#include "protocols/udp.h"
#include "protocols/teredo.h"
#include "protocols/gtp.h"
+#include "protocols/undefined_protocols.h"
#include "framework/codec.h"
#include "codecs/codec_events.h"
ScDeepTeredoInspection())
{
if ( !p->frag_flag )
- next_prot_id = teredo::teredo_id();
+ next_prot_id = PROTOCOL_TEREDO;
}
if (ScGTPDecoding() &&
(ScIsGTPPort(p->sp)||ScIsGTPPort(p->dp)))
{
if ( !p->frag_flag )
- next_prot_id = gtp::gtp_id();
+ next_prot_id = PROTOCOL_GTP;
}
return true;
#include "snort_types.h"
#include "protocols/packet.h"
#include "profiler.h"
-#include "codecs/tmp/prot_mpls.h"
+#include "protocols/mpls.h"
cd_arp.cc
cd_ethloopback.cc
cd_gre.cc
+ cd_mpls.cc
+ cd_transbridge.cc
)
"protocols/encode.h"
+MPLS:
+ "Remove protocols/mpls.h"
+ Pull in default_mpls to cd_mpls. Remove it from the snort_config.
+ Create MPLS module which creates the default mpls
+
+Trans Bridge:
+ Is no longer solely GRE. Switcht he docer name?
+
+
*****************************************************************************
******************************** *******************************************
**************************** ***************************************
RUSS
-
--- Do we change the typedef factor for structs?
__________________________________________________________________________________________________________
}
/* protocol must be 0x880B - PPP */
- if (GRE_PROTO(p->greh) != PPP_ETHERTYPE)
+ if (GRE_PROTO(p->greh) != ETHERTYPE_PPP)
{
CodecEvents::decoder_alert_encapsulated(p, DECODE_GRE_V1_INVALID_HEADER,
raw_pkt, len);
#include "protocols/ipv6.h"
#include "packet_io/active.h"
+#include "protocols/undefined_protocols.h"
+
namespace
{
class GtpCodec : public Codec
{
public:
- GtpCodec() : Codec("gtp"){};
+ GtpCodec() : Codec("GTP"){};
~GtpCodec();
void GtpCodec::get_protocol_ids(std::vector<uint16_t>& v)
{
- v.push_back(gtp::gtp_id());
+ v.push_back(PROTOCOL_GTP);
}
static Codec* ctor()
** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
** GNU General Public License for more details.
**
-** You should have received a copy of the GNU General Public License
+** You should have received a copy of the GNU General Public LicenseUpdateMPLSStats
** along with this program; if not, write to the Free Software
** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
+#include "framework/codec.h"
+#include "codecs/codec_events.h"
+#include "codecs/decode_module.h"
+#include "network_inspectors/perf_monitor/perf_base.h"
+#include "network_inspectors/perf_monitor/perf.h"
+#include "snort.h"
+#include "protocols/mpls.h"
+#include "protocols/undefined_protocols.h"
+#include "codecs/codec_events.h"
+#include "packet_io/active.h"
+#include "protocols/ethertypes.h"
+#include "protocols/mpls.h"
+
+namespace
+{
-#ifdef HAVE_CONFIG_H
-#include "config.h"
-#endif
+class MplsCodec : public Codec
+{
+public:
+ MplsCodec() : Codec("MPLS"){};
+ ~MplsCodec();
+
+
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
+ Packet *, uint16_t &p_hdr_len, int &next_prot_id);
+
+ virtual void get_protocol_ids(std::vector<uint16_t>&);
+
+};
+
+
+const uint16_t ETHERNET_TYPE_MPLS_UNICAST = 0x8847;
+const uint16_t ETHERNET_TYPE_MPLS_MULTICAST = 0x8848;
+
+const static uint32_t MPLS_HEADER_LEN = 4;
+const static uint32_t NUM_RESERVED_LABELS = 16;
-#include "generators.h"
-#include "decode.h"
-#include "static_include.h"
+} // anonymous namespace
-#include "network_inspectors/perfmonitor/perf.h"
-#include "network_inspectors/perfmonitor/perf_base.h"
-#include "prot_mpls.h"
-#include "prot_ipv6.h"
-#include "prot_ipv4.h"
-#include "prot_ethloopback.h"
-#include "prot_ethovermpls.h"
static int checkMplsHdr(uint32_t, uint8_t, uint8_t, uint8_t, Packet *);
-void DecodeMPLS(const uint8_t* pkt, const uint32_t len, Packet* p)
+
+
+bool MplsCodec::decode(const uint8_t *raw_pkt, const uint32_t len,
+ Packet *p, uint16_t &p_hdr_len, int &next_prot_id)
{
uint32_t* tmpMplsHdr;
uint32_t mpls_h;
uint32_t label;
- uint32_t mlen = 0;
+ p_hdr_len= 0;
uint8_t exp;
uint8_t bos = 0;
int iRet = 0;
-
- if(!ScMplsMulticast())
- {
- DecoderEvent(p, DECODE_BAD_MPLS,
- DECODE_MULTICAST_MPLS_STR);
-// SnortEventqAdd(GENERATOR_SNORT_DECODE, DECODE_BAD_MPLS, 1, DECODE_CLASS, 3, DECODE_MULTICAST_MPLS_STR, 0);
- }
-
-
- dc.mpls++;
+// dc.mpls++;
UpdateMPLSStats(&sfBase, len, Active_PacketWasDropped());
- tmpMplsHdr = (uint32_t *) pkt;
+ tmpMplsHdr = (uint32_t *) raw_pkt;
p->mpls = NULL;
while (!bos)
{
if(stack_len < MPLS_HEADER_LEN)
{
- DecoderEvent(p, DECODE_BAD_MPLS, DECODE_BAD_MPLS_STR);
+ DecoderEvent(p, DECODE_BAD_MPLS);
- dc.discards++;
+// dc.discards++;
p->iph = NULL;
p->family = NO_IP;
- return;
+ return false;
}
mpls_h = ntohl(*tmpMplsHdr);
label = (mpls_h>>4) & 0x000FFFFF;
if((label<NUM_RESERVED_LABELS)&&((iRet = checkMplsHdr(label, exp, bos, ttl, p)) < 0))
- return;
+ return false;
if( bos )
{
p->mplsHdr.ttl = ttl;
/**
p->mpls = &(p->mplsHdr);
- **/
+ **/
p->mpls = tmpMplsHdr;
if(!iRet)
{
if ((ScMplsStackDepth() != -1) && (chainLen++ >= ScMplsStackDepth()))
{
- DecoderEvent(p, DECODE_MPLS_LABEL_STACK,
- DECODE_MPLS_LABEL_STACK_STR);
+ DecoderEvent(p, DECODE_MPLS_LABEL_STACK);
- dc.discards++;
+// dc.discards++;
p->iph = NULL;
p->family = NO_IP;
- return;
+ return false;
}
} /* while bos not 1, peel off more labels */
- mlen = (uint8_t*)tmpMplsHdr - pkt;
- PushLayer(PROTO_MPLS, p, pkt, mlen);
- mlen = len - mlen;
+ p_hdr_len = (uint8_t*)tmpMplsHdr - raw_pkt;
switch (iRet)
{
case MPLS_PAYLOADTYPE_IPV4:
- DecodeIP((uint8_t *)tmpMplsHdr, mlen, p);
+ next_prot_id = ETHERTYPE_IPV4;
break;
case MPLS_PAYLOADTYPE_IPV6:
- DecodeIPV6((uint8_t *)tmpMplsHdr, mlen, p);
+ next_prot_id = ETHERTYPE_IPV6;
break;
case MPLS_PAYLOADTYPE_ETHERNET:
- DecodeEthOverMPLS((uint8_t *)tmpMplsHdr, mlen, p);
+ next_prot_id = ETHERTYPE_TRANS_ETHER_BRIDGING;
break;
default:
+ next_prot_id = -1;
break;
}
- return;
+
+ return true;
}
||((!label)&&(ScMplsPayloadType() != MPLS_PAYLOADTYPE_IPV4)))
{
if( !label )
- DecoderEvent(p, DECODE_BAD_MPLS_LABEL0,
- DECODE_BAD_MPLS_LABEL0_STR);
+ DecoderEvent(p, DECODE_BAD_MPLS_LABEL0);
else
- DecoderEvent(p, DECODE_BAD_MPLS_LABEL2,
- DECODE_BAD_MPLS_LABEL2_STR);
+ DecoderEvent(p, DECODE_BAD_MPLS_LABEL2);
}
break;
}
* and move on to the next one.
*/
if( !label )
- DecoderEvent(p, DECODE_BAD_MPLS_LABEL0,
- DECODE_BAD_MPLS_LABEL0_STR);
+ DecoderEvent(p, DECODE_BAD_MPLS_LABEL0);
else
- DecoderEvent(p, DECODE_BAD_MPLS_LABEL2,
- DECODE_BAD_MPLS_LABEL2_STR);
+ DecoderEvent(p, DECODE_BAD_MPLS_LABEL2);
dc.discards++;
p->iph = NULL;
case 1:
if(!bos) break;
- DecoderEvent(p, DECODE_BAD_MPLS_LABEL1,
- DECODE_BAD_MPLS_LABEL1_STR);
+ DecoderEvent(p, DECODE_BAD_MPLS_LABEL1);
- dc.discards++;
+// dc.discards++;
p->iph = NULL;
p->family = NO_IP;
iRet = MPLS_PAYLOADTYPE_ERROR;
break;
- case 3:
- DecoderEvent(p, DECODE_BAD_MPLS_LABEL3,
- DECODE_BAD_MPLS_LABEL3_STR);
+ case 3:
+ DecoderEvent(p, DECODE_BAD_MPLS_LABEL3);
- dc.discards++;
+// dc.discards++;
p->iph = NULL;
p->family = NO_IP;
iRet = MPLS_PAYLOADTYPE_ERROR;
case 13:
case 14:
case 15:
- DecoderEvent(p, DECODE_MPLS_RESERVED_LABEL,
- DECODE_MPLS_RESERVEDLABEL_STR);
+ DecoderEvent(p, DECODE_MPLS_RESERVED_LABEL);
break;
default:
break;
}
-static const char* name = "mpls_decode";
+void MplsCodec::get_protocol_ids(std::vector<uint16_t>& v)
+{
+ v.push_back(ETHERNET_TYPE_MPLS_UNICAST);
+ v.push_back(ETHERNET_TYPE_MPLS_MULTICAST);
+}
+
+static Codec* ctor()
+{
+ return new MplsCodec();
+}
+
+static void dtor(Codec *cd)
+{
+ delete cd;
+}
-static const CodecApi mpls_api =
+static void sum()
+{
+// sum_stats((PegCount*)&gdc, (PegCount*)&dc, array_size(dc_pegs));
+// memset(&dc, 0, sizeof(dc));
+}
+
+static void stats()
+{
+// show_percent_stats((PegCount*)&gdc, dc_pegs, array_size(dc_pegs),
+// "decoder");
+}
+
+
+
+static const char* name = "mpls_codec";
+
+static const CodecApi codec_api =
{
{ PT_CODEC, name, CDAPI_PLUGIN_V0, 0 },
- {ETHERNET_TYPE_MPLS_UNICAST, ETHERNET_TYPE_MPLS_MULTICAST},
NULL, // pinit
NULL, // pterm
NULL, // tinit
NULL, // tterm
- NULL, // ctor
- NULL, // dtor
- ErspanType2::DecodeTCP,
+ ctor, // ctor
+ dtor, // dtor
+ sum, // sum
+ stats // stats
};
+
#include "packet_io/active.h"
#include "protocols/ipv6.h"
#include "protocols/teredo.h"
+#include "protocols/undefined_protocols.h"
namespace
{
void TeredoCodec::get_protocol_ids(std::vector<uint16_t>& v)
{
- v.push_back(teredo::teredo_id());
+ v.push_back(PROTOCOL_TEREDO);
}
static Codec* ctor()
void TransbridgeCodec::get_protocol_ids(std::vector<uint16_t>& v)
{
- v.push_back(TRANS_ETHER_BRIDGING_ETHERTYPE); // defined in ethertypes.h"
+ v.push_back(ETHERTYPE_TRANS_ETHER_BRIDGING); // defined in ethertypes.h"
}
static Codec* ctor()
+++ /dev/null
-/* $Id: decode.c,v 1.285 2013-06-29 03:03:00 rcombs Exp $ */
-
-/*
-** Copyright (C) 2002-2013 Sourcefire, Inc.
-** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-
-
-#ifdef HAVE_CONFIG_H
-#include "config.h"
-#endif
-
-#include "generators.h"
-#include "decode.h"
-#include "static_include.h"
-#include "prot_ethovermpls.h"
-
-
-#include "decoder_includes.h"
-#include "prot_arp.h"
-#include "prot_ethloopback.h"
-#include "prot_pppoepkt.h"
-
-//--------------------------------------------------------------------
-// decode.c::MPLS
-//--------------------------------------------------------------------
-
-void DecodeEthOverMPLS(const uint8_t* pkt, const uint32_t len, Packet* p)
-{
- /* do a little validation */
- if(len < ETHERNET_HEADER_LEN)
- {
- if (ScLogVerbose())
- {
- ErrorMessage("Captured data length < Ethernet header length!"
- " (%d bytes)\n", len);
- }
-
- p->iph = NULL;
- p->family = NO_IP;
- // TBD add decoder drop event for eth over MPLS cap len issue
- dc.discards++;
- dc.ethdisc++;
- return;
- }
-
- /* lay the ethernet structure over the packet data */
- p->eh = (eth::EtherHdr *) pkt; // FIXTHIS squashes outer eth!
- PushLayer(PROTO_ETH, p, pkt, sizeof(*p->eh));
-
- DEBUG_WRAP(
- DebugMessage(DEBUG_DECODE, "%X %X\n",
- *p->eh->ether_src, *p->eh->ether_dst);
- );
-
- /* grab out the network type */
- switch(ntohs(p->eh->ether_type))
- {
- case ETHERNET_TYPE_IP:
- DEBUG_WRAP(
- DebugMessage(DEBUG_DECODE,
- "IP datagram size calculated to be %lu bytes\n",
- (unsigned long)(len - ETHERNET_HEADER_LEN));
- );
-
- DecodeIP(p->pkt + ETHERNET_HEADER_LEN,
- len - ETHERNET_HEADER_LEN, p);
-
- return;
-
- case ETHERNET_TYPE_ARP:
- case ETHERNET_TYPE_REVARP:
- DecodeARP(p->pkt + ETHERNET_HEADER_LEN,
- len - ETHERNET_HEADER_LEN, p);
- return;
-
- case ETHERNET_TYPE_IPV6:
- DecodeIPV6(p->pkt + ETHERNET_HEADER_LEN,
- (len - ETHERNET_HEADER_LEN), p);
- return;
-
- case ETHERNET_TYPE_PPPoE_DISC:
- case ETHERNET_TYPE_PPPoE_SESS:
- DecodePPPoEPkt(p->pkt + ETHERNET_HEADER_LEN,
- (len - ETHERNET_HEADER_LEN), p);
- return;
-
-#ifndef NO_NON_ETHER_DECODER
- case ETHERNET_TYPE_IPX:
- DecodeIPX(p->pkt + ETHERNET_HEADER_LEN,
- (len - ETHERNET_HEADER_LEN), p);
- return;
-#endif
-
- case ETHERNET_TYPE_LOOP:
- DecodeEthLoopback(p->pkt + ETHERNET_HEADER_LEN,
- (len - ETHERNET_HEADER_LEN), p);
- return;
-
- case ETHERNET_TYPE_8021Q:
- DecodeVlan(p->pkt + ETHERNET_HEADER_LEN,
- len - ETHERNET_HEADER_LEN, p);
- return;
-
- default:
- // TBD add decoder drop event for unknown mpls/eth type
- dc.other++;
- return;
- }
-
- return;
-}
-
arp.h
wlan.h
teredo.h
+ mpls.h
ethertypes.h
protocol_numbers.h
+ undefined_protocols.h
)
/*
* this file contained the ethertypes for all of the various protocols.
*
- * This is ONLY useful when protocols are chained and specificy the next
+ * This is ONLY used when protocols are chained and specificy the next
* protocol by name rather than by an ID. MOST protocols do NOT need to
* entered into this file.
*
*/
-const uint16_t TRANS_ETHER_BRIDGING_ETHERTYPE = 0x6558;
-const uint16_t PPP_ETHERTYPE = 0x880B;
+const uint16_t ETHERTYPE_TRANS_ETHER_BRIDGING = 0x6558;
+const uint16_t ETHERTYPE_IPV4 = 0x0800;
+const uint16_t ETHERTYPE_IPV6 = 0x86dd;
+const uint16_t ETHERTYPE_PPP = 0x880B;
#endif
namespace gtp{
namespace detail{
-
-const uint32_t GTP_ID = 0x0101;
const uint32_t GTP_MIN_LEN = 8;
const uint32_t GTP_V0_HEADER_LEN = 20;
const uint32_t GTP_V1_HEADER_LEN = 12;
};
-inline uint16_t gtp_id()
-{
- return detail::GTP_ID;
-}
-
inline uint32_t min_hdr_len()
{
return detail::GTP_MIN_LEN;
*/
-#ifndef PROT_MPLS_H
-#define PROT_MPLS_H
+#ifndef MPLS_H
+#define MPLS_H
+namespace mpls{
-#define ETHERNET_TYPE_MPLS_UNICAST 0x8847
-#define ETHERNET_TYPE_MPLS_MULTICAST 0x8848
+namespace detail{
+} // namespace detail
+
+
+struct MplsHdr
+{
+ uint32_t label;
+ uint8_t exp;
+ uint8_t bos;
+ uint8_t ttl;
+} ;
+
+
+
+
+
+} // namespace mpls
+
+typedef mpls::MplsHdr MplsHdr;
#define MPLS_PAYLOADTYPE_ETHERNET 1
#define MPLS_PAYLOADTYPE_IPV4 2
#define MPLS_PAYLOADTYPE_IPV6 3
#define MPLS_PAYLOADTYPE_ERROR -1
-void DecodeMPLS(const uint8_t*, const uint32_t, Packet*);
-
#endif
+
#include "protocols/icmp6.h"
#include "protocols/arp.h"
#include "protocols/gre.h"
-
+#include "protocols/mpls.h"
/* D E F I N E S ************************************************************/
/* payload follows */
} PPPoE_Tag;
-#define MPLS_HEADER_LEN 4
-#define NUM_RESERVED_LABELS 16
-
-typedef struct _MplsHdr
-{
- uint32_t label;
- uint8_t exp;
- uint8_t bos;
- uint8_t ttl;
-} MplsHdr;
#define PGM_NAK_ERR -1
#define PGM_NAK_OK 0
namespace detail
{
-const uint16_t TEREDO_ID = 0x0100;
const uint32_t TEREDO_PORT = 3544;
const uint32_t TEREDO_INDICATOR_ORIGIN = 0x00;
const uint32_t TEREDO_INDICATOR_ORIGIN_LEN = 8;
} // namespace detail
-inline uint16_t teredo_id()
-{
- return detail::TEREDO_ID;
-}
inline bool is_teredo_port(uint16_t port)
{
*/
-#ifndef PROT_ETHOVERMPLS_H
-#define PROT_ETHOVERMPLS_H
-
-void DecodeEthOverMPLS(const uint8_t*, const uint32_t, Packet*);
+#ifndef UNDEFINED_PROTOCOLS_H
+#define UNDEFINED_PROTOCOLS_H
+/*
+ * PROTOCOL ID'S By Range
+ * 0 (0x0000) - 255 (0x00FF) --> Ip protocols
+ * 256 (0x0100) - 1535 (0x05FF) --> random protocols (teredo, gtp)
+ * 1536 (0x6000) - 65536 (0xFFFF) --> Ethertypes
+ */
+const uint16_t PROTOCOL_TEREDO = 0x0100;
+const uint16_t PROTOCOL_GTP = 0x0101;
#endif
-
projects / thirdparty / snort3.git / commitdiff
