-/* Copyright (C) 2007-2010 Open Information Security Foundation
+/* Copyright (C) 2007-2013 Open Information Security Foundation
*
* You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
* \file
*
* \author Victor Julien <victor@inliniac.net>
+ * \author Anoop Saldanha <anoopsaldanha@gmail.com>
*/
#ifndef __DECODE_EVENTS_H__
#define __DECODE_EVENTS_H__
+/* packet decoder events */
enum {
/* IPV4 EVENTS */
IPV4_PKT_TOO_SMALL = 1, /**< ipv4 pkt smaller than minimum header size */
IPV4_OPT_DUPLICATE, /**< duplicated ip option */
IPV4_OPT_UNKNOWN, /**< unknown ip option */
IPV4_WRONG_IP_VER, /**< wrong ip version in ip options */
+ IPV4_WITH_ICMPV6, /**< IPv4 packet with ICMPv6 header */
/* ICMP EVENTS */
ICMPV4_PKT_TOO_SMALL, /**< icmpv4 packet smaller than minimum size */
ICMPV6_PKT_TOO_SMALL, /**< icmpv6 smaller than minimum size */
ICMPV6_IPV6_UNKNOWN_VER, /**< unknown version in icmpv6 packet */
ICMPV6_IPV6_TRUNC_PKT, /**< truncated icmpv6 packet */
+ ICMPV6_MLD_MESSAGE_WITH_INVALID_HL, /**< invalid MLD that doesn't have HL 1 */
+ ICMPV6_UNASSIGNED_TYPE, /**< unsassigned ICMPv6 type */
+ ICMPV6_EXPERIMENTATION_TYPE, /**< uprivate experimentation ICMPv6 type */
/* IPV6 EVENTS */
IPV6_PKT_TOO_SMALL, /**< ipv6 packet smaller than minimum size */
IPV6_TRUNC_PKT, /**< truncated ipv6 packet */
IPV6_TRUNC_EXTHDR, /**< truncated ipv6 extension header */
IPV6_EXTHDR_DUPL_FH, /**< duplicated "fragment" header in ipv6 extension headers */
+ IPV6_EXTHDR_USELESS_FH, /**< useless FH: offset 0 + no more fragments */
IPV6_EXTHDR_DUPL_RH, /**< duplicated "routing" header in ipv6 extension headers */
IPV6_EXTHDR_DUPL_HH, /**< duplicated "hop-by-hop" header in ipv6 extension headers */
IPV6_EXTHDR_DUPL_DH, /**< duplicated "destination" header in ipv6 extension headers */
IPV6_EXTHDR_INVALID_OPTLEN, /**< the opt len in an hop or dst hdr is invalid. */
IPV6_WRONG_IP_VER, /**< wrong version in ipv6 */
+ IPV6_EXTHDR_AH_RES_NOT_NULL, /**< AH hdr reserved fields not null (rfc 4302) */
+
+ IPV6_HOPOPTS_UNKNOWN_OPT, /**< unknown HOP opt */
+ IPV6_HOPOPTS_ONLY_PADDING, /**< all options in HOP opts are padding */
+ IPV6_DSTOPTS_UNKNOWN_OPT, /**< unknown DST opt */
+ IPV6_DSTOPTS_ONLY_PADDING, /**< all options in DST opts are padding */
+
+ IPV6_EXTHDR_RH_TYPE_0, /**< RH 0 is deprecated as per rfc5095 */
+ IPV6_EXTHDR_ZERO_LEN_PADN, /**< padN w/o data (0 len) */
+ IPV6_FH_NON_ZERO_RES_FIELD, /**< reserved field not zero */
+ IPV6_DATA_AFTER_NONE_HEADER, /**< data after 'none' (59) header */
+
+ IPV6_UNKNOWN_NEXT_HEADER, /**< unknown/unsupported next header */
+ IPV6_WITH_ICMPV4, /**< IPv6 packet with ICMPv4 header */
/* TCP EVENTS */
TCP_PKT_TOO_SMALL, /**< tcp packet smaller than minimum size */
/* VLAN EVENTS */
VLAN_HEADER_TOO_SMALL, /**< vlan header smaller than minimum size */
VLAN_UNKNOWN_TYPE, /**< vlan unknown type */
+ VLAN_HEADER_TOO_MANY_LAYERS,
/* RAW EVENTS */
IPRAW_INVALID_IPV, /**< invalid ip version in ip raw */
+ /* LINKTYPE NULL EVENTS */
+ LTNULL_PKT_TOO_SMALL, /**< pkt too small for lt:null */
+ LTNULL_UNSUPPORTED_TYPE, /**< pkt has a type that the decoder doesn't support */
+
+ /* STREAM EVENTS */
STREAM_3WHS_ACK_IN_WRONG_DIR,
STREAM_3WHS_ASYNC_WRONG_SEQ,
STREAM_3WHS_RIGHT_SEQ_WRONG_ACK_EVASION,
STREAM_3WHS_SYNACK_RESEND_WITH_DIFF_SEQ,
STREAM_3WHS_SYNACK_TOSERVER_ON_SYN_RECV,
STREAM_3WHS_SYNACK_WITH_WRONG_ACK,
+ STREAM_3WHS_SYNACK_FLOOD,
STREAM_3WHS_SYN_RESEND_DIFF_SEQ_ON_SYN_RECV,
STREAM_3WHS_SYN_TOCLIENT_ON_SYN_RECV,
STREAM_3WHS_WRONG_SEQ_WRONG_ACK,
STREAM_4WHS_INVALID_ACK,
STREAM_CLOSEWAIT_ACK_OUT_OF_WINDOW,
STREAM_CLOSEWAIT_FIN_OUT_OF_WINDOW,
+ STREAM_CLOSEWAIT_PKT_BEFORE_LAST_ACK,
STREAM_CLOSEWAIT_INVALID_ACK,
STREAM_CLOSING_ACK_WRONG_SEQ,
STREAM_CLOSING_INVALID_ACK,
STREAM_RST_BUT_NO_SESSION,
STREAM_TIMEWAIT_ACK_WRONG_SEQ,
STREAM_TIMEWAIT_INVALID_ACK,
+ STREAM_SHUTDOWN_SYN_RESEND,
STREAM_PKT_INVALID_TIMESTAMP,
STREAM_PKT_INVALID_ACK,
+ STREAM_PKT_BROKEN_ACK,
STREAM_RST_INVALID_ACK,
+ STREAM_PKT_RETRANSMISSION,
+ STREAM_PKT_BAD_WINDOW_UPDATE,
STREAM_REASSEMBLY_SEGMENT_BEFORE_BASE_SEQ,
STREAM_REASSEMBLY_NO_SEGMENT,
+ STREAM_REASSEMBLY_SEQ_GAP,
+
+ STREAM_REASSEMBLY_OVERLAP_DIFFERENT_DATA,
+
/* SCTP EVENTS */
- SCTP_PKT_TOO_SMALL, /**< sctp packet smaller than minimum size */
+ SCTP_PKT_TOO_SMALL, /**< sctp packet smaller than minimum size */
/* Fragmentation reasembly events. */
IPV4_FRAG_PKT_TOO_LARGE,
- IPV4_FRAG_OVERLAP,
IPV6_FRAG_PKT_TOO_LARGE,
+ IPV4_FRAG_OVERLAP,
IPV6_FRAG_OVERLAP,
+ IPV4_FRAG_TOO_LARGE,
+ IPV6_FRAG_TOO_LARGE,
+ /* Fragment ignored due to internal error */
+ IPV4_FRAG_IGNORED,
+ IPV6_FRAG_IGNORED,
+
+ /* IPv4 in IPv6 events */
+ IPV4_IN_IPV6_PKT_TOO_SMALL,
+ IPV4_IN_IPV6_WRONG_IP_VER,
+ /* IPv6 in IPv6 events */
+ IPV6_IN_IPV6_PKT_TOO_SMALL,
+ IPV6_IN_IPV6_WRONG_IP_VER,
+
+ /* MPLS decode events. */
+ MPLS_HEADER_TOO_SMALL,
+ MPLS_BAD_LABEL_ROUTER_ALERT,
+ MPLS_BAD_LABEL_IMPLICIT_NULL,
+ MPLS_BAD_LABEL_RESERVED,
+ MPLS_UNKNOWN_PAYLOAD_TYPE,
+
+ /* ERSPAN events */
+ ERSPAN_HEADER_TOO_SMALL,
+ ERSPAN_UNSUPPORTED_VERSION,
+ ERSPAN_TOO_MANY_VLAN_LAYERS,
/* should always be last! */
DECODE_EVENT_MAX,
};
#endif /* __DECODE_EVENTS_H__ */
-
projects / people / ms / suricata.git / blobdiff