cd_gre.cc
cd_mpls.cc
cd_transbridge.cc
+ cd_erspan2.cc
+ cd_erspan3.cc
)
*/
+#include "framework/codec.h"
+#include "codecs/codec_events.h"
+#include "codecs/decode_module.h"
+#include "protocols/ethertypes.h"
+
+namespace
+{
+
+class Erspan2Codec : public Codec
+{
+public:
+ Erspan2Codec() : Codec("ERSPAN_2"){};
+ ~Erspan2Codec();
+
+
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
+ Packet *, uint16_t &p_hdr_len, int &next_prot_id);
+
+ virtual void get_protocol_ids(std::vector<uint16_t>&);
+ virtual void get_data_link_type(std::vector<int>&){};
+
+};
-#ifdef HAVE_CONFIG_H
-#include "config.h"
-#endif
-#include "generators.h"
-#include "decode.h"
-#include "static_include.h"
-#include "prot_erspan2.h"
+struct ERSpanType2Hdr
+{
+ uint16_t ver_vlan;
+ uint16_t flags_spanId;
+ uint32_t pad;
+} ;
+
+const uint16_t ETHERTYPE_ERSPAN_TYPE2 = 0x88be;
+} // anonymous namespace
+
-#include "decoder_includes.h"
/*
* Function: DecodeERSPANType2(uint8_t *, uint32_t, Packet *)
* Returns: void function
*
*/
-bool ERSPANType2::Decode(const uint8_t *pkt, const uint32_t len,
- Packet *p, uint16_t &p_hdr_len, uint16_t &next_prot_id)
+bool Erspan2Codec::decode(const uint8_t *raw_pkt, const uint32_t len,
+ Packet *p, uint16_t &p_hdr_len, int &next_prot_id)
{
- uint32_t hlen = sizeof(ERSpanType2Hdr);
+ p_hdr_len = sizeof(ERSpanType2Hdr);
uint32_t payload_len;
- ERSpanType2Hdr *erSpan2Hdr = (ERSpanType2Hdr *)pkt;
+ ERSpanType2Hdr *erSpan2Hdr = (ERSpanType2Hdr *)raw_pkt;
if (len < sizeof(ERSpanType2Hdr))
{
- CodecEvents::decoder_alert_encapsulated(p, DECODE_ERSPAN2_DGRAM_LT_HDR, pkt, len);
- return;
+ CodecEvents::decoder_alert_encapsulated(p, DECODE_ERSPAN2_DGRAM_LT_HDR, raw_pkt, len);
+ return false;
}
if (p->encapsulated)
/* discard packet - multiple encapsulation */
/* not sure if this is ever used but I am assuming it is not */
CodecEvents::decoder_alert_encapsulated(p, DECODE_IP_MULTIPLE_ENCAPSULATION,
- pkt, len);
- return;
+ raw_pkt, len);
+ return false;
}
/* Check that this is in fact ERSpan Type 2.
if (ERSPAN_VERSION(erSpan2Hdr) != 0x01) /* Type 2 == version 0x01 */
{
CodecEvents::decoder_alert_encapsulated(p, DECODE_ERSPAN_HDR_VERSION_MISMATCH,
- pkt, len);
- return;
+ raw_pkt, len);
+ return false;
}
-// PushLayer(PROTO_ERSPAN, p, pkt, hlen);
- payload_len = len - hlen;
-
- // TODO: Is this actually statis or possible changable?
-// DecodeTransBridging(pkt + hlen, payload_len, p);
- next_prot_id = GRE_TYPE_TRANS_BRIDGING; // huh?
- p_hdr_len = hlen;
+ next_prot_id = ETHERTYPE_TRANS_ETHER_BRIDGING; // huh?
return true;
}
-static const char* name = "erspan2_decode";
-static const CodecApi erspan2_api =
+
+void Erspan2Codec::get_protocol_ids(std::vector<uint16_t>& v)
+{
+ v.push_back(ETHERTYPE_ERSPAN_TYPE2);
+}
+
+static Codec* ctor()
+{
+ return new Erspan2Codec();
+}
+
+static void dtor(Codec *cd)
+{
+ delete cd;
+}
+
+static void sum()
+{
+// sum_stats((PegCount*)&gdc, (PegCount*)&dc, array_size(dc_pegs));
+// memset(&dc, 0, sizeof(dc));
+}
+
+static void stats()
+{
+// show_percent_stats((PegCount*)&gdc, dc_pegs, array_size(dc_pegs),
+// "decoder");
+}
+
+
+
+static const char* name = "erspan2_codec";
+
+static const CodecApi codec_api =
{
{ PT_CODEC, name, CDAPI_PLUGIN_V0, 0 },
- {ETHERNET_TYPE_ERSPAN_TYPE2},
NULL, // pinit
NULL, // pterm
NULL, // tinit
NULL, // tterm
ctor, // ctor
dtor, // dtor
- NULL,
- NULL,
+ sum, // sum
+ stats // stats
};
-
-#ifdef HAVE_CONFIG_H
-#include "config.h"
-#endif
+#include "framework/codec.h"
+#include "codecs/codec_events.h"
+#include "codecs/decode_module.h"
+#include "protocols/ethertypes.h"
-#include "generators.h"
-#include "decode.h"
-#include "static_include.h"
+namespace
+{
+
+class Erspan3Codec : public Codec
+{
+public:
+ Erspan3Codec() : Codec("ERSPAN_3"){};
+ ~Erspan3Codec();
+
+
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
+ Packet *, uint16_t &p_hdr_len, int &next_prot_id);
+
+ virtual void get_protocol_ids(std::vector<uint16_t>&);
+ virtual void get_data_link_type(std::vector<int>&){};
+
+};
-#include "decoder_includes.h"
-#include "prot_erspan3.h"
+struct ERSpanType3Hdr
+{
+ uint16_t ver_vlan;
+ uint16_t flags_spanId;
+ uint32_t timestamp;
+ uint16_t pad0;
+ uint16_t pad1;
+ uint32_t pad2;
+ uint32_t pad3;
+};
+
+const uint16_t ETHERTYPE_ERSPAN_TYPE3 = 0x22eb;
+} // anonymous namespace
/*
* Function: DecodeERSPANType3(uint8_t *, uint32_t, Packet *)
* Returns: void function
*
*/
-void DecodeERSPANType3(const uint8_t *pkt, const uint32_t len, Packet *p)
+bool Erspan3Codec::decode(const uint8_t *raw_pkt, const uint32_t len,
+ Packet *p, uint16_t &p_hdr_len, int &next_prot_id)
{
- uint32_t hlen = sizeof(ERSpanType3Hdr);
+ p_hdr_len= sizeof(ERSpanType3Hdr);
uint32_t payload_len;
- ERSpanType3Hdr *erSpan3Hdr = (ERSpanType3Hdr *)pkt;
+ ERSpanType3Hdr *erSpan3Hdr = (ERSpanType3Hdr *)raw_pkt;
if (len < sizeof(ERSpanType3Hdr))
{
CodecEvents::decoder_alert_encapsulated(p, DECODE_ERSPAN3_DGRAM_LT_HDR,
- pkt, len);
- return;
+ raw_pkt, len);
+ return false;
}
if (p->encapsulated)
/* discard packet - multiple encapsulation */
/* not sure if this is ever used but I am assuming it is not */
CodecEvents::decoder_alert_encapsulated(p, DECODE_IP_MULTIPLE_ENCAPSULATION,
- pkt, len);
- return;
+ raw_pkt, len);
+ return false;
}
/* Check that this is in fact ERSpan Type 3.
if (ERSPAN_VERSION(erSpan3Hdr) != 0x02) /* Type 3 == version 0x02 */
{
CodecEvents::decoder_alert_encapsulated(p, DECODE_ERSPAN_HDR_VERSION_MISMATCH,
- pkt, len);
- return;
+ raw_pkt, len);
+ return false;
}
-// PushLayer(PROTO_ERSPAN, p, pkt, hlen);
-// payload_len = len - hlen;
-// TODO: Is this the only next protocol which can be called?
-// DecodeTransBridging(pkt + hlen, payload_len, p);
+ next_prot_id = ETHERTYPE_TRANS_ETHER_BRIDGING;
+ return true;
+}
- next_prot_id = GRE_TYPE_TRANS_BRIDGING; // huh?
- p_hdr_len = hlen;
- return true;
+void Erspan3Codec::get_protocol_ids(std::vector<uint16_t>& v)
+{
+ v.push_back(ETHERTYPE_ERSPAN_TYPE3);
}
+static Codec* ctor()
+{
+ return new Erspan3Codec();
+}
+
+static void dtor(Codec *cd)
+{
+ delete cd;
+}
+
+static void sum()
+{
+// sum_stats((PegCount*)&gdc, (PegCount*)&dc, array_size(dc_pegs));
+// memset(&dc, 0, sizeof(dc));
+}
+
+static void stats()
+{
+// show_percent_stats((PegCount*)&gdc, dc_pegs, array_size(dc_pegs),
+// "decoder");
+}
+
+
-static const char* name = "erspan3_decode";
+static const char* name = "erspan3_codec";
-static const CodecApi erspan3_api =
+static const CodecApi codec_api =
{
{ PT_CODEC, name, CDAPI_PLUGIN_V0, 0 },
- {ETHERNET_TYPE_ERSPAN_TYPE3},
NULL, // pinit
NULL, // pterm
NULL, // tinit
NULL, // tterm
ctor, // ctor
dtor, // dtor
- NULL,
- NULL
+ sum, // sum
+ stats // stats
};
+++ /dev/null
-/*
-** Copyright (C) 2002-2013 Sourcefire, Inc.
-** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-
-#ifndef PROT_ERSPAN_TYPE2_H
-#define PROT_ERSPAN_TYPE2_H
-
-
-#define ETHERNET_TYPE_ERSPAN_TYPE2 0x88be
-
-
-void DecodeERSPANType2(const uint8_t *, const uint32_t, Packet *);
-
-
-#endif
-
+++ /dev/null
-/*
-** Copyright (C) 2002-2013 Sourcefire, Inc.
-** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-
-#ifndef PROT_ERSPAN_TYPE3_H
-#define PROT_ERSPAN_TYPE3_H
-
-
-#define ETHERNET_TYPE_ERSPAN_TYPE3 0x22eb
-
-void DecodeERSPANType3(const uint8_t *, const uint32_t, Packet *);
-
-
-#endif
-
#endif
-typedef struct _ERSpanType2Hdr
-{
- uint16_t ver_vlan;
- uint16_t flags_spanId;
- uint32_t pad;
-} ERSpanType2Hdr;
-
-typedef struct _ERSpanType3Hdr
-{
- uint16_t ver_vlan;
- uint16_t flags_spanId;
- uint32_t timestamp;
- uint16_t pad0;
- uint16_t pad1;
- uint32_t pad2;
- uint32_t pad3;
-} ERSpanType3Hdr;
#define ERSPAN_VERSION(x) ((ntohs(x->ver_vlan) & 0xf000) >> 12)
#define ERSPAN_VLAN(x) (ntohs(x->ver_vlan) & 0x0fff)
projects / thirdparty / snort3.git / commitdiff
