# optional libraries
find_package(Asciidoc QUIET)
find_package(DBLATEX QUIET)
+find_package(Ruby QUIET)
virtual PROTO_ID get_proto_id() { return PROTO_AH; };
virtual void get_protocol_ids(std::vector<uint16_t>& v);
- virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
};
v.push_back(IPPROTO_ID_AH);
}
-bool AhCodec::decode(const uint8_t *raw_pkt, const uint32_t len,
+bool AhCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
{
IP6Extension *ah = (IP6Extension *)raw_pkt;
- if (len < ipv6::min_ext_len())
+ if (raw_len < ipv6::min_ext_len())
{
codec_events::decoder_event(p, DECODE_AUTH_HDR_TRUNC);
return false;
lyr_len = sizeof(*ah) + (ah->ip6e_len << 2);
- if (lyr_len > len)
+ if (lyr_len > raw_len)
{
codec_events::decoder_event(p, DECODE_AUTH_HDR_BAD_LEN);
return false;
virtual void get_protocol_ids(std::vector<uint16_t>& v);
- virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
virtual bool update(Packet*, Layer*, uint32_t* len);
} // anonymous namespace
-bool Ipv6DSTOptsCodec::decode(const uint8_t *raw_pkt, const uint32_t len,
+bool Ipv6DSTOptsCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
{
const IP6Dest *dsthdr = reinterpret_cast<const IP6Dest *>(raw_pkt);
ipv6_util::CheckIPv6ExtensionOrder(p);
- if(len < sizeof(IP6Dest))
+ if(raw_len < sizeof(IP6Dest))
{
codec_events::decoder_event(p, DECODE_IPV6_TRUNCATED_EXT);
return false;
}
lyr_len = sizeof(IP6Dest) + (dsthdr->ip6dest_len << 3);
- if(lyr_len > len)
+ if(lyr_len > raw_len)
{
codec_events::decoder_event(p, DECODE_IPV6_TRUNCATED_EXT);
return false;
p->ip6_extension_count++;
next_prot_id = dsthdr->ip6dest_nxt;
- if ( ipv6_util::CheckIPV6HopOptions(raw_pkt, len, p))
+ if ( ipv6_util::CheckIPV6HopOptions(raw_pkt, raw_len, p))
return true;
return false;
}
virtual void get_protocol_ids(std::vector<uint16_t>& v);
- virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
};
* This is more of a heuristic -- there is no ESP field that specifies
* the encryption type (or lack thereof).
*
- * Arguments: pkt => ptr to the packet data
- * len => length from here to the end of the packet
- * p => ptr to the Packet struct being filled out
+ * Arguments: pkt => ptr to the packet data
+ * raw_len => length from here to the end of the packet
+ * p => ptr to the Packet struct being filled out
*
* Returns: void function
*/
-bool EspCodec::decode(const uint8_t *raw_pkt, const uint32_t len,
+bool EspCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
{
const uint8_t *esp_payload;
/* The ESP header contains a crypto Initialization Vector (IV) and
a sequence number. Skip these. */
- if (len < (ESP_HEADER_LEN + ESP_AUTH_DATA_LEN + ESP_TRAILER_LEN))
+ if (raw_len < (ESP_HEADER_LEN + ESP_AUTH_DATA_LEN + ESP_TRAILER_LEN))
{
/* Truncated ESP traffic. Bail out here and inspect the rest as payload. */
codec_events::decoder_event(p, DECODE_ESP_HEADER_TRUNC);
p->data = raw_pkt;
- p->dsize = (uint16_t) len;
+ p->dsize = (uint16_t) raw_len;
return false;
}
- esp_payload = raw_pkt + ESP_HEADER_LEN;
/* The Authentication Data at the end of the packet is variable-length.
RFC 2406 says that Encryption and Authentication algorithms MUST NOT
The mandatory algorithms for Authentication are HMAC-MD5-96 and
HMAC-SHA-1-96, so we assume a 12-byte authentication data at the end. */
- lyr_len = (ESP_HEADER_LEN + ESP_AUTH_DATA_LEN + ESP_TRAILER_LEN);
+ uint32_t guessed_len = raw_len - (ESP_HEADER_LEN + ESP_AUTH_DATA_LEN + ESP_TRAILER_LEN);
- pad_length = *(esp_payload + len - lyr_len);
- next_prot_id = *(esp_payload + len + 1 - lyr_len);
+ lyr_len = ESP_HEADER_LEN;
+ esp_payload = raw_pkt + ESP_HEADER_LEN;
+ pad_length = *(esp_payload + guessed_len);
+ next_prot_id = *(esp_payload + guessed_len + 1);
/* Adjust the packet length to account for the padding.
If the padding length is too big, this is probably encrypted traffic. */
- if (pad_length < len)
+ if (pad_length < raw_len)
{
- lyr_len += (pad_length);
+ const_cast<uint32_t&>(raw_len) -= pad_length;
}
else
{
p->packet_flags |= PKT_TRUST;
+ lyr_len = ESP_HEADER_LEN; // we want data to begin at (pkt + ESP_HEADER_LEN)
next_prot_id = FINISHED_DECODE;
return true;
}
- // If we cant' decode the pakcer anymore, this is probably encrypted.
- // set the data pointers and pretend this is an ip datagram.
- if (!PacketManager::has_codec(next_prot_id))
+ if (PacketManager::has_codec(next_prot_id))
{
+ /* Attempt to decode the inner payload.
+ There is a small chance that an encrypted next_header would become a
+ different valid next_header. The PKT_UNSURE_ENCAP flag tells the next
+ decoder stage to silently ignore invalid headers. */
p->packet_flags |= PKT_UNSURE_ENCAP;
+ const_cast<uint32_t&>(raw_len) -= (ESP_AUTH_DATA_LEN + ESP_TRAILER_LEN);
+ p->packet_flags |= PKT_ESP_LYR_PRESENT;
}
- else
+ else
{
+ // If we cant' decode the packet anymore, this is probably encrypted.
+ // set the data pointers and pretend this is an ip datagram.
p->packet_flags |= PKT_TRUST;
p->data = esp_payload;
- p->dsize = (u_short) len - lyr_len;
+ p->dsize = (u_short) raw_len - lyr_len;
}
return true;
~Ipv6FragCodec() {};
- virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
virtual void get_protocol_ids(std::vector<uint16_t>&);
} // namespace
-bool Ipv6FragCodec::decode(const uint8_t *raw_pkt, const uint32_t len,
+bool Ipv6FragCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
{
const IP6Frag *ip6frag_hdr = reinterpret_cast<const IP6Frag *>(raw_pkt);
fpEvalIpProtoOnlyRules(snort_conf->ip_proto_only_lists, p, IPPROTO_ID_FRAGMENT);
ipv6_util::CheckIPv6ExtensionOrder(p);
- if(len < ipv6::min_ext_len() )
+ if(raw_len < ipv6::min_ext_len() )
{
codec_events::decoder_event(p, DECODE_IPV6_TRUNCATED_EXT);
return false;
}
// already checked for short pacekt above
- if (len == sizeof(IP6Frag))
+ if (raw_len == sizeof(IP6Frag))
{
codec_events::decoder_event(p, DECODE_ZERO_LENGTH_FRAG);
return false;
ipv6_util::CheckIPv6ExtensionOrder(p);
lyr_len = sizeof(IP6Frag);
- p->ip_frag_len = (uint16_t)(len - lyr_len);
+ p->ip_frag_len = (uint16_t)(raw_len - lyr_len);
if ( p->frag_flag && ((p->frag_offset > 0) ||
(ip6frag_hdr->ip6f_nxt != IPPROTO_UDP)) )
virtual PROTO_ID get_proto_id() { return PROTO_GRE; };
virtual void get_protocol_ids(std::vector<uint16_t>& v);
- virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
*
* Notes: see RFCs 1701, 2784 and 2637
*/
-bool GreCodec::decode(const uint8_t *raw_pkt, const uint32_t len,
+bool GreCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
{
- if (len < GRE_HEADER_LEN)
+ if (raw_len < GRE_HEADER_LEN)
{
codec_events::decoder_alert_encapsulated(p, DECODE_GRE_DGRAM_LT_GREHDR,
- raw_pkt, len);
+ raw_pkt, raw_len);
return false;
}
/* discard packet - multiple GRE encapsulation */
/* not sure if this is ever used but I am assuming it is not */
codec_events::decoder_alert_encapsulated(p, DECODE_IP_MULTIPLE_ENCAPSULATION,
- raw_pkt, len);
+ raw_pkt, raw_len);
return false;
}
if (GRE_RECUR(greh) || GRE_FLAGS(greh))
{
codec_events::decoder_alert_encapsulated(p, DECODE_GRE_INVALID_HEADER,
- raw_pkt, len);
+ raw_pkt, raw_len);
return false;
}
while (1)
{
lyr_len += GRE_SRE_HEADER_LEN;
- if (lyr_len > len)
+ if (lyr_len > raw_len)
break;
sre_addrfamily = ntohs(*((uint16_t *)sre_ptr));
GRE_RECUR(greh) || GRE_V1_FLAGS(greh))
{
codec_events::decoder_alert_encapsulated(p, DECODE_GRE_V1_INVALID_HEADER,
- raw_pkt, len);
+ raw_pkt, raw_len);
return false;
}
if (GRE_PROTO(greh) != ETHERTYPE_PPP)
{
codec_events::decoder_alert_encapsulated(p, DECODE_GRE_V1_INVALID_HEADER,
- raw_pkt, len);
+ raw_pkt, raw_len);
return false;
}
if (!(GRE_KEY(greh)))
{
codec_events::decoder_alert_encapsulated(p, DECODE_GRE_V1_INVALID_HEADER,
- raw_pkt, len);
+ raw_pkt, raw_len);
return false;
}
default:
codec_events::decoder_alert_encapsulated(p, DECODE_GRE_INVALID_VERSION,
- raw_pkt, len);
+ raw_pkt, raw_len);
return false;
}
- if (lyr_len > len)
+ if (lyr_len > raw_len)
{
codec_events::decoder_alert_encapsulated(p, DECODE_GRE_DGRAM_LT_GREHDR,
- raw_pkt, len);
+ raw_pkt, raw_len);
return false;
}
~Ipv6HopOptsCodec() {};
virtual void get_protocol_ids(std::vector<uint16_t>& v);
- virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
virtual bool update(Packet*, Layer*, uint32_t* len);
};
* Class functions
*/
-bool Ipv6HopOptsCodec::decode(const uint8_t *raw_pkt, const uint32_t len,
+bool Ipv6HopOptsCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
{
const IP6HopByHop *hbh_hdr = reinterpret_cast<const IP6HopByHop*>(raw_pkt);
- if (len < sizeof(IP6HopByHop))
+ if (raw_len < sizeof(IP6HopByHop))
{
codec_events::decoder_event(p, DECODE_IPV6_TRUNCATED_EXT);
return false;
lyr_len = sizeof(IP6HopByHop) + (hbh_hdr->ip6hbh_len << 3);
next_prot_id = (uint16_t) hbh_hdr->ip6hbh_nxt;
- if(lyr_len > len)
+ if(lyr_len > raw_len)
{
codec_events::decoder_event(p, DECODE_IPV6_TRUNCATED_EXT);
return false;
p->ip6_extension_count++;
- if ( ipv6_util::CheckIPV6HopOptions(raw_pkt, len, p))
+ if ( ipv6_util::CheckIPV6HopOptions(raw_pkt, raw_len, p))
return true;
return false;
}
virtual PROTO_ID get_proto_id() { return PROTO_ICMP4; };
virtual void get_protocol_ids(std::vector<uint16_t>&);
- virtual bool decode(const uint8_t* raw_packet, const uint32_t raw_len,
+ virtual bool decode(const uint8_t* raw_packet, const uint32_t& raw_len,
Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id);
virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in);
virtual bool update(Packet*, Layer*, uint32_t* len);
*
* Returns: void function
*/
-bool Icmp4Codec::decode(const uint8_t* raw_pkt, const uint32_t raw_len,
+bool Icmp4Codec::decode(const uint8_t* raw_pkt, const uint32_t& raw_len,
Packet *p, uint16_t &lyr_len, uint16_t& /*next_prot_id*/)
{
if(raw_len < icmp4::hdr_len())
virtual PROTO_ID get_proto_id() { return PROTO_ICMP6; };
virtual void get_protocol_ids(std::vector<uint16_t>& v);
- virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in);
virtual bool update(Packet*, Layer*, uint32_t* len);
// decode.c::ICMP6
//--------------------------------------------------------------------
-bool Icmp6Codec::decode(const uint8_t* raw_pkt, const uint32_t len,
+bool Icmp6Codec::decode(const uint8_t* raw_pkt, const uint32_t& raw_len,
Packet* p, uint16_t &lyr_len, uint16_t & /* next_prot_id */)
{
- if(len < icmp6::hdr_min_len())
+ if(raw_len < icmp6::hdr_min_len())
{
DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
- "WARNING: Truncated ICMP6 header (%d bytes).\n", len););
+ "WARNING: Truncated ICMP6 header (%d bytes).\n", raw_len););
codec_events::decoder_event(p, DECODE_ICMP6_HDR_TRUNC);
return false;
if(IS_IP4(p))
{
- csum = checksum::cksum_add((uint16_t *)(p->icmp6h), len);
+ csum = checksum::cksum_add((uint16_t *)(p->icmp6h), raw_len);
}
/* IPv6 traffic */
else
COPY4(ph6.dip, p->ip6h->ip_dst.ip32);
ph6.zero = 0;
ph6.protocol = GET_IPH_PROTO(p);
- ph6.len = htons((u_short)len);
+ ph6.len = htons((u_short)raw_len);
- csum = checksum::icmp_cksum((uint16_t *)(p->icmp6h), len, &ph6);
+ csum = checksum::icmp_cksum((uint16_t *)(p->icmp6h), raw_len, &ph6);
}
if(csum)
{
}
}
- p->dsize = (u_short)(len - icmp6::hdr_min_len());
+ p->dsize = (u_short)(raw_len - icmp6::hdr_min_len());
p->data = raw_pkt + icmp6::hdr_min_len();
DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "ICMP type: %d code: %d\n",
else
{
DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
- "WARNING: Truncated ICMP Echo header (%d bytes).\n", len););
+ "WARNING: Truncated ICMP Echo header (%d bytes).\n", raw_len););
codec_events::decoder_event(p, DECODE_ICMP_DGRAM_LT_ICMPHDR);
else
{
DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
- "WARNING: Truncated ICMP header (%d bytes).\n", len););
+ "WARNING: Truncated ICMP header (%d bytes).\n", raw_len););
codec_events::decoder_event(p, DECODE_ICMP_DGRAM_LT_ICMPHDR);
else
{
DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
- "WARNING: Truncated ICMP header (%d bytes).\n", len););
+ "WARNING: Truncated ICMP header (%d bytes).\n", raw_len););
codec_events::decoder_event(p, DECODE_ICMP_DGRAM_LT_ICMPHDR);
else
{
DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
- "WARNING: Truncated ICMP header (%d bytes).\n", len););
+ "WARNING: Truncated ICMP header (%d bytes).\n", raw_len););
codec_events::decoder_event(p, DECODE_ICMP_DGRAM_LT_ICMPHDR);
else
{
DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
- "WARNING: Truncated ICMP header (%d bytes).\n", len););
+ "WARNING: Truncated ICMP header (%d bytes).\n", raw_len););
codec_events::decoder_event(p, DECODE_ICMP_DGRAM_LT_ICMPHDR);
else
{
DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
- "WARNING: Truncated ICMP header (%d bytes).\n", len););
+ "WARNING: Truncated ICMP header (%d bytes).\n", raw_len););
codec_events::decoder_event(p, DECODE_ICMP_DGRAM_LT_ICMPHDR);
~IgmpCodec() {};
- virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
virtual void get_protocol_ids(std::vector<uint16_t>&);
-bool IgmpCodec::decode(const uint8_t *raw_pkt, const uint32_t len,
+bool IgmpCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *p, uint16_t& /*lyr_len*/, uint16_t& /*next_prot_id*/)
{
int i, alert = 0;
- if (len >= 1 && raw_pkt[0] == 0x11)
+ if (raw_len >= 1 && raw_pkt[0] == 0x11)
{
if (p->ip_options_data != NULL) {
if (p->ip_options_len >= 2) {
virtual PROTO_ID get_proto_id() { return PROTO_IP4; };
virtual void get_protocol_ids(std::vector<uint16_t>& v);
- virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in);
virtual bool update(Packet*, Layer*, uint32_t* len);
*
* Returns: void function
*/
-bool Ipv4Codec::decode(const uint8_t *raw_pkt, const uint32_t len,
+bool Ipv4Codec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
{
uint32_t ip_len; /* length from the start of the ip hdr to the pkt end */
uint16_t hlen; /* ip header length */
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Packet!\n"););
-
/* do a little validation */
- if(len < ipv4::hdr_len())
+ if(raw_len < ipv4::hdr_len())
{
DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
- "WARNING: Truncated IP4 header (%d bytes).\n", len););
+ "WARNING: Truncated IP4 header (%d bytes).\n", raw_len););
if ((p->packet_flags & PKT_UNSURE_ENCAP) == 0)
codec_events::decoder_event(p, DECODE_IP4_HDR_TRUNC);
if (p->encapsulated)
{
codec_events::decoder_alert_encapsulated(p, DECODE_IP_MULTIPLE_ENCAPSULATION,
- raw_pkt, len);
+ raw_pkt, raw_len);
return false;
}
return false;
}
- if (ip_len > len)
+ if (ip_len > raw_len)
{
DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
"IP Len field is %d bytes bigger than captured length.\n"
" (ip.len: %lu, cap.len: %lu)\n",
- ip_len - len, ip_len, len););
+ ip_len - raw_len, ip_len, raw_len););
codec_events::decoder_event(p, DECODE_IPV4_DGRAM_GT_CAPLEN);
/* set the real IP length for logging */
p->actual_ip_len = (uint16_t) ip_len;
- p->packet_flags |= PKT_NEW_IP_LEN;
/* set the remaining packet length */
+ const_cast<uint32_t&>(raw_len) = ip_len;
ip_len -= hlen;
/* check for fragmented packets */
virtual PROTO_ID get_proto_id() { return PROTO_IP6; };
virtual void get_protocol_ids(std::vector<uint16_t>& v);
- virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in);
virtual bool update(Packet*, Layer*, uint32_t* len);
}
-bool Ipv6Codec::decode(const uint8_t *raw_pkt, const uint32_t len,
+bool Ipv6Codec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
{
ipv6::IP6RawHdr *hdr;
uint32_t payload_len;
-
hdr = reinterpret_cast<ipv6::IP6RawHdr*>(const_cast<uint8_t*>(raw_pkt));
- if(len < ipv6::hdr_len())
+ if(raw_len < ipv6::hdr_len())
{
if ((p->packet_flags & PKT_UNSURE_ENCAP) == 0)
codec_events::decoder_event(p, DECODE_IPV6_TRUNCATED);
{
codec_events::decoder_alert_encapsulated(p, DECODE_IP_MULTIPLE_ENCAPSULATION,
- raw_pkt, len);
+ raw_pkt, raw_len);
goto decodeipv6_fail;
}
else
payload_len = ntohs(hdr->ip6plen) + ipv6::hdr_len();
- if(payload_len != len)
+ if(payload_len != raw_len)
{
- if (payload_len > len)
+ if (payload_len > raw_len)
{
if ((p->packet_flags & PKT_UNSURE_ENCAP) == 0)
codec_events::decoder_event(p, DECODE_IPV6_DGRAM_GT_CAPLEN);
p->actual_ip_len = ntohs(p->ip6h->len);
p->ip_data = raw_pkt + ipv6::hdr_len();
p->ip_dsize = ntohs(p->ip6h->len);
- p->packet_flags |= PKT_NEW_IP_LEN;
p->proto_bits |= PROTO_BIT__IP;
+ // extra ipv6 header will be removed in PacketManager
+ const_cast<uint32_t&>(raw_len) = p->actual_ip_len + ipv6::hdr_len();
-
- lyr_len = sizeof(*hdr);
IPV6MiscTests(p);
next_prot_id = GET_IPH_PROTO(p);
virtual void get_protocol_ids(std::vector<uint16_t>&);
- virtual bool decode(const uint8_t *raw_pkt, const uint32_t raw_len,
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
};
v.push_back(IPPROTO_ID_MOBILITY);
}
-bool MobilityCodec::decode(const uint8_t* raw_pkt, const uint32_t raw_len,
+bool MobilityCodec::decode(const uint8_t* raw_pkt, const uint32_t& raw_len,
Packet* p, uint16_t& /*lyr_len*/, uint16_t& /*next_prot_id*/)
{
codec_events::decoder_event(p, DECODE_IP_BAD_PROTO);
~Ipv6NoNextCodec() {};
- virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
virtual void get_protocol_ids(std::vector<uint16_t>&);
};
} // namespace
-bool Ipv6NoNextCodec::decode(const uint8_t* /*raw_pkt*/, const uint32_t /*len*/,
+bool Ipv6NoNextCodec::decode(const uint8_t* /*raw_pkt*/, const uint32_t& /*raw_len*/,
Packet *p, uint16_t& lyr_len, uint16_t& /*next_prot_id*/)
{
/* See if there are any ip_proto only rules that match */
~PgmCodec() {};
- virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
virtual void get_protocol_ids(std::vector<uint16_t>&);
// private functions
//-------------------------------------------------------------------------
-bool PgmCodec::decode(const uint8_t* /*raw_pkt*/, const uint32_t /*len*/,
+bool PgmCodec::decode(const uint8_t* /*raw_pkt*/, const uint32_t& /*raw_len*/,
Packet *p, uint16_t& /*lyr_len*/, uint16_t& /*next_prot_id*/)
{
if ( pgm_nak_detect((uint8_t *)p->data, p->dsize) == PGM_NAK_VULN )
~Ipv6RoutingCodec() {};
- virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
virtual void get_protocol_ids(std::vector<uint16_t>&);
} // namespace
-bool Ipv6RoutingCodec::decode(const uint8_t *raw_pkt, const uint32_t len,
+bool Ipv6RoutingCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
{
const IP6Route *rte = reinterpret_cast<const IP6Route *>(raw_pkt);
ipv6_util::CheckIPv6ExtensionOrder(p);
- if(len < ipv6::min_ext_len())
+ if(raw_len < ipv6::min_ext_len())
{
codec_events::decoder_event(p, DECODE_IPV6_TRUNCATED_EXT);
return false;
return false;
}
- if (len < sizeof(IP6Route))
+ if (raw_len < sizeof(IP6Route))
{
codec_events::decoder_event(p, DECODE_IPV6_TRUNCATED_EXT);
return false;
}
lyr_len = ipv6::min_ext_len() + (rte->ip6rte_len << 3);
- if(lyr_len > len)
+ if(lyr_len > raw_len)
{
codec_events::decoder_event(p, DECODE_IPV6_TRUNCATED_EXT);
return false;
virtual void get_protocol_ids(std::vector<uint16_t>&);
- virtual bool decode(const uint8_t *raw_pkt, const uint32_t raw_len,
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
};
v.push_back(IPPROTO_ID_SUN_ND);
}
-bool SunNdCodec::decode(const uint8_t* raw_pkt, const uint32_t raw_len,
+bool SunNdCodec::decode(const uint8_t* raw_pkt, const uint32_t& raw_len,
Packet* p, uint16_t& /*lyr_len*/, uint16_t& /*next_prot_id*/)
{
codec_events::decoder_event(p, DECODE_IP_BAD_PROTO);
virtual ~SwipeCodec(){};
virtual void get_protocol_ids(std::vector<uint16_t>& v);
- virtual bool decode(const uint8_t* raw_packet, const uint32_t raw_len,
+ virtual bool decode(const uint8_t* raw_packet, const uint32_t& raw_len,
Packet *p, uint16_t &lyr_len, uint16_t &);
};
} // namespace
}
-bool SwipeCodec::decode(const uint8_t* /*raw_packet*/, const uint32_t /*raw_len*/,
+bool SwipeCodec::decode(const uint8_t* /*raw_packet*/, const uint32_t& /*raw_len*/,
Packet *p, uint16_t& /*lyr_len*/, uint16_t& /*next_prot_id*/)
{
// currently unsupported
virtual PROTO_ID get_proto_id() { return PROTO_TCP; };
virtual void get_protocol_ids(std::vector<uint16_t>& v);
- virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *, uint16_t &lyr_len, uint16_t &);
virtual bool encode(EncState*, Buffer* out, const uint8_t *raw_in);
virtual bool update(Packet*, Layer*, uint32_t* len);
*
* Returns: void function
*/
-bool TcpCodec::decode(const uint8_t *raw_pkt, const uint32_t len,
+bool TcpCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *p, uint16_t &lyr_len, uint16_t& /*next_prot_id*/)
{
- if(len < tcp::hdr_len())
+ if(raw_len < tcp::hdr_len())
{
DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
- "TCP packet (len = %d) cannot contain " "20 byte header\n", len););
+ "TCP packet (len = %d) cannot contain " "20 byte header\n", raw_len););
codec_events::decoder_event(p, DECODE_TCP_DGRAM_LT_TCPHDR);
lyr_len = TCP_OFFSET(p->tcph) << 2;
DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "TCP th_off is %d, passed len is %lu\n",
- TCP_OFFSET(p->tcph), (unsigned long)len););
+ TCP_OFFSET(p->tcph), (unsigned long)raw_len););
if(lyr_len < tcp::hdr_len())
{
return false;
}
- if(lyr_len > len)
+ if(lyr_len > raw_len)
{
DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
"TCP Data Offset(%d) < longer than payload(%d)!\n",
- TCP_OFFSET(p->tcph) << 2, len););
+ TCP_OFFSET(p->tcph) << 2, raw_len););
codec_events::decoder_event(p, DECODE_TCP_LARGE_OFFSET);
/* setup the pseudo header for checksum calculation */
ph.zero = 0;
ph.protocol = GET_IPH_PROTO(p);
- ph.len = htons((uint16_t)len);
+ ph.len = htons((uint16_t)raw_len);
/* if we're being "stateless" we probably don't care about the TCP
* checksum, but it's not bad to keep around for shits and giggles */
/* calculate the checksum */
- csum = checksum::tcp_cksum((uint16_t *)(p->tcph), len, &ph);
+ csum = checksum::tcp_cksum((uint16_t *)(p->tcph), raw_len, &ph);
}
/* IPv6 traffic */
COPY4(ph6.dip, p->ip6h->ip_dst.ip32);
ph6.zero = 0;
ph6.protocol = GET_IPH_PROTO(p);
- ph6.len = htons((uint16_t)len);
+ ph6.len = htons((uint16_t)raw_len);
- csum = checksum::tcp_cksum((uint16_t *)(p->tcph), len, &ph6);
+ csum = checksum::tcp_cksum((uint16_t *)(p->tcph), raw_len, &ph6);
}
if(csum)
/* set the data pointer and size */
p->data = (uint8_t *) (raw_pkt + lyr_len);
- if(lyr_len < len)
+ if(lyr_len < raw_len)
{
- p->dsize = (uint16_t)(len - lyr_len);
+ p->dsize = (uint16_t)(raw_len - lyr_len);
}
else
{
virtual PROTO_ID get_proto_id() { return PROTO_UDP; };
virtual void get_protocol_ids(std::vector<uint16_t>& v);
- virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
virtual bool encode(EncState*, Buffer* out, const uint8_t *raw_in);
}
-bool UdpCodec::decode(const uint8_t *raw_pkt, const uint32_t len,
+bool UdpCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
{
uint16_t uhlen;
if (p->proto_bits & (PROTO_BIT__TEREDO | PROTO_BIT__GTP))
p->outer_udph = p->udph;
- if(len < sizeof(udp::UDPHdr))
+ if(raw_len < sizeof(udp::UDPHdr))
{
DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
- "Truncated UDP header (%d bytes)\n", len););
+ "Truncated UDP header (%d bytes)\n", raw_len););
codec_events::decoder_event(p, DECODE_UDP_DGRAM_LT_UDPHDR);
fragmented_udp_flag = 1;
}
- /* verify that the header len is a valid value */
+ /* verify that the header raw_len is a valid value */
if(uhlen < UDP_HEADER_LEN)
{
codec_events::decoder_event(p, DECODE_UDP_DGRAM_INVALID_LENGTH);
}
/* make sure there are enough bytes as designated by length field */
- if(uhlen > len)
+ if(uhlen > raw_len)
{
codec_events::decoder_event(p, DECODE_UDP_DGRAM_SHORT_PACKET);
PopUdp(p);
return false;
}
- else if(uhlen < len)
+ else if(uhlen < raw_len)
{
codec_events::decoder_event(p, DECODE_UDP_DGRAM_LONG_PACKET);
COPY4(ph6.dip, p->ip6h->ip_dst.ip32);
ph6.zero = 0;
ph6.protocol = GET_IPH_PROTO(p);
- ph6.len = htons((u_short)len);
+ ph6.len = htons((u_short)raw_len);
csum = checksum::udp_cksum((uint16_t *)(p->udph), uhlen, &ph6);
}
virtual PROTO_ID get_proto_id() { return PROTO_ARP; };
virtual void get_protocol_ids(std::vector<uint16_t>& v);
- virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *, uint16_t &lyr_len, uint16_t &);
};
*
* Returns: void function
*/
-bool ArpCodec::decode(const uint8_t* /*raw_pkt*/, const uint32_t len,
+bool ArpCodec::decode(const uint8_t* /*raw_pkt*/, const uint32_t& raw_len,
Packet *p, uint16_t &lyr_len, uint16_t& /* next_prot_id */)
{
- if(len < sizeof(EtherARP))
+ if(raw_len < sizeof(EtherARP))
{
codec_events::decoder_event(p, DECODE_ARP_TRUNCATED);
return false;
~EapolCodec() {};
- virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
virtual void get_protocol_ids(std::vector<uint16_t>&);
************** main codec functions ************
*************************************************/
-bool EapolCodec::decode(const uint8_t *raw_pkt, const uint32_t len,
+bool EapolCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *p, uint16_t & /*lyr_len*/, uint16_t &/*next_prot_id */)
{
const eapol::EtherEapol* eplh = reinterpret_cast<const eapol::EtherEapol*>(raw_pkt);
- if(len < sizeof(eapol::EtherEapol))
+ if(raw_len < sizeof(eapol::EtherEapol))
{
codec_events::decoder_event(p, DECODE_EAPOL_TRUNCATED);
return false;
}
if (eplh->eaptype == EAPOL_TYPE_EAP) {
- DecodeEAP(raw_pkt + sizeof(eapol::EtherEapol), len - sizeof(eapol::EtherEapol), p);
+ DecodeEAP(raw_pkt + sizeof(eapol::EtherEapol), raw_len - sizeof(eapol::EtherEapol), p);
}
else if(eplh->eaptype == EAPOL_TYPE_KEY) {
- DecodeEapolKey(raw_pkt + sizeof(eapol::EtherEapol), len - sizeof(eapol::EtherEapol), p);
+ DecodeEapolKey(raw_pkt + sizeof(eapol::EtherEapol), raw_len - sizeof(eapol::EtherEapol), p);
}
return true;
virtual PROTO_ID get_proto_id() { return PROTO_ERSPAN; };
virtual void get_protocol_ids(std::vector<uint16_t>& v);
- virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
};
* Returns: void function
*
*/
-bool Erspan2Codec::decode(const uint8_t *raw_pkt, const uint32_t len,
+bool Erspan2Codec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
{
lyr_len = sizeof(ERSpanType2Hdr);
ERSpanType2Hdr *erSpan2Hdr = (ERSpanType2Hdr *)raw_pkt;
- if (len < sizeof(ERSpanType2Hdr))
+ if (raw_len < sizeof(ERSpanType2Hdr))
{
- codec_events::decoder_alert_encapsulated(p, DECODE_ERSPAN2_DGRAM_LT_HDR, raw_pkt, len);
+ codec_events::decoder_alert_encapsulated(p, DECODE_ERSPAN2_DGRAM_LT_HDR,
+ raw_pkt, raw_len);
return false;
}
/* discard packet - multiple encapsulation */
/* not sure if this is ever used but I am assuming it is not */
codec_events::decoder_alert_encapsulated(p, DECODE_IP_MULTIPLE_ENCAPSULATION,
- raw_pkt, len);
+ raw_pkt, raw_len);
return false;
}
if (erspan_version(erSpan2Hdr) != 0x01) /* Type 2 == version 0x01 */
{
codec_events::decoder_alert_encapsulated(p, DECODE_ERSPAN_HDR_VERSION_MISMATCH,
- raw_pkt, len);
+ raw_pkt, raw_len);
return false;
}
virtual void get_protocol_ids(std::vector<uint16_t>& v);
- virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
virtual PROTO_ID get_proto_id() { return PROTO_ERSPAN; };
* Returns: void function
*
*/
-bool Erspan3Codec::decode(const uint8_t *raw_pkt, const uint32_t len,
+bool Erspan3Codec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
{
lyr_len = sizeof(ERSpanType3Hdr);
ERSpanType3Hdr *erSpan3Hdr = (ERSpanType3Hdr *)raw_pkt;
- if (len < sizeof(ERSpanType3Hdr))
+ if (raw_len < sizeof(ERSpanType3Hdr))
{
codec_events::decoder_alert_encapsulated(p, DECODE_ERSPAN3_DGRAM_LT_HDR,
- raw_pkt, len);
+ raw_pkt, raw_len);
return false;
}
/* discard packet - multiple encapsulation */
/* not sure if this is ever used but I am assuming it is not */
codec_events::decoder_alert_encapsulated(p, DECODE_IP_MULTIPLE_ENCAPSULATION,
- raw_pkt, len);
+ raw_pkt, raw_len);
return false;
}
if (erspan_version(erSpan3Hdr) != 0x02) /* Type 3 == version 0x02 */
{
codec_events::decoder_alert_encapsulated(p, DECODE_ERSPAN_HDR_VERSION_MISMATCH,
- raw_pkt, len);
+ raw_pkt, raw_len);
return false;
}
virtual void get_protocol_ids(std::vector<uint16_t>& v);
- virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
v.push_back(ETHERNET_TYPE_LOOP);
}
-bool EthLoopbackCodec::decode(const uint8_t* /*raw_pkt*/, const uint32_t /*raw_len*/,
+bool EthLoopbackCodec::decode(const uint8_t* /*raw_pkt*/, const uint32_t& /*raw_len*/,
Packet* /*p*/, uint16_t& /*lyr_len*/, uint16_t& /*next_prot_id*/)
{
virtual PROTO_ID get_proto_id() { return PROTO_MPLS; };
virtual void get_protocol_ids(std::vector<uint16_t>& v);
- virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
};
}
-bool MplsCodec::decode(const uint8_t *raw_pkt, const uint32_t len,
+bool MplsCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
{
const uint32_t* tmpMplsHdr;
uint8_t bos = 0;
uint8_t ttl;
uint8_t chainLen = 0;
- uint32_t stack_len = len;
+ uint32_t stack_len = raw_len;
int iRet = 0;
- UpdateMPLSStats(&sfBase, len, Active_PacketWasDropped());
+ UpdateMPLSStats(&sfBase, raw_len, Active_PacketWasDropped());
tmpMplsHdr = (const uint32_t *) raw_pkt;
while (!bos)
virtual PROTO_ID get_proto_id() { return PROTO_PPP_ENCAP; };
virtual void get_protocol_ids(std::vector<uint16_t>& v);
- virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
};
*
* Returns: void function
*/
-bool PppEncap::decode(const uint8_t *raw_pkt, const uint32_t len,
+bool PppEncap::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
{
static THREAD_LOCAL bool had_vj = false;
/* do a little validation:
*
*/
- if(len < 2)
+ if(raw_len < 2)
{
if (ScLogVerbose())
{
case PPP_VJ_UCOMP:
/* VJ compression modifies the protocol field. It must be set
* to tcp (only TCP packets can be VJ compressed) */
- if(len < (lyr_len + ipv4::hdr_len()))
+ if(raw_len < (lyr_len + ipv4::hdr_len()))
{
if (ScLogVerbose())
ErrorMessage("PPP VJ min packet length > captured len! "
- "(%d bytes)\n", len);
+ "(%d bytes)\n", raw_len);
return false;
}
virtual PROTO_ID get_proto_id() { return PROTO_PPPOE; };
virtual void get_protocol_ids(std::vector<uint16_t>& v);
- virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in);
};
}
-bool PPPoEDiscCodec::decode(const uint8_t *raw_pkt, const uint32_t raw_len,
+bool PPPoEDiscCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
{
return pppoepkt_decode(raw_pkt, raw_len, p, PppoepktType::DISCOVERY,
virtual PROTO_ID get_proto_id() { return PROTO_PPPOE; };
virtual void get_protocol_ids(std::vector<uint16_t>& v);
- virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in);
};
}
-bool PPPoESessCodec::decode(const uint8_t *raw_pkt, const uint32_t raw_len,
+bool PPPoESessCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
{
return pppoepkt_decode(raw_pkt, raw_len, p, PppoepktType::SESSION,
virtual void get_protocol_ids(std::vector<uint16_t>& v);
- virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
};
* convention needed to be changed and the stuff at the beginning
* wasn't needed since we are already deep into the packet
*/
-bool TransbridgeCodec::decode(const uint8_t *raw_pkt, const uint32_t raw_len,
+bool TransbridgeCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
{
if(raw_len < eth::hdr_len())
virtual PROTO_ID get_proto_id() { return PROTO_VLAN; };
virtual void get_protocol_ids(std::vector<uint16_t>& v);
- virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
};
}
-bool VlanCodec::decode(const uint8_t *raw_pkt, const uint32_t len,
+bool VlanCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
{
- if(len < sizeof(vlan::VlanTagHdr))
+ if(raw_len < sizeof(vlan::VlanTagHdr))
{
codec_events::decoder_event(p, DECODE_BAD_VLAN);
*/
if(ntohs(vh->vth_proto) <= ETHERNET_MAX_LEN_ENCAP)
{
- if(len < sizeof(vlan::VlanTagHdr) + sizeof(EthLlc))
+ if(raw_len < sizeof(vlan::VlanTagHdr) + sizeof(EthLlc))
{
codec_events::decoder_event(p, DECODE_BAD_VLAN_ETHLLC);
if(ehllc->dsap == ETH_DSAP_IP && ehllc->ssap == ETH_SSAP_IP)
{
- if ( len < len_vlan_llc_other() )
+ if (raw_len < len_vlan_llc_other())
{
codec_events::decoder_event(p, DECODE_BAD_VLAN_OTHER);
~DefaultCodec(){};
virtual void get_protocol_ids(std::vector<uint16_t>& v);
- virtual bool decode(const uint8_t*, const uint32_t,
+ virtual bool decode(const uint8_t*, const uint32_t&,
Packet*, uint16_t&, uint16_t&) { return false; };
};
virtual PROTO_ID get_proto_id() { return PROTO_GTP; };
virtual void get_protocol_ids(std::vector<uint16_t>& v);
- virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in);
virtual bool update(Packet*, Layer*, uint32_t* len);
*
*/
-bool GtpCodec::decode(const uint8_t *raw_pkt, const uint32_t len,
+bool GtpCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
{
uint8_t next_hdr_type;
if (p->GTPencapsulated)
{
codec_events::decoder_alert_encapsulated(p, DECODE_GTP_MULTIPLE_ENCAPSULATION,
- raw_pkt, len);
+ raw_pkt, raw_len);
return false;
}
else
p->GTPencapsulated = 1;
}
/*Check the length*/
- if (len < GTP_MIN_LEN)
+ if (raw_len < GTP_MIN_LEN)
return false;
/* We only care about PDU*/
if ( hdr->type != 255)
lyr_len = GTP_V0_HEADER_LEN;
/*Check header fields*/
- if (len < lyr_len)
+ if (raw_len < lyr_len)
{
codec_events::decoder_event(p, DECODE_GTP_BAD_LEN);
return false;
p->proto_bits |= PROTO_BIT__GTP;
/*Check the length field. */
- if (len != ((unsigned int)ntohs(hdr->length) + lyr_len))
+ if (raw_len != ((unsigned int)ntohs(hdr->length) + lyr_len))
{
DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Calculated length %d != %d in header.\n",
- len - lyr_len, ntohs(hdr->length)););
+ raw_len - lyr_len, ntohs(hdr->length)););
codec_events::decoder_event(p, DECODE_GTP_BAD_LEN);
return false;
}
lyr_len = GTP_V1_HEADER_LEN;
/*Check optional fields*/
- if (len < lyr_len)
+ if (raw_len < lyr_len)
{
codec_events::decoder_event(p, DECODE_GTP_BAD_LEN);
return false;
{
uint16_t ext_hdr_len;
/*check length before reading data*/
- if (len < (uint32_t)(lyr_len + 4))
+ if (raw_len < (uint32_t)(lyr_len + 4))
{
codec_events::decoder_event(p, DECODE_GTP_BAD_LEN);
return false;
lyr_len += ext_hdr_len * 4;
/*check length before reading data*/
- if (len < lyr_len)
+ if (raw_len < lyr_len)
{
codec_events::decoder_event(p, DECODE_GTP_BAD_LEN);
return false;
p->proto_bits |= PROTO_BIT__GTP;
/*Check the length field. */
- if (len != ((unsigned int)ntohs(hdr->length) + GTP_MIN_LEN))
+ if (raw_len != ((unsigned int)ntohs(hdr->length) + GTP_MIN_LEN))
{
DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Calculated length %d != %d in header.\n",
- len - GTP_MIN_LEN, ntohs(hdr->length)););
+ raw_len - GTP_MIN_LEN, ntohs(hdr->length)););
codec_events::decoder_event(p, DECODE_GTP_BAD_LEN);
return false;
}
Active_SetTunnelBypass();
- if (len > 0)
+ if (raw_len > 0)
{
p->packet_flags |= PKT_UNSURE_ENCAP;
~TeredoCodec(){};
virtual void get_protocol_ids(std::vector<uint16_t>& v);
- virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
};
v.push_back(PROTOCOL_TEREDO);
}
-bool TeredoCodec::decode(const uint8_t *raw_pkt, const uint32_t len,
+bool TeredoCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
{
- if (len < teredo::min_hdr_len())
+ if (raw_len < teredo::min_hdr_len())
return false;
/* Decode indicators. If both are present, Auth always comes before Origin. */
{
uint8_t client_id_length, auth_data_length;
- if (len < teredo::min_indicator_auth_len())
+ if (raw_len < teredo::min_indicator_auth_len())
return false;
client_id_length = *(raw_pkt + 2);
auth_data_length = *(raw_pkt + 3);
- if (len < (uint32_t)(teredo::min_indicator_auth_len() + client_id_length + auth_data_length))
+ if (raw_len < (uint32_t)(teredo::min_indicator_auth_len() + client_id_length + auth_data_length))
return false;
raw_pkt += (teredo::min_indicator_auth_len() + client_id_length + auth_data_length);
if (ntohs(*(uint16_t *)raw_pkt) == teredo::indicator_origin())
{
- if (len < teredo::indicator_origin_len())
+ if (raw_len < teredo::indicator_origin_len())
return false;
raw_pkt += teredo::indicator_origin_len();
virtual PROTO_ID get_proto_id() { return PROTO_ETH; };
virtual void get_protocol_ids(std::vector<uint16_t>&) {};
virtual void get_data_link_type(std::vector<int>&);
- virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id);
virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in);
virtual bool update(Packet*, Layer*, uint32_t* len);
*
* Returns: void function
*/
-bool EthCodec::decode(const uint8_t *raw_pkt, const uint32_t len,
+bool EthCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *p, uint16_t &lyr_len, uint16_t& next_prot_id)
{
/* do a little validation */
- if(len < eth::hdr_len())
+ if(raw_len < eth::hdr_len())
{
DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
- "WARNING: Truncated eth header (%d bytes).\n", len););
+ "WARNING: Truncated eth header (%d bytes).\n", raw_len););
codec_events::decoder_event(p, DECODE_ETH_HDR_TRUNC);
virtual void get_data_link_type(std::vector<int>&);
- virtual bool decode(const uint8_t *raw_pkt, const uint32_t raw_len,
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t &raw_len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
};
#endif
}
-bool LinuxSllCodec::decode(const uint8_t *raw_pkt, const uint32_t raw_len,
+bool LinuxSllCodec::decode(const uint8_t *raw_pkt, const uint32_t &raw_len,
Packet* /*p*/, uint16_t &lyr_len, uint16_t &next_prot_id)
{
/* do a little validation */
~NullCodec() {};
- virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
virtual void get_data_link_type(std::vector<int>&);
*
* Returns: void function
*/
-bool NullCodec::decode(const uint8_t* /*raw_pkt*/, const uint32_t raw_len,
+bool NullCodec::decode(const uint8_t* /*raw_pkt*/, const uint32_t& raw_len,
Packet* /*p*/, uint16_t &lyr_len, uint16_t &next_prot_id)
{
DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "NULL Packet!\n"); );
~Raw4Codec() {};
- virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
virtual void get_data_link_type(std::vector<int>&);
*
* Returns: void function
*/
-bool Raw4Codec::decode(const uint8_t* /*raw_pkt*/, const uint32_t /*raw_len*/,
+bool Raw4Codec::decode(const uint8_t* /*raw_pkt*/, const uint32_t& /*raw_len*/,
Packet* /*p*/, uint16_t& /*lyr_len*/, uint16_t &next_prot_id)
{
DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Raw IP4 Packet!\n"););
Raw6Codec() : Codec(CD_RAW6_NAME){};
~Raw6Codec() {};
- virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
virtual void get_data_link_type(std::vector<int>&);
// raw packets are predetermined to be ip4 (above) or ip6 (below) by the DLT
-bool Raw6Codec::decode(const uint8_t* /*raw_pkt*/, const uint32_t /*raw_len*/,
+bool Raw6Codec::decode(const uint8_t* /*raw_pkt*/, const uint32_t& /*raw_len*/,
Packet* /*p*/, uint16_t& /*lyr_len*/, uint16_t& next_prot_id)
{
DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Raw IP6 Packet!\n"););
~WlanCodec() {};
- virtual bool decode(const uint8_t *raw_pkt, const uint32_t raw_len,
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
virtual void get_data_link_type(std::vector<int>&);
#endif
}
-bool WlanCodec::decode(const uint8_t *raw_pkt, const uint32_t raw_len,
+bool WlanCodec::decode(const uint8_t *raw_pkt, const uint32_t &raw_len,
Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
{
uint32_t cap_len = raw_len;
~NameCodec() {};
- virtual bool decode(const uint8_t *raw_pkt, const uint32_t raw_len,
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t &raw_len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
virtual void get_protocol_ids(std::vector<uint16_t>&);
// v.push_back(PROTO_TYPE);
}
-bool NameCodec::decode(const uint8_t *raw_pkt, const uint32_t raw_len,
+bool NameCodec::decode(const uint8_t *raw_pkt, const uint32_t &raw_len,
Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
{
// reinterpret the raw data into this codec's data format
// Register the code's protocol ID's and Ethertypes
virtual void get_protocol_ids(std::vector<uint16_t>&) {};
// decode function
- virtual bool decode(const uint8_t* raw_packet, const uint32_t raw_len,
+ virtual bool decode(const uint8_t* raw_packet, const uint32_t& raw_len,
Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) = 0;
//
uint16_t prot_id;
uint8_t mapped_prot = grinder;
uint16_t prev_prot_id = FINISHED_DECODE;
- uint16_t len, lyr_len;
-
+ uint16_t lyr_len = 0;
+ uint32_t len = 0;
DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Packet!\n");
DebugMessage(DEBUG_DECODE, "caplen: %lu pktlen: %lu\n",
len -= lyr_len;
pkt += lyr_len;
lyr_len = 0;
-
- // since the IP length and the packet length may not be equal.
- if (p->packet_flags & PKT_NEW_IP_LEN)
- {
- len = p->ip_dsize;
- p->packet_flags &= ~PKT_NEW_IP_LEN;
- }
}
// if the final protocol ID is not the default codec, a Codec failed
if (prev_prot_id != FINISHED_DECODE)
{
- // if the codec exists, it failed
- if(s_proto_map[prev_prot_id])
- s_stats[discards]++;
- else
- s_stats[other_codecs]++;
+ if (!(p->packet_flags & PKT_UNSURE_ENCAP))
+ {
+ // if the codec exists, it failed
+ if(s_proto_map[prev_prot_id])
+ s_stats[discards]++;
+ else
+ s_stats[other_codecs]++;
+ }
+
+ if (p->packet_flags & PKT_ESP_LYR_PRESENT)
+ p->packet_flags |= PKT_TRUST;
}
if (p->ip6_extension_count > 0)
ipv6_util::CheckIPv6ExtensionOrder(p);
s_stats[mapped_prot + stat_offset]++;
+ p->packet_flags &= ~PKT_ESP_LYR_PRESENT; // cleanup. Just in case.
p->dsize = len;
p->data = pkt;
+
PREPROC_PROFILE_END(decodePerfStats);
}
|| (p->packet_flags & PKT_RESIZED)
)
pkth->caplen = pkth->pktlen = len;
-
- p->packet_flags &= ~PKT_LOGGED;
}
//-------------------------------------------------------------------------
#define PKT_IP_RULE 0x00040000 /* this packet is being evaluated against an IP rule */
#define PKT_IP_RULE_2ND 0x00080000 /* this packet is being evaluated against an IP rule */
-#define PKT_LOGGED 0x00100000 /* this packet has been logged */
-#define PKT_PSEUDO 0x00200000 /* is a pseudo packet */
-#define PKT_MODIFIED 0x00400000 /* packet had normalizations, etc. */
-#define PKT_RESIZED 0x00800000 /* packet has new size; must set modified too */
+#define PKT_PSEUDO 0x00100000 /* is a pseudo packet */
+#define PKT_MODIFIED 0x00200000 /* packet had normalizations, etc. */
+#define PKT_RESIZED 0x00300000 /* packet has new size; must set modified too */
// neither of these flags will be set for (full) retransmissions or non-data segments
// a partial overlap results in out of sequence condition
// out of sequence condition is sticky
-#define PKT_STREAM_ORDER_OK 0x01000000 /* this segment is in order, w/o gaps */
-#define PKT_STREAM_ORDER_BAD 0x02000000 /* this stream had at least one gap */
-#define PKT_REASSEMBLED_OLD 0x04000000 /* for backwards compat with so rules */
-
-#define PKT_IPREP_SOURCE_TRIGGERED 0x08000000
-#define PKT_IPREP_DATA_SET 0x10000000
-#define PKT_FILE_EVENT_SET 0x20000000
-#define PKT_NEW_IP_LEN 0X40000000 /* For Codecs to tell PacketManger a new length should be set */
-// 0x40000000 are available
+#define PKT_STREAM_ORDER_OK 0x00800000 /* this segment is in order, w/o gaps */
+#define PKT_STREAM_ORDER_BAD 0x01000000 /* this stream had at least one gap */
+#define PKT_REASSEMBLED_OLD 0x02000000 /* for backwards compat with so rules */
+
+#define PKT_FILE_EVENT_SET 0x04000000
+#define PKT_ESP_LYR_PRESENT 0x08000000
+// 0x40000000 are available
#define PKT_PDU_FULL (PKT_PDU_HEAD | PKT_PDU_TAIL)
#define REASSEMBLED_PACKET_FLAGS (PKT_REBUILT_STREAM|PKT_REASSEMBLED_OLD)
namespace {
-template<const std::string *snort_option,
- const std::string *lua_table_name,
- const std::string *lua_option_name>
+template<const std::string* snort_option,
+ const std::string* lua_table_name,
+ const std::string* lua_option_name>
class ConfigChecksum : public ConversionState
{
public:
}
};
-template<const std::string *snort_option, const std::string *lua_name, const std::string *lua_option_name = nullptr>
+template<const std::string *snort_option,
+ const std::string *lua_name,
+ const std::string *lua_option_name = nullptr>
static ConversionState* config_checksum_ctor(Converter* cv, LuaData* ld)
{
if (lua_option_name)
} // namespace
-template<const std::string* snort_option, const std::string* lua_table_name, const std::string* lua_option_name = nullptr>
+template<const std::string* snort_option,
+ const std::string* lua_table_name,
+ const std::string* lua_option_name = nullptr>
static ConversionState* config_true_no_opt_ctor(Converter* cv, LuaData* ld)
{
ld->open_table(*lua_table_name);
return new DeadCode(cv, ld);
}
-template<const std::string* snort_option, const std::string* lua_table_name, const std::string* lua_option_name = nullptr>
+template<const std::string* snort_option,
+ const std::string* lua_table_name,
+ const std::string* lua_option_name = nullptr>
static ConversionState* config_false_no_opt_ctor(Converter* cv, LuaData* ld)
{
ld->open_table(*lua_table_name);
(lua_option) &&
(*snort_option).compare(*lua_option))
{
- ld->add_diff_option_comment("config " + *snort_option + ":", *lua_option);
+ ld->add_diff_option_comment("config " + *snort_option +
+ ":", *lua_option);
}
bool retval = parse_int_option(*lua_option, stream);
// if the two names are not equal ...
if((*snort_option).compare(*lua_option))
- ld->add_diff_option_comment("config " + *snort_option + ":", *lua_option);
+ ld->add_diff_option_comment("config " + *snort_option +
+ ":", *lua_option);
// get length (stringstream will not read spaces...which we want)
const int pos = stream.tellg();
static inline void set_difference_print() {mode = PrintMode::DIFFERENCES; }
static inline bool is_difference_mode() { return mode == PrintMode::DIFFERENCES; }
inline bool failed_conversions() { return !errors->empty() || !bad_rules->empty(); }
- inline bool contains_rules() { return rules.size() != 0; }
+ inline bool contains_rules() { return rules.size() > 0; }
friend std::ostream &operator<<(std::ostream&, const LuaData &);
delete comments;
}
+bool Table::has_differences()
+{
+ if (!comments->empty())
+ return true;
+
+ for (Table* t : tables)
+ if (t->has_differences())
+ return true;
+
+ return false;
+}
+
Table* Table::open_table()
{
Table *t = new Table(depth + 1);
for (Variable* v : t.lists)
out << (*v) << ",\n";
+
+ for (Table* sub_t : t.tables)
+ out << (*sub_t) << ",\n";
+ }
+ else
+ {
+ for (Table* sub_t : t.tables)
+ if (sub_t->has_differences())
+ out << (*sub_t) << ",\n";
}
- for (Table* sub_t : t.tables)
- out << (*sub_t) << ",\n";
// don't add a comma if the depth is zero
if(t.depth == 0)
Table(std::string name, int depth);
virtual ~Table();
- inline std::string get_name(){ return name; };
+ inline std::string get_name(){ return name; }
+ bool has_differences();
Table* open_table();
Table* open_table(std::string);
bool add_option(std::string, int val);
std::istringstream format(keyword);
while (std::getline(format, val, ','))
{
- std::string new_val = std::string();
+ bool tmpval = true;
if (!val.compare("default"))
ld->add_deleted_comment("default");
else if (!val.compare("timestamp"))
- new_val = "timestamp";
+ tmpval = ld->add_list_to_table("csv", "timestamp");
else if (!val.compare("msg"))
- new_val = "msg";
+ tmpval = ld->add_list_to_table("csv", "msg");
+
+ else if (!val.compare("proto"))
+ tmpval = ld->add_list_to_table("csv", "proto");
+
+ else if (!val.compare("dst"))
+ tmpval = ld->add_list_to_table("csv", "dst");
+
+ else if (!val.compare("src"))
+ tmpval = ld->add_list_to_table("csv", "src");
+
+ else if (!val.compare("ttl"))
+ tmpval = ld->add_list_to_table("csv", "ttl");
+
+ else if (!val.compare("id"))
+ tmpval = ld->add_list_to_table("csv", "id");
+
+ else if (!val.compare("tos"))
+ tmpval = ld->add_list_to_table("csv", "tos");
else if (!val.compare("sig_generator"))
- new_val = "gid";
+ {
+ ld->add_diff_option_comment("sig_generator", "gid");
+ tmpval = ld->add_list_to_table("csv", "gid");
+ }
else if (!val.compare("sid_id"))
- new_val = "sid";
+ {
+ ld->add_diff_option_comment("sid_id", "sid");
+ tmpval = ld->add_list_to_table("csv", "sid");
+ }
else if (!val.compare("sig_rev"))
- new_val = "rev";
-
- else if (!val.compare("proto"))
- new_val = "proto";
-
- else if (!val.compare("src"))
- new_val = "src";
+ {
+ ld->add_diff_option_comment("sig_rev", "rev");
+ tmpval = ld->add_list_to_table("csv", "rev");
+ }
else if (!val.compare("srcport"))
- new_val = "src_port";
-
- else if (!val.compare("dst"))
- new_val = "dst";
+ {
+ ld->add_diff_option_comment("srcport", "src_port");
+ tmpval = ld->add_list_to_table("csv", "src_port");
+ }
else if (!val.compare("dstport"))
- new_val = "dst_port";
+ {
+ ld->add_diff_option_comment("dstport", "dst_port");
+ tmpval = ld->add_list_to_table("csv", "dst_port");
+ }
else if (!val.compare("ethsrc"))
- new_val = "eth_src";
+ {
+ ld->add_diff_option_comment("ethsrc", "eth_src");
+ tmpval = ld->add_list_to_table("csv", "eth_src");
+ }
else if (!val.compare("ethdst"))
- new_val = "eth_dst";
+ {
+ ld->add_diff_option_comment("ethdst", "eth_dst");
+ tmpval = ld->add_list_to_table("csv", "eth_dst");
+ }
else if (!val.compare("ethlen"))
- new_val = "eth_len";
+ {
+ ld->add_diff_option_comment("ethlen", "eth_len");
+ tmpval = ld->add_list_to_table("csv", "eth_len");
+ }
else if (!val.compare("tcpflags"))
- new_val = "tcp_flags";
+ {
+ ld->add_diff_option_comment("tcpflags", "tcp_flags");
+ tmpval = ld->add_list_to_table("csv", "tcp_flags");
+ }
else if (!val.compare("tcpseq"))
- new_val = "tcp_seq";
+ {
+ ld->add_diff_option_comment("tcpseq", "tcp_seq");
+ tmpval = ld->add_list_to_table("csv", "tcp_seq");
+ }
else if (!val.compare("tcpack"))
- new_val = "tcp_ack";
+ {
+ ld->add_diff_option_comment("tcpack", "tcp_ack");
+ tmpval = ld->add_list_to_table("csv", "tcp_ack");
+ }
else if (!val.compare("tcplen"))
- new_val = "tcp_len";
+ {
+ ld->add_diff_option_comment("tcplen", "tcp_len");
+ tmpval = ld->add_list_to_table("csv", "tcp_len");
+ }
else if (!val.compare("tcpwindow"))
- new_val = "tcp_win";
-
- else if (!val.compare("ttl"))
- new_val = "ttl";
-
- else if (!val.compare("tos"))
- new_val = "tos";
-
- else if (!val.compare("id"))
- new_val = "id";
+ {
+ ld->add_diff_option_comment("tcpwindow", "tcp_win");
+ tmpval = ld->add_list_to_table("csv", "tcp_win");
+ }
else if (!val.compare("dgmlen"))
- new_val = "dgm_len";
+ {
+ ld->add_diff_option_comment("dgmlen", "dgm_len");
+ tmpval = ld->add_list_to_table("csv", "dgm_len");
+ }
else if (!val.compare("iplen"))
- new_val = "ip_len";
+ {
+ ld->add_diff_option_comment("iplen", "ip_len");
+ tmpval = ld->add_list_to_table("csv", "ip_len");
+ }
else if (!val.compare("icmptype"))
- new_val = "icmp_type";
+ {
+ ld->add_diff_option_comment("icmptype", "icmp_type");
+ tmpval = ld->add_list_to_table("csv", "icmp_type");
+ }
else if (!val.compare("icmpcode"))
- new_val = "icmp_code";
+ {
+ ld->add_diff_option_comment("icmpcode", "icmp_code");
+ tmpval = ld->add_list_to_table("csv", "icmp_code");
+ }
else if (!val.compare("icmpid"))
- new_val = "icmp_id";
+ {
+ ld->add_diff_option_comment("icmpid", "icmp_id");
+ tmpval = ld->add_list_to_table("csv", "icmp_id");
+ }
else if (!val.compare("icmpseq"))
- new_val = "icmp_seq";
+ {
+ ld->add_diff_option_comment("icmpseq", "icmp_seq");
+ tmpval = ld->add_list_to_table("csv", "icmp_seq");
+ }
else
{
retval = false;
}
- if (!new_val.empty())
- {
- if (val.compare(new_val))
- ld->add_diff_option_comment(val, new_val);
-
- if (!ld->add_list_to_table("csv", new_val))
- retval = false;
- }
+ if (retval && !tmpval)
+ retval = false;
}
if (!(data_stream >> limit))
retval = ld->add_option_to_table("limit", limit) && retval;
retval = ld->add_option_to_table("units", units) && retval;
-
- // If we read something, more data available and bad input
- if (data_stream >> keyword)
- retval = false;
-
return retval;
}
template<const std::string* output_name>
static ConversionState* unified2_ctor(Converter* cv, LuaData* ld)
{
- ld->open_top_level_table("unified2"); // in case there are no arguments
+ ld->open_top_level_table("unified2"); // create table in case there are no arguments
ld->close_table();
return new Unified2<output_name>(cv, ld);
}
PerfMonitor(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
virtual ~PerfMonitor() {};
virtual bool convert(std::istringstream& data_stream);
+
private:
bool parse_file_option(std::istringstream& data_stream,
std::string orig_name,
ld->add_comment_to_table(orig_name + " deprecated. If '" + option_name +
" = true', Snort++ automatically prints to '" + new_file_name + "'");
- ld->add_diff_option_comment(orig_name, option_name + " = true");
tmpval = ld->add_option_to_table(option_name, true);
if (eat_option(data_stream)) // we no longer care about the file name.
"file", "perf_monitor.csv");
else if (!keyword.compare("snortfile"))
+ {
+ ld->add_diff_option_comment("snortfile", "file = true");
parse_file_option(data_stream, "snortfile",
"file", "perf_monitor.csv");
+ }
else if (!keyword.compare("flow-file"))
+ {
+ ld->add_diff_option_comment("flow-file", "flow_file = true");
parse_file_option(data_stream, "flow-file",
"flow_file", "perf_monitor_flow.csv");
+ }
else if (!keyword.compare("flow-ip-file"))
+ {
+ ld->add_diff_option_comment("flow-ip-file", "flow_ip_file = true");
parse_file_option(data_stream, "flow-ip-file",
"flow_ip_file", "perf_monitor_flow_ip.csv");
+ }
else if (!keyword.compare("accumulate"))
{
return false;
if( !dir.compare("client"))
+ {
+ ld->add_diff_option_comment("ports client", "client_ports");
opt_name = "client_ports";
+ }
else if( !dir.compare("server"))
+ {
+ ld->add_diff_option_comment("ports server", "server_ports");
opt_name = "server_ports";
+ }
else if( !dir.compare("both"))
+ {
+ ld->add_diff_option_comment("ports both", "both_ports");
opt_name = "both_ports";
+ }
else
return false;
+#if 0
+ // do nothing if no ports provided
+ if (stream >> protocol )
+ {
+ ld->open_top_level_table("binder");
+ ld->open_table();
+ ld->open_table("when");
+ ld->add_option_to_table("proto", "tcp");
+
+
+ if (!protocol.compare("all"))
+
+ else if (!protocol.compare("none"))
+
+ else
+ do
+ {
+
+ }while(stream >> protocol);
+
+ while (stream >> protocol)
+ tmpval = ld->add_list_to_table(lua_dir, protocol) && tmpval;
+ }
+
while(stream >> s_val)
retval = ld->add_list_to_table(opt_name, s_val) && retval;
-
ld->add_diff_option_comment("port " + dir, opt_name);
+
+#endif
return retval;
}
else
return false;
- // TODO: update funcitnoality if Snort++ StreamTcpModule is updated
while (stream >> protocol)
tmpval = ld->add_list_to_table(lua_dir, protocol) && tmpval;
- ld->add_diff_option_comment("protocol " + dir, lua_dir);
return true;
}
+
+
+ cv.initialize(&init_state_ctor, &ld);
+
+ // MAIN LOOP!! walk through every input file and begin converting!
+ option::Option* opt = options[CONF_FILE];
+ do {
+ if (cv.convert_file(std::string(opt->arg)) < 0)
+ {
+ print_line("Failed Conversion of file " + std::string(opt->arg));
+ fail = true;
+ }
+ } while ((opt = opt->next()));
+
+
+
// if no rule file is specified (or the same output and rule file specified),
// rules will be printed in the 'default_rules' variable. Set that up
// now. Otherwise, set up the include file.
}
-
- cv.initialize(&init_state_ctor, &ld);
-
- // MAIN LOOP!! walk through every input file and begin converting!
- option::Option* opt = options[CONF_FILE];
- do {
- if (cv.convert_file(std::string(opt->arg)) < 0)
- {
- print_line("Failed Conversion of file " + std::string(opt->arg));
- fail = true;
- }
- } while ((opt = opt->next()));
-
-
-
// finally, lets print the converter to file
std::ofstream out;
#include <sys/stat.h>
#include <iostream>
#include <string>
+#include <cstring>
#include "utils/snort2lua_util.h"
#include "conversion_state.h"
projects / thirdparty / snort3.git / commitdiff
