suricata
decode-udp.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2022 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  */
23 
24 #ifndef SURICATA_DECODE_UDP_H
25 #define SURICATA_DECODE_UDP_H
26 
27 #define UDP_HEADER_LEN 8
28 
29 /* XXX RAW* needs to be really 'raw', so no SCNtohs there */
30 #define UDP_GET_RAW_LEN(udph) SCNtohs((udph)->uh_len)
31 #define UDP_GET_RAW_SRC_PORT(udph) SCNtohs((udph)->uh_sport)
32 #define UDP_GET_RAW_DST_PORT(udph) SCNtohs((udph)->uh_dport)
33 #define UDP_GET_RAW_SUM(udph) SCNtohs((udph)->uh_sum)
34 
35 #define UDP_GET_LEN(p) UDP_GET_RAW_LEN(p->udph)
36 #define UDP_GET_SRC_PORT(p) UDP_GET_RAW_SRC_PORT(p->udph)
37 #define UDP_GET_DST_PORT(p) UDP_GET_RAW_DST_PORT(p->udph)
38 #define UDP_GET_SUM(p) UDP_GET_RAW_SUM(p->udph)
39 
40 /* UDP header structure */
41 typedef struct UDPHdr_
42 {
43  uint16_t uh_sport; /* source port */
44  uint16_t uh_dport; /* destination port */
45  uint16_t uh_len; /* length */
46  uint16_t uh_sum; /* checksum */
47 } __attribute__((__packed__)) UDPHdr;
48 
49 #define CLEAR_UDP_PACKET(p) do { \
50  (p)->level4_comp_csum = -1; \
51  (p)->udph = NULL; \
52 } while (0)
53 
54 void DecodeUDPV4RegisterTests(void);
55 
56 /** ------ Inline function ------ */
57 
58 /**
59  * \brief Calculate or valid the checksum for the UDP packet
60  *
61  * \param shdr Pointer to source address field from the IP packet. Used as a
62  * part of the psuedoheader for computing the checksum
63  * \param pkt Pointer to the start of the UDP packet
64  * \param hlen Total length of the UDP packet(header + payload)
65  * \param init For validation this is the UDP checksum, for calculation this
66  * value should be set to 0.
67  *
68  * \retval csum For validation 0 will be returned for success, for calculation
69  * this will be the checksum.
70  */
71 static inline uint16_t UDPV4Checksum(
72  const uint16_t *shdr, const uint16_t *pkt, uint16_t tlen, uint16_t init)
73 {
74  uint16_t pad = 0;
75  uint32_t csum = init;
76 
77  csum += shdr[0] + shdr[1] + shdr[2] + shdr[3] + htons(17) + htons(tlen);
78 
79  csum += pkt[0] + pkt[1] + pkt[2];
80 
81  tlen -= 8;
82  pkt += 4;
83 
84  while (tlen >= 32) {
85  csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
86  pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] +
87  pkt[14] + pkt[15];
88  tlen -= 32;
89  pkt += 16;
90  }
91 
92  while(tlen >= 8) {
93  csum += pkt[0] + pkt[1] + pkt[2] + pkt[3];
94  tlen -= 8;
95  pkt += 4;
96  }
97 
98  while(tlen >= 4) {
99  csum += pkt[0] + pkt[1];
100  tlen -= 4;
101  pkt += 2;
102  }
103 
104  while (tlen > 1) {
105  csum += pkt[0];
106  pkt += 1;
107  tlen -= 2;
108  }
109 
110  if (tlen == 1) {
111  *(uint8_t *)(&pad) = (*(uint8_t *)pkt);
112  csum += pad;
113  }
114 
115  csum = (csum >> 16) + (csum & 0x0000FFFF);
116  csum += (csum >> 16);
117 
118  uint16_t csum_u16 = (uint16_t)~csum;
119  if (init == 0 && csum_u16 == 0)
120  return 0xFFFF;
121  else
122  return csum_u16;
123 }
124 
125 /**
126  * \brief Calculate or valid the checksum for the UDP packet
127  *
128  * \param shdr Pointer to source address field from the IPV6 packet. Used as a
129  * part of the psuedoheader for computing the checksum
130  * \param pkt Pointer to the start of the UDP packet
131  * \param tlen Total length of the UDP packet(header + payload)
132  * \param init For validation this is the UDP checksum, for calculation this
133  * value should be set to 0.
134  *
135  * \retval csum For validation 0 will be returned for success, for calculation
136  * this will be the checksum.
137  */
138 static inline uint16_t UDPV6Checksum(
139  const uint16_t *shdr, const uint16_t *pkt, uint16_t tlen, uint16_t init)
140 {
141  uint16_t pad = 0;
142  uint32_t csum = init;
143 
144  csum += shdr[0] + shdr[1] + shdr[2] + shdr[3] + shdr[4] + shdr[5] + shdr[6] +
145  shdr[7] + shdr[8] + shdr[9] + shdr[10] + shdr[11] + shdr[12] +
146  shdr[13] + shdr[14] + shdr[15] + htons(17) + htons(tlen);
147 
148  csum += pkt[0] + pkt[1] + pkt[2];
149 
150  tlen -= 8;
151  pkt += 4;
152 
153  while (tlen >= 32) {
154  csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
155  pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] +
156  pkt[14] + pkt[15];
157  tlen -= 32;
158  pkt += 16;
159  }
160 
161  while(tlen >= 8) {
162  csum += pkt[0] + pkt[1] + pkt[2] + pkt[3];
163  tlen -= 8;
164  pkt += 4;
165  }
166 
167  while(tlen >= 4) {
168  csum += pkt[0] + pkt[1];
169  tlen -= 4;
170  pkt += 2;
171  }
172 
173  while (tlen > 1) {
174  csum += pkt[0];
175  pkt += 1;
176  tlen -= 2;
177  }
178 
179  if (tlen == 1) {
180  *(uint8_t *)(&pad) = (*(uint8_t *)pkt);
181  csum += pad;
182  }
183 
184  csum = (csum >> 16) + (csum & 0x0000FFFF);
185  csum += (csum >> 16);
186 
187  uint16_t csum_u16 = (uint16_t)~csum;
188  if (init == 0 && csum_u16 == 0)
189  return 0xFFFF;
190  else
191  return csum_u16;
192 }
193 
194 #endif /* SURICATA_DECODE_UDP_H */
UDPHdr_::uh_dport
uint16_t uh_dport
Definition: decode-udp.h:44
DecodeUDPV4RegisterTests
void DecodeUDPV4RegisterTests(void)
Definition: decode-udp.c:221
pad
uint16_t pad
Definition: source-erf-file.c:61
__attribute__
struct UDPHdr_ __attribute__((__packed__)) UDPHdr
DNP3 link header.
Definition: decode-vlan.c:103
UDPHdr_::uh_len
uint16_t uh_len
Definition: decode-udp.h:45
UDPHdr_::uh_sport
uint16_t uh_sport
Definition: decode-udp.h:43
UDPHdr_
Definition: decode-udp.h:42
UDPHdr_::uh_sum
uint16_t uh_sum
Definition: decode-udp.h:46