From: Josh Date: Wed, 16 Apr 2014 16:01:25 +0000 (-0400) Subject: checking in new protocols directory X-Git-Tag: 3.0.0-233~1559^2~28 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b8462bbaf4ff9e8adb188abe04b5185d370e940e;p=thirdparty%2Fsnort3.git checking in new protocols directory --- diff --git a/src/protocols/CMakeLists.txt b/src/protocols/CMakeLists.txt index eedfe11c4..79977d1ef 100644 --- a/src/protocols/CMakeLists.txt +++ b/src/protocols/CMakeLists.txt @@ -1,23 +1,13 @@ -set (PROTOCOL_HEADERS +add_library (protocols + ipv4.h + tcp.h packet.h - sf_protocols.h + packet.cc + ipv6.h + udp.h + eth.h + icmp4.h + icmp6.h ) -add_library (protocols STATIC - checksum.h - decode.cc - decode.h - encode.cc - encode.h - decode_module.cc - decode_module.h - sf_protocols.h - ${PROTOCOL_HEADERS} -) - -install (FILES ${PROTOCOL_HEADERS} - DESTINATION "${CMAKE_PROJECT_NAME}/protocols" -) - - diff --git a/src/protocols/eth.h b/src/protocols/eth.h new file mode 100644 index 000000000..3d2f07e9e --- /dev/null +++ b/src/protocols/eth.h @@ -0,0 +1,63 @@ +/* +** Copyright (C) 2002-2013 Sourcefire, Inc. +** Copyright (C) 1998-2002 Martin Roesch +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + + +#ifndef ETH_H +#define ETH_H + + +#define ETHERNET_HEADER_LEN 14 +#define ETHERNET_MTU 1500 + +namespace eth +{ + + + +namespace detail +{ + const uint16_t HEADER_LEN = 14; + const uint16_t MTU_LEN = 1500; + +} // namespace detail + +struct EtherHdr +{ + uint8_t ether_dst[6]; + uint8_t ether_src[6]; + uint16_t ether_type; + +}; + +inline uint16_t hdr_len() +{ + return detail::HEADER_LEN; +} + +inline uint16_t mtu_len() +{ + return detail::MTU_LEN; +} + +} // namespace eth + + +#endif + diff --git a/src/protocols/gtp.h b/src/protocols/gtp.h new file mode 100644 index 000000000..eeb1b5142 --- /dev/null +++ b/src/protocols/gtp.h @@ -0,0 +1,43 @@ +/* +** Copyright (C) 2002-2013 Sourcefire, Inc. +** Copyright (C) 1998-2002 Martin Roesch +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + + +#ifndef GTP_H +#define GTP_H + +namespace gtp{ + +namespace detail{ + +const uint32_t GTP_ID = 0x0101; +const uint32_t GTP_MIN_LEN = 8; +const uint32_t GTP_V0_HEADER_LEN = 20; +const uint32_t GTP_V1_HEADER_LEN = 12; + +} // namespace detail + +inline uint16_t gtp_id() +{ + return detail::GTP_ID; +} + +} // namespace gtp + +#endif diff --git a/src/protocols/icmp4.h b/src/protocols/icmp4.h new file mode 100644 index 000000000..e7298251c --- /dev/null +++ b/src/protocols/icmp4.h @@ -0,0 +1,291 @@ +/* +** Copyright (C) 2002-2013 Sourcefire, Inc. +** Copyright (C) 1998-2002 Martin Roesch +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + + +#ifndef ICMP4_H +#define ICMP4_H + +#include +#include "snort_types.h" + +namespace icmp4 +{ + + // class to hold any data which should be hidden + namespace detail + { + + + + + } + + +// do NOT add 'ICMP_' to the begining of these const because they +// will overlap with dnet macros + + +enum class IcmpType : std::uint8_t { + ECHOREPLY = 0, + DEST_UNREACH = 3, + SOURCE_QUENCH = 4, + REDIRECT = 5, + ECHO = 8, + ROUTER_ADVERTISE = 9, + ROUTER_SOLICIT = 10, + TIME_EXCEEDED = 11, + PARAMETERPROB = 12, + TIMESTAMP = 13, + TIMESTAMPREPLY = 14, + INFO_REQUEST = 15, + INFO_REPLY = 16, + ADDRESS = 17, + ADDRESSREPLY = 18, +// NR_ICMP_TYPES = 18, +}; + + +enum class IcmpCode : std::uint8_t { + /* Codes for ICMP UNREACHABLES (3) */ + NET_UNREACH = 0, + HOST_UNREACH = 1, + PROT_UNREACH = 2, + PORT_UNREACH = 3, + FRAG_NEEDED = 4, + SR_FAILED = 5, + NET_UNKNOWN = 6, + HOST_UNKNOWN = 7, + HOST_ISOLATED = 8, + PKT_FILTERED_NET = 9, + PKT_FILTERED_HOST = 10, + NET_UNR_TOS = 11, + HOST_UNR_TOS = 12, + PKT_FILTERED = 13, + PREC_VIOLATION = 14, + PREC_CUTOFF = 15, + + /* Code for ICMP Source Quence (4) */ + SOURCE_QUENCH = 0, + + /* Codes for an ICMP Redirect (5) */ + REDIR_NET = 0, + REDIR_HOST = 1, + REDIR_TOS_NET = 2, + REDIR_TOS_HOST = 3, + + /* Codes for ICMP Echo (8) */ + ECHO = 0, + + /* Codes for ICMP time excceeded (11) */ + TIMEOUT_TRANSIT = 0, + TIMEOUT_REASSY = 1, + + /* code for ICMP Parameter Problem (12) */ + PARAM_BADIPHDR = 0, + PARAM_OPTMISSING = 1, + PARAM_BAD_LENGTH = 2, +}; + +struct ICMPbaseHdr +{ + IcmpType type; + IcmpCode code; + +}; + +struct ICMPHdr +{ + IcmpType type; +// union { +// uint8_t type; +// _IcmpType enum_type; +// }; + IcmpCode code; + uint16_t csum; + + union + { + struct + { + uint8_t pptr; + uint8_t pres1; + uint16_t pres2; + } param; + + struct in_addr gwaddr; + + struct idseq + { + uint16_t id; + uint16_t seq; + } idseq; + + uint32_t sih_void; + + struct pmtu + { + uint16_t ipm_void; + uint16_t nextmtu; + } pmtu; + + struct rtradv + { + uint8_t num_addrs; + uint8_t wpa; + uint16_t lifetime; + } rtradv; + } icmp_hun; + +#define s_icmp_pptr icmp_hun.param.pptr +#define s_icmp_gwaddr icmp_hun.gwaddr +#define s_icmp_id icmp_hun.idseq.id +#define s_icmp_seq icmp_hun.idseq.seq +#define s_icmp_void icmp_hun.sih_void +#define s_icmp_pmvoid icmp_hun.pmtu.ipm_void +#define s_icmp_nextmtu icmp_hun.pmtu.nextmtu +#define s_icmp_num_addrs icmp_hun.rtradv.num_addrs +#define s_icmp_wpa icmp_hun.rtradv.wpa +#define s_icmp_lifetime icmp_hun.rtradv.lifetime + + union + { + /* timestamp */ + struct ts + { + uint32_t otime; + uint32_t rtime; + uint32_t ttime; + } ts; + + /* IP header for unreach */ + struct ih_ip + { + IPHdr *ip; + /* options and then 64 bits of data */ + } ip; + + struct ra_addr + { + uint32_t addr; + uint32_t preference; + } radv; + + uint32_t mask; + + char data[1]; + + } icmp_dun; +#define s_icmp_otime icmp_dun.ts.otime +#define s_icmp_rtime icmp_dun.ts.rtime +#define s_icmp_ttime icmp_dun.ts.ttime +#define s_icmp_ip icmp_dun.ih_ip +#define s_icmp_radv icmp_dun.radv +#define s_icmp_mask icmp_dun.mask +#define s_icmp_data icmp_dun.data + +} ; + + + + +inline bool is_echo_reply(uint32_t type) +{ + return (type == (uint32_t) IcmpType::ECHOREPLY); +} + +inline bool is_echo(uint32_t type) +{ + return (type == (uint32_t) IcmpType::ECHO); +} + + + +/* + * CHECKSUM + */ + +/* +* checksum icmp +*/ +static uint16_t in_chksum_icmp( unsigned short * w, int blen ) +{ + unsigned short answer=0; + unsigned int cksum = 0; + + while(blen >=32) + { + cksum += w[0]; + cksum += w[1]; + cksum += w[2]; + cksum += w[3]; + cksum += w[4]; + cksum += w[5]; + cksum += w[6]; + cksum += w[7]; + cksum += w[8]; + cksum += w[9]; + cksum += w[10]; + cksum += w[11]; + cksum += w[12]; + cksum += w[13]; + cksum += w[14]; + cksum += w[15]; + w += 16; + blen -= 32; + } + + while(blen >=8) + { + cksum += w[0]; + cksum += w[1]; + cksum += w[2]; + cksum += w[3]; + w += 4; + blen -= 8; + } + + while(blen > 1) + { + cksum += *w++; + blen -= 2; + } + + if( blen == 1 ) + { + *(unsigned char*)(&answer) = (*(unsigned char*)w); + cksum += answer; + } + + cksum = (cksum >> 16) + (cksum & 0x0000ffff); + cksum += (cksum >> 16); + + + return (unsigned short)(~cksum); +} + +} //namespace icmp4 + + + +typedef icmp4::ICMPbaseHdr ICMPbaseHdr; +typedef icmp4::ICMPHdr ICMPHdr; + + +#endif /* ICMP4_H */ diff --git a/src/protocols/icmp6.h b/src/protocols/icmp6.h new file mode 100644 index 000000000..b7708a7b4 --- /dev/null +++ b/src/protocols/icmp6.h @@ -0,0 +1,133 @@ +/* +** Copyright (C) 2002-2013 Sourcefire, Inc. +** Copyright (C) 1998-2002 Martin Roesch +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + + +#ifndef ICMP6_H +#define ICMP6_H + +#include + +namespace icmp6 +{ + +namespace detail +{ + const uint16_t HEADER_MIN_LEN = 4; + const uint16_t HEADER_NORMAL_LEN = 8; +} // namespace detail + +struct ICMP6Hdr +{ + uint8_t type; + uint8_t code; + uint16_t csum; + +}; + +struct ICMP6TooBig +{ + uint8_t type; + uint8_t code; + uint16_t csum; + uint32_t mtu; +} ; + +struct ICMP6RouterAdvertisement +{ + uint8_t type; + uint8_t code; + uint16_t csum; + uint8_t num_addrs; + uint8_t addr_entry_size; + uint16_t lifetime; + uint32_t reachable_time; + uint32_t retrans_time; +}; + +struct ICMP6RouterSolicitation +{ + uint8_t type; + uint8_t code; + uint16_t csum; + uint32_t reserved; +} ; + +struct ICMP6NodeInfo +{ + uint8_t type; + uint8_t code; + uint16_t csum; + uint16_t qtype; + uint16_t flags; + uint64_t nonce; +} ; + +// +//enum class Icmp6Types : std::uint8_t { +enum Icmp6Types : std::uint8_t { + UNREACH = 1, + ICMP6_TYPE_BIG = 2, + TIME = 3, + PARAMS = 4, + ECHO = 128, + REPLY = 129, + SOLICITATION = 133, + ADVERTISEMENT = 134, + NODE_INFO_QUERY = 139, + NODE_INFO_RESPONSE = 140, +}; + +inline uint16_t hdr_min_len() +{ + return detail::HEADER_MIN_LEN; +} + + +inline uint16_t hdr_normal_len() +{ + return detail::HEADER_NORMAL_LEN; +} + +} // namespace icmp6 + + + +// Things that should be deleted immediately....which I bet will manage to make it into production + +#define ICMP6_UNREACH 1 +#define ICMP6_BIG 2 +#define ICMP6_TIME 3 +#define ICMP6_PARAMS 4 +#define ICMP6_ECHO 128 +#define ICMP6_REPLY 129 +#define ICMP6_SOLICITATION 133 +#define ICMP6_ADVERTISEMENT 134 +#define ICMP6_NODE_INFO_QUERY 139 +#define ICMP6_NODE_INFO_RESPONSE 140 + +typedef icmp6::ICMP6Hdr ICMP6Hdr; +typedef icmp6::ICMP6TooBig ICMP6TooBig; +typedef icmp6::ICMP6NodeInfo ICMP6NodeInfo; +typedef icmp6::ICMP6RouterAdvertisement ICMP6RouterAdvertisement; +typedef icmp6::ICMP6RouterSolicitation ICMP6RouterSolicitation; + + +#endif + diff --git a/src/protocols/ipv4.h b/src/protocols/ipv4.h new file mode 100644 index 000000000..6166783fc --- /dev/null +++ b/src/protocols/ipv4.h @@ -0,0 +1,193 @@ +/* +** Copyright (C) 2002-2013 Sourcefire, Inc. +** Copyright (C) 1998-2002 Martin Roesch +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + + +#ifndef IPV4_H +#define IPV4_H + +#include + + +#define ETHERNET_TYPE_IP 0x0800 + + +namespace ipv4 +{ + + +struct IPHdr +{ + uint8_t ip_verhl; /* version & header length */ + uint8_t ip_tos; /* type of service */ + uint16_t ip_len; /* datagram length */ + uint16_t ip_id; /* identification */ + uint16_t ip_off; /* fragment offset */ + uint8_t ip_ttl; /* time to live field */ + uint8_t ip_proto; /* datagram protocol */ + uint16_t ip_csum; /* checksum */ + struct in_addr ip_src; /* source IP */ + struct in_addr ip_dst; /* dest IP */ +} ; + + + struct IP4Hdr + { + uint8_t ip_verhl; /* version & header length */ + uint8_t ip_tos; /* type of service */ + uint16_t ip_len; /* datagram length */ + uint16_t ip_id; /* identification */ + uint16_t ip_off; /* fragment offset */ + uint8_t ip_ttl; /* time to live field */ + uint8_t ip_proto; /* datagram protocol */ + uint16_t ip_csum; /* checksum */ + sfip_t ip_src; /* source IP */ + sfip_t ip_dst; /* dest IP */ + }; + + enum class IPOptionCodes : std::uint8_t { + IPOPT_EOL = 0x00, + IPOPT_NOP = 0x01, + IPOPT_RR = 0x07, + IPOPT_TS = 0x44, + IPOPT_SECURITY = 0x82, + IPOPT_LSRR = 0x83, + IPOPT_LSRR_E = 0x84, + IPOPT_ESEC = 0x85, + IPOPT_SATID = 0x88, + IPOPT_SSRR = 0x89, + IPOPT_RTRALT = 0x94, + IPOPT_ANY = 0xff, + }; + + namespace detail + { + /* ip option type codes */ + + const uint32_t IP4_THIS_NET = 0x00; // msb + const uint32_t IP4_MULTICAST = 0x0E; // ms nibble + const uint32_t IP4_RESERVED = 0x0F; // ms nibble + const uint32_t IP4_LOOPBACK = 0x7F; // msb + const uint32_t IP4_BROADCAST = 0xffffffff; + + + const uint16_t C_ETHERNET_TYPE_IP = 0x0800; + + + const uint8_t IP_HEADER_LEN = 20; + } /* detail */ + + + inline bool isPrivateIP(uint32_t addr) + { + switch (addr & 0xff) + { + case 0x0a: + return true; + break; + case 0xac: + if ((addr & 0xf000) == 0x1000) + return true; + break; + case 0xc0: + if (((addr & 0xff00) ) == 0xa800) + return true; + break; + } + return false; + } + + inline bool is_broadcast(uint32_t addr) + { + return (addr == detail::IP4_BROADCAST); + } + + inline bool is_multicast(uint8_t addr) + { + return (addr == detail::IP4_MULTICAST); + } + + inline bool is_opt_rr(IPOptionCodes code) + { + return (code == IPOptionCodes::IPOPT_RR); + } + + inline bool is_ethertype_ip(int proto) + { + return (proto == detail::C_ETHERNET_TYPE_IP); + } + + inline int get_ethertype_ip() + { + return detail::C_ETHERNET_TYPE_IP; + } + + + inline bool is_ipv4(struct _IPHdr* p) + { + return (((reinterpret_cast(p)->ip_verhl & 0xf0) >> 4) == 4); + } + + + inline bool is_ipv4(IP4Hdr* p) + { + return ((((p->ip_verhl & 0xf0) >> 4) ) == 4); + } + + inline uint8_t get_pkt_hdr_len(IP4Hdr* p) + { + return p->ip_verhl & 0x0f; + } + + inline uint8_t get_pkt_hdr_len(IPHdr* p) + { + return (reinterpret_cast(p)->ip_verhl & 0x0f); + } + + inline uint8_t get_pkt_hdr_len(const IPHdr* p) + { + return (reinterpret_cast(p)->ip_verhl & 0x0f); + } + + inline uint8_t ip_hdr_len() + { + return detail::IP_HEADER_LEN; + } + + inline bool is_loopback(uint8_t addr) + { + return addr == detail::IP4_LOOPBACK; + } + + inline bool is_this_net(uint8_t addr) + { + return addr == detail::IP4_THIS_NET; + } + + inline bool is_reserved(uint8_t addr) + { + return addr == detail::IP4_RESERVED; + } + +} /* Ipv4 */ + +typedef ipv4::IPHdr IPHdr; + +#endif + diff --git a/src/protocols/ipv6.h b/src/protocols/ipv6.h new file mode 100644 index 000000000..a5c7ef7c4 --- /dev/null +++ b/src/protocols/ipv6.h @@ -0,0 +1,264 @@ +/* +** Copyright (C) 2002-2013 Sourcefire, Inc. +** Copyright (C) 1998-2002 Martin Roesch +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + + +#ifndef IPV6_H +#define IPV6_H + +#include +#include "sfip/sfip_t.h" + +namespace ipv6 +{ + + +namespace detail +{ +const uint16_t ETHERNET_TYPE_IPV6 = 0x86dd; +const uint8_t IP6_HEADER_LEN = 40; +const uint8_t IP6_MULTICAST = 0xFF; // first/most significant octet +} // namespace + + + +/* IPv6 address */ +#ifndef s6_addr +struct in6_addr +{ + union + { + uint8_t u6_addr8[16]; + uint16_t u6_addr16[8]; + uint32_t u6_addr32[4]; + } in6_u; +#define s6_addr in6_u.u6_addr8 +#define s6_addr16 in6_u.u6_addr16 +#define s6_addr32 in6_u.u6_addr32 +}; +#endif + + +#define ip6flow ip6_vtf +#define ip6plen ip6_payload_len +#define ip6nxt ip6_next +#define ip6hlim ip6_hoplim +#define ip6hops ip6_hoplim + +#define IPRAW_HDR_VER(p_rawiph) \ + (ntohl(p_rawiph->ip6_vtf) >> 28) + +#ifndef IP_PROTO_HOPOPTS +# define IP_PROTO_HOPOPTS 0 +#endif + +#define IP_PROTO_NONE 59 +#define IP_PROTO_ROUTING 43 +#define IP_PROTO_FRAGMENT 44 +#define IP_PROTO_AH 51 +#define IP_PROTO_DSTOPTS 60 +#define IP_PROTO_ICMPV6 58 +#define IP_PROTO_IPV6 41 +#define IP_PROTO_IPIP 4 + +#define IP6F_OFFSET_MASK 0xfff8 /* mask out offset from _offlg */ +#define IP6F_MF_MASK 0x0001 /* more-fragments flag */ + +#define IP6F_OFFSET(fh) ((ntohs((fh)->ip6f_offlg) & IP6F_OFFSET_MASK) >> 3) +#define IP6F_RES(fh) (fh)->ip6f_reserved +#define IP6F_MF(fh) (ntohs((fh)->ip6f_offlg) & IP6F_MF_MASK ) + +/* to store references to IP6 Extension Headers */ +struct IP6Option +{ + uint8_t type; + const uint8_t *data; +}; + +/* Generic Extension Header */ +typedef struct _IP6Extension +{ + uint8_t ip6e_nxt; + uint8_t ip6e_len; + /* options follow */ + uint8_t ip6e_pad[6]; +} IP6Extension; + +typedef struct _IP6HopByHop +{ + uint8_t ip6hbh_nxt; + uint8_t ip6hbh_len; + /* options follow */ + uint8_t ip6hbh_pad[6]; +} IP6HopByHop; + +typedef struct _IP6Dest +{ + uint8_t ip6dest_nxt; + uint8_t ip6dest_len; + /* options follow */ + uint8_t ip6dest_pad[6]; +} IP6Dest; + +typedef struct _IP6Route +{ + uint8_t ip6rte_nxt; + uint8_t ip6rte_len; + uint8_t ip6rte_type; + uint8_t ip6rte_seg_left; + /* type specific data follows */ +} IP6Route; + +typedef struct _IP6Route0 +{ + uint8_t ip6rte0_nxt; + uint8_t ip6rte0_len; + uint8_t ip6rte0_type; + uint8_t ip6rte0_seg_left; + uint8_t ip6rte0_reserved; + uint8_t ip6rte0_bitmap[3]; + struct in6_addr ip6rte0_addr[1]; /* Up to 23 IP6 addresses */ +} IP6Route0; + +/* Fragment header */ +typedef struct _IP6Frag +{ + uint8_t ip6f_nxt; /* next header */ + uint8_t ip6f_reserved; /* reserved field */ + uint16_t ip6f_offlg; /* offset, reserved, and flag */ + uint32_t ip6f_ident; /* identification */ +} IP6Frag; + + +struct IP6RawHdr +{ + uint32_t ip6_vtf; /* 4 bits version, 8 bits TC, + 20 bits flow-ID */ + uint16_t ip6_payload_len; /* payload length */ + uint8_t ip6_next; /* next header */ + uint8_t ip6_hoplim; /* hop limit */ + + struct in6_addr ip6_src; /* source address */ + struct in6_addr ip6_dst; /* destination address */ +}; + +struct IP6Hdr +{ + uint32_t vcl; /* version, class, and label */ + uint16_t len; /* length of the payload */ + uint8_t next; /* next header + * Uses the same flags as + * the IPv4 protocol field */ + uint8_t hop_lmt; /* hop limit */ + sfip_t ip_src; + sfip_t ip_dst; +}; + +enum class MulticastScope : uint8_t +{ + IP6_MULTICAST_SCOPE_RESERVED = 0x00, + IP6_MULTICAST_SCOPE_INTERFACE = 0x01, + IP6_MULTICAST_SCOPE_LINK = 0x02, + IP6_MULTICAST_SCOPE_ADMIN = 0x04, + IP6_MULTICAST_SCOPE_SITE = 0x05, + IP6_MULTICAST_SCOPE_ORG = 0x08, + IP6_MULTICAST_SCOPE_GLOBAL = 0x0E, +}; + +enum class HopByHopOptions : uint8_t +{ + PAD1 = 0x00, + PADN = 0x01, + TUNNEL_ENCAP = 0x04, + RTALERT = 0x05, + QUICK_START = 0x06, + CALIPSO = 0x07, + HOME_ADDRESS = 0xC9, + JUMBO = 0xC2, + ENDPOINT_IDENT = 0x8A, +}; + + + +inline uint8_t header_length() +{ + return detail::IP6_HEADER_LEN; +} + +inline uint16_t ethertype() +{ + return detail::ETHERNET_TYPE_IPV6; +} + +inline bool is_multicast(uint8_t addr) +{ + return addr == detail::IP6_MULTICAST; +} + +inline MulticastScope get_multicast_scope(uint8_t ch) +{ + return static_cast(ch & 0x0F); +} + +inline bool is_multicast_scope_reserved(uint8_t ch) +{ + return (static_cast(ch) == MulticastScope::IP6_MULTICAST_SCOPE_RESERVED); +} + +inline bool is_multicast_scope_interface(uint8_t ch) +{ + return (static_cast(ch) == MulticastScope::IP6_MULTICAST_SCOPE_INTERFACE); +} + +inline bool is_multicast_scope_link(uint8_t ch) +{ + return (static_cast(ch) == MulticastScope::IP6_MULTICAST_SCOPE_LINK); +} + +inline bool is_multicast_scope_site(uint8_t ch) +{ + return (static_cast(ch) == MulticastScope::IP6_MULTICAST_SCOPE_SITE); +} + +inline bool is_multicast_scope_global(uint8_t ch) +{ + return (static_cast(ch) == MulticastScope::IP6_MULTICAST_SCOPE_GLOBAL); +} + +inline bool is_ip6_hdr_ver(IP6RawHdr *hdr) +{ + return ((ntohl(hdr->ip6_vtf) >> 28) == 6); +} + + +} // namespace + + + + + +// TODO --> delete EVERYTHING below this line! +typedef ipv6::IP6Option IP6Option; +typedef ipv6::IP6Frag IP6Frag; +typedef ipv6::IP6Route IP6Route; +typedef ipv6::IP6HopByHop IP6HopByHop; +typedef ipv6::IP6Dest IP6Dest; +typedef ipv6::IP6Extension IP6Extension; + +#endif diff --git a/src/protocols/packet.cc b/src/protocols/packet.cc new file mode 100644 index 000000000..15afd3bb5 --- /dev/null +++ b/src/protocols/packet.cc @@ -0,0 +1,42 @@ +/* $Id: decode.c,v 1.285 2013-06-29 03:03:00 rcombs Exp $ */ + +/* +** Copyright (C) 2002-2013 Sourcefire, Inc. +** Copyright (C) 1998-2002 Martin Roesch +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +#include "packet.h" +#include "codecs/sf_protocols.h" +#include "log/messages.h" + +void PacketClass::PushLayer(Packet *p, const Codec *cd, const uint8_t *hdr_start, uint32_t len) +{ + if ( p->next_layer < LAYER_MAX ) + { + Layer* lyr = p->layers + p->next_layer++; + lyr->proto = PROTO_TCP; + lyr->cd = cd; + lyr->start = (uint8_t*)hdr_start; + lyr->length = (uint16_t)len; + } + else + { + LogMessage("(snort_decoder) WARNING: decoder got too many layers;" + " next proto is something.\n"); + } +} \ No newline at end of file diff --git a/src/protocols/packet.h b/src/protocols/packet.h index 787d4a3cc..aab580cfc 100644 --- a/src/protocols/packet.h +++ b/src/protocols/packet.h @@ -1,5 +1,4 @@ /* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. ** Copyright (C) 2002-2013 Sourcefire, Inc. ** Copyright (C) 1998-2002 Martin Roesch ** @@ -31,14 +30,16 @@ #include #include +#ifndef WIN32 #include #include #include +#else /* !WIN32 */ #include - #ifndef IFNAMSIZ #define IFNAMESIZ MAX_ADAPTER_NAME -#endif +#endif /* !IFNAMSIZ */ +#endif /* !WIN32 */ extern "C" { #include @@ -46,11 +47,20 @@ extern "C" { } #include "snort_types.h" -#include "protocols/sf_protocols.h" #include "sfip/ipv6_port.h" #include "sfip/sf_ip.h" #include "sfip/sf_iph.h" +#include "codecs/layer.h" +#include "protocols/ipv4.h" +#include "protocols/ipv6.h" +#include "protocols/tcp.h" +#include "protocols/udp.h" +#include "protocols/eth.h" +#include "protocols/icmp4.h" +#include "protocols/icmp6.h" + + /* D E F I N E S ************************************************************/ /* packet status flags */ @@ -200,6 +210,10 @@ typedef struct _Trh_hdr uint8_t saddr[TR_ALEN]; /* dst address */ } Trh_hdr; +#ifdef WIN32 + /* Visual C++ pragma to enable warning messages about nonstandard bit field type */ + #pragma warning( default : 4214 ) +#endif /* End Token Ring Data Structures */ @@ -424,18 +438,6 @@ typedef struct _EthLlcOther #define SPARC_TWIDDLE 0 #endif -/* - * Ethernet header - */ - -typedef struct _EtherHdr -{ - uint8_t ether_dst[6]; - uint8_t ether_src[6]; - uint16_t ether_type; - -} EtherHdr; - #ifndef NO_NON_ETHER_DECODER /* @@ -497,225 +499,7 @@ typedef struct _WifiHdr #define IP6_EXTMAX 8 #define TCP_OPTLENMAX 40 /* (((2^4) - 1) * 4 - TCP_HEADER_LEN) */ -typedef struct _IPHdr -{ - uint8_t ip_verhl; /* version & header length */ - uint8_t ip_tos; /* type of service */ - uint16_t ip_len; /* datagram length */ - uint16_t ip_id; /* identification */ - uint16_t ip_off; /* fragment offset */ - uint8_t ip_ttl; /* time to live field */ - uint8_t ip_proto; /* datagram protocol */ - uint16_t ip_csum; /* checksum */ - struct in_addr ip_src; /* source IP */ - struct in_addr ip_dst; /* dest IP */ -} IPHdr; - -typedef struct _IPv4Hdr -{ - uint8_t ip_verhl; /* version & header length */ - uint8_t ip_tos; /* type of service */ - uint16_t ip_len; /* datagram length */ - uint16_t ip_id; /* identification */ - uint16_t ip_off; /* fragment offset */ - uint8_t ip_ttl; /* time to live field */ - uint8_t ip_proto; /* datagram protocol */ - uint16_t ip_csum; /* checksum */ - sfip_t ip_src; /* source IP */ - sfip_t ip_dst; /* dest IP */ -} IP4Hdr; - -typedef struct _IPv6Hdr -{ - uint32_t vcl; /* version, class, and label */ - uint16_t len; /* length of the payload */ - uint8_t next; /* next header - * Uses the same flags as - * the IPv4 protocol field */ - uint8_t hop_lmt; /* hop limit */ - sfip_t ip_src; - sfip_t ip_dst; -} IP6Hdr; - -/* IPv6 address */ -#ifndef s6_addr -struct in6_addr -{ - union - { - uint8_t u6_addr8[16]; - uint16_t u6_addr16[8]; - uint32_t u6_addr32[4]; - } in6_u; -#define s6_addr in6_u.u6_addr8 -#define s6_addr16 in6_u.u6_addr16 -#define s6_addr32 in6_u.u6_addr32 -}; -#endif - -typedef struct _IP6RawHdr -{ - uint32_t ip6_vtf; /* 4 bits version, 8 bits TC, - 20 bits flow-ID */ - uint16_t ip6_payload_len; /* payload length */ - uint8_t ip6_next; /* next header */ - uint8_t ip6_hoplim; /* hop limit */ - - struct in6_addr ip6_src; /* source address */ - struct in6_addr ip6_dst; /* destination address */ -} IP6RawHdr; - -#define ip6flow ip6_vtf -#define ip6plen ip6_payload_len -#define ip6nxt ip6_next -#define ip6hlim ip6_hoplim -#define ip6hops ip6_hoplim -#define IPRAW_HDR_VER(p_rawiph) \ - (ntohl(p_rawiph->ip6_vtf) >> 28) - -#define IP6_HDR_LEN 40 - -#ifndef IP_PROTO_HOPOPTS -# define IP_PROTO_HOPOPTS 0 -#endif - -#define IP_PROTO_NONE 59 -#define IP_PROTO_ROUTING 43 -#define IP_PROTO_FRAGMENT 44 -#define IP_PROTO_AH 51 -#define IP_PROTO_DSTOPTS 60 -#define IP_PROTO_ICMPV6 58 -#define IP_PROTO_IPV6 41 -#define IP_PROTO_IPIP 4 - -#define IP6F_OFFSET_MASK 0xfff8 /* mask out offset from _offlg */ -#define IP6F_MF_MASK 0x0001 /* more-fragments flag */ - -#define IP6F_OFFSET(fh) ((ntohs((fh)->ip6f_offlg) & IP6F_OFFSET_MASK) >> 3) -#define IP6F_RES(fh) (fh)->ip6f_reserved -#define IP6F_MF(fh) (ntohs((fh)->ip6f_offlg) & IP6F_MF_MASK ) - -/* to store references to IP6 Extension Headers */ -typedef struct _IP6Option -{ - uint8_t type; - const uint8_t *data; -} IP6Option; - -/* Generic Extension Header */ -typedef struct _IP6Extension -{ - uint8_t ip6e_nxt; - uint8_t ip6e_len; - /* options follow */ - uint8_t ip6e_pad[6]; -} IP6Extension; - -typedef struct _IP6HopByHop -{ - uint8_t ip6hbh_nxt; - uint8_t ip6hbh_len; - /* options follow */ - uint8_t ip6hbh_pad[6]; -} IP6HopByHop; - -typedef struct _IP6Dest -{ - uint8_t ip6dest_nxt; - uint8_t ip6dest_len; - /* options follow */ - uint8_t ip6dest_pad[6]; -} IP6Dest; - -typedef struct _IP6Route -{ - uint8_t ip6rte_nxt; - uint8_t ip6rte_len; - uint8_t ip6rte_type; - uint8_t ip6rte_seg_left; - /* type specific data follows */ -} IP6Route; - -typedef struct _IP6Route0 -{ - uint8_t ip6rte0_nxt; - uint8_t ip6rte0_len; - uint8_t ip6rte0_type; - uint8_t ip6rte0_seg_left; - uint8_t ip6rte0_reserved; - uint8_t ip6rte0_bitmap[3]; - struct in6_addr ip6rte0_addr[1]; /* Up to 23 IP6 addresses */ -} IP6Route0; - -/* Fragment header */ -typedef struct _IP6Frag -{ - uint8_t ip6f_nxt; /* next header */ - uint8_t ip6f_reserved; /* reserved field */ - uint16_t ip6f_offlg; /* offset, reserved, and flag */ - uint32_t ip6f_ident; /* identification */ -} IP6Frag; - -typedef struct _ICMP6 -{ - uint8_t type; - uint8_t code; - uint16_t csum; - -} ICMP6Hdr; - -typedef struct _ICMP6TooBig -{ - uint8_t type; - uint8_t code; - uint16_t csum; - uint32_t mtu; -} ICMP6TooBig; - -typedef struct _ICMP6RouterAdvertisement -{ - uint8_t type; - uint8_t code; - uint16_t csum; - uint8_t num_addrs; - uint8_t addr_entry_size; - uint16_t lifetime; - uint32_t reachable_time; - uint32_t retrans_time; -} ICMP6RouterAdvertisement; - -typedef struct _ICMP6RouterSolicitation -{ - uint8_t type; - uint8_t code; - uint16_t csum; - uint32_t reserved; -} ICMP6RouterSolicitation; - -typedef struct _ICMP6NodeInfo -{ - uint8_t type; - uint8_t code; - uint16_t csum; - uint16_t qtype; - uint16_t flags; - uint64_t nonce; -} ICMP6NodeInfo; - -#define ICMP6_UNREACH 1 -#define ICMP6_BIG 2 -#define ICMP6_TIME 3 -#define ICMP6_PARAMS 4 -#define ICMP6_ECHO 128 -#define ICMP6_REPLY 129 -#define ICMP6_SOLICITATION 133 -#define ICMP6_ADVERTISEMENT 134 -#define ICMP6_NODE_INFO_QUERY 139 -#define ICMP6_NODE_INFO_RESPONSE 140 - -/* Minus 1 due to the 'body' field */ -#define ICMP6_MIN_HEADER_LEN (sizeof(ICMP6Hdr) ) #ifdef _MSC_VER /* Visual C++ pragma to enable warning messages about nonstandard bit field type */ @@ -829,103 +613,6 @@ typedef struct _TCPHdr #endif -typedef struct _UDPHdr -{ - uint16_t uh_sport; - uint16_t uh_dport; - uint16_t uh_len; - uint16_t uh_chk; - -} UDPHdr; - - -typedef struct _ICMPHdr -{ - uint8_t type; - uint8_t code; - uint16_t csum; - union - { - struct - { - uint8_t pptr; - uint8_t pres1; - uint16_t pres2; - } param; - - struct in_addr gwaddr; - - struct idseq - { - uint16_t id; - uint16_t seq; - } idseq; - - uint32_t sih_void; - - struct pmtu - { - uint16_t ipm_void; - uint16_t nextmtu; - } pmtu; - - struct rtradv - { - uint8_t num_addrs; - uint8_t wpa; - uint16_t lifetime; - } rtradv; - } icmp_hun; - -#define s_icmp_pptr icmp_hun.param.pptr -#define s_icmp_gwaddr icmp_hun.gwaddr -#define s_icmp_id icmp_hun.idseq.id -#define s_icmp_seq icmp_hun.idseq.seq -#define s_icmp_void icmp_hun.sih_void -#define s_icmp_pmvoid icmp_hun.pmtu.ipm_void -#define s_icmp_nextmtu icmp_hun.pmtu.nextmtu -#define s_icmp_num_addrs icmp_hun.rtradv.num_addrs -#define s_icmp_wpa icmp_hun.rtradv.wpa -#define s_icmp_lifetime icmp_hun.rtradv.lifetime - - union - { - /* timestamp */ - struct ts - { - uint32_t otime; - uint32_t rtime; - uint32_t ttime; - } ts; - - /* IP header for unreach */ - struct ih_ip - { - IPHdr *ip; - /* options and then 64 bits of data */ - } ip; - - struct ra_addr - { - uint32_t addr; - uint32_t preference; - } radv; - - uint32_t mask; - - char data[1]; - - } icmp_dun; -#define s_icmp_otime icmp_dun.ts.otime -#define s_icmp_rtime icmp_dun.ts.rtime -#define s_icmp_ttime icmp_dun.ts.ttime -#define s_icmp_ip icmp_dun.ih_ip -#define s_icmp_radv icmp_dun.radv -#define s_icmp_mask icmp_dun.mask -#define s_icmp_data icmp_dun.data - -} ICMPHdr; - typedef struct _ARPHdr { @@ -981,7 +668,16 @@ typedef struct _Options const uint8_t *data; } Options; -/* PPPoEHdr Header; EtherHdr plus the PPPoE Header */ + +typedef struct _IpOptions +{ + ipv4::IPOptionCodes code; + uint8_t len; /* length of the data section */ + const uint8_t *data; +} IpOptions; + + +/* PPPoEHdr Header; eth::EtherHdr plus the PPPoE Header */ typedef struct _PPPoEHdr { unsigned char ver_type; /* pppoe version/type */ @@ -1068,7 +764,7 @@ struct Packet //vvv----------------------------- EtherARP *ah; - const EtherHdr *eh; /* standard TCP/IP/Ethernet/ARP headers */ + const eth::EtherHdr *eh; /* standard TCP/IP/Ethernet/ARP headers */ const VlanTagHdr *vh; EthLlc *ehllc; EthLlcOther *ehllcother; @@ -1080,9 +776,9 @@ struct Packet const IPHdr *inner_iph; /* if IP-in-IP, this will be the inner IP header */ const IPHdr *outer_iph; /* if IP-in-IP, this will be the outer IP header */ const TCPHdr *tcph, *orig_tcph; - const UDPHdr *udph, *orig_udph; - const UDPHdr *inner_udph; /* if Teredo + UDP, this will be the inner UDP header */ - const UDPHdr *outer_udph; /* if Teredo + UDP, this will be the outer UDP header */ + const udp::UDPHdr *udph, *orig_udph; + const udp::UDPHdr *inner_udph; /* if Teredo + UDP, this will be the inner UDP header */ + const udp::UDPHdr *outer_udph; /* if Teredo + UDP, this will be the outer UDP header */ const ICMPHdr *icmph, *orig_icmph; const uint8_t *data; /* packet payload pointer */ @@ -1094,9 +790,9 @@ struct Packet void *fragtracker; /* for ip fragmentation tracking info... */ //vvv----------------------------- - IP4Hdr *ip4h, *orig_ip4h; - IP6Hdr *ip6h, *orig_ip6h; - ICMP6Hdr *icmp6h, *orig_icmp6h; + ipv4::IP4Hdr *ip4h, *orig_ip4h; + ipv6::IP6Hdr *ip6h, *orig_ip6h; + icmp6::ICMP6Hdr *icmp6h, *orig_icmp6h; IPH_API* iph_api; IPH_API* orig_iph_api; @@ -1180,7 +876,7 @@ struct Packet #endif // nothing after this point is zeroed ... - Options ip_options[IP_OPTMAX]; /* ip options decode structure */ + IpOptions ip_options[IP_OPTMAX]; /* ip options decode structure */ Options tcp_options[TCP_OPTLENMAX]; /* tcp options decode struct */ IP6Option ip6_extensions[IP6_EXTMAX]; /* IPv6 Extension References */ @@ -1188,13 +884,13 @@ struct Packet const uint8_t *ip_options_data; const uint8_t *tcp_options_data; - const IP6RawHdr* raw_ip6h; // innermost raw ip6 header + const ipv6::IP6RawHdr* raw_ip6h; // innermost raw ip6 header Layer layers[LAYER_MAX]; /* decoded encapsulations */ - IP4Hdr inner_ip4h, inner_orig_ip4h; - IP6Hdr inner_ip6h, inner_orig_ip6h; - IP4Hdr outer_ip4h, outer_orig_ip4h; - IP6Hdr outer_ip6h, outer_orig_ip6h; + ipv4::IP4Hdr inner_ip4h, inner_orig_ip4h; + ipv6::IP6Hdr inner_ip6h, inner_orig_ip6h; + ipv4::IP4Hdr outer_ip4h, outer_orig_ip4h; + ipv6::IP6Hdr outer_ip6h, outer_orig_ip6h; MplsHdr mplsHdr; @@ -1204,6 +900,7 @@ struct Packet /**policyId provided in configuration file. Used for correlating configuration * with event output */ + uint16_t configPolicyId; uint16_t user_policy_id; uint32_t iplist_id; @@ -1228,7 +925,6 @@ struct Packet #define IsIP(p) (IPH_IS_VALID(p)) #define IsTCP(p) (IsIP(p) && p->tcph) -#define IsUDP(p) (IsIP(p) && p->udph) #define IsICMP(p) (IsIP(p) && p->icmph) #define GET_PKT_SEQ(p) (ntohl(p->tcph->th_seq)) @@ -1283,5 +979,39 @@ static inline void SetExtraData (Packet* p, uint32_t xid) p->xtradata_mask |= BIT(xid); } + +// Encoder && Decoder general structs + +typedef struct +{ + uint32_t sip[4], dip[4]; + uint8_t zero; + uint8_t protocol; + uint16_t len; +} pseudoheader6; + + +typedef struct +{ + uint32_t sip, dip; + uint8_t zero; + uint8_t protocol; + uint16_t len; +} pseudoheader; + + +class PacketClass{ + +public: + static + void PushLayer(Packet *p, const Codec *cd, const uint8_t *hdr_start, uint32_t len); + + +private: + + + +}; + #endif diff --git a/src/protocols/tcp.h b/src/protocols/tcp.h new file mode 100644 index 000000000..6c11f9336 --- /dev/null +++ b/src/protocols/tcp.h @@ -0,0 +1,235 @@ +/* +** Copyright (C) 2013-2013 Sourcefire, Inc. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + + +#ifndef TCP_H +#define TCP_H + +#include + + +// these are bits in th_flags: +#define TH_FIN 0x01 +#define TH_SYN 0x02 +#define TH_RST 0x04 +#define TH_PUSH 0x08 +#define TH_ACK 0x10 +#define TH_URG 0x20 +#define TH_ECE 0x40 +#define TH_CWR 0x80 +#define TH_RES2 TH_ECE // TBD TH_RES* should be deleted (see log.c) +#define TH_RES1 TH_CWR +#define TH_NORESERVED (TH_FIN|TH_SYN|TH_RST|TH_PUSH|TH_ACK|TH_URG) + +// these are bits in th_offx2: +#define TH_RSV 0x0E // reserved bits +#define TH_NS 0x01 // ECN nonce bit + + +/* Why are these lil buggers here? Never Used. -- cmg */ +#define TCPOLEN_TSTAMP_APPA (TCPOLEN_TIMESTAMP+2) /* appendix A / rfc 1323 */ +#define TCPOPT_TSTAMP_HDR \ + (TCPOPT_NOP<<24|TCPOPT_NOP<<16|TCPOPT_TIMESTAMP<<8|TCPOLEN_TIMESTAMP) + +/* + * Default maximum segment size for TCP. + * With an IP MSS of 576, this is 536, + * but 512 is probably more convenient. + * This should be defined as MIN(512, IP_MSS - sizeof (struct tcpiphdr)). + */ + +#define TCP_MSS 512 +#define TCP_MAXWIN 65535 /* largest value for (unscaled) window */ +#define TCP_MAX_WINSHIFT 14 /* maximum window shift */ + +/* + * User-settable options (used with setsockopt). + */ +#define TCP_NODELAY 0x01 /* don't delay send to coalesce packets */ +#define TCP_MAXSEG 0x02 /* set maximum segment size */ +#define SOL_TCP 6 /* TCP level */ + + +/* tcp option codes */ +#define TOPT_EOL 0x00 +#define TOPT_NOP 0x01 +#define TOPT_MSS 0x02 +#define TOPT_WS 0x03 +#define TOPT_TS 0x08 + +namespace tcp +{ + +namespace detail +{ + +const uint8_t TCP_HEADER_LEN = 20; + +} // namespace detail + +const int OPT_TRUNC = -1; +const int OPT_BADLEN = -2; + +inline uint8_t header_length() +{ + return detail::TCP_HEADER_LEN; +} + + + +/* http://www.iana.org/assignments/tcp-parameters + * + * tcp options stuff. used to be in but it breaks + * things on AIX + */ + +// enum class TcpOpt{ +enum TcpOpt{ + EOL = 0, /* End of Option List [RFC793] */ + NOP = 1, /* No-Option [RFC793] */ + MAXSEG = 2, /* Maximum Segment Size [RFC793] */ + WSCALE = 3, /* Window scaling option [RFC1323] */ + SACKOK = 4, /* Experimental [RFC2018]*/ + SACK = 5, /* Experimental [RFC2018] variable length */ + ECHO = 6, /* Echo (obsoleted by option 8) [RFC1072] */ + ECHOREPLY = 7, /* Echo Reply (obsoleted by option 8)[RFC1072] */ + TIMESTAMP = 8, /* Timestamp [RFC1323], 10 bytes */ + PARTIAL_PERM = 9, /* Partial Order Permitted/ Experimental [RFC1693] */ + PARTIAL_SVC = 10, /* Partial Order Profile [RFC1693] */ + CC = 11, /* T/TCP Connection count [RFC1644] */ + CC_NEW = 12, /* CC.NEW [RFC1644] */ + CC_ECHO = 13, /* CC.ECHO [RFC1644] */ + + ALTCSUM = 15, /* TCP Alternate Checksum Data [RFC1146], variable length */ + SKEETER = 16, /* Skeeter [Knowles] */ + BUBBA = 17, /* Bubba [Knowles] */ + TRAILER_CSUM = 18, /* Trailer Checksum Option [Subbu & Monroe] */ + MD5SIG = 19, /* MD5 Signature Option [RFC2385] */ + + + /* Space Communications Protocol Standardization */ + SCPS = 20, /* Capabilities [Scott] */ + SELNEGACK = 21, /* Selective Negative Acknowledgements [Scott] */ + RECORDBOUND = 22, /* Record Boundaries [Scott] */ + CORRUPTION = 23, /* Corruption experienced [Scott] */ + SNAP = 24, /* SNAP [Sukonnik] -- anyone have info?*/ + UNASSIGNED = 25, /* Unassigned (released 12/18/00) */ + COMPRESSION = 26, /* TCP Compression Filter [Bellovin] */ + /* http://www.research.att.com/~smb/papers/draft-bellovin-tcpcomp-00.txt*/ + + AUTH = 29, /* [RFC5925] - The TCP Authentication Option + Intended to replace MD5 Signature Option [RFC2385] */ +}; + + +#define TCPOLEN_EOL 1 /* Always one byte */ +#define TCPOLEN_NOP 1 /* Always one byte */ +#define TCPOLEN_MAXSEG 4 /* Always 4 bytes */ +#define TCPOLEN_WSCALE 3 /* 1 byte with logarithmic values */ +#define TCPOLEN_SACKOK 2 +#define TCPOLEN_ECHO 6 /* 6 bytes */ +#define TCPOLEN_ECHOREPLY 6 /* 6 bytes */ +#define TCPOLEN_TIMESTAMP 10 +#define TCPOLEN_PARTIAL_PERM 2 /* Partial Order Permitted/ Experimental [RFC1693] */ +#define TCPOLEN_PARTIAL_SVC 3 /* 3 bytes long -- Experimental */ + +/* atleast decode T/TCP options... */ +#define TCPOLEN_CC 6 /* page 17 of rfc1644 */ +#define TCPOLEN_CC_NEW 6 /* page 17 of rfc1644 */ +#define TCPOLEN_CC_ECHO 6 /* page 17 of rfc1644 */ +#define TCPOLEN_TRAILER_CSUM 3 +#define TCPOLEN_MD5SIG 18 + + + + + + +} // namespace Tcp + + + +/* delete everything from here to the end of the file (excluding the #endif of course) */ + +#define TCPOPT_EOL 0 /* End of Option List [RFC793] */ +#define TCPOLEN_EOL 1 /* Always one byte */ + +#define TCPOPT_NOP 1 /* No-Option [RFC793] */ +#define TCPOLEN_NOP 1 /* Always one byte */ + +#define TCPOPT_MAXSEG 2 /* Maximum Segment Size [RFC793] */ +#define TCPOLEN_MAXSEG 4 /* Always 4 bytes */ + +#define TCPOPT_WSCALE 3 /* Window scaling option [RFC1323] */ +#define TCPOLEN_WSCALE 3 /* 1 byte with logarithmic values */ + +#define TCPOPT_SACKOK 4 /* Experimental [RFC2018]*/ +#define TCPOLEN_SACKOK 2 + +#define TCPOPT_SACK 5 /* Experimental [RFC2018] variable length */ + +#define TCPOPT_ECHO 6 /* Echo (obsoleted by option 8) [RFC1072] */ +#define TCPOLEN_ECHO 6 /* 6 bytes */ + +#define TCPOPT_ECHOREPLY 7 /* Echo Reply (obsoleted by option 8)[RFC1072] */ +#define TCPOLEN_ECHOREPLY 6 /* 6 bytes */ + +#define TCPOPT_TIMESTAMP 8 /* Timestamp [RFC1323], 10 bytes */ +#define TCPOLEN_TIMESTAMP 10 + +#define TCPOPT_PARTIAL_PERM 9 /* Partial Order Permitted/ Experimental [RFC1693] */ +#define TCPOLEN_PARTIAL_PERM 2 /* Partial Order Permitted/ Experimental [RFC1693] */ + +#define TCPOPT_PARTIAL_SVC 10 /* Partial Order Profile [RFC1693] */ +#define TCPOLEN_PARTIAL_SVC 3 /* 3 bytes long -- Experimental */ + +/* atleast decode T/TCP options... */ +#define TCPOPT_CC 11 /* T/TCP Connection count [RFC1644] */ +#define TCPOPT_CC_NEW 12 /* CC.NEW [RFC1644] */ +#define TCPOPT_CC_ECHO 13 /* CC.ECHO [RFC1644] */ +#define TCPOLEN_CC 6 /* page 17 of rfc1644 */ +#define TCPOLEN_CC_NEW 6 /* page 17 of rfc1644 */ +#define TCPOLEN_CC_ECHO 6 /* page 17 of rfc1644 */ + +#define TCPOPT_ALTCSUM 15 /* TCP Alternate Checksum Data [RFC1146], variable length */ +#define TCPOPT_SKEETER 16 /* Skeeter [Knowles] */ +#define TCPOPT_BUBBA 17 /* Bubba [Knowles] */ + +#define TCPOPT_TRAILER_CSUM 18 /* Trailer Checksum Option [Subbu & Monroe] */ +#define TCPOLEN_TRAILER_CSUM 3 + +#define TCPOPT_MD5SIG 19 /* MD5 Signature Option [RFC2385] */ +#define TCPOLEN_MD5SIG 18 + +/* Space Communications Protocol Standardization */ +#define TCPOPT_SCPS 20 /* Capabilities [Scott] */ +#define TCPOPT_SELNEGACK 21 /* Selective Negative Acknowledgements [Scott] */ +#define TCPOPT_RECORDBOUND 22 /* Record Boundaries [Scott] */ +#define TCPOPT_CORRUPTION 23 /* Corruption experienced [Scott] */ + +#define TCPOPT_SNAP 24 /* SNAP [Sukonnik] -- anyone have info?*/ +#define TCPOPT_UNASSIGNED 25 /* Unassigned (released 12/18/00) */ +#define TCPOPT_COMPRESSION 26 /* TCP Compression Filter [Bellovin] */ +/* http://www.research.att.com/~smb/papers/draft-bellovin-tcpcomp-00.txt*/ + +#define TCPOPT_AUTH 29 /* [RFC5925] - The TCP Authentication Option + Intended to replace MD5 Signature Option [RFC2385] */ + + +#endif /* TCP_H */ diff --git a/src/protocols/teredo.h b/src/protocols/teredo.h new file mode 100644 index 000000000..a5fb3badc --- /dev/null +++ b/src/protocols/teredo.h @@ -0,0 +1,84 @@ +/* +** Copyright (C) 2002-2013 Sourcefire, Inc. +** Copyright (C) 1998-2002 Martin Roesch +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + + +#ifndef TEREDO_H +#define TEREDO_H + +#include + + + +namespace teredo +{ + +namespace detail +{ + +const uint16_t TEREDO_ID = 0x0100; +const uint32_t TEREDO_PORT = 3544; +const uint32_t TEREDO_INDICATOR_ORIGIN = 0x00; +const uint32_t TEREDO_INDICATOR_ORIGIN_LEN = 8; +const uint32_t TEREDO_INDICATOR_AUTH = 0x01; +const uint32_t TEREDO_INDICATOR_AUTH_MIN_LEN = 13; +const uint32_t TEREDO_MIN_LEN = 2; + + +} // namespace detail + + +inline uint16_t teredo_id() +{ + return detail::TEREDO_ID; +} + +inline bool is_teredo_port(uint16_t port) +{ + return port == (detail::TEREDO_PORT); +} + +inline uint32_t min_hdr_len() +{ + return detail::TEREDO_MIN_LEN; +} + +inline uint32_t indicator_origin() +{ + return detail::TEREDO_INDICATOR_ORIGIN; +} + +inline uint32_t indicator_origin_len() +{ + return detail::TEREDO_INDICATOR_ORIGIN_LEN; +} + +inline uint32_t inidicator_auth() +{ + return detail::TEREDO_INDICATOR_AUTH; +} + +inline uint32_t min_indicator_auth_len() +{ + return detail::TEREDO_INDICATOR_AUTH_MIN_LEN; +} + +} // namespace teredo + +#endif diff --git a/src/protocols/udp.h b/src/protocols/udp.h new file mode 100644 index 000000000..cf3e5dc7f --- /dev/null +++ b/src/protocols/udp.h @@ -0,0 +1,60 @@ +/* +** Copyright (C) 2002-2013 Sourcefire, Inc. +** Copyright (C) 1998-2002 Martin Roesch +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + + +#ifndef UDP_H +#define UDP_H + +#include + + +/* otherwise defined in /usr/include/ppp_defs.h */ +#define UDP_HEADER_LEN 8 + +#define IsUDP(p) (IsIP(p) && p->udph) + + +namespace udp +{ + +namespace detail +{ +const uint8_t HEADER_LEN = 8; + +} // namespace detail + +struct UDPHdr +{ + uint16_t uh_sport; + uint16_t uh_dport; + uint16_t uh_len; + uint16_t uh_chk; + +}; + +inline uint8_t header_len() +{ + return detail::HEADER_LEN; +} + + +} // namespace + +#endif