Merge pull request #1308 in SNORT/snort3 from raw_dlt to master

Squashed commit of the following:

commit 25919d4fcd1eda54066366047c58783dbfaf4743
Author: Michael Altizer <mialtize@cisco.com>
Date:   Mon Jul 16 13:12:20 2018 -0400

    codecs: Handle raw IP packets in Snort proper

diff --git a/src/codecs/codec_api.cc b/src/codecs/codec_api.cc
index f4fcdf7157224380f3e3d13fb8e349c604c1921c..686293fa3d16a1282a7a8f184105f43cbe8c0dec 100644 (file)
--- a/src/codecs/codec_api.cc
+++ b/src/codecs/codec_api.cc
@@ -61,6 +61,7 @@ extern const BaseApi* cd_no_next[];
 extern const BaseApi* cd_pgm[];
 extern const BaseApi* cd_pppencap[];
 extern const BaseApi* cd_pppoepkt[];
+extern const BaseApi* cd_raw[];
 extern const BaseApi* cd_routing[];
 extern const BaseApi* cd_teredo[];
 extern const BaseApi* cd_transbridge[];
@@ -102,6 +103,7 @@ void load_codecs()
     PluginManager::load_plugins(cd_pgm);
     PluginManager::load_plugins(cd_pppencap);
     PluginManager::load_plugins(cd_pppoepkt);
+    PluginManager::load_plugins(cd_raw);
     PluginManager::load_plugins(cd_routing);
     PluginManager::load_plugins(cd_teredo);
     PluginManager::load_plugins(cd_transbridge);

diff --git a/src/codecs/ip/cd_ipv4.cc b/src/codecs/ip/cd_ipv4.cc
index bc04c2c38cdf116a732e4ee10d8f616247947500..a2e9404b0022292d4600e3630dfe42a24c117f96 100644 (file)
--- a/src/codecs/ip/cd_ipv4.cc
+++ b/src/codecs/ip/cd_ipv4.cc
@@ -22,6 +22,8 @@
 #include "config.h"
 #endif
 
+#include <sfbpf_dlt.h>
+
 #include <random>
 
 #include "codecs/codec_module.h"
@@ -41,7 +43,8 @@
 using namespace snort;
 
 #define CD_IPV4_NAME "ipv4"
-#define CD_IPV4_HELP "support for Internet protocol v4"
+#define CD_IPV4_HELP_STR "support for Internet protocol v4"
+#define CD_IPV4_HELP ADD_DLT(CD_IPV4_HELP_STR, DLT_IPV4)
 
 namespace
 {
@@ -105,6 +108,7 @@ class Ipv4Codec : public Codec
 public:
     Ipv4Codec() : Codec(CD_IPV4_NAME) { }
 
+    void get_data_link_type(std::vector<int>&) override;
     void get_protocol_ids(std::vector<ProtocolId>& v) override;
     bool decode(const RawData&, CodecData&, DecodeData&) override;
     void log(TextLog* const, const uint8_t* pkt, const uint16_t len) override;
@@ -121,6 +125,11 @@ private:
 };
 }  // namespace
 
+void Ipv4Codec::get_data_link_type(std::vector<int>& v)
+{
+    v.push_back(DLT_IPV4);
+}
+
 void Ipv4Codec::get_protocol_ids(std::vector<ProtocolId>& v)
 {
     v.push_back(ProtocolId::ETHERTYPE_IPV4);

diff --git a/src/codecs/ip/cd_ipv6.cc b/src/codecs/ip/cd_ipv6.cc
index 0d3bcd142e59248c647e5273f5d3455521eaf345..95bd0b0049a8f56fed74f75e6d7257ebfe7a7bb1 100644 (file)
--- a/src/codecs/ip/cd_ipv6.cc
+++ b/src/codecs/ip/cd_ipv6.cc
@@ -22,6 +22,8 @@
 #include "config.h"
 #endif
 
+#include <sfbpf_dlt.h>
+
 #include "codecs/codec_module.h"
 #include "framework/codec.h"
 #include "log/text_log.h"
@@ -31,7 +33,8 @@
 using namespace snort;
 
 #define CD_IPV6_NAME "ipv6"
-#define CD_IPV6_HELP "support for Internet protocol v6"
+#define CD_IPV6_HELP_STR "support for Internet protocol v6"
+#define CD_IPV6_HELP ADD_DLT(CD_IPV6_HELP_STR, DLT_IPV6)
 
 namespace
 {
@@ -86,6 +89,7 @@ class Ipv6Codec : public Codec
 public:
     Ipv6Codec() : Codec(CD_IPV6_NAME) { }
 
+    void get_data_link_type(std::vector<int>&) override;
     void get_protocol_ids(std::vector<ProtocolId>& v) override;
     bool decode(const RawData&, CodecData&, DecodeData&) override;
     bool encode(const uint8_t* const raw_in, const uint16_t raw_len,
@@ -109,6 +113,11 @@ private:
  *************************   CLASS FUNCTIONS ************************
  ********************************************************************/
 
+void Ipv6Codec::get_data_link_type(std::vector<int>& v)
+{
+    v.push_back(DLT_IPV6);
+}
+
 void Ipv6Codec::get_protocol_ids(std::vector<ProtocolId>& v)
 {
     v.push_back(ProtocolId::ETHERTYPE_IPV6);

diff --git a/src/codecs/root/CMakeLists.txt b/src/codecs/root/CMakeLists.txt
index 45268d1a4b74a40cc2228f15221a444dfbbb7037..5d680993e4be9a7b37f28804c379483678550ed1 100644 (file)
--- a/src/codecs/root/CMakeLists.txt
+++ b/src/codecs/root/CMakeLists.txt
@@ -2,10 +2,11 @@
 if (STATIC_CODECS)
     set (PLUGIN_LIST
         cd_eth.cc
+        cd_raw.cc
     )
 
 else (STATIC_CODECS)
-    add_dynamic_module (cd_eth codecs cd_eth.cc)
+    add_dynamic_module (cd_eth codecs cd_eth.cc cd_raw.cc)
 
 endif (STATIC_CODECS)
 

diff --git a/src/codecs/root/cd_raw.cc b/src/codecs/root/cd_raw.cc
new file mode 100644 (file)
index 0000000..e26d27a
--- /dev/null
+++ b/src/codecs/root/cd_raw.cc
@@ -0,0 +1,105 @@
+//--------------------------------------------------------------------------
+// Copyright (C) 2018-2018 Cisco and/or its affiliates. All rights reserved.
+//
+// This program is free software; you can redistribute it and/or modify it
+// under the terms of the GNU General Public License Version 2 as published
+// by the Free Software Foundation.  You may not use, modify or distribute
+// this program under any other version of the GNU General Public License.
+//
+// This program is distributed in the hope that it will be useful, but
+// WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+// General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+//--------------------------------------------------------------------------
+// cd_raw.cc author Michael Altizer <mialtize@cisco.com>
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <sfbpf_dlt.h>
+
+#include "framework/codec.h"
+
+using namespace snort;
+
+#define CD_RAW_NAME "raw"
+#define CD_RAW_HELP_STR "support for raw IP"
+#define CD_RAW_HELP ADD_DLT(CD_RAW_HELP_STR, DLT_RAW)
+
+namespace
+{
+class RawCodec : public Codec
+{
+public:
+    RawCodec() : Codec(CD_RAW_NAME) { }
+
+    bool decode(const RawData&, CodecData&, DecodeData&) override;
+    void get_data_link_type(std::vector<int>&) override;
+};
+} // namespace
+
+bool RawCodec::decode(const RawData& raw, CodecData& data, DecodeData&)
+{
+    uint8_t ipver = (raw.data[0] & 0xf0);
+
+    if (ipver == 0x40)
+        data.next_prot_id = ProtocolId::ETHERTYPE_IPV4;
+    else if (ipver == 0x60)
+        data.next_prot_id = ProtocolId::ETHERTYPE_IPV6;
+    else
+        return false;
+
+    return true;
+}
+
+void RawCodec::get_data_link_type(std::vector<int>& v)
+{
+    v.push_back(DLT_RAW);
+}
+
+//-------------------------------------------------------------------------
+// api
+//-------------------------------------------------------------------------
+
+static Codec* ctor(Module*)
+{ return new RawCodec(); }
+
+static void dtor(Codec* cd)
+{ delete cd; }
+
+static const CodecApi raw_api =
+{
+    {
+        PT_CODEC,
+        sizeof(CodecApi),
+        CDAPI_VERSION,
+        0,
+        API_RESERVED,
+        API_OPTIONS,
+        CD_RAW_NAME,
+        CD_RAW_HELP,
+        nullptr,
+        nullptr,
+    },
+    nullptr, // pinit
+    nullptr, // pterm
+    nullptr, // tinit
+    nullptr, // tterm
+    ctor, // ctor
+    dtor, // dtor
+};
+
+#ifdef BUILDING_SO
+SO_PUBLIC const BaseApi* snort_plugins[] =
+#else
+const BaseApi* cd_raw[] =
+#endif
+{
+    &raw_api.base,
+    nullptr
+};