suricata
defrag.c File Reference
#include "suricata-common.h"
#include "queue.h"
#include "suricata.h"
#include "threads.h"
#include "conf.h"
#include "decode-ipv6.h"
#include "util-hashlist.h"
#include "util-pool.h"
#include "util-time.h"
#include "util-print.h"
#include "util-debug.h"
#include "util-fix_checksum.h"
#include "util-random.h"
#include "stream-tcp-private.h"
#include "stream-tcp-reassemble.h"
#include "util-host-os-info.h"
#include "defrag.h"
#include "defrag-hash.h"
#include "defrag-queue.h"
#include "defrag-config.h"
#include "tmqh-packetpool.h"
#include "decode.h"
#include "util-unittest.h"
Include dependency graph for defrag.c:

Go to the source code of this file.

Macros

#define DEFAULT_DEFRAG_HASH_SIZE   0xffff
 
#define DEFAULT_DEFRAG_POOL_SIZE   0xffff
 
#define TIMEOUT_DEFAULT   60
 
#define TIMEOUT_MAX   (60 * 60 * 24)
 
#define TIMEOUT_MIN   1
 
#define IP_MF   0x2000
 

Enumerations

enum  defrag_policies {
  DEFRAG_POLICY_FIRST = 1, DEFRAG_POLICY_LAST, DEFRAG_POLICY_BSD, DEFRAG_POLICY_BSD_RIGHT,
  DEFRAG_POLICY_LINUX, DEFRAG_POLICY_WINDOWS, DEFRAG_POLICY_SOLARIS, DEFRAG_POLICY_DEFAULT = DEFRAG_POLICY_BSD
}
 

Functions

 RB_GENERATE (IP_FRAGMENTS, Frag_, rb, DefragRbFragCompare)
 
void DefragTrackerFreeFrags (DefragTracker *tracker)
 Free all frags associated with a tracker. More...
 
int DefragRbFragCompare (struct Frag_ *a, struct Frag_ *b)
 
uint8_t DefragGetOsPolicy (Packet *p)
 Get the defrag policy based on the destination address of the packet. More...
 
PacketDefrag (ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, PacketQueue *pq)
 Entry point for IPv4 and IPv6 fragments. More...
 
void DefragInit (void)
 
void DefragDestroy (void)
 
void DefragRegisterTests (void)
 

Detailed Description

Author
Endace Technology Limited, Jason Ish jason.nosp@m..ish.nosp@m.@enda.nosp@m.ce.c.nosp@m.om

Defragmentation module. References:

  • RFC 815
  • OpenBSD PF's IP normalizaton (pf_norm.c)
Todo:

pool for frag packet storage

policy bsd-right

profile hash function

log anomalies

Definition in file defrag.c.

Macro Definition Documentation

#define DEFAULT_DEFRAG_HASH_SIZE   0xffff

Definition at line 65 of file defrag.c.

Referenced by DefragInit(), and DefragTrackerFreeFrags().

#define DEFAULT_DEFRAG_POOL_SIZE   0xffff

Definition at line 66 of file defrag.c.

Referenced by DefragTrackerFreeFrags().

#define IP_MF   0x2000

Definition at line 1076 of file defrag.c.

#define TIMEOUT_DEFAULT   60

Default timeout (in seconds) before a defragmentation tracker will be released.

Definition at line 72 of file defrag.c.

Referenced by DefragTrackerFreeFrags().

#define TIMEOUT_MAX   (60 * 60 * 24)

Maximum allowed timeout, 24 hours.

Definition at line 77 of file defrag.c.

Referenced by DefragTrackerFreeFrags().

#define TIMEOUT_MIN   1

Minimum allowed timeout, 1 second.

Definition at line 82 of file defrag.c.

Referenced by DefragTrackerFreeFrags().

Enumeration Type Documentation

Fragment reassembly policies.

Enumerator
DEFRAG_POLICY_FIRST 
DEFRAG_POLICY_LAST 
DEFRAG_POLICY_BSD 
DEFRAG_POLICY_BSD_RIGHT 
DEFRAG_POLICY_LINUX 
DEFRAG_POLICY_WINDOWS 
DEFRAG_POLICY_SOLARIS 
DEFRAG_POLICY_DEFAULT 

Definition at line 85 of file defrag.c.

Function Documentation

Packet* Defrag ( ThreadVars tv,
DecodeThreadVars dtv,
Packet p,
PacketQueue pq 
)

Entry point for IPv4 and IPv6 fragments.

Parameters
tvThreadVars for the calling decoder.
pThe packet fragment.
Return values
Anew Packet resembling the re-assembled packet if the most recent fragment allowed the packet to be re-assembled, otherwise NULL is returned.

Definition at line 999 of file defrag.c.

References af, DecodeThreadVars_::counter_defrag_ipv4_fragments, DecodeThreadVars_::counter_defrag_ipv6_fragments, DefragTrackerRelease(), IPV4_GET_IPOFFSET, IPV4_GET_MF, IPV6_EXTHDR_GET_FH_FLAG, IPV6_EXTHDR_GET_FH_OFFSET, PKT_IS_IPV4, PKT_IS_IPV6, and StatsIncr().

Referenced by DecodeIPV4(), and DecodeIPV6().

Here is the call graph for this function:

Here is the caller graph for this function:

void DefragDestroy ( void  )

Definition at line 1067 of file defrag.c.

References DefragHashShutdown(), and DefragTreeDestroy().

Referenced by DecodeIPV4(), DecodeIPV6(), and PostRunDeinit().

Here is the call graph for this function:

Here is the caller graph for this function:

void DefragInit ( void  )

Definition at line 1045 of file defrag.c.

References ConfGetInt(), DEFAULT_DEFRAG_HASH_SIZE, DefragInitConfig(), DefragPolicyLoadFromConfig(), DefragSetDefaultTimeout(), FALSE, SC_ERR_MEM_ALLOC, SCLogError, and DefragContext_::timeout.

Referenced by DecodeIPV4(), DecodeIPV6(), and PreRunInit().

Here is the call graph for this function:

Here is the caller graph for this function:

int DefragRbFragCompare ( struct Frag_ a,
struct Frag_ b 
)

The RB_TREE compare function for fragments.

When it comes to adding fragments, we want subsequent ones with the same offset to be treated as greater than, so we don't have an equal return value here.

Definition at line 499 of file defrag.c.

References DefragTracker_::af, af, DecodeThreadVars_::counter_defrag_ipv4_reassembled, DecodeThreadVars_::counter_defrag_ipv6_reassembled, Frag_::data_len, DecodeIPV4(), DecodeIPV6(), DEFRAG_POLICY_BSD, DEFRAG_POLICY_FIRST, DEFRAG_POLICY_LAST, DEFRAG_POLICY_LINUX, DEFRAG_POLICY_SOLARIS, DEFRAG_POLICY_WINDOWS, ENGINE_SET_EVENT, IPV6ExtHdrs_::fh_data_len, IPV6ExtHdrs_::fh_data_offset, IPV6ExtHdrs_::fh_header_offset, IPV6ExtHdrs_::fh_prev_hdr_offset, DefragContext_::frag_pool, DefragContext_::frag_pool_lock, DefragTracker_::fragment_tree, GET_PKT_DATA, GET_PKT_LEN, DefragTracker_::host_timeout, Packet_::ip4h, Packet_::ip6eh, Packet_::ip6h, IPV4_FRAG_IGNORED, IPV4_FRAG_OVERLAP, IPV4_FRAG_PKT_TOO_LARGE, IPV4_GET_HLEN, IPV4_GET_IPLEN, IPV4_GET_IPOFFSET, IPV4_GET_MF, IPV4_HEADER_LEN, IPV4_MAXPACKET_LEN, IPV6_EXTHDR_GET_FH_FLAG, IPV6_EXTHDR_GET_FH_NH, IPV6_EXTHDR_GET_FH_OFFSET, IPV6_FRAG_IGNORED, IPV6_FRAG_OVERLAP, IPV6_FRAG_PKT_TOO_LARGE, IPV6_GET_PLEN, IPV6_HEADER_LEN, IPV6_MAXPACKET, Frag_::ltrim, next, Frag_::offset, offset, PacketDefragPktSetupParent(), Packet_::pcap_cnt, DefragTracker_::policy, PoolGet(), PoolReturn(), RB_EMPTY, RB_MIN, RB_NFIND, RB_REMOVE, Packet_::root, SC_ERR_INVALID_ARGUMENT, SCLogDebug, SCLogWarning, SCMalloc, SCMutexLock, SCMutexUnlock, DefragTracker_::seen_last, Frag_::skip, StatsIncr(), DefragTracker_::timeout, TM_ECODE_OK, TmqhOutputPacketpool(), Packet_::ts, and UNSET_TUNNEL_PKT.

Here is the call graph for this function:

void DefragRegisterTests ( void  )

Definition at line 2461 of file defrag.c.

References UtRegisterTest().

Here is the call graph for this function:

RB_GENERATE ( IP_FRAGMENTS  ,
Frag_  ,
rb  ,
DefragRbFragCompare   
)