fixing GTP tunneling. Fixing a couple of DAQ output statistics bugs

diff --git a/src/codecs/ip/cd_udp.cc b/src/codecs/ip/cd_udp.cc
index f1d80ffcb7118a085a537aed2e71992c63bc0a6a..dcad75382d490a85794a5eb9f612c4d8393d743b 100644 (file)
--- a/src/codecs/ip/cd_udp.cc
+++ b/src/codecs/ip/cd_udp.cc
@@ -94,10 +94,13 @@ static const RuleMap udp_rules[] =
     { 0, nullptr }
 };
 
+constexpr uint16_t GTP_U_PORT = 2152;
+constexpr uint16_t GTP_U_PORT_V0 = 3386;
+
 class UdpModule : public CodecModule
 {
 public:
-    UdpModule() : CodecModule(CD_UDP_NAME, CD_UDP_HELP, udp_params) {}
+    UdpModule() : CodecModule(CD_UDP_NAME, CD_UDP_HELP, udp_params), gtp_ports_set(false) {}
 
     const RuleMap* get_rules() const override
     { return udp_rules; }
@@ -116,12 +119,25 @@ public:
         }
         else if ( v.is("gtp_ports") )
         {
-            ConfigGTPDecoding(sc, v.get_string());
+            if ( !gtp_ports_set )
+            {
+                gtp_ports_set = true;
+                sc->gtp_ports.reset(GTP_U_PORT);
+                sc->gtp_ports.reset(GTP_U_PORT_V0);
+            }
+            v.get_bits(sc->gtp_ports);
         }
         else if ( v.is("enable_gtp") )
         {
             if ( v.get_bool() )
+            {
+                if ( !gtp_ports_set )
+                {
+                    sc->gtp_ports.set(GTP_U_PORT);
+                    sc->gtp_ports.set(GTP_U_PORT_V0);
+                }
                 sc->enable_gtp = 1;  // FIXIT-L move to existing bitfield
+            }
         }
         else
         {
@@ -130,6 +146,9 @@ public:
 
         return true;
     }
+
+private:
+    bool gtp_ports_set;
 };
 
 

diff --git a/src/main/snort.h b/src/main/snort.h
index ddc7b4b5aa70774b9a43efec695c86090cddd330..d2e96bdd32ce71c37004234e394db1f97ba9a0a2 100644 (file)
--- a/src/main/snort.h
+++ b/src/main/snort.h
@@ -521,8 +521,7 @@ static inline int ScGTPDecoding(void)
 
 static inline int ScIsGTPPort(uint16_t port)
 {
-    // FIXIT-H-J check for gtp_ports should not be necessary
-    return snort_conf->gtp_ports && snort_conf->gtp_ports[port];
+    return snort_conf->gtp_ports.test(port);
 }
 
 static inline int ScESPDecoding(void)

diff --git a/src/main/snort_config.cc b/src/main/snort_config.cc
index fdc4ef77ea85e02e6b1b044ec152cd4b0637f078..b3844f79e1b4916c21836f694e235e00a0eee458 100644 (file)
--- a/src/main/snort_config.cc
+++ b/src/main/snort_config.cc
@@ -180,6 +180,7 @@ SnortConfig * SnortConfNew(void)
     sc->num_layers = DEFAULT_LAYERMAX;
     sc->max_ip6_extensions = 0;
     sc->max_ip_layers = 0;
+    sc->gtp_ports.reset();
 
     /*user_id and group_id should be initialized to -1 by default, because
      * chown() use this later, -1 means no change to user_id/group_id*/
@@ -324,9 +325,6 @@ void SnortConfFree(SnortConfig *sc)
      if (sc->eth_dst )
         free(sc->eth_dst);
 
-    if (sc->gtp_ports)
-        free(sc->gtp_ports);
-
     if ( sc->output )
         free(sc->output);
 

diff --git a/src/main/snort_config.h b/src/main/snort_config.h
index f3e2910711729fd61e8b0281d3513491e87972cb..6f3712b0abbbf625b2450325b58b3f9183a9b946 100644 (file)
--- a/src/main/snort_config.h
+++ b/src/main/snort_config.h
@@ -35,6 +35,7 @@
 #include "utils/util.h"
 #include "protocols/packet.h"
 #include "main/thread.h"
+#include "framework/bits.h"
 
 
 #define DEFAULT_LOG_DIR "."
@@ -156,7 +157,7 @@ struct SnortConfig
 
     uint8_t enable_teredo;
     uint8_t enable_gtp;
-    char *gtp_ports;
+    PortList gtp_ports;
     uint8_t enable_esp;
 
     uint8_t num_layers;

diff --git a/src/parser/config_file.cc b/src/parser/config_file.cc
index 8287269edf5b6ef8476d55772f3bd1b0eee3b340..b1af58ae3c85e89248d365273a82f2da36056b3a 100644 (file)
--- a/src/parser/config_file.cc
+++ b/src/parser/config_file.cc
@@ -256,30 +256,6 @@ void ConfigDumpPayloadVerbose(SnortConfig *sc, const char*)
     sc->output_flags |= OUTPUT_FLAG__VERBOSE_DUMP;
 }
 
-#define GTP_U_PORT 2152
-#define GTP_U_PORT_V0 3386
-void ConfigGTPDecoding(SnortConfig *sc, const char*)
-{
-    PortObject *portObject;
-    int numberOfPorts = 0;
-
-    /*Set the ports*/
-    portObject = PortVarTableFind(get_ips_policy()->portVarTable, "GTP_PORTS");
-
-    if (portObject)
-    {
-       sc->gtp_ports = PortObjectCharPortArray(sc->gtp_ports,portObject, &numberOfPorts);
-    }
-
-    if (!sc->gtp_ports || (0 == numberOfPorts))
-    {
-        /*No ports defined, use default GTP ports*/
-        sc->gtp_ports = (char *)SnortAlloc(UINT16_MAX);
-        sc->gtp_ports[GTP_U_PORT] = 1;
-        sc->gtp_ports[GTP_U_PORT_V0] = 1;
-    }
-}
-
 void ConfigDstMac(SnortConfig* sc, const char* s)
 {
     eth_addr_t dst;

diff --git a/src/parser/config_file.h b/src/parser/config_file.h
index 58a5e1be5ba96d5c1c8eec6f03ffbcdfa29eafb9..626991efec59e6cdd533590b953c83d0fd9c749b 100644 (file)
--- a/src/parser/config_file.h
+++ b/src/parser/config_file.h
@@ -59,7 +59,6 @@ void ConfigPluginPath(SnortConfig*, const char*);
 void ConfigScriptPath(SnortConfig*, const char*);
 void ConfigDstMac(SnortConfig*, const char*);
 
-SO_PUBLIC void ConfigGTPDecoding(SnortConfig*sc, const char*args);
 void ConfigSetGid(SnortConfig*, const char*);
 void ConfigSetUid(SnortConfig*, const char*);
 void ConfigUmask(SnortConfig*, const char*);

diff --git a/src/stream/tcp/tcp_session.cc b/src/stream/tcp/tcp_session.cc
index ca4d57d8e0007cf537430316c2f8578170ec963f..3cc99b10af830cd105955d36be3db02ba106f83c 100644 (file)
--- a/src/stream/tcp/tcp_session.cc
+++ b/src/stream/tcp/tcp_session.cc
@@ -430,7 +430,7 @@ static const char* const reassembly_policy_names[] = {
     "MACOS",
     "HPUX10",
     "WINDOWS VISTA",
-    "WINDOWS 2003"
+    "WINDOWS 2003",
     "IPS"
 };
 

diff --git a/src/utils/stats.cc b/src/utils/stats.cc
index 513fea5c7c87b7de68cd6d08f110102a0d3aa25b..304451b8193ffa915ef2d6cbc6cb76548a54981f 100644 (file)
--- a/src/utils/stats.cc
+++ b/src/utils/stats.cc
@@ -198,6 +198,7 @@ const char* const verdict_names[] =
     "whitelist",
     "blacklist",
     "ignore",
+    "retry",
     "internal blacklist",
     "internal whitelist"
 };
@@ -298,8 +299,8 @@ void DropStats()
         for ( unsigned i = 0; i < MAX_DAQ_VERDICT; i++ )
             daq_verdicts.verdicts[i] = pkt_stats->verdicts[i];
 
-        daq_verdicts.internal_blacklist = pc.internal_blacklist;
-        daq_verdicts.internal_whitelist = pc.internal_whitelist;
+        daq_verdicts.internal_blacklist = gpc.internal_blacklist;
+        daq_verdicts.internal_whitelist = gpc.internal_whitelist;
 
         show_stats((PegCount*)&daq_verdicts, verdict_names, array_size(verdict_names));
     }