suricata
decode-tcp.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2013 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  * \todo RAW* macro's should be returning the raw value, not the host order
23  */
24 
25 #ifndef __DECODE_TCP_H__
26 #define __DECODE_TCP_H__
27 
28 #define TCP_HEADER_LEN 20
29 #define TCP_OPTLENMAX 40
30 #define TCP_OPTMAX 20 /* every opt is at least 2 bytes
31  * (type + len), except EOL and NOP */
32 
33 /* TCP flags */
34 
35 #define TH_FIN 0x01
36 #define TH_SYN 0x02
37 #define TH_RST 0x04
38 #define TH_PUSH 0x08
39 #define TH_ACK 0x10
40 #define TH_URG 0x20
41 /** Establish a new connection reducing window */
42 #define TH_ECN 0x40
43 /** Echo Congestion flag */
44 #define TH_CWR 0x80
45 
46 /* tcp option codes */
47 #define TCP_OPT_EOL 0x00
48 #define TCP_OPT_NOP 0x01
49 #define TCP_OPT_MSS 0x02
50 #define TCP_OPT_WS 0x03
51 #define TCP_OPT_SACKOK 0x04
52 #define TCP_OPT_SACK 0x05
53 #define TCP_OPT_TS 0x08
54 
55 #define TCP_OPT_SACKOK_LEN 2
56 #define TCP_OPT_WS_LEN 3
57 #define TCP_OPT_TS_LEN 10
58 #define TCP_OPT_MSS_LEN 4
59 #define TCP_OPT_SACK_MIN_LEN 10 /* hdr 2, 1 pair 8 = 10 */
60 #define TCP_OPT_SACK_MAX_LEN 34 /* hdr 2, 4 pair 32= 34 */
61 
62 /** Max valid wscale value. */
63 #define TCP_WSCALE_MAX 14
64 
65 #define TCP_GET_RAW_OFFSET(tcph) (((tcph)->th_offx2 & 0xf0) >> 4)
66 #define TCP_GET_RAW_X2(tcph) (unsigned char)((tcph)->th_offx2 & 0x0f)
67 #define TCP_GET_RAW_SRC_PORT(tcph) SCNtohs((tcph)->th_sport)
68 #define TCP_GET_RAW_DST_PORT(tcph) SCNtohs((tcph)->th_dport)
69 
70 #define TCP_SET_RAW_TCP_OFFSET(tcph, value) ((tcph)->th_offx2 = (unsigned char)(((tcph)->th_offx2 & 0x0f) | (value << 4)))
71 #define TCP_SET_RAW_TCP_X2(tcph, value) ((tcph)->th_offx2 = (unsigned char)(((tcph)->th_offx2 & 0xf0) | (value & 0x0f)))
72 
73 #define TCP_GET_RAW_SEQ(tcph) SCNtohl((tcph)->th_seq)
74 #define TCP_GET_RAW_ACK(tcph) SCNtohl((tcph)->th_ack)
75 
76 #define TCP_GET_RAW_WINDOW(tcph) SCNtohs((tcph)->th_win)
77 #define TCP_GET_RAW_URG_POINTER(tcph) SCNtohs((tcph)->th_urp)
78 #define TCP_GET_RAW_SUM(tcph) SCNtohs((tcph)->th_sum)
79 
80 /** macro for getting the first timestamp from the packet in host order */
81 #define TCP_GET_TSVAL(p) ((p)->tcpvars.ts_val)
82 
83 /** macro for getting the second timestamp from the packet in host order. */
84 #define TCP_GET_TSECR(p) ((p)->tcpvars.ts_ecr)
85 
86 #define TCP_HAS_WSCALE(p) ((p)->tcpvars.ws.type == TCP_OPT_WS)
87 #define TCP_HAS_SACK(p) ((p)->tcpvars.sack.type == TCP_OPT_SACK)
88 #define TCP_HAS_SACKOK(p) ((p)->tcpvars.sackok.type == TCP_OPT_SACKOK)
89 #define TCP_HAS_TS(p) ((p)->tcpvars.ts_set == TRUE)
90 #define TCP_HAS_MSS(p) ((p)->tcpvars.mss.type == TCP_OPT_MSS)
91 
92 /** macro for getting the wscale from the packet. */
93 #define TCP_GET_WSCALE(p) (TCP_HAS_WSCALE((p)) ? \
94  (((*(uint8_t *)(p)->tcpvars.ws.data) <= TCP_WSCALE_MAX) ? \
95  (*(uint8_t *)((p)->tcpvars.ws.data)) : 0) : 0)
96 
97 #define TCP_GET_SACKOK(p) (TCP_HAS_SACKOK((p)) ? 1 : 0)
98 #define TCP_GET_SACK_PTR(p) TCP_HAS_SACK((p)) ? (p)->tcpvars.sack.data : NULL
99 #define TCP_GET_SACK_CNT(p) (TCP_HAS_SACK((p)) ? (((p)->tcpvars.sack.len - 2) / 8) : 0)
100 #define TCP_GET_MSS(p) SCNtohs(*(uint16_t *)((p)->tcpvars.mss.data))
101 
102 #define TCP_GET_OFFSET(p) TCP_GET_RAW_OFFSET((p)->tcph)
103 #define TCP_GET_X2(p) TCP_GET_RAW_X2((p)->tcph)
104 #define TCP_GET_HLEN(p) (TCP_GET_OFFSET((p)) << 2)
105 #define TCP_GET_SRC_PORT(p) TCP_GET_RAW_SRC_PORT((p)->tcph)
106 #define TCP_GET_DST_PORT(p) TCP_GET_RAW_DST_PORT((p)->tcph)
107 #define TCP_GET_SEQ(p) TCP_GET_RAW_SEQ((p)->tcph)
108 #define TCP_GET_ACK(p) TCP_GET_RAW_ACK((p)->tcph)
109 #define TCP_GET_WINDOW(p) TCP_GET_RAW_WINDOW((p)->tcph)
110 #define TCP_GET_URG_POINTER(p) TCP_GET_RAW_URG_POINTER((p)->tcph)
111 #define TCP_GET_SUM(p) TCP_GET_RAW_SUM((p)->tcph)
112 #define TCP_GET_FLAGS(p) (p)->tcph->th_flags
113 
114 #define TCP_ISSET_FLAG_FIN(p) ((p)->tcph->th_flags & TH_FIN)
115 #define TCP_ISSET_FLAG_SYN(p) ((p)->tcph->th_flags & TH_SYN)
116 #define TCP_ISSET_FLAG_RST(p) ((p)->tcph->th_flags & TH_RST)
117 #define TCP_ISSET_FLAG_PUSH(p) ((p)->tcph->th_flags & TH_PUSH)
118 #define TCP_ISSET_FLAG_ACK(p) ((p)->tcph->th_flags & TH_ACK)
119 #define TCP_ISSET_FLAG_URG(p) ((p)->tcph->th_flags & TH_URG)
120 #define TCP_ISSET_FLAG_RES2(p) ((p)->tcph->th_flags & TH_RES2)
121 #define TCP_ISSET_FLAG_RES1(p) ((p)->tcph->th_flags & TH_RES1)
122 
123 typedef struct TCPOpt_ {
124  uint8_t type;
125  uint8_t len;
126  uint8_t *data;
127 } TCPOpt;
128 
129 typedef struct TCPOptSackRecord_ {
130  uint32_t le; /**< left edge, network order */
131  uint32_t re; /**< right edge, network order */
133 
134 typedef struct TCPHdr_
135 {
136  uint16_t th_sport; /**< source port */
137  uint16_t th_dport; /**< destination port */
138  uint32_t th_seq; /**< sequence number */
139  uint32_t th_ack; /**< acknowledgement number */
140  uint8_t th_offx2; /**< offset and reserved */
141  uint8_t th_flags; /**< pkt flags */
142  uint16_t th_win; /**< pkt window */
143  uint16_t th_sum; /**< checksum */
144  uint16_t th_urp; /**< urgent pointer */
145 } __attribute__((__packed__)) TCPHdr;
146 
147 typedef struct TCPVars_
148 {
149  /* commonly used and needed opts */
150  _Bool ts_set;
151  uint32_t ts_val; /* host-order */
152  uint32_t ts_ecr; /* host-order */
157 } TCPVars;
158 
159 #define CLEAR_TCP_PACKET(p) { \
160  (p)->level4_comp_csum = -1; \
161  PACKET_CLEAR_L4VARS((p)); \
162  (p)->tcph = NULL; \
163 }
164 
165 void DecodeTCPRegisterTests(void);
166 
167 /** -------- Inline functions ------- */
168 static inline uint16_t TCPChecksum(uint16_t *, uint16_t *, uint16_t, uint16_t);
169 static inline uint16_t TCPV6Checksum(uint16_t *, uint16_t *, uint16_t, uint16_t);
170 
171 /**
172  * \brief Calculate or validate the checksum for the TCP packet
173  *
174  * \param shdr Pointer to source address field from the IP packet. Used as a
175  * part of the pseudoheader for computing the checksum
176  * \param pkt Pointer to the start of the TCP packet
177  * \param tlen Total length of the TCP packet(header + payload)
178  * \param init The current checksum if validating, 0 if generating.
179  *
180  * \retval csum For validation 0 will be returned for success, for calculation
181  * this will be the checksum.
182  */
183 static inline uint16_t TCPChecksum(uint16_t *shdr, uint16_t *pkt,
184  uint16_t tlen, uint16_t init)
185 {
186  uint16_t pad = 0;
187  uint32_t csum = init;
188 
189  csum += shdr[0] + shdr[1] + shdr[2] + shdr[3] + htons(6) + htons(tlen);
190 
191  csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
192  pkt[7] + pkt[9];
193 
194  tlen -= 20;
195  pkt += 10;
196 
197  while (tlen >= 32) {
198  csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
199  pkt[7] +
200  pkt[8] +
201  pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] +
202  pkt[14] + pkt[15];
203  tlen -= 32;
204  pkt += 16;
205  }
206 
207  while(tlen >= 8) {
208  csum += pkt[0] + pkt[1] + pkt[2] + pkt[3];
209  tlen -= 8;
210  pkt += 4;
211  }
212 
213  while(tlen >= 4) {
214  csum += pkt[0] + pkt[1];
215  tlen -= 4;
216  pkt += 2;
217  }
218 
219  while (tlen > 1) {
220  csum += pkt[0];
221  pkt += 1;
222  tlen -= 2;
223  }
224 
225  if (tlen == 1) {
226  *(uint8_t *)(&pad) = (*(uint8_t *)pkt);
227  csum += pad;
228  }
229 
230  csum = (csum >> 16) + (csum & 0x0000FFFF);
231  csum += (csum >> 16);
232 
233  return (uint16_t)~csum;
234 }
235 
236 /**
237  * \brief Calculate or validate the checksum for the TCP packet
238  *
239  * \param shdr Pointer to source address field from the IPV6 packet. Used as a
240  * part of the psuedoheader for computing the checksum
241  * \param pkt Pointer to the start of the TCP packet
242  * \param tlen Total length of the TCP packet(header + payload)
243  * \param init The current checksum if validating, 0 if generating.
244  *
245  * \retval csum For validation 0 will be returned for success, for calculation
246  * this will be the checksum.
247  */
248 static inline uint16_t TCPV6Checksum(uint16_t *shdr, uint16_t *pkt,
249  uint16_t tlen, uint16_t init)
250 {
251  uint16_t pad = 0;
252  uint32_t csum = init;
253 
254  csum += shdr[0] + shdr[1] + shdr[2] + shdr[3] + shdr[4] + shdr[5] +
255  shdr[6] + shdr[7] + shdr[8] + shdr[9] + shdr[10] + shdr[11] +
256  shdr[12] + shdr[13] + shdr[14] + shdr[15] + htons(6) + htons(tlen);
257 
258  csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
259  pkt[7] + pkt[9];
260 
261  tlen -= 20;
262  pkt += 10;
263 
264  while (tlen >= 32) {
265  csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
266  pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] +
267  pkt[14] + pkt[15];
268  tlen -= 32;
269  pkt += 16;
270  }
271 
272  while(tlen >= 8) {
273  csum += pkt[0] + pkt[1] + pkt[2] + pkt[3];
274  tlen -= 8;
275  pkt += 4;
276  }
277 
278  while(tlen >= 4) {
279  csum += pkt[0] + pkt[1];
280  tlen -= 4;
281  pkt += 2;
282  }
283 
284  while (tlen > 1) {
285  csum += pkt[0];
286  pkt += 1;
287  tlen -= 2;
288  }
289 
290  if (tlen == 1) {
291  *(uint8_t *)(&pad) = (*(uint8_t *)pkt);
292  csum += pad;
293  }
294 
295  csum = (csum >> 16) + (csum & 0x0000FFFF);
296  csum += (csum >> 16);
297 
298  return (uint16_t)~csum;
299 }
300 
301 
302 #endif /* __DECODE_TCP_H__ */
303 
uint32_t ts_ecr
Definition: decode-tcp.h:152
uint16_t th_win
Definition: decode-tcp.h:142
void DecodeTCPRegisterTests(void)
Definition: decode-tcp.c:517
uint8_t len
Definition: decode-tcp.h:125
uint8_t th_flags
Definition: decode-tcp.h:141
uint16_t th_sum
Definition: decode-tcp.h:143
struct TCPVars_ TCPVars
uint16_t pad
uint32_t ts_val
Definition: decode-tcp.h:151
TCPOpt sackok
Definition: decode-tcp.h:154
uint8_t type
Definition: decode-tcp.h:124
uint16_t th_dport
Definition: decode-tcp.h:137
uint8_t * data
Definition: decode-tcp.h:126
struct TCPOpt_ TCPOpt
uint8_t th_offx2
Definition: decode-tcp.h:140
uint16_t th_urp
Definition: decode-tcp.h:144
TCPOpt mss
Definition: decode-tcp.h:156
struct TCPOptSackRecord_ TCPOptSackRecord
uint16_t th_sport
Definition: decode-tcp.h:136
_Bool ts_set
Definition: decode-tcp.h:150
TCPOpt sack
Definition: decode-tcp.h:153
uint32_t th_ack
Definition: decode-tcp.h:139
uint32_t th_seq
Definition: decode-tcp.h:138
struct TCPHdr_ __attribute__((__packed__)) TCPHdr
DNP3 link header.
TCPOpt ws
Definition: decode-tcp.h:155