fixing extra. Packet now has a 'type' which correlates to Snort's proto()'

diff --git a/extra/src/codecs/pim.cc b/extra/src/codecs/pim.cc
index 149d25b83a0214db0bdc2620bba3d5c41ac0e3e2..e4543692784ceaecb961900429f6c41d41a58274 100644 (file)
--- a/extra/src/codecs/pim.cc
+++ b/extra/src/codecs/pim.cc
@@ -44,8 +44,7 @@ public:
 
 
     virtual void get_protocol_ids(std::vector<uint16_t>&);
-    virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
-        Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
+    virtual bool decode(const RawData&, CodecData&, SnortData&);
 
 };
 
@@ -59,10 +58,9 @@ void PimCodec::get_protocol_ids(std::vector<uint16_t>& v)
     v.push_back(IPPROTO_ID_PIM);
 }
 
-bool PimCodec::decode(const uint8_t* /*raw_pkt*/, const uint32_t& /*raw_len*/,
-        Packet* p, uint16_t& /*lyr_len*/, uint16_t& /*next_prot_id*/)
+bool PimCodec::decode(const RawData&, CodecData&, SnortData&)
 {
-    codec_events::decoder_event(p, DECODE_IP_BAD_PROTO);
+    codec_events::decoder_event(DECODE_IP_BAD_PROTO);
     return true;
 }
 

diff --git a/extra/src/codecs/token_ring.cc b/extra/src/codecs/token_ring.cc
index bc4645478d7a14654a2032eff322cf6e0088971d..f03e0a7fd496154cf3839674a18055746375b3b3 100644 (file)
--- a/extra/src/codecs/token_ring.cc
+++ b/extra/src/codecs/token_ring.cc
@@ -27,12 +27,14 @@
 #endif
 
 #include <pcap.h>
-#include "protocols/packet.h"
 #include "protocols/token_ring.h"
 #include "framework/codec.h"
 #include "codecs/codec_events.h"
 #include "codecs/decode_module.h"
 
+
+#ifdef DLT_IEEE802
+
 namespace
 {
 
@@ -69,8 +71,7 @@ public:
 
 
     virtual void get_data_link_type(std::vector<int>&);
-    virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
-        Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
+    virtual bool decode(const RawData&, CodecData&, SnortData&);
 };
 
 
@@ -99,23 +100,20 @@ public:
 
 void TrCodec::get_data_link_type(std::vector<int>&v)
 {
-#ifdef DLT_IEEE802
     v.push_back(DLT_IEEE802);
-#endif
 }
 
 
 //void DecodeTRPkt(Packet * p, const DAQ_PktHdr_t * pkthdr, const uint8_t * pkt)
-bool TrCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
-        Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
+bool TrCodec::decode(const RawData& raw, CodecData& codec, SnortData&)
 {
 
-    uint32_t cap_len = raw_len;
+    const uint32_t cap_len = raw.len;
     uint32_t dataoff;      /* data offset is variable here */
 
     if(cap_len < sizeof(token_ring::Trh_hdr))
     {
-        codec_events::decoder_event(p, DECODE_BAD_TRH);
+        codec_events::decoder_event(DECODE_BAD_TRH);
         return false;
     }
 
@@ -141,12 +139,12 @@ bool TrCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
      */
     if(cap_len < (sizeof(token_ring::Trh_hdr) + sizeof(token_ring::Trh_llc)))
     {
-        codec_events::decoder_event(p, DECODE_BAD_TR_ETHLLC);
+        codec_events::decoder_event(DECODE_BAD_TR_ETHLLC);
         return false;
     }
 
     const token_ring::Trh_llc *trhllc =
-        reinterpret_cast<const token_ring::Trh_llc *>(raw_pkt + sizeof(token_ring::Trh_hdr));
+        reinterpret_cast<const token_ring::Trh_llc *>(raw.data + sizeof(token_ring::Trh_hdr));
 
     if(trhllc->dsap != IPARP_SAP && trhllc->ssap != IPARP_SAP)
     {
@@ -158,22 +156,22 @@ bool TrCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
 
         if(cap_len < (sizeof(token_ring::Trh_hdr) + sizeof(token_ring::Trh_llc) + sizeof(token_ring::Trh_mr)))
         {
-            codec_events::decoder_event(p, DECODE_BAD_TRHMR);
+            codec_events::decoder_event(DECODE_BAD_TRHMR);
             return false;
         }
 
-        const token_ring::Trh_mr* trhmr =
-            reinterpret_cast<const token_ring::Trh_mr *>(raw_pkt + sizeof(token_ring::Trh_hdr));
+        const token_ring::Trh_mr* const trhmr =
+            reinterpret_cast<const token_ring::Trh_mr *>(raw.data + sizeof(token_ring::Trh_hdr));
 
 
         if(cap_len < (sizeof(token_ring::Trh_hdr) + sizeof(token_ring::Trh_llc) +
                       sizeof(token_ring::Trh_mr) + TRH_MR_LEN(trhmr)))
         {
-            codec_events::decoder_event(p, DECODE_BAD_TR_MR_LEN);
+            codec_events::decoder_event(DECODE_BAD_TR_MR_LEN);
             return false;
         }
 
-        dataoff   = sizeof(token_ring::Trh_hdr) + TRH_MR_LEN(trhmr) + sizeof(token_ring::Trh_llc);
+        dataoff = sizeof(token_ring::Trh_hdr) + TRH_MR_LEN(trhmr) + sizeof(token_ring::Trh_llc);
 
     }
     else
@@ -196,8 +194,8 @@ bool TrCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
         return false;
     }
 
-    lyr_len = dataoff;
-    next_prot_id = htons(trhllc->ethertype);
+    codec.lyr_len = dataoff;
+    codec.next_prot_id = htons(trhllc->ethertype);
     return true;
 }
 
@@ -209,24 +207,16 @@ bool TrCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
 
 
 static Module* mod_ctor()
-{
-    return new TrCodecModule;
-}
+{ return new TrCodecModule; }
 
 static void mod_dtor(Module* m)
-{
-    delete m;
-}
+{ delete m; }
 
 static Codec* ctor(Module*)
-{
-    return new TrCodec();
-}
+{ return new TrCodec(); }
 
 static void dtor(Codec *cd)
-{
-    delete cd;
-}
+{ delete cd; }
 
 
 static const CodecApi tr_api =
@@ -254,3 +244,5 @@ SO_PUBLIC const BaseApi* snort_plugins[] =
     &tr_api.base,
     nullptr
 };
+
+#endif

diff --git a/extra/src/inspectors/dpx.cc b/extra/src/inspectors/dpx.cc
index 8d0530bc7ae30b3065ac5e6a0ca118a4ba42c0de..8da9d4328348008b89b2e3b52e9f02eae2c4c231 100644 (file)
--- a/extra/src/inspectors/dpx.cc
+++ b/extra/src/inspectors/dpx.cc
@@ -96,7 +96,7 @@ void DpxPH::eval(Packet* p)
     // precondition - what we registered for
     assert(IsUDP(p));
 
-    if ( p->dp == port && p->dsize > max )
+    if ( p->ptrs.dp == port && p->dsize > max )
         SnortEventqAdd(DPX_GID, DPX_SID);
 
     ++dpxstats.total_packets;

diff --git a/extra/src/ips_options/ips_urg.cc b/extra/src/ips_options/ips_urg.cc
index 3236454e9dd4cbaa0a7cf043df54c253f89f4326..918377e6bc91c533687bb316b65f74aa5c45434a 100644 (file)
--- a/extra/src/ips_options/ips_urg.cc
+++ b/extra/src/ips_options/ips_urg.cc
@@ -97,7 +97,7 @@ int TcpUrgOption::eval(Packet *p)
 
     int rval = DETECTION_OPTION_NO_MATCH;
 
-    if ( p->tcph && config.eval(p->tcph->th_ack) )
+    if ( p->ptrs.tcph && config.eval(p->ptrs.tcph->th_ack) )
         rval = DETECTION_OPTION_MATCH;
 
     //MODULE_PROFILE_END(tcpUrgPerfStats);

diff --git a/src/codecs/ip/cd_icmp4.cc b/src/codecs/ip/cd_icmp4.cc
index 3499986d3f2c5c04508dc60069808f6591eb90f4..b9012c7f56fb2d05c097324e48b50243e66bf25c 100644 (file)
--- a/src/codecs/ip/cd_icmp4.cc
+++ b/src/codecs/ip/cd_icmp4.cc
@@ -242,6 +242,7 @@ bool Icmp4Codec::decode(const RawData& raw, CodecData& codec,SnortData& snort)
     /* Run a bunch of ICMP decoder rules */
     ICMP4MiscTests(icmph, codec, (uint16_t)raw.len - len);
 
+    snort.packet_type = PKT_TYPE__ICMP4;
     snort.icmph = icmph;
     codec.proto_bits |= PROTO_BIT__ICMP;
     codec.lyr_len = len;

diff --git a/src/codecs/ip/cd_icmp6.cc b/src/codecs/ip/cd_icmp6.cc
index 71450fb82676a23da4c99caeb9d6d500c3e13e6f..6e935d89d3e218c5bdfe83cc98ea2f320ad9d805 100644 (file)
--- a/src/codecs/ip/cd_icmp6.cc
+++ b/src/codecs/ip/cd_icmp6.cc
@@ -277,6 +277,7 @@ bool Icmp6Codec::decode(const RawData& raw, CodecData& codec, SnortData& snort)
     codec.lyr_len = len;
     codec.proto_bits |= PROTO_BIT__ICMP;
     snort.icmph = reinterpret_cast<const icmp::ICMPHdr*>(icmp6h);
+    snort.packet_type = PKT_TYPE__ICMP6;
     return true;
 }
 

diff --git a/src/codecs/ip/cd_ipv4.cc b/src/codecs/ip/cd_ipv4.cc
index 364703cbba8b8346841ed422da712572c1d58aca..8709238b1a054d36e5eeb22f115f6d7d586a43da 100644 (file)
--- a/src/codecs/ip/cd_ipv4.cc
+++ b/src/codecs/ip/cd_ipv4.cc
@@ -367,6 +367,7 @@ bool Ipv4Codec::decode(const RawData& raw, CodecData& codec, SnortData& snort)
         codec_events::decoder_event(DECODE_BAD_FRAGBITS);
 
 
+    snort.packet_type = PKT_TYPE__IP;
     codec.proto_bits |= PROTO_BIT__IP;
     IPMiscTests(iph, ip::IP4_HEADER_LEN + ip_opt_len);
     codec.lyr_len = hlen;

diff --git a/src/codecs/ip/cd_ipv6.cc b/src/codecs/ip/cd_ipv6.cc
index 87610fdba97a1d1829fd7be458926cfbce2f0d47..3551313d1529da4c3ba5323bfe7762d395965ae9 100644 (file)
--- a/src/codecs/ip/cd_ipv6.cc
+++ b/src/codecs/ip/cd_ipv6.cc
@@ -258,6 +258,7 @@ bool Ipv6Codec::decode(const RawData& raw, CodecData& codec, SnortData& snort)
         IPV6MiscTests(snort);
         CheckIPV6Multicast(ip6h);
 
+        snort.packet_type = PKT_TYPE__IP;
         codec.next_prot_id = ip6h->get_next();
         codec.lyr_len = ip::IP6_HEADER_LEN;
 

diff --git a/src/codecs/ip/cd_tcp.cc b/src/codecs/ip/cd_tcp.cc
index c894abb61cd69fc48f45c914f146592aaba6aa60..12d569b6e40a2e2888a72532932f3559b088a00c 100644 (file)
--- a/src/codecs/ip/cd_tcp.cc
+++ b/src/codecs/ip/cd_tcp.cc
@@ -279,6 +279,7 @@ bool TcpCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort)
     snort.tcph = tcph;
     snort.sp = tcph->src_port();
     snort.dp = tcph->dst_port();
+    snort.packet_type = PKT_TYPE__TCP;
 
     TCPMiscTests(snort, tcph);
 

diff --git a/src/codecs/ip/cd_udp.cc b/src/codecs/ip/cd_udp.cc
index 972cdcb6e0d0341008ca896b0de998c199499ac9..789db0e6848c698a73ac1c2883898df55d97b76d 100644 (file)
--- a/src/codecs/ip/cd_udp.cc
+++ b/src/codecs/ip/cd_udp.cc
@@ -290,6 +290,7 @@ bool UdpCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort)
     snort.dp = dst_port;
     codec.lyr_len = udp::UDP_HEADER_LEN;
     codec.proto_bits |= PROTO_BIT__UDP;
+    snort.packet_type = PKT_TYPE__UDP;
 
     // set in packet manager
     UDPMiscTests(snort, uhlen - udp::UDP_HEADER_LEN);

diff --git a/src/codecs/link/cd_arp.cc b/src/codecs/link/cd_arp.cc
index 206677352a5bda6ac89d6dd17b7d2141fc0bedca..88a57aa84de5d94268d94750f7830e2c131c85b6 100644 (file)
--- a/src/codecs/link/cd_arp.cc
+++ b/src/codecs/link/cd_arp.cc
@@ -89,7 +89,7 @@ void ArpCodec::get_protocol_ids(std::vector<uint16_t>& v)
  *
  * Returns: void function
  */
-bool ArpCodec::decode(const RawData& raw, CodecData& codec, SnortData&)
+bool ArpCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort)
 {
     if(raw.len < sizeof(arp::EtherARP))
     {
@@ -99,7 +99,8 @@ bool ArpCodec::decode(const RawData& raw, CodecData& codec, SnortData&)
 
     codec.proto_bits |= PROTO_BIT__ARP;
     codec.lyr_len = sizeof(arp::EtherARP);
-    
+    snort.packet_type = PKT_TYPE__ARP;
+
     return true;
 }
 

diff --git a/src/framework/codec.h b/src/framework/codec.h
index c4de7221fac96d683c58c2bab7425d3586fc8add..e34fb6b427af6dbd0e5fde5c2a2594640396bed3 100644 (file)
--- a/src/framework/codec.h
+++ b/src/framework/codec.h
@@ -23,6 +23,7 @@
 #include <vector>
 #include <cstdint>
 #include <cstddef>
+#include <type_traits> // static_assert
 
 #include "main/snort_types.h"
 #include "framework/base_api.h"
@@ -133,6 +134,36 @@ struct RawData
     uint32_t len;
 };
 
+/*  SnortData Flags */
+
+/* error flags */
+constexpr uint8_t DECODE_ERR_CKSUM_IP = 0x01;
+constexpr uint8_t DECODE_ERR_CKSUM_TCP = 0x02;
+constexpr uint8_t DECODE_ERR_CKSUM_UDP = 0x04;
+constexpr uint8_t DECODE_ERR_CKSUM_ICMP = 0x08;
+constexpr uint8_t DECODE_ERR_CKSUM_ANY = 0x0F;
+constexpr uint8_t DECODE_ERR_BAD_TTL = 0x10;
+constexpr uint8_t DECODE_PKT_TRUST = 0x20;    /* Tell Snort++ to whitelist this packet */
+constexpr uint8_t DECODE_FRAG = 0x40;  /* flag to indicate a fragmented packet */
+constexpr uint8_t DECODE_MF = 0x80;
+
+constexpr uint8_t DECODE_ERR_FLAGS = DECODE_ERR_CKSUM_IP |
+    DECODE_ERR_CKSUM_TCP |
+    DECODE_ERR_CKSUM_UDP |
+    DECODE_ERR_CKSUM_UDP |
+    DECODE_ERR_CKSUM_ICMP |
+    DECODE_ERR_CKSUM_ANY |
+    DECODE_ERR_BAD_TTL;
+
+
+constexpr uint8_t PKT_TYPE__UNKOWN = 0x00;
+constexpr uint8_t PKT_TYPE__IP = 0x01;
+constexpr uint8_t PKT_TYPE__TCP = 0x02;
+constexpr uint8_t PKT_TYPE__UDP = 0x04;
+constexpr uint8_t PKT_TYPE__ICMP4 = 0x08;
+constexpr uint8_t PKT_TYPE__ICMP6 = 0x10;
+constexpr uint8_t PKT_TYPE__ARP = 0x10;
+
 struct SnortData
 {
     /*  Pointers which will be used by Snort++. (starting with uint16_t so tcph is 64 bytes from start*/
@@ -147,36 +178,19 @@ struct SnortData
     uint16_t sp;                /* source port (TCP/UDP) */
     uint16_t dp;                /* dest port (TCP/UDP) */
     uint8_t decode_flags;       /* decoder flags including checksum errors, bad TTLs, frag, etc. */
+    uint8_t packet_type;
 
     ip::IpApi ip_api;
     mpls::MplsHdr mplsHdr;
 
     inline void reset()
     {
+        static_assert(PKT_TYPE__UNKOWN == 0, "PKT_TYPE__UNKOWN must be zero!!");
         memset((char*)tcph, '\0', offsetof(SnortData, ip_api));
         ip_api.reset();
     }
 };
 
-/* error flags */
-constexpr uint8_t DECODE_ERR_CKSUM_IP = 0x01;
-constexpr uint8_t DECODE_ERR_CKSUM_TCP = 0x02;
-constexpr uint8_t DECODE_ERR_CKSUM_UDP = 0x04;
-constexpr uint8_t DECODE_ERR_CKSUM_ICMP = 0x08;
-constexpr uint8_t DECODE_ERR_CKSUM_ANY = 0x0F;
-constexpr uint8_t DECODE_ERR_BAD_TTL = 0x10;
-constexpr uint8_t DECODE_PKT_TRUST = 0x20;    /* Tell Snort++ to whitelist this packet */
-constexpr uint8_t DECODE_FRAG = 0x40;  /* flag to indicate a fragmented packet */
-constexpr uint8_t DECODE_MF = 0x80;
-
-constexpr uint8_t DECODE_ERR_FLAGS = DECODE_ERR_CKSUM_IP |
-    DECODE_ERR_CKSUM_TCP |
-    DECODE_ERR_CKSUM_UDP |
-    DECODE_ERR_CKSUM_UDP |
-    DECODE_ERR_CKSUM_ICMP |
-    DECODE_ERR_CKSUM_ANY |
-    DECODE_ERR_BAD_TTL;
-
 
 struct CodecData
 {
@@ -224,6 +238,8 @@ struct CodecData
 #define PROTO_BIT__ALL      0xffff
 
 
+
+
 /*  Decode Flags */
 constexpr uint8_t CODEC_DF = 0x01;    /* don't fragment flag */
 constexpr uint8_t CODEC_UNSURE_ENCAP = 0x02;  /* packet may have incorrect encapsulation layer.

diff --git a/src/protocols/packet.h b/src/protocols/packet.h
index 12678baffa300673eef14d64cefc1b21f65e9522..5967ca98eb15ae9ab99574b0217c66c0c65896ea 100644 (file)
--- a/src/protocols/packet.h
+++ b/src/protocols/packet.h
@@ -202,6 +202,11 @@ struct Packet
     uint32_t iplist_id;
 
     uint8_t ps_proto;  // Used for portscan and unified2 logging
+
+    /*  Access methods */
+
+    inline uint8_t type() const
+    { return ptrs.packet_type; }
 };
 
 #define PKT_ZERO_LEN offsetof(Packet, pkth)

diff --git a/src/protocols/token_ring.h b/src/protocols/token_ring.h
index e94161823d846d24e30a47e485c2502681852053..1cf3053fec5b45a86eda88588efbfa67962b9507 100644 (file)
--- a/src/protocols/token_ring.h
+++ b/src/protocols/token_ring.h
@@ -23,6 +23,8 @@
 #ifndef PROTOCOLS_TOKEN_RING_H
 #define PROTOCOLS_TOKEN_RING_H
 
+#include <cstdint>
+
 namespace token_ring{
 
 /* LLC structure */