suricata
decode-udp.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2013 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  */
23 
24 #ifndef __DECODE_UDP_H__
25 #define __DECODE_UDP_H__
26 
27 #define UDP_HEADER_LEN 8
28 
29 /* XXX RAW* needs to be really 'raw', so no SCNtohs there */
30 #define UDP_GET_RAW_LEN(udph) SCNtohs((udph)->uh_len)
31 #define UDP_GET_RAW_SRC_PORT(udph) SCNtohs((udph)->uh_sport)
32 #define UDP_GET_RAW_DST_PORT(udph) SCNtohs((udph)->uh_dport)
33 #define UDP_GET_RAW_SUM(udph) SCNtohs((udph)->uh_sum)
34 
35 #define UDP_GET_LEN(p) UDP_GET_RAW_LEN(p->udph)
36 #define UDP_GET_SRC_PORT(p) UDP_GET_RAW_SRC_PORT(p->udph)
37 #define UDP_GET_DST_PORT(p) UDP_GET_RAW_DST_PORT(p->udph)
38 #define UDP_GET_SUM(p) UDP_GET_RAW_SUM(p->udph)
39 
40 /* UDP header structure */
41 typedef struct UDPHdr_
42 {
43  uint16_t uh_sport; /* source port */
44  uint16_t uh_dport; /* destination port */
45  uint16_t uh_len; /* length */
46  uint16_t uh_sum; /* checksum */
47 } __attribute__((__packed__)) UDPHdr;
48 
49 #define CLEAR_UDP_PACKET(p) do { \
50  (p)->level4_comp_csum = -1; \
51  (p)->udph = NULL; \
52 } while (0)
53 
54 void DecodeUDPV4RegisterTests(void);
55 
56 /** ------ Inline function ------ */
57 static inline uint16_t UDPV4Checksum(uint16_t *, uint16_t *, uint16_t, uint16_t);
58 static inline uint16_t UDPV6Checksum(uint16_t *, uint16_t *, uint16_t, uint16_t);
59 
60 /**
61  * \brief Calculate or valid the checksum for the UDP packet
62  *
63  * \param shdr Pointer to source address field from the IP packet. Used as a
64  * part of the psuedoheader for computing the checksum
65  * \param pkt Pointer to the start of the UDP packet
66  * \param hlen Total length of the UDP packet(header + payload)
67  * \param init For validation this is the UDP checksum, for calculation this
68  * value should be set to 0.
69  *
70  * \retval csum For validation 0 will be returned for success, for calculation
71  * this will be the checksum.
72  */
73 static inline uint16_t UDPV4Checksum(uint16_t *shdr, uint16_t *pkt,
74  uint16_t tlen, uint16_t init)
75 {
76  uint16_t pad = 0;
77  uint32_t csum = init;
78 
79  csum += shdr[0] + shdr[1] + shdr[2] + shdr[3] + htons(17) + htons(tlen);
80 
81  csum += pkt[0] + pkt[1] + pkt[2];
82 
83  tlen -= 8;
84  pkt += 4;
85 
86  while (tlen >= 32) {
87  csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
88  pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] +
89  pkt[14] + pkt[15];
90  tlen -= 32;
91  pkt += 16;
92  }
93 
94  while(tlen >= 8) {
95  csum += pkt[0] + pkt[1] + pkt[2] + pkt[3];
96  tlen -= 8;
97  pkt += 4;
98  }
99 
100  while(tlen >= 4) {
101  csum += pkt[0] + pkt[1];
102  tlen -= 4;
103  pkt += 2;
104  }
105 
106  while (tlen > 1) {
107  csum += pkt[0];
108  pkt += 1;
109  tlen -= 2;
110  }
111 
112  if (tlen == 1) {
113  *(uint8_t *)(&pad) = (*(uint8_t *)pkt);
114  csum += pad;
115  }
116 
117  csum = (csum >> 16) + (csum & 0x0000FFFF);
118  csum += (csum >> 16);
119 
120  uint16_t csum_u16 = (uint16_t)~csum;
121  if (init == 0 && csum_u16 == 0)
122  return 0xFFFF;
123  else
124  return csum_u16;
125 }
126 
127 /**
128  * \brief Calculate or valid the checksum for the UDP packet
129  *
130  * \param shdr Pointer to source address field from the IPV6 packet. Used as a
131  * part of the psuedoheader for computing the checksum
132  * \param pkt Pointer to the start of the UDP packet
133  * \param tlen Total length of the UDP packet(header + payload)
134  * \param init For validation this is the UDP checksum, for calculation this
135  * value should be set to 0.
136  *
137  * \retval csum For validation 0 will be returned for success, for calculation
138  * this will be the checksum.
139  */
140 static inline uint16_t UDPV6Checksum(uint16_t *shdr, uint16_t *pkt,
141  uint16_t tlen, uint16_t init)
142 {
143  uint16_t pad = 0;
144  uint32_t csum = init;
145 
146  csum += shdr[0] + shdr[1] + shdr[2] + shdr[3] + shdr[4] + shdr[5] + shdr[6] +
147  shdr[7] + shdr[8] + shdr[9] + shdr[10] + shdr[11] + shdr[12] +
148  shdr[13] + shdr[14] + shdr[15] + htons(17) + htons(tlen);
149 
150  csum += pkt[0] + pkt[1] + pkt[2];
151 
152  tlen -= 8;
153  pkt += 4;
154 
155  while (tlen >= 32) {
156  csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
157  pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] +
158  pkt[14] + pkt[15];
159  tlen -= 32;
160  pkt += 16;
161  }
162 
163  while(tlen >= 8) {
164  csum += pkt[0] + pkt[1] + pkt[2] + pkt[3];
165  tlen -= 8;
166  pkt += 4;
167  }
168 
169  while(tlen >= 4) {
170  csum += pkt[0] + pkt[1];
171  tlen -= 4;
172  pkt += 2;
173  }
174 
175  while (tlen > 1) {
176  csum += pkt[0];
177  pkt += 1;
178  tlen -= 2;
179  }
180 
181  if (tlen == 1) {
182  *(uint8_t *)(&pad) = (*(uint8_t *)pkt);
183  csum += pad;
184  }
185 
186  csum = (csum >> 16) + (csum & 0x0000FFFF);
187  csum += (csum >> 16);
188 
189  uint16_t csum_u16 = (uint16_t)~csum;
190  if (init == 0 && csum_u16 == 0)
191  return 0xFFFF;
192  else
193  return csum_u16;
194 }
195 
196 
197 #endif /* __DECODE_UDP_H__ */
uint16_t pad
void DecodeUDPV4RegisterTests(void)
Definition: decode-udp.c:210
uint16_t uh_len
Definition: decode-udp.h:45
uint16_t uh_dport
Definition: decode-udp.h:44
uint16_t uh_sport
Definition: decode-udp.h:43
uint16_t uh_sum
Definition: decode-udp.h:46
struct UDPHdr_ __attribute__((__packed__)) UDPHdr
DNP3 link header.