p->dsize -= sizeof(ICMPHdr::icmp_hun.idseq);
p->data += sizeof(ICMPHdr::icmp_hun.idseq);
- if ( ipv6::is_multicast(p->ip_api.get_dst()->ip.u6_addr8[0]) )
+ if ( ipv6::is_multicast(p->ip_api.get_dst()->ip8[0]) )
codec_events::decoder_event(p, DECODE_ICMP6_DST_MULTICAST);
}
else
goto decodeipv6_fail;
}
+#if 0
+ // multiple encapsulations are now allowed. this alert is no longer valid
+ if (p->encapsulations)
+ codec_events::decoder_alert_encapsulated(p, DECODE_IP_MULTIPLE_ENCAPSULATION,
+ raw_pkt, raw_len);
+#endif
- // This will need to go
- if (p->family != NO_IP)
- {
- if (p->encapsulations)
- codec_events::decoder_alert_encapsulated(p, DECODE_IP_MULTIPLE_ENCAPSULATION,
- raw_pkt, raw_len);
- }
payload_len = ntohs(ip6h->ip6plen) + ipv6::hdr_len();
fe80:0000:0000:0000:0000:5efe, followed by the IPv4 address. */
if (isatap_interface_id == 0x00005EFE)
{
- if (p->ip_api.get_src()->ip.u6_addr32[0] != ip6h->ip6_src.u6_addr32[3])
+ if (p->ip_api.get_src()->ip32[0] != ip6h->ip6_src.u6_addr32[3])
codec_events::decoder_event(p, DECODE_IPV6_ISATAP_SPOOF);
}
}
{
checksum::Pseudoheader ps;
const IPHdr *ip4h = ip_api->get_ip4h();
- ps.sip = ((IPHdr *)enc->ip_hdr)->ip_src;
- ps.dip = ((IPHdr *)enc->ip_hdr)->ip_dst;
+ ps.sip = ip4h->get_src();
+ ps.dip = ip4h->get_dst();
ps.zero = 0;
ps.protocol = IPPROTO_UDP;
ps.len = ho->uh_len;
else
{
sfip_t cleared;
- IP_CLEAR(cleared);
+ sfip_clear(cleared);
filterEvent = sfthreshold_test(
otn->sigInfo.generator,
otn->sigInfo.id,
- IP_ARG(cleared), IP_ARG(cleared),
+ &cleared, &cleared,
p->pkth->ts.tv_sec);
}
return;
}
- IP_COPY_VALUE(idx->key.sip, p->ip_api.get_src());
- IP_COPY_VALUE(idx->key.dip, p->ip_api.get_dst());
+ sfip_copy(idx->key.sip, p->ip_api.get_src());
+ sfip_copy(idx->key.dip, p->ip_api.get_dst());
idx->key.sp = p->sp;
idx->key.dp = p->dp;
idx->proto = p->ip_api.proto();
DEBUG_WRAP(DebugMessage(DEBUG_FLOW, "[*] Checking session tag list (forward)...\n"););
- IP_COPY_VALUE(idx.key.sip, p->ip_api.get_src());
- IP_COPY_VALUE(idx.key.dip, p->ip_api.get_dst());
+ sfip_copy(idx.key.sip, p->ip_api.get_src());
+ sfip_copy(idx.key.dip, p->ip_api.get_dst());
idx.key.sp = p->sp;
idx.key.dp = p->dp;
if(returned == NULL)
{
- IP_COPY_VALUE(idx.key.dip, p->ip_api.get_src());
- IP_COPY_VALUE(idx.key.sip, p->ip_api.get_dst());
+ sfip_copy(idx.key.dip, p->ip_api.get_src());
+ sfip_copy(idx.key.sip, p->ip_api.get_dst());
idx.key.dp = p->sp;
idx.key.sp = p->dp;
** Only switch sip, because that's all we check for
** the host tags.
*/
- IP_COPY_VALUE(idx.key.sip, p->ip_api.get_src());
+ sfip_copy(idx.key.sip, p->ip_api.get_src());
returned = (TagNode *) sfxhash_find(host_tag_cache_ptr, &idx);
}
srcIP = p->ip_api.get_src();
dstIP = p->ip_api.get_dst();
- IP_COPY_VALUE(hashKey.dip, dstIP);
- IP_COPY_VALUE(hashKey.sip, srcIP);
+ sfip_copy(hashKey.dip, dstIP);
+ sfip_copy(hashKey.sip, srcIP);
hashKey.file_sig = file_sig;
hash_node = sfxhash_find_node(fileHash, &hashKey);
}
srcIP = p->ip_api.get_src();
dstIP = p->ip_api.get_dst();
- IP_COPY_VALUE(hashKey.dip, dstIP);
- IP_COPY_VALUE(hashKey.sip, srcIP);
+ sfip_copy(hashKey.dip, dstIP);
+ sfip_copy(hashKey.sip, srcIP);
hashKey.file_sig = file_sig;
hash_node = sfxhash_find_node(fileHash, &hashKey);
}
else
{
- IP_CLEAR(cleared);
- sip = IP_ARG(cleared);
- dip = IP_ARG(cleared);
+ sfip_clear(cleared);
+ sip = &cleared;
+ dip = &cleared;
}
if ((snort_conf == NULL) || (snort_conf->rate_filter_config == NULL))
case SFRF_TRACK_BY_RULE:
{
sfip_t cleared;
- IP_CLEAR(cleared);
- newStatus = SFRF_TestObject(cfgNode, IP_ARG(cleared), curTime, op);
+ sfip_clear(cleared);
+ newStatus = SFRF_TestObject(cfgNode, &cleared, curTime, op);
}
break;
SFXHASH_NODE * hnode = NULL;
/* Setup key */
- key.ip = *(IP_PTR(ip));
+ key.ip = *(ip);
key.tid = tid;
key.policyId = get_network_policy()->policy_id;
/* Set up the key */
key.policyId = policy_id;
- key.ip = IP_VAL(ip);
+ key.ip = *ip;
key.thd_id = sfthd_node->thd_id;
/* Set up a new data element */
*/
/* Set up the key */
- key.ip = IP_VAL(ip);
+ key.ip = *ip;
key.gen_id = sfthd_node->gen_id;
key.sig_id = sig_id;
key.policyId = policy_id;
if (rval == SFIP_LESSER || (rval == SFIP_EQUAL && cliPort < srvPort))
{
- IP_COPY_VALUE(ip1, cliIP);
+ sfip_copy(ip1, cliIP);
port1 = cliPort;
- IP_COPY_VALUE(ip2, srvIP);
+ sfip_copy(ip2, srvIP);
port2 = srvPort;
reverse = false;
}
else
{
- IP_COPY_VALUE(ip1, srvIP);
+ sfip_copy(ip1, srvIP);
port1 = srvPort;
- IP_COPY_VALUE(ip2, cliIP);
+ sfip_copy(ip2, cliIP);
port2 = cliPort;
reverse = true;
}
#endif
PROFILE_VARS;
- if(!p->iph_api || (IsTCP(p) && !p->tcph)
+ if(!p->ip_api.is_valid() || (IsTCP(p) && !p->tcph)
|| (IsUDP(p) && !p->udph))
return 0; /* if error occured while ip header
* was processed, return 0 automagically. */
if (ip == NULL)
return ip_buf;
- if (!IP_IS_SET(snort_conf->obfuscation_net))
+ if (!sfip_is_set(snort_conf->obfuscation_net))
{
if (ip->is_ip6())
SnortSnprintf(ip_buf, buf_size, "x:x:x:x::x:x:x:x");
sfip_t tmp;
char *tmp_buf;
- IP_COPY_VALUE(tmp, ip);
+ sfip_copy(tmp, ip);
- if (IP_IS_SET(snort_conf->homenet))
+ if (sfip_is_set(snort_conf->homenet))
{
if (sfip_contains(&snort_conf->homenet, &tmp) == SFIP_CONTAINS)
sfip_obfuscate(&snort_conf->obfuscation_net, &tmp);
Layer* lyr;
int len;
int num_layers = p->num_layers;
-
- // TODO -- remove
DAQ_PktHdr_t* pkth = (DAQ_PktHdr_t*)c->pkth;
- uint8_t* pkt = (uint8_t*)c->pkt;
if ( num_layers <= 0 )
return -1;
sfip_t in;
sfip_set_raw(&in, &p.ipv4_addr, AF_INET);
// FIXIT replace all inet_ntoa() with thread safe
- LogMessage(" %s -> ", inet_ntoa(IP_ARG(in)));
+ LogMessage(" %s -> ", inet_ntoa(&in));
for (int i = 0; i < 6; i++)
{
sfSFSKey key;
sfSFSValue *value;
- if (IP_LESSER(src_addr, dst_addr))
+ if (sfip_lesser(src_addr, dst_addr))
{
- IP_COPY_VALUE(key.ipA, src_addr);
- IP_COPY_VALUE(key.ipB, dst_addr);
+ sfip_copy(key.ipA, src_addr);
+ sfip_copy(key.ipB, dst_addr);
*swapped = 0;
}
else
{
- IP_COPY_VALUE(key.ipA, dst_addr);
- IP_COPY_VALUE(key.ipB, src_addr);
+ sfip_copy(key.ipA, dst_addr);
+ sfip_copy(key.ipB, src_addr);
*swapped = 1;
}
#include "snort.h"
#include "filters/sfthreshold.h"
#include "sfsnprintfappend.h"
-#include "sf_iph.h"
#include "framework/inspector.h"
#include "framework/share.h"
#include "framework/plug_data.h"
const sfip_t *src_addr;
const sfip_t *dst_addr;
- if(!p->iph_api)
+ if(!p->ip_api.is_valid())
return -1;
/* Do not log if being suppressed */
if (config->detect_scan_type &
(PS_TYPE_PORTSCAN | PS_TYPE_DECOYSCAN | PS_TYPE_DISTPORTSCAN))
{
- IP_CLEAR(key.scanner);
+ sfip_clear(key.scanner);
if(ps_pkt->reverse_pkt)
- IP_COPY_VALUE(key.scanned, p->ip_api.get_src());
+ sfip_copy(key.scanned, p->ip_api.get_src());
else
- IP_COPY_VALUE(key.scanned, p->ip_api.get_dst());
+ sfip_copy(key.scanned, p->ip_api.get_dst());
/*
** Get the scanned tracker.
*/
if(config->detect_scan_type & PS_TYPE_PORTSWEEP)
{
- IP_CLEAR(key.scanned);
+ sfip_clear(key.scanned);
if(ps_pkt->reverse_pkt)
- IP_COPY_VALUE(key.scanner, p->ip_api.get_dst());
+ sfip_copy(key.scanner, p->ip_api.get_dst());
else
- IP_COPY_VALUE(key.scanner, p->ip_api.get_src());
+ sfip_copy(key.scanner, p->ip_api.get_src());
/*
** Get the scanner tracker
if(proto->connection_count < 0)
proto->connection_count = 0;
- if(!IP_EQUALITY_UNSET(&proto->u_ips, ip))
+ if(!sfip_unset_equals(&proto->u_ips, ip))
{
proto->u_ip_count++;
- IP_COPY_VALUE(proto->u_ips, ip);
+ sfip_copy(proto->u_ips, ip);
}
/* we need to do the IP comparisons in host order */
if(sfip_is_set(&proto->low_ip))
{
- if(IP_GREATER(&proto->low_ip, ip))
- IP_COPY_VALUE(proto->low_ip, ip);
+ if(sfip_greater(&proto->low_ip, ip))
+ sfip_copy(proto->low_ip, ip);
}
else
{
- IP_COPY_VALUE(proto->low_ip, ip);
+ sfip_copy(proto->low_ip, ip);
}
- if(IP_IS_SET(proto->high_ip))
+ if(sfip_is_set(proto->high_ip))
{
- if(IP_LESSER(&proto->high_ip, ip))
- IP_COPY_VALUE(proto->high_ip, ip);
+ if(sfip_lesser(&proto->high_ip, ip))
+ sfip_copy(proto->high_ip, ip);
}
else
{
- IP_COPY_VALUE(proto->high_ip, ip);
+ sfip_copy(proto->high_ip, ip);
}
if(proto->u_ports != port)
Packet *p;
uint32_t session_flags;
sfip_t cleared;
- IP_CLEAR(cleared);
+ sfip_clear(cleared);
p = (Packet *)ps_pkt->pkt;
{
Packet *p;
sfip_t cleared;
- IP_CLEAR(cleared);
+ sfip_clear(cleared);
p = (Packet *)ps_pkt->pkt;
{
Packet *p;
sfip_t cleared;
- IP_CLEAR(cleared);
+ sfip_clear(cleared);
p = (Packet *)ps_pkt->pkt;
{
Packet *p;
sfip_t cleared;
- IP_CLEAR(cleared);
+ sfip_clear(cleared);
p = (Packet *)ps_pkt->pkt;
inline uint8_t get_version() const
{ return version & 0x07; }
- inline uint8_t get_proto() const
+ inline uint16_t get_proto() const
{ return ntohs(ether_type); }
};
#include "sfip/sfip_t.h"
-class Packet;
+struct Packet;
namespace ip
{
struct ICMPHdr;
}
+struct Packet;
+
namespace layer
{
#include "main/snort_types.h"
#include "sfip/ipv6_port.h"
#include "sfip/sf_ip.h"
-#include "sfip/sf_iph.h"
#include "codecs/sf_protocols.h"
Flow* flow; /* for session tracking */
//vvv-----------------------------
- IPH_API* iph_api;
-
int family;
//^^^-----------------------------
return FTPP_INVALID_ARG;
}
- iRet = KMapAdd(BounceLookup, (void*)IP_PTR(Ip), IP_SIZE(Ip), (void*)BounceTo);
+ iRet = KMapAdd(BounceLookup, (void*)Ip, Ip->sfip_size(), (void*)BounceTo);
if (iRet)
{
*iError = FTPP_SUCCESS;
- BounceTo = (FTP_BOUNCE_TO *)KMapFind(BounceLookup, (void*)IP_PTR(Ip), IP_SIZE(Ip));
+ BounceTo = (FTP_BOUNCE_TO *)KMapFind(BounceLookup, (void*)Ip, Ip->sfip_size());
if (!BounceTo)
{
*iError = FTPP_NOT_FOUND;
newBounce->porthi = high;
int iRet = ftp_bounce_lookup_add(
- ClientConf->bounce_lookup, IP_ARG(newBounce->ip), newBounce);
+ ClientConf->bounce_lookup, &newBounce->ip, newBounce);
if (iRet)
{
Ftpsession->server_conf = NULL;
Ftpsession->encr_state = NO_STATE;
- IP_CLEAR(Ftpsession->clientIP);
+ sfip_clear(Ftpsession->clientIP);
Ftpsession->clientPort = 0;
- IP_CLEAR(Ftpsession->serverIP);
+ sfip_clear(Ftpsession->serverIP);
Ftpsession->serverPort = 0;
Ftpsession->data_chan_state = NO_STATE;
Ftpsession->data_chan_index = -1;
*/
int SetSiInput(FTPP_SI_INPUT *SiInput, Packet *p)
{
- IP_COPY_VALUE(SiInput->sip, p->ip_api.get_src());
- IP_COPY_VALUE(SiInput->dip, p->ip_api.get_dst());
+ sfip_copy(SiInput->sip, p->ip_api.get_src());
+ sfip_copy(SiInput->dip, p->ip_api.get_dst());
SiInput->sport = p->sp;
SiInput->dport = p->dp;
int family = AF_UNSPEC, port = 0;
char buf[64];
- IP_CLEAR((*ipRet));
+ sfip_clear((*ipRet));
*portRet = 0;
/* check first delimiter */
break;
}
- if ( ThisFmt->type == e_extd_host_port && !IP_IS_SET(ipAddr) )
+ if ( ThisFmt->type == e_extd_host_port && !sfip_is_set(ipAddr) )
{
// actually, we expect no addr in 229 responses, which is
// understood to be server address, so we set that here
}
if ( session->client_conf->bounce )
{
- if (!IP_EQUALITY(&ipAddr, p->ip_api.get_src()))
+ if (!sfip_equals(&ipAddr, p->ip_api.get_src()))
{
int alert = 1;
FTP_BOUNCE_TO *BounceTo = ftp_bounce_lookup_find(
- session->client_conf->bounce_lookup, (const sfip_t*)IP_ARG(ipAddr), &iRet);
+ session->client_conf->bounce_lookup, &ipAddr, &iRet);
if (BounceTo)
{
if (BounceTo->portlo)
session->data_chan_state &= ~DATA_CHAN_PASV_CMD_ISSUED;
}
- IP_CLEAR(session->serverIP);
+ sfip_clear(session->serverIP);
session->serverPort = 0;
}
break;
sfip_t ipAddr;
uint16_t port=0;
const char *ip_begin = req->param_begin;
- IP_CLEAR(ipAddr);
+ sfip_clear(ipAddr);
session->data_chan_state &= ~DATA_CHAN_PASV_CMD_ISSUED;
session->data_chan_state |= DATA_CHAN_PASV_CMD_ACCEPT;
session->data_chan_index = -1;
);
if (iRet == FTPP_SUCCESS)
{
- if (!IP_IS_SET(ipAddr))
- IP_COPY_VALUE(session->serverIP, p->ip_api.get_src());
+ if (!sfip_is_set(ipAddr))
+ sfip_copy(session->serverIP, p->ip_api.get_src());
else
{
session->serverIP = ipAddr;
}
session->serverPort = port;
- IP_COPY_VALUE(session->clientIP, p->ip_api.get_dst());
+ sfip_copy(session->clientIP, p->ip_api.get_dst());
session->clientPort = 0;
if ((file_api->get_max_file_depth() > 0) || !(session->server_conf->data_chan))
/* Call into Streams to mark data channel as ftp-data */
result = stream.set_application_protocol_id_expected(
- IP_ARG(session->clientIP), session->clientPort,
- IP_ARG(session->serverIP), session->serverPort,
+ &session->clientIP, session->clientPort,
+ &session->serverIP, session->serverPort,
(uint8_t)(p->ip_api.proto()), ftp_data_app_id, fd);
if (result < 0)
/* Call into Streams to mark data channel as something
* to ignore. */
stream.ignore_session(
- IP_ARG(session->clientIP), session->clientPort,
- IP_ARG(session->serverIP), session->serverPort,
+ &session->clientIP, session->clientPort,
+ &session->serverIP, session->serverPort,
(uint8_t)(p->ip_api.proto()),
FtpDataFlowData::flow_id, SSN_DIR_BOTH);
}
session->data_chan_state &= ~DATA_CHAN_PORT_CMD_ISSUED;
session->data_chan_state |= DATA_CHAN_PORT_CMD_ACCEPT;
session->data_chan_index = -1;
- if (IP_IS_SET(session->clientIP))
+ if (sfip_is_set(session->clientIP))
{
/* This means we're not in passive mode. */
/* Server is listening/sending from its own IP,
* FTP Port -1 */
/* Client IP, Port specified via PORT command */
- IP_COPY_VALUE(session->serverIP, p->ip_api.get_src());
+ sfip_copy(session->serverIP, p->ip_api.get_src());
/* Can't necessarily guarantee this, especially
* in the case of a proxy'd connection where the
/* Call into Streams to mark data channel as ftp-data */
result = stream.set_application_protocol_id_expected(
- IP_ARG(session->clientIP), session->clientPort,
- IP_ARG(session->serverIP), session->serverPort,
+ &session->clientIP, session->clientPort,
+ &session->serverIP, session->serverPort,
(uint8_t)(p->ip_api.proto()), ftp_data_app_id, fd);
if (result < 0)
/* Call into Streams to mark data channel as something
* to ignore. */
stream.ignore_session(
- IP_ARG(session->clientIP), session->clientPort,
- IP_ARG(session->serverIP), session->serverPort,
+ &session->clientIP, session->clientPort,
+ &session->serverIP, session->serverPort,
(uint8_t)(p->ip_api.proto()),
FtpDataFlowData::flow_id, SSN_DIR_BOTH);
}
}
/* Clear the session info for next transfer -->
* reset host/port */
- IP_CLEAR(session->serverIP);
- IP_CLEAR(session->clientIP);
+ sfip_clear(session->serverIP);
+ sfip_clear(session->clientIP);
session->serverPort = session->clientPort = 0;
session->data_chan_state = NO_STATE;
}
if(*true_ip)
{
- if(!IP_EQUALITY(*true_ip, tmp))
+ if(!sfip_equals(*true_ip, tmp))
{
sfip_free(*true_ip);
*true_ip = tmp;
static inline int SetSiInput(HI_SI_INPUT *SiInput, Packet *p)
{
- IP_COPY_VALUE(SiInput->sip, p->ip_api.get_src());
- IP_COPY_VALUE(SiInput->dip, p->ip_api.get_dst());
+ sfip_copy(SiInput->sip, p->ip_api.get_src());
+ sfip_copy(SiInput->dip, p->ip_api.get_dst());
SiInput->sport = p->sp;
SiInput->dport = p->dp;
if (sip.family == AF_INET)
{
- sip.ip.u6_addr32[0] = ntohl(sip.ip.u6_addr32[0]);
+ sip.ip32[0] = ntohl(sip.ip32[0]);
}
if (dip.family == AF_INET)
{
- dip.ip.u6_addr32[0] = ntohl(dip.ip.u6_addr32[0]);
+ dip.ip32[0] = ntohl(dip.ip32[0]);
}
ServerConfDip = ServerConfSip = GlobalConf;
set(SFIP_INCLUDES
ipv6_port.h
- sf_iph.h
sf_ip.h
sf_ipvar.h
sfip_t.h
add_library ( sfip STATIC
${SFIP_INCLUDES}
sf_ip.cc
- sf_iph.cc
sf_ipvar.cc
sf_vartable.cc
sf_vartable.h
x_include_HEADERS = \
ipv6_port.h \
sf_ip.h \
-sf_iph.h \
sf_ipvar.h \
sfip_t.h
libsfip_a_SOURCES = \
sf_ip.cc \
-sf_iph.cc \
sf_ipvar.cc \
sf_vartable.cc \
sf_vartable.h
#include "sfip/sf_ipvar.h"
-#ifdef inet_ntoa
-#undef inet_ntoa
-#endif
-#define inet_ntoa sfip_ntoa
#if 0
typedef const sfip_t *const sfip_t*;
#define GET_IPH_OFF(p) (p)->iph_api->iph_ret_off(p)
#define GET_IPH_VER(p) (p)->iph_api->iph_ret_ver(p)
-#endif
-
-
-#if 0
#define p->ip_api.proto() ((uint8_t)(IS_IP6(p) ? ((p)->ip6h->next) : ((p)->iph_api->iph_ret_proto(p))))
/* XXX make sure these aren't getting confused with sfip_is_valid within the code */
#define IPH_IS_VALID(p) iph_is_valid(p)
-#endif
#define IP_EQUALITY(x,y) (sfip_compare((x),(y)) == SFIP_EQUAL)
#define IP_EQUALITY_UNSET(x,y) (sfip_compare_unset((x),(y)) == SFIP_EQUAL)
#define IP_LESSER(x,y) (sfip_compare((x),(y)) == SFIP_LESSER)
#define IP_GREATER(x,y) (sfip_compare((x),(y)) == SFIP_GREATER)
-
-
-
#define IP_CLEAR(x) (x).bits = (x).family = 0; (x).ip32[0] = (x).ip32[1] = (x).ip32[2] = (x).ip32[3] = 0;
-
#define IP_IS_SET(x) sfip_is_set(&x)
+#define IP_COPY_VALUE(x,y) ( x = *y)
/* This loop trickery is intentional. If each copy is performed
* individually on each field, then the following expression gets broken:
* If the macro is instead enclosed in braces, then having a semicolon
* trailing the macro causes compile breakage.
* So: use loop. */
-#define IP_COPY_VALUE(x,y) \
+
+ \
do { \
(x).bits = (y)->bits; \
(x).family = (y)->family; \
(x).ip32[3] = (y)->ip32[3]; \
} while(0)
-#if 0
#define GET_IPH_HLEN(p) ((p)->iph_api->iph_ret_hlen(p))
#define SET_IPH_HLEN(p, val)
#define GET_INNER_SRC_IP(p) (IS_IP6(p) ? (&((p)->inner_ip6h.ip_src)):(&((p)->inner_ip4h.ip_src)))
#define GET_INNER_DST_IP(p) (IS_IP6(p) ? (&((p)->inner_ip6h.ip_dst)):(&((p)->inner_ip4h.ip_dst)))
-#endif
+
+
#define IP_ARG(ipt) (&ipt)
#define IP_PTR(ipp) (ipp)
#define IP_VAL(ipt) (*ipt)
#define IP_SIZE(ipp) (sfip_size(ipp))
+
static inline int sfip_equal (const sfip_t *ip1, const sfip_t *ip2)
{
if ( ip1->family != ip2->family )
}
return 0;
}
+#endif
#endif /* IPV6_PORT_H */
static inline unsigned int sfip_size(const sfip_t *ipt)
{
if ( ipt->family == AF_INET6 ) return sizeof(*ipt);
- return (unsigned int)((ipt->ip.u6_addr8+4) - (u_int8_t*)ipt);
+ return (unsigned int)((ipt->ip8+4) - (u_int8_t*)ipt);
}
/* Member-access *******************************************************/
/* Returns SFIP_EQUAL if so */
SFIP_RET sfip_contains(const sfip_t *net, const sfip_t *ip);
+#if 0
/* Returns 1 if the IP is non-zero. 0 otherwise */
/* XXX This is a performance critical function, \
- * need to determine if it's safe to not check these pointers */\
+ * need to determine if it's safe to not check these pointers */
static inline int sfip_is_set(const sfip_t *ip) {
// ARG_CHECK1(ip, -1);
return ip->ip32[0] ||
ip->ip32[2] ||
ip->ip32[3] || ip->bits != 128)) || ((ip->family == AF_INET) && ip->bits != 32) ;
}
+#endif
/* Return 1 if the IP is a loopback IP */
int sfip_is_loopback(const sfip_t *ip);
* or greater than ip2 In the case of mismatched families, the IPv4 address
* is converted to an IPv6 representation. */
/* XXX-IPv6 Should add version of sfip_compare that just tests equality */
-static inline SFIP_RET sfip_compare(const sfip_t *ip1, const sfip_t *ip2) {
+static inline SFIP_RET sfip_compare(const sfip_t* const ip1, const sfip_t* const ip2) {
int f1,f2;
ARG_CHECK2(ip1, ip2, SFIP_ARG_ERR);
* or greater than ip2 In the case of mismatched families, the IPv4 address
* is converted to an IPv6 representation. */
/* XXX-IPv6 Should add version of sfip_compare that just tests equality */
-static inline SFIP_RET sfip_compare_unset(const sfip_t *ip1, const sfip_t *ip2) {
+static inline SFIP_RET sfip_compare_unset(const sfip_t* const ip1, const sfip_t* const ip2) {
int f1,f2;
ARG_CHECK2(ip1, ip2, SFIP_ARG_ERR);
return SFIP_FAILURE;
}
-static inline int sfip_fast_lt4(const sfip_t *ip1, const sfip_t *ip2) {
+static inline int sfip_fast_lt4(const sfip_t* const ip1, const sfip_t* const ip2) {
return *ip1->ip32 < *ip2->ip32;
}
-static inline int sfip_fast_gt4(const sfip_t *ip1, const sfip_t *ip2) {
+static inline int sfip_fast_gt4(const sfip_t* const ip1, const sfip_t* const ip2) {
return *ip1->ip32 > *ip2->ip32;
}
-static inline int sfip_fast_eq4(const sfip_t *ip1, const sfip_t *ip2) {
+static inline int sfip_fast_eq4(const sfip_t* const ip1, const sfip_t* const ip2) {
return *ip1->ip32 == *ip2->ip32;
}
-static inline int sfip_fast_lt6(const sfip_t *ip1, const sfip_t *ip2) {
+static inline int sfip_fast_lt6(const sfip_t* const ip1, const sfip_t* const ip2) {
const u_int32_t *p1, *p2;
p1 = ip1->ip32;
return 0;
}
-static inline int sfip_fast_gt6(const sfip_t *ip1, const sfip_t *ip2) {
+static inline int sfip_fast_gt6(const sfip_t* const ip1, const sfip_t* const ip2) {
const u_int32_t *p1, *p2;
p1 = ip1->ip32;
}
+#if 0
#define sfip_equals(x,y) (sfip_compare(&x, &y) == SFIP_EQUAL)
#define sfip_not_equals !sfip_equals
#define sfip_clear(x) memset(x, 0, 16)
+#endif
/* Printing ************************************************************/
/* Uses a static buffer to return a string representation of the IP */
-char *sfip_to_str(const sfip_t *ip);
-#define sfip_ntoa(x) sfip_to_str(x)
void sfip_raw_ntop(int family, const void *ip_raw, char *buf, int bufsize);
void sfip_ntop(const sfip_t *ip, char *buf, int bufsize);
+++ /dev/null
-/****************************************************************************
- *
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
- * Copyright (C) 2007-2013 Sourcefire, Inc.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License Version 2 as
- * published by the Free Software Foundation. You may not use, modify or
- * distribute this program under any other version of the GNU General
- * Public License.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
- *
- ****************************************************************************/
-
-#include "sf_iph.h"
-
-#ifdef HAVE_CONFIG_H
-#include "config.h"
-#endif
-#include <string.h>
-#include "protocols/packet.h"
-
-#define FAILURE -1
-#define SUCCESS 0
-#define IP6_HDR_LEN 40
-
-/* Version is the first four bits of the uint32_t passed in */
-#define IP6_VER(x) \
- (ntohl(x) >> 28)
-
-/* The 'Packet' structure is almost always allocated on the stack.
- * Likewise, return buffers will almost always be aswell.
- * So, for performance reasons, argument validation can be disabled
- * and removed from the code at compile time to prevent unecessary extra
- * conditionals from being checked at run-time. */
-#define ERR_CHK_LVL 0
-#if ERR_CHK_LVL == 2
-#define VALIDATE(x,y) if(!x || !y) return FAILURE;
-#elif ERR_CHK_LVL == 1
-#define VALIDATE(x,y) if(!y) return FAILURE;
-#else
-#define VALIDATE(x,y)
-#endif
-
-#if 0
-
-sfip_t *ip6_ret_src(const Packet *p)
-{
- VALIDATE(p, 1);
- return &p->ip6h->ip_src;
-}
-
-sfip_t *orig_ip6_ret_src(const Packet *p)
-{
- VALIDATE(p, 1);
-
- return nullptr;
-// return &p->orig_ip6h->ip_src;
-}
-
-sfip_t *ip6_ret_dst(const Packet *p)
-{
- VALIDATE(p, 1);
-
- return &p->ip6h->ip_dst;
-}
-
-
-sfip_t *orig_ip6_ret_dst(const Packet *p)
-{
- VALIDATE(p, 1);
- return nullptr;
-// return &p->orig_ip6h->ip_dst;
-}
-
-uint16_t ip6_ret_toc(const Packet *p)
-{
- uint16_t toc;
- VALIDATE(p,1);
-
- toc = (uint16_t)((ntohl(p->ip6h->vcl) & 0x0FF00000) >> 20);
-
- return 0;
-// return toc;
-}
-
-uint16_t orig_ip6_ret_toc(const Packet *p)
-{
- uint16_t toc;
- VALIDATE(p,1);
-
- return 0;
-// toc = (uint16_t)((ntohl(p->orig_ip6h->vcl) & 0x0FF00000) >> 20);
-// return toc;
-}
-
-uint8_t ip6_ret_hops(const Packet *p)
-{
-// VALIDATE(p,1);
-
- return p->ip6h->hop_lmt;
-}
-
-uint8_t orig_ip6_ret_hops(const Packet *p)
-{
-// VALIDATE(p,1);
-
- return 0;
-// return p->orig_ip6h->hop_lmt;
-}
-
-uint16_t ip6_ret_len(const Packet *p)
-{
- VALIDATE(p,1);
-
- /* The length field does not include the header in IPv6, but does in IPv4.
- * To make this analogous to IPv4, for Snort's purposes, we need to tack
- * on the difference. */
- return p->ip6h->len;
-}
-
-uint16_t orig_ip6_ret_len(const Packet *p)
-{
- VALIDATE(p,1);
-
- return 0;
-// return p->orig_ip6h->len;
-}
-
-uint32_t ip6_ret_id(const Packet *p)
-{
- IP6Frag *frag_hdr;
- if (p->ip6_extension_count == 0)
- return 0;
-
- frag_hdr = (IP6Frag*)p->ip6_extensions[p->ip6_frag_index].data;
-
- return frag_hdr->ip6f_ident;
-}
-
-uint32_t orig_ip6_ret_id(const Packet*)
-{
-// XXX-IPv6 "NOT YET IMPLEMENTED - IP6 identification"
- return 0;
-}
-
-uint8_t ip6_ret_next(const Packet *p)
-{
- VALIDATE(p,1);
- return p->ip6h->next;
-}
-
-uint8_t orig_ip6_ret_next(const Packet *p)
-{
- VALIDATE(p,1);
- return 0;
-// return p->orig_ip6h->next;
-}
-
-uint16_t ip6_ret_off(const Packet *p)
-{
- IP6Frag *frag_hdr;
- if (p->ip6_extension_count == 0)
- return 0;
-
- frag_hdr = (IP6Frag *)p->ip6_extensions[p->ip6_frag_index].data;
-
- return frag_hdr->ip6f_offlg;
-}
-
-uint16_t orig_ip6_ret_off(const Packet*)
-{
-// XXX-IPv6 "NOT YET IMPLEMENTED - IP6 frag offset"
- return 0;
-}
-
-uint8_t ip6_ret_ver(const Packet *p)
-{
- return (uint8_t)IP6_VER(p->ip6h->vcl);
-}
-
-uint8_t orig_ip6_ret_ver(const Packet *p)
-{
- return 0;
-// return (uint8_t)IP6_VER(p->orig_ip6h->vcl);
-}
-
-sfip_t *ip4_ret_dst(const Packet *p)
-{
- VALIDATE(p,1);
- return &p->ip4h->ip_dst;
-}
-
-sfip_t *orig_ip4_ret_dst(const Packet *p)
-{
- VALIDATE(p,1);
- return nullptr;
-// return &p->orig_ip4h->ip_dst;
-}
-
-sfip_t *ip4_ret_src(const Packet *p)
-{
- VALIDATE(p,1);
- return &p->ip4h->ip_src;
-}
-
-sfip_t *orig_ip4_ret_src(const Packet *p)
-{
- VALIDATE(p,1);
- return nullptr;
-// return &p->orig_ip4h->ip_src;
-}
-
-uint16_t ip4_ret_tos(const Packet *p)
-{
- VALIDATE(p,1);
-
- return p->ip4h->ip_tos;
-}
-
-uint16_t orig_ip4_ret_tos(const Packet *p)
-{
- VALIDATE(p,1);
-
- return 0;
-// return p->orig_ip4h->ip_tos;
-}
-
-uint8_t ip4_ret_ttl(const Packet *p)
-{
- VALIDATE(p,1);
-
- return p->ip4h->ip_ttl;
-}
-
-uint8_t orig_ip4_ret_ttl(const Packet *p)
-{
- VALIDATE(p,1);
-
- return 0;
-// return p->orig_ip4h->ip_ttl;
-}
-
-uint16_t ip4_ret_len(const Packet *p)
-{
- VALIDATE(p,1);
-
- return p->ip4h->ip_len;
-}
-
-uint16_t orig_ip4_ret_len(const Packet *p)
-{
- VALIDATE(p,1);
-
- return 0;
-// return p->orig_ip4h->ip_len;
-}
-
-uint32_t ip4_ret_id(const Packet *p)
-{
- VALIDATE(p,1);
-
- return (uint32_t)p->ip4h->ip_id;
-}
-
-uint32_t orig_ip4_ret_id(const Packet *p)
-{
- VALIDATE(p,1);
-
- return 0;
-// return (uint32_t)p->orig_ip4h->ip_id;
-}
-
-uint8_t ip4_ret_proto(const Packet *p)
-{
- // VALIDATION()
-
- return p->ip4h->ip_proto;
-}
-
-uint8_t orig_ip4_ret_proto(const Packet *p)
-{
- // VALIDATION()
-
- return 0;
-// return p->orig_ip4h->ip_proto;
-}
-
-uint16_t ip4_ret_off(const Packet *p)
-{
- return p->ip4h->ip_off;
-}
-
-uint16_t orig_ip4_ret_off(const Packet *p)
-{
- return 0;
-// return p->orig_ip4h->ip_off;
-}
-
-uint8_t ip4_ret_ver(const Packet *p)
-{
- return (p->iph->ip_verhl & 0xf0) >> 4;
-}
-
-#if 0
-uint8_t orig_ip4_ret_ver(const Packet *p)
-{
- return (p->orig_iph->ip_verhl & 0xf0) >> 4;
-}
-#endif
-
-uint8_t ip4_ret_hlen(const Packet *p)
-{
- return p->iph->ip_verhl & 0x0f;
-}
-
-uint8_t orig_ip4_ret_hlen(const Packet *p)
-{
- return 0;
-// return p->orig_iph->ip_verhl & 0x0f;
-}
-
-uint8_t ip6_ret_hlen(const Packet*)
-{
- /* Snort is expecting this number to be in terms of 32 bit words */
- return IP6_HDR_LEN / 4 ;
-}
-
-uint8_t orig_ip6_ret_hlen(const Packet*)
-{
- return IP6_HDR_LEN / 4;
-}
-
-#endif
-
-IPH_API ip4 =
-{
-#if 0
- ip4_ret_src,
- ip4_ret_dst,
- ip4_ret_tos,
- ip4_ret_ttl,
- ip4_ret_len,
- ip4_ret_id,
- ip4_ret_proto,
- ip4_ret_off,
- ip4_ret_ver,
- ip4_ret_hlen,
- orig_ip4_ret_src,
- orig_ip4_ret_dst,
- orig_ip4_ret_tos,
- orig_ip4_ret_ttl,
- orig_ip4_ret_len,
- orig_ip4_ret_id,
- orig_ip4_ret_proto,
- orig_ip4_ret_off,
- orig_ip4_ret_ver,
- orig_ip4_ret_hlen,
-#endif
- IPH_API_V4
-};
-
-IPH_API ip6 =
-{
-#if 0
- ip6_ret_src,
- ip6_ret_dst,
- ip6_ret_toc,
- ip6_ret_hops,
- ip6_ret_len,
- ip6_ret_id,
- ip6_ret_next,
- ip6_ret_off,
- ip6_ret_ver,
- ip6_ret_hlen,
- orig_ip6_ret_src,
- orig_ip6_ret_dst,
- orig_ip6_ret_toc,
- orig_ip6_ret_hops,
- orig_ip6_ret_len,
- orig_ip6_ret_id,
- orig_ip6_ret_next,
- orig_ip6_ret_off,
- orig_ip6_ret_ver,
- orig_ip6_ret_hlen,
-#endif
- IPH_API_V6
-};
-
-static inline void _set_callbacks(Packet* p, int family, char orig)
-{
- if ( !orig )
- {
- if(family == AF_INET)
- p->iph_api = &ip4;
- else
- p->iph_api = &ip6;
-
- p->family = family;
- }
-}
-
-void set_callbacks(Packet* p, int family, char orig)
-{
- _set_callbacks(p, family, orig);
-}
-
-void sfiph_build(Packet *p, const void *hdr, int family)
-{
- ipv6::IP6RawHdr *hdr6;
- IPHdr *hdr4;
-
- if(!p || !hdr)
- return;
-
- /* If family is already set, we've been here before.
- * That means this is a nested IP. */
-#if 0
- if (p->family != NO_IP)
- {
- if (p->iph_api->ver == IPH_API_V4)
- memcpy(&p->outer_ip4h, &p->inner_ip4h, sizeof(IP4Hdr));
- else if (p->iph_api->ver == IPH_API_V6)
- memcpy(&p->outer_ip6h, &p->inner_ip6h, sizeof(IP6Hdr));
-
- }
-#endif
- _set_callbacks(p, family, CALLBACK_IP);
-
-#if 0
-
- if(family == AF_INET)
- {
- hdr4 = (IPHdr*)hdr;
-
- /* The struct Snort uses is identical to the actual IP6 struct,
- * with the exception of the IP addresses. Copy over everything but
- * the IPs */
- memcpy(&p->inner_ip4h, hdr4, sizeof(IPHdr) - 8);
- sfip_set_raw(&p->inner_ip4h.ip_src, &hdr4->ip_src, family);
- sfip_set_raw(&p->inner_ip4h.ip_dst, &hdr4->ip_dst, family);
-// p->actual_ip_len = ntohs(p->inner_ip4h.ip_len);
- p->ip4h = &p->inner_ip4h;
- }
- else
- {
- hdr6 = (ipv6::IP6RawHdr*)hdr;
-
- /* The struct Snort uses is identical to the actual IP6 struct,
- * with the exception of the IP addresses. Copy over everything but
- * the IPs*/
- memcpy(&p->inner_ip6h, hdr6, sizeof(ipv6::IP6RawHdr) - 32);
- sfip_set_raw(&p->inner_ip6h.ip_src, &hdr6->ip6_src, family);
- sfip_set_raw(&p->inner_ip6h.ip_dst, &hdr6->ip6_dst, family);
-// p->actual_ip_len = ntohs(p->inner_ip6h.len) + IP6_HDR_LEN;
- p->ip6h = &p->inner_ip6h;
- }
-#endif
-}
-
-void sfiph_orig_build(Packet *p, const void *hdr, int family)
-{
-#if 0
- ipv6::IP6RawHdr *hdr6;
- IPHdr *hdr4;
-
- if(!p || !hdr)
- return;
-
- /* If iph_api is already set, we've been here before.
- * That means this is a nested IP. */
- if (p->orig_iph_api && (p->orig_iph_api->ver == IPH_API_V4))
- memcpy(&p->outer_orig_ip4h, &p->inner_orig_ip4h, sizeof(IP4Hdr));
-
- else if (p->orig_iph_api && (p->orig_iph_api->ver == IPH_API_V6))
- memcpy(&p->outer_orig_ip6h, &p->inner_orig_ip6h, sizeof(IP6Hdr));
-
-
- _set_callbacks(p, family, CALLBACK_ICMP_ORIG);
-
- if(family == AF_INET)
- {
- hdr4 = (IPHdr*)hdr;
-
- /* The struct Snort uses is identical to the actual IP6 struct,
- * with the exception of the IP addresses. Copy over everything but
- * the IPs */
- memcpy(&p->inner_orig_ip4h, hdr4, sizeof(IPHdr) - 8);
- sfip_set_raw(&p->inner_orig_ip4h.ip_src, &hdr4->ip_src, family);
- sfip_set_raw(&p->inner_orig_ip4h.ip_dst, &hdr4->ip_dst, family);
- p->actual_ip_len = ntohs(p->inner_orig_ip4h.ip_len);
- p->orig_ip4h = &p->inner_orig_ip4h;
- }
- else
- {
- hdr6 = (ipv6::IP6RawHdr*)hdr;
-
- /* The struct Snort uses is identical to the actual IP6 struct,
- * with the exception of the IP addresses. Copy over everything but
- * the IPs*/
- memcpy(&p->inner_orig_ip6h, hdr6, sizeof(ipv6::IP6RawHdr) - 32);
- sfip_set_raw(&p->inner_orig_ip6h.ip_src, &hdr6->ip6_src, family);
- sfip_set_raw(&p->inner_orig_ip6h.ip_dst, &hdr6->ip6_dst, family);
- p->actual_ip_len = ntohs(p->inner_orig_ip6h.len) + IP6_HDR_LEN;
- p->orig_ip6h = &p->inner_orig_ip6h;
- }
- #endif
-}
-
-#ifdef TESTER
-int main()
-{
- Packet p;
- IP4Hdr i4;
- IP6Hdr i6;
-
- /* This test assumes we get an IPv4 packet and verifies
- * that the correct callbacks are setup, and they return
- * the correct values. */
-
- _set_callbacks(&p, AF_INET, CALLBACK_IP);
-
- /* Same test as above, but with IPv6 */
- _set_callbacks(&p, AF_INET6, CALLBACK_IP);
-
- return 0;
-}
-#endif
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-** Copyright (C) 2007-2013 Sourcefire, Inc.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if nto, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
-** USA
-*/
-
-#ifndef SF_IPH_H
-#define SF_IPH_H
-
-#include "sfip_t.h"
-
-struct Packet;
-
-typedef struct _IPH_API
-{
-#if 0
- sfip_t * (*iph_ret_src)(const Packet*);
- sfip_t * (*iph_ret_dst)(const Packet*);
- uint16_t (*iph_ret_tos)(const Packet*);
- uint8_t (*iph_ret_ttl)(const Packet*);
- uint16_t (*iph_ret_len)(const Packet*);
- uint32_t (*iph_ret_id)(const Packet*);
- uint8_t (*iph_ret_proto)(const Packet*);
- uint16_t (*iph_ret_off)(const Packet*);
- uint8_t (*iph_ret_ver)(const Packet*);
- uint8_t (*iph_ret_hlen)(const Packet*);
-
- sfip_t * (*orig_iph_ret_src)(const Packet*);
- sfip_t * (*orig_iph_ret_dst)(const Packet*);
- uint16_t (*orig_iph_ret_tos)(const Packet*);
- uint8_t (*orig_iph_ret_ttl)(const Packet*);
- uint16_t (*orig_iph_ret_len)(const Packet*);
- uint32_t (*orig_iph_ret_id)(const Packet*);
- uint8_t (*orig_iph_ret_proto)(const Packet*);
- uint16_t (*orig_iph_ret_off)(const Packet*);
- uint8_t (*orig_iph_ret_ver)(const Packet*);
- uint8_t (*orig_iph_ret_hlen)(const Packet*);
-#endif
- char ver;
-} IPH_API;
-
-extern IPH_API ip4;
-extern IPH_API ip6;
-
-#define IPH_API_V4 4
-#define IPH_API_V6 6
-
-#define iph_is_valid(p) ((p)->family != NO_IP)
-#define NO_IP 0
-
-void sfiph_build(Packet*, const void *hdr, int family);
-
-/* Sets the callbacks to point at the family selected by
- * * "family". "family" is either AF_INET or AF_INET6 */
-#define CALLBACK_IP 0
-#define CALLBACK_ICMP_ORIG 1
-
-void set_callbacks(Packet*, int family, char orig);
-
-#endif
* 11/17/06
*/
-#ifndef SFIP_T_H
-#define SFIP_T_H
+#ifndef SFIP_SFIP_T_H
+#define SFIP_SFIP_T_H
+#include <cstddef>
#include <stdint.h>
+#include <arpa/inet.h>
#ifndef WIN32
#include <netinet/in.h>
#include <winsock2.h>
#endif
+
/* factored out for attribute table */
struct sfip_t {
* must be the last field in this struct */
union
{
- uint8_t u6_addr8[16];
- uint16_t u6_addr16[8];
- uint32_t u6_addr32[4];
-/* uint64_t u6_addr64[2]; */
- } ip;
- #define ip8 ip.u6_addr8
- #define ip16 ip.u6_addr16
- #define ip32 ip.u6_addr32
-/* #define ip64 ip.u6_addr64 */
+ uint8_t ip8[16];
+ uint16_t ip16[8];
+ uint32_t ip32[4];
+/* uint64_t ip64[2]; */
+ };
inline bool is_ip6() const
{ return family == AF_INET6; }
inline bool is_ip4() const
{ return family == AF_INET; }
+ // the '+ 4' is the int32_t IPv4 address
+ inline std::size_t sfip_size() const
+ { return is_ip6() ? sizeof(sfip_t) : offsetof(sfip_t, ip8) + 4; }
};
-inline bool operator==(const sfip_t& lhs, const sfip_t& rhs)
+
+// because we can --- and this is leftover from Snort which we're stuck with
+#ifdef inet_ntoa
+#undef inet_ntoa
+#endif
+
+char *sfip_to_str(const sfip_t *ip);
+#define sfip_ntoa(x) sfip_to_str(x)
+#define inet_ntoa sfip_ntoa
+
+
+/*
+ * Implementing these functions rather than opeators since
+ * the Google style guide recomends staying away from
+ * operators. Most of these are a copy and paste from sf_ip.h
+ */
+static inline int sfip_is_set(const sfip_t& ip);
+static inline int sfip_is_set(const sfip_t* const ip);
+static inline bool sfip_equals(const sfip_t& lhs, const sfip_t& rhs);
+static inline bool sfip_unset_equals(const sfip_t& lhs, const sfip_t& rhs);
+static inline bool sfip_not_equals(const sfip_t& lhs, const sfip_t& rhs);
+static inline bool sfip_lesser(const sfip_t* const lhs, const sfip_t* const rhs);
+static inline bool sfip_greater(const sfip_t* const lhs, const sfip_t* const rhs);
+static inline void sfip_clear(sfip_t& x);
+static inline void sfip_copy(sfip_t& lhs, const sfip_t* const rhs);
+
+
+
+/* Returns 1 if the IP is non-zero. 0 otherwise *
+ * XXX This is a performance critical function,
+ * need to determine if it's safe to not check these pointers
+ *
+ * SNORT RELIC
+ */
+static inline int sfip_is_set(const sfip_t* const ip) {
+// ARG_CHECK1(ip, -1);
+ return ip->ip32[0] ||
+ ( (ip->family == AF_INET6) &&
+ (ip->ip32[1] ||
+ ip->ip32[2] ||
+ ip->ip32[3] || ip->bits != 128)) || ((ip->family == AF_INET) && ip->bits != 32) ;
+}
+
+static inline int sfip_is_set(const sfip_t& ip) {
+// ARG_CHECK1(ip, -1);
+ return ip.ip32[0] ||
+ ( (ip.family == AF_INET6) &&
+ (ip.ip32[1] ||
+ ip.ip32[2] ||
+ ip.ip32[3] || ip.bits != 128)) || ((ip.family == AF_INET) && ip.bits != 32) ;
+}
+
+
+
+static inline bool _is_sfip_equals(const sfip_t* const lhs, const sfip_t* const rhs)
{
- if (lhs.is_ip4())
+ if (lhs->is_ip4())
{
- return (rhs.is_ip4()) &&
- (lhs.ip.u6_addr32[0] == rhs.ip.u6_addr32[0]);
+ return (rhs->is_ip4()) &&
+ (lhs->ip32[0] == rhs->ip32[0]);
}
- else if (lhs.is_ip6())
+ else if (lhs->is_ip6())
{
- return (rhs.is_ip6()) &&
- (lhs.ip.u6_addr32[0] == rhs.ip.u6_addr32[0]) &&
- (lhs.ip.u6_addr32[1] == rhs.ip.u6_addr32[1]) &&
- (lhs.ip.u6_addr32[2] == rhs.ip.u6_addr32[2]) &&
- (lhs.ip.u6_addr32[3] == rhs.ip.u6_addr32[3]);
+ return (rhs->is_ip6()) &&
+ (lhs->ip32[0] == rhs->ip32[0]) &&
+ (lhs->ip32[1] == rhs->ip32[1]) &&
+ (lhs->ip32[2] == rhs->ip32[2]) &&
+ (lhs->ip32[3] == rhs->ip32[3]);
}
else
{
}
}
-inline bool operator!=(const sfip_t& lhs, const sfip_t& rhs)
-{ return !(lhs == rhs); }
+static inline bool _is_sfip_lesser(const sfip_t* const lhs, const sfip_t* const rhs)
+{
+ if (lhs->is_ip4())
+ {
+ return (rhs->is_ip4() &&
+ (htonl(lhs->ip32[0]) < htonl(rhs->ip32[0])));
+ }
+ else if (lhs->is_ip6())
+ {
+ return (rhs->is_ip6() &&
+ (htonl(lhs->ip32[0]) < htonl(rhs->ip32[0])) &&
+ (htonl(lhs->ip32[1]) < htonl(rhs->ip32[1])) &&
+ (htonl(lhs->ip32[2]) < htonl(rhs->ip32[2])) &&
+ (htonl(lhs->ip32[3]) < htonl(rhs->ip32[3])));
+ }
+ else
+ {
+ return false;
+ }
+}
+
+
+static inline bool sfip_equals(const sfip_t* const lhs, const sfip_t* const rhs)
+{
+ if(!sfip_is_set(lhs) || !sfip_is_set(rhs))
+ return true;
+
+ return _is_sfip_equals(lhs, rhs);
+}
+
+
+static inline bool sfip_not_equals(const sfip_t* const lhs, const sfip_t* const rhs)
+{ return !sfip_equals(lhs,rhs); }
+
+
+static inline bool sfip_unset_equals(const sfip_t* const lhs, const sfip_t* const rhs)
+{
+ if(!sfip_is_set(lhs) || !sfip_is_set(rhs))
+ return false;
+
+ return _is_sfip_equals(lhs, rhs);
+}
+
+
+static inline bool sfip_lesser(const sfip_t* const lhs, const sfip_t* const rhs)
+{
+ // I'm copying and pasting. Don't ask me why this is different then sfip_equals
+ if(!sfip_is_set(lhs) || !sfip_is_set(rhs))
+ return false;
+
+ return _is_sfip_lesser(lhs, rhs);
+}
+
+
+static inline bool sfip_greater(const sfip_t* const lhs, const sfip_t* const rhs)
+{
+ // I'm copying and pasting. Don't ask me why this is different then sfip_equals
+ if(!sfip_is_set(lhs) || !sfip_is_set(rhs))
+ return false;
+
+ return _is_sfip_lesser(rhs, lhs);
+}
+
+
+static inline void sfip_clear(sfip_t& x)
+{
+ x.family = 0;
+ x.bits = 0;
+ x.ip32[0] = 0;
+ x.ip32[1] = 0;
+ x.ip32[2] = 0;
+ x.ip32[3] = 0;
+}
+
+/*
+ * This is the former macro IP_COPY_VALUE(x, y). No need to assign
+ * specific operator since the default equals operator will
+ * correctly assign values
+ */
+static inline void sfip_copy(sfip_t& lhs, const sfip_t* const rhs)
+{ lhs = *rhs; }
#endif
COPY4(skey.ip_h, dst->ip32);
skey.port_h = dport;
}
- else if (IP_EQUALITY(iph.get_src(), iph.get_dst()))
+ else if (sfip_equals(iph.get_src(), iph.get_dst()))
{
COPY4(skey.ip_l, src->ip32);
COPY4(skey.ip_h, skey.ip_l);
void IcmpSession::update_direction(char dir, const sfip_t *ip, uint16_t)
{
- if (IP_EQUALITY(&icmp_sender_ip, ip))
+ if (sfip_equals(&icmp_sender_ip, ip))
{
if ((dir == SSN_DIR_SENDER) && (flow->s5_state.direction == SSN_DIR_SENDER))
{
return;
}
}
- else if (IP_EQUALITY(&icmp_responder_ip, ip))
+ else if (sfip_equals(&icmp_responder_ip, ip))
{
if ((dir == SSN_DIR_RESPONDER) && (flow->s5_state.direction == SSN_DIR_RESPONDER))
{
ipStats.sessions++;
- IP_COPY_VALUE(flow->client_ip, p->ip_api.get_src());
- IP_COPY_VALUE(flow->server_ip, p->ip_api.get_dst());
+ sfip_copy(flow->client_ip, p->ip_api.get_src());
+ sfip_copy(flow->server_ip, p->ip_api.get_dst());
#ifdef ENABLE_EXPECTED_IP
if ( flow_con->expected_session(flow, p))
set_ip_protocol(flow);
}
- host_entry = SFAT_LookupHostEntryByIP(IP_ARG(flow->server_ip));
+ host_entry = SFAT_LookupHostEntryByIP(&flow->server_ip);
if (host_entry)
{
set_application_protocol_id_from_host_entry(flow, host_entry, SSN_DIR_SERVER);
}
}
- host_entry = SFAT_LookupHostEntryByIP(IP_ARG(flow->client_ip));
+ host_entry = SFAT_LookupHostEntryByIP(&flow->client_ip);
if (host_entry)
{
set_ip_protocol(flow);
SFAT_UpdateApplicationProtocol(
- IP_ARG(flow->server_ip), ntohs(flow->server_port),
+ &flow->server_ip, ntohs(flow->server_port),
flow->s5_state.ipprotocol, id);
return id;
#include "flow/session.h"
#include "profiler.h"
#include "ipv6_port.h"
-#include "sf_iph.h"
#include "fpdetect.h"
#include "detection_util.h"
#include "file_api/file_api.h"
sf_base->iSessionsEstablished++;
if (perfmon_config && (perfmon_config->perf_flags & SFPERF_FLOWIP))
- UpdateFlowIPState(&sfFlow, IP_ARG(lwssn->client_ip), IP_ARG(lwssn->server_ip), SFS_STATE_TCP_ESTABLISHED);
+ UpdateFlowIPState(&sfFlow, &lwssn->client_ip, &lwssn->server_ip, SFS_STATE_TCP_ESTABLISHED);
lwssn->s5_state.session_flags |= SSNFLAG_COUNTED_ESTABLISH;
sf_base->iSessionsEstablished--;
if (perfmon_config && (perfmon_config->perf_flags & SFPERF_FLOWIP))
- UpdateFlowIPState(&sfFlow, IP_ARG(lwssn->client_ip), IP_ARG(lwssn->server_ip), SFS_STATE_TCP_CLOSED);
+ UpdateFlowIPState(&sfFlow, &lwssn->client_ip, &lwssn->server_ip, SFS_STATE_TCP_CLOSED);
}
else if (lwssn->s5_state.session_flags & SSNFLAG_COUNTED_INITIALIZE)
{
sf_base->iSessionsEstablished--;
if (perfmon_config && (perfmon_config->perf_flags & SFPERF_FLOWIP))
- UpdateFlowIPState(&sfFlow, IP_ARG(lwssn->client_ip), IP_ARG(lwssn->server_ip), SFS_STATE_TCP_CLOSED);
+ UpdateFlowIPState(&sfFlow, &lwssn->client_ip, &lwssn->server_ip, SFS_STATE_TCP_CLOSED);
}
else if (lwssn->s5_state.session_flags & SSNFLAG_COUNTED_INITIALIZE)
{
"session direction.\n"););
/* SYN packet from client */
lwssn->s5_state.direction = FROM_CLIENT;
- IP_COPY_VALUE(lwssn->client_ip, p->ip_api.get_src());
+ sfip_copy(lwssn->client_ip, p->ip_api.get_src());
lwssn->client_port = p->tcph->th_sport;
- IP_COPY_VALUE(lwssn->server_ip, p->ip_api.get_dst());
+ sfip_copy(lwssn->server_ip, p->ip_api.get_dst());
lwssn->server_port = p->tcph->th_dport;
lwssn->session_state |= STREAM5_STATE_SYN;
"Stream5 SYN|ACK PACKET, establishing lightweight"
"session direction.\n"););
lwssn->s5_state.direction = FROM_SERVER;
- IP_COPY_VALUE(lwssn->client_ip, p->ip_api.get_dst());
+ sfip_copy(lwssn->client_ip, p->ip_api.get_dst());
lwssn->client_port = p->tcph->th_dport;
- IP_COPY_VALUE(lwssn->server_ip, p->ip_api.get_src());
+ sfip_copy(lwssn->server_ip, p->ip_api.get_src());
lwssn->server_port = p->tcph->th_sport;
}
lwssn->session_state |= STREAM5_STATE_SYN_ACK;
if (p->sp > p->dp)
{
lwssn->s5_state.direction = FROM_CLIENT;
- IP_COPY_VALUE(lwssn->client_ip, p->ip_api.get_src());
+ sfip_copy(lwssn->client_ip, p->ip_api.get_src());
lwssn->client_port = p->tcph->th_sport;
- IP_COPY_VALUE(lwssn->server_ip, p->ip_api.get_dst());
+ sfip_copy(lwssn->server_ip, p->ip_api.get_dst());
lwssn->server_port = p->tcph->th_dport;
}
else
{
lwssn->s5_state.direction = FROM_SERVER;
- IP_COPY_VALUE(lwssn->client_ip, p->ip_api.get_dst());
+ sfip_copy(lwssn->client_ip, p->ip_api.get_dst());
lwssn->client_port = p->tcph->th_dport;
- IP_COPY_VALUE(lwssn->server_ip, p->ip_api.get_src());
+ sfip_copy(lwssn->server_ip, p->ip_api.get_src());
lwssn->server_port = p->tcph->th_sport;
}
lwssn->session_state |= STREAM5_STATE_MIDSTREAM;
!TCP_ISFLAGSET(p->tcph, TH_ACK))
{
lwssn->s5_state.direction = FROM_CLIENT;
- IP_COPY_VALUE(lwssn->client_ip, p->ip_api.get_src());
+ sfip_copy(lwssn->client_ip, p->ip_api.get_src());
lwssn->client_port = p->tcph->th_sport;
- IP_COPY_VALUE(lwssn->server_ip, p->ip_api.get_dst());
+ sfip_copy(lwssn->server_ip, p->ip_api.get_dst());
lwssn->server_port = p->tcph->th_dport;
lwssn->session_state = STREAM5_STATE_SYN;
lwssn->set_ttl(p, true);
else if (TCP_ISFLAGSET(p->tcph, (TH_SYN|TH_ACK)))
{
lwssn->s5_state.direction = FROM_SERVER;
- IP_COPY_VALUE(lwssn->client_ip, p->ip_api.get_dst());
+ sfip_copy(lwssn->client_ip, p->ip_api.get_dst());
lwssn->client_port = p->tcph->th_dport;
- IP_COPY_VALUE(lwssn->server_ip, p->ip_api.get_src());
+ sfip_copy(lwssn->server_ip, p->ip_api.get_src());
lwssn->server_port = p->tcph->th_sport;
lwssn->session_state = STREAM5_STATE_SYN_ACK;
lwssn->set_ttl(p, false);
/* StreamTracker is the opposite of the ip of the reassembled
* packet --> it came out the queue for the other side */
- if (IP_EQUALITY(p->ip_api.get_src(), &tcpssn->tcp_client_ip))
+ if (sfip_equals(p->ip_api.get_src(), &tcpssn->tcp_client_ip))
{
st = &tcpssn->server;
}
/* StreamTracker is the opposite of the ip of the reassembled
* packet --> it came out the queue for the other side */
- if (IP_EQUALITY(p->ip_api.get_src(), &tcpssn->tcp_client_ip))
+ if (sfip_equals(p->ip_api.get_src(), &tcpssn->tcp_client_ip))
st = &tcpssn->server;
else
st = &tcpssn->client;
Stream5AlertInfo* ai;
TcpSession *tcpssn = (TcpSession*)lwssn->session;
- if (IP_EQUALITY(p->ip_api.get_src(),&tcpssn->tcp_client_ip))
+ if (sfip_equals(p->ip_api.get_src(),&tcpssn->tcp_client_ip))
{
st = &tcpssn->server;
}
return 0;
}
- if (IP_EQUALITY(p->ip_api.get_src(), &tcpssn->tcp_client_ip))
+ if (sfip_equals(p->ip_api.get_src(), &tcpssn->tcp_client_ip))
{
st = &tcpssn->server;
}
uint32_t seq_num;
TcpSession *tcpssn = (TcpSession*)lwssn->session;
- if (IP_EQUALITY(p->ip_api.get_src(), &tcpssn->tcp_client_ip))
+ if (sfip_equals(p->ip_api.get_src(), &tcpssn->tcp_client_ip))
{
st = &tcpssn->server;
}
StreamTracker *st;
TcpSession *tcpssn = (TcpSession*)lwssn->session;
- if (IP_EQUALITY(p->ip_api.get_src(),&tcpssn->tcp_client_ip))
+ if (sfip_equals(p->ip_api.get_src(),&tcpssn->tcp_client_ip))
st = &tcpssn->server;
else
st = &tcpssn->client;
StreamTracker *st;
TcpSession *tcpssn = (TcpSession*)lwssn->session;
- if (IP_EQUALITY(p->ip_api.get_src(),&tcpssn->tcp_client_ip))
+ if (sfip_equals(p->ip_api.get_src(),&tcpssn->tcp_client_ip))
st = &tcpssn->server;
else
st = &tcpssn->client;
uint16_t tmpPort;
StreamTracker tmpTracker;
- if (IP_EQUALITY(&tcp_client_ip, ip) && (tcp_client_port == port))
+ if (sfip_equals(&tcp_client_ip, ip) && (tcp_client_port == port))
{
if ((dir == SSN_DIR_CLIENT) && (flow->s5_state.direction == SSN_DIR_CLIENT))
{
return;
}
}
- else if (IP_EQUALITY(&tcp_server_ip, ip) && (tcp_server_port == port))
+ else if (sfip_equals(&tcp_server_ip, ip) && (tcp_server_port == port))
{
if ((dir == SSN_DIR_SERVER) && (flow->s5_state.direction == SSN_DIR_SERVER))
{
AddUDPSession(&sfBase);
if (perfmon_config && (perfmon_config->perf_flags & SFPERF_FLOWIP))
- UpdateFlowIPState(&sfFlow, IP_ARG(flow->client_ip),
- IP_ARG(flow->server_ip), SFS_STATE_UDP_CREATED);
+ UpdateFlowIPState(&sfFlow, &flow->client_ip,
+ &flow->server_ip, SFS_STATE_UDP_CREATED);
flow->s5_state.direction = FROM_SENDER;
- IP_COPY_VALUE(flow->client_ip, p->ip_api.get_src());
+ sfip_copy(flow->client_ip, p->ip_api.get_src());
flow->client_port = p->udph->uh_sport;
- IP_COPY_VALUE(flow->server_ip, p->ip_api.get_dst());
+ sfip_copy(flow->server_ip, p->ip_api.get_dst());
flow->server_port = p->udph->uh_dport;
if ( flow_con->expected_flow(flow, p) )
sfip_t tmpIp;
uint16_t tmpPort;
- if (IP_EQUALITY(&udp_sender_ip, ip) && (udp_sender_port == port))
+ if (sfip_equals(&udp_sender_ip, ip) && (udp_sender_port == port))
{
if ((dir == SSN_DIR_SENDER) && (flow->s5_state.direction == SSN_DIR_SENDER))
{
return;
}
}
- else if (IP_EQUALITY(&udp_responder_ip, ip) && (udp_responder_port == port))
+ else if (sfip_equals(&udp_responder_ip, ip) && (udp_responder_port == port))
{
if ((dir == SSN_DIR_RESPONDER) && (flow->s5_state.direction == SSN_DIR_RESPONDER))
{
HostAttributeEntry *SFAT_LookupHostEntryBySrc(Packet *p)
{
- if (!p || !p->iph_api)
+ if (!p || !p->ip_api.is_valid())
return NULL;
return SFAT_LookupHostEntryByIP(p->ip_api.get_src());
HostAttributeEntry *SFAT_LookupHostEntryByDst(Packet *p)
{
- if (!p || !p->iph_api)
+ if (!p || !p->ip_api.is_valid())
return NULL;
return SFAT_LookupHostEntryByIP(p->ip_api.get_dst());
sfip_pton(p->dip, &dip);
status = SFRF_TestThreshold(
- &rfc, p->gid, p->sid, IP_ARG(sip), IP_ARG(dip), curtime, op);
+ &rfc, p->gid, p->sid, &sip, &dip, curtime, op);
if ( status >= RULE_TYPE__MAX ) status -= RULE_TYPE__MAX;
if ( rule )
{
status = sfthd_test_rule(
- dThd, (THD_NODE *)rule, IP_ARG(sip), IP_ARG(dip), curtime);
+ dThd, (THD_NODE *)rule, &sip, &dip, curtime);
}
else
{
status = sfthd_test_threshold(
- pThdObjs, pThd, p->gid, p->sid, IP_ARG(sip), IP_ARG(dip), curtime);
+ pThdObjs, pThd, p->gid, p->sid, &sip, &dip, curtime);
}
return status;
else
{
sfip_t cleared;
- IP_CLEAR(cleared);
+ sfip_clear(cleared);
filterEvent = sfthreshold_test(
potn->sigInfo.generator,
potn->sigInfo.id,
- IP_ARG(cleared), IP_ARG(cleared),
+ &cleared, &cleared,
p->pkth->ts.tv_sec);
}
else
{
sfip_t cleared;
- IP_CLEAR(cleared);
+ sfip_clear(cleared);
filterEvent = sfthreshold_test(
otn->sigInfo.generator,
otn->sigInfo.id,
- IP_ARG(cleared), IP_ARG(cleared),
+ &cleared, &cleared,
p->pkth->ts.tv_sec);
}
else
{
sfip_t cleared;
- IP_CLEAR(cleared);
+ sfip_clear(cleared);
filterEvent = sfthreshold_test(
otn->sigInfo.generator,
otn->sigInfo.id,
- IP_ARG(cleared), IP_ARG(cleared),
+ &cleared, &cleared,
p->pkth->ts.tv_sec);
}
projects / thirdparty / snort3.git / commitdiff
