suricata
decode-icmpv4.h File Reference
#include "decode-tcp.h"
#include "decode-udp.h"
Include dependency graph for decode-icmpv4.h:
This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Data Structures

struct  ICMPV4Hdr_
 
struct  ICMPV4ExtHdr_
 
struct  ICMPV4Vars_
 
struct  ICMPV4RtrAdvert_
 
struct  ICMPV4Timestamp_
 

Macros

#define ICMPV4_HEADER_LEN   8
 
#define ICMP_ECHOREPLY   0 /* Echo Reply */
 
#define ICMP_DEST_UNREACH   3 /* Destination Unreachable */
 
#define ICMP_SOURCE_QUENCH   4 /* Source Quench */
 
#define ICMP_REDIRECT   5 /* Redirect (change route) */
 
#define ICMP_ECHO   8 /* Echo Request */
 
#define ICMP_ROUTERADVERT   9
 
#define ICMP_ROUTERSOLICIT   10
 
#define ICMP_TIME_EXCEEDED   11 /* Time Exceeded */
 
#define ICMP_PARAMETERPROB   12 /* Parameter Problem */
 
#define ICMP_TIMESTAMP   13 /* Timestamp Request */
 
#define ICMP_TIMESTAMPREPLY   14 /* Timestamp Reply */
 
#define ICMP_INFO_REQUEST   15 /* Information Request */
 
#define ICMP_INFO_REPLY   16 /* Information Reply */
 
#define ICMP_ADDRESS   17 /* Address Mask Request */
 
#define ICMP_ADDRESSREPLY   18 /* Address Mask Reply */
 
#define NR_ICMP_TYPES   18
 
#define ICMP_NET_UNREACH   0 /* Network Unreachable */
 
#define ICMP_HOST_UNREACH   1 /* Host Unreachable */
 
#define ICMP_PROT_UNREACH   2 /* Protocol Unreachable */
 
#define ICMP_PORT_UNREACH   3 /* Port Unreachable */
 
#define ICMP_FRAG_NEEDED   4 /* Fragmentation Needed/DF set */
 
#define ICMP_SR_FAILED   5 /* Source Route failed */
 
#define ICMP_NET_UNKNOWN   6
 
#define ICMP_HOST_UNKNOWN   7
 
#define ICMP_HOST_ISOLATED   8
 
#define ICMP_NET_ANO   9
 
#define ICMP_HOST_ANO   10
 
#define ICMP_NET_UNR_TOS   11
 
#define ICMP_HOST_UNR_TOS   12
 
#define ICMP_PKT_FILTERED   13 /* Packet filtered */
 
#define ICMP_PREC_VIOLATION   14 /* Precedence violation */
 
#define ICMP_PREC_CUTOFF   15 /* Precedence cut off */
 
#define NR_ICMP_UNREACH   15 /* instead of hardcoding immediate value */
 
#define ICMP_REDIR_NET   0 /* Redirect Net */
 
#define ICMP_REDIR_HOST   1 /* Redirect Host */
 
#define ICMP_REDIR_NETTOS   2 /* Redirect Net for TOS */
 
#define ICMP_REDIR_HOSTTOS   3 /* Redirect Host for TOS */
 
#define ICMP_EXC_TTL   0 /* TTL count exceeded */
 
#define ICMP_EXC_FRAGTIME   1 /* Fragment Reass time exceeded */
 
#define ICMPV4_GET_TYPE(p)   (p)->icmpv4h->type
 
#define ICMPV4_GET_CODE(p)   (p)->icmpv4h->code
 
#define CLEAR_ICMPV4_PACKET(p)
 
#define ICMPV4_HEADER_PKT_OFFSET   8
 
#define ICMPV4_GET_TYPE(p)   (p)->icmpv4h->type
 
#define ICMPV4_GET_CODE(p)   (p)->icmpv4h->code
 
#define ICMPV4_GET_RAW_CSUM(p)   SCNtohs((p)->icmpv4h->checksum)
 
#define ICMPV4_GET_CSUM(p)   (p)->icmpv4h->checksum
 
#define ICMPV4_GET_ID(p)   ((p)->icmpv4vars.id)
 
#define ICMPV4_GET_SEQ(p)   ((p)->icmpv4vars.seq)
 
#define ICMPV4_GET_EMB_PROTO(p)   (p)->icmpv4vars.emb_ip4_proto
 
#define ICMPV4_GET_EMB_IPV4(p)   (p)->icmpv4vars.emb_ipv4h
 
#define ICMPV4_GET_EMB_TCP(p)   (p)->icmpv4vars.emb_tcph
 
#define ICMPV4_GET_EMB_UDP(p)   (p)->icmpv4vars.emb_udph
 
#define ICMPV4_GET_EMB_ICMPV4H(p)   (p)->icmpv4vars.emb_icmpv4h
 
#define ICMPV4_GET_HLEN_ICMPV4H(p)   (p)->icmpv4vars.hlen
 
#define ICMPV4_DEST_UNREACH_IS_VALID(p)
 
#define ICMPV4_IS_ERROR_MSG(p)
 

Typedefs

typedef struct ICMPV4ExtHdr_ ICMPV4ExtHdr
 
typedef struct ICMPV4Vars_ ICMPV4Vars
 

Functions

struct ICMPV4Hdr_ __attribute__ ((__packed__)) ICMPV4Hdr
 DNP3 link header. More...
 
void DecodeICMPV4RegisterTests (void)
 Registers ICMPV4 unit test. More...
 
int ICMPv4GetCounterpart (uint8_t type)
 

Variables

uint8_t type
 
uint8_t code
 
uint16_t checksum
 
uint8_t naddr
 
uint8_t addr_sz
 
uint32_t orig_ts
 
uint32_t rx_ts
 
uint32_t tx_ts
 

Detailed Description

Macro Definition Documentation

◆ CLEAR_ICMPV4_PACKET

#define CLEAR_ICMPV4_PACKET (   p)
Value:
do { \
(p)->level4_comp_csum = -1; \
PACKET_CLEAR_L4VARS((p)); \
(p)->icmpv4h = NULL; \
} while(0)

Definition at line 225 of file decode-icmpv4.h.

◆ ICMP_ADDRESS

#define ICMP_ADDRESS   17 /* Address Mask Request */

Definition at line 73 of file decode-icmpv4.h.

◆ ICMP_ADDRESSREPLY

#define ICMP_ADDRESSREPLY   18 /* Address Mask Reply */

Definition at line 76 of file decode-icmpv4.h.

◆ ICMP_DEST_UNREACH

#define ICMP_DEST_UNREACH   3 /* Destination Unreachable */

Definition at line 37 of file decode-icmpv4.h.

◆ ICMP_ECHO

#define ICMP_ECHO   8 /* Echo Request */

Definition at line 46 of file decode-icmpv4.h.

◆ ICMP_ECHOREPLY

#define ICMP_ECHOREPLY   0 /* Echo Reply */

Definition at line 34 of file decode-icmpv4.h.

◆ ICMP_EXC_FRAGTIME

#define ICMP_EXC_FRAGTIME   1 /* Fragment Reass time exceeded */

Definition at line 156 of file decode-icmpv4.h.

◆ ICMP_EXC_TTL

#define ICMP_EXC_TTL   0 /* TTL count exceeded */

Definition at line 153 of file decode-icmpv4.h.

◆ ICMP_FRAG_NEEDED

#define ICMP_FRAG_NEEDED   4 /* Fragmentation Needed/DF set */

Definition at line 97 of file decode-icmpv4.h.

◆ ICMP_HOST_ANO

#define ICMP_HOST_ANO   10

Definition at line 115 of file decode-icmpv4.h.

◆ ICMP_HOST_ISOLATED

#define ICMP_HOST_ISOLATED   8

Definition at line 109 of file decode-icmpv4.h.

◆ ICMP_HOST_UNKNOWN

#define ICMP_HOST_UNKNOWN   7

Definition at line 106 of file decode-icmpv4.h.

◆ ICMP_HOST_UNR_TOS

#define ICMP_HOST_UNR_TOS   12

Definition at line 121 of file decode-icmpv4.h.

◆ ICMP_HOST_UNREACH

#define ICMP_HOST_UNREACH   1 /* Host Unreachable */

Definition at line 88 of file decode-icmpv4.h.

◆ ICMP_INFO_REPLY

#define ICMP_INFO_REPLY   16 /* Information Reply */

Definition at line 70 of file decode-icmpv4.h.

◆ ICMP_INFO_REQUEST

#define ICMP_INFO_REQUEST   15 /* Information Request */

Definition at line 67 of file decode-icmpv4.h.

◆ ICMP_NET_ANO

#define ICMP_NET_ANO   9

Definition at line 112 of file decode-icmpv4.h.

◆ ICMP_NET_UNKNOWN

#define ICMP_NET_UNKNOWN   6

Definition at line 103 of file decode-icmpv4.h.

◆ ICMP_NET_UNR_TOS

#define ICMP_NET_UNR_TOS   11

Definition at line 118 of file decode-icmpv4.h.

◆ ICMP_NET_UNREACH

#define ICMP_NET_UNREACH   0 /* Network Unreachable */

Definition at line 85 of file decode-icmpv4.h.

◆ ICMP_PARAMETERPROB

#define ICMP_PARAMETERPROB   12 /* Parameter Problem */

Definition at line 58 of file decode-icmpv4.h.

◆ ICMP_PKT_FILTERED

#define ICMP_PKT_FILTERED   13 /* Packet filtered */

Definition at line 124 of file decode-icmpv4.h.

◆ ICMP_PORT_UNREACH

#define ICMP_PORT_UNREACH   3 /* Port Unreachable */

Definition at line 94 of file decode-icmpv4.h.

◆ ICMP_PREC_CUTOFF

#define ICMP_PREC_CUTOFF   15 /* Precedence cut off */

Definition at line 131 of file decode-icmpv4.h.

◆ ICMP_PREC_VIOLATION

#define ICMP_PREC_VIOLATION   14 /* Precedence violation */

Definition at line 127 of file decode-icmpv4.h.

◆ ICMP_PROT_UNREACH

#define ICMP_PROT_UNREACH   2 /* Protocol Unreachable */

Definition at line 91 of file decode-icmpv4.h.

◆ ICMP_REDIR_HOST

#define ICMP_REDIR_HOST   1 /* Redirect Host */

Definition at line 142 of file decode-icmpv4.h.

◆ ICMP_REDIR_HOSTTOS

#define ICMP_REDIR_HOSTTOS   3 /* Redirect Host for TOS */

Definition at line 148 of file decode-icmpv4.h.

◆ ICMP_REDIR_NET

#define ICMP_REDIR_NET   0 /* Redirect Net */

Definition at line 139 of file decode-icmpv4.h.

◆ ICMP_REDIR_NETTOS

#define ICMP_REDIR_NETTOS   2 /* Redirect Net for TOS */

Definition at line 145 of file decode-icmpv4.h.

◆ ICMP_REDIRECT

#define ICMP_REDIRECT   5 /* Redirect (change route) */

Definition at line 43 of file decode-icmpv4.h.

◆ ICMP_ROUTERADVERT

#define ICMP_ROUTERADVERT   9

Definition at line 49 of file decode-icmpv4.h.

◆ ICMP_ROUTERSOLICIT

#define ICMP_ROUTERSOLICIT   10

Definition at line 52 of file decode-icmpv4.h.

◆ ICMP_SOURCE_QUENCH

#define ICMP_SOURCE_QUENCH   4 /* Source Quench */

Definition at line 40 of file decode-icmpv4.h.

◆ ICMP_SR_FAILED

#define ICMP_SR_FAILED   5 /* Source Route failed */

Definition at line 100 of file decode-icmpv4.h.

◆ ICMP_TIME_EXCEEDED

#define ICMP_TIME_EXCEEDED   11 /* Time Exceeded */

Definition at line 55 of file decode-icmpv4.h.

◆ ICMP_TIMESTAMP

#define ICMP_TIMESTAMP   13 /* Timestamp Request */

Definition at line 61 of file decode-icmpv4.h.

◆ ICMP_TIMESTAMPREPLY

#define ICMP_TIMESTAMPREPLY   14 /* Timestamp Reply */

Definition at line 64 of file decode-icmpv4.h.

◆ ICMPV4_DEST_UNREACH_IS_VALID

#define ICMPV4_DEST_UNREACH_IS_VALID (   p)
Value:
( \
(!((p)->flags & PKT_IS_INVALID)) && \
((p)->icmpv4h != NULL) && \
(ICMPV4_GET_EMB_IPV4((p)) != NULL) && \
((ICMPV4_GET_EMB_TCP((p)) != NULL) || \
(ICMPV4_GET_EMB_UDP((p)) != NULL)))

macro for checking if a ICMP DEST UNREACH packet is valid for use in other parts of the engine, such as the flow engine.

Warning
use only after the decoder has processed the packet

Definition at line 268 of file decode-icmpv4.h.

◆ ICMPV4_GET_CODE [1/2]

#define ICMPV4_GET_CODE (   p)    (p)->icmpv4h->code

marco for icmpv4 code access

macro for icmpv4 "code" access

Definition at line 236 of file decode-icmpv4.h.

◆ ICMPV4_GET_CODE [2/2]

#define ICMPV4_GET_CODE (   p)    (p)->icmpv4h->code

marco for icmpv4 code access

macro for icmpv4 "code" access

Definition at line 236 of file decode-icmpv4.h.

◆ ICMPV4_GET_CSUM

#define ICMPV4_GET_CSUM (   p)    (p)->icmpv4h->checksum

Definition at line 239 of file decode-icmpv4.h.

◆ ICMPV4_GET_EMB_ICMPV4H

#define ICMPV4_GET_EMB_ICMPV4H (   p)    (p)->icmpv4vars.emb_icmpv4h

macro for icmpv4 embedded "icmpv4h" header access

Definition at line 259 of file decode-icmpv4.h.

◆ ICMPV4_GET_EMB_IPV4

#define ICMPV4_GET_EMB_IPV4 (   p)    (p)->icmpv4vars.emb_ipv4h

macro for icmpv4 embedded "ipv4h" header access

Definition at line 253 of file decode-icmpv4.h.

◆ ICMPV4_GET_EMB_PROTO

#define ICMPV4_GET_EMB_PROTO (   p)    (p)->icmpv4vars.emb_ip4_proto

macro for icmpv4 embedded "protocol" access

Definition at line 251 of file decode-icmpv4.h.

◆ ICMPV4_GET_EMB_TCP

#define ICMPV4_GET_EMB_TCP (   p)    (p)->icmpv4vars.emb_tcph

macro for icmpv4 embedded "tcph" header access

Definition at line 255 of file decode-icmpv4.h.

◆ ICMPV4_GET_EMB_UDP

#define ICMPV4_GET_EMB_UDP (   p)    (p)->icmpv4vars.emb_udph

macro for icmpv4 embedded "udph" header access

Definition at line 257 of file decode-icmpv4.h.

◆ ICMPV4_GET_HLEN_ICMPV4H

#define ICMPV4_GET_HLEN_ICMPV4H (   p)    (p)->icmpv4vars.hlen

macro for icmpv4 header length

Definition at line 261 of file decode-icmpv4.h.

◆ ICMPV4_GET_ID

#define ICMPV4_GET_ID (   p)    ((p)->icmpv4vars.id)

macro for icmpv4 "id" access

Definition at line 244 of file decode-icmpv4.h.

◆ ICMPV4_GET_RAW_CSUM

#define ICMPV4_GET_RAW_CSUM (   p)    SCNtohs((p)->icmpv4h->checksum)

macro for icmpv4 "csum" access

Definition at line 238 of file decode-icmpv4.h.

◆ ICMPV4_GET_SEQ

#define ICMPV4_GET_SEQ (   p)    ((p)->icmpv4vars.seq)

macro for icmpv4 "seq" access

Definition at line 246 of file decode-icmpv4.h.

◆ ICMPV4_GET_TYPE [1/2]

#define ICMPV4_GET_TYPE (   p)    (p)->icmpv4h->type

marco for icmpv4 type access

macro for icmpv4 "type" access

Definition at line 234 of file decode-icmpv4.h.

◆ ICMPV4_GET_TYPE [2/2]

#define ICMPV4_GET_TYPE (   p)    (p)->icmpv4h->type

marco for icmpv4 type access

macro for icmpv4 "type" access

Definition at line 234 of file decode-icmpv4.h.

◆ ICMPV4_HEADER_LEN

#define ICMPV4_HEADER_LEN   8

Definition at line 31 of file decode-icmpv4.h.

◆ ICMPV4_HEADER_PKT_OFFSET

#define ICMPV4_HEADER_PKT_OFFSET   8

Definition at line 231 of file decode-icmpv4.h.

◆ ICMPV4_IS_ERROR_MSG

#define ICMPV4_IS_ERROR_MSG (   p)
Value:
ICMPV4_GET_TYPE((p)) == ICMP_SOURCE_QUENCH || \
ICMPV4_GET_TYPE((p)) == ICMP_REDIRECT || \
ICMPV4_GET_TYPE((p)) == ICMP_TIME_EXCEEDED || \
ICMPV4_GET_TYPE((p)) == ICMP_PARAMETERPROB)

marco for checking if a ICMP packet is an error message or an query message.

Todo:
This check is used in the flow engine and needs to be as cheap as possible. Consider setting a bitflag at the decoder stage so we can to a bit check instead of the more expensive check below.

Definition at line 285 of file decode-icmpv4.h.

◆ NR_ICMP_TYPES

#define NR_ICMP_TYPES   18

Definition at line 79 of file decode-icmpv4.h.

◆ NR_ICMP_UNREACH

#define NR_ICMP_UNREACH   15 /* instead of hardcoding immediate value */

Definition at line 134 of file decode-icmpv4.h.

Typedef Documentation

◆ ICMPV4ExtHdr

typedef struct ICMPV4ExtHdr_ ICMPV4ExtHdr

◆ ICMPV4Vars

typedef struct ICMPV4Vars_ ICMPV4Vars

Function Documentation

◆ DecodeICMPV4RegisterTests()

void DecodeICMPV4RegisterTests ( void  )

Registers ICMPV4 unit test.

Definition at line 827 of file decode-icmpv4.c.

References UtRegisterTest().

Here is the call graph for this function:

◆ ICMPv4GetCounterpart()

int ICMPv4GetCounterpart ( uint8_t  type)
Return values
typecounterpart type or -1

Definition at line 360 of file decode-icmpv4.c.

References CASE_CODE, ICMP_ADDRESS, ICMP_ADDRESSREPLY, ICMP_ECHO, ICMP_ECHOREPLY, ICMP_INFO_REPLY, ICMP_INFO_REQUEST, ICMP_ROUTERADVERT, ICMP_ROUTERSOLICIT, ICMP_TIMESTAMP, ICMP_TIMESTAMPREPLY, and type.

Referenced by DecodeICMPV4().

Here is the caller graph for this function:

Variable Documentation

◆ addr_sz

uint8_t addr_sz

Size of each advertised address

Definition at line 4 of file decode-icmpv4.h.

◆ checksum

uint16_t checksum

Definition at line 2 of file decode-icmpv4.h.

◆ code

uint8_t code

Definition at line 1 of file decode-icmpv4.h.

Referenced by DecodeRegisterPerfCounters().

◆ naddr

uint8_t naddr

Number of advertised addresses

Definition at line 1 of file decode-icmpv4.h.

◆ orig_ts

uint32_t orig_ts

Definition at line 0 of file decode-icmpv4.h.

◆ rx_ts

uint32_t rx_ts

Definition at line 1 of file decode-icmpv4.h.

◆ tx_ts

uint32_t tx_ts

Definition at line 2 of file decode-icmpv4.h.

◆ type

ICMP_PARAMETERPROB
#define ICMP_PARAMETERPROB
Definition: decode-icmpv4.h:57
ICMP_REDIRECT
#define ICMP_REDIRECT
Definition: decode-icmpv4.h:42
ICMP_SOURCE_QUENCH
#define ICMP_SOURCE_QUENCH
Definition: decode-icmpv4.h:39
ICMPV4_GET_EMB_UDP
#define ICMPV4_GET_EMB_UDP(p)
Definition: decode-icmpv4.h:256
ICMPV4_GET_EMB_IPV4
#define ICMPV4_GET_EMB_IPV4(p)
Definition: decode-icmpv4.h:252
ICMPV4_GET_TYPE
#define ICMPV4_GET_TYPE(p)
Definition: decode-icmpv4.h:233
ICMP_TIME_EXCEEDED
#define ICMP_TIME_EXCEEDED
Definition: decode-icmpv4.h:54
flags
uint8_t flags
Definition: decode-gre.h:0
ICMP_DEST_UNREACH
#define ICMP_DEST_UNREACH
Definition: decode-icmpv4.h:36
ICMPV4_GET_EMB_TCP
#define ICMPV4_GET_EMB_TCP(p)
Definition: decode-icmpv4.h:254
PKT_IS_INVALID
#define PKT_IS_INVALID
Definition: decode.h:1027