** along with this program; if not, write to the Free Software
** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
+// cd_esp.cc author Josh Rosenbaum <jorosenba@cisco.com>
#include "snort.h"
#include "codecs/decode_module.h"
#include "managers/packet_manager.h"
+#include <cstring>
namespace
virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *, uint16_t &p_hdr_len, int &next_prot_id);
+ Packet *, uint16_t &lyr_len, int &next_prot_id);
};
const uint32_t ESP_AUTH_DATA_LEN = 12;
const uint32_t ESP_TRAILER_LEN = 2;
-} // anonymous namespace
+struct CdPegs{
+ PegCount processed = 0;
+ PegCount discards = 0;
+};
+std::vector<const char*> peg_names =
+{
+ "NameCodec_processed",
+ "NameCodec_discards",
+};
+} // anonymous namespace
+static THREAD_LOCAL CdPegs counts;
+static CdPegs gcounts;
* Returns: void function
*/
bool EspCodec::decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *p, uint16_t &p_hdr_len, int &next_prot_id)
+ Packet *p, uint16_t &lyr_len, int &next_prot_id)
{
const uint8_t *esp_payload;
uint8_t pad_length;
if (len < (ESP_HEADER_LEN + ESP_AUTH_DATA_LEN + ESP_TRAILER_LEN))
{
/* Truncated ESP traffic. Bail out here and inspect the rest as payload. */
- DecoderEvent(p, DECODE_ESP_HEADER_TRUNC);
+ codec_events::decoder_event(p, DECODE_ESP_HEADER_TRUNC);
p->data = raw_pkt;
p->dsize = (uint16_t) len;
return false;
The mandatory algorithms for Authentication are HMAC-MD5-96 and
HMAC-SHA-1-96, so we assume a 12-byte authentication data at the end. */
- p_hdr_len = (ESP_HEADER_LEN + ESP_AUTH_DATA_LEN + ESP_TRAILER_LEN);
+ lyr_len = (ESP_HEADER_LEN + ESP_AUTH_DATA_LEN + ESP_TRAILER_LEN);
- pad_length = *(esp_payload + len - p_hdr_len);
- next_prot_id = *(esp_payload + len + 1 - p_hdr_len);
+ pad_length = *(esp_payload + len - lyr_len);
+ next_prot_id = *(esp_payload + len + 1 - lyr_len);
/* Adjust the packet length to account for the padding.
If the padding length is too big, this is probably encrypted traffic. */
if (pad_length < len)
{
- p_hdr_len += (pad_length);
+ lyr_len += (pad_length);
}
else
{
p->packet_flags |= PKT_TRUST;
p->data = esp_payload;
- p->dsize = (u_short) len - p_hdr_len;
+ p->dsize = (u_short) len - lyr_len;
next_prot_id = -1;
return true;
}
{
p->packet_flags |= PKT_TRUST;
p->data = esp_payload;
- p->dsize = (u_short) len - p_hdr_len;
+ p->dsize = (u_short) len - lyr_len;
}
return true;
static void sum()
{
-// sum_stats((PegCount*)&gdc, (PegCount*)&dc, array_size(dc_pegs));
-// memset(&dc, 0, sizeof(dc));
+ sum_stats((PegCount*)&gcounts, (PegCount*)&counts, peg_names.size());
+ memset(&counts, 0, sizeof(counts));
}
-static void stats()
+static void stats(std::vector<PegCount> g_peg_counts, std::vector<const char*> g_peg_names)
{
-// show_percent_stats((PegCount*)&gdc, dc_pegs, array_size(dc_pegs),
-// "decoder");
+ std::memcpy(&g_peg_counts, &counts, sizeof(CdPegs));
+ g_peg_names.insert(g_peg_names.end(), peg_names.begin(), peg_names.end());
}
#include "config.h"
#endif
+#include <pcap.h>
#include "codecs/decode_module.h"
#include "framework/codec.h"
#include "time/profiler.h"
#include "codecs/codec_events.h"
-
-
-#include <pcap.h>
-
-
-
namespace
{
virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *p, uint16_t &p_hdr_len, int &next_prot_id);
+ Packet *p, uint16_t &lyr_len, int &next_prot_id);
// DELETE
#include "codecs/sf_protocols.h"
};
-} // anonymous namespace
+} // namespace
//--------------------------------------------------------------------
* Returns: void function
*/
bool EthCodec::decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *p, uint16_t &p_hdr_len, int &next_prot_id)
+ Packet *p, uint16_t &lyr_len, int &next_prot_id)
{
// dc.eth++;
DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
"WARNING: Truncated eth header (%d bytes).\n", len););
- // TODO --> UNCOMMENT!!
-// DecoderEvent(p, DECODE_ETH_HDR_TRUNC);
+ codec_events::decoder_event(p, DECODE_ETH_HDR_TRUNC);
// dc.discards++;
// dc.ethdisc++;
/* lay the ethernet structure over the packet data */
p->eh = reinterpret_cast<const eth::EtherHdr *>(raw_pkt);
-// PushLayer(PROTO_ETH, p, pkt, sizeof(*p->eh));
DEBUG_WRAP(
DebugMessage(DEBUG_DECODE, "%X:%X:%X:%X:%X:%X -> %X:%X:%X:%X:%X:%X\n",
);
next_prot_id = ntohs(p->eh->ether_type);
- p_hdr_len = eth::hdr_len();
+ lyr_len = eth::hdr_len();
return true;
}
#endif
+//-------------------------------------------------------------------------
+// api
+//-------------------------------------------------------------------------
static void get_data_link_type(std::vector<int>&v)
{
-/* $Id: decode.c,v 1.285 2013-06-29 03:03:00 rcombs Exp $ */
-
/*
** Copyright (C) 2002-2013 Sourcefire, Inc.
** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
~Icmp4Codec() {};
virtual bool decode(const uint8_t* raw_packet, const uint32_t raw_len,
- Packet *p, uint16_t &p_hdr_len, int &next_prot_id);
- virtual void get_protocol_ids(std::vector<uint16_t>&);
+ Packet *p, uint16_t &lyr_len, int &next_prot_id);
// DELETE from here and below
* Returns: void function
*/
bool Icmp4Codec::decode(const uint8_t* raw_pkt, const uint32_t raw_len,
- Packet *p, uint16_t &p_hdr_len, int &next_prot_id)
+ Packet *p, uint16_t &lyr_len, int &next_prot_id)
{
if(raw_len < ICMP_HEADER_LEN)
{
DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
"WARNING: Truncated ICMP4 header (%d bytes).\n", raw_len););
- DecoderEvent(p, DECODE_ICMP4_HDR_TRUNC);
+ codec_events::decoder_event(p, DECODE_ICMP4_HDR_TRUNC);
// p->icmph = NULL;
// dc.discards++;
DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
"Truncated ICMP header(%d bytes)\n", raw_len););
- DecoderEvent(p, DECODE_ICMP_DGRAM_LT_ICMPHDR);
+ codec_events::decoder_event(p, DECODE_ICMP_DGRAM_LT_ICMPHDR);
p->icmph = NULL;
// dc.discards++;
DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
"Truncated ICMP header(%d bytes)\n", raw_len););
- DecoderEvent(p, DECODE_ICMP_DGRAM_LT_TIMESTAMPHDR);
+ codec_events::decoder_event(p, DECODE_ICMP_DGRAM_LT_TIMESTAMPHDR);
p->icmph = NULL;
// dc.discards++;
"Truncated ICMP header(%d bytes)\n", raw_len););
- DecoderEvent(p, DECODE_ICMP_DGRAM_LT_ADDRHDR);
+ codec_events::decoder_event(p, DECODE_ICMP_DGRAM_LT_ADDRHDR);
p->icmph = NULL;
// dc.discards++;
break;
default:
- DecoderEvent(p, DECODE_ICMP4_TYPE_OTHER);
+ codec_events::decoder_event(p, DECODE_ICMP4_TYPE_OTHER);
break;
}
{
p->error_flags |= PKT_ERR_CKSUM_ICMP;
DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Bad ICMP Checksum\n"););
- CodecEvents::exec_icmp_chksm_drop(p);
+ codec_events::exec_icmp_chksm_drop(p);
// dc.invalid_checksums++;
}
else
}
}
- p_hdr_len = ICMP_HEADER_LEN;
+ lyr_len = ICMP_HEADER_LEN;
p->dsize = (u_short)(raw_len - ICMP_HEADER_LEN);
p->data = raw_pkt + ICMP_HEADER_LEN;
/* setup the pkt id and seq numbers */
/* add the size of the echo ext to the data
* ptr and subtract it from the data size */
- p_hdr_len += sizeof(ICMPHdr::icmp_hun.idseq);
+ lyr_len += sizeof(ICMPHdr::icmp_hun.idseq);
break;
case icmp4::IcmpType::DEST_UNREACH:
if ((p->icmph->code == icmp4::IcmpCode::FRAG_NEEDED)
&& (ntohs(p->icmph->s_icmp_nextmtu) < 576))
{
- DecoderEvent(p, DECODE_ICMP_PATH_MTU_DOS);
+ codec_events::decoder_event(p, DECODE_ICMP_PATH_MTU_DOS);
}
/* Fall through */
case icmp4::IcmpType::TIME_EXCEEDED:
case icmp4::IcmpType::PARAMETERPROB:
/* account for extra 4 bytes in header */
- p_hdr_len += 4;
- DecodeICMPEmbeddedIP(raw_pkt + p_hdr_len, raw_len - p_hdr_len, p);
+ lyr_len += 4;
+ DecodeICMPEmbeddedIP(raw_pkt + lyr_len, raw_len - lyr_len, p);
break;
default:
/* Run a bunch of ICMP decoder rules */
- p->dsize = (u_short)(raw_len - p_hdr_len);
- p->data = raw_pkt + p_hdr_len;
+ p->dsize = (u_short)(raw_len - lyr_len);
+ p->data = raw_pkt + lyr_len;
ICMP4MiscTests(p);
p->proto_bits |= PROTO_BIT__ICMP;
return true;
}
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
/*
* Function: DecodeICMPEmbeddedIP(uint8_t *, const uint32_t, Packet *)
DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
"ICMP: IP short header (%d bytes)\n", len););
- DecoderEvent(p, DECODE_ICMP_ORIG_IP_TRUNCATED);
+ codec_events::decoder_event(p, DECODE_ICMP_ORIG_IP_TRUNCATED);
p->orig_family = NO_IP;
p->orig_iph = NULL;
"ICMP: not IPv4 datagram ([ver: 0x%x][len: 0x%x])\n",
GET_ORIG_IPH_VER(p), GET_ORIG_IPH_LEN(p)););
- DecoderEvent(p, DECODE_ICMP_ORIG_IP_VER_MISMATCH);
+ codec_events::decoder_event(p, DECODE_ICMP_ORIG_IP_VER_MISMATCH);
p->orig_family = NO_IP;
p->orig_iph = NULL;
"ICMP: IP len (%d bytes) < IP hdr len (%d bytes), packet discarded\n",
ip_len, hlen););
- DecoderEvent(p, DECODE_ICMP_ORIG_DGRAM_LT_ORIG_IP);
+ codec_events::decoder_event(p, DECODE_ICMP_ORIG_DGRAM_LT_ORIG_IP);
p->orig_family = NO_IP;
p->orig_iph = NULL;
/* Original IP payload should be 64 bits */
if (ip_len < 8)
{
- DecoderEvent(p, DECODE_ICMP_ORIG_PAYLOAD_LT_64);
+ codec_events::decoder_event(p, DECODE_ICMP_ORIG_PAYLOAD_LT_64);
return;
}
*/
else if (ntohs(GET_IPH_LEN(p)) > 576)
{
- DecoderEvent(p, DECODE_ICMP_ORIG_PAYLOAD_GT_576);
+ codec_events::decoder_event(p, DECODE_ICMP_ORIG_PAYLOAD_GT_576);
}
}
else
{
/* RFC states that only first frag will get an ICMP response */
- DecoderEvent(p, DECODE_ICMP_ORIG_IP_WITH_FRAGOFFSET);
+ codec_events::decoder_event(p, DECODE_ICMP_ORIG_IP_WITH_FRAGOFFSET);
return;
}
// check all 32 bits; all set so byte order is irrelevant ...
if ( ipv4::is_broadcast(dst) )
- DecoderEvent(p, DECODE_ICMP4_DST_BROADCAST);
+ codec_events::decoder_event(p, DECODE_ICMP4_DST_BROADCAST);
/* - don't use htonl for speed reasons -
* s_addr is always in network order */
msb_dst >>= 4;
if( ipv4::is_multicast(msb_dst) )
- DecoderEvent(p, DECODE_ICMP4_DST_MULTICAST);
+ codec_events::decoder_event(p, DECODE_ICMP4_DST_MULTICAST);
}
{
if ((p->dsize == 0) &&
(p->icmph->type == icmp4::IcmpType::ECHO))
- DecoderEvent(p, DECODE_ICMP_PING_NMAP);
+ codec_events::decoder_event(p, DECODE_ICMP_PING_NMAP);
if ((p->dsize == 0) &&
(p->icmph->s_icmp_seq == 666))
- DecoderEvent(p, DECODE_ICMP_ICMPENUM);
+ codec_events::decoder_event(p, DECODE_ICMP_ICMPENUM);
if ((p->icmph->type == icmp4::IcmpType::REDIRECT) &&
(p->icmph->code == icmp4::IcmpCode::REDIR_HOST))
- DecoderEvent(p, DECODE_ICMP_REDIRECT_HOST);
+ codec_events::decoder_event(p, DECODE_ICMP_REDIRECT_HOST);
if ((p->icmph->type == icmp4::IcmpType::REDIRECT) &&
(p->icmph->code == icmp4::IcmpCode::REDIR_NET))
- DecoderEvent(p, DECODE_ICMP_REDIRECT_NET);
+ codec_events::decoder_event(p, DECODE_ICMP_REDIRECT_NET);
if (p->icmph->type == icmp4::IcmpType::ECHOREPLY)
{
for (i = 0; i < p->ip_option_count; i++)
{
if ( ipv4::is_opt_rr(p->ip_options[i].code) )
- DecoderEvent(p, DECODE_ICMP_TRACEROUTE_IPOPTS);
+ codec_events::decoder_event(p, DECODE_ICMP_TRACEROUTE_IPOPTS);
}
}
if ((p->icmph->type == icmp4::IcmpType::SOURCE_QUENCH) &&
(p->icmph->code == icmp4::IcmpCode::SOURCE_QUENCH_CODE))
- DecoderEvent(p, DECODE_ICMP_SOURCE_QUENCH);
+ codec_events::decoder_event(p, DECODE_ICMP_SOURCE_QUENCH);
if ((p->dsize == 4) &&
(p->icmph->type == icmp4::IcmpType::ECHO) &&
(p->icmph->s_icmp_seq == 0) &&
(p->icmph->code == icmp4::IcmpCode::ECHO_CODE))
- DecoderEvent(p, DECODE_ICMP_BROADSCAN_SMURF_SCANNER);
+ codec_events::decoder_event(p, DECODE_ICMP_BROADSCAN_SMURF_SCANNER);
if ((p->icmph->type == icmp4::IcmpType::DEST_UNREACH) &&
(p->icmph->code == icmp4::IcmpCode::PKT_FILTERED))
- DecoderEvent(p, DECODE_ICMP_DST_UNREACH_ADMIN_PROHIBITED);
+ codec_events::decoder_event(p, DECODE_ICMP_DST_UNREACH_ADMIN_PROHIBITED);
if ((p->icmph->type == icmp4::IcmpType::DEST_UNREACH) &&
(p->icmph->code == icmp4::IcmpCode::PKT_FILTERED_HOST))
- DecoderEvent(p, DECODE_ICMP_DST_UNREACH_DST_HOST_PROHIBITED);
+ codec_events::decoder_event(p, DECODE_ICMP_DST_UNREACH_DST_HOST_PROHIBITED);
if ((p->icmph->type == icmp4::IcmpType::DEST_UNREACH) &&
(p->icmph->code == icmp4::IcmpCode::PKT_FILTERED_NET))
- DecoderEvent(p, DECODE_ICMP_DST_UNREACH_DST_NET_PROHIBITED);
+ codec_events::decoder_event(p, DECODE_ICMP_DST_UNREACH_DST_NET_PROHIBITED);
}
/*
}
#endif
+
+//-------------------------------------------------------------------------
+// api
+//-------------------------------------------------------------------------
+
static Codec *ctor()
{
return new Icmp4Codec();
delete cd;
}
-void Icmp4Codec::get_protocol_ids(std::vector<uint16_t> &proto_ids)
+static void get_protocol_ids(std::vector<uint16_t> &proto_ids)
{
proto_ids.push_back(IPPROTO_ICMP);
}
virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *, uint16_t &p_hdr_len, int &next_prot_id);
- virtual void get_protocol_ids(std::vector<uint16_t>&);
+ Packet *, uint16_t &lyr_len, int &next_prot_id);
// DELETE from here and below
#include "codecs/sf_protocols.h"
//--------------------------------------------------------------------
bool Icmp6Codec::decode(const uint8_t* raw_pkt, const uint32_t len,
- Packet* p, uint16_t& p_hdr_len, int&)
+ Packet* p, uint16_t &lyr_len, int&next_prot_id)
{
if(len < icmp6::hdr_min_len())
{
DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
"WARNING: Truncated ICMP6 header (%d bytes).\n", len););
- DecoderEvent(p, DECODE_ICMP6_HDR_TRUNC);
+ codec_events::decoder_event(p, DECODE_ICMP6_HDR_TRUNC);
return false;
}
{
p->error_flags |= PKT_ERR_CKSUM_ICMP;
DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Bad ICMP Checksum\n"););
- CodecEvents::exec_icmp_chksm_drop(p);
+ codec_events::exec_icmp_chksm_drop(p);
// dc.invalid_checksums++;
}
else
p->data += sizeof(ICMPHdr::icmp_hun.idseq);
if ( ipv6::is_multicast(p->ip6h->ip_dst.ip.u6_addr8[0]) )
- DecoderEvent(p, DECODE_ICMP6_DST_MULTICAST);
+ codec_events::decoder_event(p, DECODE_ICMP6_DST_MULTICAST);
}
else
{
DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
"WARNING: Truncated ICMP Echo header (%d bytes).\n", len););
- DecoderEvent(p, DECODE_ICMP_DGRAM_LT_ICMPHDR);
+ codec_events::decoder_event(p, DECODE_ICMP_DGRAM_LT_ICMPHDR);
p->icmph = NULL;
p->icmp6h = NULL;
if (ntohl(too_big->mtu) < 1280)
{
- DecoderEvent(p, DECODE_ICMPV6_TOO_BIG_BAD_MTU);
+ codec_events::decoder_event(p, DECODE_ICMPV6_TOO_BIG_BAD_MTU);
}
- p_hdr_len = icmp6::hdr_normal_len();
+ lyr_len = icmp6::hdr_normal_len();
DecodeICMPEmbeddedIP6(p->data, p->dsize, p);
}
else
DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
"WARNING: Truncated ICMP header (%d bytes).\n", len););
- DecoderEvent(p, DECODE_ICMP_DGRAM_LT_ICMPHDR);
+ codec_events::decoder_event(p, DECODE_ICMP_DGRAM_LT_ICMPHDR);
p->icmph = NULL;
p->icmp6h = NULL;
{
if (p->icmp6h->code == 2)
{
- DecoderEvent(p, DECODE_ICMPV6_UNREACHABLE_NON_RFC_2463_CODE);
+ codec_events::decoder_event(p, DECODE_ICMPV6_UNREACHABLE_NON_RFC_2463_CODE);
}
else if (p->icmp6h->code > 6)
{
- DecoderEvent(p, DECODE_ICMPV6_UNREACHABLE_NON_RFC_4443_CODE);
+ codec_events::decoder_event(p, DECODE_ICMPV6_UNREACHABLE_NON_RFC_4443_CODE);
}
}
- p_hdr_len = icmp6::hdr_normal_len();
+ lyr_len = icmp6::hdr_normal_len();
DecodeICMPEmbeddedIP6(p->data, p->dsize, p);
}
else
DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
"WARNING: Truncated ICMP header (%d bytes).\n", len););
- DecoderEvent(p, DECODE_ICMP_DGRAM_LT_ICMPHDR);
+ codec_events::decoder_event(p, DECODE_ICMP_DGRAM_LT_ICMPHDR);
p->icmph = NULL;
p->icmp6h = NULL;
ICMP6RouterAdvertisement *ra = (ICMP6RouterAdvertisement *)raw_pkt;
if (p->icmp6h->code != 0)
{
- DecoderEvent(p, DECODE_ICMPV6_ADVERT_BAD_CODE);
+ codec_events::decoder_event(p, DECODE_ICMPV6_ADVERT_BAD_CODE);
}
if (ntohl(ra->reachable_time) > 3600000)
{
- DecoderEvent(p, DECODE_ICMPV6_ADVERT_BAD_REACHABLE);
+ codec_events::decoder_event(p, DECODE_ICMPV6_ADVERT_BAD_REACHABLE);
}
- p_hdr_len = icmp6::hdr_min_len();
+ lyr_len = icmp6::hdr_min_len();
}
else
{
DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
"WARNING: Truncated ICMP header (%d bytes).\n", len););
- DecoderEvent(p, DECODE_ICMP_DGRAM_LT_ICMPHDR);
+ codec_events::decoder_event(p, DECODE_ICMP_DGRAM_LT_ICMPHDR);
p->icmph = NULL;
p->icmp6h = NULL;
ICMP6RouterSolicitation *rs = (ICMP6RouterSolicitation *)raw_pkt;
if (rs->code != 0)
{
- DecoderEvent(p, DECODE_ICMPV6_SOLICITATION_BAD_CODE);
+ codec_events::decoder_event(p, DECODE_ICMPV6_SOLICITATION_BAD_CODE);
}
if (ntohl(rs->reserved) != 0)
{
- DecoderEvent(p, DECODE_ICMPV6_SOLICITATION_BAD_RESERVED);
+ codec_events::decoder_event(p, DECODE_ICMPV6_SOLICITATION_BAD_RESERVED);
}
- p_hdr_len = icmp6::hdr_min_len();
+ lyr_len = icmp6::hdr_min_len();
}
else
{
DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
"WARNING: Truncated ICMP header (%d bytes).\n", len););
- DecoderEvent(p, DECODE_ICMP_DGRAM_LT_ICMPHDR);
+ codec_events::decoder_event(p, DECODE_ICMP_DGRAM_LT_ICMPHDR);
p->icmph = NULL;
p->icmp6h = NULL;
ICMP6NodeInfo *ni = (ICMP6NodeInfo *)raw_pkt;
if (ni->code > 2)
{
- DecoderEvent(p, DECODE_ICMPV6_NODE_INFO_BAD_CODE);
+ codec_events::decoder_event(p, DECODE_ICMPV6_NODE_INFO_BAD_CODE);
}
/* TODO: Add alert for INFO Response, code == 1 || code == 2)
* and there is data.
*/
- p_hdr_len = icmp6::hdr_min_len();
+ lyr_len = icmp6::hdr_min_len();
}
else
{
DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
"WARNING: Truncated ICMP header (%d bytes).\n", len););
- DecoderEvent(p, DECODE_ICMP_DGRAM_LT_ICMPHDR);
+ codec_events::decoder_event(p, DECODE_ICMP_DGRAM_LT_ICMPHDR);
p->icmph = NULL;
p->icmp6h = NULL;
break;
default:
- DecoderEvent(p, DECODE_ICMP6_TYPE_OTHER);
+ codec_events::decoder_event(p, DECODE_ICMP6_TYPE_OTHER);
- p_hdr_len = icmp6::hdr_min_len();
+ lyr_len = icmp6::hdr_min_len();
break;
}
p->proto_bits |= PROTO_BIT__ICMP;
p->proto_bits &= ~(PROTO_BIT__UDP | PROTO_BIT__TCP);
+ next_prot_id = -1;
return true;
}
DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
"ICMP6: IP short header (%d bytes)\n", len););
- DecoderEvent(p, DECODE_ICMP_ORIG_IP_TRUNCATED);
+ codec_events::decoder_event(p, DECODE_ICMP_ORIG_IP_TRUNCATED);
// dc.discards++;
return;
"ICMP: not IPv6 datagram ([ver: 0x%x][len: 0x%x])\n",
IPRAW_HDR_VER(hdr), len););
- DecoderEvent(p, DECODE_ICMP_ORIG_IP_VER_MISMATCH);
+ codec_events::decoder_event(p, DECODE_ICMP_ORIG_IP_VER_MISMATCH);
// dc.discards++;
return;
"ICMP6: IP6 len (%d bytes) < IP6 hdr len (%d bytes), packet discarded\n",
len, ipv6::hdr_len()););
- DecoderEvent(p, DECODE_ICMP_ORIG_DGRAM_LT_ORIG_IP);
+ codec_events::decoder_event(p, DECODE_ICMP_ORIG_DGRAM_LT_ORIG_IP);
// dc.discards++;
return;
}
-
-
-void Icmp6Codec::get_protocol_ids(std::vector<uint16_t>& v)
+static void get_protocol_ids(std::vector<uint16_t>& v)
{
v.push_back(IPPROTO_ICMPV6);
}
ctor, // ctor
dtor, // dtor
NULL,
+ get_protocol_ids,
+ NULL,
NULL
};
~Ipv4Codec(){};
virtual bool decode(const uint8_t *raw_packet, const uint32_t len,
- Packet *, uint16_t &p_hdr_len, int &next_prot_id);
-
-
- virtual void get_protocol_ids(std::vector<uint16_t>&);
+ Packet *, uint16_t &lyr_len, int &next_prot_id);
// used in random classes throughout Snort++
static void DecodeIPOptions(const uint8_t *start, uint32_t o_len, Packet *p);
-void Ipv4Codec::get_protocol_ids(std::vector<uint16_t>& v)
-{
- v.push_back(ipv4::ethertype_ip());
- v.push_back(ipv4::prot_id());
-}
//--------------------------------------------------------------------
// prot_ipv4.cc::IP4 decoder
* Returns: void function
*/
bool Ipv4Codec::decode(const uint8_t *raw_packet, const uint32_t len,
- Packet *p, uint16_t &p_hdr_len, int &next_prot_id)
+ Packet *p, uint16_t &lyr_len, int &next_prot_id)
{
uint32_t ip_len; /* length from the start of the ip hdr to the pkt end */
"WARNING: Truncated IP4 header (%d bytes).\n", len););
if ((p->packet_flags & PKT_UNSURE_ENCAP) == 0)
- DecoderEvent(p, DECODE_IP4_HDR_TRUNC);
+ codec_events::decoder_event(p, DECODE_IP4_HDR_TRUNC);
p->iph = NULL;
p->family = NO_IP;
{
if (p->encapsulated)
{
- CodecEvents::decoder_alert_encapsulated(p, DECODE_IP_MULTIPLE_ENCAPSULATION,
+ codec_events::decoder_alert_encapsulated(p, DECODE_IP_MULTIPLE_ENCAPSULATION,
raw_packet, len);
return false;
if(IP_VER((IPHdr*)raw_packet) != 4)
{
if ((p->packet_flags & PKT_UNSURE_ENCAP) == 0)
- DecoderEvent(p, DECODE_NOT_IPV4_DGRAM);
+ codec_events::decoder_event(p, DECODE_NOT_IPV4_DGRAM);
p->iph = NULL;
p->family = NO_IP;
ip_len = ntohs(p->iph->ip_len);
/* get the IP header length */
- p_hdr_len = ipv4::get_pkt_hdr_len(p->iph) << 2;
+ lyr_len = ipv4::get_pkt_hdr_len(p->iph) << 2;
/* header length sanity check */
- if(p_hdr_len < ipv4::hdr_len())
+ if(lyr_len < ipv4::hdr_len())
{
DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
- "Bogus IP header length of %i bytes\n", p_hdr_len););
+ "Bogus IP header length of %i bytes\n", lyr_len););
- DecoderEvent(p, DECODE_IPV4_INVALID_HEADER_LEN);
+ codec_events::decoder_event(p, DECODE_IPV4_INVALID_HEADER_LEN);
p->iph = NULL;
p->family = NO_IP;
" (ip.len: %lu, cap.len: %lu)\n",
ip_len - len, ip_len, len););
- DecoderEvent(p, DECODE_IPV4_DGRAM_GT_CAPLEN);
+ codec_events::decoder_event(p, DECODE_IPV4_DGRAM_GT_CAPLEN);
p->iph = NULL;
p->family = NO_IP;
}
#endif
- if(ip_len < p_hdr_len)
+ if(ip_len < lyr_len)
{
DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
"IP dgm len (%d bytes) < IP hdr "
- "len (%d bytes), packet discarded\n", ip_len, p_hdr_len););
+ "len (%d bytes), packet discarded\n", ip_len, lyr_len););
- DecoderEvent(p, DECODE_IPV4_DGRAM_LT_IPHDR);
+ codec_events::decoder_event(p, DECODE_IPV4_DGRAM_LT_IPHDR);
p->iph = NULL;
p->family = NO_IP;
* need to check them (should make this a command line/config
* option
*/
- int16_t csum = in_chksum_ip((u_short *)p->iph, p_hdr_len);
+ int16_t csum = in_chksum_ip((u_short *)p->iph, lyr_len);
if(csum)
{
p->error_flags |= PKT_ERR_CKSUM_IP;
DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Bad IP checksum\n"););
- CodecEvents::exec_ip_chksm_drop(p);
+ codec_events::exec_ip_chksm_drop(p);
// dc.invalid_checksums++;
}
#ifdef DEBUG_MSGS
}
/* test for IP options */
- p->ip_options_len = (uint16_t)(p_hdr_len - ipv4::hdr_len());
+ p->ip_options_len = (uint16_t)(lyr_len - ipv4::hdr_len());
if(p->ip_options_len > 0)
{
p->actual_ip_len = (uint16_t) ip_len;
/* set the remaining packet length */
- ip_len -= p_hdr_len;
+ ip_len -= lyr_len;
/* check for fragmented packets */
p->frag_offset = ntohs(p->iph->ip_off);
p->frag_offset &= 0x1FFF;
if ( p->df && p->frag_offset )
- DecoderEvent(p, DECODE_IP4_DF_OFFSET);
+ codec_events::decoder_event(p, DECODE_IP4_DF_OFFSET);
if ( p->frag_offset + p->actual_ip_len > IP_MAXPACKET )
- DecoderEvent(p, DECODE_IP4_LEN_OFFSET);
+ codec_events::decoder_event(p, DECODE_IP4_LEN_OFFSET);
if(p->frag_offset || p->mf)
{
if ( !ip_len)
{
- DecoderEvent(p, DECODE_ZERO_LENGTH_FRAG);
+ codec_events::decoder_event(p, DECODE_ZERO_LENGTH_FRAG);
p->frag_flag = 0;
}
else
{
/* set the packet fragment flag */
p->frag_flag = 1;
- p->ip_frag_start = raw_packet + p_hdr_len;
+ p->ip_frag_start = raw_packet + lyr_len;
p->ip_frag_len = (uint16_t)ip_len;
// dc.frags++;
}
if( p->mf && p->df )
{
- DecoderEvent(p, DECODE_BAD_FRAGBITS);
+ codec_events::decoder_event(p, DECODE_BAD_FRAGBITS);
}
/* Set some convienience pointers */
- p->ip_data = raw_packet + p_hdr_len;
+ p->ip_data = raw_packet + lyr_len;
p->ip_dsize = (u_short) ip_len;
/* See if there are any ip_proto only rules that match */
(p->iph->ip_proto == IPPROTO_UDP)))
{
DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "IP header length: %lu\n",
- (unsigned long)p_hdr_len););
+ (unsigned long)lyr_len););
next_prot_id = p->iph->ip_proto;
return true;
else
{
/* set the payload pointer and payload size */
- p->data = raw_packet + p_hdr_len;
+ p->data = raw_packet + lyr_len;
p->dsize = (u_short) ip_len;
}
case IPPROTO_SUN_ND:
case IPPROTO_PIM:
if ( Event_Enabled(DECODE_IP_BAD_PROTO) )
- DecoderEvent(p, DECODE_IP_BAD_PROTO));
+ codec_events::decoder_event(p, DECODE_IP_BAD_PROTO));
// dc.other++;
p->data = pkt;
p->dsize = (uint16_t)len;
#endif
default:
if (GET_IPH_PROTO(p) >= MIN_UNASSIGNED_IP_PROTO)
- DecoderEvent(p, DECODE_IP_UNASSIGNED_PROTO);
+ codec_events::decoder_event(p, DECODE_IP_UNASSIGNED_PROTO);
// dc.other++;
p->data = pkt;
static inline void CheckPGMVuln(Packet *p)
{
if ( pgm_nak_detect((uint8_t *)p->data, p->dsize) == PGM_NAK_VULN )
- DecoderEvent(p, DECODE_PGM_NAK_OVERFLOW);
+ codec_events::decoder_event(p, DECODE_PGM_NAK_OVERFLOW);
}
if (p->ip_options_len >= 2) {
if (*(p->ip_options_data) == 0 && *(p->ip_options_data+1) == 0)
{
- DecoderEvent(p, DECODE_IGMP_OPTIONS_DOS);
+ codec_events::decoder_event(p, DECODE_IGMP_OPTIONS_DOS);
return;
}
}
}
if (alert > 0)
- DecoderEvent(p, DECODE_IGMP_OPTIONS_DOS);
+ codec_events::decoder_event(p, DECODE_IGMP_OPTIONS_DOS);
}
}
// check all 32 bits ...
if( p->iph->ip_src.s_addr == p->iph->ip_dst.s_addr )
{
- DecoderEvent(p, DECODE_BAD_TRAFFIC_SAME_SRCDST);
+ codec_events::decoder_event(p, DECODE_BAD_TRAFFIC_SAME_SRCDST);
}
// check all 32 bits ...
if ( ipv4::is_broadcast(p->iph->ip_src.s_addr) )
- DecoderEvent(p, DECODE_IP4_SRC_BROADCAST);
+ codec_events::decoder_event(p, DECODE_IP4_SRC_BROADCAST);
if ( ipv4::is_broadcast(p->iph->ip_dst.s_addr) )
- DecoderEvent(p, DECODE_IP4_DST_BROADCAST);
+ codec_events::decoder_event(p, DECODE_IP4_DST_BROADCAST);
/* Loopback traffic - don't use htonl for speed reasons -
* s_addr is always in network order */
// check the msb ...
if ( ipv4::is_loopback(msb_src) || ipv4::is_loopback(msb_dst) )
{
- DecoderEvent(p, DECODE_BAD_TRAFFIC_LOOPBACK);
+ codec_events::decoder_event(p, DECODE_BAD_TRAFFIC_LOOPBACK);
}
// check the msb ...
if ( ipv4::is_this_net(msb_src) )
- DecoderEvent(p, DECODE_IP4_SRC_THIS_NET);
+ codec_events::decoder_event(p, DECODE_IP4_SRC_THIS_NET);
if ( ipv4::is_this_net(msb_dst) )
- DecoderEvent(p, DECODE_IP4_DST_THIS_NET);
+ codec_events::decoder_event(p, DECODE_IP4_DST_THIS_NET);
// check the 'msn' (most significant nibble) ...
msb_src >>= 4;
msb_dst >>= 4;
if ( ipv4::is_multicast(msb_src) )
- DecoderEvent(p, DECODE_IP4_SRC_MULTICAST);
+ codec_events::decoder_event(p, DECODE_IP4_SRC_MULTICAST);
if ( ipv4::is_reserved(msb_src) )
- DecoderEvent(p, DECODE_IP4_SRC_RESERVED);
+ codec_events::decoder_event(p, DECODE_IP4_SRC_RESERVED);
if ( ipv4::is_reserved(msb_dst))
- DecoderEvent(p, DECODE_IP4_DST_RESERVED);
+ codec_events::decoder_event(p, DECODE_IP4_DST_RESERVED);
}
/* If the remaining space in the option isn't a multiple of 4
bytes, alert. */
if (((length + 3) - pointer) % 4)
- DecoderEvent(p, DECODE_ICMP_DOS_ATTEMPT);
+ codec_events::decoder_event(p, DECODE_ICMP_DOS_ATTEMPT);
}
else if (ipv4::is_opt_ts(p->ip_options[i].code))
{
/* If the remaining space in the option isn't a multiple of 4
bytes, alert. */
if (((length + 3) - pointer) % 4)
- DecoderEvent(p, DECODE_ICMP_DOS_ATTEMPT);
+ codec_events::decoder_event(p, DECODE_ICMP_DOS_ATTEMPT);
/* If there is a timestamp + address, we need a multiple of 8
bytes instead. */
if ((p->ip_options[i].data[1] & 0x01) && /* address flag */
(((length + 3) - pointer) % 8))
- DecoderEvent(p, DECODE_ICMP_DOS_ATTEMPT);
+ codec_events::decoder_event(p, DECODE_ICMP_DOS_ATTEMPT);
}
}
}
*/
if(code == tcp::OPT_BADLEN)
{
- DecoderEvent(p, DECODE_IPV4OPT_BADLEN);
+ codec_events::decoder_event(p, DECODE_IPV4OPT_BADLEN);
}
else if(code == tcp::OPT_TRUNC)
{
- DecoderEvent(p, DECODE_IPV4OPT_TRUNCATED);
+ codec_events::decoder_event(p, DECODE_IPV4OPT_TRUNCATED);
}
return;
}
+//-------------------------------------------------------------------------
+// api
+//-------------------------------------------------------------------------
+
+
//-------------------------------------------------------------------------
// ip id considerations:
//
// iterate over the vector as IDs are assigned. when we wrap to the beginning,
// the vector is randomly reordered.
//-------------------------------------------------------------------------
-
static void ipv4_codec_ginit()
{
#ifndef VALGRIND_TESTING
delete cd;
}
+
+static void get_protocol_ids(std::vector<uint16_t>& v)
+{
+ v.push_back(ipv4::ethertype_ip());
+ v.push_back(ipv4::prot_id());
+}
+
static const char* name = "ipv4_decode";
static const CodecApi ipv4_api =
NULL, // tterm
ctor, // ctor
dtor, // dtor
+ NULL,
+ get_protocol_ids,
NULL, // sum
NULL // stats
};
~Ipv6Codec(){};
virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *, uint16_t &p_hdr_len, int &next_prot_id);
- virtual void get_protocol_ids(std::vector<uint16_t>&);
-
+ Packet *, uint16_t &lyr_len, int &next_prot_id);
// DELETE from here and below
#include "codecs/sf_protocols.h"
//--------------------------------------------------------------------
bool Ipv6Codec::decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *p, uint16_t &p_hdr_len, int &next_prot_id)
+ Packet *p, uint16_t &lyr_len, int &next_prot_id)
{
ipv6::IP6RawHdr *hdr;
uint32_t payload_len;
if(len < ipv6::hdr_len())
{
if ((p->packet_flags & PKT_UNSURE_ENCAP) == 0)
- DecoderEvent(p, DECODE_IPV6_TRUNCATED);
+ codec_events::decoder_event(p, DECODE_IPV6_TRUNCATED);
// Taken from prot_ipv4.cc
- DecoderEvent(p, DECODE_IPV6_TUNNELED_IPV4_TRUNCATED);
+ codec_events::decoder_event(p, DECODE_IPV6_TUNNELED_IPV4_TRUNCATED);
goto decodeipv6_fail;
}
if(!is_ip6_hdr_ver(hdr))
{
if ((p->packet_flags & PKT_UNSURE_ENCAP) == 0)
- DecoderEvent(p, DECODE_IPV6_IS_NOT);
+ codec_events::decoder_event(p, DECODE_IPV6_IS_NOT);
goto decodeipv6_fail;
}
if (p->encapsulated)
{
- CodecEvents::decoder_alert_encapsulated(p, DECODE_IP_MULTIPLE_ENCAPSULATION,
+ codec_events::decoder_alert_encapsulated(p, DECODE_IP_MULTIPLE_ENCAPSULATION,
raw_pkt, len);
goto decodeipv6_fail;
}
if (payload_len > len)
{
if ((p->packet_flags & PKT_UNSURE_ENCAP) == 0)
- DecoderEvent(p, DECODE_IPV6_DGRAM_GT_CAPLEN);
+ codec_events::decoder_event(p, DECODE_IPV6_DGRAM_GT_CAPLEN);
goto decodeipv6_fail;
}
p->ip_dsize = ntohs(p->ip6h->len);
- p_hdr_len = sizeof(*hdr);
+ lyr_len = sizeof(*hdr);
IPV6MiscTests(p);
next_prot_id = GET_IPH_PROTO(p);
- p_hdr_len = ipv6::hdr_len();
+ lyr_len = ipv6::hdr_len();
// write down ip6 header len!!
// DecodeIPV6Extensions(GET_IPH_PROTO(p), raw_pkt + ipv6::hdr_len(), ntohs(p->ip6h->len), p);
uint8_t oplen;
if (len < total_octets)
- DecoderEvent(p, DECODE_IPV6_TRUNCATED_EXT);
+ codec_events::decoder_event(p, DECODE_IPV6_TRUNCATED_EXT);
/* Skip to the options */
pkt += 2;
oplen = *(++pkt);
if ((pkt + oplen + 1) > hdr_end)
{
- DecoderEvent(p, DECODE_IPV6_BAD_OPT_LEN);
+ codec_events::decoder_event(p, DECODE_IPV6_BAD_OPT_LEN);
return -1;
}
pkt += oplen + 1;
break;
default:
- DecoderEvent(p, DECODE_IPV6_BAD_OPT_TYPE);
+ codec_events::decoder_event(p, DECODE_IPV6_BAD_OPT_TYPE);
return -1;
}
}
/* But size is an integer multiple of 8 octets, so 8 is min. */
if(len < sizeof(IP6Extension))
{
- DecoderEvent(p, DECODE_IPV6_TRUNCATED_EXT);
+ codec_events::decoder_event(p, DECODE_IPV6_TRUNCATED_EXT);
return;
}
if ( p->ip6_extension_count >= IP6_EXTMAX )
{
- DecoderEvent(p, DECODE_IP6_EXCESS_EXT_HDR);
+ codec_events::decoder_event(p, DECODE_IP6_EXCESS_EXT_HDR);
return;
}
case IPPROTO_HOPOPTS:
if (len < sizeof(IP6HopByHop))
{
- DecoderEvent(p, DECODE_IPV6_TRUNCATED_EXT);
+ codec_events::decoder_event(p, DECODE_IPV6_TRUNCATED_EXT);
return;
}
hdrlen = sizeof(IP6Extension) + (exthdr->ip6e_len << 3);
case IPPROTO_DSTOPTS:
if (len < sizeof(IP6Dest))
{
- DecoderEvent(p, DECODE_IPV6_TRUNCATED_EXT);
+ codec_events::decoder_event(p, DECODE_IPV6_TRUNCATED_EXT);
return;
}
if (exthdr->ip6e_nxt == IPPROTO_ROUTING)
{
- DecoderEvent(p, DECODE_IPV6_DSTOPTS_WITH_ROUTING);
+ codec_events::decoder_event(p, DECODE_IPV6_DSTOPTS_WITH_ROUTING);
}
hdrlen = sizeof(IP6Extension) + (exthdr->ip6e_len << 3);
case IPPROTO_ROUTING:
if (len < sizeof(IP6Route))
{
- DecoderEvent(p, DECODE_IPV6_TRUNCATED_EXT);
+ codec_events::decoder_event(p, DECODE_IPV6_TRUNCATED_EXT);
return;
}
if (rte->ip6rte_type == 0)
{
- DecoderEvent(p, DECODE_IPV6_ROUTE_ZERO);
+ codec_events::decoder_event(p, DECODE_IPV6_ROUTE_ZERO);
}
}
if (exthdr->ip6e_nxt == IPPROTO_HOPOPTS)
{
- DecoderEvent(p, DECODE_IPV6_ROUTE_AND_HOPBYHOP);
+ codec_events::decoder_event(p, DECODE_IPV6_ROUTE_AND_HOPBYHOP);
}
if (exthdr->ip6e_nxt == IPPROTO_ROUTING)
{
- DecoderEvent(p, DECODE_IPV6_TWO_ROUTE_HEADERS);
+ codec_events::decoder_event(p, DECODE_IPV6_TWO_ROUTE_HEADERS);
}
hdrlen = sizeof(IP6Extension) + (exthdr->ip6e_len << 3);
break;
if (len <= sizeof(IP6Frag))
{
if ( len < sizeof(IP6Frag) )
- DecoderEvent(p, DECODE_IPV6_TRUNCATED_EXT);
+ codec_events::decoder_event(p, DECODE_IPV6_TRUNCATED_EXT);
else
- DecoderEvent(p, DECODE_ZERO_LENGTH_FRAG);
+ codec_events::decoder_event(p, DECODE_ZERO_LENGTH_FRAG);
return;
}
else
}
else
{
- DecoderEvent(p, DECODE_IPV6_BAD_FRAG_PKT);
+ codec_events::decoder_event(p, DECODE_IPV6_BAD_FRAG_PKT);
}
if (!(p->frag_offset))
{
// check header ordering of fragged (next) header
if ( IPV6ExtensionOrder(ip6frag_hdr->ip6f_nxt) <
IPV6ExtensionOrder(IPPROTO_FRAGMENT) )
- DecoderEvent(p, DECODE_IPV6_UNORDERED_EXTENSIONS);
+ codec_events::decoder_event(p, DECODE_IPV6_UNORDERED_EXTENSIONS);
}
// check header ordering up thru frag header
CheckIPv6ExtensionOrder(p);
if(hdrlen > len)
{
- DecoderEvent(p, DECODE_IPV6_TRUNCATED_EXT);
+ codec_events::decoder_event(p, DECODE_IPV6_TRUNCATED_EXT);
return;
}
// need to decode this header, set "next" and continue
// looping.
- DecoderEvent(p, DECODE_IPV6_BAD_NEXT_HEADER);
+ codec_events::decoder_event(p, DECODE_IPV6_BAD_NEXT_HEADER);
// dc.other++;
// p->data = pkt;
!(p->ip6_extensions[i].type == IPPROTO_DSTOPTS) ||
!(i+1 == p->ip6_extension_count))
{
- DecoderEvent(p, DECODE_IPV6_UNORDERED_EXTENSIONS);
+ codec_events::decoder_event(p, DECODE_IPV6_UNORDERED_EXTENSIONS);
}
}
* is used here in the interrim. */
if( sfip_contains(&p->ip6h->ip_src, &p->ip6h->ip_dst) == SFIP_CONTAINS)
{
- DecoderEvent(p, DECODE_BAD_TRAFFIC_SAME_SRCDST);
+ codec_events::decoder_event(p, DECODE_BAD_TRAFFIC_SAME_SRCDST);
}
if(sfip_is_loopback(&p->ip6h->ip_src) || sfip_is_loopback(&p->ip6h->ip_dst))
{
- DecoderEvent(p, DECODE_BAD_TRAFFIC_LOOPBACK);
+ codec_events::decoder_event(p, DECODE_BAD_TRAFFIC_LOOPBACK);
}
/* Other decoder alerts for IPv6 addresses
Added: 5/24/10 (Snort 2.9.0) */
if (!sfip_is_set(&p->ip6h->ip_dst))
{
- DecoderEvent(p, DECODE_IPV6_DST_ZERO);
+ codec_events::decoder_event(p, DECODE_IPV6_DST_ZERO);
}
CheckIPV6Multicast(p);
if (isatap_interface_id == 0x00005EFE)
{
if (p->ip4h->ip_src.ip.u6_addr32[0] != p->ip6h->ip_src.ip.u6_addr32[3])
- DecoderEvent(p, DECODE_IPV6_ISATAP_SPOOF);
+ codec_events::decoder_event(p, DECODE_IPV6_ISATAP_SPOOF);
}
}
}
if ( ipv6::is_multicast(p->ip6h->ip_src.ip.u6_addr8[0]) )
{
- DecoderEvent(p, DECODE_IPV6_SRC_MULTICAST);
+ codec_events::decoder_event(p, DECODE_IPV6_SRC_MULTICAST);
}
if ( !ipv6::is_multicast(p->ip6h->ip_dst.ip.u6_addr8[0]))
{
break;
default:
- DecoderEvent(p, DECODE_IPV6_BAD_MULTICAST_SCOPE);
+ codec_events::decoder_event(p, DECODE_IPV6_BAD_MULTICAST_SCOPE);
}
/* Check against assigned multicast addresses. These are listed at:
(p->ip6h->ip_dst.ip.u6_addr16[4] != 0) ||
(p->ip6h->ip_dst.ip.u6_addr8[10] != 0))
{
- DecoderEvent(p, DECODE_IPV6_DST_RESERVED_MULTICAST);
+ codec_events::decoder_event(p, DECODE_IPV6_DST_RESERVED_MULTICAST);
return;
}
(p->ip6h->ip_dst.ip.u6_addr16[6] != 0))
{
- DecoderEvent(p, DECODE_IPV6_DST_RESERVED_MULTICAST);
+ codec_events::decoder_event(p, DECODE_IPV6_DST_RESERVED_MULTICAST);
}
else
{
case 0x000000FB: // mDNSv6
break;
default:
- DecoderEvent(p, DECODE_IPV6_DST_RESERVED_MULTICAST);
+ codec_events::decoder_event(p, DECODE_IPV6_DST_RESERVED_MULTICAST);
}
}
}
{
break; // Node Information Queries
}
- DecoderEvent(p, DECODE_IPV6_DST_RESERVED_MULTICAST);
+ codec_events::decoder_event(p, DECODE_IPV6_DST_RESERVED_MULTICAST);
}
}
else if (ipv6::is_multicast_scope_site(p->ip6h->ip_dst.ip.u6_addr8[1]))
case 0x00010005: // SL-MANET-ROUTERS
break;
default:
- DecoderEvent(p, DECODE_IPV6_DST_RESERVED_MULTICAST);
+ codec_events::decoder_event(p, DECODE_IPV6_DST_RESERVED_MULTICAST);
}
}
else if ((p->ip6h->ip_dst.ip.u6_addr8[1] & 0xF0) == 0)
break; // SAP Dynamic Assignments
}
- DecoderEvent(p, DECODE_IPV6_DST_RESERVED_MULTICAST);
+ codec_events::decoder_event(p, DECODE_IPV6_DST_RESERVED_MULTICAST);
}
}
else if ((p->ip6h->ip_dst.ip.u6_addr8[1] & 0xF0) == 0x30)
else
{
// Other addresses in this block are reserved.
- DecoderEvent(p, DECODE_IPV6_DST_RESERVED_MULTICAST);
+ codec_events::decoder_event(p, DECODE_IPV6_DST_RESERVED_MULTICAST);
}
}
else
{
/* Addresses not listed above are reserved. */
- DecoderEvent(p, DECODE_IPV6_DST_RESERVED_MULTICAST);
+ codec_events::decoder_event(p, DECODE_IPV6_DST_RESERVED_MULTICAST);
}
}
#endif
+//-------------------------------------------------------------------------
+// api
+//-------------------------------------------------------------------------
-void Ipv6Codec::get_protocol_ids(std::vector<uint16_t>& v)
+static void get_protocol_ids(std::vector<uint16_t>& v)
{
v.push_back(ipv6::ethertype());
v.push_back(ipv6::prot_id());
ctor, // ctor
dtor, // dtor
NULL,
+ get_protocol_ids,
+ NULL,
NULL
};
-/* $Id: decode.c,v 1.285 2013-06-29 03:03:00 rcombs Exp $ */
-
/*
** Copyright (C) 2002-2013 Sourcefire, Inc.
** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *, uint16_t &p_hdr_len, int &next_prot_id);
- virtual void get_protocol_ids(std::vector<uint16_t>&);
+ Packet *, uint16_t &lyr_len, int &next_prot_id);
// DELETE
#include "codecs/sf_protocols.h"
static void DecodeTCPOptions(const uint8_t *, uint32_t, Packet *);
-static inline void execTcpChksmDrop (void*);
static inline void TCPMiscTests(Packet *p);
static inline unsigned short in_chksum_tcp(pseudoheader *, unsigned short *, int);
* Returns: void function
*/
bool TcpCodec::decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *p, uint16_t &p_hdr_len, int &next_prot_id)
+ Packet *p, uint16_t &lyr_len, int &next_prot_id)
{
if(len < tcp::hdr_len())
{
DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
"TCP packet (len = %d) cannot contain " "20 byte header\n", len););
- DecoderEvent(p, DECODE_TCP_DGRAM_LT_TCPHDR);
+ codec_events::decoder_event(p, DECODE_TCP_DGRAM_LT_TCPHDR);
p->tcph = NULL;
// dc.discards++;
p->tcph = reinterpret_cast<TCPHdr*>(const_cast<uint8_t*>(raw_pkt));
/* multiply the payload offset value by 4 */
- p_hdr_len = TCP_OFFSET(p->tcph) << 2;
+ lyr_len = TCP_OFFSET(p->tcph) << 2;
DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "TCP th_off is %d, passed len is %lu\n",
TCP_OFFSET(p->tcph), (unsigned long)len););
- if(p_hdr_len < tcp::hdr_len())
+ if(lyr_len < tcp::hdr_len())
{
DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
- "TCP Data Offset (%d) < p_hdr_len (%d) \n",
- TCP_OFFSET(p->tcph), p_hdr_len););
+ "TCP Data Offset (%d) < lyr_len (%d) \n",
+ TCP_OFFSET(p->tcph), lyr_len););
- DecoderEvent(p, DECODE_TCP_INVALID_OFFSET);
+ codec_events::decoder_event(p, DECODE_TCP_INVALID_OFFSET);
p->tcph = NULL;
// dc.discards++;
return false;
}
- if(p_hdr_len > len)
+ if(lyr_len > len)
{
DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
"TCP Data Offset(%d) < longer than payload(%d)!\n",
TCP_OFFSET(p->tcph) << 2, len););
- DecoderEvent(p, DECODE_TCP_LARGE_OFFSET);
+ codec_events::decoder_event(p, DECODE_TCP_LARGE_OFFSET);
p->tcph = NULL;
// dc.discards++;
"0x%x versus 0x%x\n", csum,
ntohs(p->tcph->th_sum)););
- CodecEvents::exec_tcp_chksm_drop(p);
+ codec_events::exec_tcp_chksm_drop(p);
// dc.invalid_checksums++;
}
else
{
if(TCP_ISFLAGSET(p->tcph, (TH_SYN|TH_ACK|TH_RST)))
{
- DecoderEvent(p, DECODE_TCP_XMAS);
+ codec_events::decoder_event(p, DECODE_TCP_XMAS);
}
else
{
- DecoderEvent(p, DECODE_TCP_NMAP_XMAS);
+ codec_events::decoder_event(p, DECODE_TCP_NMAP_XMAS);
}
// Allowing this packet for further processing
// (in case there is a valid data inside it).
{
if( GET_IPH_ID(p) == 413 )
{
- DecoderEvent(p, DECODE_DOS_NAPTHA);
+ codec_events::decoder_event(p, DECODE_DOS_NAPTHA);
}
}
}
if( IpAddrSetContains(SynToMulticastDstIp, GET_DST_ADDR(p)) )
{
- DecoderEvent(p, DECODE_SYN_TO_MULTICAST);
+ codec_events::decoder_event(p, DECODE_SYN_TO_MULTICAST);
}
if ( (p->tcph->th_flags & TH_RST) )
- DecoderEvent(p, DECODE_TCP_SYN_RST);
+ codec_events::decoder_event(p, DECODE_TCP_SYN_RST);
if ( (p->tcph->th_flags & TH_FIN) )
- DecoderEvent(p, DECODE_TCP_SYN_FIN);
+ codec_events::decoder_event(p, DECODE_TCP_SYN_FIN);
}
else
{ // we already know there is no SYN
if ( !(p->tcph->th_flags & (TH_ACK|TH_RST)) )
- DecoderEvent(p, DECODE_TCP_NO_SYN_ACK_RST);
+ codec_events::decoder_event(p, DECODE_TCP_NO_SYN_ACK_RST);
}
if ( (p->tcph->th_flags & (TH_FIN|TH_PUSH|TH_URG)) &&
!(p->tcph->th_flags & TH_ACK) )
- DecoderEvent(p, DECODE_TCP_MUST_ACK);
+ codec_events::decoder_event(p, DECODE_TCP_MUST_ACK);
/* stuff more data into the printout data struct */
p->sp = ntohs(p->tcph->th_sport);
DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "tcp header starts at: %p\n", p->tcph););
-// PushLayer(PROTO_TCP, p, pkt, p_hdr_len);
- next_prot_id = -1;
-
/* if options are present, decode them */
- p->tcp_options_len = (uint16_t)(p_hdr_len - tcp::hdr_len());
+ p->tcp_options_len = (uint16_t)(lyr_len - tcp::hdr_len());
if(p->tcp_options_len > 0)
{
}
/* set the data pointer and size */
- p->data = (uint8_t *) (raw_pkt + p_hdr_len);
+ p->data = (uint8_t *) (raw_pkt + lyr_len);
- if(p_hdr_len < len)
+ if(lyr_len < len)
{
- p->dsize = (u_short)(len - p_hdr_len);
+ p->dsize = (u_short)(len - lyr_len);
}
else
{
if ( (p->tcph->th_flags & TH_URG) &&
(!p->dsize || ntohs(p->tcph->th_urp) > p->dsize) )
- DecoderEvent(p, DECODE_TCP_BAD_URP);
+ codec_events::decoder_event(p, DECODE_TCP_BAD_URP);
p->proto_bits |= PROTO_BIT__TCP;
((uint16_t) p->tcp_options[opt_count].data[0] > 14))
{
/* LOG INVALID WINDOWSCALE alert */
- DecoderEvent(p, DECODE_TCPOPT_WSCALE_INVALID);
+ codec_events::decoder_event(p, DECODE_TCPOPT_WSCALE_INVALID);
}
}
break;
{
if(code == tcp::OPT_BADLEN)
{
- DecoderEvent(p, DECODE_TCPOPT_BADLEN);
+ codec_events::decoder_event(p, DECODE_TCPOPT_BADLEN);
}
else if(code == tcp::OPT_TRUNC)
{
- DecoderEvent(p, DECODE_TCPOPT_TRUNCATED);
+ codec_events::decoder_event(p, DECODE_TCPOPT_TRUNCATED);
}
/* set the option count to the number of valid
if (experimental_option_found)
{
- DecoderEvent(p, DECODE_TCPOPT_EXPERIMENTAL);
+ codec_events::decoder_event(p, DECODE_TCPOPT_EXPERIMENTAL);
}
else if (obsolete_option_found)
{
- DecoderEvent(p, DECODE_TCPOPT_OBSOLETE);
+ codec_events::decoder_event(p, DECODE_TCPOPT_OBSOLETE);
}
else if (ttcp_found)
{
- DecoderEvent(p, DECODE_TCPOPT_TTCP);
+ codec_events::decoder_event(p, DECODE_TCPOPT_TTCP);
}
return;
{
if ( ((p->tcph->th_flags & TH_NORESERVED) == TH_SYN ) &&
(p->tcph->th_seq == htonl(674711609)) )
- DecoderEvent(p, DECODE_TCP_SHAFT_SYNFLOOD);
+ codec_events::decoder_event(p, DECODE_TCP_SHAFT_SYNFLOOD);
if (p->sp == 0 || p->dp == 0)
- DecoderEvent(p, DECODE_TCP_PORT_ZERO);
+ codec_events::decoder_event(p, DECODE_TCP_PORT_ZERO);
}
-
-static inline void execTcpChksmDrop (void*)
-{
- if( ScInlineMode() && ScTcpChecksumDrops() )
- {
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
- "Dropping bad packet (TCP checksum)\n"););
- Active_DropPacket();
- }
-}
-
/*
* ENCODER
*/
}
+//-------------------------------------------------------------------------
+// api
+//-------------------------------------------------------------------------
+
/*
* Static api functions. there are NOT part of the TCPCodec class,
* but provide global initializers and/or destructors to the class
-
-void TcpCodec::get_protocol_ids(std::vector<uint16_t>& v)
-{
- v.push_back(IPPROTO_TCP);
-}
-
static Codec* ctor()
{
return new TcpCodec();
delete cd;
}
-
+void get_protocol_ids(std::vector<uint16_t>& v)
+{
+ v.push_back(IPPROTO_TCP);
+}
static const char* name = "tcp_decode";
NULL, // tterm
ctor, // ctor
dtor, // dtor
+ NULL,
+ get_protocol_ids,
NULL,
NULL
};
virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *, uint16_t &p_hdr_len, int &next_prot_id);
-
- virtual void get_protocol_ids(std::vector<uint16_t>&);
+ Packet *, uint16_t &lyr_len, int &next_prot_id);
// DELETE
#include "codecs/sf_protocols.h"
bool UdpCodec::decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *p, uint16_t &p_hdr_len, int &next_prot_id)
+ Packet *p, uint16_t &lyr_len, int &next_prot_id)
{
uint16_t uhlen;
u_char fragmented_udp_flag = 0;
DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
"Truncated UDP header (%d bytes)\n", len););
- DecoderEvent(p, DECODE_UDP_DGRAM_LT_UDPHDR);
+ codec_events::decoder_event(p, DECODE_UDP_DGRAM_LT_UDPHDR);
PopUdp(p);
return false;
/* verify that the header len is a valid value */
if(uhlen < UDP_HEADER_LEN)
{
- DecoderEvent(p, DECODE_UDP_DGRAM_INVALID_LENGTH);
+ codec_events::decoder_event(p, DECODE_UDP_DGRAM_INVALID_LENGTH);
PopUdp(p);
return false;
/* make sure there are enough bytes as designated by length field */
if(uhlen > len)
{
- DecoderEvent(p, DECODE_UDP_DGRAM_SHORT_PACKET);
+ codec_events::decoder_event(p, DECODE_UDP_DGRAM_SHORT_PACKET);
PopUdp(p);
return false;
}
else if(uhlen < len)
{
- DecoderEvent(p, DECODE_UDP_DGRAM_LONG_PACKET);
+ codec_events::decoder_event(p, DECODE_UDP_DGRAM_LONG_PACKET);
PopUdp(p);
return false;
if(!p->udph->uh_chk)
{
csum = 1;
- DecoderEvent(p, DECODE_UDP_IPV6_ZERO_CHECKSUM);
+ codec_events::decoder_event(p, DECODE_UDP_IPV6_ZERO_CHECKSUM);
}
/* Don't do checksum calculation if
* 1) Fragmented
p->error_flags |= PKT_ERR_CKSUM_UDP;
DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Bad UDP Checksum\n"););
- CodecEvents::exec_udp_chksm_drop(p);
+ codec_events::exec_udp_chksm_drop(p);
// dc.invalid_checksums++;
}
else
DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "UDP header starts at: %p\n", p->udph););
- p_hdr_len = udp::header_len();
+ lyr_len = udp::header_len();
next_prot_id = -1;
// PushLayer(PROTO_UDP, p, raw_pkt, udp::header_len());
static inline void UDPMiscTests(Packet *p)
{
if (p->dsize > 4000)
- DecoderEvent(p, DECODE_UDP_LARGE_PACKET);
+ codec_events::decoder_event(p, DECODE_UDP_LARGE_PACKET);
if (p->sp == 0 || p->dp == 0)
- DecoderEvent(p, DECODE_UDP_PORT_ZERO);
+ codec_events::decoder_event(p, DECODE_UDP_PORT_ZERO);
}
/*
return (unsigned short)(~cksum);
}
+//-------------------------------------------------------------------------
+// api
+//-------------------------------------------------------------------------
-
-void UdpCodec::get_protocol_ids(std::vector<uint16_t>& v)
+static void get_protocol_ids(std::vector<uint16_t>& v)
{
v.push_back(IPPROTO_UDP);
}
ctor, // ctor
dtor, // dtor
NULL,
+ get_protocol_ids,
+ NULL,
NULL
};
+++ /dev/null
-/*
-** Copyright (C) 2002-2013 Sourcefire, Inc.
-** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-#include "cd_stats.h"
-#include "src/thread.h"
-
-namespace codec_statistics
-{
-
-static THREAD_LOCAL ProtType curr_type;
-
-
-void set_state(ProtType ct)
-{
- curr_type = ct;
-}
-
-ProtType get_state(){
- return curr_type;
-}
-
-} //namespace codec_statistics
+++ /dev/null
-/*
-** Copyright (C) 2002-2013 Sourcefire, Inc.
-** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-#ifndef CD_STATS_H
-#define CD_STATS_H
-
-namespace codec_statistics
-{
-
-enum class ProtType{
- PROT_IPV4,
- PROT_IPV6,
- PROT_IPV6_EXT,
- PROT_ICMP4,
- PROT_ICMP6,
- PROT_UDP,
- PROT_TCP,
- PROT_GRE,
-};
-
-void set_state(ProtType);
-ProtType get_state();
-
-}; // namespace codec_statistics
-
-#endif
#include "utils/stats.h"
#include "codecs/decode_module.h"
-#if 0
- // the empty bracket initializes the array to false
-//static std::array<bool, DECODE_INDEX_MAX> CodecEvents::decodeRuleEnabled() = {};
-static const uint16_t DECODE_INDEX_MAX = 0xFFFF; // == 2^16 - 1
-THREAD_LOCAL tSfActionQueue* decoderActionQ;
-THREAD_LOCAL MemPool decoderAlertMemPool;
-
-static THREAD_LOCAL PegCount bad_ttl = 0;
-
-
-
-void CodecEvents::queueDecoderEvent(
- unsigned int gid,
- unsigned int sid,
- unsigned int rev,
- unsigned int classification,
- unsigned int pri,
- const char *msg,
- void *rule_info)
-{
- MemBucket *alertBucket;
- EventNode *en;
- int ret;
-
- alertBucket = (MemBucket *)mempool_alloc(&decoderAlertMemPool);
- if(!alertBucket)
- return;
-
- en = (EventNode *)alertBucket->data;
- en->gid = gid;
- en->sid = sid;
- en->rev = rev;
- en->classification = classification;
- en->priority = pri;
- en->msg = msg;
- en->rule_info = rule_info;
-
- ret = sfActionQueueAdd( decoderActionQ, execDecoderEvent, alertBucket);
- if (ret == -1)
- {
- ErrorMessage("Could not add event to decoderActionQ\n");
- mempool_free(&decoderAlertMemPool, alertBucket);
- }
-}
-
-
-void CodecEvents::execDecoderEvent(void *data)
-{
- MemBucket *alertBucket = (MemBucket *)data;
- EventNode *en = (EventNode *)alertBucket->data;
-
- if ( ScDecoderAlerts() )
- {
- SnortEventqAdd(en->gid, en->sid, en->rev, en->classification,
- en->priority, en->msg, en->rule_info);
- }
- mempool_free(&decoderAlertMemPool, alertBucket);
-}
-
-
-
-
-void CodecEvents::DecoderOptEvent (
- Packet *p, int sid, const char *str, void_callback_f callback )
-{
- if ( p->packet_flags & PKT_REBUILT_STREAM )
- return;
-
- if ( ScLogVerbose() )
- ErrorMessage("%s\n", str);
-
- queueDecoderEvent(GENERATOR_SNORT_DECODE, sid, 1,
- DECODE_CLASS, 3, str, 0);
-
- queue_exec_drop(callback, p);
-}
-
-
-
-
-void CodecEvents::decoder_init(unsigned max)
+void codec_events::exec_udp_chksm_drop (Packet *)
{
- decoderActionQ = sfActionQueueInit(max);
-
- if (mempool_init(&decoderAlertMemPool, max, sizeof(EventNode)) != 0)
+ if( ScInlineMode() && ScUdpChecksumDrops() )
{
- FatalError("Could not initialize decoder action queue memory pool.\n");
+ DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
+ "Dropping bad packet (UDP checksum)\n"););
+ Active_DropPacket();
}
}
-void CodecEvents::decoder_term()
+void codec_events::exec_tcp_chksm_drop (Packet*)
{
- if (decoderActionQ != NULL)
+ if( ScInlineMode() && ScTcpChecksumDrops() )
{
- sfActionQueueDestroy (decoderActionQ);
- mempool_destroy (&decoderAlertMemPool);
- decoderActionQ = NULL;
- memset(&decoderAlertMemPool, 0, sizeof(decoderAlertMemPool));
+ DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
+ "Dropping bad packet (TCP checksum)\n"););
+ Active_DropPacket();
}
}
-void CodecEvents::decoder_exec()
-{
- sfActionQueueExecAll(decoderActionQ);
-}
-
-#endif
-
-
-
-
-//****************************************************************************************************88
-
-
-
-
-void CodecEvents::decoder_event (Packet *p, int sid)
+void codec_events::decoder_event(Packet *p, int sid)
{
if ( p->packet_flags & PKT_REBUILT_STREAM )
return;
SnortEventqAdd(GID_DECODE, sid);
}
-void CodecEvents::exec_tcp_chksm_drop (Packet*)
-{
- if( ScInlineMode() && ScTcpChecksumDrops() )
- {
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
- "Dropping bad packet (TCP checksum)\n"););
- Active_DropPacket();
- }
-}
-
-void CodecEvents::exec_udp_chksm_drop (Packet *)
-{
- if( ScInlineMode() && ScUdpChecksumDrops() )
- {
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
- "Dropping bad packet (UDP checksum)\n"););
- Active_DropPacket();
- }
-}
-
-
-void CodecEvents::exec_ip_chksm_drop (Packet*)
+void codec_events::exec_ip_chksm_drop (Packet*)
{
// TBD only set policy csum drop if policy inline
// and delete this inline mode check
}
}
-void CodecEvents::exec_hop_drop (Packet* p, int sid)
+void codec_events::exec_hop_drop (Packet* p, int sid)
{
if ( p->packet_flags & PKT_REBUILT_STREAM )
return;
}
}
-
-
-void CodecEvents::exec_ttl_drop (Packet *p, int sid)
+void codec_events::exec_ttl_drop (Packet *p, int sid)
{
if ( p->packet_flags & PKT_REBUILT_STREAM )
return;
}
}
-
-void CodecEvents::exec_icmp_chksm_drop (Packet*)
+void codec_events::exec_icmp_chksm_drop (Packet*)
{
if( ScInlineMode() && ScIcmpChecksumDrops() )
{
}
}
-void CodecEvents::decoder_alert_encapsulated(
+void codec_events::decoder_alert_encapsulated(
Packet *p, int sid, const uint8_t *pkt, uint32_t len)
{
- DecoderEvent(p, sid);
+ decoder_event(p, sid);
p->data = pkt;
p->dsize = (uint16_t)len;
p->greh = NULL;
}
-
-//-----------------
-
-int CodecEvents::ScNormalDrop (NormFlags nf)
+int codec_events::ScNormalDrop (NormFlags nf)
{
return !Normalize_IsEnabled(snort_conf, nf);
}
#include "network_inspectors/normalize/normalize.h"
#include "protocols/packet.h"
#include "time/profiler.h"
+#include "codecs/decode_module.h"
-// forward declarations
-typedef void (*void_callback_f)(void*);
-
-class CodecEvents
+namespace codec_events
{
-public:
- static void exec_ip_chksm_drop(Packet*);
- static void exec_udp_chksm_drop (Packet *);
- static void exec_tcp_chksm_drop (Packet*);
- static void exec_hop_drop(Packet* p, int sid);
- static void exec_ttl_drop (Packet *data, int sid);
- static void exec_icmp_chksm_drop (Packet*);
-
- static void decoder_event (Packet *p, int sid);
- static void decoder_alert_encapsulated(
- Packet *p, int sid, const uint8_t *pkt, uint32_t len);
- static void decoder_init(unsigned max);
- static void decoder_term(void);
- static void decoder_exec(void);
+ void exec_ip_chksm_drop(Packet*);
+ void exec_udp_chksm_drop (Packet *);
+ void exec_tcp_chksm_drop (Packet*);
+ void exec_hop_drop(Packet* p, int sid);
+ void exec_ttl_drop (Packet *data, int sid);
+ void exec_icmp_chksm_drop (Packet*);
- static void DecoderOptEvent (
- Packet *p, int sid, const char *str, void_callback_f );
+ void decoder_event (Packet *, int);
+ void decoder_alert_encapsulated(
+ Packet *p, int sid, const uint8_t *pkt, uint32_t len);
- static void queueDecoderEvent(
- unsigned int gid,
- unsigned int sid,
- unsigned int rev,
- unsigned int classification,
- unsigned int pri,
- const char *msg,
- void *rule_info);
+ int ScNormalDrop (NormFlags nf);
- static int ScNormalDrop (NormFlags nf);
- static void execDecoderEvent(Packet *p);
-};
+} //namespace codec_events
-static inline void DecoderEvent(Packet *p, int sid)
-{
- CodecEvents::decoder_event(p, sid);
-}
#endif
{
if ( ttl == 0 )
{
- CodecEvents::exec_ttl_drop(p, DECODE_ZERO_TTL);
+ codec_events::exec_ttl_drop(p, DECODE_ZERO_TTL);
}
else
{
- CodecEvents::exec_ttl_drop(p, DECODE_IP4_MIN_TTL);
+ codec_events::exec_ttl_drop(p, DECODE_IP4_MIN_TTL);
}
}
}
{
if ( hop_limit == 0 )
{
- CodecEvents::exec_hop_drop(p, DECODE_IP6_ZERO_HOP_LIMIT);
+ codec_events::exec_hop_drop(p, DECODE_IP6_ZERO_HOP_LIMIT);
}
else
{
- CodecEvents::exec_hop_drop(p, DECODE_IPV6_MIN_TTL);
+ codec_events::exec_hop_drop(p, DECODE_IPV6_MIN_TTL);
}
}
}
-/* $Id: decode.c,v 1.285 2013-06-29 03:03:00 rcombs Exp $ */
-
/*
** Copyright (C) 2002-2013 Sourcefire, Inc.
** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
** along with this program; if not, write to the Free Software
** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
+// cd_ah.cc author Josh Rosenbaum <jorosenba@cisco.com>
#include "framework/codec.h"
#include "codecs/codec_events.h"
#include "protocols/ipv4.h"
+#include <cstring>
namespace
{
virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *, uint16_t &p_hdr_len, int &next_prot_id);
+ Packet *, uint16_t &lyr_len, int &next_prot_id);
// DELETE from here and below
static const uint16_t AH_PROT_ID = 51; // RFC 4302
+
+struct CdPegs{
+ PegCount processed = 0;
+ PegCount discards = 0;
+};
+
+std::vector<const char*> peg_names =
+{
+ "NameCodec_processed",
+ "NameCodec_discards",
+};
+
+
} // anonymous namespace
+static THREAD_LOCAL CdPegs counts;
+static CdPegs gcounts;
+
bool AhCodec::decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *p, uint16_t &p_hdr_len, int &next_prot_id)
+ Packet *p, uint16_t &lyr_len, int &next_prot_id)
{
IP6Extension *ah = (IP6Extension *)raw_pkt;
- p_hdr_len = sizeof(*ah) + (ah->ip6e_len << 2);
+ lyr_len = sizeof(*ah) + (ah->ip6e_len << 2);
- if (p_hdr_len > len)
+ if (lyr_len > len)
{
return false;
}
static void sum()
{
-// sum_stats((PegCount*)&gdc, (PegCount*)&dc, array_size(dc_pegs));
-// memset(&dc, 0, sizeof(dc));
+ sum_stats((PegCount*)&gcounts, (PegCount*)&counts, peg_names.size());
+ memset(&counts, 0, sizeof(counts));
}
-static void stats()
+static void stats(std::vector<PegCount> g_peg_counts, std::vector<const char*> g_peg_names)
{
-// show_percent_stats((PegCount*)&gdc, dc_pegs, array_size(dc_pegs),
-// "decoder");
+ std::memcpy(&g_peg_counts, &counts, sizeof(CdPegs));
+ g_peg_names.insert(g_peg_names.end(), peg_names.begin(), peg_names.end());
}
-
-
static const char* name = "ah_codec";
-
static const CodecApi ah_api =
{
{ PT_CODEC, name, CDAPI_PLUGIN_V0, 0 },
-/* $Id: decode.c,v 1.285 2013-06-29 03:03:00 rcombs Exp $ */
-
/*
** Copyright (C) 2002-2013 Sourcefire, Inc.
** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
** along with this program; if not, write to the Free Software
** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
+// cd_vlan.cc author Josh Rosenbaum <jorosenba@cisco.com>
virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *, uint16_t &p_hdr_len, int &next_prot_id);
+ Packet *, uint16_t &lyr_len, int &next_prot_id);
// DELETE from here and below
* Returns: void function
*/
bool ArpCodec::decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *p, uint16_t &p_hdr_len, int &next_prot_id)
+ Packet *p, uint16_t &lyr_len, int &next_prot_id)
{
// dc.arp++;
if(len < sizeof(EtherARP))
{
- DecoderEvent(p, DECODE_ARP_TRUNCATED);
+ codec_events::decoder_event(p, DECODE_ARP_TRUNCATED);
// dc.discards++;
return false;
}
p->proto_bits |= PROTO_BIT__ARP;
- p_hdr_len = sizeof(*p->ah);
+ lyr_len = sizeof(*p->ah);
next_prot_id = -1;
return true;
NULL, // tterm
ctor, // ctor
dtor, // dtor
- nullptr, // get_dlt
+ NULL, // get_dlt
get_protocol_ids,
- sum, // sum
- stats // stats
+ NULL, // sum
+ NULL // stats
};
#ifdef BUILDING_SO
virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *, uint16_t &p_hdr_len, int &next_prot_id);
+ Packet *, uint16_t &lyr_len, int &next_prot_id);
virtual void get_protocol_ids(std::vector<uint16_t>&);
virtual void get_data_link_type(std::vector<int>&){};
-/* $Id: decode.c,v 1.285 2013-06-29 03:03:00 rcombs Exp $ */
-
/*
** Copyright (C) 2002-2013 Sourcefire, Inc.
** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
** along with this program; if not, write to the Free Software
** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
+// cd_esp.cc author Josh Rosenbaum <jorosenba@cisco.com>
#include "framework/codec.h"
virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *, uint16_t &p_hdr_len, int &next_prot_id);
+ Packet *, uint16_t &lyr_len, int &next_prot_id);
// DELETE from here and below
#include "codecs/sf_protocols.h"
*
*/
bool Erspan2Codec::decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *p, uint16_t &p_hdr_len, int &next_prot_id)
+ Packet *p, uint16_t &lyr_len, int &next_prot_id)
{
- p_hdr_len = sizeof(ERSpanType2Hdr);
+ lyr_len = sizeof(ERSpanType2Hdr);
uint32_t payload_len;
ERSpanType2Hdr *erSpan2Hdr = (ERSpanType2Hdr *)raw_pkt;
if (len < sizeof(ERSpanType2Hdr))
{
- CodecEvents::decoder_alert_encapsulated(p, DECODE_ERSPAN2_DGRAM_LT_HDR, raw_pkt, len);
+ codec_events::decoder_alert_encapsulated(p, DECODE_ERSPAN2_DGRAM_LT_HDR, raw_pkt, len);
return false;
}
{
/* discard packet - multiple encapsulation */
/* not sure if this is ever used but I am assuming it is not */
- CodecEvents::decoder_alert_encapsulated(p, DECODE_IP_MULTIPLE_ENCAPSULATION,
+ codec_events::decoder_alert_encapsulated(p, DECODE_IP_MULTIPLE_ENCAPSULATION,
raw_pkt, len);
return false;
}
*/
if (ERSPAN_VERSION(erSpan2Hdr) != 0x01) /* Type 2 == version 0x01 */
{
- CodecEvents::decoder_alert_encapsulated(p, DECODE_ERSPAN_HDR_VERSION_MISMATCH,
+ codec_events::decoder_alert_encapsulated(p, DECODE_ERSPAN_HDR_VERSION_MISMATCH,
raw_pkt, len);
return false;
}
dtor, // dtor
nullptr,
get_protocol_ids,
- sum, // sum
- stats // stats
+ NULL, // sum
+ NULL // stats
};
#ifdef BUILDING_SO
** along with this program; if not, write to the Free Software
** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
+// cd_erspan3.cc author Josh Rosenbaum <jorosenba@cisco.com>
virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *, uint16_t &p_hdr_len, int &next_prot_id);
+ Packet *, uint16_t &lyr_len, int &next_prot_id);
// DELETE from here and below
#include "codecs/sf_protocols.h"
*
*/
bool Erspan3Codec::decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *p, uint16_t &p_hdr_len, int &next_prot_id)
+ Packet *p, uint16_t &lyr_len, int &next_prot_id)
{
- p_hdr_len= sizeof(ERSpanType3Hdr);
+ lyr_len= sizeof(ERSpanType3Hdr);
uint32_t payload_len;
ERSpanType3Hdr *erSpan3Hdr = (ERSpanType3Hdr *)raw_pkt;
if (len < sizeof(ERSpanType3Hdr))
{
- CodecEvents::decoder_alert_encapsulated(p, DECODE_ERSPAN3_DGRAM_LT_HDR,
+ codec_events::decoder_alert_encapsulated(p, DECODE_ERSPAN3_DGRAM_LT_HDR,
raw_pkt, len);
return false;
}
{
/* discard packet - multiple encapsulation */
/* not sure if this is ever used but I am assuming it is not */
- CodecEvents::decoder_alert_encapsulated(p, DECODE_IP_MULTIPLE_ENCAPSULATION,
+ codec_events::decoder_alert_encapsulated(p, DECODE_IP_MULTIPLE_ENCAPSULATION,
raw_pkt, len);
return false;
}
*/
if (ERSPAN_VERSION(erSpan3Hdr) != 0x02) /* Type 3 == version 0x02 */
{
- CodecEvents::decoder_alert_encapsulated(p, DECODE_ERSPAN_HDR_VERSION_MISMATCH,
+ codec_events::decoder_alert_encapsulated(p, DECODE_ERSPAN_HDR_VERSION_MISMATCH,
raw_pkt, len);
return false;
}
dtor, // dtor
nullptr, // get_dlt
get_protocol_ids,
- sum, // sum
- stats // stats
+ NULL, // sum
+ NULL // stats
};
** along with this program; if not, write to the Free Software
** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
+// cd_vlan.cc author Josh Rosenbaum <jorosenba@cisco.com>
#include "framework/codec.h"
virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *, uint16_t &p_hdr_len, int &next_prot_id);
+ Packet *, uint16_t &lyr_len, int &next_prot_id);
};
} // anonymous namespace
bool EthLoopbackCodec::decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *p, uint16_t &p_hdr_len, int &next_prot_id)
+ Packet *p, uint16_t &lyr_len, int &next_prot_id)
{
DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "EthLoopback is not supported.\n"););
dtor, // dtor
nullptr, // get_dlt
get_protocol_ids,
- sum, // sum
- stats // stats
+ NULL, // sum
+ NULL // stats
};
virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *, uint16_t &p_hdr_len, int &next_prot_id);
+ Packet *, uint16_t &lyr_len, int &next_prot_id);
virtual void get_protocol_ids(std::vector<uint16_t>&);
-/* $Id: decode.c,v 1.285 2013-06-29 03:03:00 rcombs Exp $ */
-
/*
** Copyright (C) 2002-2013 Sourcefire, Inc.
** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
** along with this program; if not, write to the Free Software
** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
+// cd_gre.cc author Josh Rosenbaum <jorosenba@cisco.com>
#include "framework/codec.h"
virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *, uint16_t &p_hdr_len, int &next_prot_id);
+ Packet *, uint16_t &lyr_len, int &next_prot_id);
// DELETE from here and below
#include "codecs/sf_protocols.h"
* Notes: see RFCs 1701, 2784 and 2637
*/
bool GreCodec::decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *p, uint16_t &p_hdr_len, int &next_prot_id)
+ Packet *p, uint16_t &lyr_len, int &next_prot_id)
{
if (len < GRE_HEADER_LEN)
{
- CodecEvents::decoder_alert_encapsulated(p, DECODE_GRE_DGRAM_LT_GREHDR,
+ codec_events::decoder_alert_encapsulated(p, DECODE_GRE_DGRAM_LT_GREHDR,
raw_pkt, len);
return false;
}
{
/* discard packet - multiple GRE encapsulation */
/* not sure if this is ever used but I am assuming it is not */
- CodecEvents::decoder_alert_encapsulated(p, DECODE_IP_MULTIPLE_ENCAPSULATION,
+ codec_events::decoder_alert_encapsulated(p, DECODE_IP_MULTIPLE_ENCAPSULATION,
raw_pkt, len);
return false;
}
*/
p->greh = (GREHdr *)raw_pkt;
- p_hdr_len = GRE_HEADER_LEN;
+ lyr_len = GRE_HEADER_LEN;
switch (GRE_VERSION(p->greh))
{
/* these must not be set */
if (GRE_RECUR(p->greh) || GRE_FLAGS(p->greh))
{
- CodecEvents::decoder_alert_encapsulated(p, DECODE_GRE_INVALID_HEADER,
+ codec_events::decoder_alert_encapsulated(p, DECODE_GRE_INVALID_HEADER,
raw_pkt, len);
return false;
}
if (GRE_CHKSUM(p->greh) || GRE_ROUTE(p->greh))
- p_hdr_len += GRE_CHKSUM_LEN + GRE_OFFSET_LEN;
+ lyr_len += GRE_CHKSUM_LEN + GRE_OFFSET_LEN;
if (GRE_KEY(p->greh))
- p_hdr_len += GRE_KEY_LEN;
+ lyr_len += GRE_KEY_LEN;
if (GRE_SEQ(p->greh))
- p_hdr_len += GRE_SEQ_LEN;
+ lyr_len += GRE_SEQ_LEN;
/* if this flag is set, we need to walk through all of the
* Source Route Entries */
uint8_t sre_length;
const uint8_t *sre_ptr;
- sre_ptr = raw_pkt + p_hdr_len;
+ sre_ptr = raw_pkt + lyr_len;
while (1)
{
- p_hdr_len += GRE_SRE_HEADER_LEN;
- if (p_hdr_len > len)
+ lyr_len += GRE_SRE_HEADER_LEN;
+ if (lyr_len > len)
break;
sre_addrfamily = ntohs(*((uint16_t *)sre_ptr));
if ((sre_addrfamily == 0) && (sre_length == 0))
break;
- p_hdr_len += sre_length;
+ lyr_len += sre_length;
sre_ptr += sre_length;
}
}
if (GRE_CHKSUM(p->greh) || GRE_ROUTE(p->greh) || GRE_SSR(p->greh) ||
GRE_RECUR(p->greh) || GRE_V1_FLAGS(p->greh))
{
- CodecEvents::decoder_alert_encapsulated(p, DECODE_GRE_V1_INVALID_HEADER,
+ codec_events::decoder_alert_encapsulated(p, DECODE_GRE_V1_INVALID_HEADER,
raw_pkt, len);
return false;
}
/* protocol must be 0x880B - PPP */
if (GRE_PROTO(p->greh) != ETHERTYPE_PPP)
{
- CodecEvents::decoder_alert_encapsulated(p, DECODE_GRE_V1_INVALID_HEADER,
+ codec_events::decoder_alert_encapsulated(p, DECODE_GRE_V1_INVALID_HEADER,
raw_pkt, len);
return false;
}
/* this flag should always be present */
if (!(GRE_KEY(p->greh)))
{
- CodecEvents::decoder_alert_encapsulated(p, DECODE_GRE_V1_INVALID_HEADER,
+ codec_events::decoder_alert_encapsulated(p, DECODE_GRE_V1_INVALID_HEADER,
raw_pkt, len);
return false;
}
- p_hdr_len += GRE_KEY_LEN;
+ lyr_len += GRE_KEY_LEN;
if (GRE_SEQ(p->greh))
- p_hdr_len += GRE_SEQ_LEN;
+ lyr_len += GRE_SEQ_LEN;
if (GRE_V1_ACK(p->greh))
- p_hdr_len += GRE_V1_ACK_LEN;
+ lyr_len += GRE_V1_ACK_LEN;
break;
default:
- CodecEvents::decoder_alert_encapsulated(p, DECODE_GRE_INVALID_VERSION,
+ codec_events::decoder_alert_encapsulated(p, DECODE_GRE_INVALID_VERSION,
raw_pkt, len);
return false;
}
- if (p_hdr_len > len)
+ if (lyr_len > len)
{
- CodecEvents::decoder_alert_encapsulated(p, DECODE_GRE_DGRAM_LT_GREHDR,
+ codec_events::decoder_alert_encapsulated(p, DECODE_GRE_DGRAM_LT_GREHDR,
raw_pkt, len);
return false;
}
dtor, // dtor
nullptr,
get_protocol_ids,
- sum, // sum
- stats // stats
+ NULL, // sum
+ NULL // stats
};
#ifdef BUILDING_SO
virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *, uint16_t &p_hdr_len, int &next_prot_id);
+ Packet *, uint16_t &lyr_len, int &next_prot_id);
virtual void get_protocol_ids(std::vector<uint16_t>&);
*/
bool GtpCodec::decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *p, uint16_t &p_hdr_len, int &next_prot_id)
+ Packet *p, uint16_t &lyr_len, int &next_prot_id)
{
uint32_t header_len;
uint8_t next_hdr_type;
if (p->GTPencapsulated)
{
- CodecEvents::decoder_alert_encapsulated(p, DECODE_GTP_MULTIPLE_ENCAPSULATION,
+ codec_events::decoder_alert_encapsulated(p, DECODE_GTP_MULTIPLE_ENCAPSULATION,
raw_pkt, len);
return false;
}
case 0: /*GTP v0*/
DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "GTP v0 packets.\n"););
- p_hdr_len = gtp::v0_hdr_len();
+ lyr_len = gtp::v0_hdr_len();
/*Check header fields*/
- if (len < p_hdr_len)
+ if (len < lyr_len)
{
- DecoderEvent(p, DECODE_GTP_BAD_LEN);
+ codec_events::decoder_event(p, DECODE_GTP_BAD_LEN);
return false;
}
p->proto_bits |= PROTO_BIT__GTP;
/*Check the length field. */
- if (len != ((unsigned int)ntohs(hdr->length) + p_hdr_len))
+ if (len != ((unsigned int)ntohs(hdr->length) + lyr_len))
{
DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Calculated length %d != %d in header.\n",
- len - p_hdr_len, ntohs(hdr->length)););
- DecoderEvent(p, DECODE_GTP_BAD_LEN);
+ len - lyr_len, ntohs(hdr->length)););
+ codec_events::decoder_event(p, DECODE_GTP_BAD_LEN);
return false;
}
if (hdr->flag & 0x07)
{
- p_hdr_len = gtp::v1_hdr_len();
+ lyr_len = gtp::v1_hdr_len();
/*Check optional fields*/
- if (len < p_hdr_len)
+ if (len < lyr_len)
{
- DecoderEvent(p, DECODE_GTP_BAD_LEN);
+ codec_events::decoder_event(p, DECODE_GTP_BAD_LEN);
return false;
}
- next_hdr_type = *(raw_pkt + p_hdr_len - 1);
+ next_hdr_type = *(raw_pkt + lyr_len - 1);
/*Check extension headers*/
while (next_hdr_type)
{
uint16_t ext_hdr_len;
/*check length before reading data*/
- if (len < p_hdr_len + 4)
+ if (len < lyr_len + 4)
{
- DecoderEvent(p, DECODE_GTP_BAD_LEN);
+ codec_events::decoder_event(p, DECODE_GTP_BAD_LEN);
return false;
}
- ext_hdr_len = *(raw_pkt + p_hdr_len);
+ ext_hdr_len = *(raw_pkt + lyr_len);
if (!ext_hdr_len)
{
- DecoderEvent(p, DECODE_GTP_BAD_LEN);
+ codec_events::decoder_event(p, DECODE_GTP_BAD_LEN);
return false;
}
/*Extension header length is a unit of 4 octets*/
- p_hdr_len += ext_hdr_len * 4;
+ lyr_len += ext_hdr_len * 4;
/*check length before reading data*/
- if (len < p_hdr_len)
+ if (len < lyr_len)
{
- DecoderEvent(p, DECODE_GTP_BAD_LEN);
+ codec_events::decoder_event(p, DECODE_GTP_BAD_LEN);
return false;
}
- next_hdr_type = *(raw_pkt + p_hdr_len - 1);
+ next_hdr_type = *(raw_pkt + lyr_len - 1);
}
}
else
- p_hdr_len = gtp::min_hdr_len();
+ lyr_len = gtp::min_hdr_len();
p->proto_bits |= PROTO_BIT__GTP;
{
DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Calculated length %d != %d in header.\n",
len - gtp::min_hdr_len(), ntohs(hdr->length)););
- DecoderEvent(p, DECODE_GTP_BAD_LEN);
+ codec_events::decoder_event(p, DECODE_GTP_BAD_LEN);
return false;
}
virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *, uint16_t &p_hdr_len, int &next_prot_id);
+ Packet *, uint16_t &lyr_len, int &next_prot_id);
virtual void get_protocol_ids(std::vector<uint16_t>&);
virtual void get_data_link_type(std::vector<int>&){};
** along with this program; if not, write to the Free Software
** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
+// cd_mpls.cc author Josh Rosenbaum <jorosenba@cisco.com>
+
#include "framework/codec.h"
virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *, uint16_t &p_hdr_len, int &next_prot_id);
+ Packet *, uint16_t &lyr_len, int &next_prot_id);
// DELETE from here and below
#include "codecs/sf_protocols.h"
bool MplsCodec::decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *p, uint16_t &p_hdr_len, int &next_prot_id)
+ Packet *p, uint16_t &lyr_len, int &next_prot_id)
{
uint32_t* tmpMplsHdr;
uint32_t mpls_h;
uint32_t label;
- p_hdr_len= 0;
+ lyr_len= 0;
uint8_t exp;
uint8_t bos = 0;
{
if(stack_len < MPLS_HEADER_LEN)
{
- DecoderEvent(p, DECODE_BAD_MPLS);
+ codec_events::decoder_event(p, DECODE_BAD_MPLS);
// dc.discards++;
p->iph = NULL;
if ((ScMplsStackDepth() != -1) && (chainLen++ >= ScMplsStackDepth()))
{
- DecoderEvent(p, DECODE_MPLS_LABEL_STACK);
+ codec_events::decoder_event(p, DECODE_MPLS_LABEL_STACK);
// dc.discards++;
p->iph = NULL;
}
} /* while bos not 1, peel off more labels */
- p_hdr_len = (uint8_t*)tmpMplsHdr - raw_pkt;
+ lyr_len = (uint8_t*)tmpMplsHdr - raw_pkt;
switch (iRet)
{
||((!label)&&(ScMplsPayloadType() != MPLS_PAYLOADTYPE_IPV4)))
{
if( !label )
- DecoderEvent(p, DECODE_BAD_MPLS_LABEL0);
+ codec_events::decoder_event(p, DECODE_BAD_MPLS_LABEL0);
else
- DecoderEvent(p, DECODE_BAD_MPLS_LABEL2);
+ codec_events::decoder_event(p, DECODE_BAD_MPLS_LABEL2);
}
break;
}
* and move on to the next one.
*/
if( !label )
- DecoderEvent(p, DECODE_BAD_MPLS_LABEL0);
+ codec_events::decoder_event(p, DECODE_BAD_MPLS_LABEL0);
else
- DecoderEvent(p, DECODE_BAD_MPLS_LABEL2);
+ codec_events::decoder_event(p, DECODE_BAD_MPLS_LABEL2);
dc.discards++;
p->iph = NULL;
case 1:
if(!bos) break;
- DecoderEvent(p, DECODE_BAD_MPLS_LABEL1);
+ codec_events::decoder_event(p, DECODE_BAD_MPLS_LABEL1);
// dc.discards++;
p->iph = NULL;
break;
case 3:
- DecoderEvent(p, DECODE_BAD_MPLS_LABEL3);
+ codec_events::decoder_event(p, DECODE_BAD_MPLS_LABEL3);
// dc.discards++;
p->iph = NULL;
case 13:
case 14:
case 15:
- DecoderEvent(p, DECODE_MPLS_RESERVED_LABEL);
+ codec_events::decoder_event(p, DECODE_MPLS_RESERVED_LABEL);
break;
default:
break;
dtor, // dtor
nullptr, // get_dlt
get_protocol_ids,
- sum, // sum
- stats // stats
+ NULL, // sum
+ NULL // stats
};
#ifdef BUILDING_SO
virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *, uint16_t &p_hdr_len, int &next_prot_id);
+ Packet *, uint16_t &lyr_len, int &next_prot_id);
virtual void get_protocol_ids(std::vector<uint16_t>&);
virtual void get_data_link_type(std::vector<int>&){};
** along with this program; if not, write to the Free Software
** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
+// cd_pppencap.cc author Josh Rosenbaum <jorosenba@cisco.com>
#ifdef HAVE_CONFIG_H
virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *, uint16_t &p_hdr_len, int &next_prot_id);
+ Packet *, uint16_t &lyr_len, int &next_prot_id);
// DELETE from here and below
#include "codecs/sf_protocols.h"
* Returns: void function
*/
bool PppEncap::decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *p, uint16_t &p_hdr_len, int &next_prot_id)
+ Packet *p, uint16_t &lyr_len, int &next_prot_id)
{
static THREAD_LOCAL bool had_vj = false;
uint16_t protocol;
/* Check for protocol compression rfc1661 section 5
*
*/
- p_hdr_len = 1;
+ lyr_len = 1;
protocol = raw_pkt[0];
}
else
{
protocol = ntohs(*((uint16_t *)raw_pkt));
- p_hdr_len = 2;
+ lyr_len = 2;
}
/*
case PPP_VJ_UCOMP:
/* VJ compression modifies the protocol field. It must be set
* to tcp (only TCP packets can be VJ compressed) */
- if(len < (p_hdr_len + ipv4::hdr_len()))
+ if(len < (lyr_len + ipv4::hdr_len()))
{
if (ScLogVerbose())
ErrorMessage("PPP VJ min packet length > captured len! "
return false;
}
- ((IPHdr *)(raw_pkt + p_hdr_len))->ip_proto = IPPROTO_TCP;
+ ((IPHdr *)(raw_pkt + lyr_len))->ip_proto = IPPROTO_TCP;
/* fall through */
case PPP_IP:
dtor, // dtor
nullptr, // get_dlt
get_protocol_ids,
- sum, // sum
- stats // stats
+ NULL, // sum
+ NULL // stats
};
** along with this program; if not, write to the Free Software
** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
+// cd_pppoepkt.cc author Josh Rosenbaum <jorosenba@cisco.com>
virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *, uint16_t &p_hdr_len, int &next_prot_id);
+ Packet *, uint16_t &lyr_len, int &next_prot_id);
// DELETE from here and below
#include "codecs/sf_protocols.h"
*
*/
bool PPPoEPkt::decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *p, uint16_t &p_hdr_len, int &next_prot_id)
+ Packet *p, uint16_t &lyr_len, int &next_prot_id)
{
//PPPoE_Tag *ppppoe_tag=0;
//PPPoE_Tag tag; /* needed to avoid alignment problems */
"Captured data length < PPPoE header length! "
"(%d bytes)\n", len););
- DecoderEvent(p, DECODE_BAD_PPPOE);
+ codec_events::decoder_event(p, DECODE_BAD_PPPOE);
return false;
}
// DecodePppPktEncapsulated(pkt + PPPOE_HEADER_LEN, len - PPPOE_HEADER_LEN, p);
// TODO: Why is this specifically PppPktEncapsulated?
- p_hdr_len = PPPOE_HEADER_LEN;
+ lyr_len = PPPOE_HEADER_LEN;
next_prot_id = ntohs(p->eh->ether_type);
return true;
}
dtor, // dtor
nullptr,
get_protocol_ids,
- sum, // sum
- stats // stats
+ NULL, // sum
+ NULL // stats
};
virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *, uint16_t &p_hdr_len, int &next_prot_id);
+ Packet *, uint16_t &lyr_len, int &next_prot_id);
virtual void get_protocol_ids(std::vector<uint16_t>&);
virtual void get_data_link_type(std::vector<int>&){};
virtual ~SwipeCodec(){};
virtual bool decode(const uint8_t* raw_packet, const uint32_t raw_len,
- Packet *p, uint16_t &p_hdr_len, int &next_prot_id);
+ Packet *p, uint16_t &lyr_len, int &next_prot_id);
virtual void get_protocol_ids(std::vector<uint16_t>&);
};
} // namespace
bool SwipeCodec::decode(const uint8_t* raw_packet, const uint32_t raw_len,
- Packet *p, uint16_t &p_hdr_len, int &next_prot_id)
+ Packet *p, uint16_t &lyr_len, int &next_prot_id)
{
- CodecEvents::decoder_event(p, DECODE_IP_BAD_PROTO);
+ codec_events::decoder_event(p, DECODE_IP_BAD_PROTO);
// dc.other++;
p->data = raw_packet;
p->dsize = (uint16_t)raw_len;
- p_hdr_len = 0;
+ lyr_len = 0;
next_prot_id = -1;
return true;
}
-/* $Id: decode.c,v 1.285 2013-06-29 03:03:00 rcombs Exp $ */
-
/*
** Copyright (C) 2002-2013 Sourcefire, Inc.
** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
** along with this program; if not, write to the Free Software
** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
+// cd_teredo.cc author Josh Rosenbaum <jorosenba@cisco.com>
+
virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *, uint16_t &p_hdr_len, int &next_prot_id);
+ Packet *, uint16_t &lyr_len, int &next_prot_id);
virtual void get_protocol_ids(std::vector<uint16_t>&);
} // anonymous namespace
bool TeredoCodec::decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *p, uint16_t &p_hdr_len, int &next_prot_id)
+ Packet *p, uint16_t &lyr_len, int &next_prot_id)
{
if (len < (uint32_t)(teredo::min_indicator_auth_len() + client_id_length + auth_data_length))
return false;
- p_hdr_len = (teredo::min_indicator_auth_len() + client_id_length + auth_data_length);
+ lyr_len = (teredo::min_indicator_auth_len() + client_id_length + auth_data_length);
}
if (ntohs(*(uint16_t *)raw_pkt) == teredo::indicator_origin())
if (len < teredo::indicator_origin_len())
return false;
- p_hdr_len += teredo::indicator_origin_len();
+ lyr_len += teredo::indicator_origin_len();
}
/* If this is an IPv6 datagram, the first 4 bits will be the number 6. */
** along with this program; if not, write to the Free Software
** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
+// cd_transbridge.cc author Josh Rosenbaum <jorosenba@cisco.com>
virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *, uint16_t &p_hdr_len, int &next_prot_id);
+ Packet *, uint16_t &lyr_len, int &next_prot_id);
};
* wasn't needed since we are already deep into the packet
*/
bool TransbridgeCodec::decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *p, uint16_t &p_hdr_len, int &next_prot_id)
+ Packet *p, uint16_t &lyr_len, int &next_prot_id)
{
// dc.gre_eth++;
if(len < eth::hdr_len())
{
- CodecEvents::decoder_alert_encapsulated(p, DECODE_GRE_TRANS_DGRAM_LT_TRANSHDR,
+ codec_events::decoder_alert_encapsulated(p, DECODE_GRE_TRANS_DGRAM_LT_TRANSHDR,
raw_pkt, len);
return false;
}
*/
p->eh = (eth::EtherHdr *)raw_pkt;
- p_hdr_len = eth::hdr_len();
+ lyr_len = eth::hdr_len();
next_prot_id = ntohs(p->eh->ether_type);
return true;
dtor, // dtor
nullptr,
get_protocol_ids,
- sum, // sum
- stats // stats
+ NULL, // sum
+ NULL // stats
};
** along with this program; if not, write to the Free Software
** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
+// cd_vlan.cc author Josh Rosenbaum <jorosenba@cisco.com>
#include "codecs/decode_module.h"
#include "codecs/codec_events.h"
#include "codecs/decode.h"
+#include <cstring>
-#define LEN_VLAN_LLC_OTHER (sizeof(VlanTagHdr) + sizeof(EthLlc) + sizeof(EthLlcOther))
-
-
-const uint16_t ETHERNET_TYPE_8021Q = 0x8100;
-
-
namespace
{
virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *, uint16_t &p_hdr_len, int &next_prot_id);
+ Packet *, uint16_t &lyr_len, int &next_prot_id);
// DELETE from here and below
virtual inline PROTO_ID get_proto_id() { return PROTO_VLAN; };
};
+struct CdPegs{
+ PegCount processed = 0;
+ PegCount discards = 0;
+};
+
+std::vector<const char*> peg_names =
+{
+ "NameCodec_processed",
+ "NameCodec_discards",
+};
+
+
} // anonymous namespace
+static THREAD_LOCAL CdPegs counts;
+static CdPegs gcounts;
+static const uint16_t ETHERNET_TYPE_8021Q = 0x8100;
+
+static inline uint32_t len_vlan_llc_other()
+{
+ return (sizeof(VlanTagHdr) + sizeof(EthLlc) + sizeof(EthLlcOther));
+}
bool VlanCodec::decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *p, uint16_t &p_hdr_len, int &next_prot_id)
+ Packet *p, uint16_t &lyr_len, int &next_prot_id)
{
// dc.vlan++;
if(len < sizeof(VlanTagHdr))
{
- DecoderEvent(p, DECODE_BAD_VLAN);
+ codec_events::decoder_event(p, DECODE_BAD_VLAN);
// TBD add decoder drop event for VLAN hdr len issue
// dc.discards++;
{
if(len < sizeof(VlanTagHdr) + sizeof(EthLlc))
{
- DecoderEvent(p, DECODE_BAD_VLAN_ETHLLC);
+ codec_events::decoder_event(p, DECODE_BAD_VLAN_ETHLLC);
// dc.discards++;
p->iph = NULL;
if(p->ehllc->dsap == ETH_DSAP_IP && p->ehllc->ssap == ETH_SSAP_IP)
{
- if ( len < LEN_VLAN_LLC_OTHER )
+ if ( len < len_vlan_llc_other() )
{
- DecoderEvent(p, DECODE_BAD_VLAN_OTHER);
+ codec_events::decoder_event(p, DECODE_BAD_VLAN_OTHER);
// dc.discards++;
p->iph = NULL;
// PushLayer(PROTO_VLAN, p, pkt, sizeof(*p->vh));
- p_hdr_len = LEN_VLAN_LLC_OTHER;
+ lyr_len = len_vlan_llc_other();
next_prot_id = ntohs(p->ehllcother->proto_id);
}
}
else
{
- p_hdr_len = sizeof(VlanTagHdr);
+ lyr_len = sizeof(VlanTagHdr);
next_prot_id = ntohs(p->vh->vth_proto);
}
static void sum()
{
-// sum_stats((PegCount*)&gdc, (PegCount*)&dc, array_size(dc_pegs));
-// memset(&dc, 0, sizeof(dc));
+ sum_stats((PegCount*)&gcounts, (PegCount*)&counts, peg_names.size());
+ memset(&counts, 0, sizeof(counts));
}
-static void stats()
+static void stats(std::vector<PegCount> g_peg_counts, std::vector<const char*> g_peg_names)
{
-// show_percent_stats((PegCount*)&gdc, dc_pegs, array_size(dc_pegs),
-// "decoder");
+ std::memcpy(&g_peg_counts, &counts, sizeof(CdPegs));
+ g_peg_names.insert(g_peg_names.end(), peg_names.begin(), peg_names.end());
}
-
-static const char* name = "vlan";
-
+static const char* name = "vlan_codec";
static const CodecApi vlan_api =
{
{ PT_CODEC, name, CDAPI_PLUGIN_V0, 0 },
#include "static_include.h"
#include "prot_eap.h"
-#include "decoder_includes.h"
+#include "codecs/codec_events.h"
/*
p->eaph = (EAPHdr *) pkt;
if(len < sizeof(EAPHdr))
{
- DecoderEvent(p, DECODE_EAP_TRUNCATED,
+ codec_events::decoder_event(p, DECODE_EAP_TRUNCATED,
DECODE_EAP_TRUNCATED_STR);
dc.discards++;
#include "static_include.h"
#include "prot_eapol.h"
-#include "decoder_includes.h"
+#include "codecs/codec_events.h"
/*
dc.eapol++;
if(len < sizeof(EtherEapol))
{
- DecoderEvent(p, DECODE_EAPOL_TRUNCATED,
+ codec_events::decoder_event(p, DECODE_EAPOL_TRUNCATED,
DECODE_EAPOL_TRUNCATED_STR);
dc.discards++;
#include "config.h"
#endif
-#include "generators.h"
-#include "decode.h"
-#include "static_include.h"
#include "prot_eapolkey.h"
-#include "decoder_includes.h"
+#include "codecs/codev_events.h"
/*
p->eapolk = (EapolKey *) pkt;
if(len < sizeof(EapolKey))
{
- DecoderEvent(p, DECODE_EAPKEY_TRUNCATED,
+ codec_events::decoder_event(p, DECODE_EAPKEY_TRUNCATED,
DECODE_EAPKEY_TRUNCATED_STR);
dc.discards++;
if(cap_len < IEEE802_11_DATA_HDR_LEN + sizeof(EthLlc))
{
- DecoderEvent(p, DECODE_BAD_80211_ETHLLC,
+ codec_events::decoder_event(p, DECODE_BAD_80211_ETHLLC,
DECODE_BAD_80211_ETHLLC_STR);
PREPROC_PROFILE_END(decodePerfStats);
if(cap_len < IEEE802_11_DATA_HDR_LEN +
sizeof(EthLlc) + sizeof(EthLlcOther))
{
- DecoderEvent(p, DECODE_BAD_80211_OTHER,
+ codec_events::decoder_event(p, DECODE_BAD_80211_OTHER,
DECODE_BAD_80211_OTHER_STR);
PREPROC_PROFILE_END(decodePerfStats);
"Captured data length < Token Ring header length! "
"(%d < %d bytes)\n", cap_len, TR_HLEN););
- DecoderEvent(p, DECODE_BAD_TRH, DECODE_BAD_TRH_STR);
+ codec_events::decoder_event(p, DECODE_BAD_TRH, DECODE_BAD_TRH_STR);
PREPROC_PROFILE_END(decodePerfStats);
return;
"(%d < %d bytes)\n", cap_len,
(sizeof(Trh_hdr) + sizeof(Trh_llc))););
- DecoderEvent(p, DECODE_BAD_TR_ETHLLC, DECODE_BAD_TR_ETHLLC_STR);
+ codec_events::decoder_event(p, DECODE_BAD_TR_ETHLLC, DECODE_BAD_TR_ETHLLC_STR);
PREPROC_PROFILE_END(decodePerfStats);
return;
"(%d < %d bytes)\n", cap_len,
(sizeof(Trh_hdr) + sizeof(Trh_llc) + sizeof(Trh_mr))););
- DecoderEvent(p, DECODE_BAD_TRHMR, DECODE_BAD_TRHMR_STR);
+ codec_events::decoder_event(p, DECODE_BAD_TRHMR, DECODE_BAD_TRHMR_STR);
PREPROC_PROFILE_END(decodePerfStats);
return;
"(%d < %d bytes)\n", cap_len,
(sizeof(Trh_hdr) + sizeof(Trh_llc) + sizeof(Trh_mr))););
- DecoderEvent(p, DECODE_BAD_TR_MR_LEN, DECODE_BAD_TR_MR_LEN_STR);
+ codec_events::decoder_event(p, DECODE_BAD_TR_MR_LEN, DECODE_BAD_TR_MR_LEN_STR);
PREPROC_PROFILE_END(decodePerfStats);
return;
-/* $Id: decode.c,v 1.285 2013-06-29 03:03:00 rcombs Exp $ */
-
/*
** Copyright (C) 2002-2013 Sourcefire, Inc.
** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *, uint16_t &p_hdr_len, int &next_prot_id);
+ Packet *, uint16_t &lyr_len, int &next_prot_id);
virtual void get_protocol_ids(std::vector<uint16_t>&);
virtual void get_data_link_type(std::vector<int>&){};
};
-} // anonymous namespace
+
+struct CdPegs{
+ PegCount processed = 0;
+ PegCount discards = 0;
+};
+
+std::vector<const char*> peg_names =
+{
+ "NameCodec_processed",
+ "NameCodec_discards",
+};
+
+} // namespace
+
+static THREAD_LOCAL CdPegs counts;
+static CdPegs gcounts;
+
bool NameCodec::decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *p, uint16_t &p_hdr_len, int &next_prot_id)
+ Packet *p, uint16_t &lyr_len, int &next_prot_id)
{
}
-void NameCodec::get_data_link_type(std::vector<int>&){};
+//-------------------------------------------------------------------------
+// api
+//-------------------------------------------------------------------------
+
+
+void NameCodec::get_data_link_type(std::vector<int>&)
+{
+// v.push_back(DLT_ID);
+}
void NameCodec::get_protocol_ids(std::vector<uint16_t>& v)
{
- v.push_back(ipv6::ethertype());
- v.push_back(IPPROTO_IPV6);
+// v.push_back(PROTO_TYPE);
}
static Codec* ctor()
static void sum()
{
-// sum_stats((PegCount*)&gdc, (PegCount*)&dc, array_size(dc_pegs));
-// memset(&dc, 0, sizeof(dc));
+ sum_stats((PegCount*)&gcounts, (PegCount*)&counts, peg_names.size());
+ memset(&counts, 0, sizeof(counts));
}
-static void stats()
+static void stats(std::vector<PegCount> g_peg_counts, std::vector<const char*> g_peg_names)
{
-// show_percent_stats((PegCount*)&gdc, dc_pegs, array_size(dc_pegs),
-// "decoder");
+ std::memcpy(&g_peg_counts, &counts, sizeof(CdPegs));
+ g_peg_names.insert(g_peg_names.end(), peg_names.begin(), peg_names.end());
}
-
static const char* name = "name_codec";
-
static const CodecApi codec_api =
{
{ PT_CODEC, name, CDAPI_PLUGIN_V0, 0 },
#include "snort_types.h"
#include "framework/base_api.h"
-
+#include "utils/stats.h"
// REMOVE WHEN POSSIBLE!!!
#include "codecs/sf_protocols.h"
virtual ~Codec() { };
virtual bool decode(const uint8_t* raw_packet, const uint32_t raw_len,
- Packet *p, uint16_t &p_hdr_len, int &next_prot_id) = 0;
+ Packet *p, uint16_t &lyr_len, int &next_prot_id) = 0;
// do nothing unless methods overridden.
// ONE OF THESE METHODS MUST BE IMPLEMENTED!!
typedef void (*cd_dlt_f)(std::vector<int>&v);
typedef void (*cd_prot_id_f)(std::vector<uint16_t>&);
+typedef void (*cd_stat_f)(std::vector<PegCount>, std::vector<const char*>);
// add every protocol id, included IP protocols and
// ethertypes, to the passed in vector
// cd_get_protos get_protos;
cd_prot_id_f proto_id; // get the protocol ids
cd_aux_f sum;
- cd_aux_f stats;
+ cd_stat_f stats;
};
#endif
#include "packet_manager.h"
#include <list>
#include <vector>
+#include <cstring>
#include "framework/codec.h"
#include "packet_manager.h"
#include "snort.h"
FatalError("Codec %s: dtor() must be implemented. Look at the example code for an example.\n",
api->base.name);
+
+ WarningMessage("The size of a Codec* is %d\n", sizeof(Codec));
s_codecs.push_back(api);
}
{
PROFILE_VARS;
int curr_prot_id, next_prot_id;
- uint16_t len, p_hdr_len;
+ uint16_t len, lyr_len;
PREPROC_PROFILE_START(decodePerfStats);
pkt_cnt.other_codecs++;
break;
}
- else if( !s_protocols[curr_prot_id]->decode(pkt, len, p, p_hdr_len, next_prot_id))
+ else if( !s_protocols[curr_prot_id]->decode(pkt, len, p, lyr_len, next_prot_id))
{
pkt_cnt.discards++;
break;
}
- PacketClass::PushLayer(p, s_protocols[curr_prot_id], pkt, p_hdr_len);
+ PacketClass::PushLayer(p, s_protocols[curr_prot_id], pkt, lyr_len);
curr_prot_id = next_prot_id;
- len -= p_hdr_len;
- pkt += p_hdr_len;
+ len -= lyr_len;
+ pkt += lyr_len;
+ next_prot_id = -1;
+ lyr_len = 0;
}
p->dsize = len;
std::vector<const char*> pegNames(CdGenPegNames);
std::vector<PegCount> pegs;
- pegs.push_back(gpkt_cnt.total_processed);
- pegs.push_back(gpkt_cnt.other_codecs);
- pegs.push_back(gpkt_cnt.discards);
+
+ std::memcpy(&pegs[0], &gpkt_cnt, sizeof(gpkt_cnt));
+
+// pegs.push_back(gpkt_cnt.total_processed);
+// pegs.push_back(gpkt_cnt.other_codecs);
+// pegs.push_back(gpkt_cnt.discards);
// using two temporary vectors to ensure codecs cannot
// see any other codecs statistics
{
tmpPegs.clear();
tmpNames.clear();
-// cd->stats(tmpPegs, tmpNames);
+ if(cd->stats)
+ cd->stats(tmpPegs, tmpNames);
if (tmpNames.size() == tmpPegs.size())
{
pegs.insert(pegs.end(), tmpPegs.begin(), tmpPegs.end());
"codecs");
}
-
bool PacketManager::has_codec(uint16_t cd_id)
{
return s_protocols[cd_id] != 0;
** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
+// packet_manager.h author Josh Rosenbaum <jorosenba@cisco.com>
+
#ifndef PACKET_MANAGER_H
#define PACKET_MANAGER_H
projects / thirdparty / snort3.git / commitdiff
