
760 ip4h.s_ip_src.s_addr = p->
src.addr_data32[0];
761 ip4h.s_ip_dst.s_addr = p->
dst.addr_data32[0];
779 static int DecodeICMPV4test08(
void)
781 uint8_t raw_icmpv4[] = {
782 0x08, 0x00, 0x78, 0x47, 0xfc, 0x55, 0x00, 0x00
792 memset(&ip4h, 0,
sizeof(
IPV4Hdr));
804 ip4h.s_ip_src.s_addr = p->
src.addr_data32[0];
805 ip4h.s_ip_dst.s_addr = p->
dst.addr_data32[0];
834 ICMPV4CalculateValidChecksumtest05);
836 ICMPV4CalculateInvalidChecksumtest06);