mirror of https://github.com/OISF/suricata
PPP Support
Breno Silva
16 years ago
committed by
Victor Julien
parent
1c2240cfeb
commit
dec11038c6
@ -0,0 +1,222 @@
|
||||
/* Copyright (c) 2009 Open Infosec Foundation
|
||||
* Written by Breno Silva Pinto <breno.silva@gmail.com> */
|
||||
|
||||
#include "decode.h"
|
||||
#include "decode-ppp.h"
|
||||
#include "decode-events.h"
|
||||
|
||||
#include "util-unittest.h"
|
||||
|
||||
|
||||
void DecodePPP(ThreadVars *t, Packet *p, u_int8_t *pkt, u_int16_t len, PacketQueue *pq)
|
||||
{
|
||||
|
||||
if(len < PPP_HEADER_LEN) {
|
||||
DECODER_SET_EVENT(p,PPP_PKT_TOO_SMALL);
|
||||
return;
|
||||
}
|
||||
|
||||
p->ppph = (PPPHdr *)pkt;
|
||||
|
||||
if(p->ppph == NULL)
|
||||
return;
|
||||
|
||||
#ifdef DEBUG
|
||||
printf("DecodePPP: p %p pkt %p PPP protocol %04x Len: %d\n", p, pkt, ntohs(p->ppph->protocol), len);
|
||||
#endif
|
||||
|
||||
switch (ntohs(p->ppph->protocol))
|
||||
{
|
||||
case PPP_VJ_COMP:
|
||||
case PPP_IPX:
|
||||
case PPP_OSI:
|
||||
case PPP_NS:
|
||||
case PPP_DECNET:
|
||||
case PPP_APPLE:
|
||||
case PPP_BRPDU:
|
||||
case PPP_STII:
|
||||
case PPP_VINES:
|
||||
case PPP_HELLO:
|
||||
case PPP_LUXCOM:
|
||||
case PPP_SNS:
|
||||
case PPP_MPLS_UCAST:
|
||||
case PPP_MPLS_MCAST:
|
||||
case PPP_IPCP:
|
||||
case PPP_OSICP:
|
||||
case PPP_NSCP:
|
||||
case PPP_DECNETCP:
|
||||
case PPP_APPLECP:
|
||||
case PPP_IPXCP:
|
||||
case PPP_STIICP:
|
||||
case PPP_VINESCP:
|
||||
case PPP_IPV6CP:
|
||||
case PPP_MPLSCP:
|
||||
case PPP_LCP:
|
||||
case PPP_PAP:
|
||||
case PPP_LQM:
|
||||
case PPP_CHAP:
|
||||
break;
|
||||
|
||||
case PPP_VJ_UCOMP:
|
||||
|
||||
if(len < (PPP_HEADER_LEN + IPV4_HEADER_LEN)) {
|
||||
DECODER_SET_EVENT(p,PPPVJU_PKT_TOO_SMALL);
|
||||
return;
|
||||
}
|
||||
|
||||
|
||||
if(IPV4_GET_RAW_VER((IPV4Hdr *)(pkt + PPP_HEADER_LEN)) == 4) {
|
||||
DecodeIPV4(t, p, pkt + PPP_HEADER_LEN, len - PPP_HEADER_LEN, pq );
|
||||
}
|
||||
break;
|
||||
|
||||
case PPP_IP:
|
||||
if(len < (PPP_HEADER_LEN + IPV4_HEADER_LEN)) {
|
||||
DECODER_SET_EVENT(p,PPPIPV4_PKT_TOO_SMALL);
|
||||
return;
|
||||
}
|
||||
|
||||
DecodeIPV4(t, p, pkt + PPP_HEADER_LEN, len - PPP_HEADER_LEN, pq );
|
||||
break;
|
||||
|
||||
/* PPP IPv6 was not tested */
|
||||
case PPP_IPV6:
|
||||
if(len < (PPP_HEADER_LEN + IPV6_HEADER_LEN)) {
|
||||
DECODER_SET_EVENT(p,PPPIPV6_PKT_TOO_SMALL);
|
||||
return;
|
||||
}
|
||||
|
||||
DecodeIPV6(t, p, pkt + PPP_HEADER_LEN, len - PPP_HEADER_LEN);
|
||||
break;
|
||||
|
||||
default:
|
||||
#ifdef DEBUG
|
||||
printf("Unknown PPP protocol: %x\n",ntohs(p->ppph->protocol));
|
||||
#endif
|
||||
DECODER_SET_EVENT(p,PPP_WRONG_TYPE);
|
||||
return;
|
||||
}
|
||||
|
||||
return;
|
||||
}
|
||||
|
||||
/* DecodePPPtest01
|
||||
* Decode malformed ip layer PPP packet
|
||||
* Expected test value: 1
|
||||
*/
|
||||
|
||||
static int DecodePPPtest01 (void) {
|
||||
u_int8_t raw_ppp[] = { 0xff ,0x03 ,0x00 ,0x21 ,0x45 ,0xc0 ,0x00 };
|
||||
Packet p;
|
||||
ThreadVars tv;
|
||||
|
||||
|
||||
memset(&tv, 0, sizeof(ThreadVars));
|
||||
memset(&p, 0, sizeof(Packet));
|
||||
|
||||
DecodePPP(&tv, &p, raw_ppp, sizeof(raw_ppp), NULL);
|
||||
|
||||
/* Function my returns here with expected value */
|
||||
|
||||
if(DECODER_ISSET_EVENT(&p,PPPIPV4_PKT_TOO_SMALL)) {
|
||||
return 1;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* DecodePPPtest02
|
||||
* Decode malformed ppp layer packet
|
||||
* Expected test value: 1
|
||||
*/
|
||||
|
||||
static int DecodePPPtest02 (void) {
|
||||
u_int8_t raw_ppp[] = { 0xff ,0x03 ,0x00 ,0xff ,0x45 ,0xc0 ,0x00 ,0x2c ,0x4d ,0xed ,0x00 ,0x00 ,0xff ,0x06 ,0xd5 ,0x17, 0xbf ,0x01 ,0x0d ,0x01 ,0xbf ,0x01 ,0x0d ,0x03 ,0xea ,0x37 ,0x00 ,0x17 ,0x6d ,0x0b ,0xba ,0xc3, 0x00 ,0x00 ,0x00 ,0x00 ,0x60 ,0x02 ,0x10 ,0x20 ,0xdd ,0xe1 ,0x00 ,0x00};
|
||||
Packet p;
|
||||
ThreadVars tv;
|
||||
|
||||
|
||||
memset(&tv, 0, sizeof(ThreadVars));
|
||||
memset(&p, 0, sizeof(Packet));
|
||||
|
||||
DecodePPP(&tv, &p, raw_ppp, sizeof(raw_ppp), NULL);
|
||||
|
||||
/* Function must returns here */
|
||||
|
||||
if(DECODER_ISSET_EVENT(&p,PPP_WRONG_TYPE)) {
|
||||
return 1;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* DecodePPPtest03
|
||||
* Decode right PPP packet
|
||||
* Expected test value: 1
|
||||
*/
|
||||
|
||||
|
||||
static int DecodePPPtest03 (void) {
|
||||
u_int8_t raw_ppp[] = { 0xff ,0x03 ,0x00 ,0x21 ,0x45 ,0xc0 ,0x00 ,0x2c ,0x4d ,0xed ,0x00 ,0x00 ,0xff ,0x06 ,0xd5 ,0x17, 0xbf ,0x01 ,0x0d ,0x01 ,0xbf ,0x01 ,0x0d ,0x03 ,0xea ,0x37 ,0x00 ,0x17 ,0x6d ,0x0b ,0xba ,0xc3, 0x00 ,0x00 ,0x00 ,0x00 ,0x60 ,0x02 ,0x10 ,0x20 ,0xdd ,0xe1 ,0x00 ,0x00};
|
||||
Packet p;
|
||||
ThreadVars tv;
|
||||
|
||||
|
||||
memset(&tv, 0, sizeof(ThreadVars));
|
||||
memset(&p, 0, sizeof(Packet));
|
||||
|
||||
DecodePPP(&tv, &p, raw_ppp, sizeof(raw_ppp), NULL);
|
||||
|
||||
if(p.ppph == NULL) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
if(DECODER_ISSET_EVENT(&p,PPP_PKT_TOO_SMALL)) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
if(DECODER_ISSET_EVENT(&p,PPPIPV4_PKT_TOO_SMALL)) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
if(DECODER_ISSET_EVENT(&p,PPP_WRONG_TYPE)) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* Function must return here */
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
|
||||
/* DecodePPPtest04
|
||||
* Check if ppp header is null
|
||||
* Expected test value: 1
|
||||
*/
|
||||
|
||||
static int DecodePPPtest04 (void) {
|
||||
u_int8_t raw_ppp[] = { 0xff ,0x03 ,0x00 ,0x21 ,0x45 ,0xc0 ,0x00 ,0x2c ,0x4d ,0xed ,0x00 ,0x00 ,0xff ,0x06 ,0xd5 ,0x17, 0xbf ,0x01 ,0x0d ,0x01 ,0xbf ,0x01 ,0x0d ,0x03 ,0xea ,0x37 ,0x00 ,0x17 ,0x6d ,0x0b ,0xba ,0xc3, 0x00 ,0x00 ,0x00 ,0x00 ,0x60 ,0x02 ,0x10 ,0x20 ,0xdd ,0xe1 ,0x00 ,0x00};
|
||||
Packet p;
|
||||
ThreadVars tv;
|
||||
|
||||
|
||||
memset(&tv, 0, sizeof(ThreadVars));
|
||||
memset(&p, 0, sizeof(Packet));
|
||||
|
||||
DecodePPP(&tv, &p, raw_ppp, sizeof(raw_ppp), NULL);
|
||||
|
||||
if(p.ppph == NULL) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* Function must returns here */
|
||||
|
||||
return 1;
|
||||
}
|
||||
void DecodePPPRegisterTests(void) {
|
||||
UtRegisterTest("DecodePPPtest01", DecodePPPtest01, 1);
|
||||
UtRegisterTest("DecodePPPtest02", DecodePPPtest02, 1);
|
||||
UtRegisterTest("DecodePPPtest03", DecodePPPtest03, 1);
|
||||
UtRegisterTest("DecodePPPtest04", DecodePPPtest04, 1);
|
||||
}
|
||||
|
||||
@ -0,0 +1,56 @@
|
||||
/* Copyright (c) 2009 Open Infosec Foundation
|
||||
* Written by Breno Silva Pinto <breno.silva@gmail.com> */
|
||||
|
||||
#ifndef __DECODE_PPP_H__
|
||||
#define __DECODE_PPP_H__
|
||||
|
||||
/* Point to Point Protocol RFC1331 - Supported tyes */
|
||||
|
||||
#define PPP_IP 0x0021 /* Internet Protocol */
|
||||
#define PPP_IPV6 0x0057 /* Internet Protocol version 6 */
|
||||
#define PPP_VJ_UCOMP 0x002f /* VJ uncompressed TCP/IP */
|
||||
|
||||
/* Unsupported PPP types (libpcap source reference) */
|
||||
|
||||
#define PPP_IPX 0x002b /* Novell IPX Protocol */
|
||||
#define PPP_VJ_COMP 0x002d /* VJ compressed TCP/IP */
|
||||
#define PPP_IPX 0x002b /* Novell IPX Protocol */
|
||||
#define PPP_OSI 0x0023 /* OSI Network Layer */
|
||||
#define PPP_NS 0x0025 /* Xerox NS IDP */
|
||||
#define PPP_DECNET 0x0027 /* DECnet Phase IV */
|
||||
#define PPP_APPLE 0x0029 /* Appletalk */
|
||||
#define PPP_BRPDU 0x0031 /* Bridging PDU */
|
||||
#define PPP_STII 0x0033 /* Stream Protocol (ST-II) */
|
||||
#define PPP_VINES 0x0035 /* Banyan Vines */
|
||||
#define PPP_HELLO 0x0201 /* 802.1d Hello Packets */
|
||||
#define PPP_LUXCOM 0x0231 /* Luxcom */
|
||||
#define PPP_SNS 0x0233 /* Sigma Network Systems */
|
||||
#define PPP_MPLS_UCAST 0x0281 /* rfc 3032 */
|
||||
#define PPP_MPLS_MCAST 0x0283 /* rfc 3022 */
|
||||
#define PPP_IPCP 0x8021 /* IP Control Protocol */
|
||||
#define PPP_OSICP 0x8023 /* OSI Network Layer Control Protocol */
|
||||
#define PPP_NSCP 0x8025 /* Xerox NS IDP Control Protocol */
|
||||
#define PPP_DECNETCP 0x8027 /* DECnet Control Protocol */
|
||||
#define PPP_APPLECP 0x8029 /* Appletalk Control Protocol */
|
||||
#define PPP_IPXCP 0x802b /* Novell IPX Control Protocol */
|
||||
#define PPP_STIICP 0x8033 /* Strean Protocol Control Protocol */
|
||||
#define PPP_VINESCP 0x8035 /* Banyan Vines Control Protocol */
|
||||
#define PPP_IPV6CP 0x8057 /* IPv6 Control Protocol */
|
||||
#define PPP_MPLSCP 0x8281 /* rfc 3022 */
|
||||
#define PPP_LCP 0xc021 /* Link Control Protocol */
|
||||
#define PPP_PAP 0xc023 /* Password Authentication Protocol */
|
||||
#define PPP_LQM 0xc025 /* Link Quality Monitoring */
|
||||
#define PPP_CHAP 0xc223 /* Challenge Handshake Authentication Protocol */
|
||||
|
||||
typedef struct _PPPHdr {
|
||||
u_int8_t address;
|
||||
u_int8_t control;
|
||||
u_int16_t protocol;
|
||||
} PPPHdr;
|
||||
|
||||
#define PPP_HEADER_LEN (sizeof(struct _PPPHdr))
|
||||
|
||||
void DecodePPPRegisterTests(void);
|
||||
|
||||
#endif /* __DECODE_PPP_H__ */
|
||||
|
||||
Loading…
Reference in New Issue