-set (PROTOCOL_HEADERS
+add_library (protocols
+ ipv4.h
+ tcp.h
packet.h
- sf_protocols.h
+ packet.cc
+ ipv6.h
+ udp.h
+ eth.h
+ icmp4.h
+ icmp6.h
)
-add_library (protocols STATIC
- checksum.h
- decode.cc
- decode.h
- encode.cc
- encode.h
- decode_module.cc
- decode_module.h
- sf_protocols.h
- ${PROTOCOL_HEADERS}
-)
-
-install (FILES ${PROTOCOL_HEADERS}
- DESTINATION "${CMAKE_PROJECT_NAME}/protocols"
-)
-
-
--- /dev/null
+/*
+** Copyright (C) 2002-2013 Sourcefire, Inc.
+** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+
+#ifndef ETH_H
+#define ETH_H
+
+
+#define ETHERNET_HEADER_LEN 14
+#define ETHERNET_MTU 1500
+
+namespace eth
+{
+
+
+
+namespace detail
+{
+ const uint16_t HEADER_LEN = 14;
+ const uint16_t MTU_LEN = 1500;
+
+} // namespace detail
+
+struct EtherHdr
+{
+ uint8_t ether_dst[6];
+ uint8_t ether_src[6];
+ uint16_t ether_type;
+
+};
+
+inline uint16_t hdr_len()
+{
+ return detail::HEADER_LEN;
+}
+
+inline uint16_t mtu_len()
+{
+ return detail::MTU_LEN;
+}
+
+} // namespace eth
+
+
+#endif
+
--- /dev/null
+/*
+** Copyright (C) 2002-2013 Sourcefire, Inc.
+** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+
+#ifndef GTP_H
+#define GTP_H
+
+namespace gtp{
+
+namespace detail{
+
+const uint32_t GTP_ID = 0x0101;
+const uint32_t GTP_MIN_LEN = 8;
+const uint32_t GTP_V0_HEADER_LEN = 20;
+const uint32_t GTP_V1_HEADER_LEN = 12;
+
+} // namespace detail
+
+inline uint16_t gtp_id()
+{
+ return detail::GTP_ID;
+}
+
+} // namespace gtp
+
+#endif
--- /dev/null
+/*
+** Copyright (C) 2002-2013 Sourcefire, Inc.
+** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+
+#ifndef ICMP4_H
+#define ICMP4_H
+
+#include <cstdint>
+#include "snort_types.h"
+
+namespace icmp4
+{
+
+ // class to hold any data which should be hidden
+ namespace detail
+ {
+
+
+
+
+ }
+
+
+// do NOT add 'ICMP_' to the begining of these const because they
+// will overlap with dnet macros
+
+
+enum class IcmpType : std::uint8_t {
+ ECHOREPLY = 0,
+ DEST_UNREACH = 3,
+ SOURCE_QUENCH = 4,
+ REDIRECT = 5,
+ ECHO = 8,
+ ROUTER_ADVERTISE = 9,
+ ROUTER_SOLICIT = 10,
+ TIME_EXCEEDED = 11,
+ PARAMETERPROB = 12,
+ TIMESTAMP = 13,
+ TIMESTAMPREPLY = 14,
+ INFO_REQUEST = 15,
+ INFO_REPLY = 16,
+ ADDRESS = 17,
+ ADDRESSREPLY = 18,
+// NR_ICMP_TYPES = 18,
+};
+
+
+enum class IcmpCode : std::uint8_t {
+ /* Codes for ICMP UNREACHABLES (3) */
+ NET_UNREACH = 0,
+ HOST_UNREACH = 1,
+ PROT_UNREACH = 2,
+ PORT_UNREACH = 3,
+ FRAG_NEEDED = 4,
+ SR_FAILED = 5,
+ NET_UNKNOWN = 6,
+ HOST_UNKNOWN = 7,
+ HOST_ISOLATED = 8,
+ PKT_FILTERED_NET = 9,
+ PKT_FILTERED_HOST = 10,
+ NET_UNR_TOS = 11,
+ HOST_UNR_TOS = 12,
+ PKT_FILTERED = 13,
+ PREC_VIOLATION = 14,
+ PREC_CUTOFF = 15,
+
+ /* Code for ICMP Source Quence (4) */
+ SOURCE_QUENCH = 0,
+
+ /* Codes for an ICMP Redirect (5) */
+ REDIR_NET = 0,
+ REDIR_HOST = 1,
+ REDIR_TOS_NET = 2,
+ REDIR_TOS_HOST = 3,
+
+ /* Codes for ICMP Echo (8) */
+ ECHO = 0,
+
+ /* Codes for ICMP time excceeded (11) */
+ TIMEOUT_TRANSIT = 0,
+ TIMEOUT_REASSY = 1,
+
+ /* code for ICMP Parameter Problem (12) */
+ PARAM_BADIPHDR = 0,
+ PARAM_OPTMISSING = 1,
+ PARAM_BAD_LENGTH = 2,
+};
+
+struct ICMPbaseHdr
+{
+ IcmpType type;
+ IcmpCode code;
+
+};
+
+struct ICMPHdr
+{
+ IcmpType type;
+// union {
+// uint8_t type;
+// _IcmpType enum_type;
+// };
+ IcmpCode code;
+ uint16_t csum;
+
+ union
+ {
+ struct
+ {
+ uint8_t pptr;
+ uint8_t pres1;
+ uint16_t pres2;
+ } param;
+
+ struct in_addr gwaddr;
+
+ struct idseq
+ {
+ uint16_t id;
+ uint16_t seq;
+ } idseq;
+
+ uint32_t sih_void;
+
+ struct pmtu
+ {
+ uint16_t ipm_void;
+ uint16_t nextmtu;
+ } pmtu;
+
+ struct rtradv
+ {
+ uint8_t num_addrs;
+ uint8_t wpa;
+ uint16_t lifetime;
+ } rtradv;
+ } icmp_hun;
+
+#define s_icmp_pptr icmp_hun.param.pptr
+#define s_icmp_gwaddr icmp_hun.gwaddr
+#define s_icmp_id icmp_hun.idseq.id
+#define s_icmp_seq icmp_hun.idseq.seq
+#define s_icmp_void icmp_hun.sih_void
+#define s_icmp_pmvoid icmp_hun.pmtu.ipm_void
+#define s_icmp_nextmtu icmp_hun.pmtu.nextmtu
+#define s_icmp_num_addrs icmp_hun.rtradv.num_addrs
+#define s_icmp_wpa icmp_hun.rtradv.wpa
+#define s_icmp_lifetime icmp_hun.rtradv.lifetime
+
+ union
+ {
+ /* timestamp */
+ struct ts
+ {
+ uint32_t otime;
+ uint32_t rtime;
+ uint32_t ttime;
+ } ts;
+
+ /* IP header for unreach */
+ struct ih_ip
+ {
+ IPHdr *ip;
+ /* options and then 64 bits of data */
+ } ip;
+
+ struct ra_addr
+ {
+ uint32_t addr;
+ uint32_t preference;
+ } radv;
+
+ uint32_t mask;
+
+ char data[1];
+
+ } icmp_dun;
+#define s_icmp_otime icmp_dun.ts.otime
+#define s_icmp_rtime icmp_dun.ts.rtime
+#define s_icmp_ttime icmp_dun.ts.ttime
+#define s_icmp_ip icmp_dun.ih_ip
+#define s_icmp_radv icmp_dun.radv
+#define s_icmp_mask icmp_dun.mask
+#define s_icmp_data icmp_dun.data
+
+} ;
+
+
+
+
+inline bool is_echo_reply(uint32_t type)
+{
+ return (type == (uint32_t) IcmpType::ECHOREPLY);
+}
+
+inline bool is_echo(uint32_t type)
+{
+ return (type == (uint32_t) IcmpType::ECHO);
+}
+
+
+
+/*
+ * CHECKSUM
+ */
+
+/*
+* checksum icmp
+*/
+static uint16_t in_chksum_icmp( unsigned short * w, int blen )
+{
+ unsigned short answer=0;
+ unsigned int cksum = 0;
+
+ while(blen >=32)
+ {
+ cksum += w[0];
+ cksum += w[1];
+ cksum += w[2];
+ cksum += w[3];
+ cksum += w[4];
+ cksum += w[5];
+ cksum += w[6];
+ cksum += w[7];
+ cksum += w[8];
+ cksum += w[9];
+ cksum += w[10];
+ cksum += w[11];
+ cksum += w[12];
+ cksum += w[13];
+ cksum += w[14];
+ cksum += w[15];
+ w += 16;
+ blen -= 32;
+ }
+
+ while(blen >=8)
+ {
+ cksum += w[0];
+ cksum += w[1];
+ cksum += w[2];
+ cksum += w[3];
+ w += 4;
+ blen -= 8;
+ }
+
+ while(blen > 1)
+ {
+ cksum += *w++;
+ blen -= 2;
+ }
+
+ if( blen == 1 )
+ {
+ *(unsigned char*)(&answer) = (*(unsigned char*)w);
+ cksum += answer;
+ }
+
+ cksum = (cksum >> 16) + (cksum & 0x0000ffff);
+ cksum += (cksum >> 16);
+
+
+ return (unsigned short)(~cksum);
+}
+
+} //namespace icmp4
+
+
+
+typedef icmp4::ICMPbaseHdr ICMPbaseHdr;
+typedef icmp4::ICMPHdr ICMPHdr;
+
+
+#endif /* ICMP4_H */
--- /dev/null
+/*
+** Copyright (C) 2002-2013 Sourcefire, Inc.
+** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+
+#ifndef ICMP6_H
+#define ICMP6_H
+
+#include <cstdint>
+
+namespace icmp6
+{
+
+namespace detail
+{
+ const uint16_t HEADER_MIN_LEN = 4;
+ const uint16_t HEADER_NORMAL_LEN = 8;
+} // namespace detail
+
+struct ICMP6Hdr
+{
+ uint8_t type;
+ uint8_t code;
+ uint16_t csum;
+
+};
+
+struct ICMP6TooBig
+{
+ uint8_t type;
+ uint8_t code;
+ uint16_t csum;
+ uint32_t mtu;
+} ;
+
+struct ICMP6RouterAdvertisement
+{
+ uint8_t type;
+ uint8_t code;
+ uint16_t csum;
+ uint8_t num_addrs;
+ uint8_t addr_entry_size;
+ uint16_t lifetime;
+ uint32_t reachable_time;
+ uint32_t retrans_time;
+};
+
+struct ICMP6RouterSolicitation
+{
+ uint8_t type;
+ uint8_t code;
+ uint16_t csum;
+ uint32_t reserved;
+} ;
+
+struct ICMP6NodeInfo
+{
+ uint8_t type;
+ uint8_t code;
+ uint16_t csum;
+ uint16_t qtype;
+ uint16_t flags;
+ uint64_t nonce;
+} ;
+
+//
+//enum class Icmp6Types : std::uint8_t {
+enum Icmp6Types : std::uint8_t {
+ UNREACH = 1,
+ ICMP6_TYPE_BIG = 2,
+ TIME = 3,
+ PARAMS = 4,
+ ECHO = 128,
+ REPLY = 129,
+ SOLICITATION = 133,
+ ADVERTISEMENT = 134,
+ NODE_INFO_QUERY = 139,
+ NODE_INFO_RESPONSE = 140,
+};
+
+inline uint16_t hdr_min_len()
+{
+ return detail::HEADER_MIN_LEN;
+}
+
+
+inline uint16_t hdr_normal_len()
+{
+ return detail::HEADER_NORMAL_LEN;
+}
+
+} // namespace icmp6
+
+
+
+// Things that should be deleted immediately....which I bet will manage to make it into production
+
+#define ICMP6_UNREACH 1
+#define ICMP6_BIG 2
+#define ICMP6_TIME 3
+#define ICMP6_PARAMS 4
+#define ICMP6_ECHO 128
+#define ICMP6_REPLY 129
+#define ICMP6_SOLICITATION 133
+#define ICMP6_ADVERTISEMENT 134
+#define ICMP6_NODE_INFO_QUERY 139
+#define ICMP6_NODE_INFO_RESPONSE 140
+
+typedef icmp6::ICMP6Hdr ICMP6Hdr;
+typedef icmp6::ICMP6TooBig ICMP6TooBig;
+typedef icmp6::ICMP6NodeInfo ICMP6NodeInfo;
+typedef icmp6::ICMP6RouterAdvertisement ICMP6RouterAdvertisement;
+typedef icmp6::ICMP6RouterSolicitation ICMP6RouterSolicitation;
+
+
+#endif
+
--- /dev/null
+/*
+** Copyright (C) 2002-2013 Sourcefire, Inc.
+** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+
+#ifndef IPV4_H
+#define IPV4_H
+
+#include <cstdint>
+
+
+#define ETHERNET_TYPE_IP 0x0800
+
+
+namespace ipv4
+{
+
+
+struct IPHdr
+{
+ uint8_t ip_verhl; /* version & header length */
+ uint8_t ip_tos; /* type of service */
+ uint16_t ip_len; /* datagram length */
+ uint16_t ip_id; /* identification */
+ uint16_t ip_off; /* fragment offset */
+ uint8_t ip_ttl; /* time to live field */
+ uint8_t ip_proto; /* datagram protocol */
+ uint16_t ip_csum; /* checksum */
+ struct in_addr ip_src; /* source IP */
+ struct in_addr ip_dst; /* dest IP */
+} ;
+
+
+ struct IP4Hdr
+ {
+ uint8_t ip_verhl; /* version & header length */
+ uint8_t ip_tos; /* type of service */
+ uint16_t ip_len; /* datagram length */
+ uint16_t ip_id; /* identification */
+ uint16_t ip_off; /* fragment offset */
+ uint8_t ip_ttl; /* time to live field */
+ uint8_t ip_proto; /* datagram protocol */
+ uint16_t ip_csum; /* checksum */
+ sfip_t ip_src; /* source IP */
+ sfip_t ip_dst; /* dest IP */
+ };
+
+ enum class IPOptionCodes : std::uint8_t {
+ IPOPT_EOL = 0x00,
+ IPOPT_NOP = 0x01,
+ IPOPT_RR = 0x07,
+ IPOPT_TS = 0x44,
+ IPOPT_SECURITY = 0x82,
+ IPOPT_LSRR = 0x83,
+ IPOPT_LSRR_E = 0x84,
+ IPOPT_ESEC = 0x85,
+ IPOPT_SATID = 0x88,
+ IPOPT_SSRR = 0x89,
+ IPOPT_RTRALT = 0x94,
+ IPOPT_ANY = 0xff,
+ };
+
+ namespace detail
+ {
+ /* ip option type codes */
+
+ const uint32_t IP4_THIS_NET = 0x00; // msb
+ const uint32_t IP4_MULTICAST = 0x0E; // ms nibble
+ const uint32_t IP4_RESERVED = 0x0F; // ms nibble
+ const uint32_t IP4_LOOPBACK = 0x7F; // msb
+ const uint32_t IP4_BROADCAST = 0xffffffff;
+
+
+ const uint16_t C_ETHERNET_TYPE_IP = 0x0800;
+
+
+ const uint8_t IP_HEADER_LEN = 20;
+ } /* detail */
+
+
+ inline bool isPrivateIP(uint32_t addr)
+ {
+ switch (addr & 0xff)
+ {
+ case 0x0a:
+ return true;
+ break;
+ case 0xac:
+ if ((addr & 0xf000) == 0x1000)
+ return true;
+ break;
+ case 0xc0:
+ if (((addr & 0xff00) ) == 0xa800)
+ return true;
+ break;
+ }
+ return false;
+ }
+
+ inline bool is_broadcast(uint32_t addr)
+ {
+ return (addr == detail::IP4_BROADCAST);
+ }
+
+ inline bool is_multicast(uint8_t addr)
+ {
+ return (addr == detail::IP4_MULTICAST);
+ }
+
+ inline bool is_opt_rr(IPOptionCodes code)
+ {
+ return (code == IPOptionCodes::IPOPT_RR);
+ }
+
+ inline bool is_ethertype_ip(int proto)
+ {
+ return (proto == detail::C_ETHERNET_TYPE_IP);
+ }
+
+ inline int get_ethertype_ip()
+ {
+ return detail::C_ETHERNET_TYPE_IP;
+ }
+
+
+ inline bool is_ipv4(struct _IPHdr* p)
+ {
+ return (((reinterpret_cast<IP4Hdr*>(p)->ip_verhl & 0xf0) >> 4) == 4);
+ }
+
+
+ inline bool is_ipv4(IP4Hdr* p)
+ {
+ return ((((p->ip_verhl & 0xf0) >> 4) ) == 4);
+ }
+
+ inline uint8_t get_pkt_hdr_len(IP4Hdr* p)
+ {
+ return p->ip_verhl & 0x0f;
+ }
+
+ inline uint8_t get_pkt_hdr_len(IPHdr* p)
+ {
+ return (reinterpret_cast<IP4Hdr*>(p)->ip_verhl & 0x0f);
+ }
+
+ inline uint8_t get_pkt_hdr_len(const IPHdr* p)
+ {
+ return (reinterpret_cast<const IP4Hdr*>(p)->ip_verhl & 0x0f);
+ }
+
+ inline uint8_t ip_hdr_len()
+ {
+ return detail::IP_HEADER_LEN;
+ }
+
+ inline bool is_loopback(uint8_t addr)
+ {
+ return addr == detail::IP4_LOOPBACK;
+ }
+
+ inline bool is_this_net(uint8_t addr)
+ {
+ return addr == detail::IP4_THIS_NET;
+ }
+
+ inline bool is_reserved(uint8_t addr)
+ {
+ return addr == detail::IP4_RESERVED;
+ }
+
+} /* Ipv4 */
+
+typedef ipv4::IPHdr IPHdr;
+
+#endif
+
--- /dev/null
+/*
+** Copyright (C) 2002-2013 Sourcefire, Inc.
+** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+
+#ifndef IPV6_H
+#define IPV6_H
+
+#include <cstdint>
+#include "sfip/sfip_t.h"
+
+namespace ipv6
+{
+
+
+namespace detail
+{
+const uint16_t ETHERNET_TYPE_IPV6 = 0x86dd;
+const uint8_t IP6_HEADER_LEN = 40;
+const uint8_t IP6_MULTICAST = 0xFF; // first/most significant octet
+} // namespace
+
+
+
+/* IPv6 address */
+#ifndef s6_addr
+struct in6_addr
+{
+ union
+ {
+ uint8_t u6_addr8[16];
+ uint16_t u6_addr16[8];
+ uint32_t u6_addr32[4];
+ } in6_u;
+#define s6_addr in6_u.u6_addr8
+#define s6_addr16 in6_u.u6_addr16
+#define s6_addr32 in6_u.u6_addr32
+};
+#endif
+
+
+#define ip6flow ip6_vtf
+#define ip6plen ip6_payload_len
+#define ip6nxt ip6_next
+#define ip6hlim ip6_hoplim
+#define ip6hops ip6_hoplim
+
+#define IPRAW_HDR_VER(p_rawiph) \
+ (ntohl(p_rawiph->ip6_vtf) >> 28)
+
+#ifndef IP_PROTO_HOPOPTS
+# define IP_PROTO_HOPOPTS 0
+#endif
+
+#define IP_PROTO_NONE 59
+#define IP_PROTO_ROUTING 43
+#define IP_PROTO_FRAGMENT 44
+#define IP_PROTO_AH 51
+#define IP_PROTO_DSTOPTS 60
+#define IP_PROTO_ICMPV6 58
+#define IP_PROTO_IPV6 41
+#define IP_PROTO_IPIP 4
+
+#define IP6F_OFFSET_MASK 0xfff8 /* mask out offset from _offlg */
+#define IP6F_MF_MASK 0x0001 /* more-fragments flag */
+
+#define IP6F_OFFSET(fh) ((ntohs((fh)->ip6f_offlg) & IP6F_OFFSET_MASK) >> 3)
+#define IP6F_RES(fh) (fh)->ip6f_reserved
+#define IP6F_MF(fh) (ntohs((fh)->ip6f_offlg) & IP6F_MF_MASK )
+
+/* to store references to IP6 Extension Headers */
+struct IP6Option
+{
+ uint8_t type;
+ const uint8_t *data;
+};
+
+/* Generic Extension Header */
+typedef struct _IP6Extension
+{
+ uint8_t ip6e_nxt;
+ uint8_t ip6e_len;
+ /* options follow */
+ uint8_t ip6e_pad[6];
+} IP6Extension;
+
+typedef struct _IP6HopByHop
+{
+ uint8_t ip6hbh_nxt;
+ uint8_t ip6hbh_len;
+ /* options follow */
+ uint8_t ip6hbh_pad[6];
+} IP6HopByHop;
+
+typedef struct _IP6Dest
+{
+ uint8_t ip6dest_nxt;
+ uint8_t ip6dest_len;
+ /* options follow */
+ uint8_t ip6dest_pad[6];
+} IP6Dest;
+
+typedef struct _IP6Route
+{
+ uint8_t ip6rte_nxt;
+ uint8_t ip6rte_len;
+ uint8_t ip6rte_type;
+ uint8_t ip6rte_seg_left;
+ /* type specific data follows */
+} IP6Route;
+
+typedef struct _IP6Route0
+{
+ uint8_t ip6rte0_nxt;
+ uint8_t ip6rte0_len;
+ uint8_t ip6rte0_type;
+ uint8_t ip6rte0_seg_left;
+ uint8_t ip6rte0_reserved;
+ uint8_t ip6rte0_bitmap[3];
+ struct in6_addr ip6rte0_addr[1]; /* Up to 23 IP6 addresses */
+} IP6Route0;
+
+/* Fragment header */
+typedef struct _IP6Frag
+{
+ uint8_t ip6f_nxt; /* next header */
+ uint8_t ip6f_reserved; /* reserved field */
+ uint16_t ip6f_offlg; /* offset, reserved, and flag */
+ uint32_t ip6f_ident; /* identification */
+} IP6Frag;
+
+
+struct IP6RawHdr
+{
+ uint32_t ip6_vtf; /* 4 bits version, 8 bits TC,
+ 20 bits flow-ID */
+ uint16_t ip6_payload_len; /* payload length */
+ uint8_t ip6_next; /* next header */
+ uint8_t ip6_hoplim; /* hop limit */
+
+ struct in6_addr ip6_src; /* source address */
+ struct in6_addr ip6_dst; /* destination address */
+};
+
+struct IP6Hdr
+{
+ uint32_t vcl; /* version, class, and label */
+ uint16_t len; /* length of the payload */
+ uint8_t next; /* next header
+ * Uses the same flags as
+ * the IPv4 protocol field */
+ uint8_t hop_lmt; /* hop limit */
+ sfip_t ip_src;
+ sfip_t ip_dst;
+};
+
+enum class MulticastScope : uint8_t
+{
+ IP6_MULTICAST_SCOPE_RESERVED = 0x00,
+ IP6_MULTICAST_SCOPE_INTERFACE = 0x01,
+ IP6_MULTICAST_SCOPE_LINK = 0x02,
+ IP6_MULTICAST_SCOPE_ADMIN = 0x04,
+ IP6_MULTICAST_SCOPE_SITE = 0x05,
+ IP6_MULTICAST_SCOPE_ORG = 0x08,
+ IP6_MULTICAST_SCOPE_GLOBAL = 0x0E,
+};
+
+enum class HopByHopOptions : uint8_t
+{
+ PAD1 = 0x00,
+ PADN = 0x01,
+ TUNNEL_ENCAP = 0x04,
+ RTALERT = 0x05,
+ QUICK_START = 0x06,
+ CALIPSO = 0x07,
+ HOME_ADDRESS = 0xC9,
+ JUMBO = 0xC2,
+ ENDPOINT_IDENT = 0x8A,
+};
+
+
+
+inline uint8_t header_length()
+{
+ return detail::IP6_HEADER_LEN;
+}
+
+inline uint16_t ethertype()
+{
+ return detail::ETHERNET_TYPE_IPV6;
+}
+
+inline bool is_multicast(uint8_t addr)
+{
+ return addr == detail::IP6_MULTICAST;
+}
+
+inline MulticastScope get_multicast_scope(uint8_t ch)
+{
+ return static_cast<MulticastScope>(ch & 0x0F);
+}
+
+inline bool is_multicast_scope_reserved(uint8_t ch)
+{
+ return (static_cast<MulticastScope>(ch) == MulticastScope::IP6_MULTICAST_SCOPE_RESERVED);
+}
+
+inline bool is_multicast_scope_interface(uint8_t ch)
+{
+ return (static_cast<MulticastScope>(ch) == MulticastScope::IP6_MULTICAST_SCOPE_INTERFACE);
+}
+
+inline bool is_multicast_scope_link(uint8_t ch)
+{
+ return (static_cast<MulticastScope>(ch) == MulticastScope::IP6_MULTICAST_SCOPE_LINK);
+}
+
+inline bool is_multicast_scope_site(uint8_t ch)
+{
+ return (static_cast<MulticastScope>(ch) == MulticastScope::IP6_MULTICAST_SCOPE_SITE);
+}
+
+inline bool is_multicast_scope_global(uint8_t ch)
+{
+ return (static_cast<MulticastScope>(ch) == MulticastScope::IP6_MULTICAST_SCOPE_GLOBAL);
+}
+
+inline bool is_ip6_hdr_ver(IP6RawHdr *hdr)
+{
+ return ((ntohl(hdr->ip6_vtf) >> 28) == 6);
+}
+
+
+} // namespace
+
+
+
+
+
+// TODO --> delete EVERYTHING below this line!
+typedef ipv6::IP6Option IP6Option;
+typedef ipv6::IP6Frag IP6Frag;
+typedef ipv6::IP6Route IP6Route;
+typedef ipv6::IP6HopByHop IP6HopByHop;
+typedef ipv6::IP6Dest IP6Dest;
+typedef ipv6::IP6Extension IP6Extension;
+
+#endif
--- /dev/null
+/* $Id: decode.c,v 1.285 2013-06-29 03:03:00 rcombs Exp $ */
+
+/*
+** Copyright (C) 2002-2013 Sourcefire, Inc.
+** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+#include "packet.h"
+#include "codecs/sf_protocols.h"
+#include "log/messages.h"
+
+void PacketClass::PushLayer(Packet *p, const Codec *cd, const uint8_t *hdr_start, uint32_t len)
+{
+ if ( p->next_layer < LAYER_MAX )
+ {
+ Layer* lyr = p->layers + p->next_layer++;
+ lyr->proto = PROTO_TCP;
+ lyr->cd = cd;
+ lyr->start = (uint8_t*)hdr_start;
+ lyr->length = (uint16_t)len;
+ }
+ else
+ {
+ LogMessage("(snort_decoder) WARNING: decoder got too many layers;"
+ " next proto is something.\n");
+ }
+}
\ No newline at end of file
/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
** Copyright (C) 2002-2013 Sourcefire, Inc.
** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
**
#include <stddef.h>
#include <sys/types.h>
+#ifndef WIN32
#include <sys/socket.h>
#include <netinet/in.h>
#include <net/if.h>
+#else /* !WIN32 */
#include <netinet/in_systm.h>
-
#ifndef IFNAMSIZ
#define IFNAMESIZ MAX_ADAPTER_NAME
-#endif
+#endif /* !IFNAMSIZ */
+#endif /* !WIN32 */
extern "C" {
#include <daq.h>
}
#include "snort_types.h"
-#include "protocols/sf_protocols.h"
#include "sfip/ipv6_port.h"
#include "sfip/sf_ip.h"
#include "sfip/sf_iph.h"
+#include "codecs/layer.h"
+#include "protocols/ipv4.h"
+#include "protocols/ipv6.h"
+#include "protocols/tcp.h"
+#include "protocols/udp.h"
+#include "protocols/eth.h"
+#include "protocols/icmp4.h"
+#include "protocols/icmp6.h"
+
+
/* D E F I N E S ************************************************************/
/* packet status flags */
uint8_t saddr[TR_ALEN]; /* dst address */
} Trh_hdr;
+#ifdef WIN32
+ /* Visual C++ pragma to enable warning messages about nonstandard bit field type */
+ #pragma warning( default : 4214 )
+#endif
/* End Token Ring Data Structures */
#define SPARC_TWIDDLE 0
#endif
-/*
- * Ethernet header
- */
-
-typedef struct _EtherHdr
-{
- uint8_t ether_dst[6];
- uint8_t ether_src[6];
- uint16_t ether_type;
-
-} EtherHdr;
-
#ifndef NO_NON_ETHER_DECODER
/*
#define IP6_EXTMAX 8
#define TCP_OPTLENMAX 40 /* (((2^4) - 1) * 4 - TCP_HEADER_LEN) */
-typedef struct _IPHdr
-{
- uint8_t ip_verhl; /* version & header length */
- uint8_t ip_tos; /* type of service */
- uint16_t ip_len; /* datagram length */
- uint16_t ip_id; /* identification */
- uint16_t ip_off; /* fragment offset */
- uint8_t ip_ttl; /* time to live field */
- uint8_t ip_proto; /* datagram protocol */
- uint16_t ip_csum; /* checksum */
- struct in_addr ip_src; /* source IP */
- struct in_addr ip_dst; /* dest IP */
-} IPHdr;
-
-typedef struct _IPv4Hdr
-{
- uint8_t ip_verhl; /* version & header length */
- uint8_t ip_tos; /* type of service */
- uint16_t ip_len; /* datagram length */
- uint16_t ip_id; /* identification */
- uint16_t ip_off; /* fragment offset */
- uint8_t ip_ttl; /* time to live field */
- uint8_t ip_proto; /* datagram protocol */
- uint16_t ip_csum; /* checksum */
- sfip_t ip_src; /* source IP */
- sfip_t ip_dst; /* dest IP */
-} IP4Hdr;
-
-typedef struct _IPv6Hdr
-{
- uint32_t vcl; /* version, class, and label */
- uint16_t len; /* length of the payload */
- uint8_t next; /* next header
- * Uses the same flags as
- * the IPv4 protocol field */
- uint8_t hop_lmt; /* hop limit */
- sfip_t ip_src;
- sfip_t ip_dst;
-} IP6Hdr;
-
-/* IPv6 address */
-#ifndef s6_addr
-struct in6_addr
-{
- union
- {
- uint8_t u6_addr8[16];
- uint16_t u6_addr16[8];
- uint32_t u6_addr32[4];
- } in6_u;
-#define s6_addr in6_u.u6_addr8
-#define s6_addr16 in6_u.u6_addr16
-#define s6_addr32 in6_u.u6_addr32
-};
-#endif
-
-typedef struct _IP6RawHdr
-{
- uint32_t ip6_vtf; /* 4 bits version, 8 bits TC,
- 20 bits flow-ID */
- uint16_t ip6_payload_len; /* payload length */
- uint8_t ip6_next; /* next header */
- uint8_t ip6_hoplim; /* hop limit */
-
- struct in6_addr ip6_src; /* source address */
- struct in6_addr ip6_dst; /* destination address */
-} IP6RawHdr;
-
-#define ip6flow ip6_vtf
-#define ip6plen ip6_payload_len
-#define ip6nxt ip6_next
-#define ip6hlim ip6_hoplim
-#define ip6hops ip6_hoplim
-#define IPRAW_HDR_VER(p_rawiph) \
- (ntohl(p_rawiph->ip6_vtf) >> 28)
-
-#define IP6_HDR_LEN 40
-
-#ifndef IP_PROTO_HOPOPTS
-# define IP_PROTO_HOPOPTS 0
-#endif
-
-#define IP_PROTO_NONE 59
-#define IP_PROTO_ROUTING 43
-#define IP_PROTO_FRAGMENT 44
-#define IP_PROTO_AH 51
-#define IP_PROTO_DSTOPTS 60
-#define IP_PROTO_ICMPV6 58
-#define IP_PROTO_IPV6 41
-#define IP_PROTO_IPIP 4
-
-#define IP6F_OFFSET_MASK 0xfff8 /* mask out offset from _offlg */
-#define IP6F_MF_MASK 0x0001 /* more-fragments flag */
-
-#define IP6F_OFFSET(fh) ((ntohs((fh)->ip6f_offlg) & IP6F_OFFSET_MASK) >> 3)
-#define IP6F_RES(fh) (fh)->ip6f_reserved
-#define IP6F_MF(fh) (ntohs((fh)->ip6f_offlg) & IP6F_MF_MASK )
-
-/* to store references to IP6 Extension Headers */
-typedef struct _IP6Option
-{
- uint8_t type;
- const uint8_t *data;
-} IP6Option;
-
-/* Generic Extension Header */
-typedef struct _IP6Extension
-{
- uint8_t ip6e_nxt;
- uint8_t ip6e_len;
- /* options follow */
- uint8_t ip6e_pad[6];
-} IP6Extension;
-
-typedef struct _IP6HopByHop
-{
- uint8_t ip6hbh_nxt;
- uint8_t ip6hbh_len;
- /* options follow */
- uint8_t ip6hbh_pad[6];
-} IP6HopByHop;
-
-typedef struct _IP6Dest
-{
- uint8_t ip6dest_nxt;
- uint8_t ip6dest_len;
- /* options follow */
- uint8_t ip6dest_pad[6];
-} IP6Dest;
-
-typedef struct _IP6Route
-{
- uint8_t ip6rte_nxt;
- uint8_t ip6rte_len;
- uint8_t ip6rte_type;
- uint8_t ip6rte_seg_left;
- /* type specific data follows */
-} IP6Route;
-
-typedef struct _IP6Route0
-{
- uint8_t ip6rte0_nxt;
- uint8_t ip6rte0_len;
- uint8_t ip6rte0_type;
- uint8_t ip6rte0_seg_left;
- uint8_t ip6rte0_reserved;
- uint8_t ip6rte0_bitmap[3];
- struct in6_addr ip6rte0_addr[1]; /* Up to 23 IP6 addresses */
-} IP6Route0;
-
-/* Fragment header */
-typedef struct _IP6Frag
-{
- uint8_t ip6f_nxt; /* next header */
- uint8_t ip6f_reserved; /* reserved field */
- uint16_t ip6f_offlg; /* offset, reserved, and flag */
- uint32_t ip6f_ident; /* identification */
-} IP6Frag;
-
-typedef struct _ICMP6
-{
- uint8_t type;
- uint8_t code;
- uint16_t csum;
-
-} ICMP6Hdr;
-
-typedef struct _ICMP6TooBig
-{
- uint8_t type;
- uint8_t code;
- uint16_t csum;
- uint32_t mtu;
-} ICMP6TooBig;
-
-typedef struct _ICMP6RouterAdvertisement
-{
- uint8_t type;
- uint8_t code;
- uint16_t csum;
- uint8_t num_addrs;
- uint8_t addr_entry_size;
- uint16_t lifetime;
- uint32_t reachable_time;
- uint32_t retrans_time;
-} ICMP6RouterAdvertisement;
-
-typedef struct _ICMP6RouterSolicitation
-{
- uint8_t type;
- uint8_t code;
- uint16_t csum;
- uint32_t reserved;
-} ICMP6RouterSolicitation;
-
-typedef struct _ICMP6NodeInfo
-{
- uint8_t type;
- uint8_t code;
- uint16_t csum;
- uint16_t qtype;
- uint16_t flags;
- uint64_t nonce;
-} ICMP6NodeInfo;
-
-#define ICMP6_UNREACH 1
-#define ICMP6_BIG 2
-#define ICMP6_TIME 3
-#define ICMP6_PARAMS 4
-#define ICMP6_ECHO 128
-#define ICMP6_REPLY 129
-#define ICMP6_SOLICITATION 133
-#define ICMP6_ADVERTISEMENT 134
-#define ICMP6_NODE_INFO_QUERY 139
-#define ICMP6_NODE_INFO_RESPONSE 140
-
-/* Minus 1 due to the 'body' field */
-#define ICMP6_MIN_HEADER_LEN (sizeof(ICMP6Hdr) )
#ifdef _MSC_VER
/* Visual C++ pragma to enable warning messages about nonstandard bit field type */
#endif
-typedef struct _UDPHdr
-{
- uint16_t uh_sport;
- uint16_t uh_dport;
- uint16_t uh_len;
- uint16_t uh_chk;
-
-} UDPHdr;
-
-
-typedef struct _ICMPHdr
-{
- uint8_t type;
- uint8_t code;
- uint16_t csum;
- union
- {
- struct
- {
- uint8_t pptr;
- uint8_t pres1;
- uint16_t pres2;
- } param;
-
- struct in_addr gwaddr;
-
- struct idseq
- {
- uint16_t id;
- uint16_t seq;
- } idseq;
-
- uint32_t sih_void;
-
- struct pmtu
- {
- uint16_t ipm_void;
- uint16_t nextmtu;
- } pmtu;
-
- struct rtradv
- {
- uint8_t num_addrs;
- uint8_t wpa;
- uint16_t lifetime;
- } rtradv;
- } icmp_hun;
-
-#define s_icmp_pptr icmp_hun.param.pptr
-#define s_icmp_gwaddr icmp_hun.gwaddr
-#define s_icmp_id icmp_hun.idseq.id
-#define s_icmp_seq icmp_hun.idseq.seq
-#define s_icmp_void icmp_hun.sih_void
-#define s_icmp_pmvoid icmp_hun.pmtu.ipm_void
-#define s_icmp_nextmtu icmp_hun.pmtu.nextmtu
-#define s_icmp_num_addrs icmp_hun.rtradv.num_addrs
-#define s_icmp_wpa icmp_hun.rtradv.wpa
-#define s_icmp_lifetime icmp_hun.rtradv.lifetime
-
- union
- {
- /* timestamp */
- struct ts
- {
- uint32_t otime;
- uint32_t rtime;
- uint32_t ttime;
- } ts;
-
- /* IP header for unreach */
- struct ih_ip
- {
- IPHdr *ip;
- /* options and then 64 bits of data */
- } ip;
-
- struct ra_addr
- {
- uint32_t addr;
- uint32_t preference;
- } radv;
-
- uint32_t mask;
-
- char data[1];
-
- } icmp_dun;
-#define s_icmp_otime icmp_dun.ts.otime
-#define s_icmp_rtime icmp_dun.ts.rtime
-#define s_icmp_ttime icmp_dun.ts.ttime
-#define s_icmp_ip icmp_dun.ih_ip
-#define s_icmp_radv icmp_dun.radv
-#define s_icmp_mask icmp_dun.mask
-#define s_icmp_data icmp_dun.data
-
-} ICMPHdr;
-
typedef struct _ARPHdr
{
const uint8_t *data;
} Options;
-/* PPPoEHdr Header; EtherHdr plus the PPPoE Header */
+
+typedef struct _IpOptions
+{
+ ipv4::IPOptionCodes code;
+ uint8_t len; /* length of the data section */
+ const uint8_t *data;
+} IpOptions;
+
+
+/* PPPoEHdr Header; eth::EtherHdr plus the PPPoE Header */
typedef struct _PPPoEHdr
{
unsigned char ver_type; /* pppoe version/type */
//vvv-----------------------------
EtherARP *ah;
- const EtherHdr *eh; /* standard TCP/IP/Ethernet/ARP headers */
+ const eth::EtherHdr *eh; /* standard TCP/IP/Ethernet/ARP headers */
const VlanTagHdr *vh;
EthLlc *ehllc;
EthLlcOther *ehllcother;
const IPHdr *inner_iph; /* if IP-in-IP, this will be the inner IP header */
const IPHdr *outer_iph; /* if IP-in-IP, this will be the outer IP header */
const TCPHdr *tcph, *orig_tcph;
- const UDPHdr *udph, *orig_udph;
- const UDPHdr *inner_udph; /* if Teredo + UDP, this will be the inner UDP header */
- const UDPHdr *outer_udph; /* if Teredo + UDP, this will be the outer UDP header */
+ const udp::UDPHdr *udph, *orig_udph;
+ const udp::UDPHdr *inner_udph; /* if Teredo + UDP, this will be the inner UDP header */
+ const udp::UDPHdr *outer_udph; /* if Teredo + UDP, this will be the outer UDP header */
const ICMPHdr *icmph, *orig_icmph;
const uint8_t *data; /* packet payload pointer */
void *fragtracker; /* for ip fragmentation tracking info... */
//vvv-----------------------------
- IP4Hdr *ip4h, *orig_ip4h;
- IP6Hdr *ip6h, *orig_ip6h;
- ICMP6Hdr *icmp6h, *orig_icmp6h;
+ ipv4::IP4Hdr *ip4h, *orig_ip4h;
+ ipv6::IP6Hdr *ip6h, *orig_ip6h;
+ icmp6::ICMP6Hdr *icmp6h, *orig_icmp6h;
IPH_API* iph_api;
IPH_API* orig_iph_api;
#endif
// nothing after this point is zeroed ...
- Options ip_options[IP_OPTMAX]; /* ip options decode structure */
+ IpOptions ip_options[IP_OPTMAX]; /* ip options decode structure */
Options tcp_options[TCP_OPTLENMAX]; /* tcp options decode struct */
IP6Option ip6_extensions[IP6_EXTMAX]; /* IPv6 Extension References */
const uint8_t *ip_options_data;
const uint8_t *tcp_options_data;
- const IP6RawHdr* raw_ip6h; // innermost raw ip6 header
+ const ipv6::IP6RawHdr* raw_ip6h; // innermost raw ip6 header
Layer layers[LAYER_MAX]; /* decoded encapsulations */
- IP4Hdr inner_ip4h, inner_orig_ip4h;
- IP6Hdr inner_ip6h, inner_orig_ip6h;
- IP4Hdr outer_ip4h, outer_orig_ip4h;
- IP6Hdr outer_ip6h, outer_orig_ip6h;
+ ipv4::IP4Hdr inner_ip4h, inner_orig_ip4h;
+ ipv6::IP6Hdr inner_ip6h, inner_orig_ip6h;
+ ipv4::IP4Hdr outer_ip4h, outer_orig_ip4h;
+ ipv6::IP6Hdr outer_ip6h, outer_orig_ip6h;
MplsHdr mplsHdr;
/**policyId provided in configuration file. Used for correlating configuration
* with event output
*/
+ uint16_t configPolicyId;
uint16_t user_policy_id;
uint32_t iplist_id;
#define IsIP(p) (IPH_IS_VALID(p))
#define IsTCP(p) (IsIP(p) && p->tcph)
-#define IsUDP(p) (IsIP(p) && p->udph)
#define IsICMP(p) (IsIP(p) && p->icmph)
#define GET_PKT_SEQ(p) (ntohl(p->tcph->th_seq))
p->xtradata_mask |= BIT(xid);
}
+
+// Encoder && Decoder general structs
+
+typedef struct
+{
+ uint32_t sip[4], dip[4];
+ uint8_t zero;
+ uint8_t protocol;
+ uint16_t len;
+} pseudoheader6;
+
+
+typedef struct
+{
+ uint32_t sip, dip;
+ uint8_t zero;
+ uint8_t protocol;
+ uint16_t len;
+} pseudoheader;
+
+
+class PacketClass{
+
+public:
+ static
+ void PushLayer(Packet *p, const Codec *cd, const uint8_t *hdr_start, uint32_t len);
+
+
+private:
+
+
+
+};
+
#endif
--- /dev/null
+/*
+** Copyright (C) 2013-2013 Sourcefire, Inc.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+
+#ifndef TCP_H
+#define TCP_H
+
+#include <cstdint>
+
+
+// these are bits in th_flags:
+#define TH_FIN 0x01
+#define TH_SYN 0x02
+#define TH_RST 0x04
+#define TH_PUSH 0x08
+#define TH_ACK 0x10
+#define TH_URG 0x20
+#define TH_ECE 0x40
+#define TH_CWR 0x80
+#define TH_RES2 TH_ECE // TBD TH_RES* should be deleted (see log.c)
+#define TH_RES1 TH_CWR
+#define TH_NORESERVED (TH_FIN|TH_SYN|TH_RST|TH_PUSH|TH_ACK|TH_URG)
+
+// these are bits in th_offx2:
+#define TH_RSV 0x0E // reserved bits
+#define TH_NS 0x01 // ECN nonce bit
+
+
+/* Why are these lil buggers here? Never Used. -- cmg */
+#define TCPOLEN_TSTAMP_APPA (TCPOLEN_TIMESTAMP+2) /* appendix A / rfc 1323 */
+#define TCPOPT_TSTAMP_HDR \
+ (TCPOPT_NOP<<24|TCPOPT_NOP<<16|TCPOPT_TIMESTAMP<<8|TCPOLEN_TIMESTAMP)
+
+/*
+ * Default maximum segment size for TCP.
+ * With an IP MSS of 576, this is 536,
+ * but 512 is probably more convenient.
+ * This should be defined as MIN(512, IP_MSS - sizeof (struct tcpiphdr)).
+ */
+
+#define TCP_MSS 512
+#define TCP_MAXWIN 65535 /* largest value for (unscaled) window */
+#define TCP_MAX_WINSHIFT 14 /* maximum window shift */
+
+/*
+ * User-settable options (used with setsockopt).
+ */
+#define TCP_NODELAY 0x01 /* don't delay send to coalesce packets */
+#define TCP_MAXSEG 0x02 /* set maximum segment size */
+#define SOL_TCP 6 /* TCP level */
+
+
+/* tcp option codes */
+#define TOPT_EOL 0x00
+#define TOPT_NOP 0x01
+#define TOPT_MSS 0x02
+#define TOPT_WS 0x03
+#define TOPT_TS 0x08
+
+namespace tcp
+{
+
+namespace detail
+{
+
+const uint8_t TCP_HEADER_LEN = 20;
+
+} // namespace detail
+
+const int OPT_TRUNC = -1;
+const int OPT_BADLEN = -2;
+
+inline uint8_t header_length()
+{
+ return detail::TCP_HEADER_LEN;
+}
+
+
+
+/* http://www.iana.org/assignments/tcp-parameters
+ *
+ * tcp options stuff. used to be in <netinet/tcp.h> but it breaks
+ * things on AIX
+ */
+
+// enum class TcpOpt{
+enum TcpOpt{
+ EOL = 0, /* End of Option List [RFC793] */
+ NOP = 1, /* No-Option [RFC793] */
+ MAXSEG = 2, /* Maximum Segment Size [RFC793] */
+ WSCALE = 3, /* Window scaling option [RFC1323] */
+ SACKOK = 4, /* Experimental [RFC2018]*/
+ SACK = 5, /* Experimental [RFC2018] variable length */
+ ECHO = 6, /* Echo (obsoleted by option 8) [RFC1072] */
+ ECHOREPLY = 7, /* Echo Reply (obsoleted by option 8)[RFC1072] */
+ TIMESTAMP = 8, /* Timestamp [RFC1323], 10 bytes */
+ PARTIAL_PERM = 9, /* Partial Order Permitted/ Experimental [RFC1693] */
+ PARTIAL_SVC = 10, /* Partial Order Profile [RFC1693] */
+ CC = 11, /* T/TCP Connection count [RFC1644] */
+ CC_NEW = 12, /* CC.NEW [RFC1644] */
+ CC_ECHO = 13, /* CC.ECHO [RFC1644] */
+
+ ALTCSUM = 15, /* TCP Alternate Checksum Data [RFC1146], variable length */
+ SKEETER = 16, /* Skeeter [Knowles] */
+ BUBBA = 17, /* Bubba [Knowles] */
+ TRAILER_CSUM = 18, /* Trailer Checksum Option [Subbu & Monroe] */
+ MD5SIG = 19, /* MD5 Signature Option [RFC2385] */
+
+
+ /* Space Communications Protocol Standardization */
+ SCPS = 20, /* Capabilities [Scott] */
+ SELNEGACK = 21, /* Selective Negative Acknowledgements [Scott] */
+ RECORDBOUND = 22, /* Record Boundaries [Scott] */
+ CORRUPTION = 23, /* Corruption experienced [Scott] */
+ SNAP = 24, /* SNAP [Sukonnik] -- anyone have info?*/
+ UNASSIGNED = 25, /* Unassigned (released 12/18/00) */
+ COMPRESSION = 26, /* TCP Compression Filter [Bellovin] */
+ /* http://www.research.att.com/~smb/papers/draft-bellovin-tcpcomp-00.txt*/
+
+ AUTH = 29, /* [RFC5925] - The TCP Authentication Option
+ Intended to replace MD5 Signature Option [RFC2385] */
+};
+
+
+#define TCPOLEN_EOL 1 /* Always one byte */
+#define TCPOLEN_NOP 1 /* Always one byte */
+#define TCPOLEN_MAXSEG 4 /* Always 4 bytes */
+#define TCPOLEN_WSCALE 3 /* 1 byte with logarithmic values */
+#define TCPOLEN_SACKOK 2
+#define TCPOLEN_ECHO 6 /* 6 bytes */
+#define TCPOLEN_ECHOREPLY 6 /* 6 bytes */
+#define TCPOLEN_TIMESTAMP 10
+#define TCPOLEN_PARTIAL_PERM 2 /* Partial Order Permitted/ Experimental [RFC1693] */
+#define TCPOLEN_PARTIAL_SVC 3 /* 3 bytes long -- Experimental */
+
+/* atleast decode T/TCP options... */
+#define TCPOLEN_CC 6 /* page 17 of rfc1644 */
+#define TCPOLEN_CC_NEW 6 /* page 17 of rfc1644 */
+#define TCPOLEN_CC_ECHO 6 /* page 17 of rfc1644 */
+#define TCPOLEN_TRAILER_CSUM 3
+#define TCPOLEN_MD5SIG 18
+
+
+
+
+
+
+} // namespace Tcp
+
+
+
+/* delete everything from here to the end of the file (excluding the #endif of course) */
+
+#define TCPOPT_EOL 0 /* End of Option List [RFC793] */
+#define TCPOLEN_EOL 1 /* Always one byte */
+
+#define TCPOPT_NOP 1 /* No-Option [RFC793] */
+#define TCPOLEN_NOP 1 /* Always one byte */
+
+#define TCPOPT_MAXSEG 2 /* Maximum Segment Size [RFC793] */
+#define TCPOLEN_MAXSEG 4 /* Always 4 bytes */
+
+#define TCPOPT_WSCALE 3 /* Window scaling option [RFC1323] */
+#define TCPOLEN_WSCALE 3 /* 1 byte with logarithmic values */
+
+#define TCPOPT_SACKOK 4 /* Experimental [RFC2018]*/
+#define TCPOLEN_SACKOK 2
+
+#define TCPOPT_SACK 5 /* Experimental [RFC2018] variable length */
+
+#define TCPOPT_ECHO 6 /* Echo (obsoleted by option 8) [RFC1072] */
+#define TCPOLEN_ECHO 6 /* 6 bytes */
+
+#define TCPOPT_ECHOREPLY 7 /* Echo Reply (obsoleted by option 8)[RFC1072] */
+#define TCPOLEN_ECHOREPLY 6 /* 6 bytes */
+
+#define TCPOPT_TIMESTAMP 8 /* Timestamp [RFC1323], 10 bytes */
+#define TCPOLEN_TIMESTAMP 10
+
+#define TCPOPT_PARTIAL_PERM 9 /* Partial Order Permitted/ Experimental [RFC1693] */
+#define TCPOLEN_PARTIAL_PERM 2 /* Partial Order Permitted/ Experimental [RFC1693] */
+
+#define TCPOPT_PARTIAL_SVC 10 /* Partial Order Profile [RFC1693] */
+#define TCPOLEN_PARTIAL_SVC 3 /* 3 bytes long -- Experimental */
+
+/* atleast decode T/TCP options... */
+#define TCPOPT_CC 11 /* T/TCP Connection count [RFC1644] */
+#define TCPOPT_CC_NEW 12 /* CC.NEW [RFC1644] */
+#define TCPOPT_CC_ECHO 13 /* CC.ECHO [RFC1644] */
+#define TCPOLEN_CC 6 /* page 17 of rfc1644 */
+#define TCPOLEN_CC_NEW 6 /* page 17 of rfc1644 */
+#define TCPOLEN_CC_ECHO 6 /* page 17 of rfc1644 */
+
+#define TCPOPT_ALTCSUM 15 /* TCP Alternate Checksum Data [RFC1146], variable length */
+#define TCPOPT_SKEETER 16 /* Skeeter [Knowles] */
+#define TCPOPT_BUBBA 17 /* Bubba [Knowles] */
+
+#define TCPOPT_TRAILER_CSUM 18 /* Trailer Checksum Option [Subbu & Monroe] */
+#define TCPOLEN_TRAILER_CSUM 3
+
+#define TCPOPT_MD5SIG 19 /* MD5 Signature Option [RFC2385] */
+#define TCPOLEN_MD5SIG 18
+
+/* Space Communications Protocol Standardization */
+#define TCPOPT_SCPS 20 /* Capabilities [Scott] */
+#define TCPOPT_SELNEGACK 21 /* Selective Negative Acknowledgements [Scott] */
+#define TCPOPT_RECORDBOUND 22 /* Record Boundaries [Scott] */
+#define TCPOPT_CORRUPTION 23 /* Corruption experienced [Scott] */
+
+#define TCPOPT_SNAP 24 /* SNAP [Sukonnik] -- anyone have info?*/
+#define TCPOPT_UNASSIGNED 25 /* Unassigned (released 12/18/00) */
+#define TCPOPT_COMPRESSION 26 /* TCP Compression Filter [Bellovin] */
+/* http://www.research.att.com/~smb/papers/draft-bellovin-tcpcomp-00.txt*/
+
+#define TCPOPT_AUTH 29 /* [RFC5925] - The TCP Authentication Option
+ Intended to replace MD5 Signature Option [RFC2385] */
+
+
+#endif /* TCP_H */
--- /dev/null
+/*
+** Copyright (C) 2002-2013 Sourcefire, Inc.
+** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+
+#ifndef TEREDO_H
+#define TEREDO_H
+
+#include <cstdint>
+
+
+
+namespace teredo
+{
+
+namespace detail
+{
+
+const uint16_t TEREDO_ID = 0x0100;
+const uint32_t TEREDO_PORT = 3544;
+const uint32_t TEREDO_INDICATOR_ORIGIN = 0x00;
+const uint32_t TEREDO_INDICATOR_ORIGIN_LEN = 8;
+const uint32_t TEREDO_INDICATOR_AUTH = 0x01;
+const uint32_t TEREDO_INDICATOR_AUTH_MIN_LEN = 13;
+const uint32_t TEREDO_MIN_LEN = 2;
+
+
+} // namespace detail
+
+
+inline uint16_t teredo_id()
+{
+ return detail::TEREDO_ID;
+}
+
+inline bool is_teredo_port(uint16_t port)
+{
+ return port == (detail::TEREDO_PORT);
+}
+
+inline uint32_t min_hdr_len()
+{
+ return detail::TEREDO_MIN_LEN;
+}
+
+inline uint32_t indicator_origin()
+{
+ return detail::TEREDO_INDICATOR_ORIGIN;
+}
+
+inline uint32_t indicator_origin_len()
+{
+ return detail::TEREDO_INDICATOR_ORIGIN_LEN;
+}
+
+inline uint32_t inidicator_auth()
+{
+ return detail::TEREDO_INDICATOR_AUTH;
+}
+
+inline uint32_t min_indicator_auth_len()
+{
+ return detail::TEREDO_INDICATOR_AUTH_MIN_LEN;
+}
+
+} // namespace teredo
+
+#endif
--- /dev/null
+/*
+** Copyright (C) 2002-2013 Sourcefire, Inc.
+** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+
+#ifndef UDP_H
+#define UDP_H
+
+#include <cstdint>
+
+
+/* otherwise defined in /usr/include/ppp_defs.h */
+#define UDP_HEADER_LEN 8
+
+#define IsUDP(p) (IsIP(p) && p->udph)
+
+
+namespace udp
+{
+
+namespace detail
+{
+const uint8_t HEADER_LEN = 8;
+
+} // namespace detail
+
+struct UDPHdr
+{
+ uint16_t uh_sport;
+ uint16_t uh_dport;
+ uint16_t uh_len;
+ uint16_t uh_chk;
+
+};
+
+inline uint8_t header_len()
+{
+ return detail::HEADER_LEN;
+}
+
+
+} // namespace
+
+#endif
projects / thirdparty / snort3.git / commitdiff
