Store IPv4 decoder vars in a new Packet::l3 section in the packet.
Use inline functions instead of the often multi-layer macro's for
various IPv4 header getters.
Ticket: #6938.
char proto[16] = "";
const char *protoptr;
- const uint8_t ipproto = IPV4_GET_IPPROTO(p);
+ const IPV4Hdr *ipv4h = PacketGetIPv4(p);
+ const uint8_t ipproto = IPV4_GET_RAW_IPPROTO(ipv4h);
if (SCProtoNameValid(ipproto)) {
protoptr = known_proto[ipproto];
} else {
char s[16], d[16];
PrintInet(AF_INET, &(p->icmpv4vars.emb_ip4_src), s, sizeof(s));
PrintInet(AF_INET, &(p->icmpv4vars.emb_ip4_dst), d, sizeof(d));
- SCLogDebug("ICMPv4 embedding IPV4 %s->%s - PROTO: %" PRIu32 " ID: %" PRIu32 "", s,d,
+ SCLogDebug("ICMPv4 embedding IPV4 %s->%s - PROTO: %" PRIu32 " ID: %" PRIu32 "", s, d,
IPV4_GET_RAW_IPPROTO(icmp4_ip4h), IPV4_GET_RAW_IPID(icmp4_ip4h));
#endif
ip4h.s_ip_src.s_addr = p->src.addr_data32[0];
ip4h.s_ip_dst.s_addr = p->dst.addr_data32[0];
- p->ip4h = &ip4h;
+ UTHSetIPV4Hdr(p, &ip4h);
DecodeICMPV4(&tv, &dtv, p, raw_icmpv4, sizeof(raw_icmpv4));
ip4h.s_ip_src.s_addr = p->src.addr_data32[0];
ip4h.s_ip_dst.s_addr = p->dst.addr_data32[0];
- p->ip4h = &ip4h;
+ UTHSetIPV4Hdr(p, &ip4h);
DecodeICMPV4(&tv, &dtv, p, raw_icmpv4, sizeof(raw_icmpv4));
ip4h.s_ip_src.s_addr = p->src.addr_data32[0];
ip4h.s_ip_dst.s_addr = p->dst.addr_data32[0];
- p->ip4h = &ip4h;
+ UTHSetIPV4Hdr(p, &ip4h);
DecodeICMPV4(&tv, &dtv, p, raw_icmpv4, sizeof(raw_icmpv4));
ip4h.s_ip_src.s_addr = p->src.addr_data32[0];
ip4h.s_ip_dst.s_addr = p->dst.addr_data32[0];
- p->ip4h = &ip4h;
+ UTHSetIPV4Hdr(p, &ip4h);
DecodeICMPV4(&tv, &dtv, p, raw_icmpv4, sizeof(raw_icmpv4));
ip4h.s_ip_src.s_addr = p->src.addr_data32[0];
ip4h.s_ip_dst.s_addr = p->dst.addr_data32[0];
- p->ip4h = &ip4h;
+ UTHSetIPV4Hdr(p, &ip4h);
DecodeICMPV4(&tv, &dtv, p, raw_icmpv4, sizeof(raw_icmpv4));
ip4h.s_ip_src.s_addr = p->src.addr_data32[0];
ip4h.s_ip_dst.s_addr = p->dst.addr_data32[0];
- p->ip4h = &ip4h;
+ UTHSetIPV4Hdr(p, &ip4h);
DecodeICMPV4(&tv, &dtv, p, raw_icmpv4, sizeof(raw_icmpv4));
ip4h.s_ip_src.s_addr = p->src.addr_data32[0];
ip4h.s_ip_dst.s_addr = p->dst.addr_data32[0];
- p->ip4h = &ip4h;
+ UTHSetIPV4Hdr(p, &ip4h);
DecodeICMPV4(&tv, &dtv, p, raw_icmpv4, sizeof(raw_icmpv4));
while (plen)
{
- p->ip4vars.opt_cnt++;
+ p->l3.vars.ip4.opt_cnt++;
/* single byte options */
if (*pkt == IPV4_OPT_EOL) {
/** \todo What if more data exist after EOL (possible covert channel or data leakage)? */
SCLogDebug("IPV4OPT %" PRIu8 " len 1 @ %d/%d",
*pkt, (len - plen), (len - 1));
- p->ip4vars.opts_set |= IPV4_OPT_FLAG_EOL;
+ p->l3.vars.ip4.opts_set |= IPV4_OPT_FLAG_EOL;
break;
} else if (*pkt == IPV4_OPT_NOP) {
SCLogDebug("IPV4OPT %" PRIu8 " len 1 @ %d/%d",
pkt++;
plen--;
- p->ip4vars.opts_set |= IPV4_OPT_FLAG_NOP;
+ p->l3.vars.ip4.opts_set |= IPV4_OPT_FLAG_NOP;
- /* multibyte options */
+ /* multibyte options */
} else {
if (unlikely(plen < 2)) {
/** \todo What if padding is non-zero (possible covert channel or data leakage)? */
/* Warn - we can keep going */
} else if (IPV4OptValidateTimestamp(p, &opt) == 0) {
opts->o_ts = opt;
- p->ip4vars.opts_set |= IPV4_OPT_FLAG_TS;
+ p->l3.vars.ip4.opts_set |= IPV4_OPT_FLAG_TS;
}
break;
case IPV4_OPT_RR:
/* Warn - we can keep going */
} else if (IPV4OptValidateRoute(p, &opt) == 0) {
opts->o_rr = opt;
- p->ip4vars.opts_set |= IPV4_OPT_FLAG_RR;
+ p->l3.vars.ip4.opts_set |= IPV4_OPT_FLAG_RR;
}
break;
case IPV4_OPT_QS:
/* Warn - we can keep going */
} else if (IPV4OptValidateGeneric(p, &opt) == 0) {
opts->o_qs = opt;
- p->ip4vars.opts_set |= IPV4_OPT_FLAG_QS;
+ p->l3.vars.ip4.opts_set |= IPV4_OPT_FLAG_QS;
}
break;
case IPV4_OPT_SEC:
/* Warn - we can keep going */
} else if (IPV4OptValidateGeneric(p, &opt) == 0) {
opts->o_sec = opt;
- p->ip4vars.opts_set |= IPV4_OPT_FLAG_SEC;
+ p->l3.vars.ip4.opts_set |= IPV4_OPT_FLAG_SEC;
}
break;
case IPV4_OPT_LSRR:
/* Warn - we can keep going */
} else if (IPV4OptValidateRoute(p, &opt) == 0) {
opts->o_lsrr = opt;
- p->ip4vars.opts_set |= IPV4_OPT_FLAG_LSRR;
+ p->l3.vars.ip4.opts_set |= IPV4_OPT_FLAG_LSRR;
}
break;
case IPV4_OPT_ESEC:
/* Warn - we can keep going */
} else if (IPV4OptValidateGeneric(p, &opt) == 0) {
opts->o_esec = opt;
- p->ip4vars.opts_set |= IPV4_OPT_FLAG_ESEC;
+ p->l3.vars.ip4.opts_set |= IPV4_OPT_FLAG_ESEC;
}
break;
case IPV4_OPT_CIPSO:
/* Warn - we can keep going */
} else if (IPV4OptValidateCIPSO(p, &opt) == 0) {
opts->o_cipso = opt;
- p->ip4vars.opts_set |= IPV4_OPT_FLAG_CIPSO;
+ p->l3.vars.ip4.opts_set |= IPV4_OPT_FLAG_CIPSO;
}
break;
case IPV4_OPT_SID:
/* Warn - we can keep going */
} else if (IPV4OptValidateGeneric(p, &opt) == 0) {
opts->o_sid = opt;
- p->ip4vars.opts_set |= IPV4_OPT_FLAG_SID;
+ p->l3.vars.ip4.opts_set |= IPV4_OPT_FLAG_SID;
}
break;
case IPV4_OPT_SSRR:
/* Warn - we can keep going */
} else if (IPV4OptValidateRoute(p, &opt) == 0) {
opts->o_ssrr = opt;
- p->ip4vars.opts_set |= IPV4_OPT_FLAG_SSRR;
+ p->l3.vars.ip4.opts_set |= IPV4_OPT_FLAG_SSRR;
}
break;
case IPV4_OPT_RTRALT:
/* Warn - we can keep going */
} else if (IPV4OptValidateGeneric(p, &opt) == 0) {
opts->o_rtralt = opt;
- p->ip4vars.opts_set |= IPV4_OPT_FLAG_RTRALT;
+ p->l3.vars.ip4.opts_set |= IPV4_OPT_FLAG_RTRALT;
}
break;
default:
return 0;
}
-static int DecodeIPV4Packet(Packet *p, const uint8_t *pkt, uint16_t len)
+static const IPV4Hdr *DecodeIPV4Packet(Packet *p, const uint8_t *pkt, uint16_t len)
{
if (unlikely(len < IPV4_HEADER_LEN)) {
ENGINE_SET_INVALID_EVENT(p, IPV4_PKT_TOO_SMALL);
- return -1;
+ return NULL;
}
if (unlikely(IP_GET_RAW_VER(pkt) != 4)) {
SCLogDebug("wrong ip version %d",IP_GET_RAW_VER(pkt));
ENGINE_SET_INVALID_EVENT(p, IPV4_WRONG_IP_VER);
- return -1;
+ return NULL;
}
- p->ip4h = (IPV4Hdr *)pkt;
+ const IPV4Hdr *ip4h = PacketSetIPV4(p, pkt);
- if (unlikely(IPV4_GET_HLEN(p) < IPV4_HEADER_LEN)) {
+ if (unlikely(IPV4_GET_RAW_HLEN(ip4h) < IPV4_HEADER_LEN)) {
ENGINE_SET_INVALID_EVENT(p, IPV4_HLEN_TOO_SMALL);
- return -1;
+ return NULL;
}
- if (unlikely(IPV4_GET_IPLEN(p) < IPV4_GET_HLEN(p))) {
+ if (unlikely(IPV4_GET_RAW_IPLEN(ip4h) < IPV4_GET_RAW_HLEN(ip4h))) {
ENGINE_SET_INVALID_EVENT(p, IPV4_IPLEN_SMALLER_THAN_HLEN);
- return -1;
+ return NULL;
}
- if (unlikely(len < IPV4_GET_IPLEN(p))) {
+ if (unlikely(len < IPV4_GET_RAW_IPLEN(ip4h))) {
ENGINE_SET_INVALID_EVENT(p, IPV4_TRUNC_PKT);
- return -1;
+ return NULL;
}
/* set the address struct */
- SET_IPV4_SRC_ADDR(p,&p->src);
- SET_IPV4_DST_ADDR(p,&p->dst);
+ SET_IPV4_SRC_ADDR(ip4h, &p->src);
+ SET_IPV4_DST_ADDR(ip4h, &p->dst);
/* save the options len */
- uint8_t ip_opt_len = IPV4_GET_HLEN(p) - IPV4_HEADER_LEN;
+ uint8_t ip_opt_len = IPV4_GET_RAW_HLEN(ip4h) - IPV4_HEADER_LEN;
if (ip_opt_len > 0) {
IPV4Options opts;
memset(&opts, 0x00, sizeof(opts));
if (DecodeIPV4Options(p, pkt + IPV4_HEADER_LEN, ip_opt_len, &opts) < 0) {
- return -1;
+ return NULL;
}
}
- return 0;
+ return ip4h;
}
int DecodeIPV4(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
return TM_ECODE_FAILED;
}
/* do the actual decoding */
- if (unlikely(DecodeIPV4Packet (p, pkt, len) < 0)) {
+ const IPV4Hdr *ip4h = DecodeIPV4Packet(p, pkt, len);
+ if (unlikely(ip4h == NULL)) {
SCLogDebug("decoding IPv4 packet failed");
- CLEAR_IPV4_PACKET((p));
+ PacketClearL3(p);
return TM_ECODE_FAILED;
}
- p->proto = IPV4_GET_IPPROTO(p);
+ p->proto = IPV4_GET_RAW_IPPROTO(ip4h);
/* If a fragment, pass off for re-assembly. */
- if (unlikely(IPV4_GET_IPOFFSET(p) > 0 || IPV4_GET_MF(p) == 1)) {
+ if (unlikely(IPV4_GET_RAW_FRAGOFFSET(ip4h) > 0 || IPV4_GET_RAW_FLAG_MF(ip4h))) {
Packet *rp = Defrag(tv, dtv, p);
if (rp != NULL) {
PacketEnqueueNoLock(&tv->decode_pq, rp);
char s[16], d[16];
PrintInet(AF_INET, (const void *)GET_IPV4_SRC_ADDR_PTR(p), s, sizeof(s));
PrintInet(AF_INET, (const void *)GET_IPV4_DST_ADDR_PTR(p), d, sizeof(d));
- SCLogDebug("IPV4 %s->%s PROTO: %" PRIu32 " OFFSET: %" PRIu32 " RF: %" PRIu32 " DF: %" PRIu32 " MF: %" PRIu32 " ID: %" PRIu32 "", s,d,
- IPV4_GET_IPPROTO(p), IPV4_GET_IPOFFSET(p), IPV4_GET_RF(p),
- IPV4_GET_DF(p), IPV4_GET_MF(p), IPV4_GET_IPID(p));
+ SCLogDebug("IPV4 %s->%s PROTO: %" PRIu32 " OFFSET: %" PRIu32 " RF: %" PRIu8 " DF: %" PRIu8
+ " MF: %" PRIu8 " ID: %" PRIu32 "",
+ s, d, IPV4_GET_RAW_IPPROTO(ip4h), IPV4_GET_RAW_IPOFFSET(ip4h),
+ IPV4_GET_RAW_FLAG_RF(ip4h), IPV4_GET_RAW_FLAG_DF(ip4h), IPV4_GET_RAW_FLAG_MF(ip4h),
+ IPV4_GET_RAW_IPID(ip4h));
}
#endif /* DEBUG */
- const uint8_t *data = pkt + IPV4_GET_HLEN(p);
- const uint16_t data_len = IPV4_GET_IPLEN(p) - IPV4_GET_HLEN(p);
+ const uint8_t *data = pkt + IPV4_GET_RAW_HLEN(ip4h);
+ const uint16_t data_len = IPV4_GET_RAW_IPLEN(ip4h) - IPV4_GET_RAW_HLEN(ip4h);
/* check what next decoder to invoke */
- switch (IPV4_GET_IPPROTO(p)) {
+ switch (p->proto) {
case IPPROTO_TCP:
DecodeTCP(tv, dtv, p, data, data_len);
break;
result = 0;
goto end;
}
- if (tp->ip4h == NULL || tp->tcph == NULL) {
+ if (tp->l3.hdrs.ip4h == NULL || tp->tcph == NULL) {
printf("pseudo packet's ip header and tcp header shouldn't be NULL, "
"but it is\n");
result = 0;
tp->recursion_level, p->recursion_level);
goto end;
}
- if (tp->ip4h == NULL || tp->tcph == NULL) {
+ if (tp->l3.hdrs.ip4h == NULL || tp->tcph == NULL) {
printf("pseudo packet's ip header and tcp header shouldn't be NULL, "
"but it is\n");
goto end;
result = 0;
goto end;
}
- if (tp->ip4h == NULL || tp->tcph == NULL) {
+ if (tp->l3.hdrs.ip4h == NULL || tp->tcph == NULL) {
printf("pseudo packet's ip header and tcp header shouldn't be NULL, "
"but it is\n");
result = 0;
-/* Copyright (C) 2007-2022 Open Information Security Foundation
+/* Copyright (C) 2007-2024 Open Information Security Foundation
*
* You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
#define s_ip_addrs ip4_hdrun1.ip_addrs
#define IPV4_GET_RAW_VER(ip4h) (((ip4h)->ip_verhl & 0xf0) >> 4)
-#define IPV4_GET_RAW_HLEN(ip4h) ((ip4h)->ip_verhl & 0x0f)
+#define IPV4_GET_RAW_HLEN(ip4h) (uint8_t)(((ip4h)->ip_verhl & (uint8_t)0x0f) << (uint8_t)2)
#define IPV4_GET_RAW_IPTOS(ip4h) ((ip4h)->ip_tos)
-#define IPV4_GET_RAW_IPLEN(ip4h) ((ip4h)->ip_len)
-#define IPV4_GET_RAW_IPID(ip4h) ((ip4h)->ip_id)
-#define IPV4_GET_RAW_IPOFFSET(ip4h) ((ip4h)->ip_off)
+#define IPV4_GET_RAW_IPLEN(ip4h) (SCNtohs((ip4h)->ip_len))
+#define IPV4_GET_RAW_IPID(ip4h) (SCNtohs((ip4h)->ip_id))
+#define IPV4_GET_RAW_IPOFFSET(ip4h) SCNtohs((ip4h)->ip_off)
+#define IPV4_GET_RAW_FRAGOFFSET(ip4h) (IPV4_GET_RAW_IPOFFSET((ip4h)) & 0x1fff)
#define IPV4_GET_RAW_IPTTL(ip4h) ((ip4h)->ip_ttl)
#define IPV4_GET_RAW_IPPROTO(ip4h) ((ip4h)->ip_proto)
#define IPV4_GET_RAW_IPSRC(ip4h) ((ip4h)->s_ip_src)
/** return the raw (directly from the header) dst ip as uint32_t */
#define IPV4_GET_RAW_IPDST_U32(ip4h) (uint32_t)((ip4h)->s_ip_dst.s_addr)
-/* we need to change them as well as get them */
-#define IPV4_SET_RAW_VER(ip4h, value) ((ip4h)->ip_verhl = (((ip4h)->ip_verhl & 0x0f) | (value << 4)))
-#define IPV4_SET_RAW_HLEN(ip4h, value) ((ip4h)->ip_verhl = (((ip4h)->ip_verhl & 0xf0) | (value & 0x0f)))
-#define IPV4_SET_RAW_IPTOS(ip4h, value) ((ip4h)->ip_tos = value)
-#define IPV4_SET_RAW_IPLEN(ip4h, value) ((ip4h)->ip_len = value)
-#define IPV4_SET_RAW_IPPROTO(ip4h, value) ((ip4h)->ip_proto = value)
-
-/* ONLY call these functions after making sure that:
- * 1. p->ip4h is set
- * 2. p->ip4h is valid (len is correct)
- */
-#define IPV4_GET_VER(p) \
- IPV4_GET_RAW_VER((p)->ip4h)
-#define IPV4_GET_HLEN(p) ((uint8_t)(IPV4_GET_RAW_HLEN((p)->ip4h) << 2))
-#define IPV4_GET_IPTOS(p) \
- IPV4_GET_RAW_IPTOS((p)->ip4h)
-#define IPV4_GET_IPLEN(p) \
- (SCNtohs(IPV4_GET_RAW_IPLEN((p)->ip4h)))
-#define IPV4_GET_IPID(p) \
- (SCNtohs(IPV4_GET_RAW_IPID((p)->ip4h)))
-/* _IPV4_GET_IPOFFSET: get the content of the offset header field in host order */
-#define _IPV4_GET_IPOFFSET(p) \
- (SCNtohs(IPV4_GET_RAW_IPOFFSET((p)->ip4h)))
-/* IPV4_GET_IPOFFSET: get the final offset */
-#define IPV4_GET_IPOFFSET(p) \
- (_IPV4_GET_IPOFFSET(p) & 0x1fff)
-/* IPV4_GET_RF: get the RF flag. Use _IPV4_GET_IPOFFSET to save a SCNtohs call. */
-#define IPV4_GET_RF(p) \
- (uint8_t)((_IPV4_GET_IPOFFSET((p)) & 0x8000) >> 15)
-/* IPV4_GET_DF: get the DF flag. Use _IPV4_GET_IPOFFSET to save a SCNtohs call. */
-#define IPV4_GET_DF(p) \
- (uint8_t)((_IPV4_GET_IPOFFSET((p)) & 0x4000) >> 14)
-/* IPV4_GET_MF: get the MF flag. Use _IPV4_GET_IPOFFSET to save a SCNtohs call. */
-#define IPV4_GET_MF(p) \
- (uint8_t)((_IPV4_GET_IPOFFSET((p)) & 0x2000) >> 13)
-#define IPV4_GET_IPTTL(p) \
- IPV4_GET_RAW_IPTTL(p->ip4h)
-#define IPV4_GET_IPPROTO(p) \
- IPV4_GET_RAW_IPPROTO((p)->ip4h)
-
-#define CLEAR_IPV4_PACKET(p) \
- do { \
- (p)->ip4h = NULL; \
- memset(&p->ip4vars, 0x00, sizeof(p->ip4vars)); \
- } while (0)
+#define IPV4_GET_RAW_FLAG_MF(ip4h) ((IPV4_GET_RAW_IPOFFSET((ip4h)) & 0x2000) != 0)
+#define IPV4_GET_RAW_FLAG_DF(ip4h) ((IPV4_GET_RAW_IPOFFSET((ip4h)) & 0x4000) != 0)
+#define IPV4_GET_RAW_FLAG_RF(ip4h) ((IPV4_GET_RAW_IPOFFSET((ip4h)) & 0x8000) != 0)
#define IPV4_OPT_FLAG_EOL BIT_U16(1)
#define IPV4_OPT_FLAG_NOP BIT_U16(2)
p->src.family = AF_INET;
p->dst.family = AF_INET;
- p->ip4h = &ip4h;
-
+ UTHSetIPV4Hdr(p, &ip4h);
FlowInitConfig(FLOW_QUIET);
DecodeTCP(&tv, &dtv, p, raw_tcp, sizeof(raw_tcp));
p->src.family = AF_INET;
p->dst.family = AF_INET;
- p->ip4h = &ip4h;
+ UTHSetIPV4Hdr(p, &ip4h);
FlowInitConfig(FLOW_QUIET);
DecodeTCP(&tv, &dtv, p, raw_tcp, sizeof(raw_tcp));
p->src.family = AF_INET;
p->dst.family = AF_INET;
- p->ip4h = &ip4h;
+ UTHSetIPV4Hdr(p, &ip4h);
FlowInitConfig(FLOW_QUIET);
DecodeTCP(&tv, &dtv, p, raw_tcp, sizeof(raw_tcp));
p->src.family = AF_INET;
p->dst.family = AF_INET;
- p->ip4h = &ip4h;
+ UTHSetIPV4Hdr(p, &ip4h);
FlowInitConfig(FLOW_QUIET);
DecodeTCP(&tv, &dtv, p, raw_tcp, sizeof(raw_tcp));
#include "decode-vlan.h"
#include "decode-mpls.h"
+#include "util-validate.h"
/* forward declarations */
struct DetectionEngineThreadCtx_;
*
* We set the rest of the struct to 0 so we can
* prevent using memset. */
-#define SET_IPV4_SRC_ADDR(p, a) do { \
- (a)->family = AF_INET; \
- (a)->addr_data32[0] = (uint32_t)(p)->ip4h->s_ip_src.s_addr; \
- (a)->addr_data32[1] = 0; \
- (a)->addr_data32[2] = 0; \
- (a)->addr_data32[3] = 0; \
+#define SET_IPV4_SRC_ADDR(ip4h, a) \
+ do { \
+ (a)->family = AF_INET; \
+ (a)->addr_data32[0] = (uint32_t)(ip4h)->s_ip_src.s_addr; \
+ (a)->addr_data32[1] = 0; \
+ (a)->addr_data32[2] = 0; \
+ (a)->addr_data32[3] = 0; \
} while (0)
-#define SET_IPV4_DST_ADDR(p, a) do { \
- (a)->family = AF_INET; \
- (a)->addr_data32[0] = (uint32_t)(p)->ip4h->s_ip_dst.s_addr; \
- (a)->addr_data32[1] = 0; \
- (a)->addr_data32[2] = 0; \
- (a)->addr_data32[3] = 0; \
+#define SET_IPV4_DST_ADDR(ip4h, a) \
+ do { \
+ (a)->family = AF_INET; \
+ (a)->addr_data32[0] = (uint32_t)(ip4h)->s_ip_dst.s_addr; \
+ (a)->addr_data32[1] = 0; \
+ (a)->addr_data32[2] = 0; \
+ (a)->addr_data32[3] = 0; \
} while (0)
/* Set the IPv6 addresses into the Addrs of the Packet.
*We determine the ip version. */
#define IP_GET_RAW_VER(pkt) ((((pkt)[0] & 0xf0) >> 4))
-#define PKT_IS_IPV4(p) (((p)->ip4h != NULL))
#define PKT_IS_IPV6(p) (((p)->ip6h != NULL))
#define PKT_IS_TCP(p) (((p)->tcph != NULL))
#define PKT_IS_UDP(p) (((p)->udph != NULL))
#define PKT_IS_TOSERVER(p) (((p)->flowflags & FLOW_PKT_TOSERVER))
#define PKT_IS_TOCLIENT(p) (((p)->flowflags & FLOW_PKT_TOCLIENT))
-#define IPH_IS_VALID(p) (PKT_IS_IPV4((p)) || PKT_IS_IPV6((p)))
-
/* structure to store the sids/gids/etc the detection engine
* found in this packet */
typedef struct PacketAlert_ {
/* forward declaration since Packet struct definition requires this */
struct PacketQueue_;
+enum PacketL3Types {
+ PACKET_L3_UNKNOWN = 0,
+ PACKET_L3_IPV4,
+};
+
+struct PacketL3 {
+ enum PacketL3Types type;
+ /* Checksum for IP packets. */
+ int32_t comp_csum;
+ union Hdrs {
+ IPV4Hdr *ip4h;
+ } hdrs;
+ /* IPv4 and IPv6 are mutually exclusive */
+ union {
+ IPV4Vars ip4;
+ } vars;
+};
+
/* sizes of the members:
* src: 17 bytes
* dst: 17 bytes
/* header pointers */
EthernetHdr *ethh;
- /* Checksum for IP packets. */
- int32_t level3_comp_csum;
/* Check sum for TCP, UDP or ICMP packets */
int32_t level4_comp_csum;
- IPV4Hdr *ip4h;
-
+ struct PacketL3 l3;
IPV6Hdr *ip6h;
-
- /* IPv4 and IPv6 are mutually exclusive */
- union {
- IPV4Vars ip4vars;
- struct {
- IPV6Vars ip6vars;
- IPV6ExtHdrs ip6eh;
- };
+ struct {
+ IPV6Vars ip6vars;
+ IPV6ExtHdrs ip6eh;
};
+
/* Can only be one of TCP, UDP, ICMP at any given time */
union {
TCPVars tcpvars;
uint8_t pkt_data[];
} Packet;
+static inline bool PacketIsIPv4(const Packet *p);
+
/** highest mtu of the interfaces we monitor */
#define DEFAULT_MTU 1500
#define MINIMUM_MTU 68 /**< ipv4 minimum: rfc791 */
extern uint32_t default_packet_size;
#define SIZE_OF_PACKET (default_packet_size + sizeof(Packet))
+static inline bool PacketIsIPv4(const Packet *p)
+{
+ return p->l3.type == PACKET_L3_IPV4;
+}
+
+static inline const IPV4Hdr *PacketGetIPv4(const Packet *p)
+{
+ DEBUG_VALIDATE_BUG_ON(!PacketIsIPv4(p));
+ return p->l3.hdrs.ip4h;
+}
+
+static inline IPV4Hdr *PacketSetIPV4(Packet *p, const uint8_t *buf)
+{
+ DEBUG_VALIDATE_BUG_ON(p->l3.type != PACKET_L3_UNKNOWN);
+ p->l3.type = PACKET_L3_IPV4;
+ p->l3.hdrs.ip4h = (IPV4Hdr *)buf;
+ return p->l3.hdrs.ip4h;
+}
+
/* Retrieve proto regardless of IP version */
static inline uint8_t PacketGetIPProto(const Packet *p)
{
if (p->proto != 0) {
return p->proto;
}
- if (PKT_IS_IPV4(p)) {
- return IPV4_GET_IPPROTO(p);
+ if (PacketIsIPv4(p)) {
+ const IPV4Hdr *hdr = PacketGetIPv4(p);
+ return IPV4_GET_RAW_IPPROTO(hdr);
} else if (PKT_IS_IPV6(p)) {
return IPV6_GET_L4PROTO(p);
- } else {
- return 0;
}
+ return 0;
}
-static inline bool PacketIsIPv4(const Packet *p)
+static inline uint8_t PacketGetIPv4IPProto(const Packet *p)
+{
+ if (PacketGetIPv4(p)) {
+ const IPV4Hdr *hdr = PacketGetIPv4(p);
+ return IPV4_GET_RAW_IPPROTO(hdr);
+ }
+ return 0;
+}
+
+static inline void PacketClearL3(Packet *p)
{
- return PKT_IS_IPV4(p);
+ memset(&p->l3, 0, sizeof(p->l3));
}
static inline bool PacketIsIPv6(const Packet *p)
/**
* \brief reset these to -1(indicates that the packet is fresh from the queue)
*/
-#define PACKET_RESET_CHECKSUMS(p) do { \
- (p)->level3_comp_csum = -1; \
- (p)->level4_comp_csum = -1; \
+#define PACKET_RESET_CHECKSUMS(p) \
+ do { \
+ (p)->level4_comp_csum = -1; \
} while (0)
/* if p uses extended data, free them */
#include "util-byte.h"
#include "util-misc.h"
#include "util-hash-lookup3.h"
+#include "util-validate.h"
/** defrag tracker hash table */
DefragTrackerHashRow *defragtracker_hash;
COPY_ADDRESS(&p->dst, &dt->dst_addr);
if (PacketIsIPv4(p)) {
- dt->id = (int32_t)IPV4_GET_IPID(p);
+ const IPV4Hdr *ip4h = PacketGetIPv4(p);
+ dt->id = (int32_t)IPV4_GET_RAW_IPID(ip4h);
dt->af = AF_INET;
} else {
+ DEBUG_VALIDATE_BUG_ON(!PacketIsIPv6(p));
dt->id = (int32_t)IPV6_EXTHDR_GET_FH_ID(p);
dt->af = AF_INET6;
}
{
uint32_t key;
- if (p->ip4h != NULL) {
+ if (PacketIsIPv4(p)) {
+ const IPV4Hdr *ip4h = PacketGetIPv4(p);
DefragHashKey4 dhk = { .pad[0] = 0 };
if (p->src.addr_data32[0] > p->dst.addr_data32[0]) {
dhk.src = p->src.addr_data32[0];
dhk.src = p->dst.addr_data32[0];
dhk.dst = p->src.addr_data32[0];
}
- dhk.id = (uint32_t)IPV4_GET_IPID(p);
+ dhk.id = (uint32_t)IPV4_GET_RAW_IPID(ip4h);
memcpy(&dhk.vlan_id[0], &p->vlan_id[0], sizeof(dhk.vlan_id));
uint32_t hash =
hashword(dhk.u32, sizeof(dhk.u32) / sizeof(uint32_t), defrag_config.hash_rand);
key = hash % defrag_config.hash_size;
- } else if (p->ip6h != NULL) {
+ } else if (PacketIsIPv6(p)) {
DefragHashKey6 dhk = { .pad[0] = 0 };
if (DefragHashRawAddressIPv6GtU32(p->src.addr_data32, p->dst.addr_data32)) {
dhk.src[0] = p->src.addr_data32[0];
{
uint32_t id;
if (PacketIsIPv4(p)) {
- id = (uint32_t)IPV4_GET_IPID(p);
+ const IPV4Hdr *ip4h = PacketGetIPv4(p);
+ id = (uint32_t)IPV4_GET_RAW_IPID(ip4h);
} else {
id = IPV6_EXTHDR_GET_FH_ID(p);
}
}
}
+ const IPV4Hdr *oip4h = PacketGetIPv4(p);
+
/* Allocate a Packet for the reassembled packet. On failure we
* SCFree all the resources held by this tracker. */
- rp = PacketDefragPktSetup(p, NULL, 0, IPV4_GET_IPPROTO(p));
+ rp = PacketDefragPktSetup(p, NULL, 0, IPV4_GET_RAW_IPPROTO(oip4h));
if (rp == NULL) {
goto error_remove_tracker;
}
SCLogDebug("ip_hdr_offset %u, hlen %" PRIu16 ", fragmentable_len %" PRIu16, ip_hdr_offset, hlen,
fragmentable_len);
- rp->ip4h = (IPV4Hdr *)(GET_PKT_DATA(rp) + ip_hdr_offset);
- uint16_t old = rp->ip4h->ip_len + rp->ip4h->ip_off;
+ IPV4Hdr *ip4h = (IPV4Hdr *)(GET_PKT_DATA(rp) + ip_hdr_offset);
+ uint16_t old = ip4h->ip_len + ip4h->ip_off;
DEBUG_VALIDATE_BUG_ON(hlen > UINT16_MAX - fragmentable_len);
- rp->ip4h->ip_len = htons(fragmentable_len + hlen);
- rp->ip4h->ip_off = 0;
- rp->ip4h->ip_csum = FixChecksum(rp->ip4h->ip_csum,
- old, rp->ip4h->ip_len + rp->ip4h->ip_off);
+ ip4h->ip_len = htons(fragmentable_len + hlen);
+ ip4h->ip_off = 0;
+ ip4h->ip_csum = FixChecksum(ip4h->ip_csum, old, ip4h->ip_len + ip4h->ip_off);
SET_PKT_LEN(rp, ip_hdr_offset + hlen + fragmentable_len);
tracker->remove = 1;
#endif
if (tracker->af == AF_INET) {
- more_frags = IPV4_GET_MF(p);
- frag_offset = (uint16_t)(IPV4_GET_IPOFFSET(p) << 3);
- hlen = IPV4_GET_HLEN(p);
- data_offset = (uint16_t)((uint8_t *)p->ip4h + hlen - GET_PKT_DATA(p));
- data_len = IPV4_GET_IPLEN(p) - hlen;
+ const IPV4Hdr *ip4h = PacketGetIPv4(p);
+ more_frags = IPV4_GET_RAW_FLAG_MF(ip4h);
+ frag_offset = (uint16_t)((uint16_t)IPV4_GET_RAW_FRAGOFFSET(ip4h) << (uint16_t)3);
+ hlen = IPV4_GET_RAW_HLEN(ip4h);
+ data_offset = (uint16_t)((uint8_t *)ip4h + hlen - GET_PKT_DATA(p));
+ data_len = IPV4_GET_RAW_IPLEN(ip4h) - hlen;
frag_end = frag_offset + data_len;
- ip_hdr_offset = (uint16_t)((uint8_t *)p->ip4h - GET_PKT_DATA(p));
+ ip_hdr_offset = (uint16_t)((uint8_t *)ip4h - GET_PKT_DATA(p));
/* Ignore fragment if the end of packet extends past the
* maximum size of a packet. */
r = Defrag4Reassemble(tv, tracker, p);
if (r != NULL && tv != NULL && dtv != NULL) {
StatsIncr(tv, dtv->counter_defrag_ipv4_reassembled);
- if (DecodeIPV4(tv, dtv, r, (void *)r->ip4h, IPV4_GET_IPLEN(r)) != TM_ECODE_OK) {
+ const uint32_t len = GET_PKT_LEN(r) - (uint32_t)tracker->ip_hdr_offset;
+ DEBUG_VALIDATE_BUG_ON(len > UINT16_MAX);
+ if (DecodeIPV4(tv, dtv, r, GET_PKT_DATA(r) + tracker->ip_hdr_offset,
+ (uint16_t)len) != TM_ECODE_OK) {
r->root = NULL;
TmqhOutputPacketpool(tv, r);
r = NULL;
int af;
if (PacketIsIPv4(p)) {
+ const IPV4Hdr *ip4h = PacketGetIPv4(p);
af = AF_INET;
- more_frags = IPV4_GET_MF(p);
- frag_offset = IPV4_GET_IPOFFSET(p);
+ more_frags = IPV4_GET_RAW_FLAG_MF(ip4h);
+ frag_offset = IPV4_GET_RAW_FRAGOFFSET(ip4h);
} else if (PacketIsIPv6(p)) {
af = AF_INET6;
frag_offset = IPV6_EXTHDR_GET_FH_OFFSET(p);
/* copy content_len crap, we need full length */
PacketCopyData(p, (uint8_t *)&ip4h, sizeof(ip4h));
- p->ip4h = (IPV4Hdr *)GET_PKT_DATA(p);
- SET_IPV4_SRC_ADDR(p, &p->src);
- SET_IPV4_DST_ADDR(p, &p->dst);
+ IPV4Hdr *ip4p = PacketSetIPV4(p, GET_PKT_DATA(p));
+ SET_IPV4_SRC_ADDR(ip4p, &p->src);
+ SET_IPV4_DST_ADDR(ip4p, &p->dst);
pcontent = SCCalloc(1, content_len);
if (unlikely(pcontent == NULL))
SET_PKT_LEN(p, hlen + content_len);
SCFree(pcontent);
- p->ip4h->ip_csum = IPV4Checksum((uint16_t *)GET_PKT_DATA(p), hlen, 0);
+ ip4p->ip_csum = IPV4Checksum((uint16_t *)GET_PKT_DATA(p), hlen, 0);
/* Self test. */
- if (IPV4_GET_VER(p) != 4)
- goto error;
- if (IPV4_GET_HLEN(p) != hlen)
- goto error;
- if (IPV4_GET_IPLEN(p) != hlen + content_len)
- goto error;
- if (IPV4_GET_IPID(p) != id)
- goto error;
- if (IPV4_GET_IPOFFSET(p) != off)
- goto error;
- if (IPV4_GET_MF(p) != mf)
- goto error;
- if (IPV4_GET_IPTTL(p) != ttl)
- goto error;
- if (IPV4_GET_IPPROTO(p) != proto)
- goto error;
+ FAIL_IF(IPV4_GET_RAW_VER(ip4p) != 4);
+ FAIL_IF(IPV4_GET_RAW_HLEN(ip4p) != hlen);
+ FAIL_IF(IPV4_GET_RAW_IPLEN(ip4p) != hlen + content_len);
+ FAIL_IF(IPV4_GET_RAW_IPID(ip4p) != id);
+ FAIL_IF(IPV4_GET_RAW_FRAGOFFSET(ip4p) != off);
+ FAIL_IF(IPV4_GET_RAW_FLAG_MF(ip4p) != mf);
+ FAIL_IF(IPV4_GET_RAW_IPTTL(ip4p) != ttl);
+ FAIL_IF(IPV4_GET_RAW_IPPROTO(ip4p) != proto);
return p;
-error:
- if (p != NULL)
- SCFree(p);
- return NULL;
}
/**
/* copy content_len crap, we need full length */
PacketCopyData(p, (uint8_t *)&ip4h, sizeof(ip4h));
- p->ip4h = (IPV4Hdr *)GET_PKT_DATA(p);
- SET_IPV4_SRC_ADDR(p, &p->src);
- SET_IPV4_DST_ADDR(p, &p->dst);
+ IPV4Hdr *ip4p = PacketSetIPV4(p, GET_PKT_DATA(p));
+ SET_IPV4_SRC_ADDR(ip4p, &p->src);
+ SET_IPV4_DST_ADDR(ip4p, &p->dst);
PacketCopyDataOffset(p, hlen, content, content_len);
SET_PKT_LEN(p, hlen + content_len);
- p->ip4h->ip_csum = IPV4Checksum((uint16_t *)GET_PKT_DATA(p), hlen, 0);
+ ip4p->ip_csum = IPV4Checksum((uint16_t *)GET_PKT_DATA(p), hlen, 0);
/* Self test. */
- FAIL_IF(IPV4_GET_VER(p) != 4);
- FAIL_IF(IPV4_GET_HLEN(p) != hlen);
- FAIL_IF(IPV4_GET_IPLEN(p) != hlen + content_len);
- FAIL_IF(IPV4_GET_IPID(p) != id);
- FAIL_IF(IPV4_GET_IPOFFSET(p) != off);
- FAIL_IF(IPV4_GET_MF(p) != mf);
- FAIL_IF(IPV4_GET_IPTTL(p) != ttl);
- FAIL_IF(IPV4_GET_IPPROTO(p) != proto);
+ FAIL_IF(IPV4_GET_RAW_VER(ip4p) != 4);
+ FAIL_IF(IPV4_GET_RAW_HLEN(ip4p) != hlen);
+ FAIL_IF(IPV4_GET_RAW_IPLEN(ip4p) != hlen + content_len);
+ FAIL_IF(IPV4_GET_RAW_IPID(ip4p) != id);
+ FAIL_IF(IPV4_GET_RAW_FRAGOFFSET(ip4p) != off);
+ FAIL_IF(IPV4_GET_RAW_FLAG_MF(ip4p) != mf);
+ FAIL_IF(IPV4_GET_RAW_IPTTL(ip4p) != ttl);
+ FAIL_IF(IPV4_GET_RAW_IPPROTO(ip4p) != proto);
*packet = p;
PASS;
reassembled = Defrag(&tv, &dtv, p3);
FAIL_IF_NULL(reassembled);
- FAIL_IF(IPV4_GET_HLEN(reassembled) != 20);
- FAIL_IF(IPV4_GET_IPLEN(reassembled) != 39);
+ FAIL_IF(IPV4_GET_RAW_HLEN(PacketGetIPv4(reassembled)) != 20);
+ FAIL_IF(IPV4_GET_RAW_IPLEN(PacketGetIPv4(reassembled)) != 39);
/* 20 bytes in we should find 8 bytes of A. */
for (int i = 20; i < 20 + 8; i++) {
reassembled = Defrag(&tv, &dtv, p1);
FAIL_IF_NULL(reassembled);
- FAIL_IF(IPV4_GET_HLEN(reassembled) != 20);
- FAIL_IF(IPV4_GET_IPLEN(reassembled) != 39);
+ FAIL_IF(IPV4_GET_RAW_HLEN(PacketGetIPv4(reassembled)) != 20);
+ FAIL_IF(IPV4_GET_RAW_IPLEN(PacketGetIPv4(reassembled)) != 39);
/* 20 bytes in we should find 8 bytes of A. */
for (int i = 20; i < 20 + 8; i++) {
Packet *reassembled = Defrag(&tv, &dtv, packets[16]);
FAIL_IF_NULL(reassembled);
- FAIL_IF(IPV4_GET_HLEN(reassembled) != 20);
- FAIL_IF(IPV4_GET_IPLEN(reassembled) != 20 + 192);
+ FAIL_IF(IPV4_GET_RAW_HLEN(PacketGetIPv4(reassembled)) != 20);
+ FAIL_IF(IPV4_GET_RAW_IPLEN(PacketGetIPv4(reassembled)) != 20 + 192);
FAIL_IF(expected_len != 192);
if (memcmp(expected, GET_PKT_DATA(reassembled) + 20, expected_len) != 0) {
/* Expected IP length is 20 + 8 + 8 = 36 as only 2 of the
* fragments should be in the re-assembled packet. */
- FAIL_IF(IPV4_GET_IPLEN(p) != 36);
+ FAIL_IF(IPV4_GET_RAW_IPLEN(PacketGetIPv4(p)) != 36);
/* Verify the payload of the IPv4 packet. */
uint8_t expected_payload[] = "AAAAAAAABBBBBBBB";
{
const DetectCsumData *cd = (const DetectCsumData *)ctx;
- if (p->ip4h == NULL || PKT_IS_PSEUDOPKT(p))
+ if (!PacketIsIPv4(p) || PKT_IS_PSEUDOPKT(p))
return 0;
if (p->flags & PKT_IGNORE_CHECKSUM) {
return cd->valid;
}
- if (p->level3_comp_csum == -1)
- p->level3_comp_csum = IPV4Checksum((uint16_t *)p->ip4h,
- IPV4_GET_HLEN(p),
- p->ip4h->ip_csum);
+ if (p->l3.comp_csum == -1) {
+ const IPV4Hdr *ip4h = PacketGetIPv4(p);
+ p->l3.comp_csum = IPV4Checksum((uint16_t *)ip4h, IPV4_GET_RAW_HLEN(ip4h), ip4h->ip_csum);
+ }
- if (p->level3_comp_csum == 0 && cd->valid == 1)
+ if (p->l3.comp_csum == 0 && cd->valid == 1)
return 1;
- else if (p->level3_comp_csum != 0 && cd->valid == 0)
+ else if (p->l3.comp_csum != 0 && cd->valid == 0)
return 1;
else
return 0;
{
const DetectCsumData *cd = (const DetectCsumData *)ctx;
- if (p->ip4h == NULL || p->tcph == NULL || p->proto != IPPROTO_TCP || PKT_IS_PSEUDOPKT(p))
+ if (!PacketIsIPv4(p) || p->tcph == NULL || p->proto != IPPROTO_TCP || PKT_IS_PSEUDOPKT(p))
return 0;
if (p->flags & PKT_IGNORE_CHECKSUM) {
return cd->valid;
}
- if (p->level4_comp_csum == -1)
- p->level4_comp_csum = TCPChecksum(p->ip4h->s_ip_addrs,
- (uint16_t *)p->tcph,
- (p->payload_len +
- TCP_GET_HLEN(p)),
- p->tcph->th_sum);
-
+ if (p->level4_comp_csum == -1) {
+ const IPV4Hdr *ip4h = PacketGetIPv4(p);
+ p->level4_comp_csum = TCPChecksum(ip4h->s_ip_addrs, (uint16_t *)p->tcph,
+ (p->payload_len + TCP_GET_HLEN(p)), p->tcph->th_sum);
+ }
if (p->level4_comp_csum == 0 && cd->valid == 1)
return 1;
else if (p->level4_comp_csum != 0 && cd->valid == 0)
{
const DetectCsumData *cd = (const DetectCsumData *)ctx;
- if (p->ip4h == NULL || p->udph == NULL || p->proto != IPPROTO_UDP || PKT_IS_PSEUDOPKT(p) || p->udph->uh_sum == 0)
+ if (!PacketIsIPv4(p) || p->udph == NULL || p->proto != IPPROTO_UDP || PKT_IS_PSEUDOPKT(p) ||
+ p->udph->uh_sum == 0)
return 0;
if (p->flags & PKT_IGNORE_CHECKSUM) {
return cd->valid;
}
- if (p->level4_comp_csum == -1)
- p->level4_comp_csum = UDPV4Checksum(p->ip4h->s_ip_addrs,
- (uint16_t *)p->udph,
- (p->payload_len +
- UDP_HEADER_LEN),
- p->udph->uh_sum);
-
+ if (p->level4_comp_csum == -1) {
+ const IPV4Hdr *ip4h = PacketGetIPv4(p);
+ p->level4_comp_csum = UDPV4Checksum(ip4h->s_ip_addrs, (uint16_t *)p->udph,
+ (p->payload_len + UDP_HEADER_LEN), p->udph->uh_sum);
+ }
if (p->level4_comp_csum == 0 && cd->valid == 1)
return 1;
else if (p->level4_comp_csum != 0 && cd->valid == 0)
{
const DetectCsumData *cd = (const DetectCsumData *)ctx;
- if (p->ip4h == NULL || p->icmpv4h == NULL || p->proto != IPPROTO_ICMP || PKT_IS_PSEUDOPKT(p))
+ if (!PacketIsIPv4(p) || p->icmpv4h == NULL || p->proto != IPPROTO_ICMP || PKT_IS_PSEUDOPKT(p))
return 0;
if (p->flags & PKT_IGNORE_CHECKSUM) {
return cd->valid;
}
- if (p->level4_comp_csum == -1)
- p->level4_comp_csum = ICMPV4CalculateChecksum((uint16_t *)p->icmpv4h,
- SCNtohs(IPV4_GET_RAW_IPLEN(p->ip4h)) -
- IPV4_GET_RAW_HLEN(p->ip4h) * 4);
-
+ if (p->level4_comp_csum == -1) {
+ const IPV4Hdr *ip4h = PacketGetIPv4(p);
+ p->level4_comp_csum = ICMPV4CalculateChecksum(
+ (uint16_t *)p->icmpv4h, IPV4_GET_RAW_IPLEN(ip4h) - IPV4_GET_RAW_HLEN(ip4h));
+ }
if (p->level4_comp_csum == p->icmpv4h->checksum && cd->valid == 1)
return 1;
else if (p->level4_comp_csum != p->icmpv4h->checksum && cd->valid == 0)
uint8_t fragbits = 0;
const DetectFragBitsData *de = (const DetectFragBitsData *)ctx;
- if(IPV4_GET_MF(p))
+ const IPV4Hdr *ip4h = PacketGetIPv4(p);
+ if (IPV4_GET_RAW_FLAG_MF(ip4h))
fragbits |= FRAGBITS_HAVE_MF;
- if(IPV4_GET_DF(p))
+ if (IPV4_GET_RAW_FLAG_DF(ip4h))
fragbits |= FRAGBITS_HAVE_DF;
- if(IPV4_GET_RF(p))
+ if (IPV4_GET_RAW_FLAG_RF(ip4h))
fragbits |= FRAGBITS_HAVE_RF;
return FragBitsMatch(fragbits, de->modifier, de->fragbits);
return;
uint8_t fragbits = 0;
- if (IPV4_GET_MF(p))
+ const IPV4Hdr *ip4h = PacketGetIPv4(p);
+ if (IPV4_GET_RAW_FLAG_MF(ip4h))
fragbits |= FRAGBITS_HAVE_MF;
- if (IPV4_GET_DF(p))
+ if (IPV4_GET_RAW_FLAG_DF(ip4h))
fragbits |= FRAGBITS_HAVE_DF;
- if (IPV4_GET_RF(p))
+ if (IPV4_GET_RAW_FLAG_RF(ip4h))
fragbits |= FRAGBITS_HAVE_RF;
if (FragBitsMatch(fragbits, ctx->v1.u8[0], ctx->v1.u8[1]))
return 0;
if (PacketIsIPv4(p)) {
- frag = IPV4_GET_IPOFFSET(p);
+ const IPV4Hdr *ip4h = PacketGetIPv4(p);
+ frag = IPV4_GET_RAW_FRAGOFFSET(ip4h);
} else if (PacketIsIPv6(p)) {
if (IPV6_EXTHDR_ISSET_FH(p)) {
frag = IPV6_EXTHDR_GET_FH_OFFSET(p);
uint16_t frag;
if (PacketIsIPv4(p)) {
- frag = IPV4_GET_IPOFFSET(p);
+ const IPV4Hdr *ip4h = PacketGetIPv4(p);
+ frag = IPV4_GET_RAW_FRAGOFFSET(ip4h);
} else if (PacketIsIPv6(p)) {
if (IPV6_EXTHDR_ISSET_FH(p)) {
frag = IPV6_EXTHDR_GET_FH_OFFSET(p);
ip4h.s_ip_src.s_addr = p->src.addr_data32[0];
ip4h.s_ip_dst.s_addr = p->dst.addr_data32[0];
ip4h.ip_off = 0x2222;
- p->ip4h = &ip4h;
+ UTHSetIPV4Hdr(p, &ip4h);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
FAIL_IF_NULL(de_ctx);
ip4h.s_ip_src.s_addr = p->src.addr_data32[0];
ip4h.s_ip_dst.s_addr = p->dst.addr_data32[0];
- p->ip4h = &ip4h;
+ UTHSetIPV4Hdr(p, &ip4h);
DecodeICMPV4(&th_v, &dtv, p, raw_icmpv4, sizeof(raw_icmpv4));
return 0;
}
- if (id_d->id == IPV4_GET_IPID(p)) {
+ const IPV4Hdr *ip4h = PacketGetIPv4(p);
+ if (id_d->id == IPV4_GET_RAW_IPID(ip4h)) {
SCLogDebug("IPV4 Proto and matched with ip_id: %u.\n",
id_d->id);
return 1;
if (!PrefilterPacketHeaderExtraMatch(ctx, p))
return;
- if (IPV4_GET_IPID(p) == ctx->v1.u16[0])
- {
+ const IPV4Hdr *ip4h = PacketGetIPv4(p);
+ if (ctx->v1.u16[0] == IPV4_GET_RAW_IPID(ip4h)) {
SCLogDebug("packet matches IP id %u", ctx->v1.u16[0]);
PrefilterAddSids(&det_ctx->pmq, ctx->sigs_array, ctx->sigs_cnt);
}
FAIL_IF_NULL(p[2]);
/* TCP IP id = 1234 */
- p[0]->ip4h->ip_id = htons(1234);
+ p[0]->l3.hdrs.ip4h->ip_id = htons(1234);
/* UDP IP id = 5678 */
- p[1]->ip4h->ip_id = htons(5678);
+ p[1]->l3.hdrs.ip4h->ip_id = htons(5678);
/* UDP IP id = 91011 */
- p[2]->ip4h->ip_id = htons(5101);
+ p[2]->l3.hdrs.ip4h->ip_id = htons(5101);
const char *sigs[3];
sigs[0]= "alert ip any any -> any any (msg:\"Testing id 1\"; id:1234; sid:1;)";
#include "detect-ipopts.h"
#include "util-unittest.h"
+#include "util-unittest-helper.h"
static int DetectIpOptsMatch (DetectEngineThreadCtx *, Packet *,
const Signature *, const SigMatchCtx *);
if (!de || !PacketIsIPv4(p) || PKT_IS_PSEUDOPKT(p))
return 0;
- return (p->ip4vars.opts_set & de->ipopt) == de->ipopt;
+ return (p->l3.vars.ip4.opts_set & de->ipopt) == de->ipopt;
}
/**
memset(&tv, 0, sizeof(ThreadVars));
memset(&ip4h, 0, sizeof(IPV4Hdr));
- p->ip4h = &ip4h;
- p->ip4vars.opts_set = IPV4_OPT_FLAG_RR;
+ UTHSetIPV4Hdr(p, &ip4h);
+ p->l3.vars.ip4.opts_set = IPV4_OPT_FLAG_RR;
DetectIpOptsData *de = DetectIpOptsParse("rr");
FAIL_IF_NULL(de);
memset(&tv, 0, sizeof(ThreadVars));
memset(&ip4h, 0, sizeof(IPV4Hdr));
- p->ip4h = &ip4h;
- p->ip4vars.opts_set = IPV4_OPT_FLAG_RR;
+ UTHSetIPV4Hdr(p, &ip4h);
+ p->l3.vars.ip4.opts_set = IPV4_OPT_FLAG_RR;
DetectIpOptsData *de = DetectIpOptsParse("lsrr");
FAIL_IF_NULL(de);
InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
if (buffer->inspect == NULL) {
- if (p->ip4h == NULL) {
+ if (!PacketIsIPv4(p)) {
// DETECT_PROTO_IPV4 does not prefilter
return NULL;
}
- uint32_t hlen = IPV4_GET_HLEN(p);
- if (((uint8_t *)p->ip4h + (ptrdiff_t)hlen) >
- ((uint8_t *)GET_PKT_DATA(p) + (ptrdiff_t)GET_PKT_LEN(p)))
- {
- SCLogDebug("data out of range: %p > %p",
- ((uint8_t *)p->ip4h + (ptrdiff_t)hlen),
+ const IPV4Hdr *ip4h = PacketGetIPv4(p);
+ uint32_t hlen = IPV4_GET_RAW_HLEN(ip4h);
+ if (((uint8_t *)ip4h + (ptrdiff_t)hlen) >
+ ((uint8_t *)GET_PKT_DATA(p) + (ptrdiff_t)GET_PKT_LEN(p))) {
+ SCLogDebug("data out of range: %p > %p", ((uint8_t *)ip4h + (ptrdiff_t)hlen),
((uint8_t *)GET_PKT_DATA(p) + (ptrdiff_t)GET_PKT_LEN(p)));
return NULL;
}
const uint32_t data_len = hlen;
- const uint8_t *data = (const uint8_t *)p->ip4h;
+ const uint8_t *data = (const uint8_t *)ip4h;
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
InspectionBufferApplyTransforms(buffer, transforms);
p->src.family = AF_INET;
p->dst.family = AF_INET;
p->proto = IPPROTO_TCP;
- p->ip4h = &ip4h;
+ UTHSetIPV4Hdr(p, &ip4h);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
FAIL_IF_NULL(de_ctx);
#include "suricata-common.h"
#include "stream-tcp.h"
#include "util-unittest.h"
+#include "util-unittest-helper.h"
#include "detect.h"
#include "detect-parse.h"
ssn.client = client;
f.protoctx = &ssn;
p->flow = &f;
- p->ip4h = &ip4h;
+ UTHSetIPV4Hdr(p, &ip4h);
sm.ctx = (SigMatchCtx*)sd;
if (!DetectStreamSizeMatch(&dtx, p, &s, sm.ctx))
#include "detect-tcp-flags.h"
#include "util-unittest.h"
+#include "util-unittest-helper.h"
#include "util-debug.h"
memset(&ipv4h, 0, sizeof(IPV4Hdr));
memset(&tcph, 0, sizeof(TCPHdr));
- p->ip4h = &ipv4h;
+ UTHSetIPV4Hdr(p, &ipv4h);
p->tcph = &tcph;
p->tcph->th_flags = TH_ACK|TH_PUSH|TH_SYN|TH_RST;
memset(&ipv4h, 0, sizeof(IPV4Hdr));
memset(&tcph, 0, sizeof(TCPHdr));
- p->ip4h = &ipv4h;
+ UTHSetIPV4Hdr(p, &ipv4h);
p->tcph = &tcph;
p->tcph->th_flags = TH_SYN;
memset(&ipv4h, 0, sizeof(IPV4Hdr));
memset(&tcph, 0, sizeof(TCPHdr));
- p->ip4h = &ipv4h;
+ UTHSetIPV4Hdr(p, &ipv4h);
p->tcph = &tcph;
p->tcph->th_flags = TH_ACK|TH_PUSH|TH_SYN|TH_RST;
memset(&ipv4h, 0, sizeof(IPV4Hdr));
memset(&tcph, 0, sizeof(TCPHdr));
- p->ip4h = &ipv4h;
+ UTHSetIPV4Hdr(p, &ipv4h);
p->tcph = &tcph;
p->tcph->th_flags = TH_ACK|TH_PUSH|TH_SYN|TH_RST;
memset(&ipv4h, 0, sizeof(IPV4Hdr));
memset(&tcph, 0, sizeof(TCPHdr));
- p->ip4h = &ipv4h;
+ UTHSetIPV4Hdr(p, &ipv4h);
p->tcph = &tcph;
p->tcph->th_flags = TH_SYN|TH_RST;
memset(&ipv4h, 0, sizeof(IPV4Hdr));
memset(&tcph, 0, sizeof(TCPHdr));
- p->ip4h = &ipv4h;
+ UTHSetIPV4Hdr(p, &ipv4h);
p->tcph = &tcph;
p->tcph->th_flags = TH_SYN|TH_RST;
memset(&ipv4h, 0, sizeof(IPV4Hdr));
memset(&tcph, 0, sizeof(TCPHdr));
- p->ip4h = &ipv4h;
+ UTHSetIPV4Hdr(p, &ipv4h);
p->tcph = &tcph;
p->tcph->th_flags = TH_SYN|TH_RST;
memset(&ipv4h, 0, sizeof(IPV4Hdr));
memset(&tcph, 0, sizeof(TCPHdr));
- p->ip4h = &ipv4h;
+ UTHSetIPV4Hdr(p, &ipv4h);
p->tcph = &tcph;
p->tcph->th_flags = TH_SYN|TH_RST;
memset(&ipv4h, 0, sizeof(IPV4Hdr));
memset(&tcph, 0, sizeof(TCPHdr));
- p->ip4h = &ipv4h;
+ UTHSetIPV4Hdr(p, &ipv4h);
p->tcph = &tcph;
p->tcph->th_flags = TH_SYN|TH_RST|TH_URG;
memset(&ipv4h, 0, sizeof(IPV4Hdr));
memset(&tcph, 0, sizeof(TCPHdr));
- p->ip4h = &ipv4h;
+ UTHSetIPV4Hdr(p, &ipv4h);
p->tcph = &tcph;
p->tcph->th_flags = TH_SYN;
memset(&ipv4h, 0, sizeof(IPV4Hdr));
memset(&tcph, 0, sizeof(TCPHdr));
- p->ip4h = &ipv4h;
+ UTHSetIPV4Hdr(p, &ipv4h);
p->tcph = &tcph;
p->tcph->th_flags = TH_ECN | TH_CWR | TH_SYN | TH_RST;
memset(&ipv4h, 0, sizeof(IPV4Hdr));
memset(&tcph, 0, sizeof(TCPHdr));
- p->ip4h = &ipv4h;
+ UTHSetIPV4Hdr(p, &ipv4h);
p->tcph = &tcph;
p->tcph->th_flags = TH_ECN | TH_SYN | TH_RST;
memset(&ipv4h, 0, sizeof(IPV4Hdr));
memset(&tcph, 0, sizeof(TCPHdr));
- p->ip4h = &ipv4h;
+ UTHSetIPV4Hdr(p, &ipv4h);
p->tcph = &tcph;
p->tcph->th_flags = TH_ECN | TH_SYN | TH_RST;
/* TODO replace this */
uint8_t ptemplate2;
if (PacketIsIPv4(p)) {
- ptemplate2 = IPV4_GET_IPTTL(p);
+ const IPV4Hdr *ip4h = PacketGetIPv4(p);
+ ptemplate2 = IPV4_GET_RAW_IPTTL(ip4h);
} else if (PacketIsIPv6(p)) {
ptemplate2 = IPV6_GET_HLIM(p);
} else {
uint8_t ptemplate2;
/* TODO update */
if (PacketIsIPv4(p)) {
- ptemplate2 = IPV4_GET_IPTTL(p);
+ const IPV4Hdr *ip4h = PacketGetIPv4(p);
+ ptemplate2 = IPV4_GET_RAW_IPTTL(ip4h);
} else if (PacketIsIPv6(p)) {
ptemplate2 = IPV6_GET_HLIM(p);
} else {
return 0;
}
- if (tosd->tos == IPV4_GET_IPTOS(p)) {
- SCLogDebug("tos match found for %d\n", tosd->tos);
+ const IPV4Hdr *ip4h = PacketGetIPv4(p);
+ if (tosd->tos == IPV4_GET_RAW_IPTOS(ip4h)) {
+ SCLogDebug("tos match found for %d", tosd->tos);
result = 1;
}
if (p == NULL)
goto end;
- IPV4_SET_RAW_IPTOS(p->ip4h, 10);
+ p->l3.hdrs.ip4h->ip_tos = 10;
const char *sigs[4];
sigs[0]= "alert ip any any -> any any (msg:\"Testing id 1\"; tos: 10 ; sid:1;)";
uint8_t pttl;
if (PacketIsIPv4(p)) {
- pttl = IPV4_GET_IPTTL(p);
+ const IPV4Hdr *ip4h = PacketGetIPv4(p);
+ pttl = IPV4_GET_RAW_IPTTL(ip4h);
} else if (PacketIsIPv6(p)) {
pttl = IPV6_GET_HLIM(p);
} else {
uint8_t pttl;
if (PacketIsIPv4(p)) {
- pttl = IPV4_GET_IPTTL(p);
+ const IPV4Hdr *ip4h = PacketGetIPv4(p);
+ pttl = IPV4_GET_RAW_IPTTL(ip4h);
} else if (PacketIsIPv6(p)) {
pttl = IPV6_GET_HLIM(p);
} else {
}
}
/* set the ip header */
- p->ip4h = (IPV4Hdr *)GET_PKT_DATA(p);
+ IPV4Hdr *ip4h = PacketSetIPV4(p, GET_PKT_DATA(p));
/* version 4 and length 20 bytes for the tcp header */
- p->ip4h->ip_verhl = 0x45;
- p->ip4h->ip_tos = 0;
- p->ip4h->ip_len = htons(40);
- p->ip4h->ip_id = 0;
- p->ip4h->ip_off = 0;
- p->ip4h->ip_ttl = 64;
- p->ip4h->ip_proto = IPPROTO_TCP;
+ ip4h->ip_verhl = 0x45;
+ ip4h->ip_tos = 0;
+ ip4h->ip_len = htons(40);
+ ip4h->ip_id = 0;
+ ip4h->ip_off = 0;
+ ip4h->ip_ttl = 64;
+ ip4h->ip_proto = IPPROTO_TCP;
//p->ip4h->ip_csum =
if (direction == 0) {
- p->ip4h->s_ip_src.s_addr = f->src.addr_data32[0];
- p->ip4h->s_ip_dst.s_addr = f->dst.addr_data32[0];
+ ip4h->s_ip_src.s_addr = f->src.addr_data32[0];
+ ip4h->s_ip_dst.s_addr = f->dst.addr_data32[0];
} else {
- p->ip4h->s_ip_src.s_addr = f->dst.addr_data32[0];
- p->ip4h->s_ip_dst.s_addr = f->src.addr_data32[0];
+ ip4h->s_ip_src.s_addr = f->dst.addr_data32[0];
+ ip4h->s_ip_dst.s_addr = f->src.addr_data32[0];
}
/* set the tcp header */
}
if (FLOW_IS_IPV4(f)) {
- p->tcph->th_sum = TCPChecksum(p->ip4h->s_ip_addrs,
- (uint16_t *)p->tcph, 20, 0);
+ IPV4Hdr *ip4h = p->l3.hdrs.ip4h;
+ p->tcph->th_sum = TCPChecksum(ip4h->s_ip_addrs, (uint16_t *)p->tcph, 20, 0);
/* calc ipv4 csum as we may log it and barnyard might reject
* a wrong checksum */
- p->ip4h->ip_csum = IPV4Checksum((uint16_t *)p->ip4h,
- IPV4_GET_RAW_HLEN(p->ip4h), 0);
+ ip4h->ip_csum = IPV4Checksum((uint16_t *)ip4h, IPV4_GET_RAW_HLEN(ip4h), 0);
} else if (FLOW_IS_IPV6(f)) {
p->tcph->th_sum = TCPChecksum(p->ip6h->s_ip6_addrs,
(uint16_t *)p->tcph, 20, 0);
f->livedev = p->livedev;
if (PacketIsIPv4(p)) {
- FLOW_SET_IPV4_SRC_ADDR_FROM_PACKET(p, &f->src);
- FLOW_SET_IPV4_DST_ADDR_FROM_PACKET(p, &f->dst);
- f->min_ttl_toserver = f->max_ttl_toserver = IPV4_GET_IPTTL((p));
+ const IPV4Hdr *ip4h = PacketGetIPv4(p);
+ FLOW_SET_IPV4_SRC_ADDR_FROM_PACKET(ip4h, &f->src);
+ FLOW_SET_IPV4_DST_ADDR_FROM_PACKET(ip4h, &f->dst);
+ f->min_ttl_toserver = f->max_ttl_toserver = IPV4_GET_RAW_IPTTL(ip4h);
f->flags |= FLOW_IPV4;
} else if (PacketIsIPv6(p)) {
FLOW_SET_IPV6_SRC_ADDR_FROM_PACKET(p, &f->src);
FlowUpdateEthernet(tv, dtv, f, p->ethh, true);
/* update flow's ttl fields if needed */
if (PacketIsIPv4(p)) {
- FlowUpdateTtlTS(f, p, IPV4_GET_IPTTL(p));
+ const IPV4Hdr *ip4h = PacketGetIPv4(p);
+ FlowUpdateTtlTS(f, p, IPV4_GET_RAW_IPTTL(ip4h));
} else if (PacketIsIPv6(p)) {
FlowUpdateTtlTS(f, p, IPV6_GET_HLIM(p));
}
FlowUpdateEthernet(tv, dtv, f, p->ethh, false);
/* update flow's ttl fields if needed */
if (PacketIsIPv4(p)) {
- FlowUpdateTtlTC(f, p, IPV4_GET_IPTTL(p));
+ const IPV4Hdr *ip4h = PacketGetIPv4(p);
+ FlowUpdateTtlTC(f, p, IPV4_GET_RAW_IPTTL(ip4h));
} else if (PacketIsIPv6(p)) {
FlowUpdateTtlTC(f, p, IPV6_GET_HLIM(p));
}
*
* We set the rest of the struct to 0 so we can
* prevent using memset. */
-#define FLOW_SET_IPV4_SRC_ADDR_FROM_PACKET(p, a) do { \
- (a)->addr_data32[0] = (uint32_t)(p)->ip4h->s_ip_src.s_addr; \
- (a)->addr_data32[1] = 0; \
- (a)->addr_data32[2] = 0; \
- (a)->addr_data32[3] = 0; \
+#define FLOW_SET_IPV4_SRC_ADDR_FROM_PACKET(ip4h, a) \
+ do { \
+ (a)->addr_data32[0] = (uint32_t)(ip4h)->s_ip_src.s_addr; \
+ (a)->addr_data32[1] = 0; \
+ (a)->addr_data32[2] = 0; \
+ (a)->addr_data32[3] = 0; \
} while (0)
-#define FLOW_SET_IPV4_DST_ADDR_FROM_PACKET(p, a) do { \
- (a)->addr_data32[0] = (uint32_t)(p)->ip4h->s_ip_dst.s_addr; \
- (a)->addr_data32[1] = 0; \
- (a)->addr_data32[2] = 0; \
- (a)->addr_data32[3] = 0; \
+#define FLOW_SET_IPV4_DST_ADDR_FROM_PACKET(ip4h, a) \
+ do { \
+ (a)->addr_data32[0] = (uint32_t)(ip4h)->s_ip_dst.s_addr; \
+ (a)->addr_data32[1] = 0; \
+ (a)->addr_data32[2] = 0; \
+ (a)->addr_data32[3] = 0; \
} while (0)
/* Set the IPv6 addressesinto the Addrs of the Packet.
jb_open_object(js, "packet");
if (PacketIsIPv4(p)) {
- jb_set_uint(js, "len", IPV4_GET_IPLEN(p));
- jb_set_uint(js, "tos", IPV4_GET_IPTOS(p));
- jb_set_uint(js, "ttl", IPV4_GET_IPTTL(p));
- jb_set_uint(js, "ipid", IPV4_GET_IPID(p));
+ const IPV4Hdr *ip4h = PacketGetIPv4(p);
+ jb_set_uint(js, "len", IPV4_GET_RAW_IPLEN(ip4h));
+ jb_set_uint(js, "tos", IPV4_GET_RAW_IPTOS(ip4h));
+ jb_set_uint(js, "ttl", IPV4_GET_RAW_IPTTL(ip4h));
+ jb_set_uint(js, "ipid", IPV4_GET_RAW_IPID(ip4h));
} else if (PacketIsIPv6(p)) {
jb_set_uint(js, "len", IPV6_GET_PLEN(p));
jb_set_uint(js, "tc", IPV6_GET_CLASS(p));
uint16_t proto = 0;
if (PacketIsIPv4(p)) {
- jb_set_uint(js, "len", IPV4_GET_IPLEN(p));
- jb_set_uint(js, "tos", IPV4_GET_IPTOS(p));
- jb_set_uint(js, "ttl", IPV4_GET_IPTTL(p));
- jb_set_uint(js, "ipid", IPV4_GET_IPID(p));
- proto = IPV4_GET_IPPROTO(p);
+ const IPV4Hdr *ip4h = PacketGetIPv4(p);
+ jb_set_uint(js, "len", IPV4_GET_RAW_IPLEN(ip4h));
+ jb_set_uint(js, "tos", IPV4_GET_RAW_IPTOS(ip4h));
+ jb_set_uint(js, "ttl", IPV4_GET_RAW_IPTTL(ip4h));
+ jb_set_uint(js, "ipid", IPV4_GET_RAW_IPID(ip4h));
+ proto = IPV4_GET_RAW_IPPROTO(ip4h);
} else if (PacketIsIPv6(p)) {
jb_set_uint(js, "len", IPV6_GET_PLEN(p));
jb_set_uint(js, "tc", IPV6_GET_CLASS(p));
SCSpinInit(&p->persistent.tunnel_lock, 0);
p->alerts.alerts = PacketAlertCreate();
PACKET_RESET_CHECKSUMS(p);
+ p->l3.comp_csum = -1;
p->livedev = NULL;
}
p->pktvar = NULL;
}
p->ethh = NULL;
- if (p->ip4h != NULL) {
- CLEAR_IPV4_PACKET(p);
- }
- if (p->ip6h != NULL) {
- CLEAR_IPV6_PACKET(p);
- }
+ PacketClearL3(p);
+ p->l3.comp_csum = -1;
if (p->tcph != NULL) {
CLEAR_TCP_PACKET(p);
}
int RejectSendLibnet11IPv4ICMP(ThreadVars *tv, Packet *p, void *data, enum RejectDirection dir)
{
+ const IPV4Hdr *ip4h = PacketGetIPv4(p);
Libnet11Packet lpacket;
int result;
lpacket.id = 0;
lpacket.flow = 0;
lpacket.class = 0;
- const uint16_t iplen = IPV4_GET_IPLEN(p);
+ const uint16_t iplen = IPV4_GET_RAW_IPLEN(ip4h);
if (g_reject_dev_mtu >= ETHERNET_HEADER_LEN + LIBNET_IPV4_H + 8) {
lpacket.len = MIN(g_reject_dev_mtu - ETHERNET_HEADER_LEN, (LIBNET_IPV4_H + iplen));
} else {
lpacket.ttl = 64;
/* build the package */
- if ((libnet_build_icmpv4_unreach(
- ICMP_DEST_UNREACH, /* type */
- ICMP_HOST_ANO, /* code */
- 0, /* checksum */
- (uint8_t *)p->ip4h, /* payload */
- lpacket.dsize, /* payload length */
- c, /* libnet context */
- 0)) < 0) /* libnet ptag */
+ if ((libnet_build_icmpv4_unreach(ICMP_DEST_UNREACH, /* type */
+ ICMP_HOST_ANO, /* code */
+ 0, /* checksum */
+ (uint8_t *)ip4h, /* payload */
+ lpacket.dsize, /* payload length */
+ c, /* libnet context */
+ 0)) < 0) /* libnet ptag */
{
SCLogError("libnet_build_icmpv4_unreach %s", libnet_geterror(c));
goto cleanup;
if ((ol_flags & RTE_MBUF_F_RX_IP_CKSUM_MASK) == RTE_MBUF_F_RX_IP_CKSUM_BAD) {
SCLogDebug("HW detected BAD IP checksum");
// chsum recalc will not be triggered but rule keyword check will be
- p->level3_comp_csum = 0;
+ p->l3.comp_csum = 0;
}
if ((ol_flags & RTE_MBUF_F_RX_L4_CKSUM_MASK) == RTE_MBUF_F_RX_L4_CKSUM_BAD) {
SCLogDebug("HW detected BAD L4 chsum");
if (p->level4_comp_csum == -1) {
if (PacketIsIPv4(p)) {
- p->level4_comp_csum = TCPChecksum(p->ip4h->s_ip_addrs,
- (uint16_t *)p->tcph,
- (p->payload_len +
- TCP_GET_HLEN(p)),
- p->tcph->th_sum);
+ const IPV4Hdr *ip4h = PacketGetIPv4(p);
+ p->level4_comp_csum = TCPChecksum(ip4h->s_ip_addrs, (uint16_t *)p->tcph,
+ (p->payload_len + TCP_GET_HLEN(p)), p->tcph->th_sum);
} else if (PacketIsIPv6(p)) {
p->level4_comp_csum = TCPV6Checksum(p->ip6h->s_ip6_addrs,
(uint16_t *)p->tcph,
}
}
/* set the ip header */
- np->ip4h = (IPV4Hdr *)GET_PKT_DATA(np);
+ IPV4Hdr *ip4h = PacketSetIPV4(np, GET_PKT_DATA(np));
/* version 4 and length 20 bytes for the tcp header */
- np->ip4h->ip_verhl = 0x45;
- np->ip4h->ip_tos = 0;
- np->ip4h->ip_len = htons(40);
- np->ip4h->ip_id = 0;
- np->ip4h->ip_off = 0;
- np->ip4h->ip_ttl = 64;
- np->ip4h->ip_proto = IPPROTO_TCP;
+ ip4h->ip_verhl = 0x45;
+ ip4h->ip_tos = 0;
+ ip4h->ip_len = htons(40);
+ ip4h->ip_id = 0;
+ ip4h->ip_off = 0;
+ ip4h->ip_ttl = 64;
+ ip4h->ip_proto = IPPROTO_TCP;
if (dir == 0) {
- np->ip4h->s_ip_src.s_addr = f->src.addr_data32[0];
- np->ip4h->s_ip_dst.s_addr = f->dst.addr_data32[0];
+ ip4h->s_ip_src.s_addr = f->src.addr_data32[0];
+ ip4h->s_ip_dst.s_addr = f->dst.addr_data32[0];
} else {
- np->ip4h->s_ip_src.s_addr = f->dst.addr_data32[0];
- np->ip4h->s_ip_dst.s_addr = f->src.addr_data32[0];
+ ip4h->s_ip_src.s_addr = f->dst.addr_data32[0];
+ ip4h->s_ip_dst.s_addr = f->src.addr_data32[0];
}
/* set the tcp header */
p->dst.family = AF_INET;
p->proto = IPPROTO_TCP;
ip4h.ip_ttl = 15;
- p->ip4h = &ip4h;
+ UTHSetIPV4Hdr(p, &ip4h);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
FAIL_IF_NULL(de_ctx);
PACKET_RESET_CHECKSUMS(p1);
PACKET_RESET_CHECKSUMS(p2);
- p1->ip4h = (IPV4Hdr *)valid_raw_ipv4;
-
+ PacketSetIPV4(p1, valid_raw_ipv4);
p1->src.family = AF_INET;
p1->dst.family = AF_INET;
p1->payload = buf;
p1->payload_len = buflen;
p1->proto = IPPROTO_TCP;
- p2->ip4h = (IPV4Hdr *)invalid_raw_ipv4;
-
+ PacketSetIPV4(p2, invalid_raw_ipv4);
p2->src.family = AF_INET;
p2->dst.family = AF_INET;
p2->payload = buf;
PACKET_RESET_CHECKSUMS(p1);
PACKET_RESET_CHECKSUMS(p2);
- p1->ip4h = (IPV4Hdr *)valid_raw_ipv4;
-
+ PacketSetIPV4(p1, valid_raw_ipv4);
p1->src.family = AF_INET;
p1->dst.family = AF_INET;
p1->payload = buf;
p1->payload_len = buflen;
p1->proto = IPPROTO_TCP;
- p2->ip4h = (IPV4Hdr *)invalid_raw_ipv4;
-
+ PacketSetIPV4(p2, invalid_raw_ipv4);
p2->src.family = AF_INET;
p2->dst.family = AF_INET;
p2->payload = buf;
PacketCopyDataOffset(p2, GET_PKT_LEN(p2), invalid_raw_tcp, sizeof(invalid_raw_tcp));
PACKET_RESET_CHECKSUMS(p1);
- p1->ip4h = (IPV4Hdr *)GET_PKT_DATA(p1);
+ PacketSetIPV4(p1, GET_PKT_DATA(p1));
p1->tcph = (TCPHdr *)(GET_PKT_DATA(p1) + sizeof(raw_ipv4));
p1->src.family = AF_INET;
p1->dst.family = AF_INET;
p1->proto = IPPROTO_TCP;
PACKET_RESET_CHECKSUMS(p2);
- p2->ip4h = (IPV4Hdr *)GET_PKT_DATA(p2);
+ PacketSetIPV4(p2, GET_PKT_DATA(p2));
p2->tcph = (TCPHdr *)(GET_PKT_DATA(p2) + sizeof(raw_ipv4));
p2->src.family = AF_INET;
p2->dst.family = AF_INET;
PacketCopyDataOffset(p2, GET_PKT_LEN(p2), invalid_raw_tcp, sizeof(invalid_raw_tcp));
PACKET_RESET_CHECKSUMS(p1);
- p1->ip4h = (IPV4Hdr *)GET_PKT_DATA(p1);
+ PacketSetIPV4(p1, GET_PKT_DATA(p1));
p1->tcph = (TCPHdr *)(GET_PKT_DATA(p1) + sizeof(raw_ipv4));
p1->src.family = AF_INET;
p1->dst.family = AF_INET;
p1->proto = IPPROTO_TCP;
PACKET_RESET_CHECKSUMS(p2);
- p2->ip4h = (IPV4Hdr *)GET_PKT_DATA(p2);
+ PacketSetIPV4(p2, GET_PKT_DATA(p2));
p2->tcph = (TCPHdr *)(GET_PKT_DATA(p2) + sizeof(raw_ipv4));
p2->src.family = AF_INET;
p2->dst.family = AF_INET;
PacketCopyDataOffset(p2, GET_PKT_LEN(p2), invalid_raw_tcp, sizeof(invalid_raw_tcp));
PACKET_RESET_CHECKSUMS(p1);
- p1->ip4h = (IPV4Hdr *)GET_PKT_DATA(p1);
+ PacketSetIPV4(p1, GET_PKT_DATA(p1));
p1->tcph = (TCPHdr *)(GET_PKT_DATA(p1) + sizeof(raw_ipv4));
p1->src.family = AF_INET;
p1->dst.family = AF_INET;
p1->proto = IPPROTO_TCP;
PACKET_RESET_CHECKSUMS(p2);
- p2->ip4h = (IPV4Hdr *)GET_PKT_DATA(p2);
+ PacketSetIPV4(p2, GET_PKT_DATA(p2));
p2->tcph = (TCPHdr *)(GET_PKT_DATA(p2) + sizeof(raw_ipv4));
p2->src.family = AF_INET;
p2->dst.family = AF_INET;
PacketCopyDataOffset(p2, GET_PKT_LEN(p2), invalid_raw_tcp, sizeof(invalid_raw_tcp));
PACKET_RESET_CHECKSUMS(p1);
- p1->ip4h = (IPV4Hdr *)GET_PKT_DATA(p1);
+ PacketSetIPV4(p1, GET_PKT_DATA(p1));
p1->tcph = (TCPHdr *)(GET_PKT_DATA(p1) + sizeof(raw_ipv4));
p1->src.family = AF_INET;
p1->dst.family = AF_INET;
p1->proto = IPPROTO_TCP;
PACKET_RESET_CHECKSUMS(p2);
- p2->ip4h = (IPV4Hdr *)GET_PKT_DATA(p2);
+ PacketSetIPV4(p2, GET_PKT_DATA(p2));
p2->tcph = (TCPHdr *)(GET_PKT_DATA(p2) + sizeof(raw_ipv4));
p2->src.family = AF_INET;
p2->dst.family = AF_INET;
memset(&th_v, 0, sizeof(ThreadVars));
PACKET_RESET_CHECKSUMS(p1);
- p1->ip4h = (IPV4Hdr *)raw_ipv4;
+ PacketSetIPV4(p1, raw_ipv4);
p1->udph = (UDPHdr *)valid_raw_udp;
p1->src.family = AF_INET;
p1->dst.family = AF_INET;
p1->proto = IPPROTO_UDP;
PACKET_RESET_CHECKSUMS(p2);
- p2->ip4h = (IPV4Hdr *)raw_ipv4;
+ PacketSetIPV4(p2, raw_ipv4);
p2->udph = (UDPHdr *)invalid_raw_udp;
p2->src.family = AF_INET;
p2->dst.family = AF_INET;
memset(&th_v, 0, sizeof(ThreadVars));
PACKET_RESET_CHECKSUMS(p1);
- p1->ip4h = (IPV4Hdr *)raw_ipv4;
+ PacketSetIPV4(p1, raw_ipv4);
p1->udph = (UDPHdr *)valid_raw_udp;
p1->src.family = AF_INET;
p1->dst.family = AF_INET;
p1->proto = IPPROTO_UDP;
PACKET_RESET_CHECKSUMS(p2);
- p2->ip4h = (IPV4Hdr *)raw_ipv4;
+ PacketSetIPV4(p2, raw_ipv4);
p2->udph = (UDPHdr *)invalid_raw_udp;
p2->src.family = AF_INET;
p2->dst.family = AF_INET;
memset(&th_v, 0, sizeof(ThreadVars));
PACKET_RESET_CHECKSUMS(p1);
- p1->ip4h = (IPV4Hdr *)(valid_raw_ipv4);
- p1->ip4h->ip_verhl = 69;
- p1->icmpv4h = (ICMPV4Hdr *) (valid_raw_ipv4 + IPV4_GET_RAW_HLEN(p1->ip4h) * 4);
+ IPV4Hdr *ip4h = PacketSetIPV4(p1, valid_raw_ipv4);
+ ip4h->ip_verhl = 69;
+ p1->icmpv4h = (ICMPV4Hdr *)(valid_raw_ipv4 + IPV4_GET_RAW_HLEN(ip4h));
p1->src.family = AF_INET;
p1->dst.family = AF_INET;
p1->payload = buf;
p1->proto = IPPROTO_ICMP;
PACKET_RESET_CHECKSUMS(p2);
- p2->ip4h = (IPV4Hdr *)(invalid_raw_ipv4);
- p2->ip4h->ip_verhl = 69;
- p2->icmpv4h = (ICMPV4Hdr *) (invalid_raw_ipv4 + IPV4_GET_RAW_HLEN(p2->ip4h) * 4);
+ ip4h = PacketSetIPV4(p2, invalid_raw_ipv4);
+ ip4h->ip_verhl = 69;
+ p2->icmpv4h = (ICMPV4Hdr *)(invalid_raw_ipv4 + IPV4_GET_RAW_HLEN(ip4h));
p2->src.family = AF_INET;
p2->dst.family = AF_INET;
p2->payload = buf;
memset(&th_v, 0, sizeof(ThreadVars));
PACKET_RESET_CHECKSUMS(p1);
- p1->ip4h = (IPV4Hdr *)(valid_raw_ipv4);
- p1->ip4h->ip_verhl = 69;
- p1->icmpv4h = (ICMPV4Hdr *) (valid_raw_ipv4 + IPV4_GET_RAW_HLEN(p1->ip4h) * 4);
+ IPV4Hdr *ip4h = PacketSetIPV4(p1, valid_raw_ipv4);
+ ip4h->ip_verhl = 69;
+ p1->icmpv4h = (ICMPV4Hdr *)(valid_raw_ipv4 + IPV4_GET_RAW_HLEN(ip4h));
p1->src.family = AF_INET;
p1->dst.family = AF_INET;
p1->payload = buf;
p1->proto = IPPROTO_ICMP;
PACKET_RESET_CHECKSUMS(p2);
- p2->ip4h = (IPV4Hdr *)(invalid_raw_ipv4);
- p2->ip4h->ip_verhl = 69;
- p2->icmpv4h = (ICMPV4Hdr *) (invalid_raw_ipv4 + IPV4_GET_RAW_HLEN(p2->ip4h) * 4);
+ ip4h = PacketSetIPV4(p2, invalid_raw_ipv4);
+ ip4h->ip_verhl = 69;
+ p2->icmpv4h = (ICMPV4Hdr *)(invalid_raw_ipv4 + IPV4_GET_RAW_HLEN(ip4h));
p2->src.family = AF_INET;
p2->dst.family = AF_INET;
p2->payload = buf;
PACKET_RESET_CHECKSUMS(p1);
p1->ethh = (EthernetHdr *)raw_eth;
- p1->ip4h = (IPV4Hdr *)raw_ipv4;
+ PacketSetIPV4(p1, raw_ipv4);
p1->tcph = (TCPHdr *)raw_tcp;
p1->src.family = AF_INET;
p1->dst.family = AF_INET;
PACKET_RESET_CHECKSUMS(p1);
p1->ethh = (EthernetHdr *)raw_eth;
- p1->ip4h = (IPV4Hdr *)raw_ipv4;
+ PacketSetIPV4(p1, raw_ipv4);
p1->tcph = (TCPHdr *)raw_tcp;
p1->src.family = AF_INET;
p1->dst.family = AF_INET;
#include "../util-streaming-buffer.h"
#include "../util-print.h"
#include "../util-unittest.h"
+#include "../util-unittest-helper.h"
#define SET_ISN(stream, setseq) \
(stream)->isn = (setseq); \
p->tcph = &tcph;
p->dst.family = AF_INET;
p->dst.address.address_un_data32[0] = addr.s_addr;
- p->ip4h = &ipv4h;
+ UTHSetIPV4Hdr(p, &ipv4h);
StreamTcpCreateTestPacket(payload, 0x41, 3, sizeof(payload)); /*AAA*/
p->payload = payload;
p->tcph = &tcph;
p->dst.family = AF_INET;
p->dst.address.address_un_data32[0] = addr.s_addr;
- p->ip4h = &ipv4h;
+ UTHSetIPV4Hdr(p, &ipv4h);
StreamTcpCreateTestPacket(payload, 0x41, 3, sizeof(payload)); /*AAA*/
p->payload = payload;
p->tcph = &tcph;
p->dst.family = AF_INET;
p->dst.address.address_un_data32[0] = addr.s_addr;
- p->ip4h = &ipv4h;
+ UTHSetIPV4Hdr(p, &ipv4h);
StreamTcpCreateTestPacket(payload, 0x41, 3, sizeof(payload)); /*AAA*/
p->payload = payload;
p->tcph = &tcph;
p->dst.family = AF_INET;
p->dst.address.address_un_data32[0] = addr.s_addr;
- p->ip4h = &ipv4h;
+ UTHSetIPV4Hdr(p, &ipv4h);
StreamTcpCreateTestPacket(payload, 0x41, 3, sizeof(payload)); /*AAA*/
p->payload = payload;
SCHInfoAddHostOSInfo(os_policy_name, ip_addr, -1);
p->dst.family = AF_INET;
- p->ip4h = &ipv4h;
+ UTHSetIPV4Hdr(p, &ipv4h);
addr.s_addr = inet_addr("192.168.1.1");
p->dst.address.address_un_data32[0] = addr.s_addr;
StreamTcpSetOSPolicy(&stream, p);
SCHInfoAddHostOSInfo(os_policy_name, ip_addr, -1);
p->dst.family = AF_INET;
- p->ip4h = &ipv4h;
+ UTHSetIPV4Hdr(p, &ipv4h);
addr.s_addr = inet_addr("192.168.0.30");
p->dst.address.address_un_data32[0] = addr.s_addr;
StreamTcpSetOSPolicy(&stream, p);
SCHInfoAddHostOSInfo(os_policy_name, ip_addr, -1);
p->dst.family = AF_INET;
- p->ip4h = &ipv4h;
+ UTHSetIPV4Hdr(p, &ipv4h);
addr.s_addr = inet_addr("192.168.0.1");
p->dst.address.address_un_data32[0] = addr.s_addr;
StreamTcpSetOSPolicy(&stream, p);
SCHInfoAddHostOSInfo(os_policy_name, ip_addr, -1);
p->dst.family = AF_INET;
- p->ip4h = &ipv4h;
+ UTHSetIPV4Hdr(p, &ipv4h);
addr.s_addr = inet_addr("192.168.1.30");
p->dst.address.address_un_data32[0] = addr.s_addr;
StreamTcpSetOSPolicy(&stream, p);
SCHInfoAddHostOSInfo(os_policy_name, ip_addr, -1);
p->dst.family = AF_INET;
- p->ip4h = &ipv4h;
+ UTHSetIPV4Hdr(p, &ipv4h);
addr.s_addr = inet_addr("123.231.2.1");
p->dst.address.address_un_data32[0] = addr.s_addr;
StreamTcpSetOSPolicy(&stream, p);
int ReCalculateChecksum(Packet *p)
{
if (PacketIsIPv4(p)) {
+ IPV4Hdr *ip4h = p->l3.hdrs.ip4h;
if (PKT_IS_TCP(p)) {
/* TCP */
p->tcph->th_sum = 0;
- p->tcph->th_sum = TCPChecksum(p->ip4h->s_ip_addrs,
- (uint16_t *)p->tcph, (p->payload_len + TCP_GET_HLEN(p)), 0);
+ p->tcph->th_sum = TCPChecksum(
+ ip4h->s_ip_addrs, (uint16_t *)p->tcph, (p->payload_len + TCP_GET_HLEN(p)), 0);
} else if (PKT_IS_UDP(p)) {
p->udph->uh_sum = 0;
- p->udph->uh_sum = UDPV4Checksum(p->ip4h->s_ip_addrs,
- (uint16_t *)p->udph, (p->payload_len + UDP_HEADER_LEN), 0);
+ p->udph->uh_sum = UDPV4Checksum(
+ ip4h->s_ip_addrs, (uint16_t *)p->udph, (p->payload_len + UDP_HEADER_LEN), 0);
}
/* IPV4 */
- p->ip4h->ip_csum = 0;
- p->ip4h->ip_csum = IPV4Checksum((uint16_t *)p->ip4h,
- IPV4_GET_RAW_HLEN(p->ip4h), 0);
+ ip4h->ip_csum = 0;
+ ip4h->ip_csum = IPV4Checksum((uint16_t *)ip4h, IPV4_GET_RAW_HLEN(ip4h), 0);
} else if (PacketIsIPv6(p)) {
/* just TCP for IPV6 */
if (PKT_IS_TCP(p)) {
#endif
#ifdef UNITTESTS
+void UTHSetIPV4Hdr(Packet *p, IPV4Hdr *ip4h)
+{
+ PacketSetIPV4(p, (uint8_t *)ip4h);
+}
/**
* \brief return the uint32_t for a ipv4 address string
if (ipproto == IPPROTO_TCP || ipproto == IPPROTO_UDP || ipproto == IPPROTO_SCTP)
p->dp = dport;
- p->ip4h = (IPV4Hdr *)GET_PKT_DATA(p);
- if (p->ip4h == NULL)
+ IPV4Hdr *ip4h = PacketSetIPV4(p, GET_PKT_DATA(p));
+ if (ip4h == NULL)
goto error;
- p->ip4h->s_ip_src.s_addr = p->src.addr_data32[0];
- p->ip4h->s_ip_dst.s_addr = p->dst.addr_data32[0];
- p->ip4h->ip_proto = ipproto;
- p->ip4h->ip_verhl = sizeof(IPV4Hdr);
+ ip4h->s_ip_src.s_addr = p->src.addr_data32[0];
+ ip4h->s_ip_dst.s_addr = p->dst.addr_data32[0];
+ ip4h->ip_proto = ipproto;
+ ip4h->ip_verhl = sizeof(IPV4Hdr);
p->proto = ipproto;
int hdr_offset = sizeof(IPV4Hdr);
int TestHelperBufferToFile(const char *name, const uint8_t *data, size_t size);
#endif
#ifdef UNITTESTS
+void UTHSetIPV4Hdr(Packet *p, IPV4Hdr *ip4h);
+
uint32_t UTHSetIPv4Address(const char *);
Packet *UTHBuildPacketReal(uint8_t *, uint16_t, uint8_t ipproto, const char *, const char *, uint16_t, uint16_t);
projects / thirdparty / suricata.git / commitdiff
