suricata
decode-icmpv4.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2010 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  */
23 
24 #ifndef __DECODE_ICMPV4_H__
25 #define __DECODE_ICMPV4_H__
26 
27 #include "decode.h"
28 #include "decode-tcp.h"
29 #include "decode-sctp.h"
30 #include "decode-udp.h"
31 
32 #define ICMPV4_HEADER_LEN 8
33 
34 #ifndef ICMP_ECHOREPLY
35 #define ICMP_ECHOREPLY 0 /* Echo Reply */
36 #endif
37 #ifndef ICMP_DEST_UNREACH
38 #define ICMP_DEST_UNREACH 3 /* Destination Unreachable */
39 #endif
40 #ifndef ICMP_SOURCE_QUENCH
41 #define ICMP_SOURCE_QUENCH 4 /* Source Quench */
42 #endif
43 #ifndef ICMP_REDIRECT
44 #define ICMP_REDIRECT 5 /* Redirect (change route) */
45 #endif
46 #ifndef ICMP_ECHO
47 #define ICMP_ECHO 8 /* Echo Request */
48 #endif
49 #ifndef ICMP_ROUTERADVERT
50 #define ICMP_ROUTERADVERT 9
51 #endif
52 #ifndef ICMP_ROUTERSOLICIT
53 #define ICMP_ROUTERSOLICIT 10
54 #endif
55 #ifndef ICMP_TIME_EXCEEDED
56 #define ICMP_TIME_EXCEEDED 11 /* Time Exceeded */
57 #endif
58 #ifndef ICMP_PARAMETERPROB
59 #define ICMP_PARAMETERPROB 12 /* Parameter Problem */
60 #endif
61 #ifndef ICMP_TIMESTAMP
62 #define ICMP_TIMESTAMP 13 /* Timestamp Request */
63 #endif
64 #ifndef ICMP_TIMESTAMPREPLY
65 #define ICMP_TIMESTAMPREPLY 14 /* Timestamp Reply */
66 #endif
67 #ifndef ICMP_INFO_REQUEST
68 #define ICMP_INFO_REQUEST 15 /* Information Request */
69 #endif
70 #ifndef ICMP_INFO_REPLY
71 #define ICMP_INFO_REPLY 16 /* Information Reply */
72 #endif
73 #ifndef ICMP_ADDRESS
74 #define ICMP_ADDRESS 17 /* Address Mask Request */
75 #endif
76 #ifndef ICMP_ADDRESSREPLY
77 #define ICMP_ADDRESSREPLY 18 /* Address Mask Reply */
78 #endif
79 #ifndef NR_ICMP_TYPES
80 #define NR_ICMP_TYPES 18
81 #endif
82 
83 
84 /* Codes for UNREACH. */
85 #ifndef ICMP_NET_UNREACH
86 #define ICMP_NET_UNREACH 0 /* Network Unreachable */
87 #endif
88 #ifndef ICMP_HOST_UNREACH
89 #define ICMP_HOST_UNREACH 1 /* Host Unreachable */
90 #endif
91 #ifndef ICMP_PROT_UNREACH
92 #define ICMP_PROT_UNREACH 2 /* Protocol Unreachable */
93 #endif
94 #ifndef ICMP_PORT_UNREACH
95 #define ICMP_PORT_UNREACH 3 /* Port Unreachable */
96 #endif
97 #ifndef ICMP_FRAG_NEEDED
98 #define ICMP_FRAG_NEEDED 4 /* Fragmentation Needed/DF set */
99 #endif
100 #ifndef ICMP_SR_FAILED
101 #define ICMP_SR_FAILED 5 /* Source Route failed */
102 #endif
103 #ifndef ICMP_NET_UNKNOWN
104 #define ICMP_NET_UNKNOWN 6
105 #endif
106 #ifndef ICMP_HOST_UNKNOWN
107 #define ICMP_HOST_UNKNOWN 7
108 #endif
109 #ifndef ICMP_HOST_ISOLATED
110 #define ICMP_HOST_ISOLATED 8
111 #endif
112 #ifndef ICMP_NET_ANO
113 #define ICMP_NET_ANO 9
114 #endif
115 #ifndef ICMP_HOST_ANO
116 #define ICMP_HOST_ANO 10
117 #endif
118 #ifndef ICMP_NET_UNR_TOS
119 #define ICMP_NET_UNR_TOS 11
120 #endif
121 #ifndef ICMP_HOST_UNR_TOS
122 #define ICMP_HOST_UNR_TOS 12
123 #endif
124 #ifndef ICMP_PKT_FILTERED
125 #define ICMP_PKT_FILTERED 13 /* Packet filtered */
126 #endif
127 #ifndef ICMP_PREC_VIOLATION
128 #define ICMP_PREC_VIOLATION 14 /* Precedence violation */
129 
130 #endif
131 #ifndef ICMP_PREC_CUTOFF
132 #define ICMP_PREC_CUTOFF 15 /* Precedence cut off */
133 #endif
134 #ifndef NR_ICMP_UNREACH
135 #define NR_ICMP_UNREACH 15 /* instead of hardcoding immediate value */
136 #endif
137 
138 /* Codes for REDIRECT. */
139 #ifndef ICMP_REDIR_NET
140 #define ICMP_REDIR_NET 0 /* Redirect Net */
141 #endif
142 #ifndef ICMP_REDIR_HOST
143 #define ICMP_REDIR_HOST 1 /* Redirect Host */
144 #endif
145 #ifndef ICMP_REDIR_NETTOS
146 #define ICMP_REDIR_NETTOS 2 /* Redirect Net for TOS */
147 #endif
148 #ifndef ICMP_REDIR_HOSTTOS
149 #define ICMP_REDIR_HOSTTOS 3 /* Redirect Host for TOS */
150 #endif
151 
152 /* Codes for TIME_EXCEEDED. */
153 #ifndef ICMP_EXC_TTL
154 #define ICMP_EXC_TTL 0 /* TTL count exceeded */
155 #endif
156 #ifndef ICMP_EXC_FRAGTIME
157 #define ICMP_EXC_FRAGTIME 1 /* Fragment Reass time exceeded */
158 #endif
159 
160 /** marco for icmpv4 type access */
161 #define ICMPV4_GET_TYPE(p) (p)->icmpv4h->type
162 /** marco for icmpv4 code access */
163 #define ICMPV4_GET_CODE(p) (p)->icmpv4h->code
164 
165 /* ICMPv4 header structure */
166 typedef struct ICMPV4Hdr_
167 {
168  uint8_t type;
169  uint8_t code;
170  uint16_t checksum;
171 } __attribute__((__packed__)) ICMPV4Hdr;
172 
173 /* ICMPv4 header structure */
174 typedef struct ICMPV4ExtHdr_
175 {
176  uint8_t type;
177  uint8_t code;
178  uint16_t checksum;
179  uint16_t id;
180  uint16_t seq;
181 } ICMPV4ExtHdr;
182 
183 /* ICMPv4 vars */
184 typedef struct ICMPV4Vars_
185 {
186  uint16_t id;
187  uint16_t seq;
188 
189  /** Actual header length **/
190  uint32_t hlen;
191 
192  /** Pointers to the embedded packet headers */
193  IPV4Hdr *emb_ipv4h;
194  TCPHdr *emb_tcph;
195  UDPHdr *emb_udph;
196  ICMPV4Hdr *emb_icmpv4h;
197 
198  /** IPv4 src and dst address */
199  struct in_addr emb_ip4_src;
200  struct in_addr emb_ip4_dst;
201  uint8_t emb_ip4_hlen;
202  uint8_t emb_ip4_proto;
203 
204  /** TCP/UDP ports */
205  uint16_t emb_sport;
206  uint16_t emb_dport;
207 } ICMPV4Vars;
208 
209 /* ICMPV4 Router Advertisement - fixed components */
210 /* actual size determined by address count and size */
211 typedef struct ICMPV4RtrAdvert_ {
212  /** Number of advertised addresses **/
213  uint8_t naddr;
214 
215  /** Size of each advertised address **/
216  uint8_t addr_sz;
217 } __attribute__((__packed__)) ICMPV4RtrAdvert;
218 
219 /* ICMPV4 TImestamp messages */
220 typedef struct ICMPV4Timestamp_ {
221  uint32_t orig_ts;
222  uint32_t rx_ts;
223  uint32_t tx_ts;
224 } __attribute__((__packed__)) ICMPV4Timestamp;
225 
226 #define CLEAR_ICMPV4_PACKET(p) do { \
227  (p)->level4_comp_csum = -1; \
228  PACKET_CLEAR_L4VARS((p)); \
229  (p)->icmpv4h = NULL; \
230 } while(0)
231 
232 #define ICMPV4_HEADER_PKT_OFFSET 8
233 
234 /** macro for icmpv4 "type" access */
235 #define ICMPV4_GET_TYPE(p) (p)->icmpv4h->type
236 /** macro for icmpv4 "code" access */
237 #define ICMPV4_GET_CODE(p) (p)->icmpv4h->code
238 /** macro for icmpv4 "csum" access */
239 #define ICMPV4_GET_RAW_CSUM(p) SCNtohs((p)->icmpv4h->checksum)
240 #define ICMPV4_GET_CSUM(p) (p)->icmpv4h->checksum
241 
242 /* If message is informational */
243 
244 /** macro for icmpv4 "id" access */
245 #define ICMPV4_GET_ID(p) ((p)->icmpv4vars.id)
246 /** macro for icmpv4 "seq" access */
247 #define ICMPV4_GET_SEQ(p) ((p)->icmpv4vars.seq)
248 
249 /* If message is Error */
250 
251 /** macro for icmpv4 embedded "protocol" access */
252 #define ICMPV4_GET_EMB_PROTO(p) (p)->icmpv4vars.emb_ip4_proto
253 /** macro for icmpv4 embedded "ipv4h" header access */
254 #define ICMPV4_GET_EMB_IPV4(p) (p)->icmpv4vars.emb_ipv4h
255 /** macro for icmpv4 embedded "tcph" header access */
256 #define ICMPV4_GET_EMB_TCP(p) (p)->icmpv4vars.emb_tcph
257 /** macro for icmpv4 embedded "udph" header access */
258 #define ICMPV4_GET_EMB_UDP(p) (p)->icmpv4vars.emb_udph
259 /** macro for icmpv4 embedded "icmpv4h" header access */
260 #define ICMPV4_GET_EMB_ICMPV4H(p) (p)->icmpv4vars.emb_icmpv4h
261 /** macro for icmpv4 header length */
262 #define ICMPV4_GET_HLEN_ICMPV4H(p) (p)->icmpv4vars.hlen
263 
264 /** macro for checking if a ICMP DEST UNREACH packet is valid for use
265  * in other parts of the engine, such as the flow engine.
266  *
267  * \warning use only _after_ the decoder has processed the packet
268  */
269 #define ICMPV4_DEST_UNREACH_IS_VALID(p) ( \
270  (!((p)->flags & PKT_IS_INVALID)) && \
271  ((p)->icmpv4h != NULL) && \
272  (ICMPV4_GET_TYPE((p)) == ICMP_DEST_UNREACH) && \
273  (ICMPV4_GET_EMB_IPV4((p)) != NULL) && \
274  ((ICMPV4_GET_EMB_TCP((p)) != NULL) || \
275  (ICMPV4_GET_EMB_UDP((p)) != NULL)))
276 
277 /**
278  * marco for checking if a ICMP packet is an error message or an
279  * query message.
280  *
281  * \todo This check is used in the flow engine and needs to be as
282  * cheap as possible. Consider setting a bitflag at the decoder
283  * stage so we can to a bit check instead of the more expensive
284  * check below.
285  */
286 #define ICMPV4_IS_ERROR_MSG(p) (ICMPV4_GET_TYPE((p)) == ICMP_DEST_UNREACH || \
287  ICMPV4_GET_TYPE((p)) == ICMP_SOURCE_QUENCH || \
288  ICMPV4_GET_TYPE((p)) == ICMP_REDIRECT || \
289  ICMPV4_GET_TYPE((p)) == ICMP_TIME_EXCEEDED || \
290  ICMPV4_GET_TYPE((p)) == ICMP_PARAMETERPROB)
291 
292 void DecodeICMPV4RegisterTests(void);
293 
294 /** ------ Inline functions ------ */
295 static inline uint16_t ICMPV4CalculateChecksum(uint16_t *, uint16_t);
296 
297 /**
298  * \brief Calculates the checksum for the ICMP packet
299  *
300  * \param pkt Pointer to the start of the ICMP packet
301  * \param hlen Total length of the ICMP packet(header + payload)
302  *
303  * \retval csum Checksum for the ICMP packet
304  */
305 static inline uint16_t ICMPV4CalculateChecksum(uint16_t *pkt, uint16_t tlen)
306 {
307  uint16_t pad = 0;
308  uint32_t csum = pkt[0];
309 
310  tlen -= 4;
311  pkt += 2;
312 
313  while (tlen >= 32) {
314  csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
315  pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] +
316  pkt[14] + pkt[15];
317  tlen -= 32;
318  pkt += 16;
319  }
320 
321  while(tlen >= 8) {
322  csum += pkt[0] + pkt[1] + pkt[2] + pkt[3];
323  tlen -= 8;
324  pkt += 4;
325  }
326 
327  while(tlen >= 4) {
328  csum += pkt[0] + pkt[1];
329  tlen -= 4;
330  pkt += 2;
331  }
332 
333  while (tlen > 1) {
334  csum += pkt[0];
335  tlen -= 2;
336  pkt += 1;
337  }
338 
339  if (tlen == 1) {
340  *(uint8_t *)(&pad) = (*(uint8_t *)pkt);
341  csum += pad;
342  }
343 
344  csum = (csum >> 16) + (csum & 0x0000FFFF);
345  csum += (csum >> 16);
346 
347  return (uint16_t) ~csum;
348 }
349 
350 int ICMPv4GetCounterpart(uint8_t type);
351 
352 #endif /* __DECODE_ICMPV4_H__ */
353 
decode-tcp.h
ICMPV4RtrAdvert_::naddr
uint8_t naddr
Definition: decode-icmpv4.h:213
ICMPV4ExtHdr
struct ICMPV4ExtHdr_ ICMPV4ExtHdr
ICMPV4ExtHdr_
Definition: decode-icmpv4.h:175
ICMPV4Vars_
Definition: decode-icmpv4.h:185
ICMPV4ExtHdr_::checksum
uint16_t checksum
Definition: decode-icmpv4.h:178
decode-udp.h
ICMPV4Vars_::emb_tcph
TCPHdr * emb_tcph
Definition: decode-icmpv4.h:194
ICMPV4ExtHdr_::seq
uint16_t seq
Definition: decode-icmpv4.h:180
ICMPV4Vars_::emb_icmpv4h
ICMPV4Hdr * emb_icmpv4h
Definition: decode-icmpv4.h:196
DecodeICMPV4RegisterTests
void DecodeICMPV4RegisterTests(void)
Registers ICMPV4 unit test.
Definition: decode-icmpv4.c:825
ICMPV4RtrAdvert_::addr_sz
uint8_t addr_sz
Definition: decode-icmpv4.h:216
ICMPV4Vars_::emb_ipv4h
IPV4Hdr * emb_ipv4h
Definition: decode-icmpv4.h:193
pad
uint16_t pad
Definition: source-erf-file.c:60
ICMPv4GetCounterpart
int ICMPv4GetCounterpart(uint8_t type)
Definition: decode-icmpv4.c:351
__attribute__
struct ICMPV4Hdr_ __attribute__((__packed__)) ICMPV4Hdr
DNP3 link header.
Definition: decode-vlan.c:113
decode.h
type
uint8_t type
Definition: decode-icmpv4.h:0
ICMPV4Vars_::emb_ip4_proto
uint8_t emb_ip4_proto
Definition: decode-icmpv4.h:202
ICMPV4Vars_::emb_dport
uint16_t emb_dport
Definition: decode-icmpv4.h:206
ICMPV4Vars_::emb_ip4_hlen
uint8_t emb_ip4_hlen
Definition: decode-icmpv4.h:201
ICMPV4ExtHdr_::code
uint8_t code
Definition: decode-icmpv4.h:177
ICMPV4Vars_::id
uint16_t id
Definition: decode-icmpv4.h:186
ICMPV4Timestamp_::rx_ts
uint32_t rx_ts
Definition: decode-icmpv4.h:222
ICMPV4Hdr_::type
uint8_t type
Definition: decode-icmpv4.h:168
ICMPV4Hdr_
Definition: decode-icmpv4.h:167
ICMPV4Vars_::hlen
uint32_t hlen
Definition: decode-icmpv4.h:190
ICMPV4Timestamp_
Definition: decode-icmpv4.h:220
ICMPV4Vars_::emb_udph
UDPHdr * emb_udph
Definition: decode-icmpv4.h:195
IPV4Hdr_
Definition: decode-ipv4.h:71
ICMPV4ExtHdr_::type
uint8_t type
Definition: decode-icmpv4.h:176
ICMPV4Hdr_::checksum
uint16_t checksum
Definition: decode-icmpv4.h:170
ICMPV4Vars_::emb_ip4_dst
struct in_addr emb_ip4_dst
Definition: decode-icmpv4.h:200
ICMPV4Vars
struct ICMPV4Vars_ ICMPV4Vars
ICMPV4ExtHdr_::id
uint16_t id
Definition: decode-icmpv4.h:179
ICMPV4Hdr_::code
uint8_t code
Definition: decode-icmpv4.h:169
decode-sctp.h
ICMPV4Timestamp_::orig_ts
uint32_t orig_ts
Definition: decode-icmpv4.h:221
ICMPV4RtrAdvert_
Definition: decode-icmpv4.h:211
ICMPV4Vars_::emb_ip4_src
struct in_addr emb_ip4_src
Definition: decode-icmpv4.h:199
ICMPV4Timestamp_::tx_ts
uint32_t tx_ts
Definition: decode-icmpv4.h:223
ICMPV4Vars_::emb_sport
uint16_t emb_sport
Definition: decode-icmpv4.h:205
ICMPV4Vars_::seq
uint16_t seq
Definition: decode-icmpv4.h:187