set_project_compiler_defines_if_true (ENABLE_DEBUG "DEBUG")
set_project_compiler_defines_if_true (ENABLE_SOURCEFIRE "PERF_PROFILING")
set_project_compiler_defines_if_true (BUILD_HA "ENABLE_HA")
-set_project_compiler_defines_if_false (ENABLE_NON_ETHER_DECODERS "NO_NON_ETHER_DECODER")
set_project_compiler_defines_if_true (ENABLE_LARGE_PCAP "_LARGEFILE_SOURCE")
set_project_compiler_defines_if_true (ENABLE_LARGE_PCAP "_LARGEFILE64_SOURCE")
set_project_compiler_defines_if_true (ENABLE_LARGE_PCAP "_FILE_OFFSET_BITS=64")
set_if_true (ENABLE_SOURCEFIRE PPM_MGR)
set_if_true (ENABLE_SOURCEFIRE PERF_PROFILING)
set_if_false (ENABLE_COREFILES NOCOREFILE)
-set_if_false (ENABLE_NON_ETHER_DECODERS NO_NON_ETHER_DECODER)
set_if_true (HAVE_INTEL_SOFT_CPM INTEL_SOFT_CPM)
set_if_true (BUILD_UNIT_TESTS UNIT_TEST)
set_if_true (ENABLE_PROFILE PROFILE)
option (ENABLE_SOURCEFIRE "Enable Sourcefire specific build options, encompasing ENABLE_PERFPROFILING and ENABLE_PPM" ON)
option (ENABLE_COREFILES "Prevent Snort from generating core files" ON)
option (BUILD_HA "Enable high-availability state sharing" OFF)
-option (ENABLE_NON_ETHER_DECODERS "Enable non Ethernet decoders" OFF)
option (HAVE_INTEL_SOFT_CPM "Enable Intel Soft CPM support" OFF)
option (ENABLE_LARGE_PCAP "Enable support for pcaps larger than 2 GB" OFF)
option (BUILD_SIDE_CHANNEL "Build the side channel library" OFF)
/* enable ha capable build */
#cmakedefine ENABLE_HA 1
-/* do not build non-ethernet decoders */
-#cmakedefine NO_NON_ETHER_DECODER 1
-
/* enable intel cpm support in build */
#cmakedefine INTEL_SOFT_CPM 1
AC_DEFINE(NOCOREFILE, [1], [do not generate a core file on segfault etc.])
fi
-AC_ARG_ENABLE(non-ether-decoders,
-[ --enable-non-ether-decoders Enable non Ethernet decoders.],
- enable_non_ether_decoders="$enableval", enable_non_ether_decoders="no")
-
-if test "x$enable_non_ether_decoders" = "xno"; then
- CPPFLAGS="$CPPFLAGS -DNO_NON_ETHER_DECODER"
- AC_DEFINE(NO_NON_ETHER_DECODER, [1], [do not build non-ethernet decoders])
-fi
-
-AM_CONDITIONAL(ENABLE_NON_ETHER_DECODER, test "x$enable_non_ether_decoders" = "xyes")
-
AC_ARG_ENABLE(intel_soft_cpm,
[ --enable-intel-soft-cpm Enable Intel Soft CPM support],
enable_intel_soft_cpm="$enableval", enable_intel_soft_cpm="no")
--enable-ha)
append_cache_entry BUILD_HA BOOL true
;;
- --disable-non-ether-decoders)
- append_cache_entry ENABLE_NON_ETHER_DECODERS BOOL false
- ;;
- --enable-non-ether-decoders)
- append_cache_entry ENABLE_NON_ETHER_DECODERS BOOL true
- ;;
--disable-large-pcap)
append_cache_entry ENABLE_LARGE_PCAP BOOL false
;;
{
// yes, macros are necessary. The API and class constructor require different strings.
-#define CD_PIM_NAME "cd_pim"
+#define CD_PIM_NAME "pim"
class PimCodec : public Codec
{
class TrCodec : public Codec
{
public:
- TrCodec() : Codec(CD_TR_NAME){};
+ TrCodec() : Codec(TR_NAME){};
~TrCodec() {};
{
{
PT_CODEC,
- CD_TR_NAME,
+ TR_NAME,
CDAPI_PLUGIN_V0,
0,
mod_ctor,
static const RuleMap tkr_rules[] =
{
- { DECODE_BAD_TRH, "(" CD_TR_NAME ") Bad Token Ring Header" },
- { DECODE_BAD_TR_ETHLLC, "(" CD_TR_NAME ") Bad Token Ring ETHLLC Header" },
- { DECODE_BAD_TR_MR_LEN, "(" CD_TR_NAME ") Bad Token Ring MRLENHeader" },
- { DECODE_BAD_TRHMR, "(" CD_TR_NAME ") Bad Token Ring MR Header" },
+ { DECODE_BAD_TRH, "(" TR_NAME ") Bad Token Ring Header" },
+ { DECODE_BAD_TR_ETHLLC, "(" TR_NAME ") Bad Token Ring ETHLLC Header" },
+ { DECODE_BAD_TR_MR_LEN, "(" TR_NAME ") Bad Token Ring MRLENHeader" },
+ { DECODE_BAD_TRHMR, "(" TR_NAME ") Bad Token Ring MR Header" },
{ 0, nullptr }
};
// token ring module
//-------------------------------------------------------------------------
-TrCodecModule::TrCodecModule() : DecodeModule(CD_TR_NAME, tkr_params)
+TrCodecModule::TrCodecModule() : DecodeModule(TR_NAME, tkr_params)
{ }
const RuleMap* TrCodecModule::get_rules() const
// token_ring_module.h author Josh Rosenbaum <jrosenba@cisco.com>
-#ifndef CD_TRK_MODULE_H
-#define CD_TRK_MODULE_H
+#ifndef CODECS_TOKEN_RING_MODULE_H
+#define CODECS_TOKEN_RING_MODULE_H
#include "codecs/decode_module.h"
-#define CD_TR_NAME "cd_tr"
+#define TR_NAME "token_ring"
class TrCodecModule : public DecodeModule
{
#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"BLACKLIST User-Agent known malicious user agent - SAH Agent"; flow:to_server,established; content:"User-Agent|3A| SAH Agent"; metadata: policy balanced-ips drop, policy connectivity-ips drop, policy security-ips drop, service http; classtype:misc-activity; sid:5808; rev:9;)
-#alert tcp any any -> any 80 ( msg:"Sample rule for Snort++"; http_uri; content:"attack"; sid:1; )
+alert tcp any any -> any 80 ( msg:"Sample rule for Snort++"; http_uri; content:"attack"; sid:1; )
#alert tcp any 80 -> any any ( msg:"Sample rule for Snort++"; http_header:Transfer-Encoding; content:"chunk"; sid:2; )
#alert tcp any 80 -> any any ( msg:"Sample rule for Snort++"; http_header; content:"chunk"; sid:3; )
#alert tcp any any -> any any ( msg:"Sample rule for Snort++"; content:"trigger"; sid:2; )
-alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"FILE-IDENTIFY Microsoft Windows Visual Basic script file download request"; metadata:service http; reference:url,en.wikipedia.org/wiki/Vbs; classtype:misc-activity; sid:18758; rev:8; soid:3|18758;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"FILE-IDENTIFY Microsoft Windows Visual Basic script file download request"; metadata:service http; reference:url,en.wikipedia.org/wiki/Vbs; classtype:misc-activity; sid:18758; rev:8; soid:3|18758;)
]]
network =
)
endif()
+if (STATIC_CODECS)
+ set (STATIC_CODEC_LIBRARIES
+ link_codecs
+ )
+endif()
+
if (BUILD_UNIT_TESTS)
set( UNIT_TESTS_LIBRARIES unit_tests)
add_subdirectory(test)
managers
codecs
root_codecs
- link_codecs
ip_codecs
misc_codecs
+ ${STATIC_CODEC_LIBRARIES}
${STATIC_INSPECTOR_LIBRARIES}
${UNIT_TESTS_LIBRARIES}
${EXTERNAL_LIBRARIES}
target_based/libtarget_based.a \
managers/libmanagers.a \
main/libmain.a \
-parser/libparser.a \
loggers/libloggers.a \
codecs/libcodecs.a \
codecs/ip/libip_codecs.a \
file_api/libfile_api.a \
file_api/libs/libfile.a \
ips_options/libips_options.a \
+parser/libparser.a \
search_engines/libsearch_engines.a \
flow/libflow.a \
control/libcontrol.a \
codec_api.h
codec_api.cc
codec_events.cc
- checksum.h
- checksum.cc
template.cc # for development purposes. Keep the template up to date
)
+if (STATIC_CODECS)
+ set (CODEC_PLUGIN_LIBRARIES
+ link_codecs
+ )
+endif(STATIC_CODECS)
+
target_link_libraries( codecs
+ ${CODEC_PLUGIN_LIBRARIES}
root_codecs
- link_codecs
ip_codecs
misc_codecs
protocols
sf_protocols.h
libcodec_utils_a_SOURCES = \
-codec_events.cc \
-checksum.h \
-checksum.cc
+codec_events.cc
SUBDIRS = \
ip \
+++ /dev/null
-/*
-** Copyright (C) 2002-2013 Sourcefire, Inc.
-** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-// checksum.h author Josh Rosenbaum <jrosenba@cisco.com>
-
-#ifndef CHECKSUM_H
-#define CHECKSUM_H
-
-#ifdef HAVE_CONFIG_H
-#include "config.h"
-#endif
-
-#include <stdint.h>
-#include <stdlib.h>
-#include <cstddef>
-
-
-namespace checksum
-{
-
-struct Pseudoheader6
-{
- uint32_t sip[4], dip[4];
- uint8_t zero;
- uint8_t protocol;
- uint16_t len;
-};
-
-
-struct Pseudoheader
-{
- uint32_t sip, dip;
- uint8_t zero;
- uint8_t protocol;
- uint16_t len;
-};
-
-
-uint16_t cksum_add(const uint16_t *buf, std::size_t len);
-uint16_t tcp_cksum(const uint16_t *buf, std::size_t len, Pseudoheader*);
-uint16_t tcp_cksum(const uint16_t *buf, std::size_t len, Pseudoheader6 *ph );
-uint16_t udp_cksum(const uint16_t *buf, std::size_t len, Pseudoheader*);
-uint16_t udp_cksum(const uint16_t *buf, std::size_t len, Pseudoheader6*);
-uint16_t icmp_cksum(const uint16_t *buf, std::size_t len, Pseudoheader6*);
-uint16_t icmp_cksum(const uint16_t *buf, std::size_t len);
-uint16_t ip_cksum(const uint16_t *buf, std::size_t len);
-
-} // namespace checksum
-
-#endif
\ No newline at end of file
// ip codecs
-extern const BaseApi* cd_ipv4;
-extern const BaseApi* cd_ipv6;
-extern const BaseApi* cd_icmp4;
-extern const BaseApi* cd_icmp6;
-extern const BaseApi* cd_tcp;
-extern const BaseApi* cd_udp;
extern const BaseApi* cd_esp;
+extern const BaseApi* cd_ipv4; // static due to dependence on fpdetect
// link codecs
-extern const BaseApi* cd_arp;
#ifdef STATIC_CODECS
extern const BaseApi* cd_ah;
+extern const BaseApi* cd_arp;
extern const BaseApi* cd_dstopts;
extern const BaseApi* cd_erspan2;
extern const BaseApi* cd_erspan3;
-extern const BaseApi* cd_ethloopback;
extern const BaseApi* cd_frag;
extern const BaseApi* cd_gre;
extern const BaseApi* cd_gtp;
extern const BaseApi* cd_hopopts;
-extern const BaseApi* cd_ip4_embedded_in_icmp;
-extern const BaseApi* cd_ip6_embedded_in_icmp;
-extern const BaseApi* cd_prot_embedded_in_icmp;
+extern const BaseApi* cd_icmp4;
+extern const BaseApi* cd_icmp4_ip;
+extern const BaseApi* cd_icmp6;
+extern const BaseApi* cd_icmp6_ip;
+extern const BaseApi* cd_ipv6;
extern const BaseApi* cd_igmp;
extern const BaseApi* cd_mobility;
extern const BaseApi* cd_mpls;
extern const BaseApi* cd_routing;
extern const BaseApi* cd_sun_nd;
extern const BaseApi* cd_swipe;
+extern const BaseApi* cd_tcp;
extern const BaseApi* cd_teredo;
extern const BaseApi* cd_transbridge;
+extern const BaseApi* cd_udp;
extern const BaseApi* cd_vlan;
// Root codecs
extern const BaseApi* cd_raw4;
extern const BaseApi* cd_raw6;
extern const BaseApi* cd_null;
-
-#ifndef NO_NON_ETHER_DECODER
extern const BaseApi* cd_eapol;
extern const BaseApi* cd_linux_sll;
extern const BaseApi* cd_ppp;
#endif
-#endif
-
const BaseApi* codecs[] =
{
- // non root codeccs
- cd_ipv4,
- cd_ipv6,
- cd_icmp4,
- cd_icmp6,
- cd_tcp,
- cd_udp,
+ // non root codecs
cd_esp,
- cd_arp,
+ cd_ipv4,
#ifdef STATIC_CODECS
cd_ah,
+ cd_arp,
cd_dstopts,
cd_erspan2,
cd_erspan3,
- cd_ethloopback,
cd_frag,
cd_gre,
cd_gtp,
cd_hopopts,
- cd_ip4_embedded_in_icmp,
- cd_ip6_embedded_in_icmp,
- cd_prot_embedded_in_icmp,
+ cd_icmp4,
+ cd_icmp4_ip,
+ cd_icmp6,
+ cd_icmp6_ip,
+ cd_ipv6,
cd_igmp,
cd_mobility,
cd_mpls,
cd_routing,
cd_sun_nd,
cd_swipe,
+ cd_tcp,
cd_teredo,
cd_transbridge,
+ cd_udp,
cd_vlan,
/* root codecs */
cd_raw4,
cd_raw6,
cd_null,
-
-#ifndef NO_NON_ETHER_DECODER
cd_eapol,
cd_linux_sll,
cd_ppp,
cd_wlan,
-#endif
-
#endif
nullptr
if( STATIC_CODECS )
set( PLUGIN_SOURCES
cd_auth.cc
- cd_auth_module.h
- cd_auth_module.cc
- cd_dstopts.cc
+ cd_dst_opts.cc
cd_frag.cc
cd_gre.cc
- cd_gre_module.h
- cd_gre_module.cc
- cd_hopopts.cc
+ cd_hop_opts.cc
cd_icmp4.cc
- cd_icmp4_module.h
- cd_icmp4_module.cc
cd_icmp6.cc
- cd_icmp6_module.h
- cd_icmp6_module.cc
cd_igmp.cc
- cd_igmp_module.h
- cd_igmp_module.cc
- cd_ipv4.cc
- cd_ipv4_module.h
- cd_ipv4_module.cc
cd_ipv6.cc
- cd_ipv6_module.h
- cd_ipv6_module.cc
cd_no_next.cc
cd_mobility.cc
cd_pgm.cc
- cd_pgm_module.h
- cd_pgm_module.cc
cd_routing.cc
cd_sun_nd.cc
cd_swipe.cc
cd_tcp.cc
- cd_tcp_module.h
- cd_tcp_module.cc
cd_udp.cc
- cd_udp_module.h
- cd_udp_module.cc
- ipv6_util.h
- ipv6_util.cc
)
else()
- add_shared_library(cd_auth codecs cd_auth.cc cd_auth_module.h cd_auth_module.cc)
- add_shared_library(cd_dstopts codecs cd_dstopts.cc ipv6_util.h ipv6_util.cc)
+ add_shared_library(cd_auth codecs cd_auth.cc)
+ add_shared_library(cd_dst_opts codecs cd_dst_opts.cc ipv6_util.h ipv6_util.cc)
add_shared_library(cd_frag codecs cd_frag.cc ipv6_util.h ipv6_util.cc)
- add_shared_library(cd_gre codecs cd_gre.cc cd_gre_module.h cd_gre_module.cc)
- add_shared_library(cd_hopopts codecs cd_hopopts.cc ipv6_util.h ipv6_util.cc)
- add_shared_library(cd_icmp4 codecs cd_icmp4.cc cd_icmp4_module.h cd_icmp4_module.cc)
- add_shared_library(cd_icmp6 codecs cd_icmp6.cc cd_icmp6_module.h cd_icmp6_module.cc)
- add_shared_library(cd_igmp codecs cd_igmp.cc cd_igmp_module.h cd_igmp_module.cc)
- add_shared_library(cd_ipv4 codecs cd_ipv4.cc cd_ipv4_module.h cd_ipv4_module.cc)
- add_shared_library(cd_ipv6 codecs cd_ipv6.cc cd_ipv6_module.h cd_ipv6_module.cc ipv6_util.h ipv6_util.cc)
+ add_shared_library(cd_gre codecs cd_gre.cc)
+ add_shared_library(cd_hop_opts codecs cd_hop_opts.cc ipv6_util.h ipv6_util.cc)
+ add_shared_library(cd_icmp4 codecs cd_icmp4.cc checksum.h)
+ add_shared_library(cd_icmp6 codecs cd_icmp6.cc checksum.h)
+ add_shared_library(cd_igmp codecs cd_igmp.cc)
+# add_shared_library(cd_ipv4 codecs cd_ipv4.cc checksum.h)
+ add_shared_library(cd_ipv6 codecs cd_ipv6.cc checksum.h ipv6_util.h ipv6_util.cc)
add_shared_library(cd_mobility codecs cd_mobility.cc)
add_shared_library(cd_no_next codecs cd_no_next.cc ipv6_util.h ipv6_util.cc)
- add_shared_library(cd_pgm codecs cd_pgm.cc cd_pgm_module.h cd_pgm_module.cc)
+ add_shared_library(cd_pgm codecs cd_pgm.cc checksum.h)
add_shared_library(cd_routing codecs cd_routing.cc ipv6_util.h ipv6_util.cc)
add_shared_library(cd_sun_nd codecs cd_sun_nd.cc)
add_shared_library(cd_swipe codecs cd_swipe.cc)
- add_shared_library(cd_tcp codecs cd_tcp.cc cd_tcp_module.h cd_tcp_module.cc)
- add_shared_library(cd_udp codecs cd_udp.cc cd_udp_module.h cd_udp_module.cc)
+ add_shared_library(cd_tcp codecs cd_tcp.cc checksum.h)
+ add_shared_library(cd_udp codecs cd_udp.cc checksum.h)
endif()
add_library( ip_codecs STATIC
cd_esp.cc # statically linked due to its dependance on the packet manager.
- cd_esp_module.h
- cd_esp_module.cc
+ cd_ipv4.cc # Static due to its dependence on fpdetect
+ checksum.h
+ ipv6_util.h
+ ipv6_util.cc # PacketManager
${PLUGIN_SOURCES}
)
noinst_LIBRARIES = libip_codecs.a
libip_codecs_a_SOURCES = \
-cd_icmp4.cc \
-cd_icmp4_module.h \
-cd_icmp4_module.cc \
-cd_icmp6.cc \
-cd_icmp6_module.h \
-cd_icmp6_module.cc \
cd_ipv4.cc \
-cd_ipv4_module.h \
-cd_ipv4_module.cc \
-cd_ipv6.cc \
-cd_ipv6_module.h \
-cd_ipv6_module.cc \
-cd_tcp.cc \
-cd_tcp_module.h \
-cd_tcp_module.cc \
-cd_udp.cc \
-cd_udp_module.h \
-cd_udp_module.cc \
cd_esp.cc \
-cd_esp_module.h \
-cd_esp_module.cc \
ipv6_util.h \
ipv6_util.cc
plugin_list = \
cd_auth.cc \
-cd_auth_module.h \
-cd_auth_module.cc \
-cd_dstopts.cc \
+cd_dst_opts.cc \
cd_frag.cc \
cd_gre.cc \
-cd_gre_module.h \
-cd_gre_module.cc \
-cd_hopopts.cc \
+cd_hop_opts.cc \
+cd_icmp4.cc \
+cd_icmp6.cc \
cd_igmp.cc \
-cd_igmp_module.h \
-cd_igmp_module.cc \
+cd_ipv6.cc \
cd_mobility.cc \
cd_no_next.cc \
cd_pgm.cc \
-cd_pgm_module.h \
-cd_pgm_module.cc \
cd_routing.cc \
cd_sun_nd.cc \
-cd_swipe.cc
+cd_swipe.cc \
+cd_tcp.cc \
+cd_udp.cc \
+checksum.h
if STATIC_CODECS
ehlib_LTLIBRARIES = libcd_auth.la
libcd_auth_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
libcd_auth_la_LDFLAGS = -export-dynamic -shared
-libcd_auth_la_SOURCES = cd_auth.cc cd_auth_module.h cd_auth_module.cc
+libcd_auth_la_SOURCES = cd_auth.cc
ehlib_LTLIBRARIES += libcd_gre.la
libcd_gre_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
libcd_gre_la_LDFLAGS = -export-dynamic -shared
-libcd_gre_la_SOURCES = cd_gre.cc cd_gre_module.h cd_gre_module.cc
+libcd_gre_la_SOURCES = cd_gre.cc
+
+ehlib_LTLIBRARIES += libcd_icmp4.la
+libcd_icmp4_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
+libcd_icmp4_la_LDFLAGS = -export-dynamic -shared
+libcd_icmp4_la_SOURCES = cd_icmp4.cc checksum.h
+
+ehlib_LTLIBRARIES += libcd_icmp6.la
+libcd_icmp6_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
+libcd_icmp6_la_LDFLAGS = -export-dynamic -shared
+libcd_icmp6_la_SOURCES = cd_icmp6.cc checksum.h
ehlib_LTLIBRARIES += libcd_igmp.la
libcd_igmp_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
libcd_igmp_la_LDFLAGS = -export-dynamic -shared
-libcd_igmp_la_SOURCES = cd_igmp.cc cd_igmp_module.h cd_igmp_module.cc
+libcd_igmp_la_SOURCES = cd_igmp.cc
+
+ehlib_LTLIBRARIES += libcd_ipv6.la
+libcd_ipv6_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
+libcd_ipv6_la_LDFLAGS = -export-dynamic -shared
+libcd_ipv6_la_SOURCES = cd_ipv6.cc checksum.h
ehlib_LTLIBRARIES += libcd_mobility.la
libcd_mobility_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
ehlib_LTLIBRARIES += libcd_pgm.la
libcd_pgm_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
libcd_pgm_la_LDFLAGS = -export-dynamic -shared
-libcd_pgm_la_SOURCES = cd_pgm.cc cd_pgm_module.h cd_pgm_module.cc
+libcd_pgm_la_SOURCES = cd_pgm.cc checksum.h
ehlib_LTLIBRARIES += libcd_sun_nd.la
libcd_sun_nd_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
libcd_sun_nd_la_LDFLAGS = -export-dynamic -shared
libcd_sun_nd_la_SOURCES = cd_sun_nd.cc
-ehlib_LTLIBRARIES += libcd_dstopts.la
-libcd_dstopts_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
-libcd_dstopts_la_LDFLAGS = -export-dynamic -shared
-libcd_dstopts_la_SOURCES = cd_dstopts.cc ipv6_util.h ipv6_util.cc
+ehlib_LTLIBRARIES += libcd_dst_opts.la
+libcd_dst_opts_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
+libcd_dst_opts_la_LDFLAGS = -export-dynamic -shared
+libcd_dst_opts_la_SOURCES = cd_dst_opts.cc ipv6_util.h ipv6_util.cc
ehlib_LTLIBRARIES += libcd_frag.la
libcd_frag_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
libcd_frag_la_LDFLAGS = -export-dynamic -shared
libcd_frag_la_SOURCES = cd_frag.cc ipv6_util.h ipv6_util.cc
-ehlib_LTLIBRARIES += libcd_hopopts.la
-libcd_hopopts_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
-libcd_hopopts_la_LDFLAGS = -export-dynamic -shared
-libcd_hopopts_la_SOURCES = cd_hopopts.cc ipv6_util.h ipv6_util.cc
+ehlib_LTLIBRARIES += libcd_hop_opts.la
+libcd_hop_opts_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
+libcd_hop_opts_la_LDFLAGS = -export-dynamic -shared
+libcd_hop_opts_la_SOURCES = cd_hop_opts.cc ipv6_util.h ipv6_util.cc
ehlib_LTLIBRARIES += libcd_no_next.la
libcd_no_next_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
libcd_swipe_la_LDFLAGS = -export-dynamic -shared
libcd_swipe_la_SOURCES = cd_swipe.cc
+ehlib_LTLIBRARIES += libcd_tcp.la
+libcd_tcp_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
+libcd_tcp_la_LDFLAGS = -export-dynamic -shared
+libcd_tcp_la_SOURCES = cd_tcp.cc checksum.h
+
+ehlib_LTLIBRARIES += libcd_udp.la
+libcd_udp_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
+libcd_udp_la_LDFLAGS = -export-dynamic -shared
+libcd_udp_la_SOURCES = cd_udp.cc checksum.h
+
endif
** along with this program; if not, write to the Free Software
** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
-// cd_ah.cc author Josh Rosenbaum <jrosenba@cisco.com>
+// cd_auth.cc author Josh Rosenbaum <jrosenba@cisco.com>
#include "framework/codec.h"
#include "codecs/codec_events.h"
-#include "codecs/ip/cd_auth_module.h"
#include "protocols/protocol_ids.h"
#include "codecs/sf_protocols.h"
namespace
{
-class AhCodec : public Codec
+#define CD_AUTH_NAME "auth"
+
+static const RuleMap auth_rules[] =
+{
+ { DECODE_AUTH_HDR_TRUNC, "(" CD_AUTH_NAME ") Truncated authentication header"},
+ { DECODE_AUTH_HDR_BAD_LEN, "(" CD_AUTH_NAME ") Bad authentication header length"},
+ { 0, nullptr }
+};
+
+class AuthModule : public DecodeModule
+{
+public:
+ AuthModule() : DecodeModule(CD_AUTH_NAME) {}
+
+ const RuleMap* get_rules() const
+ { return auth_rules; }
+};
+
+
+//-------------------------------------------------------------------------
+// auth module
+//-------------------------------------------------------------------------
+
+
+class AuthCodec : public Codec
{
public:
- AhCodec() : Codec(CD_AUTH_NAME){};
- ~AhCodec(){};
+ AuthCodec() : Codec(CD_AUTH_NAME){};
+ ~AuthCodec(){};
virtual PROTO_ID get_proto_id() { return PROTO_AH; };
} // anonymous namespace
-void AhCodec::get_protocol_ids(std::vector<uint16_t>& v)
+void AuthCodec::get_protocol_ids(std::vector<uint16_t>& v)
{
v.push_back(IPPROTO_ID_AH);
}
-bool AhCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
+bool AuthCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
{
static Module* mod_ctor()
{
- return new AhModule;
+ return new AuthModule;
}
static void mod_dtor(Module* m)
static Codec* ctor(Module*)
{
- return new AhCodec();
+ return new AuthCodec();
}
static void dtor(Codec *cd)
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-// cd_ah_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
-
-#include "codecs/ip/cd_auth_module.h"
-
-static const RuleMap ah_rules[] =
-{
- { DECODE_AUTH_HDR_TRUNC, "(" CD_AUTH_NAME ") Truncated authentication header"},
- { DECODE_AUTH_HDR_BAD_LEN, "(" CD_AUTH_NAME ") Bad authentication header length"},
- { 0, nullptr }
-};
-
-//-------------------------------------------------------------------------
-// auth module
-//-------------------------------------------------------------------------
-
-AhModule::AhModule() : DecodeModule(CD_AUTH_NAME)
-{ }
-
-const RuleMap* AhModule::get_rules() const
-{ return ah_rules; }
-
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-// cd_ah_module.h author Josh Rosenbaum <jrosenba@cisco.com>
-
-#ifndef CD_AH_MODULE_H
-#define CD_AH_MODULE_H
-
-#include "codecs/decode_module.h"
-
-
-#define CD_AUTH_NAME "auth"
-
-class AhModule : public DecodeModule
-{
-public:
- AhModule();
-
- const RuleMap* get_rules() const;
-};
-
-#endif
namespace
{
-#define CD_DSTOPTS_NAME "ipv6_dstopts"
+#define CD_DSTOPTS_NAME "ipv6_dst_opts"
class Ipv6DSTOptsCodec : public Codec
{
#include "framework/codec.h"
#include "snort.h"
-#include "codecs/ip/cd_esp_module.h"
#include "managers/packet_manager.h"
#include "codecs/codec_events.h"
#include "protocols/protocol_ids.h"
namespace
{
+
+#define CD_ESP_NAME "esp"
+
+static const RuleMap esp_rules[] =
+{
+ { DECODE_ESP_HEADER_TRUNC, "(" CD_ESP_NAME ") truncated Encapsulated Security Payload (ESP) header" },
+ { 0, nullptr }
+};
+
+
+static const Parameter esp_params[] =
+{
+ { "decode_esp", Parameter::PT_BOOL, nullptr, "false",
+ "enable for inspection of esp traffic that has authentication but not encryption" },
+
+ { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
+};
+
+
+class EspModule : public DecodeModule
+{
+public:
+ EspModule() : DecodeModule(CD_ESP_NAME, esp_params) {}
+
+ const RuleMap* get_rules() const
+ { return esp_rules; }
+
+
+ bool set(const char*, Value& v, SnortConfig* sc)
+ {
+ if ( v.is("decode_esp") )
+ sc->enable_esp = v.get_bool();
+ else
+ return false;
+
+ return true;
+ }
+};
+
+
class EspCodec : public Codec
{
public:
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-// cd_esp_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
-
-#include "codecs/ip/cd_esp_module.h"
-#include "main/snort_config.h"
-
-static const Parameter esp_params[] =
-{
- { "decode_esp", Parameter::PT_BOOL, nullptr, "false",
- "enable for inspection of esp traffic that has authentication but not encryption" },
-
- { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
-};
-
-
-// rules which will loaded into snort.
-// You can now reference these rules by calling a codec_event
-// in your main codec's functions
-static const RuleMap esp_rules[] =
-{
- { DECODE_ESP_HEADER_TRUNC, "(" CD_ESP_NAME ") truncated Encapsulated Security Payload (ESP) header" },
- { 0, nullptr }
-};
-
-//-------------------------------------------------------------------------
-// rpc module
-//-------------------------------------------------------------------------
-
-EspModule::EspModule() : DecodeModule(CD_ESP_NAME, esp_params)
-{ }
-
-const RuleMap* EspModule::get_rules() const
-{ return esp_rules; }
-
-bool EspModule::set(const char*, Value& v, SnortConfig* sc)
-{
- if ( v.is("decode_esp") )
- sc->enable_esp = v.get_bool();
- else
- return false;
-
- return true;
-}
-
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-// cd_esp_module.h author Josh Rosenbaum <jrosenba@cisco.com>
-
-#ifndef CD_ESP_MODULE_H
-#define CD_ESP_MODULE_H
-
-#include "codecs/decode_module.h"
-
-
-#define CD_ESP_NAME "esp"
-
-class EspModule : public DecodeModule
-{
-public:
- EspModule();
-
- const RuleMap* get_rules() const;
- bool set(const char*, Value&, SnortConfig*);
-};
-
-#endif
-
#endif
#include "framework/codec.h"
-#include "codecs/ip/cd_gre_module.h"
#include "codecs/codec_events.h"
#include "protocols/packet.h"
#include "protocols/protocol_ids.h"
namespace
{
+#define CD_GRE_NAME "gre"
+
+static const RuleMap gre_rules[] =
+{
+ { DECODE_GRE_DGRAM_LT_GREHDR, "(" CD_GRE_NAME ") GRE header length > payload length" },
+ { DECODE_GRE_MULTIPLE_ENCAPSULATION, "(" CD_GRE_NAME ") Multiple encapsulations in packet" },
+ { DECODE_GRE_INVALID_VERSION, "(" CD_GRE_NAME ") Invalid GRE version" },
+ { DECODE_GRE_INVALID_HEADER, "(" CD_GRE_NAME ") Invalid GRE header" },
+ { DECODE_GRE_V1_INVALID_HEADER, "(" CD_GRE_NAME ") Invalid GRE v.1 PPTP header" },
+ { DECODE_GRE_TRANS_DGRAM_LT_TRANSHDR, "(" CD_GRE_NAME ") GRE Trans header length > payload length" },
+ { 0, nullptr }
+};
+
+
+class GreModule : public DecodeModule
+{
+public:
+ GreModule() : DecodeModule(CD_GRE_NAME) {}
+
+ const RuleMap* get_rules() const
+ { return gre_rules; }
+};
+
+
+
+
+
class GreCodec : public Codec
{
public:
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-// cd_gre_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
-
-#include "codecs/ip/cd_gre_module.h"
-
-static const RuleMap gre_rules[] =
-{
- { DECODE_GRE_DGRAM_LT_GREHDR, "(" CD_GRE_NAME ") GRE header length > payload length" },
- { DECODE_GRE_MULTIPLE_ENCAPSULATION, "(" CD_GRE_NAME ") Multiple encapsulations in packet" },
- { DECODE_GRE_INVALID_VERSION, "(" CD_GRE_NAME ") Invalid GRE version" },
- { DECODE_GRE_INVALID_HEADER, "(" CD_GRE_NAME ") Invalid GRE header" },
- { DECODE_GRE_V1_INVALID_HEADER, "(" CD_GRE_NAME ") Invalid GRE v.1 PPTP header" },
- { DECODE_GRE_TRANS_DGRAM_LT_TRANSHDR, "(" CD_GRE_NAME ") GRE Trans header length > payload length" },
- { 0, nullptr }
-};
-
-//-------------------------------------------------------------------------
-// rpc module
-//-------------------------------------------------------------------------
-
-GreModule::GreModule() : DecodeModule(CD_GRE_NAME)
-{ }
-
-const RuleMap* GreModule::get_rules() const
-{ return gre_rules; }
-
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-// cd_gre_module.h author Josh Rosenbaum <jrosenba@cisco.com>
-
-#ifndef CD_GRE_MODULE_H
-#define CD_GRE_MODULE_H
-
-#include "codecs/decode_module.h"
-
-
-#define CD_GRE_NAME "gre"
-
-class GreModule : public DecodeModule
-{
-public:
- GreModule();
-
- const RuleMap* get_rules() const;
-};
-
-#endif
namespace
{
-#define CD_HOPOPTS_NAME "ipv6_hopopts"
+#define CD_HOPOPTS_NAME "ipv6_hop_opts"
class Ipv6HopOptsCodec : public Codec
{
#include "snort.h"
#include "protocols/icmp4.h"
#include "codecs/codec_events.h"
-#include "codecs/checksum.h"
+#include "codecs/ip/checksum.h"
#include "protocols/protocol_ids.h"
-#include "codecs/ip/cd_icmp4_module.h"
+#include "codecs/decode_module.h"
#include "codecs/sf_protocols.h"
namespace{
+#define CD_ICMP4_NAME "icmp4"
+
+static const RuleMap icmp4_rules[] =
+{
+ { DECODE_ICMP_DGRAM_LT_ICMPHDR, "(" CD_ICMP4_NAME ") ICMP Header Truncated" },
+ { DECODE_ICMP_DGRAM_LT_TIMESTAMPHDR, "(" CD_ICMP4_NAME ") ICMP Timestamp Header Truncated" },
+ { DECODE_ICMP_DGRAM_LT_ADDRHDR, "(" CD_ICMP4_NAME ") ICMP Address Header Truncated" },
+ { DECODE_ICMP_ORIG_IP_TRUNCATED, "(" CD_ICMP4_NAME ") ICMP Original IP Header Truncated" },
+ { DECODE_ICMP_ORIG_IP_VER_MISMATCH, "(" CD_ICMP4_NAME ") ICMP version and Original IP Header versions differ" },
+ { DECODE_ICMP_ORIG_DGRAM_LT_ORIG_IP, "(" CD_ICMP4_NAME ") ICMP Original Datagram Length < Original IP Header Length" },
+ { DECODE_ICMP_ORIG_PAYLOAD_LT_64, "(" CD_ICMP4_NAME ") ICMP Original IP Payload < 64 bits" },
+ { DECODE_ICMP_ORIG_PAYLOAD_GT_576, "(" CD_ICMP4_NAME ") ICMP Origianl IP Payload > 576 bytes" },
+ { DECODE_ICMP_ORIG_IP_WITH_FRAGOFFSET, "(" CD_ICMP4_NAME ") ICMP Original IP Fragmented and Offset Not 0" },
+ { DECODE_ICMP4_DST_MULTICAST, "(" CD_ICMP4_NAME ") ICMP4 packet to multicast dest address" },
+ { DECODE_ICMP4_DST_BROADCAST, "(" CD_ICMP4_NAME ") ICMP4 packet to broadcast dest address" },
+ { DECODE_ICMP4_TYPE_OTHER, "(" CD_ICMP4_NAME ") ICMP4 type other" },
+ { DECODE_ICMP_PING_NMAP, "(" CD_ICMP4_NAME ") ICMP PING NMAP" },
+ { DECODE_ICMP_ICMPENUM, "(" CD_ICMP4_NAME ") ICMP icmpenum v1.1.1" },
+ { DECODE_ICMP_REDIRECT_HOST, "(" CD_ICMP4_NAME ") ICMP redirect host" },
+ { DECODE_ICMP_REDIRECT_NET, "(" CD_ICMP4_NAME ") ICMP redirect net" },
+ { DECODE_ICMP_TRACEROUTE_IPOPTS, "(" CD_ICMP4_NAME ") ICMP traceroute ipopts" },
+ { DECODE_ICMP_SOURCE_QUENCH, "(" CD_ICMP4_NAME ") ICMP Source Quench" },
+ { DECODE_ICMP_BROADSCAN_SMURF_SCANNER, "(" CD_ICMP4_NAME ") Broadscan Smurf Scanner" },
+ { DECODE_ICMP_DST_UNREACH_ADMIN_PROHIBITED, "(" CD_ICMP4_NAME ") ICMP Destination Unreachable Communication Administratively Prohibited" },
+ { DECODE_ICMP_DST_UNREACH_DST_HOST_PROHIBITED, "(" CD_ICMP4_NAME ") ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited" },
+ { DECODE_ICMP_DST_UNREACH_DST_NET_PROHIBITED, "(" CD_ICMP4_NAME ") ICMP Destination Unreachable Communication with Destination Network is Administratively Prohibited" },
+ { DECODE_ICMP_PATH_MTU_DOS, "(" CD_ICMP4_NAME ") ICMP PATH MTU denial of service attempt" },
+ { DECODE_ICMP_DOS_ATTEMPT, "(" CD_ICMP4_NAME ") BAD-TRAFFIC linux ICMP header dos attempt" },
+ { DECODE_ICMP4_HDR_TRUNC, "(" CD_ICMP4_NAME ") truncated ICMP4 header" },
+ { 0, nullptr }
+};
+
+class Icmp4Module : public DecodeModule
+{
+public:
+ Icmp4Module() : DecodeModule(CD_ICMP4_NAME) {}
+
+ const RuleMap* get_rules() const
+ { return icmp4_rules; }
+};
+
+
class Icmp4Codec : public Codec{
} // namespace
void Icmp4Codec::get_protocol_ids(std::vector<uint16_t> &v)
-{
- v.push_back(IPPROTO_ID_ICMPV4);
-}
+{ v.push_back(IPPROTO_ID_ICMPV4); }
return true;
}
-// TODO: delete
-#if 0
-/*
- * Function: DecodeICMPEmbeddedIP(uint8_t *, const uint32_t, Packet *)
- *
- * Purpose: Decode the ICMP embedded IP header + 64 bits payload
- *
- * Arguments: pkt => ptr to the packet data
- * len => length from here to the end of the packet
- * p => pointer to dummy packet decode struct
- *
- * Returns: void function
- */
-void Icmp4Codec::DecodeICMPEmbeddedIP(const uint8_t *pkt, const uint32_t len, Packet *p)
-{
- uint32_t ip_len; /* length from the start of the ip hdr to the
- * pkt end */
- uint32_t hlen; /* ip header length */
- uint16_t orig_frag_offset;
-
- /* do a little validation */
- if(len < ip::hdr_len())
- {
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
- "ICMP: IP short header (%d bytes)\n", len););
-
- codec_events::decoder_event(p, DECODE_ICMP_ORIG_IP_TRUNCATED);
-
- p->orig_family = NO_IP;
- p->orig_iph = NULL;
- return;
- }
-
- /* lay the IP struct over the raw data */
- sfiph_orig_build(p, pkt, AF_INET);
- p->orig_iph = (IPHdr *) pkt;
-
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "DecodeICMPEmbeddedIP: ip header"
- " starts at: %p, length is %lu\n", p->orig_iph,
- (unsigned long) len););
- /*
- * with datalink DLT_RAW it's impossible to differ ARP datagrams from IP.
- * So we are just ignoring non IP datagrams
- */
- if((GET_ORIG_IPH_VER(p) != 4) && !IS_IP6(p))
- {
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
- "ICMP: not IPv4 datagram ([ver: 0x%x][len: 0x%x])\n",
- GET_ORIG_IPH_VER(p), GET_ORIG_IPH_LEN(p)););
-
- codec_events::decoder_event(p, DECODE_ICMP_ORIG_IP_VER_MISMATCH);
-
- p->orig_family = NO_IP;
- p->orig_iph = NULL;
- return;
- }
-
- /* set the IP datagram length */
- ip_len = ntohs(GET_ORIG_IPH_LEN(p));
-
- /* set the IP header length */
- hlen = (p->orig_iph->ip_verhl & 0x0f) << 2;
-
- if(len < hlen)
- {
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
- "ICMP: IP len (%d bytes) < IP hdr len (%d bytes), packet discarded\n",
- ip_len, hlen););
-
- codec_events::decoder_event(p, DECODE_ICMP_ORIG_DGRAM_LT_ORIG_IP);
-
- p->orig_family = NO_IP;
- p->orig_iph = NULL;
- return;
- }
-
- /* set the remaining packet length */
- ip_len = len - hlen;
-
- orig_frag_offset = ntohs(GET_ORIG_IPH_OFF(p));
- orig_frag_offset &= 0x1FFF;
-
- if (orig_frag_offset == 0)
- {
- /* Original IP payload should be 64 bits */
- if (ip_len < 8)
- {
- codec_events::decoder_event(p, DECODE_ICMP_ORIG_PAYLOAD_LT_64);
-
- return;
- }
- /* ICMP error packets could contain as much of original payload
- * as possible, but not exceed 576 bytes
- */
- else if (ntohs(GET_IPH_LEN(p)) > 576)
- {
- codec_events::decoder_event(p, DECODE_ICMP_ORIG_PAYLOAD_GT_576);
- }
- }
- else
- {
- /* RFC states that only first frag will get an ICMP response */
- codec_events::decoder_event(p, DECODE_ICMP_ORIG_IP_WITH_FRAGOFFSET);
- return;
- }
-
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "ICMP Unreachable IP header length: "
- "%lu\n", (unsigned long)hlen););
-
- switch(GET_ORIG_IPH_PROTO(p))
- {
- case IPPROTO_TCP: /* decode the interesting part of the header */
- p->orig_tcph = (TCPHdr *)(pkt + hlen);
-
- /* stuff more data into the printout data struct */
- p->orig_sp = ntohs(p->orig_tcph->th_sport);
- p->orig_dp = ntohs(p->orig_tcph->th_dport);
-
- break;
-
- case IPPROTO_UDP:
- p->orig_udph = (udp::UDPHdr *)(pkt + hlen);
-
- /* fill in the printout data structs */
- p->orig_sp = ntohs(p->orig_udph->uh_sport);
- p->orig_dp = ntohs(p->orig_udph->uh_dport);
-
- break;
-
- case IPPROTO_ICMP:
- p->orig_icmph = (ICMPHdr *)(pkt + hlen);
- break;
- }
-
- return;
-}
-#endif
-
void Icmp4Codec::ICMP4AddrTests(Packet* p)
{
uint8_t msb_dst;
};
+#ifdef BUILDING_SO
+SO_PUBLIC const BaseApi* snort_plugins[] =
+{
+ &icmp4_api.base,
+ nullptr
+};
+#else
const BaseApi* cd_icmp4 = &icmp4_api.base;
-
+#endif
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-// cd_icmp4_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
-
-#include "codecs/ip/cd_icmp4_module.h"
-
-// rules which will loaded into snort.
-// You can now reference these rules by calling a codec_event
-// in your main codec's functions
-static const RuleMap icmp4_rules[] =
-{
- { DECODE_ICMP_DGRAM_LT_ICMPHDR, "(" CD_ICMP4_NAME ") ICMP Header Truncated" },
- { DECODE_ICMP_DGRAM_LT_TIMESTAMPHDR, "(" CD_ICMP4_NAME ") ICMP Timestamp Header Truncated" },
- { DECODE_ICMP_DGRAM_LT_ADDRHDR, "(" CD_ICMP4_NAME ") ICMP Address Header Truncated" },
- { DECODE_ICMP_ORIG_IP_TRUNCATED, "(" CD_ICMP4_NAME ") ICMP Original IP Header Truncated" },
- { DECODE_ICMP_ORIG_IP_VER_MISMATCH, "(" CD_ICMP4_NAME ") ICMP version and Original IP Header versions differ" },
- { DECODE_ICMP_ORIG_DGRAM_LT_ORIG_IP, "(" CD_ICMP4_NAME ") ICMP Original Datagram Length < Original IP Header Length" },
- { DECODE_ICMP_ORIG_PAYLOAD_LT_64, "(" CD_ICMP4_NAME ") ICMP Original IP Payload < 64 bits" },
- { DECODE_ICMP_ORIG_PAYLOAD_GT_576, "(" CD_ICMP4_NAME ") ICMP Origianl IP Payload > 576 bytes" },
- { DECODE_ICMP_ORIG_IP_WITH_FRAGOFFSET, "(" CD_ICMP4_NAME ") ICMP Original IP Fragmented and Offset Not 0" },
- { DECODE_ICMP4_DST_MULTICAST, "(" CD_ICMP4_NAME ") ICMP4 packet to multicast dest address" },
- { DECODE_ICMP4_DST_BROADCAST, "(" CD_ICMP4_NAME ") ICMP4 packet to broadcast dest address" },
- { DECODE_ICMP4_TYPE_OTHER, "(" CD_ICMP4_NAME ") ICMP4 type other" },
- { DECODE_ICMP_PING_NMAP, "(" CD_ICMP4_NAME ") ICMP PING NMAP" },
- { DECODE_ICMP_ICMPENUM, "(" CD_ICMP4_NAME ") ICMP icmpenum v1.1.1" },
- { DECODE_ICMP_REDIRECT_HOST, "(" CD_ICMP4_NAME ") ICMP redirect host" },
- { DECODE_ICMP_REDIRECT_NET, "(" CD_ICMP4_NAME ") ICMP redirect net" },
- { DECODE_ICMP_TRACEROUTE_IPOPTS, "(" CD_ICMP4_NAME ") ICMP traceroute ipopts" },
- { DECODE_ICMP_SOURCE_QUENCH, "(" CD_ICMP4_NAME ") ICMP Source Quench" },
- { DECODE_ICMP_BROADSCAN_SMURF_SCANNER, "(" CD_ICMP4_NAME ") Broadscan Smurf Scanner" },
- { DECODE_ICMP_DST_UNREACH_ADMIN_PROHIBITED, "(" CD_ICMP4_NAME ") ICMP Destination Unreachable Communication Administratively Prohibited" },
- { DECODE_ICMP_DST_UNREACH_DST_HOST_PROHIBITED, "(" CD_ICMP4_NAME ") ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited" },
- { DECODE_ICMP_DST_UNREACH_DST_NET_PROHIBITED, "(" CD_ICMP4_NAME ") ICMP Destination Unreachable Communication with Destination Network is Administratively Prohibited" },
- { DECODE_ICMP_PATH_MTU_DOS, "(" CD_ICMP4_NAME ") ICMP PATH MTU denial of service attempt" },
- { DECODE_ICMP_DOS_ATTEMPT, "(" CD_ICMP4_NAME ") BAD-TRAFFIC linux ICMP header dos attempt" },
- { DECODE_ICMP4_HDR_TRUNC, "(" CD_ICMP4_NAME ") truncated ICMP4 header" },
- { 0, nullptr }
-};
-
-//-------------------------------------------------------------------------
-// rpc module
-//-------------------------------------------------------------------------
-
-Icmp4Module::Icmp4Module() : DecodeModule(CD_ICMP4_NAME)
-{ }
-
-const RuleMap* Icmp4Module::get_rules() const
-{ return icmp4_rules; }
-
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-// cd_icmp4_module.h author Josh Rosenbaum <jrosenba@cisco.com>
-
-#ifndef CD_ICMP4_MODULE_H
-#define CD_ICMP4_MODULE_H
-
-#include "codecs/decode_module.h"
-
-
-#define CD_ICMP4_NAME "icmp4"
-
-class Icmp4Module : public DecodeModule
-{
-public:
- Icmp4Module();
-
- const RuleMap* get_rules() const;
-};
-
-#endif
-
** along with this program; if not, write to the Free Software
** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
+// cd_icmp6.cc author Josh Rosenbaum <jrosenba@cisco.com>
#include "framework/codec.h"
#include "codecs/decode_module.h"
#include "codecs/codec_events.h"
-#include "codecs/checksum.h"
+#include "codecs/ip/checksum.h"
#include "protocols/icmp6.h"
#include "protocols/icmp4.h"
-#include "codecs/ip/cd_icmp6_module.h"
+#include "codecs/decode_module.h"
#include "codecs/sf_protocols.h"
namespace
{
+#define CD_ICMP6_NAME "icmp6"
+static const RuleMap icmp6_rules[] =
+{
+ { DECODE_ICMP6_HDR_TRUNC, "(" CD_ICMP6_NAME ") truncated ICMP6 header" },
+ { DECODE_ICMP6_TYPE_OTHER, "(" CD_ICMP6_NAME ") ICMP6 type not decoded" },
+ { DECODE_ICMP6_DST_MULTICAST, "(" CD_ICMP6_NAME ") ICMP6 packet to multicast address" },
+ { DECODE_ICMPV6_TOO_BIG_BAD_MTU, "(" CD_ICMP6_NAME ") ICMPv6 packet of type 2 (message too big) with MTU field < 1280" },
+ { DECODE_ICMPV6_UNREACHABLE_NON_RFC_2463_CODE, "(" CD_ICMP6_NAME ") ICMPv6 packet of type 1 (destination unreachable) with non-RFC 2463 code" },
+ { DECODE_ICMPV6_SOLICITATION_BAD_CODE, "(" CD_ICMP6_NAME ") ICMPv6 router solicitation packet with a code not equal to 0" },
+ { DECODE_ICMPV6_ADVERT_BAD_CODE, "(" CD_ICMP6_NAME ") ICMPv6 router advertisement packet with a code not equal to 0" },
+ { DECODE_ICMPV6_SOLICITATION_BAD_RESERVED, "(" CD_ICMP6_NAME ") ICMPv6 router solicitation packet with the reserved field not equal to 0" },
+ { DECODE_ICMPV6_ADVERT_BAD_REACHABLE, "(" CD_ICMP6_NAME ") ICMPv6 router advertisement packet with the reachable time field set > 1 hour" },
+ { DECODE_ICMPV6_UNREACHABLE_NON_RFC_4443_CODE, "(" CD_ICMP6_NAME ") ICMPv6 packet of type 1 (destination unreachable) with non-RFC 4443 code" },
+ { DECODE_ICMPV6_NODE_INFO_BAD_CODE, "(" CD_ICMP6_NAME ") ICMPv6 node info query/response packet with a code greater than 2" },
+ { 0, nullptr }
+};
+
+class Icmp6Module : public DecodeModule
+{
+public:
+ Icmp6Module() : DecodeModule(CD_ICMP6_NAME) {}
+
+ const RuleMap* get_rules() const
+ { return icmp6_rules; }
+};
+
+
class Icmp6Codec : public Codec
{
public:
}
-// TODO: delete (along with any mention of this function)
-
-#if 0
-
-/*
- * Function: DecodeICMPEmbeddedIP6(uint8_t *, const uint32_t, Packet *)
- *
- * Purpose: Decode the ICMP embedded IP6 header + payload
- *
- * Arguments: pkt => ptr to the packet data
- * len => length from here to the end of the packet
- * p => pointer to dummy packet decode struct
- *
- * Returns: void function
- */
-static void DecodeICMPEmbeddedIP6(const uint8_t *pkt, const uint32_t len, Packet *p)
-{
-// uint16_t orig_frag_offset;
-
- /* lay the IP struct over the raw data */
- const ip::IP6RawHdr* hdr = reinterpret_cast<const ip::IP6RawHdr*>(pkt);
-
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "DecodeICMPEmbeddedIP6: ip header"
- " starts at: %p, length is %lu\n", hdr,
- (unsigned long) len););
-
- /* do a little validation */
- if ( len < ip::hdr_len() )
- {
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
- "ICMP6: IP short header (%d bytes)\n", len););
-
- codec_events::decoder_event(p, DECODE_ICMP_ORIG_IP_TRUNCATED);
-
- return;
- }
-
- /*
- * with datalink DLT_RAW it's impossible to differ ARP datagrams from IP.
- * So we are just ignoring non IP datagrams
- */
- if(hdr->get_ver() != 6)
- {
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
- "ICMP: not IPv6 datagram ([ver: 0x%x][len: 0x%x])\n",
- hdr->get_ver(), len););
-
- codec_events::decoder_event(p, DECODE_ICMP_ORIG_IP_VER_MISMATCH);
-
- return;
- }
-
- if ( len < ip::hdr_len() )
- {
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
- "ICMP6: IP6 len (%d bytes) < IP6 hdr len (%d bytes), packet discarded\n",
- len, ip::hdr_len()););
-
- codec_events::decoder_event(p, DECODE_ICMP_ORIG_DGRAM_LT_ORIG_IP);
-
- return;
- }
- sfiph_orig_build(p, pkt, AF_INET6);
-
-// orig_frag_offset = ntohs(GET_ORIG_IPH_OFF(p));
-// orig_frag_offset &= 0x1FFF;
-
- // XXX NOT YET IMPLEMENTED - fragments inside ICMP payload
-
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "ICMP6 Unreachable IP6 header length: "
- "%lu\n", (unsigned long)ip::hdr_len()););
-
- switch(GET_ORIG_IPH_PROTO(p))
- {
- case IPPROTO_TCP: /* decode the interesting part of the header */
- p->orig_tcph = (TCPHdr *)(pkt + ip::hdr_len());
-
- /* stuff more data into the printout data struct */
- p->orig_sp = ntohs(p->orig_tcph->th_sport);
- p->orig_dp = ntohs(p->orig_tcph->th_dport);
-
- break;
-
- case IPPROTO_UDP:
- p->orig_udph = (udp::UDPHdr *)(pkt + ip::hdr_len());
-
- /* fill in the printout data structs */
- p->orig_sp = ntohs(p->orig_udph->uh_sport);
- p->orig_dp = ntohs(p->orig_udph->uh_dport);
-
- break;
-
- case IPPROTO_ICMP:
- p->orig_icmph = (ICMPHdr *)(pkt + ip::hdr_len());
- break;
- }
-
- return;
-}
-
-#endif
-
-
/******************************************************************
******************** E N C O D E R ******************************
******************************************************************/
// Now performed in cd_ip6_embedded_in_icmp.cc
// TBD should be able to elminate enc->ip_hdr by using layer-2
memcpy(out->base, enc->ip_hdr, enc->ip_len);
- ((ip::IP6RawHdr*)out->base)->ip6_next = IPPROTO_UDP;
+ ((ip::IP6Hdr*)out->base)->ip6_next = IPPROTO_UDP;
#endif
enc->proto = IPPROTO_ICMPV6;
int len = buff_diff(out, (uint8_t *)ho);
- const ip::IP6RawHdr* const ip6h = enc->p->ip_api.get_ip6h();
+ const ip::IP6Hdr* const ip6h = enc->p->ip_api.get_ip6h();
memcpy(ps6.sip, ip6h->ip6_src.u6_addr8, sizeof(ps6.sip));
memcpy(ps6.dip, ip6h->ip6_dst.u6_addr8, sizeof(ps6.dip));
};
+#ifdef BUILDING_SO
+SO_PUBLIC const BaseApi* snort_plugins[] =
+{
+ &ipv6_api.base,
+ nullptr
+};
+#else
const BaseApi* cd_icmp6 = &ipv6_api.base;
+#endif
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-// cd_icmp6_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
-
-#include "codecs/ip/cd_icmp6_module.h"
-
-// rules which will loaded into snort.
-// You can now reference these rules by calling a codec_event
-// in your main codec's functions
-static const RuleMap icmp6_rules[] =
-{
- { DECODE_ICMP6_HDR_TRUNC, "(" CD_ICMP6_NAME ") truncated ICMP6 header" },
- { DECODE_ICMP6_TYPE_OTHER, "(" CD_ICMP6_NAME ") ICMP6 type not decoded" },
- { DECODE_ICMP6_DST_MULTICAST, "(" CD_ICMP6_NAME ") ICMP6 packet to multicast address" },
- { DECODE_ICMPV6_TOO_BIG_BAD_MTU, "(" CD_ICMP6_NAME ") ICMPv6 packet of type 2 (message too big) with MTU field < 1280" },
- { DECODE_ICMPV6_UNREACHABLE_NON_RFC_2463_CODE, "(" CD_ICMP6_NAME ") ICMPv6 packet of type 1 (destination unreachable) with non-RFC 2463 code" },
- { DECODE_ICMPV6_SOLICITATION_BAD_CODE, "(" CD_ICMP6_NAME ") ICMPv6 router solicitation packet with a code not equal to 0" },
- { DECODE_ICMPV6_ADVERT_BAD_CODE, "(" CD_ICMP6_NAME ") ICMPv6 router advertisement packet with a code not equal to 0" },
- { DECODE_ICMPV6_SOLICITATION_BAD_RESERVED, "(" CD_ICMP6_NAME ") ICMPv6 router solicitation packet with the reserved field not equal to 0" },
- { DECODE_ICMPV6_ADVERT_BAD_REACHABLE, "(" CD_ICMP6_NAME ") ICMPv6 router advertisement packet with the reachable time field set > 1 hour" },
- { DECODE_ICMPV6_UNREACHABLE_NON_RFC_4443_CODE, "(" CD_ICMP6_NAME ") ICMPv6 packet of type 1 (destination unreachable) with non-RFC 4443 code" },
- { DECODE_ICMPV6_NODE_INFO_BAD_CODE, "(" CD_ICMP6_NAME ") ICMPv6 node info query/response packet with a code greater than 2" },
- { 0, nullptr }
-};
-
-//-------------------------------------------------------------------------
-// rpc module
-//-------------------------------------------------------------------------
-
-Icmp6Module::Icmp6Module() : DecodeModule(CD_ICMP6_NAME)
-{ }
-
-const RuleMap* Icmp6Module::get_rules() const
-{ return icmp6_rules; }
-
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-// cd_icmp6_module.h author Josh Rosenbaum <jrosenba@cisco.com>
-
-#ifndef CD_ICMP6_MODULE_H
-#define CD_ICMP6_MODULE_H
-
-#include "codecs/decode_module.h"
-
-
-#define CD_ICMP6_NAME "icmp6"
-
-class Icmp6Module : public DecodeModule
-{
-public:
- Icmp6Module();
-
- const RuleMap* get_rules() const;
-};
-
-#endif
** along with this program; if not, write to the Free Software
** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
+// cd_igmp.cc author Josh Rosenbaum <jrosenba@cisco.com>
#endif
#include "framework/codec.h"
-#include "codecs/ip/cd_igmp_module.h"
+#include "codecs/decode_module.h"
#include "codecs/codec_events.h"
namespace
{
+
+#define CD_IGMP_NAME "igmp"
+
+static const RuleMap igmp_rules[] =
+{
+ { DECODE_IGMP_OPTIONS_DOS, "(" CD_IGMP_NAME ") DOS IGMP IP Options validation attempt" },
+ { 0, nullptr }
+};
+
+
+class IgmpModule : public DecodeModule
+{
+public:
+ IgmpModule() : DecodeModule(CD_IGMP_NAME) {}
+
+ const RuleMap* get_rules() const
+ { return igmp_rules; }
+};
+
+
+
class IgmpCodec : public Codec
{
public:
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-// cd_igmp_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
-
-#include "codecs/ip/cd_igmp_module.h"
-
-static const RuleMap igmp_rules[] =
-{
- { DECODE_IGMP_OPTIONS_DOS, "(" CD_IGMP_NAME ") DOS IGMP IP Options validation attempt" },
- { 0, nullptr }
-};
-
-//-------------------------------------------------------------------------
-// rpc module
-//-------------------------------------------------------------------------
-
-IgmpModule::IgmpModule() : DecodeModule(CD_IGMP_NAME)
-{ }
-
-const RuleMap* IgmpModule::get_rules() const
-{ return igmp_rules; }
-
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-// cd_igmp_module.h author Josh Rosenbaum <jrosenba@cisco.com>
-
-#ifndef CD_IGMP_MODULE_H
-#define CD_IGMP_MODULE_H
-
-#include "codecs/decode_module.h"
-
-
-#define CD_IGMP_NAME "igmp"
-
-class IgmpModule : public DecodeModule
-{
-public:
- IgmpModule();
-
- const RuleMap* get_rules() const;
-};
-
-#endif
#include "utils/stats.h"
#include "packet_io/active.h"
-#include "codecs/decode_module.h"
#include "codecs/codec_events.h"
-#include "codecs/checksum.h"
+#include "codecs/ip/checksum.h"
#include "main/thread.h"
#include "stream/stream_api.h"
-#include "codecs/ip/cd_ipv4_module.h"
+#include "codecs/decode_module.h"
#include "codecs/sf_protocols.h"
#include "protocols/ip.h"
namespace{
+#define CD_IPV4_NAME "ipv4"
+static const RuleMap ipv4_rules[] =
+{
+ { DECODE_NOT_IPV4_DGRAM, "(" CD_IPV4_NAME ") Not IPv4 datagram" },
+ { DECODE_IPV4_INVALID_HEADER_LEN, "(" CD_IPV4_NAME ") hlen < IP_HEADER_LEN" },
+ { DECODE_IPV4_DGRAM_LT_IPHDR, "(" CD_IPV4_NAME ") IP dgm len < IP Hdr len" },
+ { DECODE_IPV4OPT_BADLEN, "(" CD_IPV4_NAME ") Ipv4 Options found with bad lengths" },
+ { DECODE_IPV4OPT_TRUNCATED, "(" CD_IPV4_NAME ") Truncated Ipv4 Options" },
+ { DECODE_IPV4_DGRAM_GT_CAPLEN, "(" CD_IPV4_NAME ") IP dgm len > captured len" },
+ { DECODE_ZERO_TTL, "(" CD_IPV4_NAME ") IPV4 packet with zero TTL" },
+ { DECODE_BAD_FRAGBITS, "(" CD_IPV4_NAME ") IPV4 packet with bad frag bits (Both MF and DF set)" },
+ { DECODE_IP4_LEN_OFFSET, "(" CD_IPV4_NAME ") IPV4 packet frag offset + length exceed maximum" },
+ { DECODE_IP4_SRC_THIS_NET, "(" CD_IPV4_NAME ") IPV4 packet from 'current net' source address" },
+ { DECODE_IP4_DST_THIS_NET, "(" CD_IPV4_NAME ") IPV4 packet to 'current net' dest address" },
+ { DECODE_IP4_SRC_MULTICAST, "(" CD_IPV4_NAME ") IPV4 packet from multicast source address" },
+ { DECODE_IP4_SRC_RESERVED, "(" CD_IPV4_NAME ") IPV4 packet from reserved source address" },
+ { DECODE_IP4_DST_RESERVED, "(" CD_IPV4_NAME ") IPV4 packet to reserved dest address" },
+ { DECODE_IP4_SRC_BROADCAST, "(" CD_IPV4_NAME ") IPV4 packet from broadcast source address" },
+ { DECODE_IP4_DST_BROADCAST, "(" CD_IPV4_NAME ") IPV4 packet to broadcast dest address" },
+ { DECODE_IP4_MIN_TTL, "(" CD_IPV4_NAME ") IPV4 packet below TTL limit" },
+ { DECODE_IP4_DF_OFFSET, "(" CD_IPV4_NAME ") IPV4 packet both DF and offset set" },
+ { DECODE_IP_RESERVED_FRAG_BIT, "(" CD_IPV4_NAME ") BAD-TRAFFIC IP reserved bit set" },
+ { DECODE_IP_UNASSIGNED_PROTO, "(" CD_IPV4_NAME ") BAD-TRAFFIC Unassigned/Reserved IP protocol" },
+ { DECODE_IP_BAD_PROTO, "(" CD_IPV4_NAME ") BAD-TRAFFIC Bad IP protocol" },
+ { DECODE_IP_OPTION_SET, "(" CD_IPV4_NAME ") MISC IP option set" },
+ { DECODE_IP_MULTIPLE_ENCAPSULATION, "(" CD_IPV4_NAME ") Two or more IP (v4 and/or v6) encapsulation layers present" },
+ { DECODE_ZERO_LENGTH_FRAG, "(" CD_IPV4_NAME ") fragment with zero length" },
+ { DECODE_IP4_HDR_TRUNC, "(" CD_IPV4_NAME ") truncated IP4 header" },
+ { DECODE_BAD_TRAFFIC_LOOPBACK, "(" CD_IPV4_NAME ") Bad Traffic Loopback IP" },
+ { DECODE_BAD_TRAFFIC_SAME_SRCDST, "(" CD_IPV4_NAME ") Bad Traffic Same Src/Dst IP" },
+ { 0, nullptr }
+};
+
+class Ipv4Module : public DecodeModule
+{
+public:
+ Ipv4Module() : DecodeModule(CD_IPV4_NAME) {}
+
+ const RuleMap* get_rules() const
+ { return ipv4_rules; }
+};
+
+
+
class Ipv4Codec : public Codec
{
public:
} // namespace
-static inline void IP4AddrTests (const IPHdr*, const Packet* p);
+static inline void IP4AddrTests (const IP4Hdr*, const Packet* p);
static inline void IPMiscTests(Packet *);
static void DecodeIPOptions(const uint8_t *start, uint32_t o_len, Packet *p);
+static int OptLenValidate(const uint8_t *option_ptr,
+ const uint8_t *end,
+ const uint8_t *len_ptr,
+ int expected_len,
+ Options *tcpopt,
+ uint8_t *byte_skip);
/*******************************************
************ PRIVATE FUNCTIONS ***********
p->encapsulations++;
/* lay the IP struct over the raw data */
- IPHdr* iph = reinterpret_cast<IPHdr*>(const_cast<uint8_t *>(raw_pkt));
+ IP4Hdr* iph = reinterpret_cast<IP4Hdr*>(const_cast<uint8_t *>(raw_pkt));
/*
* with datalink DLT_RAW it's impossible to differ ARP datagrams from IP.
//--------------------------------------------------------------------
-static inline void IP4AddrTests(const IPHdr* iph, const Packet* p)
+static inline void IP4AddrTests(const IP4Hdr* iph, const Packet* p)
{
uint8_t msb_src, msb_dst;
return;
}
+
+static int OptLenValidate(const uint8_t *option_ptr,
+ const uint8_t *end,
+ const uint8_t *len_ptr,
+ int expected_len,
+ Options *tcpopt,
+ uint8_t *byte_skip)
+{
+ *byte_skip = 0;
+
+ if(len_ptr == NULL)
+ return tcp::OPT_TRUNC;
+
+
+ if(*len_ptr == 0 || expected_len == 0 || expected_len == 1)
+ {
+ return tcp::OPT_BADLEN;
+ }
+ else if(expected_len > 1)
+ {
+ /* not enough data to read in a perfect world */
+ if((option_ptr + expected_len) > end)
+ return tcp::OPT_TRUNC;
+
+ if(*len_ptr != expected_len)
+ return tcp::OPT_BADLEN;
+ }
+ else /* expected_len < 0 (i.e. variable length) */
+ {
+ /* RFC sez that we MUST have atleast this much data */
+ if(*len_ptr < 2)
+ return tcp::OPT_BADLEN;
+
+ /* not enough data to read in a perfect world */
+ if((option_ptr + *len_ptr) > end)
+ return tcp::OPT_TRUNC;
+ }
+
+ tcpopt->len = *len_ptr - 2;
+
+ if(*len_ptr == 2)
+ tcpopt->data = NULL;
+ else
+ tcpopt->data = option_ptr + 2;
+
+ *byte_skip = *len_ptr;
+
+ return 0;
+}
+
+
/******************************************************************
******************** E N C O D E R ******************************
*******************************************************************/
bool Ipv4Codec::encode(EncState* enc, Buffer* out, const uint8_t* raw_in)
{
- IPHdr *ho;
+ IP4Hdr *ho;
if (!update_buffer(out, sizeof(*ho)))
return false;
- const IPHdr *hi = reinterpret_cast<const IPHdr*>(raw_in);
- ho = reinterpret_cast<IPHdr*>(out->base);
+ const IP4Hdr *hi = reinterpret_cast<const IP4Hdr*>(raw_in);
+ ho = reinterpret_cast<IP4Hdr*>(out->base);
/* IPv4 encoded header is hardcoded 20 bytes */
ho->ip_verhl = 0x45;
bool Ipv4Codec::update(Packet* p, Layer* lyr, uint32_t* len)
{
- IPHdr* h = (IPHdr*)(lyr->start);
+ IP4Hdr* h = (IP4Hdr*)(lyr->start);
int i = lyr - p->layers;
uint16_t hlen = h->get_hlen() << 2;
void Ipv4Codec::format(EncodeFlags f, const Packet* p, Packet* c, Layer* lyr)
{
// TBD handle nested ip layers
- IPHdr* ch = (IPHdr*)lyr->start;
+ IP4Hdr* ch = (IP4Hdr*)lyr->start;
if ( reverse(f) )
{
int i = lyr - c->layers;
- IPHdr* ph = (IPHdr*)p->layers[i].start;
+ IP4Hdr* ph = (IP4Hdr*)p->layers[i].start;
ch->ip_src = ph->ip_dst;
ch->ip_dst = ph->ip_src;
dtor, // dtor
};
+#if 0
+#ifdef BUILDING_SO
+SO_PUBLIC const BaseApi* snort_plugins[] =
+{
+ &ipv4_api.base,
+ nullptr
+};
+#else
+const BaseApi* cd_ipv4 = &ipv4_api.base;
+#endif
+#endif
+
+// Currently needs to be static
const BaseApi* cd_ipv4 = &ipv4_api.base;
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-// cd_ipv4_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
-
-#include "codecs/ip/cd_ipv4_module.h"
-
-// rules which will loaded into snort.
-// You can now reference these rules by calling a codec_event
-// in your main codec's functions
-static const RuleMap ipv4_rules[] =
-{
- { DECODE_NOT_IPV4_DGRAM, "(" CD_IPV4_NAME ") Not IPv4 datagram" },
- { DECODE_IPV4_INVALID_HEADER_LEN, "(" CD_IPV4_NAME ") hlen < IP_HEADER_LEN" },
- { DECODE_IPV4_DGRAM_LT_IPHDR, "(" CD_IPV4_NAME ") IP dgm len < IP Hdr len" },
- { DECODE_IPV4OPT_BADLEN, "(" CD_IPV4_NAME ") Ipv4 Options found with bad lengths" },
- { DECODE_IPV4OPT_TRUNCATED, "(" CD_IPV4_NAME ") Truncated Ipv4 Options" },
- { DECODE_IPV4_DGRAM_GT_CAPLEN, "(" CD_IPV4_NAME ") IP dgm len > captured len" },
- { DECODE_ZERO_TTL, "(" CD_IPV4_NAME ") IPV4 packet with zero TTL" },
- { DECODE_BAD_FRAGBITS, "(" CD_IPV4_NAME ") IPV4 packet with bad frag bits (Both MF and DF set)" },
- { DECODE_IP4_LEN_OFFSET, "(" CD_IPV4_NAME ") IPV4 packet frag offset + length exceed maximum" },
- { DECODE_IP4_SRC_THIS_NET, "(" CD_IPV4_NAME ") IPV4 packet from 'current net' source address" },
- { DECODE_IP4_DST_THIS_NET, "(" CD_IPV4_NAME ") IPV4 packet to 'current net' dest address" },
- { DECODE_IP4_SRC_MULTICAST, "(" CD_IPV4_NAME ") IPV4 packet from multicast source address" },
- { DECODE_IP4_SRC_RESERVED, "(" CD_IPV4_NAME ") IPV4 packet from reserved source address" },
- { DECODE_IP4_DST_RESERVED, "(" CD_IPV4_NAME ") IPV4 packet to reserved dest address" },
- { DECODE_IP4_SRC_BROADCAST, "(" CD_IPV4_NAME ") IPV4 packet from broadcast source address" },
- { DECODE_IP4_DST_BROADCAST, "(" CD_IPV4_NAME ") IPV4 packet to broadcast dest address" },
- { DECODE_IP4_MIN_TTL, "(" CD_IPV4_NAME ") IPV4 packet below TTL limit" },
- { DECODE_IP4_DF_OFFSET, "(" CD_IPV4_NAME ") IPV4 packet both DF and offset set" },
- { DECODE_IP_RESERVED_FRAG_BIT, "(decode) BAD-TRAFFIC IP reserved bit set" },
- { DECODE_IP_UNASSIGNED_PROTO, "(decode) BAD-TRAFFIC Unassigned/Reserved IP protocol" },
- { DECODE_IP_BAD_PROTO, "(decode) BAD-TRAFFIC Bad IP protocol" },
- { DECODE_IP_OPTION_SET, "(decode) MISC IP option set" },
- { DECODE_IP_MULTIPLE_ENCAPSULATION, "(decode) Two or more IP (v4 and/or v6) encapsulation layers present" },
- { DECODE_ZERO_LENGTH_FRAG, "(decode) fragment with zero length" },
- { DECODE_IP4_HDR_TRUNC, "(decode) truncated IP4 header" },
- { DECODE_BAD_TRAFFIC_LOOPBACK, "(snort decoder) Bad Traffic Loopback IP" },
- { DECODE_BAD_TRAFFIC_SAME_SRCDST, "(snort decoder) Bad Traffic Same Src/Dst IP" },
- { 0, nullptr }
-};
-
-//-------------------------------------------------------------------------
-// rpc module
-//-------------------------------------------------------------------------
-
-Ipv4Module::Ipv4Module() : DecodeModule(CD_IPV4_NAME)
-{ }
-
-const RuleMap* Ipv4Module::get_rules() const
-{ return ipv4_rules; }
-
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-// cd_ipv4_module.h author Josh Rosenbaum <jrosenba@cisco.com>
-
-#ifndef TEMPLATE_MODULE_H
-#define TEMPLATE_MODULE_H
-
-#include "codecs/decode_module.h"
-
-
-#define CD_IPV4_NAME "ipv4"
-
-class Ipv4Module : public DecodeModule
-{
-public:
- Ipv4Module();
-
- const RuleMap* get_rules() const;
-};
-
-#endif
-
#include "stream/stream_api.h"
#include "main/snort.h"
#include "packet_io/active.h"
-#include "codecs/ip/cd_ipv6_module.h"
+#include "codecs/decode_module.h"
#include "codecs/sf_protocols.h"
#include "protocols/protocol_ids.h"
namespace
{
+#define CD_IPV6_NAME "ipv6"
+static const RuleMap ipv6_rules[] =
+{
+ { DECODE_IPV6_MIN_TTL, "(" CD_IPV6_NAME ") IPv6 packet below TTL limit" },
+ { DECODE_IPV6_IS_NOT, "(" CD_IPV6_NAME ") IPv6 header claims to not be IPv6" },
+ { DECODE_IPV6_TRUNCATED_EXT, "(" CD_IPV6_NAME ") IPV6 truncated extension header" },
+ { DECODE_IPV6_TRUNCATED, "(" CD_IPV6_NAME ") IPV6 truncated header" },
+ { DECODE_IPV6_DGRAM_LT_IPHDR, "(" CD_IPV6_NAME ") IP dgm len < IP Hdr len" },
+ { DECODE_IPV6_DGRAM_GT_CAPLEN, "(" CD_IPV6_NAME ") IP dgm len > captured len" },
+ { DECODE_IPV6_DST_ZERO, "(" CD_IPV6_NAME ") IPv6 packet with destination address ::0" },
+ { DECODE_IPV6_SRC_MULTICAST, "(" CD_IPV6_NAME ") IPv6 packet with multicast source address" },
+ { DECODE_IPV6_DST_RESERVED_MULTICAST, "(" CD_IPV6_NAME ") IPv6 packet with reserved multicast destination address" },
+ { DECODE_IPV6_BAD_OPT_TYPE, "(" CD_IPV6_NAME ") IPv6 header includes an undefined option type" },
+ { DECODE_IPV6_BAD_MULTICAST_SCOPE, "(" CD_IPV6_NAME ") IPv6 address includes an unassigned multicast scope value" },
+ { DECODE_IPV6_BAD_NEXT_HEADER, "(" CD_IPV6_NAME ") IPv6 header includes an invalid value for the 'next header' field" },
+ { DECODE_IPV6_ROUTE_AND_HOPBYHOP, "(" CD_IPV6_NAME ") IPv6 header includes a routing extension header followed by a hop-by-hop header" },
+ { DECODE_IPV6_TWO_ROUTE_HEADERS, "(" CD_IPV6_NAME ") IPv6 header includes two routing extension headers" },
+ { DECODE_IPV6_DSTOPTS_WITH_ROUTING, "(" CD_IPV6_NAME ") IPv6 header has destination options followed by a routing header" },
+ { DECODE_IPV6_TUNNELED_IPV4_TRUNCATED, "(" CD_IPV6_NAME ") IPV6 tunneled over IPv4, IPv6 header truncated, possible Linux Kernel attack" },
+ { DECODE_IPV6_BAD_OPT_LEN, "(" CD_IPV6_NAME ") IPv6 header includes an option which is too big for the containing header" },
+ { DECODE_IPV6_UNORDERED_EXTENSIONS, "(" CD_IPV6_NAME ") IPv6 packet includes out-of-order extension headers" },
+ { DECODE_IP6_ZERO_HOP_LIMIT, "(" CD_IPV6_NAME ") IPV6 packet has zero hop limit" },
+ { DECODE_IPV6_ISATAP_SPOOF, "(" CD_IPV6_NAME ") BAD-TRAFFIC ISATAP-addressed IPv6 traffic spoofing attempt" },
+ { DECODE_IPV6_BAD_FRAG_PKT, "(" CD_IPV6_NAME ") bogus fragmentation packet. Possible BSD attack" },
+ { DECODE_IPV6_ROUTE_ZERO, "(" CD_IPV6_NAME ") IPV6 routing type 0 extension header" },
+ { DECODE_IP6_EXCESS_EXT_HDR, "(" CD_IPV6_NAME ") too many IP6 extension headers" },
+ { 0, nullptr }
+};
+
+
+class Ipv6Module : public DecodeModule
+{
+public:
+ Ipv6Module() : DecodeModule(CD_IPV6_NAME) {}
+
+ const RuleMap* get_rules() const
+ { return ipv6_rules; }
+};
+
+
class Ipv6Codec : public Codec
{
public:
} // namespace
-static inline void IPV6CheckIsatap(const ip::IP6RawHdr* const, Packet* p);
+static inline void IPV6CheckIsatap(const ip::IP6Hdr* const, Packet* p);
static inline void IPV6MiscTests(Packet* p);
-static void CheckIPV6Multicast(const ip::IP6RawHdr*, const Packet* const p);
-static inline int CheckTeredoPrefix(const ip::IP6RawHdr* const hdr);
+static void CheckIPV6Multicast(const ip::IP6Hdr*, const Packet* const p);
+static inline int CheckTeredoPrefix(const ip::IP6Hdr* const hdr);
/********************************************************************
************************* PRIVATE FUNCTIONS **********************
uint32_t payload_len;
/* lay the IP struct over the raw data */
- const ip::IP6RawHdr* const ip6h =
- reinterpret_cast<ip::IP6RawHdr*>(const_cast<uint8_t*>(raw_pkt));
+ const ip::IP6Hdr* const ip6h =
+ reinterpret_cast<ip::IP6Hdr*>(const_cast<uint8_t*>(raw_pkt));
if(raw_len < ip::IP6_HEADER_LEN)
{
return false;
}
-static inline void IPV6CheckIsatap(const ip::IP6RawHdr* const ip6h, Packet* p)
+static inline void IPV6CheckIsatap(const ip::IP6Hdr* const ip6h, Packet* p)
{
/* Only check for IPv6 over IPv4 */
if (p->ip_api.is_ip4() && p->ip_api.proto() == IPPROTO_IPV6)
/* Check for multiple IPv6 Multicast-related alerts */
-static void CheckIPV6Multicast(const ip::IP6RawHdr* ip6h,
+static void CheckIPV6Multicast(const ip::IP6Hdr* ip6h,
const Packet* const p)
{
ip::MulticastScope multicast_scope;
/* Teredo packets need to have one of their IPs use either the Teredo prefix,
or a link-local prefix (in the case of Router Solicitation messages) */
-static inline int CheckTeredoPrefix(const ip::IP6RawHdr* const hdr)
+static inline int CheckTeredoPrefix(const ip::IP6Hdr* const hdr)
{
/* Check if src address matches 2001::/32 */
if ((hdr->ip6_src.u6_addr8[0] == 0x20) &&
bool Ipv6Codec::encode(EncState* enc, Buffer* out, const uint8_t* raw_in)
{
- if (!update_buffer(out, sizeof(ip::IP6RawHdr)))
+ if (!update_buffer(out, sizeof(ip::IP6Hdr)))
return false;
- const ip::IP6RawHdr* hi = reinterpret_cast<const ip::IP6RawHdr*>(raw_in);
- ip::IP6RawHdr* ho = (ip::IP6RawHdr*)(out->base);
+ const ip::IP6Hdr* hi = reinterpret_cast<const ip::IP6Hdr*>(raw_in);
+ ip::IP6Hdr* ho = (ip::IP6Hdr*)(out->base);
ho->ip6_vtf = htonl(ntohl(hi->ip6_vtf) & 0xFFF00000);
bool Ipv6Codec::update(Packet* p, Layer* lyr, uint32_t* len)
{
- ip::IP6RawHdr* h = (ip::IP6RawHdr*)(lyr->start);
+ ip::IP6Hdr* h = (ip::IP6Hdr*)(lyr->start);
int i = lyr - p->layers;
// if we didn't trim payload or format this packet,
void Ipv6Codec::format(EncodeFlags f, const Packet* p, Packet* c, Layer* lyr)
{
- ip::IP6RawHdr* ch = reinterpret_cast<ip::IP6RawHdr*>(
+ ip::IP6Hdr* ch = reinterpret_cast<ip::IP6Hdr*>(
const_cast<uint8_t*>(lyr->start));
if ( reverse(f) )
{
int i = lyr - c->layers;
- ip::IP6RawHdr* ph = (ip::IP6RawHdr*)p->layers[i].start;
+ ip::IP6Hdr* ph = (ip::IP6Hdr*)p->layers[i].start;
memcpy(ch->ip6_src.u6_addr8, ph->ip6_dst.u6_addr8, sizeof(ch->ip6_src.u6_addr8));
memcpy(ch->ip6_dst.u6_addr8, ph->ip6_src.u6_addr8, sizeof(ch->ip6_dst.u6_addr8));
};
+#ifdef BUILDING_SO
+SO_PUBLIC const BaseApi* snort_plugins[] =
+{
+ &ipv6_api.base,
+ nullptr
+};
+#else
const BaseApi* cd_ipv6 = &ipv6_api.base;
-
-
+#endif
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-// cd_ipv6_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
-
-#include "codecs/ip/cd_ipv6_module.h"
-
-
-static const Parameter ipv6_params[] =
-{
- { "parameter1", Parameter::PT_BOOL, nullptr, "false",
- "This is a boolean parameter" },
-
- { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
-};
-
-
-// rules which will loaded into snort.
-// You can now reference these rules by calling a codec_event
-// in your main codec's functions
-static const RuleMap ipv6_rules[] =
-{
- { DECODE_IPV6_MIN_TTL, "(" CD_IPV6_NAME ") IPv6 packet below TTL limit" },
- { DECODE_IPV6_IS_NOT, "(" CD_IPV6_NAME ") IPv6 header claims to not be IPv6" },
- { DECODE_IPV6_TRUNCATED_EXT, "(" CD_IPV6_NAME ") IPV6 truncated extension header" },
- { DECODE_IPV6_TRUNCATED, "(" CD_IPV6_NAME ") IPV6 truncated header" },
- { DECODE_IPV6_DGRAM_LT_IPHDR, "(" CD_IPV6_NAME ") IP dgm len < IP Hdr len" },
- { DECODE_IPV6_DGRAM_GT_CAPLEN, "(" CD_IPV6_NAME ") IP dgm len > captured len" },
- { DECODE_IPV6_DST_ZERO, "(" CD_IPV6_NAME ") IPv6 packet with destination address ::0" },
- { DECODE_IPV6_SRC_MULTICAST, "(" CD_IPV6_NAME ") IPv6 packet with multicast source address" },
- { DECODE_IPV6_DST_RESERVED_MULTICAST, "(" CD_IPV6_NAME ") IPv6 packet with reserved multicast destination address" },
- { DECODE_IPV6_BAD_OPT_TYPE, "(" CD_IPV6_NAME ") IPv6 header includes an undefined option type" },
- { DECODE_IPV6_BAD_MULTICAST_SCOPE, "(" CD_IPV6_NAME ") IPv6 address includes an unassigned multicast scope value" },
- { DECODE_IPV6_BAD_NEXT_HEADER, "(" CD_IPV6_NAME ") IPv6 header includes an invalid value for the 'next header' field" },
- { DECODE_IPV6_ROUTE_AND_HOPBYHOP, "(" CD_IPV6_NAME ") IPv6 header includes a routing extension header followed by a hop-by-hop header" },
- { DECODE_IPV6_TWO_ROUTE_HEADERS, "(" CD_IPV6_NAME ") IPv6 header includes two routing extension headers" },
- { DECODE_IPV6_DSTOPTS_WITH_ROUTING, "(" CD_IPV6_NAME ") IPv6 header has destination options followed by a routing header" },
- { DECODE_IPV6_TUNNELED_IPV4_TRUNCATED, "(" CD_IPV6_NAME ") IPV6 tunneled over IPv4, IPv6 header truncated, possible Linux Kernel attack" },
- { DECODE_IPV6_BAD_OPT_LEN, "(" CD_IPV6_NAME ") IPv6 header includes an option which is too big for the containing header" },
- { DECODE_IPV6_UNORDERED_EXTENSIONS, "(" CD_IPV6_NAME ") IPv6 packet includes out-of-order extension headers" },
- { DECODE_IP6_ZERO_HOP_LIMIT, "(" CD_IPV6_NAME ") IPV6 packet has zero hop limit" },
- { DECODE_IPV6_ISATAP_SPOOF, "(" CD_IPV6_NAME ") BAD-TRAFFIC ISATAP-addressed IPv6 traffic spoofing attempt" },
- { DECODE_IPV6_BAD_FRAG_PKT, "(" CD_IPV6_NAME ") bogus fragmentation packet. Possible BSD attack" },
- { DECODE_IPV6_ROUTE_ZERO, "(" CD_IPV6_NAME ") IPV6 routing type 0 extension header" },
- { DECODE_IP6_EXCESS_EXT_HDR, "(" CD_IPV6_NAME ") too many IP6 extension headers" },
- { 0, nullptr }
-};
-
-//-------------------------------------------------------------------------
-// rpc module
-//-------------------------------------------------------------------------
-
-Ipv6Module::Ipv6Module() : DecodeModule(CD_IPV6_NAME, ipv6_params)
-{ }
-
-const RuleMap* Ipv6Module::get_rules() const
-{ return ipv6_rules; }
-
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-// cd_ipv6_module.h author Josh Rosenbaum <jrosenba@cisco.com>
-
-#ifndef CD_IPV6_MODULE_H
-#define CD_IPV6_MODULE_H
-
-#include "codecs/decode_module.h"
-
-
-#define CD_IPV6_NAME "ipv6"
-
-class Ipv6Module : public DecodeModule
-{
-public:
- Ipv6Module();
-
- const RuleMap* get_rules() const;
-};
-
-#endif
-
** along with this program; if not, write to the Free Software
** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
+// cd_pgm.cc author Josh Rosenbaum <jrosenba@cisco.com>
#endif
#include "framework/codec.h"
-#include "codecs/ip/cd_pgm_module.h"
+#include "codecs/decode_module.h"
#include "codecs/codec_events.h"
#include "protocols/ipv4.h"
-#include "codecs/checksum.h"
+#include "codecs/ip/checksum.h"
namespace
{
+#define CD_PGM_NAME "pgm"
+
+static const RuleMap pgm_rules[] =
+{
+ { DECODE_PGM_NAK_OVERFLOW, "(" CD_PGM_NAME ") BAD-TRAFFIC PGM nak list overflow attempt" },
+ { 0, nullptr }
+};
+
+
+class PgmModule : public DecodeModule
+{
+public:
+ PgmModule() : DecodeModule(CD_PGM_NAME) {}
+
+ const RuleMap* get_rules() const
+ { return pgm_rules; }
+};
+
+
class PgmCodec : public Codec
{
public:
/* checksum is expensive... do that only if the length is bad */
if (header->checksum != 0) {
- checksum = checksum::cksum_add((unsigned short*)data, (int)length);
+ checksum = checksum::cksum_add((uint16_t*)data, (int)length);
if (checksum != 0)
return PGM_NAK_ERR;
}
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-// cd_pgm_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
-
-#include "codecs/ip/cd_pgm_module.h"
-
-static const RuleMap pgm_rules[] =
-{
- { DECODE_PGM_NAK_OVERFLOW, "(" CD_PGM_NAME ") BAD-TRAFFIC PGM nak list overflow attempt" },
- { 0, nullptr }
-};
-
-//-------------------------------------------------------------------------
-// rpc module
-//-------------------------------------------------------------------------
-
-PgmModule::PgmModule() : DecodeModule(CD_PGM_NAME)
-{ }
-
-const RuleMap* PgmModule::get_rules() const
-{ return pgm_rules; }
-
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-// cd_pgm_module.h author Josh Rosenbaum <jrosenba@cisco.com>
-
-#ifndef CD_PGM_MODULE_H
-#define CD_PGM_MODULE_H
-
-#include "codecs/decode_module.h"
-
-
-#define CD_PGM_NAME "pgm"
-
-class PgmModule : public DecodeModule
-{
-public:
- PgmModule();
-
- const RuleMap* get_rules() const;
-};
-
-#endif
** along with this program; if not, write to the Free Software
** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
+// cd_tcp.cc author Josh Rosenbaum <jrosenba@cisco.com>
#include "packet_io/sfdaq.h"
#include "parser/parse_ip.h"
#include "codecs/codec_events.h"
-#include "codecs/checksum.h"
+#include "codecs/ip/checksum.h"
#include "snort.h"
#include "packet_io/active.h"
#include "protocols/tcp.h"
#include "protocols/packet.h"
#include "framework/codec.h"
-#include "codecs/ip/cd_tcp_module.h"
+#include "codecs/decode_module.h"
#include "codecs/sf_protocols.h"
+
namespace
{
+
+#define CD_TCP_NAME "tcp"
+
+static const RuleMap tcp_rules[] =
+{
+ { DECODE_TCP_DGRAM_LT_TCPHDR, "(" CD_TCP_NAME ") TCP packet len is smaller than 20 bytes" },
+ { DECODE_TCP_INVALID_OFFSET, "(" CD_TCP_NAME ") TCP Data Offset is less than 5" },
+ { DECODE_TCP_LARGE_OFFSET, "(" CD_TCP_NAME ") TCP Header length exceeds packet length" },
+
+ { DECODE_TCPOPT_BADLEN, "(" CD_TCP_NAME ") Tcp Options found with bad lengths" },
+ { DECODE_TCPOPT_TRUNCATED, "(" CD_TCP_NAME ") Truncated Tcp Options" },
+ { DECODE_TCPOPT_TTCP, "(" CD_TCP_NAME ") T/TCP Detected" },
+ { DECODE_TCPOPT_OBSOLETE, "(" CD_TCP_NAME ") Obsolete TCP Options found" },
+ { DECODE_TCPOPT_EXPERIMENTAL, "(" CD_TCP_NAME ") Experimental Tcp Options found" },
+ { DECODE_TCPOPT_WSCALE_INVALID, "(" CD_TCP_NAME ") Tcp Window Scale Option found with length > 14" },
+ { DECODE_TCP_XMAS, "(" CD_TCP_NAME ") XMAS Attack Detected" },
+ { DECODE_TCP_NMAP_XMAS, "(" CD_TCP_NAME ") Nmap XMAS Attack Detected" },
+ { DECODE_TCP_BAD_URP, "(" CD_TCP_NAME ") TCP urgent pointer exceeds payload length or no payload" },
+ { DECODE_TCP_SYN_FIN, "(" CD_TCP_NAME ") TCP SYN with FIN" },
+ { DECODE_TCP_SYN_RST, "(" CD_TCP_NAME ") TCP SYN with RST" },
+ { DECODE_TCP_MUST_ACK, "(" CD_TCP_NAME ") TCP PDU missing ack for established session" },
+ { DECODE_TCP_NO_SYN_ACK_RST, "(" CD_TCP_NAME ") TCP has no SYN, ACK, or RST" },
+ { DECODE_TCP_SHAFT_SYNFLOOD, "(" CD_TCP_NAME ") DDOS shaft synflood" },
+ { DECODE_TCP_PORT_ZERO, "(" CD_TCP_NAME ") BAD-TRAFFIC TCP port 0 traffic" },
+ { DECODE_DOS_NAPTHA, "(decode) DOS NAPTHA Vulnerability Detected" },
+ { DECODE_SYN_TO_MULTICAST, "(decode) Bad Traffic SYN to multicast address" },
+ { 0, nullptr }
+};
+
+
+class TcpModule : public DecodeModule
+{
+public:
+ TcpModule() : DecodeModule(CD_TCP_NAME) {}
+
+ const RuleMap* get_rules() const
+ { return tcp_rules; }
+};
+
+
+
class TcpCodec : public Codec
{
public:
-int OptLenValidate(const uint8_t *option_ptr,
+static int OptLenValidate(const uint8_t *option_ptr,
const uint8_t *end,
const uint8_t *len_ptr,
int expected_len,
static void DecodeTCPOptions(const uint8_t *, uint32_t, Packet *);
static inline void TCPMiscTests(Packet *p);
-#if 0
-static inline unsigned short in_chksum_tcp(pseudoheader *, unsigned short *, int);
-static inline unsigned short in_chksum_tcp6(pseudoheader6 *, unsigned short *, int);
-#endif
-
void TcpCodec::get_protocol_ids(std::vector<uint16_t>& v)
{
v.push_back(IPPROTO_TCP);
DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "%lu bytes of tcp options....\n",
(unsigned long)(tcp_opt_len)););
- p->tcp_options_data = raw_pkt + tcp::TCP_HEADER_LEN;
DecodeTCPOptions((uint8_t *) (raw_pkt + tcp::TCP_HEADER_LEN), tcp_opt_len, p);
}
else
checksum::Pseudoheader ps;
int len = buff_diff(out, (uint8_t*)ho);
- const IPHdr* const ip4h = ip_api->get_ip4h();
+ const IP4Hdr* const ip4h = ip_api->get_ip4h();
ps.sip = ip4h->get_src();
ps.dip = ip4h->get_dst();
ps.zero = 0;
checksum::Pseudoheader6 ps6;
int len = buff_diff(out, (uint8_t*) ho);
- const ip::IP6RawHdr* const ip6h = ip_api->get_ip6h();
+ const ip::IP6Hdr* const ip6h = ip_api->get_ip6h();
memcpy(ps6.sip, ip6h->get_src()->u6_addr8, sizeof(ps6.sip));
memcpy(ps6.dip, ip6h->get_dst()->u6_addr8, sizeof(ps6.dip));
ps6.zero = 0;
if (p->ip_api.is_ip4())
{
checksum::Pseudoheader ps;
- const ip::IPHdr* ip4h = p->ip_api.get_ip4h();
+ const ip::IP4Hdr* ip4h = p->ip_api.get_ip4h();
ps.sip = ip4h->get_src();
ps.dip = ip4h->get_dst();;
ps.zero = 0;
else
{
checksum::Pseudoheader6 ps6;
- const ip::IP6RawHdr* ip6h = p->ip_api.get_ip6h();
+ const ip::IP6Hdr* ip6h = p->ip_api.get_ip6h();
memcpy(ps6.sip, ip6h->get_src()->u6_addr32, sizeof(ps6.sip));
memcpy(ps6.dip, ip6h->get_dst()->u6_addr32, sizeof(ps6.dip));
ps6.zero = 0;
}
-int OptLenValidate(const uint8_t *option_ptr,
+static int OptLenValidate(const uint8_t *option_ptr,
const uint8_t *end,
const uint8_t *len_ptr,
int expected_len,
dtor, // dtor
};
+#ifdef BUILDING_SO
+SO_PUBLIC const BaseApi* snort_plugins[] =
+{
+ &tcp_api.base,
+ nullptr
+};
+#else
const BaseApi* cd_tcp = &tcp_api.base;
-
+#endif
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-// cd_tcp_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
-
-#include "codecs/ip/cd_tcp_module.h"
-
-// rules which will loaded into snort.
-// You can now reference these rules by calling a codec_event
-// in your main codec's functions
-static const RuleMap tcp_rules[] =
-{
- { DECODE_TCP_DGRAM_LT_TCPHDR, "(" CD_TCP_NAME ") TCP packet len is smaller than 20 bytes" },
- { DECODE_TCP_INVALID_OFFSET, "(" CD_TCP_NAME ") TCP Data Offset is less than 5" },
- { DECODE_TCP_LARGE_OFFSET, "(" CD_TCP_NAME ") TCP Header length exceeds packet length" },
-
- { DECODE_TCPOPT_BADLEN, "(" CD_TCP_NAME ") Tcp Options found with bad lengths" },
- { DECODE_TCPOPT_TRUNCATED, "(" CD_TCP_NAME ") Truncated Tcp Options" },
- { DECODE_TCPOPT_TTCP, "(" CD_TCP_NAME ") T/TCP Detected" },
- { DECODE_TCPOPT_OBSOLETE, "(" CD_TCP_NAME ") Obsolete TCP Options found" },
- { DECODE_TCPOPT_EXPERIMENTAL, "(" CD_TCP_NAME ") Experimental Tcp Options found" },
- { DECODE_TCPOPT_WSCALE_INVALID, "(" CD_TCP_NAME ") Tcp Window Scale Option found with length > 14" },
- { DECODE_TCP_XMAS, "(" CD_TCP_NAME ") XMAS Attack Detected" },
- { DECODE_TCP_NMAP_XMAS, "(" CD_TCP_NAME ") Nmap XMAS Attack Detected" },
- { DECODE_TCP_BAD_URP, "(" CD_TCP_NAME ") TCP urgent pointer exceeds payload length or no payload" },
- { DECODE_TCP_SYN_FIN, "(" CD_TCP_NAME ") TCP SYN with FIN" },
- { DECODE_TCP_SYN_RST, "(" CD_TCP_NAME ") TCP SYN with RST" },
- { DECODE_TCP_MUST_ACK, "(" CD_TCP_NAME ") TCP PDU missing ack for established session" },
- { DECODE_TCP_NO_SYN_ACK_RST, "(" CD_TCP_NAME ") TCP has no SYN, ACK, or RST" },
- { DECODE_TCP_SHAFT_SYNFLOOD, "(" CD_TCP_NAME ") DDOS shaft synflood" },
- { DECODE_TCP_PORT_ZERO, "(" CD_TCP_NAME ") BAD-TRAFFIC TCP port 0 traffic" },
- { DECODE_DOS_NAPTHA, "(decode) DOS NAPTHA Vulnerability Detected" },
- { DECODE_SYN_TO_MULTICAST, "(decode) Bad Traffic SYN to multicast address" },
- { 0, nullptr }
-};
-
-//-------------------------------------------------------------------------
-// rpc module
-//-------------------------------------------------------------------------
-
-TcpModule::TcpModule() : DecodeModule(CD_TCP_NAME)
-{ }
-
-const RuleMap* TcpModule::get_rules() const
-{ return tcp_rules; }
-
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-// cd_tcp_module.h author Josh Rosenbaum <jrosenba@cisco.com>
-
-#ifndef CD_TCP_MODULE_H
-#define CD_TCP_MODULE_H
-
-#include "codecs/decode_module.h"
-
-
-#define CD_TCP_NAME "tcp"
-
-class TcpModule : public DecodeModule
-{
-public:
- TcpModule();
-
- const RuleMap* get_rules() const;
-};
-
-#endif
-
#include "protocols/icmp4.h"
#include "protocols/ipv4.h"
#include "protocols/protocol_ids.h"
-#include "codecs/checksum.h"
+#include "codecs/ip/checksum.h"
#include "framework/codec.h"
#include "packet_io/active.h"
#include "codecs/codec_events.h"
-#include "codecs/ip/cd_udp_module.h"
#include "codecs/sf_protocols.h"
+#include "snort_config.h"
+#include "parser/config_file.h"
namespace
{
+
+#define CD_UDP_NAME "udp"
+static const Parameter udp_params[] =
+{
+ { "deep_teredo_inspection", Parameter::PT_BOOL, nullptr, "false",
+ "look for Teredo on all UDP ports (default is only 3544)" },
+
+ { "enable_gtp", Parameter::PT_BOOL, nullptr, "false",
+ "decode GTP encapsulations" },
+
+ // FIXIT use PT_BIT_LIST
+ { "gtp_ports", Parameter::PT_STRING, nullptr,
+ "'2152 3386'", "set GTP ports" },
+
+ { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
+};
+
+
+static const RuleMap udp_rules[] =
+{
+
+ { DECODE_UDP_DGRAM_LT_UDPHDR, "(" CD_UDP_NAME ") Truncated UDP Header" },
+ { DECODE_UDP_DGRAM_INVALID_LENGTH, "(" CD_UDP_NAME ") Invalid UDP header, length field < 8" },
+ { DECODE_UDP_DGRAM_SHORT_PACKET, "(" CD_UDP_NAME ") Short UDP packet, length field > payload length" },
+ { DECODE_UDP_DGRAM_LONG_PACKET, "(" CD_UDP_NAME ") Long UDP packet, length field < payload length" },
+ { DECODE_UDP_IPV6_ZERO_CHECKSUM, "(" CD_UDP_NAME ") Invalid IPv6 UDP packet, checksum zero" },
+ { DECODE_UDP_LARGE_PACKET, "(" CD_UDP_NAME ") MISC Large UDP Packet" },
+ { DECODE_UDP_PORT_ZERO, "(" CD_UDP_NAME ") BAD-TRAFFIC UDP port 0 traffic" },
+ { 0, nullptr }
+};
+
+class UdpModule : public DecodeModule
+{
+public:
+ UdpModule() : DecodeModule(CD_UDP_NAME) {}
+
+ const RuleMap* get_rules() const
+ { return udp_rules; }
+
+ bool set(const char*, Value& v, SnortConfig* sc)
+ {
+ if ( v.is("deep_teredo_inspection") )
+ {
+ sc->enable_teredo = v.get_long(); // FIXIT move to existing bitfield
+ }
+ else if ( v.is("gtp_ports") )
+ {
+ ConfigGTPDecoding(sc, v.get_string());
+ }
+ else if ( v.is("enable_gtp") )
+ {
+ if ( v.get_bool() )
+ sc->enable_gtp = 1; // FIXIT move to existing bitfield
+ }
+ else
+ {
+ return false;
+ }
+
+ return true;
+ }
+};
+
+
class UdpCodec : public Codec
{
public:
if( !fragmented_udp_flag && udph->uh_chk )
{
checksum::Pseudoheader ph;
- const ip::IPHdr* ip4h = p->ip_api.get_ip4h();
+ const ip::IP4Hdr* ip4h = p->ip_api.get_ip4h();
ph.sip = ip4h->get_src();
ph.dip = ip4h->get_dst();
ph.zero = 0;
else if( !fragmented_udp_flag )
{
checksum::Pseudoheader6 ph6;
- const ip::IP6RawHdr* ip6h = p->ip_api.get_ip6h();
+ const ip::IP6Hdr* ip6h = p->ip_api.get_ip6h();
COPY4(ph6.sip, ip6h->ip6_src.u6_addr32);
COPY4(ph6.dip, ip6h->ip6_dst.u6_addr32);
ph6.zero = 0;
if (ip_api->is_ip4())
{
checksum::Pseudoheader ps;
- const IPHdr* const ip4h = ip_api->get_ip4h();
+ const IP4Hdr* const ip4h = ip_api->get_ip4h();
ps.sip = ip4h->get_src();
ps.dip = ip4h->get_dst();
ps.zero = 0;
else
{
checksum::Pseudoheader6 ps6;
- const ip::IP6RawHdr* const ip6h = ip_api->get_ip6h();
+ const ip::IP6Hdr* const ip6h = ip_api->get_ip6h();
memcpy(ps6.sip, ip6h->get_src()->u6_addr8, sizeof(ps6.sip));
memcpy(ps6.dip, ip6h->get_dst()->u6_addr8, sizeof(ps6.dip));
ps6.zero = 0;
return false;
memcpy(out->base, ip_api->get_ip6h(), ip::IP6_HEADER_LEN);
- ((ip::IP6RawHdr*)out->base)->ip6_next = IPPROTO_UDP;
+ ((ip::IP6Hdr*)out->base)->ip6_next = IPPROTO_UDP;
if (!update_buffer(out, sizeof(*ho)))
if (p->ip_api.is_ip4()) {
checksum::Pseudoheader ps;
- const ip::IPHdr* ip4h = p->ip_api.get_ip4h();
+ const ip::IP4Hdr* ip4h = p->ip_api.get_ip4h();
ps.sip = ip4h->get_src();
ps.dip = ip4h->get_dst();
ps.zero = 0;
else
{
checksum::Pseudoheader6 ps6;
- const ip::IP6RawHdr* ip6h = p->ip_api.get_ip6h();
+ const ip::IP6Hdr* ip6h = p->ip_api.get_ip6h();
memcpy(ps6.sip, &ip6h->ip6_src.u6_addr32, sizeof(ps6.sip));
memcpy(ps6.dip, &ip6h->ip6_dst.u6_addr32, sizeof(ps6.dip));
ps6.zero = 0;
c->dp = ntohs(ch->uh_dport);
}
-#if 0
-
-/*
- * CHECKSUMS -- TODO:: delete
- */
-
-/*
-* checksum udp
-*
-* h - pseudo header - 12 bytes
-* d - udp hdr + payload
-* dlen - length of payload in bytes
-*
-*/
-static inline unsigned short in_chksum_udp6(pseudoheader6 *ph,
- unsigned short * d, int dlen )
-{
- uint16_t *h = (uint16_t *)ph;
- unsigned int cksum;
- unsigned short answer=0;
-
- /* PseudoHeader must have 12 bytes */
- cksum = h[0];
- cksum += h[1];
- cksum += h[2];
- cksum += h[3];
- cksum += h[4];
- cksum += h[5];
- cksum += h[6];
- cksum += h[7];
- cksum += h[8];
- cksum += h[9];
- cksum += h[10];
- cksum += h[11];
- cksum += h[12];
- cksum += h[13];
- cksum += h[14];
- cksum += h[15];
- cksum += h[16];
- cksum += h[17];
-
- /* UDP must have 8 hdr bytes */
- cksum += d[0];
- cksum += d[1];
- cksum += d[2];
- cksum += d[3];
-
- dlen -= 8; /* bytes */
- d += 4; /* short's */
-
- while(dlen >=32)
- {
- cksum += d[0];
- cksum += d[1];
- cksum += d[2];
- cksum += d[3];
- cksum += d[4];
- cksum += d[5];
- cksum += d[6];
- cksum += d[7];
- cksum += d[8];
- cksum += d[9];
- cksum += d[10];
- cksum += d[11];
- cksum += d[12];
- cksum += d[13];
- cksum += d[14];
- cksum += d[15];
- d += 16;
- dlen -= 32;
- }
-
- while(dlen >=8)
- {
- cksum += d[0];
- cksum += d[1];
- cksum += d[2];
- cksum += d[3];
- d += 4;
- dlen -= 8;
- }
-
- while(dlen > 1)
- {
- cksum += *d++;
- dlen -= 2;
- }
-
- if( dlen == 1 )
- {
- *(unsigned char*)(&answer) = (*(unsigned char*)d);
- cksum += answer;
- }
-
- cksum = (cksum >> 16) + (cksum & 0x0000ffff);
- cksum += (cksum >> 16);
-
- return (unsigned short)(~cksum);
-}
-
-
-
-static inline unsigned short in_chksum_udp(pseudoheader *ph,
- unsigned short * d, int dlen )
-{
- uint16_t *h = (uint16_t *)ph;
- unsigned int cksum;
- unsigned short answer=0;
-
- /* PseudoHeader must have 36 bytes */
- cksum = h[0];
- cksum += h[1];
- cksum += h[2];
- cksum += h[3];
- cksum += h[4];
- cksum += h[5];
-
- /* UDP must have 8 hdr bytes */
- cksum += d[0];
- cksum += d[1];
- cksum += d[2];
- cksum += d[3];
-
- dlen -= 8; /* bytes */
- d += 4; /* short's */
-
- while(dlen >=32)
- {
- cksum += d[0];
- cksum += d[1];
- cksum += d[2];
- cksum += d[3];
- cksum += d[4];
- cksum += d[5];
- cksum += d[6];
- cksum += d[7];
- cksum += d[8];
- cksum += d[9];
- cksum += d[10];
- cksum += d[11];
- cksum += d[12];
- cksum += d[13];
- cksum += d[14];
- cksum += d[15];
- d += 16;
- dlen -= 32;
- }
-
- while(dlen >=8)
- {
- cksum += d[0];
- cksum += d[1];
- cksum += d[2];
- cksum += d[3];
- d += 4;
- dlen -= 8;
- }
-
- while(dlen > 1)
- {
- cksum += *d++;
- dlen -= 2;
- }
-
- if( dlen == 1 )
- {
- *(unsigned char*)(&answer) = (*(unsigned char*)d);
- cksum += answer;
- }
-
- cksum = (cksum >> 16) + (cksum & 0x0000ffff);
- cksum += (cksum >> 16);
-
- return (unsigned short)(~cksum);
-}
-#endif
-
//-------------------------------------------------------------------------
// api
//-------------------------------------------------------------------------
};
+#ifdef BUILDING_SO
+SO_PUBLIC const BaseApi* snort_plugins[] =
+{
+ &udp_api.base,
+ nullptr
+};
+#else
const BaseApi* cd_udp = &udp_api.base;
-
+#endif
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-// cd_udp_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
-
-#include "cd_udp_module.h"
-#include "snort_config.h"
-#include "parser/config_file.h"
-
-static const Parameter udp_params[] =
-{
- { "deep_teredo_inspection", Parameter::PT_BOOL, nullptr, "false",
- "look for Teredo on all UDP ports (default is only 3544)" },
-
- { "enable_gtp", Parameter::PT_BOOL, nullptr, "false",
- "decode GTP encapsulations" },
-
- // FIXIT use PT_BIT_LIST
- { "gtp_ports", Parameter::PT_STRING, nullptr,
- "'2152 3386'", "set GTP ports" },
-
- { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
-};
-
-
-static const RuleMap udp_rules[] =
-{
-
- { DECODE_UDP_DGRAM_LT_UDPHDR, "(" CD_UDP_NAME ") Truncated UDP Header" },
- { DECODE_UDP_DGRAM_INVALID_LENGTH, "(" CD_UDP_NAME ") Invalid UDP header, length field < 8" },
- { DECODE_UDP_DGRAM_SHORT_PACKET, "(" CD_UDP_NAME ") Short UDP packet, length field > payload length" },
- { DECODE_UDP_DGRAM_LONG_PACKET, "(" CD_UDP_NAME ") Long UDP packet, length field < payload length" },
- { DECODE_UDP_IPV6_ZERO_CHECKSUM, "(" CD_UDP_NAME ") Invalid IPv6 UDP packet, checksum zero" },
- { DECODE_UDP_LARGE_PACKET, "(" CD_UDP_NAME ") MISC Large UDP Packet" },
- { DECODE_UDP_PORT_ZERO, "(" CD_UDP_NAME ") BAD-TRAFFIC UDP port 0 traffic" },
-
-
- { 0, nullptr }
-};
-
-//-------------------------------------------------------------------------
-// rpc module
-//-------------------------------------------------------------------------
-
-UdpModule::UdpModule() : DecodeModule(CD_UDP_NAME, udp_params)
-{ }
-
-const RuleMap* UdpModule::get_rules() const
-{ return udp_rules; }
-
-bool UdpModule::set(const char*, Value& v, SnortConfig* sc)
-{
- if ( v.is("deep_teredo_inspection") )
- sc->enable_teredo = v.get_long(); // FIXIT move to existing bitfield
-
- else if ( v.is("enable_gtp") )
- {
- if ( v.get_bool() )
- sc->enable_gtp = 1; // FIXIT move to existing bitfield
- }
- else if ( v.is("gtp_ports") )
- ConfigGTPDecoding(sc, v.get_string());
-
- else
- return false;
-
- return true;
-}
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-// cd_udp_module.h author Josh Rosenbaum <jrosenba@cisco.com>
-
-#ifndef CD_UDP_MODULE_H
-#define CD_UDP_MODULE_H
-
-#include "codecs/decode_module.h"
-
-
-#define CD_UDP_NAME "udp"
-
-class UdpModule : public DecodeModule
-{
-public:
- UdpModule();
-
- const RuleMap* get_rules() const;
- bool set(const char*, Value&, SnortConfig*);
-};
-
-#endif
*/
// checksum.h author Josh Rosenbaum <jrosenba@cisco.com>
+#ifndef CODECS_CHECKSUM_H
+#define CODECS_CHECKSUM_H
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
-#include "codecs/checksum.h"
+#include <stdint.h>
+#include <stdlib.h>
+#include <cstddef>
-/************************************************************
- *********** Checksum information *************************
- ************************************************************/
namespace checksum
{
-uint16_t cksum_add(const uint16_t *buf, std::size_t len, uint32_t cksum)
+struct Pseudoheader6
{
- uint16_t *sp = (uint16_t *)buf;
+ uint32_t sip[4], dip[4];
+ uint8_t zero;
+ uint8_t protocol;
+ uint16_t len;
+};
+
+
+struct Pseudoheader
+{
+ uint32_t sip, dip;
+ uint8_t zero;
+ uint8_t protocol;
+ uint16_t len;
+};
+
+// calculate the checksum for this general case.
+static uint16_t cksum_add(const uint16_t *buf, std::size_t buf_len);
+inline uint16_t tcp_cksum(const uint16_t *buf, std::size_t len, const Pseudoheader* const);
+inline uint16_t tcp_cksum(const uint16_t *buf, std::size_t len, const Pseudoheader6* const);
+inline uint16_t udp_cksum(const uint16_t *buf, std::size_t len, const Pseudoheader* const);
+inline uint16_t udp_cksum(const uint16_t *buf, std::size_t len, const Pseudoheader6* const);
+inline uint16_t icmp_cksum(const uint16_t *buf, std::size_t len, const Pseudoheader6* const);
+inline uint16_t icmp_cksum(const uint16_t *buf, std::size_t len);
+inline uint16_t ip_cksum(const uint16_t *buf, std::size_t len);
+
+
+/*
+ * NOTE: Since multiple dynamic libraries use checksums, the choice
+ * is to either include all of the checksum details in a header,
+ * or ensure I include these symbols for every linker which
+ * can be used. Obviously, setting correct linker flags is
+ * signifigantly more difficult, so these functions will all
+ * stay in a header file
+ */
+
+/*
+ * IT IS HIGHLY RECOMMENDED to use the above API. Rathern than calling
+ * any of of the following recomendations directly
+ */
+namespace detail
+{
+
+static inline uint16_t cksum_add(const uint16_t *buf, std::size_t len, uint32_t cksum)
+{
+ const uint16_t *sp = buf;
std::size_t n, sn;
if (len > 1 )
}
-static inline void add_ipv4_pseudoheader(const uint16_t *h,
+static inline void add_ipv4_pseudoheader(const uint16_t* const h,
uint32_t &cksum)
{
/* ipv4 pseudo header must have 12 bytes */
}
-static inline void add_ipv6_pseudoheader(const uint16_t *h,
+static inline void add_ipv6_pseudoheader(const uint16_t* const h,
uint32_t &cksum)
{
/* PseudoHeader must have 36 bytes */
len -= 20;
}
-
-uint16_t icmp_cksum(const uint16_t *buf,
+} // namespace detail
+
+
+inline uint16_t icmp_cksum(const uint16_t *buf,
std::size_t len,
- Pseudoheader6* ph)
+ const Pseudoheader6* const ph)
{
uint32_t cksum = 0;
- add_ipv6_pseudoheader((uint16_t *)ph, cksum);
- return cksum_add(buf, len, cksum);
+ detail::add_ipv6_pseudoheader((const uint16_t* const)ph, cksum);
+ return detail::cksum_add(buf, len, cksum);
}
-uint16_t icmp_cksum(const uint16_t *buf, size_t len)
+inline uint16_t icmp_cksum(const uint16_t *buf, size_t len)
{
- return cksum_add(buf, len, 0);
+ return detail::cksum_add(buf, len, 0);
}
-uint16_t tcp_cksum(const uint16_t *h,
+inline uint16_t tcp_cksum(const uint16_t *h,
std::size_t len,
- Pseudoheader *ph )
+ const Pseudoheader* const ph )
{
uint32_t cksum = 0;
- add_ipv4_pseudoheader((uint16_t *)ph, cksum);
- add_tcp_header(h, len, cksum);
- return cksum_add(h, len, cksum);
+ detail::add_ipv4_pseudoheader((const uint16_t* const)ph, cksum);
+ detail::add_tcp_header(h, len, cksum);
+ return detail::cksum_add(h, len, cksum);
}
-uint16_t tcp_cksum(const uint16_t *buf,
+inline uint16_t tcp_cksum(const uint16_t *buf,
std::size_t len,
- Pseudoheader6 *ph )
+ const Pseudoheader6* const ph )
{
uint32_t cksum = 0;
- add_ipv6_pseudoheader((uint16_t *)ph, cksum);
- add_tcp_header(buf, len, cksum);
- return cksum_add(buf, len, cksum);
+ detail::add_ipv6_pseudoheader((const uint16_t* const)ph, cksum);
+ detail::add_tcp_header(buf, len, cksum);
+ return detail::cksum_add(buf, len, cksum);
}
-uint16_t udp_cksum(const uint16_t *buf,
+inline uint16_t udp_cksum(const uint16_t *buf,
std::size_t len,
- Pseudoheader *ph )
+ const Pseudoheader* const ph )
{
uint32_t cksum = 0;
- add_ipv4_pseudoheader((uint16_t *)ph, cksum);
- add_udp_header(buf, len, cksum);
- return cksum_add(buf, len, cksum);
+ detail::add_ipv4_pseudoheader((const uint16_t* const)ph, cksum);
+ detail::add_udp_header(buf, len, cksum);
+ return detail::cksum_add(buf, len, cksum);
}
-uint16_t udp_cksum(const uint16_t *buf,
+inline uint16_t udp_cksum(const uint16_t *buf,
std::size_t len,
- Pseudoheader6 *ph )
+ const Pseudoheader6* const ph )
{
uint32_t cksum = 0;
- add_ipv6_pseudoheader((uint16_t *)ph, cksum);
- add_udp_header(buf, len, cksum);
- return cksum_add(buf, len, cksum);
+ detail::add_ipv6_pseudoheader((const uint16_t* const)ph, cksum);
+ detail::add_udp_header(buf, len, cksum);
+ return detail::cksum_add(buf, len, cksum);
}
-uint16_t ip_cksum(const uint16_t *buf, std::size_t len)
+inline uint16_t ip_cksum(const uint16_t *buf, std::size_t len)
{
uint32_t cksum = 0;
- add_ip_header(buf, len, cksum);
- return cksum_add(buf, len, cksum);
+ detail::add_ip_header(buf, len, cksum);
+ return detail::cksum_add(buf, len, cksum);
}
-uint16_t cksum_add(const uint16_t *buf, std::size_t len)
-{
- return cksum_add(buf, len, 0);
-}
+static inline uint16_t cksum_add(const uint16_t *buf, std::size_t len)
+{ return detail::cksum_add(buf, len, 0); }
} // namespace checksum
+
+#endif /* CODECS_CHECKSUM_H */
-if( STATIC_CODECS )
+if(STATIC_CODECS)
set( PLUGIN_SOURCES
+ cd_arp.cc
+ cd_eapol.cc
cd_erspan2.cc
- cd_erspan2_module.h
- cd_erspan2_module.cc
cd_erspan3.cc
- cd_erspan3_module.h
- cd_erspan3_module.cc
- cd_eth_loopback.cc
cd_mpls.cc
- cd_mpls_module.h
- cd_mpls_module.cc
- cd_pppencap.cc
+ cd_ppp_encap.cc
cd_pppoe.cc
- cd_pppoe_module.h
- cd_pppoe_module.cc
- cd_transbridge.cc
+ cd_trans_bridge.cc
cd_vlan.cc
- cd_vlan_module.h
- cd_vlan_module.cc
)
- if(ENABLE_NON_ETHER_DECODERS)
- set( PLUGIN_SOURCES
- ${PLUGIN_SOURCES}
- cd_eapol.cc
- cd_eapol_module.h
- cd_eapol_module.cc
- )
- endif(ENABLE_NON_ETHER_DECODERS)
else(STATIC_CODECS)
- add_shared_library(cd_erspan2 codecs cd_erspan2.cc cd_erspan2_module.h cd_erspan2_module.cc)
- add_shared_library(cd_erspan3 codecs cd_erspan3.cc cd_erspan3_module.h cd_erspan3_module.cc)
- add_shared_library(cd_eth_loopback codecs cd_eth_loopback.cc)
- add_shared_library(cd_mpls codecs cd_mpls.cc cd_mpls_module.h cd_mpls_module.cc)
- add_shared_library(cd_pppencap codecs cd_pppencap.cc)
- add_shared_library(cd_pppoe codecs cd_pppoe.cc cd_pppoe_module.h cd_pppoe_module.cc)
- add_shared_library(cd_transbridge codecs cd_transbridge.cc)
- add_shared_library(cd_vlan codecs cd_vlan.cc cd_vlan_module.h cd_vlan_module.cc)
-
- if(ENABLE_NON_ETHER_DECODERS)
- add_shared_library(cd_eapol codecs cd_eapol.cc cd_eapol_module.h cd_eapol_module.cc)
- endif(ENABLE_NON_ETHER_DECODERS)
+ add_shared_library(cd_arp codecs cd_arp.cc)
+ add_shared_library(cd_erspan2 codecs cd_erspan2.cc)
+ add_shared_library(cd_erspan3 codecs cd_erspan3.cc)
+ add_shared_library(cd_mpls codecs cd_mpls.cc)
+ add_shared_library(cd_ppp_encap codecs cd_ppp_encap.cc)
+ add_shared_library(cd_pppoe codecs cd_pppoe.cc)
+ add_shared_library(cd_trans_bridge codecs cd_trans_bridge.cc)
+ add_shared_library(cd_vlan codecs cd_vlan.cc)
+ add_shared_library(cd_eapol codecs cd_eapol.cc)
endif(STATIC_CODECS)
-add_library( link_codecs STATIC
- cd_arp.cc
- cd_arp_module.h
- cd_arp_module.cc
- ${PLUGIN_SOURCES}
-)
-target_link_libraries( link_codecs
- events
- managers
-)
+# NOTE: if any static libraries need to built, this extra if()
+# MUST be removed. It is here because cmake sends out
+# a warning if no files exist in the link codecs library
+
+if(STATIC_CODECS)
+ add_library( link_codecs STATIC
+ ${PLUGIN_SOURCES}
+ )
+
+
+ target_link_libraries( link_codecs
+ events
+ managers
+ )
+
+endif(STATIC_CODECS)
noinst_LIBRARIES = liblink_codecs.a
-liblink_codecs_a_SOURCES = \
-cd_arp.cc \
-cd_arp_module.h \
-cd_arp_module.cc
-
plugin_list = \
+cd_arp.cc \
+cd_eapol.cc \
cd_erspan2.cc \
-cd_erspan2_module.h \
-cd_erspan2_module.cc \
cd_erspan3.cc \
-cd_erspan3_module.h \
-cd_erspan3_module.cc \
-cd_eth_loopback.cc \
cd_mpls.cc \
-cd_mpls_module.h \
-cd_mpls_module.cc \
-cd_pppencap.cc \
+cd_ppp_encap.cc \
cd_pppoe.cc \
-cd_pppoe_module.h \
-cd_pppoe_module.cc \
-cd_transbridge.cc \
-cd_vlan.cc \
-cd_vlan_module.h \
-cd_vlan_module.cc
+cd_trans_bridge.cc \
+cd_vlan.cc
-if ENABLE_NON_ETHER_DECODER
-plugin_list += cd_eapol.cc cd_eapol_module.h cd_eapol_module.cc
-endif
-
if STATIC_CODECS
-liblink_codecs_a_SOURCES += $(plugin_list)
+liblink_codecs_a_SOURCES = $(plugin_list)
else
ehlibdir = $(pkglibdir)/codecs
-ehlib_LTLIBRARIES = libcd_erspan2.la
+ehlib_LTLIBRARIES = libcd_arp.la
+libcd_arp_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
+libcd_arp_la_LDFLAGS = -export-dynamic -shared
+libcd_arp_la_SOURCES = cd_arp.cc
+
+ehlib_LTLIBRARIES += libcd_erspan2.la
libcd_erspan2_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
libcd_erspan2_la_LDFLAGS = -export-dynamic -shared
-libcd_erspan2_la_SOURCES = cd_erspan2.cc cd_erspan2_module.h cd_erspan2_module.cc
+libcd_erspan2_la_SOURCES = cd_erspan2.cc
ehlib_LTLIBRARIES += libcd_erspan3.la
libcd_erspan3_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
libcd_erspan3_la_LDFLAGS = -export-dynamic -shared
-libcd_erspan3_la_SOURCES = cd_erspan3.cc cd_erspan3_module.h cd_erspan3_module.cc
+libcd_erspan3_la_SOURCES = cd_erspan3.cc
ehlib_LTLIBRARIES += libcd_mpls.la
libcd_mpls_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
libcd_mpls_la_LDFLAGS = -export-dynamic -shared
-libcd_mpls_la_SOURCES = cd_mpls.cc cd_mpls_module.h cd_mpls_module.cc
+libcd_mpls_la_SOURCES = cd_mpls.cc
ehlib_LTLIBRARIES += libcd_vlan.la
libcd_vlan_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
libcd_vlan_la_LDFLAGS = -export-dynamic -shared
-libcd_vlan_la_SOURCES = cd_vlan.cc cd_vlan_module.h cd_vlan_module.cc
-
-ehlib_LTLIBRARIES += libcd_eth_loopback.la
-libcd_eth_loopback_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
-libcd_eth_loopback_la_LDFLAGS = -export-dynamic -shared
-libcd_eth_loopback_la_SOURCES = cd_eth_loopback.cc
+libcd_vlan_la_SOURCES = cd_vlan.cc
-ehlib_LTLIBRARIES += libcd_pppencap.la
-libcd_pppencap_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
-libcd_pppencap_la_LDFLAGS = -export-dynamic -shared
-libcd_pppencap_la_SOURCES = cd_pppencap.cc
+ehlib_LTLIBRARIES += libcd_ppp_encap.la
+libcd_ppp_encap_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
+libcd_ppp_encap_la_LDFLAGS = -export-dynamic -shared
+libcd_ppp_encap_la_SOURCES = cd_ppp_encap.cc
-ehlib_LTLIBRARIES += libcd_transbridge.la
-libcd_transbridge_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
-libcd_transbridge_la_LDFLAGS = -export-dynamic -shared
-libcd_transbridge_la_SOURCES = cd_transbridge.cc
+ehlib_LTLIBRARIES += libcd_trans_bridge.la
+libcd_trans_bridge_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
+libcd_trans_bridge_la_LDFLAGS = -export-dynamic -shared
+libcd_trans_bridge_la_SOURCES = cd_trans_bridge.cc
ehlib_LTLIBRARIES += libcd_pppoe.la
libcd_pppoe_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
libcd_pppoe_la_LDFLAGS = -export-dynamic -shared
-libcd_pppoe_la_SOURCES = cd_pppoe.cc cd_pppoe_module.h cd_pppoe_module.cc
+libcd_pppoe_la_SOURCES = cd_pppoe.cc
-if ENABLE_NON_ETHER_DECODER
-
ehlib_LTLIBRARIES += libcd_eapol.la
libcd_eapol_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
libcd_eapol_la_LDFLAGS = -export-dynamic -shared
-libcd_eapol_la_SOURCES = cd_eapol.cc cd_eapol_module.h cd_eapol_module.cc
-endif
+libcd_eapol_la_SOURCES = cd_eapol.cc
endif
#include "framework/codec.h"
-#include "codecs/link/cd_arp_module.h"
+#include "codecs/decode_module.h"
#include "codecs/codec_events.h"
#include "protocols/protocol_ids.h"
#include "codecs/sf_protocols.h"
namespace
{
+#define CD_ARP_NAME "arp"
+
+static const RuleMap arp_rules[] =
+{
+ { DECODE_ARP_TRUNCATED, "(" CD_ARP_NAME ") Truncated ARP" },
+ { 0, nullptr }
+};
+
+
+class ArpModule : public DecodeModule
+{
+public:
+ ArpModule() : DecodeModule(CD_ARP_NAME) {}
+
+ const RuleMap* get_rules() const
+ { return arp_rules; }
+};
+
+
class ArpCodec : public Codec
{
public:
dtor, // dtor
};
+#ifdef BUILDING_SO
+SO_PUBLIC const BaseApi* snort_plugins[] =
+{
+ &arp_api.base,
+ nullptr
+};
+#else
const BaseApi* cd_arp = &arp_api.base;
+#endif
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-// cd_arp_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
-
-#include "codecs/link/cd_arp_module.h"
-
-static const RuleMap arp_rules[] =
-{
- { DECODE_ARP_TRUNCATED, "(" CD_ARP_NAME ") Truncated ARP" },
- { 0, nullptr }
-};
-
-//-------------------------------------------------------------------------
-// rpc module
-//-------------------------------------------------------------------------
-
-ArpModule::ArpModule() : DecodeModule(CD_ARP_NAME)
-{ }
-
-const RuleMap* ArpModule::get_rules() const
-{ return arp_rules; }
-
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-// cd_arp_module.h author Josh Rosenbaum <jrosenba@cisco.com>
-
-#ifndef CD_ARP_MODULE_H
-#define CD_ARP_MODULE_H
-
-#include "codecs/decode_module.h"
-
-
-#define CD_ARP_NAME "arp"
-
-class ArpModule : public DecodeModule
-{
-public:
- ArpModule();
-
- const RuleMap* get_rules() const;
-};
-
-#endif
** along with this program; if not, write to the Free Software
** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
+// cd_eapol.cc author Josh Rosenbaum <jrosenba@cisco.com>
#endif
#include "framework/codec.h"
-#include "codecs/link/cd_eapol_module.h"
+#include "codecs/decode_module.h"
#include "codecs/codec_events.h"
#include "protocols/protocol_ids.h"
#include "protocols/eapol.h"
namespace
{
+#define CD_EAPOL_NAME "eapol"
+static const RuleMap eapol_rules[] =
+{
+ { DECODE_EAPOL_TRUNCATED, "(" CD_EAPOL_NAME ") Truncated EAP Header" },
+ { DECODE_EAPKEY_TRUNCATED, "(" CD_EAPOL_NAME ") EAP Key Truncated" },
+ { DECODE_EAP_TRUNCATED, "(" CD_EAPOL_NAME ") EAP Header Truncated" },
+ { 0, nullptr }
+};
+
+class EapolModule : public DecodeModule
+{
+public:
+ EapolModule() : DecodeModule(CD_EAPOL_NAME) {}
+
+ const RuleMap* get_rules() const
+ { return eapol_rules; }
+};
+
class EapolCodec : public Codec
{
public:
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-// cd_eapol_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
-
-#include "codecs/link/cd_eapol_module.h"
-
-static const RuleMap eapol_rules[] =
-{
- { DECODE_EAPOL_TRUNCATED, "(" CD_EAPOL_NAME ") Truncated EAP Header" },
- { DECODE_EAPKEY_TRUNCATED, "(" CD_EAPOL_NAME ") EAP Key Truncated" },
- { DECODE_EAP_TRUNCATED, "(" CD_EAPOL_NAME ") EAP Header Truncated" },
- { 0, nullptr }
-};
-
-//-------------------------------------------------------------------------
-// rpc module
-//-------------------------------------------------------------------------
-
-EapolModule::EapolModule() : DecodeModule(CD_EAPOL_NAME)
-{ }
-
-const RuleMap* EapolModule::get_rules() const
-{ return eapol_rules; }
-
-bool EapolModule::set(const char* /*fqn*/, Value& /*v*/, SnortConfig* /*sc*/)
-{ return true; }
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-// cd_eapol_module.h author Josh Rosenbaum <jrosenba@cisco.com>
-
-#ifndef CD_EAPOL_MODULE_H
-#define CD_EAPOL_MODULE_H
-
-#include "codecs/decode_module.h"
-
-
-#define CD_EAPOL_NAME "eapol"
-
-class EapolModule : public DecodeModule
-{
-public:
- EapolModule();
-
- const RuleMap* get_rules() const;
- bool set(const char*, Value&, SnortConfig*);
-};
-
-#endif
#include "framework/codec.h"
-#include "codecs/link/cd_erspan2_module.h"
+#include "codecs/decode_module.h"
#include "codecs/codec_events.h"
#include "protocols/protocol_ids.h"
#include "codecs/sf_protocols.h"
namespace
{
+#define CD_ERSPAN2_NAME "erspan2"
+
+static const RuleMap erspan2_rules[] =
+{
+ { DECODE_ERSPAN_HDR_VERSION_MISMATCH, "(codec_erspan) ERSpan Header version mismatch" },
+ { DECODE_ERSPAN2_DGRAM_LT_HDR, "(" CD_ERSPAN2_NAME ") captured < ERSpan Type2 Header Length" },
+ { 0, nullptr }
+};
+
+class Erspan2Module : public DecodeModule
+{
+public:
+ Erspan2Module() : DecodeModule(CD_ERSPAN2_NAME) {}
+
+ const RuleMap* get_rules() const
+ { return erspan2_rules; }
+};
+
+
class Erspan2Codec : public Codec
{
public:
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-// cd_erspan2_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
-
-#include "codecs/link/cd_erspan2_module.h"
-
-static const RuleMap erspan2_rules[] =
-{
- { DECODE_ERSPAN_HDR_VERSION_MISMATCH, "(codec_erspan) ERSpan Header version mismatch" },
- { DECODE_ERSPAN2_DGRAM_LT_HDR, "(" CD_ERSPAN2_NAME ") captured < ERSpan Type2 Header Length" },
- { 0, nullptr }
-};
-
-//-------------------------------------------------------------------------
-// rpc module
-//-------------------------------------------------------------------------
-
-Erspan2Module::Erspan2Module() : DecodeModule(CD_ERSPAN2_NAME)
-{ }
-
-const RuleMap* Erspan2Module::get_rules() const
-{ return erspan2_rules; }
-
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-// cd_erspan2_module.h author Josh Rosenbaum <jrosenba@cisco.com>
-
-#ifndef CD_ERSPAN2_MODULE_H
-#define CD_ERSPAN2_MODULE_H
-
-#include "codecs/decode_module.h"
-
-
-#define CD_ERSPAN2_NAME "erspan2"
-
-class Erspan2Module : public DecodeModule
-{
-public:
- Erspan2Module();
-
- const RuleMap* get_rules() const;
-};
-
-#endif
#include "framework/codec.h"
-#include "codecs/link/cd_erspan3_module.h"
+#include "codecs/decode_module.h"
#include "codecs/codec_events.h"
#include "protocols/protocol_ids.h"
#include "codecs/sf_protocols.h"
namespace
{
+#define CD_ERSPAN3_NAME "erspan3"
+static const RuleMap erspan3_rules[] =
+{
+ { DECODE_ERSPAN3_DGRAM_LT_HDR, "(" CD_ERSPAN3_NAME ") captured < ERSpan Type3 Header Length" },
+ { 0, nullptr }
+};
+
+class Erspan3Module : public DecodeModule
+{
+public:
+ Erspan3Module() : DecodeModule(CD_ERSPAN3_NAME) {}
+
+ const RuleMap* get_rules() const
+ { return erspan3_rules; }
+};
+
+
class Erspan3Codec : public Codec
{
public:
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-// cd_erspan3_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
-
-#include "codecs/link/cd_erspan3_module.h"
-
-static const RuleMap erspan3_rules[] =
-{
- { DECODE_ERSPAN3_DGRAM_LT_HDR, "(" CD_ERSPAN3_NAME ") captured < ERSpan Type3 Header Length" },
- { 0, nullptr }
-};
-
-//-------------------------------------------------------------------------
-// rpc module
-//-------------------------------------------------------------------------
-
-Erspan3Module::Erspan3Module() : DecodeModule(CD_ERSPAN3_NAME)
-{ }
-
-const RuleMap* Erspan3Module::get_rules() const
-{ return erspan3_rules; }
-
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-// cd_erspan3_module.h author Josh Rosenbaum <jrosenba@cisco.com>
-
-#ifndef CD_ERSPAN3_MODULE_H
-#define CD_ERSPAN3_MODULE_H
-
-#include "codecs/decode_module.h"
-
-
-#define CD_ERSPAN3_NAME "erspan3"
-
-class Erspan3Module : public DecodeModule
-{
-public:
- Erspan3Module();
-
- const RuleMap* get_rules() const;
-};
-
-#endif
+++ /dev/null
-/*
-** Copyright (C) 2002-2013 Sourcefire, Inc.
-** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-// cd_ethloopback.cc author Josh Rosenbaum <jrosenba@cisco.com>
-
-
-#include "framework/codec.h"
-#include "codecs/decode_module.h"
-#include "codecs/codec_events.h"
-
-namespace
-{
-
-#define CD_ETHLOOPBACK_NAME "ethloopback"
-
-
-class EthLoopbackCodec : public Codec
-{
-public:
- EthLoopbackCodec() : Codec(CD_ETHLOOPBACK_NAME){};
- ~EthLoopbackCodec(){};
-
-
- virtual void get_protocol_ids(std::vector<uint16_t>& v);
- virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
- Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
-
-
-};
-
-const uint16_t ETHERNET_TYPE_LOOP = 0x9000;
-
-
-} // anonymous namespace
-
-
-void EthLoopbackCodec::get_protocol_ids(std::vector<uint16_t>& v)
-{
- v.push_back(ETHERNET_TYPE_LOOP);
-}
-
-bool EthLoopbackCodec::decode(const uint8_t* /*raw_pkt*/, const uint32_t& /*raw_len*/,
- Packet* /*p*/, uint16_t& /*lyr_len*/, uint16_t& /*next_prot_id*/)
-{
-
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "EthLoopback is not supported.\n"););
- return true;
-}
-
-
-//-------------------------------------------------------------------------
-// api stuff
-//-------------------------------------------------------------------------
-
-static Codec* ctor(Module*)
-{
- return new EthLoopbackCodec();
-}
-
-static void dtor(Codec *cd)
-{
- delete cd;
-}
-
-static const CodecApi ethloopback_api =
-{
- {
- PT_CODEC,
- CD_ETHLOOPBACK_NAME,
- CDAPI_PLUGIN_V0,
- 0,
- nullptr,
- nullptr,
- },
- nullptr, // pinit
- nullptr, // pterm
- nullptr, // tinit
- nullptr, // tterm
- ctor, // ctor
- dtor, // dtor
-};
-
-
-#ifdef BUILDING_SO
-SO_PUBLIC const BaseApi* snort_plugins[] =
-{
- ðloopback_api.base,
- nullptr
-};
-#else
-const BaseApi* cd_ethloopback = ðloopback_api.base;
-#endif
-
-
#include "packet_io/active.h"
#include "protocols/protocol_ids.h"
#include "protocols/mpls.h"
-#include "codecs/link/cd_mpls_module.h"
#include "codecs/sf_protocols.h"
+#include "main/snort_config.h"
+#include "main/snort.h"
namespace
{
+#define CD_MPLS_NAME "mpls"
+
+static const Parameter mpls_params[] =
+{
+ { "enable_mpls_multicast", Parameter::PT_BOOL, nullptr, "false",
+ "enables support for MPLS multicast" },
+
+ { "enable_mpls_overlapping_ip", Parameter::PT_BOOL, nullptr, "false",
+ "enable if private network addresses overlap and must be differentiated by MPLS label(s)" },
+
+ { "max_mpls_stack_depth", Parameter::PT_INT, "-1:", "-1",
+ "set MPLS stack depth" },
+
+ { "mpls_payload_type", Parameter::PT_ENUM, "eth | ip4 | ip6", "ip4",
+ "set encapsulated payload type" },
+
+ { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
+};
+
+
+// rules which will loaded into snort.
+// You can now reference these rules by calling a codec_event
+// in your main codec's functions
+static const RuleMap mpls_rules[] =
+{
+ { DECODE_BAD_MPLS, "(" CD_MPLS_NAME ") Bad MPLS Frame" },
+ { DECODE_BAD_MPLS_LABEL0, "(" CD_MPLS_NAME ") MPLS Label 0 Appears in Nonbottom Header" },
+ { DECODE_BAD_MPLS_LABEL1, "(" CD_MPLS_NAME ") MPLS Label 1 Appears in Bottom Header" },
+ { DECODE_BAD_MPLS_LABEL2, "(" CD_MPLS_NAME ") MPLS Label 2 Appears in Nonbottom Header" },
+ { DECODE_BAD_MPLS_LABEL3, "(" CD_MPLS_NAME ") MPLS Label 3 Appears in Header" },
+ { DECODE_MPLS_RESERVED_LABEL, "(" CD_MPLS_NAME ") MPLS Label 4, 5,.. or 15 Appears in Header" },
+ { DECODE_MPLS_LABEL_STACK, "(" CD_MPLS_NAME ") Too Many MPLS headers" },
+ { 0, nullptr }
+};
+
+class MplsModule : public DecodeModule
+{
+public:
+ MplsModule() : DecodeModule(CD_MPLS_NAME) {};
+
+ const RuleMap* get_rules() const
+ { return mpls_rules; }
+
+ bool set(const char*, Value& v, SnortConfig* sc)
+ {
+ if ( v.is("enable_mpls_multicast") )
+ {
+ if ( v.get_bool() )
+ sc->run_flags |= RUN_FLAG__MPLS_MULTICAST; // FIXIT move to existing bitfield
+ }
+ else if ( v.is("enable_mpls_overlapping_ip") )
+ {
+ if ( v.get_bool() )
+ sc->run_flags |= RUN_FLAG__MPLS_OVERLAPPING_IP; // FIXIT move to existing bitfield
+ }
+ else if ( v.is("max_mpls_stack_depth") )
+ {
+ sc->mpls_stack_depth = v.get_long();
+ }
+ else if ( v.is("mpls_payload_type") )
+ {
+ sc->mpls_payload_type = v.get_long() + 1;
+ }
+ else
+ return false;
+
+ return true;
+ }
+};
class MplsCodec : public Codec
{
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-// cd_mpls_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
-
-#include "codecs/link/cd_mpls_module.h"
-#include "main/snort_config.h"
-#include "main/snort.h"
-
-static const Parameter mpls_params[] =
-{
- { "enable_mpls_multicast", Parameter::PT_BOOL, nullptr, "false",
- "enables support for MPLS multicast" },
-
- { "enable_mpls_overlapping_ip", Parameter::PT_BOOL, nullptr, "false",
- "enable if private network addresses overlap and must be differentiated by MPLS label(s)" },
-
- { "max_mpls_stack_depth", Parameter::PT_INT, "-1:", "-1",
- "set MPLS stack depth" },
-
- { "mpls_payload_type", Parameter::PT_ENUM, "eth | ip4 | ip6", "ip4",
- "set encapsulated payload type" },
-
- { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
-};
-
-
-// rules which will loaded into snort.
-// You can now reference these rules by calling a codec_event
-// in your main codec's functions
-static const RuleMap mpls_rules[] =
-{
- { DECODE_BAD_MPLS, "(" CD_MPLS_NAME ") Bad MPLS Frame" },
- { DECODE_BAD_MPLS_LABEL0, "(" CD_MPLS_NAME ") MPLS Label 0 Appears in Nonbottom Header" },
- { DECODE_BAD_MPLS_LABEL1, "(" CD_MPLS_NAME ") MPLS Label 1 Appears in Bottom Header" },
- { DECODE_BAD_MPLS_LABEL2, "(" CD_MPLS_NAME ") MPLS Label 2 Appears in Nonbottom Header" },
- { DECODE_BAD_MPLS_LABEL3, "(" CD_MPLS_NAME ") MPLS Label 3 Appears in Header" },
- { DECODE_MPLS_RESERVED_LABEL, "(" CD_MPLS_NAME ") MPLS Label 4, 5,.. or 15 Appears in Header" },
- { DECODE_MPLS_LABEL_STACK, "(" CD_MPLS_NAME ") Too Many MPLS headers" },
- { 0, nullptr }
-};
-
-//-------------------------------------------------------------------------
-// mpls module
-//-------------------------------------------------------------------------
-
-MplsModule::MplsModule() : DecodeModule(CD_MPLS_NAME, mpls_params)
-{ }
-
-const RuleMap* MplsModule::get_rules() const
-{ return mpls_rules; }
-
-bool MplsModule::set(const char*, Value& v, SnortConfig* sc)
-{
- if ( v.is("enable_mpls_multicast") )
- {
- if ( v.get_bool() )
- sc->run_flags |= RUN_FLAG__MPLS_MULTICAST; // FIXIT move to existing bitfield
- }
- else if ( v.is("enable_mpls_overlapping_ip") )
- {
- if ( v.get_bool() )
- sc->run_flags |= RUN_FLAG__MPLS_OVERLAPPING_IP; // FIXIT move to existing bitfield
- }
- else if ( v.is("max_mpls_stack_depth") )
- sc->mpls_stack_depth = v.get_long();
-
- else if ( v.is("mpls_payload_type") )
- sc->mpls_payload_type = v.get_long() + 1;
-
- else
- return false;
-
- return true;
-}
-
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-// cd_mpls_module.h author Josh Rosenbaum <jrosenba@cisco.com>
-
-#ifndef CD_MPLS_MODULE_H
-#define CD_MPLS_MODULE_H
-
-#include "codecs/decode_module.h"
-
-
-#define CD_MPLS_NAME "mpls"
-
-class MplsModule : public DecodeModule
-{
-public:
- MplsModule();
-
- const RuleMap* get_rules() const;
- bool set(const char*, Value&, SnortConfig*);
-};
-
-#endif
-
namespace
{
-#define CD_PPPENCAP_NAME "pppencap"
+#define CD_PPPENCAP_NAME "ppp_encap"
class PppEncap : public Codec
{
return false;
}
- ((IPHdr *)(raw_pkt + lyr_len))->ip_proto = IPPROTO_TCP;
+ ((IP4Hdr *)(raw_pkt + lyr_len))->ip_proto = IPPROTO_TCP;
/* fall through */
case PPP_IP:
#include "framework/codec.h"
-#include "codecs/link/cd_pppoe_module.h"
+#include "codecs/decode_module.h"
#include "codecs/codec_events.h"
#include "protocols/packet.h"
#include "codecs/sf_protocols.h"
/* payload follows */
};
+
+
+//-------------------------------------------------------------------------
+// General PPPoEpkt module.
+//
+// ***** NOTE: THE CODEC HAS A DIFFERENT NAME!
+// * Additionally, this module is used for generator a rule stub ONLY!
+// * If you want to create a module for configuration, you must change the
+// * names of the correct PPPoEpkt codec
+//-------------------------------------------------------------------------
+#define CD_PPPOE_NAME "pppoe"
+static const RuleMap pppoe_rules[] =
+{
+ { DECODE_BAD_PPPOE, "(" CD_PPPOE_NAME ") Bad PPPOE frame detected" },
+ { 0, nullptr }
+};
+
+class PPPoEModule : public DecodeModule
+{
+public:
+ PPPoEModule() : DecodeModule(CD_PPPOE_NAME) {}
+
+ const RuleMap* get_rules() const
+ { return pppoe_rules; }
+};
+
} // namespace
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-// cd_pppoe_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
-
-#include "codecs/link/cd_pppoe_module.h"
-
-static const RuleMap pppoe_rules[] =
-{
- { DECODE_BAD_PPPOE, "(" CD_PPPOE_NAME ") Bad PPPOE frame detected" },
- { 0, nullptr }
-};
-
-//-------------------------------------------------------------------------
-// General PPPoEpkt module.
-//
-// ***** NOTE: THE CODEC HAS A DIFFERENT NAME!
-// * Additionally, this module is used for generator a rule stub ONLY!
-// * If you want to create a module for configuration, you must change the
-// * names of the correct PPPoEpkt codec
-//-------------------------------------------------------------------------
-
-/// ^^^ READ THE COMMENT!
-PPPoEModule::PPPoEModule() : DecodeModule(CD_PPPOE_NAME)
-{ }
-
-const RuleMap* PPPoEModule::get_rules() const
-{ return pppoe_rules; }
-
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-// cd_pppoepkt_module.h author Josh Rosenbaum <jrosenba@cisco.com>
-
-#ifndef CD_PPPOEPKT_MODULE_H
-#define CD_PPPOEPKT_MODULE_H
-
-#include "codecs/decode_module.h"
-
-
-/*
- * NOTE: This name reflect the file...NOT the Codec!
- *
- * Additionally, this module is used for generator a rule stub ONLY!
- * If you want to create a module for configuration, you must change the
- * names of the correct PPPoEpkt codec
- */
-
-
-#define CD_PPPOE_NAME "pppoe"
-
-class PPPoEModule : public DecodeModule
-{
-public:
- PPPoEModule();
-
- const RuleMap* get_rules() const;
-};
-
-#endif
namespace
{
-#define CD_TRANSBRIDGE_NAME "transbridge"
+#define CD_TRANSBRIDGE_NAME "trans_ether_bridging"
class TransbridgeCodec : public Codec
{
#include "protocols/packet.h"
#include "framework/codec.h"
-#include "codecs/link/cd_vlan_module.h"
+#include "codecs/decode_module.h"
#include "codecs/codec_events.h"
#include "protocols/vlan.h"
#include "protocols/protocol_ids.h"
namespace
{
+#define CD_VLAN_NAME "vlan"
+static const RuleMap vlan_rules[] =
+{
+ { DECODE_BAD_VLAN, "(" CD_VLAN_NAME ") Bad VLAN Frame" },
+ { DECODE_BAD_VLAN_ETHLLC, "(" CD_VLAN_NAME ") Bad LLC header" },
+ { DECODE_BAD_VLAN_OTHER, "(" CD_VLAN_NAME ") Bad Extra LLC Info" },
+ { 0, nullptr }
+};
+
+class VlanModule : public DecodeModule
+{
+public:
+ VlanModule() : DecodeModule(CD_VLAN_NAME) {}
+
+ const RuleMap* get_rules() const
+ { return vlan_rules; }
+};
+
+
class VlanCodec : public Codec
{
public:
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-// cd_vlan_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
-
-#include "codecs/link/cd_vlan_module.h"
-
-static const RuleMap vlan_rules[] =
-{
- { DECODE_BAD_VLAN, "(" CD_VLAN_NAME ") Bad VLAN Frame" },
- { DECODE_BAD_VLAN_ETHLLC, "(" CD_VLAN_NAME ") Bad LLC header" },
- { DECODE_BAD_VLAN_OTHER, "(" CD_VLAN_NAME ") Bad Extra LLC Info" },
- { 0, nullptr }
-};
-
-//-------------------------------------------------------------------------
-// rpc module
-//-------------------------------------------------------------------------
-
-VlanModule::VlanModule() : DecodeModule(CD_VLAN_NAME)
-{ }
-
-const RuleMap* VlanModule::get_rules() const
-{ return vlan_rules; }
-
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-// cd_vlan_module.h author Josh Rosenbaum <jrosenba@cisco.com>
-
-#ifndef CD_VLAN_MODULE_H
-#define CD_VLAN_MODULE_H
-
-#include "codecs/decode_module.h"
-
-
-#define CD_VLAN_NAME "vlan"
-
-class VlanModule : public DecodeModule
-{
-public:
- VlanModule();
-
- const RuleMap* get_rules() const;
-};
-
-#endif
if(STATIC_CODECS)
set(PLUGIN_LIST
- cd_ip4_embedded_in_icmp.cc
- cd_ip6_embedded_in_icmp.cc
- cd_prot_embedded_in_icmp.cc
+ cd_icmp4_ip.cc
+ cd_icmp6_ip.cc
cd_gtp.cc
- cd_gtp_module.h
- cd_gtp_module.cc
cd_teredo.cc
)
else(STATIC_CODECS)
- add_shared_library(cd_gtp codecs cd_gtp.cc cd_gtp_module.h cd_gtp_module.cc)
+ add_shared_library(cd_gtp codecs cd_gtp.cc)
add_shared_library(cd_teredo codecs cd_teredo.cc)
- add_shared_library(cd_ip4_embedded_in_icmp codecs cd_ip4_embedded_in_icmp.cc)
- add_shared_library(cd_ip6_embedded_in_icmp codecs cd_ip6_embedded_in_icmp.cc)
- add_shared_library(cd_prot_embedded_in_icmp codecs cd_prot_embedded_in_icmp.cc)
-
- # When static codecs NOT enabled, the icmp files will be included in the
- # ICMP libraries in the other file.
+ add_shared_library(cd_icmp4_ip codecs cd_icmp4_ip.cc)
+ add_shared_library(cd_icmp6_ip codecs cd_icmp6_ip.cc)
endif(STATIC_CODECS)
plugin_list = \
cd_gtp.cc \
-cd_gtp_module.h \
-cd_gtp_module.cc \
cd_teredo.cc \
-cd_ip4_embedded_in_icmp.cc \
-cd_ip6_embedded_in_icmp.cc \
-cd_prot_embedded_in_icmp.cc
+cd_icmp4_ip.cc \
+cd_icmp6_ip.cc
if STATIC_CODECS
libmisc_codecs_a_SOURCES += $(plugin_list)
ehlib_LTLIBRARIES = libcd_gtp.la
libcd_gtp_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
libcd_gtp_la_LDFLAGS = -export-dynamic -shared
-libcd_gtp_la_SOURCES = cd_gtp.cc cd_gtp_module.h cd_gtp_module.cc
+libcd_gtp_la_SOURCES = cd_gtp.cc
ehlib_LTLIBRARIES += libcd_teredo.la
libcd_teredo_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
libcd_teredo_la_LDFLAGS = -export-dynamic -shared
libcd_teredo_la_SOURCES = cd_teredo.cc
-ehlib_LTLIBRARIES += libcd_ip4_embedded_in_icmp.la
-libcd_ip4_embedded_in_icmp_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
-libcd_ip4_embedded_in_icmp_la_LDFLAGS = -export-dynamic -shared
-libcd_ip4_embedded_in_icmp_la_SOURCES = cd_ip4_embedded_in_icmp.cc
+ehlib_LTLIBRARIES += libcd_icmp4_ip.la
+libcd_icmp4_ip_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
+libcd_icmp4_ip_la_LDFLAGS = -export-dynamic -shared
+libcd_icmp4_ip_la_SOURCES = cd_icmp4_ip.cc
-ehlib_LTLIBRARIES += libcd_ip6_embedded_in_icmp.la
-libcd_ip6_embedded_in_icmp_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
-libcd_ip6_embedded_in_icmp_la_LDFLAGS = -export-dynamic -shared
-libcd_ip6_embedded_in_icmp_la_SOURCES = cd_ip6_embedded_in_icmp.cc
+ehlib_LTLIBRARIES += libcd_icmp6_ip.la
+libcd_icmp6_ip_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
+libcd_icmp6_ip_la_LDFLAGS = -export-dynamic -shared
+libcd_icmp6_ip_la_SOURCES = cd_icmp6_ip.cc
-ehlib_LTLIBRARIES += libcd_prot_embedded_in_icmp.la
-libcd_prot_embedded_in_icmp_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
-libcd_prot_embedded_in_icmp_la_LDFLAGS = -export-dynamic -shared
-libcd_prot_embedded_in_icmp_la_SOURCES = cd_prot_embedded_in_icmp.cc
endif
AM_CXXFLAGS = @AM_CXXFLAGS@
#include "framework/codec.h"
#include "protocols/packet.h"
#include "codecs/codec_events.h"
-#include "codecs/misc/cd_gtp_module.h"
#include "packet_io/active.h"
#include "codecs/sf_protocols.h"
#include "protocols/protocol_ids.h"
+#include "codecs/decode_module.h"
namespace
{
+#define CD_GTP_NAME "gtp"
+
+static const RuleMap gtp_rules[] =
+{
+ { DECODE_GTP_MULTIPLE_ENCAPSULATION, "(" CD_GTP_NAME ") Two or more GTP encapsulation layers present" },
+ { DECODE_GTP_BAD_LEN, "(" CD_GTP_NAME ") GTP header length is invalid" },
+ { 0, nullptr }
+};
+
+class GtpModule : public DecodeModule
+{
+public:
+ GtpModule() : DecodeModule(CD_GTP_NAME) {};
+
+ const RuleMap* get_rules() const
+ { return gtp_rules; }
+};
+
+
+//-------------------------------------------------------------------------
+// gtp module
+//-------------------------------------------------------------------------
+
+
+
class GtpCodec : public Codec
{
public:
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-// cd_gtp_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
-
-#include "codecs/misc/cd_gtp_module.h"
-
-static const RuleMap gtp_rules[] =
-{
-
- { DECODE_GTP_MULTIPLE_ENCAPSULATION, "(" CD_GTP_NAME ") Two or more GTP encapsulation layers present" },
- { DECODE_GTP_BAD_LEN, "(" CD_GTP_NAME ") GTP header length is invalid" },
- { 0, nullptr }
-};
-
-//-------------------------------------------------------------------------
-// rpc module
-//-------------------------------------------------------------------------
-
-GtpModule::GtpModule() : DecodeModule(CD_GTP_NAME)
-{ }
-
-const RuleMap* GtpModule::get_rules() const
-{ return gtp_rules; }
-
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-// cd_gtp_module.h author Josh Rosenbaum <jrosenba@cisco.com>
-
-#ifndef CD_GTP_MODULE_H
-#define CD_GTP_MODULE_H
-
-#include "codecs/decode_module.h"
-
-
-#define CD_GTP_NAME "gtp"
-
-class GtpModule : public DecodeModule
-{
-public:
- GtpModule();
-
- const RuleMap* get_rules() const;
-};
-
-#endif
//
// this macros is defined in the module to ensure identical names. However,
// if you don't want a module, define the name here.
-#ifndef IP4_EMBEDDED_IN_ICMP
-#define IP4_EMBEDDED_IN_ICMP "ip4_embedded_in_icmp"
+#ifndef ICMP4_IP_NAME
+#define ICMP4_IP_NAME "icmp4_ip"
#endif
-class Ip4EmbeddedInIcmpCodec : public Codec
+class Icmp4IpCodec : public Codec
{
public:
- Ip4EmbeddedInIcmpCodec() : Codec(IP4_EMBEDDED_IN_ICMP){};
- ~Ip4EmbeddedInIcmpCodec() {};
+ Icmp4IpCodec() : Codec(ICMP4_IP_NAME){};
+ ~Icmp4IpCodec() {};
virtual void get_protocol_ids(std::vector<uint16_t>&);
} // namespace
-void Ip4EmbeddedInIcmpCodec::get_protocol_ids(std::vector<uint16_t>& v)
+void Icmp4IpCodec::get_protocol_ids(std::vector<uint16_t>& v)
{
v.push_back(IP_EMBEDDED_IN_ICMP4);
}
-bool Ip4EmbeddedInIcmpCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
- Packet* p, uint16_t& lyr_len, uint16_t& next_prot_id)
+bool Icmp4IpCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
+ Packet* p, uint16_t& lyr_len, uint16_t& /*next_prot_id*/)
{
uint32_t ip_len; /* length from the start of the ip hdr to the
* pkt end */
}
/* lay the IP struct over the raw data */
- const IPHdr *ip4h = reinterpret_cast<const IPHdr *>(raw_pkt);
+ const IP4Hdr *ip4h = reinterpret_cast<const IP4Hdr *>(raw_pkt);
/*
* with datalink DLT_RAW it's impossible to differ ARP datagrams from IP.
{
case IPPROTO_TCP: /* decode the interesting part of the header */
p->proto_bits |= PROTO_BIT__TCP_EMBED_ICMP;
- next_prot_id = PROT_EMBEDDED_IN_ICMP;
break;
case IPPROTO_UDP:
p->proto_bits |= PROTO_BIT__UDP_EMBED_ICMP;
- next_prot_id = PROT_EMBEDDED_IN_ICMP;
break;
case IPPROTO_ICMP:
p->proto_bits |= PROTO_BIT__ICMP_EMBED_ICMP;
- next_prot_id = PROT_EMBEDDED_IN_ICMP;
break;
}
}
-bool Ip4EmbeddedInIcmpCodec::encode(EncState* enc, Buffer* out, const uint8_t* raw_in)
+bool Icmp4IpCodec::encode(EncState* /*enc*/, Buffer* out, const uint8_t* raw_in)
{
// allocate space for this protocols encoded data
if (!update_buffer(out, ip::IP4_HEADER_LEN))
static Codec* ctor(Module*)
{
- return new Ip4EmbeddedInIcmpCodec();
+ return new Icmp4IpCodec();
}
static void dtor(Codec *cd)
}
-static const CodecApi ip4_embedded_in_icmp_api =
+static const CodecApi icmp4_ip_api =
{
{
PT_CODEC,
- IP4_EMBEDDED_IN_ICMP,
+ ICMP4_IP_NAME,
CDAPI_PLUGIN_V0,
0,
nullptr, // module constructor
#ifdef BUILDING_SO
SO_PUBLIC const BaseApi* snort_plugins[] =
{
- &ip4_embedded_in_icmp_api.base,
+ &icmp4_ip_api.base,
nullptr
};
#else
-const BaseApi* cd_ip4_embedded_in_icmp = &ip4_embedded_in_icmp_api.base;
+const BaseApi* cd_icmp4_ip = &icmp4_ip_api.base;
#endif
//
// this macros is defined in the module to ensure identical names. However,
// if you don't want a module, define the name here.
-#ifndef IP6_EMBEDDED_IN_ICMP
-#define IP6_EMBEDDED_IN_ICMP "ip6_embedded_in_icmp"
+#ifndef ICMP6_IP_NAME
+#define ICMP6_IP_NAME "icmp6_ip"
#endif
-class Ip6EmbeddedInIcmpCodec : public Codec
+class Icmp6IpCodec : public Codec
{
public:
- Ip6EmbeddedInIcmpCodec() : Codec(IP6_EMBEDDED_IN_ICMP){};
- ~Ip6EmbeddedInIcmpCodec() {};
+ Icmp6IpCodec() : Codec(ICMP6_IP_NAME){};
+ ~Icmp6IpCodec() {};
virtual void get_protocol_ids(std::vector<uint16_t>&);
} // namespace
-void Ip6EmbeddedInIcmpCodec::get_protocol_ids(std::vector<uint16_t>& v)
+void Icmp6IpCodec::get_protocol_ids(std::vector<uint16_t>& v)
{
v.push_back(IP_EMBEDDED_IN_ICMP6);
}
-bool Ip6EmbeddedInIcmpCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
- Packet* p, uint16_t& lyr_len, uint16_t& next_prot_id)
+bool Icmp6IpCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
+ Packet* p, uint16_t& lyr_len, uint16_t& /*next_prot_id*/)
{
// uint16_t orig_frag_offset;
/* lay the IP struct over the raw data */
- const ip::IP6RawHdr* ip6h = reinterpret_cast<const ip::IP6RawHdr*>(raw_pkt);
+ const ip::IP6Hdr* ip6h = reinterpret_cast<const ip::IP6Hdr*>(raw_pkt);
DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "DecodeICMPEmbeddedIP6: ip header"
" starts at: %p, length is %lu\n", ip6h,
{
case IPPROTO_TCP: /* decode the interesting part of the header */
p->proto_bits |= PROTO_BIT__TCP_EMBED_ICMP;
- next_prot_id = PROT_EMBEDDED_IN_ICMP;
break;
case IPPROTO_UDP:
p->proto_bits |= PROTO_BIT__UDP_EMBED_ICMP;
- next_prot_id = PROT_EMBEDDED_IN_ICMP;
break;
case IPPROTO_ICMP:
p->proto_bits |= PROTO_BIT__ICMP_EMBED_ICMP;
- next_prot_id = PROT_EMBEDDED_IN_ICMP;
break;
}
}
-bool Ip6EmbeddedInIcmpCodec::encode(EncState *enc, Buffer* out, const uint8_t* raw_in)
+bool Icmp6IpCodec::encode(EncState* /*enc*/, Buffer* out, const uint8_t* raw_in)
{
if (!update_buffer(out, ip::IP6_HEADER_LEN))
return false;
memcpy(out->base, raw_in, ip::IP6_HEADER_LEN);
- ((ip::IP6RawHdr*)out->base)->ip6_next = IPPROTO_UDP;
+ ((ip::IP6Hdr*)out->base)->ip6_next = IPPROTO_UDP;
return true;
}
static Codec* ctor(Module*)
{
- return new Ip6EmbeddedInIcmpCodec();
+ return new Icmp6IpCodec();
}
static void dtor(Codec *cd)
}
-static const CodecApi ip6_embedded_in_icmp_api =
+static const CodecApi icmp6_ip_api =
{
{
PT_CODEC,
- IP6_EMBEDDED_IN_ICMP,
+ ICMP6_IP_NAME,
CDAPI_PLUGIN_V0,
0,
nullptr, // module constructor
#ifdef BUILDING_SO
SO_PUBLIC const BaseApi* snort_plugins[] =
{
- &ip6_embedded_in_icmp_api.base,
+ &icmp6_ip_api.base,
nullptr
};
#else
-const BaseApi* cd_ip6_embedded_in_icmp = &ip6_embedded_in_icmp_api.base;
+const BaseApi* cd_icmp6_ip = &icmp6_ip_api.base;
#endif
+++ /dev/null
-/*
-** Copyright (C) 2002-2013 Sourcefire, Inc.
-** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-// cd_prot_embedded_in_icmp.cc author Josh Rosenbaum <jrosenba@cisco.com>
-
-
-
-#ifdef HAVE_CONFIG_H
-#include "config.h"
-#endif
-
-#include "framework/codec.h"
-
-
-namespace
-{
-
-// yes, macros are necessary. The API and class constructor require different strings.
-//
-// this macros is defined in the module to ensure identical names. However,
-// if you don't want a module, define the name here.
-#ifndef ProtEmbeddedInIcmp_NAME
-#define ProtEmbeddedInIcmp_NAME "prot_embedded_in_icmp"
-#endif
-
-class ProtEmbeddedInIcmp : public Codec
-{
-public:
- ProtEmbeddedInIcmp() : Codec(ProtEmbeddedInIcmp_NAME){};
- ~ProtEmbeddedInIcmp() {};
-
-
- virtual void get_protocol_ids(std::vector<uint16_t>&);
- virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in);
- virtual bool decode(const uint8_t *raw_pkt, const uint32_t &raw_len,
- Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
-};
-
-} // namespace
-
-
-void ProtEmbeddedInIcmp::get_protocol_ids(std::vector<uint16_t>& v)
-{
- v.push_back(PROT_EMBEDDED_IN_ICMP);
-}
-
-bool ProtEmbeddedInIcmp::decode(const uint8_t* /*raw_pkt*/, const uint32_t& raw_len,
- Packet* /*p*/, uint16_t& lyr_len, uint16_t& /*next_prot_id*/)
-{
-
- // Since the previous layer already set the correct p->proto_bits,
- // there is really nothing to do here. This layer is actually
- // a placeholder so I can easily find this layer's data at some
- // other point in Snort++.
-
- lyr_len = raw_len; // so I can access len when encoding
- return true;
-}
-
-
-bool ProtEmbeddedInIcmp::encode(EncState* enc, Buffer* out, const uint8_t* raw_in)
-{
- uint16_t lyr_len = enc->p->layers[enc->layer-1].length;
-
-
- if (icmp::ICMP_UNREACH_DATA_LEN < lyr_len)
- lyr_len = icmp::ICMP_UNREACH_DATA_LEN;
-
- if (!update_buffer(out, lyr_len))
- return false;
-
-
- memcpy(out->base, raw_in, lyr_len);
- return true;
-}
-
-
-//-------------------------------------------------------------------------
-// api
-//-------------------------------------------------------------------------
-
-
-static Codec* ctor(Module*)
-{
- return new ProtEmbeddedInIcmp();
-}
-
-static void dtor(Codec *cd)
-{
- delete cd;
-}
-
-
-static const CodecApi prot_embedded_in_icmp_api =
-{
- {
- PT_CODEC,
- ProtEmbeddedInIcmp_NAME,
- CDAPI_PLUGIN_V0,
- 0,
- nullptr,
- nullptr
- },
- nullptr, // ginit
- nullptr, // gterm
- nullptr, // tinit
- nullptr, // tterm
- ctor,
- dtor,
-};
-
-
-#ifdef BUILDING_SO
-SO_PUBLIC const BaseApi* snort_plugins[] =
-{
- &prot_embedded_in_icmp_api.base,
- nullptr
-};
-#else
-const BaseApi* cd_prot_embedded_in_icmp = &prot_embedded_in_icmp_api.base;
-#endif
if (STATIC_CODECS)
- if (ENABLE_NON_ETHER_DECODERS)
- set( PLUGIN_LIST
- cd_eth.cc
- cd_eth_module.h
- cd_eth_module.cc
- cd_raw4.cc
- cd_raw6.cc
- cd_null.cc
- cd_linux_sll.cc
- cd_ppp.cc
- cd_wlan.cc
- cd_wlan_module.h
- cd_wlan_module.cc
- # root_fddi.cc
- # root_slip.cc
- # root_i4lrawip.cc
- # root_oldpflog.cc
- # root_enc.cc
- # root_pflog.cc
- # root_pppserial.cc
- # root_chdlc.cc
- # root_i4lciscoip.cc
- # prot_ipx.cc
- # prot_eap.cc
- )
- endif (ENABLE_NON_ETHER_DECODERS)
+ set( PLUGIN_LIST
+ cd_eth.cc
+ cd_raw4.cc
+ cd_raw6.cc
+ cd_null.cc
+ cd_linux_sll.cc
+ cd_ppp.cc
+ cd_wlan.cc
+# root_fddi.cc
+# root_slip.cc
+# root_i4lrawip.cc
+# root_oldpflog.cc
+# root_enc.cc
+# root_pflog.cc
+# root_pppserial.cc
+# root_chdlc.cc
+# root_i4lciscoip.cc
+# prot_ipx.cc
+# prot_eap.cc
+ )
+
else(STATIC_CODECS)
+ add_shared_library(cd_eth codecs cd_eth.cc)
+ add_shared_library(cd_linux_sll codecs cd_linux_sll.cc)
+ add_shared_library(cd_ppp codecs cd_ppp.cc)
+ add_shared_library(cd_raw4 codecs cd_raw4.cc)
+ add_shared_library(cd_raw6 codecs cd_raw6.cc)
+ add_shared_library(cd_null codecs cd_null.cc)
+ add_shared_library(cd_wlan codecs cd_wlan.cc)
- if (ENABLE_NON_ETHER_DECODERS)
- add_shared_library(cd_eth codecs cd_eth.cc cd_eth_module.h cd_eth_module.cc)
- add_shared_library(cd_linux_sll codecs cd_linux_sll.cc)
- add_shared_library(cd_ppp codecs cd_ppp.cc)
- add_shared_library(cd_raw4 codecs cd_raw4.cc)
- add_shared_library(cd_raw6 codecs cd_raw6.cc)
- add_shared_library(cd_null codecs cd_null.cc)
- add_shared_library(cd_wlan codecs cd_wlan.cc cd_wlan_module.h cd_wlan_module.cc)
- endif(ENABLE_NON_ETHER_DECODERS)
endif(STATIC_CODECS)
AUTOMAKE_OPTIONS=foreign no-dependencies
noinst_LIBRARIES = libroot_codecs.a
-libroot_codecs_a_SOURCES = \
-cd_eth.cc \
-cd_eth_module.h \
-cd_eth_module.cc \
-cd_raw4.cc \
-cd_raw6.cc \
-cd_null.cc
-if ENABLE_NON_ETHER_DECODER
if STATIC_CODECS
-libroot_codecs_a_SOURCES += \
+
+libroot_codecs_a_SOURCES = \
+cd_eth.cc \
cd_linux_sll.cc \
+cd_null.cc \
cd_ppp.cc \
-cd_wlan.cc \
-cd_wlan_module.h \
-cd_wlan_module.cc
+cd_raw4.cc \
+cd_raw6.cc \
+cd_wlan.cc
#root_fddi.cc \
#root_slip.cc \
#root_i4lrawip.cc \
else
ehlibdir = $(pkglibdir)/codecs
-ehlib_LTLIBRARIES = libcd_linux_sll.la
+ehlib_LTLIBRARIES = libcd_eth.la
+libcd_eth_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
+libcd_eth_la_LDFLAGS = -export-dynamic -shared
+libcd_eth_la_SOURCES = cd_eth.cc
+
+ehlib_LTLIBRARIES += libcd_linux_sll.la
libcd_linux_sll_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
libcd_linux_sll_la_LDFLAGS = -export-dynamic -shared
libcd_linux_sll_la_SOURCES = cd_linux_sll.cc
+ehlib_LTLIBRARIES += libcd_null.la
+libcd_null_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
+libcd_null_la_LDFLAGS = -export-dynamic -shared
+libcd_null_la_SOURCES = cd_null.cc
+
ehlib_LTLIBRARIES += libcd_ppp.la
libcd_ppp_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
libcd_ppp_la_LDFLAGS = -export-dynamic -shared
-libcd_ppp_la_SOURCES = cd_ppp.cc cd_ppp.h
+libcd_ppp_la_SOURCES = cd_ppp.cc
+
+ehlib_LTLIBRARIES += libcd_raw4.la
+libcd_raw4_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
+libcd_raw4_la_LDFLAGS = -export-dynamic -shared
+libcd_raw4_la_SOURCES = cd_raw4.cc
+
+ehlib_LTLIBRARIES += libcd_raw6.la
+libcd_raw6_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
+libcd_raw6_la_LDFLAGS = -export-dynamic -shared
+libcd_raw6_la_SOURCES = cd_raw6.cc
ehlib_LTLIBRARIES += libcd_wlan.la
libcd_wlan_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
libcd_wlan_la_LDFLAGS = -export-dynamic -shared
-libcd_wlan_la_SOURCES = cd_wlan.cc cd_wlan_module.h cd_wlan_module.cc
+libcd_wlan_la_SOURCES = cd_wlan.cc
-endif
endif
AM_CXXFLAGS = @AM_CXXFLAGS@
#endif
#include <pcap.h>
-#include "codecs/root/cd_eth_module.h"
+#include "codecs/decode_module.h"
#include "framework/codec.h"
#include "protocols/packet.h"
#include "protocols/eth.h"
namespace
{
+#define CD_ETH_NAME "eth"
+static const RuleMap eth_rules[] =
+{
+ { DECODE_ETH_HDR_TRUNC, "(" CD_ETH_NAME ") truncated eth header" },
+ { 0, nullptr }
+};
+
+class EthModule : public DecodeModule
+{
+public:
+ EthModule() : DecodeModule(CD_ETH_NAME) {}
+
+ const RuleMap* get_rules() const
+ { return eth_rules; }
+};
+
+
class EthCodec : public Codec
{
public:
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-// cd_eth_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
-
-#include "codecs/root/cd_eth_module.h"
-
-static const RuleMap eth_rules[] =
-{
- { DECODE_ETH_HDR_TRUNC, "(" CD_ETH_NAME ") truncated eth header" },
- { 0, nullptr }
-};
-
-//-------------------------------------------------------------------------
-// rpc module
-//-------------------------------------------------------------------------
-
-EthModule::EthModule() : DecodeModule(CD_ETH_NAME)
-{ }
-
-const RuleMap* EthModule::get_rules() const
-{ return eth_rules; }
-
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-// cd_eth_module.h author Josh Rosenbaum <jrosenba@cisco.com>
-
-#ifndef CD_ETH_MODULE_H
-#define CD_ETH_MODULE_H
-
-#include "codecs/decode_module.h"
-
-
-#define CD_ETH_NAME "eth"
-
-class EthModule : public DecodeModule
-{
-public:
- EthModule();
-
- const RuleMap* get_rules() const;
-};
-
-#endif
// this macros is defined in the module to ensure identical names. However,
// if you don't want a module, define the name here.
#ifndef PPP_NAME
-#define PPP_NAME "point_to_point"
+#define PPP_NAME "ppp"
#endif
class PPPCodec : public Codec
#endif
#include <pcap.h>
+#include "protocols/wlan.h"
#include "framework/codec.h"
-#include "codecs/root/cd_wlan_module.h"
+#include "codecs/decode_module.h"
#include "codecs/codec_events.h"
-#include "protocols/wlan.h"
#include "protocols/protocol_ids.h"
#include "main/snort.h"
namespace
{
+#define CD_WLAN_NAME "wlan"
+static const RuleMap wlan_rules[] =
+{
+ { DECODE_BAD_80211_ETHLLC, "(" CD_WLAN_NAME ") Bad 802.11 LLC header" },
+ { DECODE_BAD_80211_OTHER, "(" CD_WLAN_NAME ") Bad 802.11 Extra LLC Info" },
+ { 0, nullptr }
+};
+
+class WlanCodecModule : public DecodeModule
+{
+public:
+ WlanCodecModule() : DecodeModule(CD_WLAN_NAME) {}
+
+ const RuleMap* get_rules() const
+ { return wlan_rules; }
+};
+
class WlanCodec : public Codec
{
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-// cd_ieee8021_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
-
-#include "codecs/root/cd_wlan_module.h"
-
-static const RuleMap wifi_rules[] =
-{
- { DECODE_BAD_80211_ETHLLC, "(" CD_WLAN_NAME ") Bad 802.11 LLC header" },
- { DECODE_BAD_80211_OTHER, "(" CD_WLAN_NAME ") Bad 802.11 Extra LLC Info" },
- { 0, nullptr }
-};
-
-//-------------------------------------------------------------------------
-// wifi module
-//-------------------------------------------------------------------------
-
-WlanCodecModule::WlanCodecModule() : DecodeModule(CD_WLAN_NAME)
-{ }
-
-const RuleMap* WlanCodecModule::get_rules() const
-{ return wifi_rules; }
-
-bool WlanCodecModule::set(const char* /*fqn*/, Value& /*v*/, SnortConfig* /*sc*/)
-{ return true; }
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-// cd_wlan_module.h author Josh Rosenbaum <jrosenba@cisco.com>
-
-#ifndef CD_WLAN_MODULE_H
-#define CD_WLAN_MODULE_H
-
-#include "codecs/decode_module.h"
-
-
-#define CD_WLAN_NAME "wlan"
-
-class WlanCodecModule : public DecodeModule
-{
-public:
- WlanCodecModule();
-
- const RuleMap* get_rules() const;
- bool set(const char*, Value&, SnortConfig*);
-};
-
-#endif
+++ /dev/null
-/*
-** Copyright (C) 2002-2013 Sourcefire, Inc.
-** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-
-
-#ifdef HAVE_CONFIG_H
-#include "config.h"
-#endif
-
-#include "generators.h"
-#include "protocols/packet.h"
-#include "static_include.h"
-#include "decoder_includes.h"
-
-
-
-static const uint16_t ETHERNET_TYPE_IPX = 0x8137;
-
-/*
- * Function: DecodeIPX(uint8_t *, uint32_t)
- *
- * Purpose: Well, it doesn't do much of anything right now...
- *
- * Arguments: pkt => ptr to the packet data
- * len => length from here to the end of the packet
- *
- * Returns: void function
- *
- */
-void DecodeIPX(const uint8_t*, uint32_t, Packet *p)
-{
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "IPX is not supported.\n"););
- dc.ipx++;
-}
-
-static const char* name = "ipx_decode";
-
-static const CodecApi ipx_api =
-{
- {
- PT_CODEC,
- name,
- CDAPI_PLUGIN_V0,
- 0,
- nullptr,
- nullptr,
- },
- {ETHERNET_TYPE_IPX},
- nullptr, // pinit
- nullptr, // pterm
- nullptr, // tinit
- nullptr, // tterm
- ctor, // ctor
- dtor, // dtor
-};
-
-
PROTO_GTP, // DecodeGTP
PROTO_AH, // DecodeAH - Authentication Header (IPSec stuff)
-#ifndef NO_NON_ETHER_DECODER
PROTO_TR, // DecodeTRPkt
PROTO_FDDI, // DecodeFDDIPkt
PROTO_LSLL, // DecodeLinuxSLLPkt sockaddr_ll for "any" device and
PROTO_EAP, // DecodeEAP
PROTO_EAPOL, // DecodeEapol - leaf decoder
PROTO_EAPOL_KEY, // DecodeEapolKey - leaf decoder
-#endif // NO_NON_ETHER_DECODER
PROTO_MAX
} PROTO_ID;
#include "snort_debug.h"
#include "protocols/packet.h"
#include "parser.h"
-#include "parse_byte_code.h"
+#include "parser/parse_byte_code.h"
#include "ips_content.h"
#include "snort.h"
#include "packet_io/sfdaq.h"
{
LogIPPkt(text_log, p->ip_api.proto(), p);
}
-#ifndef NO_NON_ETHER_DECODER
else if (p->proto_bits & PROTO_BIT__ARP)
{
log_mutex.lock();
LogWifiPkt(text_log, p);
}
#endif
-#endif
}
void LogNetData(const uint8_t* data, const int len, Packet* p)
* Layer 2 header stuff cloned from log.c
*--------------------------------------------------------------------
*/
-#ifndef NO_NON_ETHER_DECODER
/*--------------------------------------------------------------------
* Function: LogTrHeader(TextLog*, Packet*)
*
trhmr->rseg[6], trhmr->rseg[7]);
}
}
-#endif // NO_NON_ETHER_DECODER
/*--------------------------------------------------------------------
* Function: LogEthHeader()
greh->get_version(), greh->flags, greh->get_proto());
}
-#ifndef NO_NON_ETHER_DECODER
/*--------------------------------------------------------------------
* Function: LogSLLHeader(TextLog* )
*
if (wifih->frame_control & WLAN_FLAG_ORDER) TextLog_Puts(log," Ord");
TextLog_NewLine(log);
}
-#endif // NO_NON_ETHER_DECODER
/*--------------------------------------------------------------------
* Function: Log2ndHeader(TextLog* , Packet p)
if(p && (p->num_layers > 0))
LogEthHeader(log, p);
break;
-#ifndef NO_NON_ETHER_DECODER
#ifdef DLT_IEEE802_11
case DLT_IEEE802_11:
if(p && (p->num_layers > 0))
LogSLLHeader(log, p); /* Linux cooked sockets */
break;
#endif
-#endif // NO_NON_ETHER_DECODER
default:
if (ScLogVerbose())
{
{
case IPPROTO_TCP:
{
- const tcp::TCPHdr* tcph = layer::get_tcp_embed_icmp(p);
+ const tcp::TCPHdr* tcph = layer::get_tcp_embed_icmp(op.ip_api);
if (tcph)
{
orig_p->sp = ntohs(tcph->th_sport);
case IPPROTO_UDP:
{
- const udp::UDPHdr* udph = layer::get_udp_embed_icmp(p);
+ const udp::UDPHdr* udph = layer::get_udp_embed_icmp(op.ip_api);
if (udph)
{
orig_p->sp = ntohs(p->udph->uh_sport);
TextLog_Print(log, "\n** ORIGINAL DATAGRAM DUMP:\n");
LogIPHeader(log, orig_p);
- const icmp::ICMPHdr* icmph = layer::get_icmp_embed_icmp(p);
+ const icmp::ICMPHdr* icmph = layer::get_icmp_embed_icmp(op.ip_api);
if(icmph != NULL)
LogEmbeddedICMPHeader(log, icmph);
break;
}
}
-#ifndef NO_NON_ETHER_DECODER
/*--------------------------------------------------------------------
* ARP stuff cloned from log.c
*--------------------------------------------------------------------
{
// XXX-IPv6 "NOT YET IMPLEMENTED - printing ARP header"
}
-#endif
#if 0
// these must be converted to use TextLog
// (or just deleted)
-#ifndef NO_NON_ETHER_DECODER
/****************************************************************************
*
* Function: PrintEapolKey(FILE *)
"=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+\n\n");
}
#endif
-#endif
void LogTCPHeader(TextLog*, Packet*);
void LogUDPHeader(TextLog*, Packet*);
void LogICMPHeader(TextLog*, Packet*);
-
-#ifndef NO_NON_ETHER_DECODER
void LogArpHeader(TextLog*, Packet*);
-#endif
#endif
{
if(p->ip_api.is_valid())
LogIPPkt(fast_log, p->ip_api.proto(), p);
-#ifndef NO_NON_ETHER_DECODER
+
else if(p->proto_bits & PROTO_BIT__ARP)
LogArpHeader(fast_log, p);
-#endif
+
}
TextLog_NewLine(fast_log);
TextLog_Flush(fast_log);
if(p->ip_api.is_valid())
{
- const ip::IPHdr* const iph = p->ip_api.get_ip4h();
+ const ip::IP4Hdr* const iph = p->ip_api.get_ip4h();
alertdata.ip_source = iph->get_src();
alertdata.ip_destination = iph->get_dst();
alertdata.protocol = GetEventProto(p);
OUTPUT_FLAG__APP_DATA = 0x00000008, /* -d */
OUTPUT_FLAG__SHOW_DATA_LINK = 0x00000010, /* -e */
-#ifndef NO_NON_ETHER_DECODER
OUTPUT_FLAG__SHOW_WIFI_MGMT = 0x00000020, /* -w */
-#endif
OUTPUT_FLAG__USE_UTC = 0x00000040, /* -U */
OUTPUT_FLAG__INCLUDE_YEAR = 0x00000080, /* -y */
return snort_conf->run_flags & RUN_FLAG__PCAP_RESET;
}
-#ifndef NO_NON_ETHER_DECODER
static inline int ScOutputWifiMgmt(void)
{
return snort_conf->output_flags & OUTPUT_FLAG__SHOW_WIFI_MGMT;
}
-#endif
static inline uint32_t ScMaxAttrHosts(void)
{
static int Norm_IP4 (
NormalizerConfig* c, Packet * p, uint8_t layer, int changes)
{
- IPHdr* h = (IPHdr*)(p->layers[layer].start);
+ IP4Hdr* h = (IP4Hdr*)(p->layers[layer].start);
uint16_t fragbits = ntohs(h->ip_off);
uint16_t origbits = fragbits;
static int Norm_IP6 (
NormalizerConfig* c, Packet * p, uint8_t layer, int changes)
{
- ip::IP6RawHdr* h = (ip::IP6RawHdr*)(p->layers[layer].start);
+ ip::IP6Hdr* h = (ip::IP6Hdr*)(p->layers[layer].start);
if ( Norm_IsEnabled(c, NORM_IP6_TTL) )
{
if(p->ip_api.is_ip4())
{
- ((IPHdr*)g_tmp_pkt->ip_api.get_ip4h())->set_proto(IPPROTO_PS);
+ ((IP4Hdr*)g_tmp_pkt->ip_api.get_ip4h())->set_proto(IPPROTO_PS);
}
else
{
// since ip_api.is_valid() && !ip4h, this is automatically ip6h
- ((ip::IP6RawHdr*)g_tmp_pkt->ip_api.get_ip6h())->set_proto(IPPROTO_PS);
+ ((ip::IP6Hdr*)g_tmp_pkt->ip_api.get_ip6h())->set_proto(IPPROTO_PS);
}
switch(proto_type)
// FIXIT: IP4 is gauranteed to have been set in update(). Is IP6()
// also gauranteed?
if(g_tmp_pkt->ip_api.is_ip6())
- ((ip::IP6RawHdr*)g_tmp_pkt->ip_api.get_ip6h())->set_len(htons((uint16_t)ip_size));
+ ((ip::IP6Hdr*)g_tmp_pkt->ip_api.get_ip6h())->set_len(htons((uint16_t)ip_size));
return 0;
}
sc->run_flags |= RUN_FLAG__TEST;
}
-#if !defined(NO_NON_ETHER_DECODER) && defined(DLT_IEEE802_11)
+#if defined(DLT_IEEE802_11)
static void config_show_wifi_mgt(SnortConfig* sc, const char*)
{
sc->output_flags |= OUTPUT_FLAG__SHOW_WIFI_MGMT;
{ "W", config_ignore, // spec opt
"lists available interfaces" },
-#if !defined(NO_NON_ETHER_DECODER) && defined(DLT_IEEE802_11)
+#if defined(DLT_IEEE802_11)
{ "w", config_show_wifi_mgt,
"dump 802.11 management and control frames" },
#endif
#ifndef PROTOCOLS_EAPOL_H
#define PROTOCOLS_EAPOL_H
-#ifndef NO_NON_ETHER_DECODER
-
namespace eapol
{
}
-#endif /* NO_NON_ETHER_DECODER */
#endif /* EAPOL_H */
/* IP header for unreach */
struct ih_ip
{
- ip::IPHdr *ip;
+ ip::IP4Hdr *ip;
/* options and then 64 bits of data */
} ip;
dst_p = nullptr;
}
-void IpApi::set(const IPHdr* h4)
+void IpApi::set(const IP4Hdr* h4)
{
ip4h = h4;
ip6h = nullptr;
dst_p = nullptr;
}
-void IpApi::set(const ip::IP6RawHdr* h6)
+void IpApi::set(const ip::IP6Hdr* h6)
{
ip6h = h6;
ip4h = nullptr;
bool IpApi::set(const uint8_t* raw_ip_data)
{
- const IPHdr* h4 = reinterpret_cast<const IPHdr*>(raw_ip_data);
+ const IP4Hdr* h4 = reinterpret_cast<const IP4Hdr*>(raw_ip_data);
if (h4->get_ver() == 4)
{
set(h4);
return true;
}
- const ip::IP6RawHdr* h6 =
- reinterpret_cast<const ip::IP6RawHdr*>(raw_ip_data);
+ const ip::IP6Hdr* h6 =
+ reinterpret_cast<const ip::IP6Hdr*>(raw_ip_data);
if (h6->get_ver() != 6)
return false;
return reinterpret_cast<const uint8_t*>(ip4h) + (ip4h->get_hlen() << 2);
if (ip6h)
- return reinterpret_cast<const uint8_t*>(ip6h) + (ip6h->get_hlen() << 2);
+ return reinterpret_cast<const uint8_t*>(ip6h) + IP6_HEADER_LEN;
return nullptr;
}
// IpApi(); constructor and destructor MUST remain a trivial. Adding
// ~IpApi(); any non-trivial code will cause a compilation failure.
- void set(const IPHdr* h4);
- void set(const IP6RawHdr* h6);
+ void set(const IP4Hdr* h4);
+ void set(const IP6Hdr* h6);
bool set(const uint8_t* raw_ip_data);
void reset();
const sfip_t *get_src();
inline bool is_ip4() const
{ return ip4h; }
- inline const IPHdr* get_ip4h() const
+ inline const IP4Hdr* get_ip4h() const
{ return ip4h; }
- inline const IP6RawHdr* get_ip6h() const
+ inline const IP6Hdr* get_ip6h() const
{ return ip6h; }
inline uint16_t tos() const
sfip_t dst;
const sfip_t *src_p;
const sfip_t *dst_p;
- const IPHdr* ip4h;
- const IP6RawHdr* ip6h;
+ const IP4Hdr* ip4h;
+ const IP6Hdr* ip6h;
};
// This must be a standard layour struct!
-struct IPHdr
+struct IP4Hdr
{
uint8_t ip_verhl; /* version & header length */
uint8_t ip_tos; /* type of service */
/* we need to change them as well as get them */
// TYPEDEF WHICH NEED TO BE DELETED
-typedef ip::IPHdr IPHdr;
+typedef ip::IP4Hdr IP4Hdr;
constexpr uint8_t IPOPT_EOL = 0x00;
};
};
-struct IP6RawHdr
+struct IP6Hdr
{
uint32_t ip6_vtf; /* 4 bits version, 8 bits TC,len
20 bits flow-ID */
{
case ETHERTYPE_IPV4:
case IPPROTO_ID_IPIP:
- return reinterpret_cast<IPHdr*>(layers[i].start)->get_proto();
+ return reinterpret_cast<IP4Hdr*>(layers[i].start)->get_proto();
case ETHERTYPE_IPV6:
case IPPROTO_ID_IPV6:
- return reinterpret_cast<ip::IP6RawHdr*>(layers[i].start)->get_next();
+ return reinterpret_cast<ip::IP6Hdr*>(layers[i].start)->get_next();
default:
break;
}
case ETHERTYPE_IPV4:
case IPPROTO_ID_IPIP:
{
- const ip::IPHdr* ip4h =
- reinterpret_cast<const ip::IPHdr*>(lyr->start);
+ const ip::IP4Hdr* ip4h =
+ reinterpret_cast<const ip::IP4Hdr*>(lyr->start);
api.set(ip4h);
curr_layer--;
return true;
case ETHERTYPE_IPV6:
case IPPROTO_ID_IPV6:
{
- const ip::IP6RawHdr* ip6h =
- reinterpret_cast<const ip::IP6RawHdr*>(lyr->start);
+ const ip::IP6Hdr* ip6h =
+ reinterpret_cast<const ip::IP6Hdr*>(lyr->start);
api.set(ip6h);
curr_layer--;
return true;
case ETHERTYPE_IPV4:
case IPPROTO_ID_IPIP:
{
- const ip::IPHdr* ip4h =
- reinterpret_cast<const ip::IPHdr*>(lyr->start);
+ const ip::IP4Hdr* ip4h =
+ reinterpret_cast<const ip::IP4Hdr*>(lyr->start);
api.set(ip4h);
curr_layer++;
return true;
case ETHERTYPE_IPV6:
case IPPROTO_ID_IPV6:
{
- const ip::IP6RawHdr* ip6h =
- reinterpret_cast<const ip::IP6RawHdr*>(lyr->start);
+ const ip::IP6Hdr* ip6h =
+ reinterpret_cast<const ip::IP6Hdr*>(lyr->start);
api.set(ip6h);
curr_layer++;
return true;
{
if (lyr->prot_id == IP_EMBEDDED_IN_ICMP4)
{
- const ip::IPHdr* ip4h =
- reinterpret_cast<const ip::IPHdr*>(lyr->start);
+ const ip::IP4Hdr* ip4h =
+ reinterpret_cast<const ip::IP4Hdr*>(lyr->start);
api.set(ip4h);
return true;
}
else if (lyr->prot_id == IP_EMBEDDED_IN_ICMP6)
{
- const ip::IP6RawHdr* ip6h =
- reinterpret_cast<const ip::IP6RawHdr*>(lyr->start);
+ const ip::IP6Hdr* ip6h =
+ reinterpret_cast<const ip::IP6Hdr*>(lyr->start);
api.set(ip6h);
return true;
}
return false;
}
-const uint8_t* get_prot_embed_icmp(const Packet* const p)
-{
- return find_inner_layer(p->layers,
- p->num_layers,
- PROT_EMBEDDED_IN_ICMP);
-}
-const tcp::TCPHdr* get_tcp_embed_icmp(const Packet* const p)
-{
- return reinterpret_cast<const tcp::TCPHdr*>(
- get_prot_embed_icmp(p));
-}
+const tcp::TCPHdr* get_tcp_embed_icmp(const ip::IpApi& api)
+{ return reinterpret_cast<const tcp::TCPHdr*>(api.ip_data()); }
-const udp::UDPHdr* get_udp_embed_icmp(const Packet* const p)
-{
- return reinterpret_cast<const udp::UDPHdr*>(
- get_prot_embed_icmp(p));
-}
+const udp::UDPHdr* get_udp_embed_icmp(const ip::IpApi& api)
+{ return reinterpret_cast<const udp::UDPHdr*>(api.ip_data()); }
-const icmp::ICMPHdr* get_icmp_embed_icmp(const Packet* const p)
-{
- return reinterpret_cast<const icmp::ICMPHdr*>(
- get_prot_embed_icmp(p));
-}
+const icmp::ICMPHdr* get_icmp_embed_icmp(const ip::IpApi& api)
+{ return reinterpret_cast<const icmp::ICMPHdr*>(api.ip_data()); }
} // namespace layer
// RETURN:
// true - ip layer found and api set
// false - ip layer NOT found, api reset
-bool set_api_ip_embed_icmp(const Packet*);
bool set_api_ip_embed_icmp(const Packet*, ip::IpApi& api);
-// When a protocol is embedded in ICMP, this function
-// will return a pointer to the layer. Use the
-// proto_bits to determine what this layer is!
-const uint8_t* get_prot_embed_icmp(const Packet* const);
-const tcp::TCPHdr* get_tcp_embed_icmp(const Packet* const);
-const udp::UDPHdr* get_udp_embed_icmp(const Packet* const);
-const icmp::ICMPHdr* get_icmp_embed_icmp(const Packet* const);
+// a helper function when the api to be set is inside the packet
+bool set_api_ip_embed_icmp(const Packet* p);
+
+/*
+ *When a protocol is embedded in ICMP, these functions
+ * will return a pointer to the layer. Use the
+ * proto_bits before calling these function to determine
+ * what this layer is!
+ */
+const tcp::TCPHdr* get_tcp_embed_icmp(const ip::IpApi&);
+const udp::UDPHdr* get_udp_embed_icmp(const ip::IpApi&);
+const icmp::ICMPHdr* get_icmp_embed_icmp(const ip::IpApi&);
+
int get_inner_ip_lyr(const Packet* const p);
#ifndef PROTOCOLS_LINUX_SLL_H
#define PROTOCOLS_LINUX_SLL_H
-#ifndef NO_NON_ETHER_DECODER
-
namespace linux_sll
{
} // namespace ssl
-#endif /* NO_NON_ETHER_DECODER */
#endif /* LINUX_SLL_H */
const uint8_t *ip_frag_start;
- const uint8_t *tcp_options_data;
Layer layers[LAYER_MAX]; /* decoded encapsulations */
#define BIT(i) (0x1 << (i-1))
-static inline int PacketWasCooked(const Packet* p)
-{
- return ( p->packet_flags & PKT_PSEUDO ) != 0;
-}
+static inline int PacketWasCooked(const Packet* const p)
+{ return ( p->packet_flags & PKT_PSEUDO ) != 0; }
-static inline bool IsPortscanPacket(const Packet *p)
-{
- return ( PacketWasCooked(p) && (p->pseudo_type == PSEUDO_PKT_PS));
-}
+static inline bool IsPortscanPacket(const Packet* const p)
+{ return ( PacketWasCooked(p) && (p->pseudo_type == PSEUDO_PKT_PS)); }
-static inline uint8_t GetEventProto(const Packet *p)
+static inline uint8_t GetEventProto(const Packet* const p)
{
if (IsPortscanPacket(p))
return p->ps_proto;
return p->ip_api.proto(); // return 0 if invalid
}
-static inline bool PacketHasFullPDU (const Packet* p)
-{
- return ( (p->packet_flags & PKT_PDU_FULL) == PKT_PDU_FULL );
-}
+static inline bool PacketHasFullPDU (const Packet* const p)
+{ return ( (p->packet_flags & PKT_PDU_FULL) == PKT_PDU_FULL ); }
-static inline bool PacketHasStartOfPDU (const Packet* p)
-{
- return ( (p->packet_flags & PKT_PDU_HEAD) != 0 );
-}
+static inline bool PacketHasStartOfPDU (const Packet* const p)
+{ return ( (p->packet_flags & PKT_PDU_HEAD) != 0 ); }
-static inline bool PacketHasPAFPayload (const Packet* p)
-{
- return ( (p->packet_flags & PKT_REBUILT_STREAM) || PacketHasFullPDU(p) );
-}
+static inline bool PacketHasPAFPayload (const Packet* const p)
+{ return ( (p->packet_flags & PKT_REBUILT_STREAM) || PacketHasFullPDU(p) ); }
-static inline bool PacketIsRebuilt (const Packet* p)
-{
- return ( (p->packet_flags & (PKT_REBUILT_STREAM|PKT_REBUILT_FRAG)) != 0 );
-}
+static inline bool PacketIsRebuilt (const Packet* const p)
+{ return ( (p->packet_flags & (PKT_REBUILT_STREAM|PKT_REBUILT_FRAG)) != 0 ); }
-static inline void SetExtraData (Packet* p, uint32_t xid)
-{
- p->xtradata_mask |= BIT(xid);
-}
+static inline void SetExtraData (Packet* p, const uint32_t xid)
+{ p->xtradata_mask |= BIT(xid); }
-static inline uint16_t EXTRACT_16BITS(const uint8_t* p)
-{
- return ntohs(*(uint16_t*)(p));
-}
+static inline uint16_t EXTRACT_16BITS(const uint8_t* const p)
+{ return ntohs(*(uint16_t*)(p)); }
#ifdef WORDS_MUSTALIGN
/* allows unaligned ntohl parameter - dies w/SIGBUS on SPARCs */
static inline uint32_t EXTRACT_32BITS(const uint8_t* p)
- {
- return ntohl(*(uint32_t *)p);
- }
+ { return ntohl(*(uint32_t *)p); }
#endif /* WORDS_MUSTALIGN */
#endif
constexpr uint16_t PROTOCOL_GTP = 0x0102;
constexpr uint16_t IP_EMBEDDED_IN_ICMP4 = 0x0103;
constexpr uint16_t IP_EMBEDDED_IN_ICMP6 = 0x0104;
-constexpr uint16_t PROT_EMBEDDED_IN_ICMP = 0x0105;
#ifndef PROTOCOLS_WLAN_H
#define PROTOCOLS_WLAN_H
-#ifndef NO_NON_ETHER_DECODER
+#include <cstdint>
namespace wlan
{
} // namespace wlan
#endif
-
-#endif
-
-
if (p->proto_bits & PROTO_BIT__TCP_EMBED_ICMP)
{
- const tcp::TCPHdr* tcph = layer::get_tcp_embed_icmp(p);
+ const tcp::TCPHdr* tcph = layer::get_tcp_embed_icmp(iph);
sport = ntohs(tcph->th_sport);
dport = ntohs(tcph->th_dport);
}
else if (p->proto_bits & PROTO_BIT__UDP_EMBED_ICMP)
{
- const udp::UDPHdr* udph = layer::get_udp_embed_icmp(p);
+ const udp::UDPHdr* udph = layer::get_udp_embed_icmp(iph);
sport = ntohs(udph->uh_sport);
dport = ntohs(udph->uh_dport);
if (p->ip_api.is_ip4())
{
- ip::IPHdr* iph = const_cast<ip::IPHdr*>(dpkt->ip_api.get_ip4h());
+ ip::IP4Hdr* iph = const_cast<ip::IP4Hdr*>(dpkt->ip_api.get_ip4h());
/*
* if there are IP options, copy those in as well
}
else /* Inner/only is IP6 */
{
- ip::IP6RawHdr* rawHdr = const_cast<ip::IP6RawHdr*>(dpkt->ip_api.get_ip6h());
+ ip::IP6Hdr* rawHdr = const_cast<ip::IP6Hdr*>(dpkt->ip_api.get_ip6h());
if ( !rawHdr )
{
projects / thirdparty / snort3.git / commitdiff
