AuthCodec() : Codec(CD_AUTH_NAME) { }
~AuthCodec() { }
- void get_protocol_ids(std::vector<uint16_t>& v) override;
+ void get_protocol_ids(std::vector<ProtocolId>& v) override;
bool decode(const RawData&, CodecData&, DecodeData&) override;
};
/* Valid for both IPv4 and IPv6 */
struct AuthHdr
{
- uint8_t next;
+ IpProtocol next;
uint8_t len;
uint16_t rsv; /* reserved */
uint32_t spi; /* Security Parameters Index */
// no relatino to the AuthHdr.len field.
} // anonymous namespace
-void AuthCodec::get_protocol_ids(std::vector<uint16_t>& v)
-{ v.push_back(IPPROTO_ID_AUTH); }
+void AuthCodec::get_protocol_ids(std::vector<ProtocolId>& v)
+{ v.push_back(ProtocolId::AUTH); }
bool AuthCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort)
{
return false;
}
- codec.next_prot_id = ah->next;
+ codec.next_prot_id = (ProtocolId)ah->next;
// must be called AFTER setting next_prot_id
if (snort.ip_api.is_ip6())
return false;
}
- CheckIPv6ExtensionOrder(codec, IPPROTO_ID_AUTH);
+ CheckIPv6ExtensionOrder(codec, IpProtocol::AUTH);
codec.proto_bits |= PROTO_BIT__IP6_EXT;
codec.ip6_csum_proto = ah->next;
codec.ip6_extension_count++;
Ipv6DSTOptsCodec() : Codec(CD_DSTOPTS_NAME) { }
~Ipv6DSTOptsCodec() { }
- void get_protocol_ids(std::vector<uint16_t>& v) override;
+ void get_protocol_ids(std::vector<ProtocolId>& v) override;
bool decode(const RawData&, CodecData&, DecodeData&) override;
};
struct IP6Dest
{
- uint8_t ip6dest_nxt;
+ IpProtocol ip6dest_nxt;
uint8_t ip6dest_len;
/* options follow */
uint8_t ip6dest_pad[6];
if ( snort_conf->hit_ip6_maxopts(codec.ip6_extension_count) )
codec_event(codec, DECODE_IP6_EXCESS_EXT_HDR);
- if (dsthdr->ip6dest_nxt == IPPROTO_ROUTING)
+ if (dsthdr->ip6dest_nxt == IpProtocol::ROUTING)
codec_event(codec, DECODE_IPV6_DSTOPTS_WITH_ROUTING);
codec.lyr_len = sizeof(IP6Dest) + (dsthdr->ip6dest_len << 3);
codec.proto_bits |= PROTO_BIT__IP6_EXT;
codec.ip6_extension_count++;
- codec.next_prot_id = dsthdr->ip6dest_nxt;
+ codec.next_prot_id = (ProtocolId)dsthdr->ip6dest_nxt;
codec.ip6_csum_proto = dsthdr->ip6dest_nxt;
// must be called AFTER setting next_prot_id
- CheckIPv6ExtensionOrder(codec, IPPROTO_ID_DSTOPTS);
+ CheckIPv6ExtensionOrder(codec, IpProtocol::DSTOPTS);
if ( CheckIPV6HopOptions(raw, codec))
return true;
return false;
}
-void Ipv6DSTOptsCodec::get_protocol_ids(std::vector<uint16_t>& v)
-{ v.push_back(IPPROTO_ID_DSTOPTS); }
+void Ipv6DSTOptsCodec::get_protocol_ids(std::vector<ProtocolId>& v)
+{ v.push_back(ProtocolId::DSTOPTS); }
//-------------------------------------------------------------------------
// api
EspCodec() : Codec(CD_ESP_NAME) { }
~EspCodec() { }
- void get_protocol_ids(std::vector<uint16_t>& v) override;
+ void get_protocol_ids(std::vector<ProtocolId>& v) override;
bool decode(const RawData&, CodecData&, DecodeData&) override;
};
constexpr uint32_t ESP_TRAILER_LEN = 2;
} // anonymous namespace
-void EspCodec::get_protocol_ids(std::vector<uint16_t>& v)
-{ v.push_back(IPPROTO_ID_ESP); }
+void EspCodec::get_protocol_ids(std::vector<ProtocolId>& v)
+{ v.push_back(ProtocolId::ESP); }
/*
* Attempt to decode Encapsulated Security Payload.
{
const uint8_t* esp_payload;
uint8_t pad_length;
+ uint8_t ip_proto;
if (!SnortConfig::esp_decoding())
return false;
codec.lyr_len = ESP_HEADER_LEN;
esp_payload = raw.data + ESP_HEADER_LEN;
pad_length = *(esp_payload + guessed_len);
- codec.next_prot_id = *(esp_payload + guessed_len + 1);
+ ip_proto = *(esp_payload + guessed_len + 1);
+ codec.next_prot_id = (ProtocolId)ip_proto;
// must be called AFTER setting next_prot_id
if (snort.ip_api.is_ip6())
return false;
}
- CheckIPv6ExtensionOrder(codec, IPPROTO_ID_ESP);
+ CheckIPv6ExtensionOrder(codec, IpProtocol::ESP);
codec.proto_bits |= PROTO_BIT__IP6_EXT;
- codec.ip6_csum_proto = codec.next_prot_id;
+ codec.ip6_csum_proto = (IpProtocol)ip_proto;
codec.ip6_extension_count++;
}
{
snort.decode_flags |= DECODE_PKT_TRUST;
codec.lyr_len = ESP_HEADER_LEN; // we want data to begin at (pkt + ESP_HEADER_LEN)
- codec.next_prot_id = FINISHED_DECODE;
+ codec.next_prot_id = ProtocolId::FINISHED_DECODE;
return true;
}
decoder stage to silently ignore invalid headers. */
// highest valid protocol id == 255.
- if (codec.next_prot_id > 0xFF)
+
+ // FIXIT-M -- The next_prot_id will never be > 0xFF since it came from
+ // a uint8_t originally...
+ if (to_utype(codec.next_prot_id) > 0xFF)
{
- codec.next_prot_id = FINISHED_DECODE;
+ codec.next_prot_id = ProtocolId::FINISHED_DECODE;
snort.decode_flags |= DECODE_PKT_TRUST;
}
else
bool decode(const RawData&, CodecData&, DecodeData&) override;
void log(TextLog* const, const uint8_t* pkt, const uint16_t len) override;
- void get_protocol_ids(std::vector<uint16_t>&) override;
+ void get_protocol_ids(std::vector<ProtocolId>&) override;
};
} // namespace
codec.ip6_extension_count++;
// must be called AFTER setting next_prot_id
- CheckIPv6ExtensionOrder(codec, IPPROTO_ID_FRAGMENT);
+ CheckIPv6ExtensionOrder(codec, IpProtocol::FRAGMENT);
// Since the Frag layer is removed from rebuilt packets, ensure
// the next layer is correctly order now.
value may differ from that of the offset zero frag,
but only the Next Header of the original frag is used. */
// check DecodeIP(); we handle frags the same way here
- codec.next_prot_id = FINISHED_DECODE;
+ codec.next_prot_id = ProtocolId::FINISHED_DECODE;
}
else
{
- codec.next_prot_id = ip6frag_hdr->ip6f_nxt;
+ codec.next_prot_id = (ProtocolId)ip6frag_hdr->ip6f_nxt;
}
return true;
}
-void Ipv6FragCodec::get_protocol_ids(std::vector<uint16_t>& v)
-{ v.push_back(IPPROTO_ID_FRAGMENT); }
+void Ipv6FragCodec::get_protocol_ids(std::vector<ProtocolId>& v)
+{ v.push_back(ProtocolId::FRAGMENT); }
void Ipv6FragCodec::log(TextLog* const text_log, const uint8_t* raw_pkt,
const uint16_t /*lyr_len*/)
GreCodec() : Codec(CD_GRE_NAME) { }
~GreCodec() { }
- void get_protocol_ids(std::vector<uint16_t>& v) override;
+ void get_protocol_ids(std::vector<ProtocolId>& v) override;
bool decode(const RawData&, CodecData&, DecodeData&) override;
void log(TextLog* const, const uint8_t* pkt, const uint16_t len) override;
};
#define GRE_FLAGS(x) (x->version & 0xF8)
} // anonymous namespace
-void GreCodec::get_protocol_ids(std::vector<uint16_t>& v)
-{ v.push_back(IPPROTO_ID_GRE); }
+void GreCodec::get_protocol_ids(std::vector<ProtocolId>& v)
+{ v.push_back(ProtocolId::GRE); }
/*
* see RFCs 1701, 2784 and 2637
}
/* protocol must be 0x880B - PPP */
- if (greh->proto() != ETHERTYPE_PPP)
+ if (greh->proto() != ProtocolId::ETHERTYPE_PPP)
{
codec_event(codec, DECODE_GRE_V1_INVALID_HEADER);
return false;
Ipv6HopOptsCodec() : Codec(CD_HOPOPTS_NAME) { }
~Ipv6HopOptsCodec() { }
- void get_protocol_ids(std::vector<uint16_t>& v) override;
+ void get_protocol_ids(std::vector<ProtocolId>& v) override;
bool decode(const RawData&, CodecData&, DecodeData&) override;
};
struct IP6HopByHop
{
- uint8_t ip6hbh_nxt;
+ IpProtocol ip6hbh_nxt;
uint8_t ip6hbh_len;
/* options follow */
uint8_t ip6hbh_pad[6];
return false;
}
- codec.next_prot_id = (uint16_t)hbh_hdr->ip6hbh_nxt;
+ codec.next_prot_id = (ProtocolId)hbh_hdr->ip6hbh_nxt;
codec.ip6_csum_proto = hbh_hdr->ip6hbh_nxt;
codec.ip6_extension_count++;
codec.proto_bits |= PROTO_BIT__IP6_EXT;
// must be called AFTER setting next_prot_id
- CheckIPv6ExtensionOrder(codec, IPPROTO_ID_HOPOPTS);
+ CheckIPv6ExtensionOrder(codec, IpProtocol::HOPOPTS);
if ( CheckIPV6HopOptions(raw, codec))
return true;
return false;
}
-void Ipv6HopOptsCodec::get_protocol_ids(std::vector<uint16_t>& v)
+void Ipv6HopOptsCodec::get_protocol_ids(std::vector<ProtocolId>& v)
{
- v.push_back(IPPROTO_ID_HOPOPTS);
+ v.push_back(ProtocolId::HOPOPTS);
}
//-------------------------------------------------------------------------
Icmp4Codec() : Codec(CD_ICMP4_NAME) { }
~Icmp4Codec() { }
- void get_protocol_ids(std::vector<uint16_t>&) override;
+ void get_protocol_ids(std::vector<ProtocolId>&) override;
bool decode(const RawData&, CodecData&, DecodeData&) override;
void update(const ip::IpApi&, const EncodeFlags, uint8_t* raw_pkt,
uint16_t lyr_len, uint32_t& updated_len) override;
};
} // namespace
-void Icmp4Codec::get_protocol_ids(std::vector<uint16_t>& v)
-{ v.push_back(IPPROTO_ID_ICMPV4); }
+void Icmp4Codec::get_protocol_ids(std::vector<ProtocolId>& v)
+{ v.push_back(ProtocolId::ICMPV4); }
bool Icmp4Codec::decode(const RawData& raw, CodecData& codec,DecodeData& snort)
{
case icmp::IcmpType::PARAMETERPROB:
/* account for extra 4 bytes in header */
len += 4;
- codec.next_prot_id = PROTO_IP_EMBEDDED_IN_ICMP4;
+ codec.next_prot_id = ProtocolId::IP_EMBEDDED_IN_ICMP4;
break;
default:
Icmp6Codec() : Codec(CD_ICMP6_NAME) { }
~Icmp6Codec() { }
- void get_protocol_ids(std::vector<uint16_t>& v) override;
+ void get_protocol_ids(std::vector<ProtocolId>& v) override;
bool decode(const RawData&, CodecData&, DecodeData&) override;
void update(const ip::IpApi&, const EncodeFlags, uint8_t* raw_pkt,
uint16_t lyr_len, uint32_t& updated_len) override;
};
} // anonymous namespace
-void Icmp6Codec::get_protocol_ids(std::vector<uint16_t>& v)
-{ v.push_back(IPPROTO_ID_ICMPV6); }
+void Icmp6Codec::get_protocol_ids(std::vector<ProtocolId>& v)
+{ v.push_back(ProtocolId::ICMPV6); }
bool Icmp6Codec::decode(const RawData& raw, CodecData& codec, DecodeData& snort)
{
codec_event(codec, DECODE_ICMPV6_TOO_BIG_BAD_MTU);
len = icmp::ICMP6_HEADER_NORMAL_LEN;
- codec.next_prot_id = PROTO_IP_EMBEDDED_IN_ICMP6;
+ codec.next_prot_id = ProtocolId::IP_EMBEDDED_IN_ICMP6;
}
else
{
codec_event(codec, DECODE_ICMPV6_UNREACHABLE_NON_RFC_4443_CODE);
}
len = icmp::ICMP6_HEADER_NORMAL_LEN;
- codec.next_prot_id = PROTO_IP_EMBEDDED_IN_ICMP6;
+ codec.next_prot_id = ProtocolId::IP_EMBEDDED_IN_ICMP6;
}
else
{
memcpy(ps6.sip, api.get_src()->ip32, sizeof(ps6.sip));
memcpy(ps6.dip, api.get_dst()->ip32, sizeof(ps6.dip));
ps6.zero = 0;
- ps6.protocol = IPPROTO_ICMPV6;
+ ps6.protocol = IpProtocol::ICMPV6;
ps6.len = htons((uint16_t)updated_len);
h->cksum = checksum::icmp_cksum((uint16_t*)h, updated_len, &ps6);
}
~IgmpCodec() { }
bool decode(const RawData&, CodecData&, DecodeData&) override;
- void get_protocol_ids(std::vector<uint16_t>&) override;
+ void get_protocol_ids(std::vector<ProtocolId>&) override;
};
} // namespace
return true;
}
-void IgmpCodec::get_protocol_ids(std::vector<uint16_t>& v)
+void IgmpCodec::get_protocol_ids(std::vector<ProtocolId>& v)
{
- v.push_back(IPPROTO_IGMP);
+ v.push_back(ProtocolId::IGMP);
}
//-------------------------------------------------------------------------
Ipv4Codec() : Codec(CD_IPV4_NAME) { }
~Ipv4Codec() { }
- void get_protocol_ids(std::vector<uint16_t>& v) override;
+ void get_protocol_ids(std::vector<ProtocolId>& v) override;
bool decode(const RawData&, CodecData&, DecodeData&) override;
void log(TextLog* const, const uint8_t* pkt, const uint16_t len) override;
bool encode(const uint8_t* const raw_in, const uint16_t raw_len,
};
} // namespace
-void Ipv4Codec::get_protocol_ids(std::vector<uint16_t>& v)
+void Ipv4Codec::get_protocol_ids(std::vector<ProtocolId>& v)
{
- v.push_back(ETHERTYPE_IPV4);
- v.push_back(IPPROTO_ID_IPIP);
+ v.push_back(ProtocolId::ETHERTYPE_IPV4);
+ v.push_back(ProtocolId::IPIP);
}
bool Ipv4Codec::decode(const RawData& raw, CodecData& codec, DecodeData& snort)
* or if it is, its a UDP packet and offset is 0 */
if (!(snort.decode_flags & DECODE_FRAG) /*||
((frag_off == 0) && // FIXIT-M this forces flow to udp instead of ip
- (iph->proto() == IPPROTO_UDP))*/)
+ (iph->proto() == IpProtocol::UDP))*/)
{
- if (iph->proto() >= MIN_UNASSIGNED_IP_PROTO)
+ if (to_utype(iph->proto()) >= to_utype(ProtocolId::MIN_UNASSIGNED_IP_PROTO))
codec_event(codec, DECODE_IP_UNASSIGNED_PROTO);
else
- codec.next_prot_id = iph->proto();
+ codec.next_prot_id = (ProtocolId)iph->proto();
}
return true;
* cycles and use the literal header size for checksum */
ip4h_out->ip_csum = checksum::ip_cksum((uint16_t*)ip4h_out, ip::IP4_HEADER_LEN);
- enc.next_proto = IPPROTO_ID_IPIP;
- enc.next_ethertype = ETHERTYPE_IPV4;
+ enc.next_proto = IpProtocol::IPIP;
+ enc.next_ethertype = ProtocolId::ETHERTYPE_IPV4;
return true;
}
Ipv6Codec() : Codec(CD_IPV6_NAME) { }
~Ipv6Codec() { }
- void get_protocol_ids(std::vector<uint16_t>& v) override;
+ void get_protocol_ids(std::vector<ProtocolId>& v) override;
bool decode(const RawData&, CodecData&, DecodeData&) override;
bool encode(const uint8_t* const raw_in, const uint16_t raw_len,
EncState&, Buffer&) override;
************************* CLASS FUNCTIONS ************************
********************************************************************/
-void Ipv6Codec::get_protocol_ids(std::vector<uint16_t>& v)
+void Ipv6Codec::get_protocol_ids(std::vector<ProtocolId>& v)
{
- v.push_back(ETHERTYPE_IPV6);
- v.push_back(IPPROTO_ID_IPV6);
+ v.push_back(ProtocolId::ETHERTYPE_IPV6);
+ v.push_back(ProtocolId::IPV6);
}
bool Ipv6Codec::decode(const RawData& raw, CodecData& codec, DecodeData& snort)
const_cast<uint32_t&>(raw.len) = ip6h->len() + ip::IP6_HEADER_LEN;
snort.set_pkt_type(PktType::IP);
- codec.next_prot_id = ip6h->next();
+ codec.next_prot_id = (ProtocolId)ip6h->next();
codec.lyr_len = ip::IP6_HEADER_LEN;
codec.curr_ip6_extension = 0;
codec.ip6_extension_count = 0;
const CodecData& codec)
{
/* Only check for IPv6 over IPv4 */
- if (snort.ip_api.is_ip4() && snort.ip_api.get_ip4h()->proto() == IPPROTO_ID_IPV6)
+ if (snort.ip_api.is_ip4() && snort.ip_api.get_ip4h()->proto() == IpProtocol::IPV6)
{
uint32_t isatap_interface_id = ntohl(ip6h->ip6_src.u6_addr32[2]) & 0xFCFFFFFF;
ipvh_out->ip6_vtf = htonl(ntohl(hi->ip6_vtf) & 0xFFF00000);
ipvh_out->ip6_payload_len = htons(buf.size() - sizeof(ip::IP6Hdr));
- enc.next_proto = IPPROTO_ID_IPV6;
- enc.next_ethertype = ETHERTYPE_IPV6;
+ enc.next_proto = IpProtocol::IPV6;
+ enc.next_ethertype = ProtocolId::ETHERTYPE_IPV6;
return true;
}
MobilityCodec() : Codec(CD_MOBILE_NAME) { }
~MobilityCodec() { }
- void get_protocol_ids(std::vector<uint16_t>&) override;
+ void get_protocol_ids(std::vector<ProtocolId>&) override;
bool decode(const RawData&, CodecData&, DecodeData&) override;
};
} // namespace
-void MobilityCodec::get_protocol_ids(std::vector<uint16_t>& v)
+void MobilityCodec::get_protocol_ids(std::vector<ProtocolId>& v)
{
- v.push_back(IPPROTO_ID_MOBILITY);
+ v.push_back(ProtocolId::MOBILITY);
}
bool MobilityCodec::decode(const RawData&, CodecData& codec, DecodeData&)
~Ipv6NoNextCodec() { }
bool decode(const RawData&, CodecData&, DecodeData&) override;
- void get_protocol_ids(std::vector<uint16_t>&) override;
+ void get_protocol_ids(std::vector<ProtocolId>&) override;
};
} // namespace
return true;
}
-void Ipv6NoNextCodec::get_protocol_ids(std::vector<uint16_t>& v)
-{ v.push_back(IPPROTO_ID_NONEXT); }
+void Ipv6NoNextCodec::get_protocol_ids(std::vector<ProtocolId>& v)
+{ v.push_back(ProtocolId::NONEXT); }
//-------------------------------------------------------------------------
// api
~PgmCodec() { }
bool decode(const RawData&, CodecData&, DecodeData&) override;
- void get_protocol_ids(std::vector<uint16_t>&) override;
+ void get_protocol_ids(std::vector<ProtocolId>&) override;
};
-static const uint16_t IPPROTO_ID_PGM = 113;
static const int PGM_NAK_ERR = -1;
static const int PGM_NAK_OK = 0;
static const int PGM_NAK_VULN = 1;
return true;
}
-void PgmCodec::get_protocol_ids(std::vector<uint16_t>& v)
+void PgmCodec::get_protocol_ids(std::vector<ProtocolId>& v)
{
- v.push_back(IPPROTO_ID_PGM);
+ v.push_back(ProtocolId::PGM);
}
//-------------------------------------------------------------------------
bool decode(const RawData&, CodecData&, DecodeData&) override;
- void get_protocol_ids(std::vector<uint16_t>&) override;
+ void get_protocol_ids(std::vector<ProtocolId>&) override;
};
struct IP6Route
{
- uint8_t ip6rte_nxt;
+ IpProtocol ip6rte_nxt;
uint8_t ip6rte_len;
uint8_t ip6rte_type;
uint8_t ip6rte_seg_left;
#endif
} // namespace
-void Ipv6RoutingCodec::get_protocol_ids(std::vector<uint16_t>& v)
-{ v.push_back(IPPROTO_ID_ROUTING); }
+void Ipv6RoutingCodec::get_protocol_ids(std::vector<ProtocolId>& v)
+{ v.push_back(ProtocolId::ROUTING); }
bool Ipv6RoutingCodec::decode(const RawData& raw, CodecData& codec, DecodeData&)
{
if (rte->ip6rte_type == 0)
codec_event(codec, DECODE_IPV6_ROUTE_ZERO);
- if (rte->ip6rte_nxt == IPPROTO_ID_HOPOPTS)
+ if (rte->ip6rte_nxt == IpProtocol::HOPOPTS)
codec_event(codec, DECODE_IPV6_ROUTE_AND_HOPBYHOP);
- if (rte->ip6rte_nxt == IPPROTO_ID_ROUTING)
+ if (rte->ip6rte_nxt == IpProtocol::ROUTING)
codec_event(codec, DECODE_IPV6_TWO_ROUTE_HEADERS);
codec.lyr_len = ip::MIN_EXT_LEN + (rte->ip6rte_len << 3);
codec.proto_bits |= PROTO_BIT__IP6_EXT; // check ip proto rules against this layer
codec.ip6_extension_count++;
- codec.next_prot_id = rte->ip6rte_nxt;
+ codec.next_prot_id = (ProtocolId)rte->ip6rte_nxt;
codec.ip6_csum_proto = rte->ip6rte_nxt;
// must be called AFTER setting next_prot_id
- CheckIPv6ExtensionOrder(codec, IPPROTO_ID_ROUTING);
+ CheckIPv6ExtensionOrder(codec, IpProtocol::ROUTING);
return true;
}
SunNdCodec() : Codec(CD_SUN_ND_NAME) { }
~SunNdCodec() { }
- void get_protocol_ids(std::vector<uint16_t>&) override;
+ void get_protocol_ids(std::vector<ProtocolId>&) override;
bool decode(const RawData&, CodecData&, DecodeData&) override;
};
-const uint16_t IPPROTO_ID_SUN_ND = 77;
} // namespace
-void SunNdCodec::get_protocol_ids(std::vector<uint16_t>& v)
+void SunNdCodec::get_protocol_ids(std::vector<ProtocolId>& v)
{
- v.push_back(IPPROTO_ID_SUN_ND);
+ v.push_back(ProtocolId::SUN_ND);
}
bool SunNdCodec::decode(const RawData&, CodecData& codec, DecodeData&)
SwipeCodec() : Codec(CD_SWIPE_NAME) { }
~SwipeCodec() { }
- void get_protocol_ids(std::vector<uint16_t>& v) override;
+ void get_protocol_ids(std::vector<ProtocolId>& v) override;
bool decode(const RawData&, CodecData&, DecodeData&) override;
};
} // namespace
-static const uint16_t SWIPE_PROT_ID = 53;
-
-void SwipeCodec::get_protocol_ids(std::vector<uint16_t>& proto_ids)
-{ proto_ids.push_back(SWIPE_PROT_ID); }
+void SwipeCodec::get_protocol_ids(std::vector<ProtocolId>& proto_ids)
+{ proto_ids.push_back(ProtocolId::SWIPE); }
bool SwipeCodec::decode(const RawData&, CodecData& codec, DecodeData&)
{
~TcpCodec() { }
- void get_protocol_ids(std::vector<uint16_t>& v) override;
+ void get_protocol_ids(std::vector<ProtocolId>& v) override;
void log(TextLog* const, const uint8_t* pkt, const uint16_t len) override;
bool decode(const RawData&, CodecData&, DecodeData&) override;
bool encode(const uint8_t* const raw_in, const uint16_t raw_len,
static sfip_var_t* SynToMulticastDstIp = NULL;
} // namespace
-void TcpCodec::get_protocol_ids(std::vector<uint16_t>& v)
+void TcpCodec::get_protocol_ids(std::vector<ProtocolId>& v)
{
- v.push_back(IPPROTO_ID_TCP);
+ v.push_back(ProtocolId::TCP);
}
bool TcpCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort)
}
// in case of ip6 extension headers, this gets next correct
- enc.next_proto = IPPROTO_ID_TCP;
+ enc.next_proto = IpProtocol::TCP;
tcph_out->th_sum = 0;
const ip::IpApi& ip_api = enc.ip_api;
ps.sip = ip4h->get_src();
ps.dip = ip4h->get_dst();
ps.zero = 0;
- ps.protocol = IPPROTO_ID_TCP;
+ ps.protocol = IpProtocol::TCP;
ps.len = htons((uint16_t)len);
tcph_out->th_sum = checksum::tcp_cksum((uint16_t*)tcph_out, len, &ps);
}
memcpy(&ps6.sip, ip6h->get_src()->u6_addr8, sizeof(ps6.sip));
memcpy(&ps6.dip, ip6h->get_dst()->u6_addr8, sizeof(ps6.dip));
ps6.zero = 0;
- ps6.protocol = IPPROTO_ID_TCP;
+ ps6.protocol = IpProtocol::TCP;
ps6.len = htons((uint16_t)len);
tcph_out->th_sum = checksum::tcp_cksum((uint16_t*)tcph_out, len, &ps6);
}
ps.sip = ip4h->get_src();
ps.dip = ip4h->get_dst();
ps.zero = 0;
- ps.protocol = IPPROTO_TCP;
+ ps.protocol = IpProtocol::TCP;
ps.len = htons((uint16_t)updated_len);
h->th_sum = checksum::tcp_cksum((uint16_t*)h, updated_len, &ps);
}
memcpy(ps6.sip, ip6h->get_src()->u6_addr32, sizeof(ps6.sip));
memcpy(ps6.dip, ip6h->get_dst()->u6_addr32, sizeof(ps6.dip));
ps6.zero = 0;
- ps6.protocol = IPPROTO_TCP;
+ ps6.protocol = IpProtocol::TCP;
ps6.len = htons((uint16_t)updated_len);
h->th_sum = checksum::tcp_cksum((uint16_t*)h, updated_len, &ps6);
}
UdpCodec() : Codec(CD_UDP_NAME) { }
~UdpCodec() { }
- void get_protocol_ids(std::vector<uint16_t>& v) override;
+ void get_protocol_ids(std::vector<ProtocolId>& v) override;
bool decode(const RawData&, CodecData&, DecodeData&) override;
bool encode(const uint8_t* const raw_in, const uint16_t raw_len,
};
} // anonymous namespace
-void UdpCodec::get_protocol_ids(std::vector<uint16_t>& v)
+void UdpCodec::get_protocol_ids(std::vector<ProtocolId>& v)
{
- v.push_back(IPPROTO_ID_UDP);
+ v.push_back(ProtocolId::UDP);
}
bool UdpCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort)
(SnortConfig::is_gtp_port(src_port)||SnortConfig::is_gtp_port(dst_port)))
{
if ( !(snort.decode_flags & DECODE_FRAG) )
- codec.next_prot_id = PROTO_GTP;
+ codec.next_prot_id = ProtocolId::GTP;
}
else if (teredo::is_teredo_port(src_port) ||
teredo::is_teredo_port(dst_port) ||
SnortConfig::deep_teredo_inspection())
{
- codec.next_prot_id = PROTO_TEREDO;
+ codec.next_prot_id = ProtocolId::TEREDO;
}
return true;
ps.sip = ip4h->get_src();
ps.dip = ip4h->get_dst();
ps.zero = 0;
- ps.protocol = IPPROTO_ID_UDP;
+ ps.protocol = IpProtocol::UDP;
ps.len = udph_out->uh_len;
udph_out->uh_chk = checksum::udp_cksum((uint16_t*)udph_out, len, &ps);
}
memcpy(ps6.sip, ip6h->get_src()->u6_addr8, sizeof(ps6.sip));
memcpy(ps6.dip, ip6h->get_dst()->u6_addr8, sizeof(ps6.dip));
ps6.zero = 0;
- ps6.protocol = IPPROTO_ID_UDP;
+ ps6.protocol = IpProtocol::UDP;
ps6.len = udph_out->uh_len;
udph_out->uh_chk = checksum::udp_cksum((uint16_t*)udph_out, len, &ps6);
}
- enc.next_proto = IPPROTO_ID_UDP;
- enc.next_ethertype = 0;
+ enc.next_proto = IpProtocol::UDP;
+ enc.next_ethertype = ProtocolId::ETHERTYPE_NOT_SET;
return true;
}
ps.sip = ip4h->get_src();
ps.dip = ip4h->get_dst();
ps.zero = 0;
- ps.protocol = IPPROTO_ID_UDP;
+ ps.protocol = IpProtocol::UDP;
ps.len = htons((uint16_t)updated_len);
h->uh_chk = checksum::udp_cksum((uint16_t*)h, updated_len, &ps);
}
memcpy(ps6.sip, ip6h->ip6_src.u6_addr32, sizeof(ps6.sip));
memcpy(ps6.dip, ip6h->ip6_dst.u6_addr32, sizeof(ps6.dip));
ps6.zero = 0;
- ps6.protocol = IPPROTO_ID_UDP;
+ ps6.protocol = IpProtocol::UDP;
ps6.len = htons((uint16_t)updated_len);
h->uh_chk = checksum::udp_cksum((uint16_t*)h, updated_len, &ps6);
}
#include <stdlib.h>
#include <cstddef>
+#include <protocols/protocol_ids.h>
+
namespace checksum
{
struct Pseudoheader6
uint32_t sip[4];
uint32_t dip[4];
uint8_t zero;
- uint8_t protocol;
+ IpProtocol protocol;
uint16_t len;
};
uint32_t sip;
uint32_t dip;
uint8_t zero;
- uint8_t protocol;
+ IpProtocol protocol;
uint16_t len;
};
ArpCodec() : Codec(CD_ARP_NAME) { }
~ArpCodec() { }
- void get_protocol_ids(std::vector<uint16_t>& v) override;
+ void get_protocol_ids(std::vector<ProtocolId>& v) override;
bool decode(const RawData&, CodecData&, DecodeData&) override;
void format(bool reverse, uint8_t* raw_pkt, DecodeData& snort) override;
};
} // anonymous namespace
-void ArpCodec::get_protocol_ids(std::vector<uint16_t>& v)
+void ArpCodec::get_protocol_ids(std::vector<ProtocolId>& v)
{
- v.push_back(ETHERTYPE_ARP);
- v.push_back(ETHERTYPE_REVARP);
+ v.push_back(ProtocolId::ETHERTYPE_ARP);
+ v.push_back(ProtocolId::ETHERTYPE_REVARP);
}
bool ArpCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort)
Erspan2Codec() : Codec(CD_ERSPAN2_NAME) { }
~Erspan2Codec() { }
- void get_protocol_ids(std::vector<uint16_t>& v) override;
+ void get_protocol_ids(std::vector<ProtocolId>& v) override;
bool decode(const RawData&, CodecData&, DecodeData&) override;
};
{ return ntohs(ver_vlan) >> 12; }
};
-constexpr uint16_t ETHERTYPE_ERSPAN_TYPE2 = 0x88be;
} // namespace
-void Erspan2Codec::get_protocol_ids(std::vector<uint16_t>& v)
-{ v.push_back(ETHERTYPE_ERSPAN_TYPE2); }
+void Erspan2Codec::get_protocol_ids(std::vector<ProtocolId>& v)
+{ v.push_back(ProtocolId::ETHERTYPE_ERSPAN_TYPE2); }
bool Erspan2Codec::decode(const RawData& raw, CodecData& codec, DecodeData&)
{
}
codec.lyr_len = sizeof(ERSpanType2Hdr);
- codec.next_prot_id = ETHERTYPE_TRANS_ETHER_BRIDGING;
+ codec.next_prot_id = ProtocolId::ETHERTYPE_TRANS_ETHER_BRIDGING;
return true;
}
Erspan3Codec() : Codec(CD_ERSPAN3_NAME) { }
~Erspan3Codec() { }
- void get_protocol_ids(std::vector<uint16_t>& v) override;
+ void get_protocol_ids(std::vector<ProtocolId>& v) override;
bool decode(const RawData&, CodecData&, DecodeData&) override;
};
{ return ntohs(time_stamp); }
};
-constexpr uint16_t ETHERTYPE_ERSPAN_TYPE3 = 0x22eb;
} // anonymous namespace
-void Erspan3Codec::get_protocol_ids(std::vector<uint16_t>& v)
-{ v.push_back(ETHERTYPE_ERSPAN_TYPE3); }
+void Erspan3Codec::get_protocol_ids(std::vector<ProtocolId>& v)
+{ v.push_back(ProtocolId::ETHERTYPE_ERSPAN_TYPE3); }
bool Erspan3Codec::decode(const RawData& raw, CodecData& codec, DecodeData&)
{
return false;
}
- codec.next_prot_id = ETHERTYPE_TRANS_ETHER_BRIDGING;
+ codec.next_prot_id = ProtocolId::ETHERTYPE_TRANS_ETHER_BRIDGING;
codec.lyr_len = sizeof(ERSpanType3Hdr);
return true;
}
FabricPathCodec() : Codec(CD_FABRICPATH_NAME) { }
~FabricPathCodec() { }
- void get_protocol_ids(std::vector<uint16_t>& v) override;
+ void get_protocol_ids(std::vector<ProtocolId>& v) override;
bool decode(const RawData&, CodecData&, DecodeData&) override;
bool encode(const uint8_t* const raw_in, const uint16_t raw_len,
EncState&, Buffer&) override;
constexpr uint8_t FABRICPATH_HEADER_LEN = 16;
} // anonymous namespace
-void FabricPathCodec::get_protocol_ids(std::vector<uint16_t>& v)
-{ v.push_back(ETHERTYPE_FPATH); }
+void FabricPathCodec::get_protocol_ids(std::vector<ProtocolId>& v)
+{ v.push_back(ProtocolId::ETHERTYPE_FPATH); }
bool FabricPathCodec::decode(const RawData& raw, CodecData& codec, DecodeData&)
{
return false;
}
- codec.next_prot_id = PROTO_ETHERNET_802_3;
+ codec.next_prot_id = ProtocolId::ETHERNET_802_3;
codec.lyr_len = FABRICPATH_HEADER_LEN;
return true;
}
MplsCodec() : Codec(CD_MPLS_NAME) { }
~MplsCodec() { }
- void get_protocol_ids(std::vector<uint16_t>& v) override;
+ void get_protocol_ids(std::vector<ProtocolId>& v) override;
bool decode(const RawData&, CodecData&, DecodeData&) override;
void log(TextLog* const, const uint8_t* pkt, const uint16_t len) override;
int checkMplsHdr(const CodecData&, uint32_t label, uint8_t bos);
};
-constexpr uint16_t ETHERTYPE_MPLS_UNICAST = 0x8847;
-constexpr uint16_t ETHERTYPE_MPLS_MULTICAST = 0x8848;
constexpr int MPLS_HEADER_LEN = 4;
constexpr int NUM_RESERVED_LABELS = 16;
constexpr int MPLS_PAYLOADTYPE_ERROR = -1;
} // namespace
-void MplsCodec::get_protocol_ids(std::vector<uint16_t>& v)
+void MplsCodec::get_protocol_ids(std::vector<ProtocolId>& v)
{
- v.push_back(ETHERTYPE_MPLS_UNICAST);
- v.push_back(ETHERTYPE_MPLS_MULTICAST);
+ v.push_back(ProtocolId::ETHERTYPE_MPLS_UNICAST);
+ v.push_back(ProtocolId::ETHERTYPE_MPLS_MULTICAST);
}
bool MplsCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort)
switch (iRet)
{
case MPLS_PAYLOADTYPE_IPV4:
- codec.next_prot_id = ETHERTYPE_IPV4;
+ codec.next_prot_id = ProtocolId::ETHERTYPE_IPV4;
break;
case MPLS_PAYLOADTYPE_IPV6:
- codec.next_prot_id = ETHERTYPE_IPV6;
+ codec.next_prot_id = ProtocolId::ETHERTYPE_IPV6;
break;
case MPLS_PAYLOADTYPE_ETHERNET:
- codec.next_prot_id = ETHERTYPE_TRANS_ETHER_BRIDGING;
+ codec.next_prot_id = ProtocolId::ETHERTYPE_TRANS_ETHER_BRIDGING;
break;
default:
PppEncap() : Codec(CD_PPPENCAP_NAME) { }
~PppEncap() { }
- void get_protocol_ids(std::vector<uint16_t>& v) override;
+ void get_protocol_ids(std::vector<ProtocolId>& v) override;
bool decode(const RawData&, CodecData&, DecodeData&) override;
};
static const uint16_t PPP_IPX = 0x002b; /* Novell IPX Protocol */
} // namespace
-void PppEncap::get_protocol_ids(std::vector<uint16_t>& v)
-{ v.push_back(ETHERTYPE_PPP); }
+void PppEncap::get_protocol_ids(std::vector<ProtocolId>& v)
+{ v.push_back(ProtocolId::ETHERTYPE_PPP); }
bool PppEncap::decode(const RawData& raw, CodecData& codec, DecodeData&)
{
return false;
}
- ((IP4Hdr*)(raw.data + codec.lyr_len))->set_proto(IPPROTO_TCP);
+ ((IP4Hdr*)(raw.data + codec.lyr_len))->set_proto(IpProtocol::TCP);
/* fall through */
case PPP_IP:
- codec.next_prot_id = ETHERTYPE_IPV4;
+ codec.next_prot_id = ProtocolId::ETHERTYPE_IPV4;
break;
case PPP_IPV6:
- codec.next_prot_id = ETHERTYPE_IPV6;
+ codec.next_prot_id = ProtocolId::ETHERTYPE_IPV6;
break;
case PPP_IPX:
- codec.next_prot_id = ETHERTYPE_IPX;
+ codec.next_prot_id = ProtocolId::ETHERTYPE_IPX;
break;
default:
}
codec.lyr_len = PPPOE_HEADER_LEN;
- codec.next_prot_id = ETHERTYPE_PPP;
+ codec.next_prot_id = ProtocolId::ETHERTYPE_PPP;
return true;
}
namespace
{
-const uint16_t ETHERNET_TYPE_PPPoE_DISC = 0x8863; /* discovery stage */
-const uint16_t ETHERNET_TYPE_PPPoE_SESS = 0x8864; /* session stage */
-
#define CD_PPPOEPKT_DISC_NAME "pppoe_disc"
#define CD_PPPOEPKT_DISC_HELP "support for point-to-point discovery"
PPPoEDiscCodec() : PPPoECodec(CD_PPPOEPKT_DISC_NAME, PppoepktType::DISCOVERY) { }
~PPPoEDiscCodec() { }
- void get_protocol_ids(std::vector<uint16_t>& v) override
- { v.push_back(ETHERNET_TYPE_PPPoE_DISC); }
+ void get_protocol_ids(std::vector<ProtocolId>& v) override
+ { v.push_back(ProtocolId::ETHERTYPE_PPPOE_DISC); }
};
class PPPoESessCodec : public PPPoECodec
PPPoESessCodec() : PPPoECodec(CD_PPPOEPKT_SESS_NAME, PppoepktType::SESSION) { }
~PPPoESessCodec() { }
- void get_protocol_ids(std::vector<uint16_t>& v) override
- { v.push_back(ETHERNET_TYPE_PPPoE_SESS); }
+ void get_protocol_ids(std::vector<ProtocolId>& v) override
+ { v.push_back(ProtocolId::ETHERTYPE_PPPOE_SESS); }
};
} // namespace
TransbridgeCodec() : Codec(CD_TRANSBRIDGE_NAME) { }
~TransbridgeCodec() { }
- void get_protocol_ids(std::vector<uint16_t>& v) override;
+ void get_protocol_ids(std::vector<ProtocolId>& v) override;
bool decode(const RawData&, CodecData&, DecodeData&) override;
};
} // anonymous namespace
-void TransbridgeCodec::get_protocol_ids(std::vector<uint16_t>& v)
-{ v.push_back(ETHERTYPE_TRANS_ETHER_BRIDGING); }
+void TransbridgeCodec::get_protocol_ids(std::vector<ProtocolId>& v)
+{ v.push_back(ProtocolId::ETHERTYPE_TRANS_ETHER_BRIDGING); }
bool TransbridgeCodec::decode(const RawData& raw, CodecData& codec, DecodeData&)
{
codec.proto_bits |= PROTO_BIT__ETH;
codec.lyr_len = eth::ETH_HEADER_LEN;
- codec.next_prot_id = ntohs(eh->ether_type);
+ codec.next_prot_id = eh->ethertype();
return true;
}
VlanCodec() : Codec(CD_VLAN_NAME) { }
~VlanCodec() { }
- void get_protocol_ids(std::vector<uint16_t>& v) override;
+ void get_protocol_ids(std::vector<ProtocolId>& v) override;
bool decode(const RawData&, CodecData&, DecodeData&) override;
void log(TextLog* const, const uint8_t* pkt, const uint16_t len) override;
};
constexpr unsigned int ETHERNET_MAX_LEN_ENCAP = 1518; /* 802.3 (+LLC) or ether II ? */
} // namespace
-void VlanCodec::get_protocol_ids(std::vector<uint16_t>& v)
+void VlanCodec::get_protocol_ids(std::vector<ProtocolId>& v)
{
- v.push_back(ETHERTYPE_8021Q);
+ v.push_back(ProtocolId::ETHERTYPE_8021Q);
}
bool VlanCodec::decode(const RawData& raw, CodecData& codec, DecodeData&)
* http://www.geocities.com/billalexander/ethernet.html
*/
if (proto <= ETHERNET_MAX_LEN_ENCAP)
- codec.next_prot_id = PROTO_ETHERNET_LLC;
+ codec.next_prot_id = ProtocolId::ETHERNET_LLC;
else
- codec.next_prot_id = proto;
+ codec.next_prot_id = (ProtocolId)proto;
// Vlan IDs 0 and 4095 are reserved.
const uint16_t vid = vh->vid();
DefaultCodec() : Codec(CD_DEFAULT_NAME) { }
~DefaultCodec() { }
- void get_protocol_ids(std::vector<uint16_t>& v) override
- { v.push_back(FINISHED_DECODE); }
+ void get_protocol_ids(std::vector<ProtocolId>& v) override
+ { v.push_back(ProtocolId::FINISHED_DECODE); }
bool decode(const RawData&, CodecData&, DecodeData&) override
{ return false; }
GtpCodec() : Codec(CD_GTP_NAME) { }
~GtpCodec() { }
- void get_protocol_ids(std::vector<uint16_t>& v) override;
+ void get_protocol_ids(std::vector<ProtocolId>& v) override;
bool decode(const RawData&, CodecData&, DecodeData&) override;
bool encode(const uint8_t* const raw_in, const uint16_t raw_len,
EncState&, Buffer&) override;
static const uint32_t GTP_V0_HEADER_LEN = 20;
static const uint32_t GTP_V1_HEADER_LEN = 12;
-void GtpCodec::get_protocol_ids(std::vector<uint16_t>& v)
+void GtpCodec::get_protocol_ids(std::vector<ProtocolId>& v)
{
- v.push_back(PROTO_GTP);
+ v.push_back(ProtocolId::GTP);
}
bool GtpCodec::decode(const RawData& raw, CodecData& codec, DecodeData& dd)
ip_ver = *(raw.data + len) & 0xF0;
if (ip_ver == 0x40)
- codec.next_prot_id = IPPROTO_ID_IPIP;
+ codec.next_prot_id = ProtocolId::IPIP;
else if (ip_ver == 0x60)
- codec.next_prot_id = IPPROTO_ID_IPV6;
+ codec.next_prot_id = ProtocolId::IPV6;
}
return true;
Icmp4IpCodec() : Codec(ICMP4_IP_NAME) { }
~Icmp4IpCodec() { }
- void get_protocol_ids(std::vector<uint16_t>&) override;
+ void get_protocol_ids(std::vector<ProtocolId>&) override;
bool decode(const RawData&, CodecData&, DecodeData&) override;
void log(TextLog* const, const uint8_t* pkt, const uint16_t len) override;
};
} // namespace
-void Icmp4IpCodec::get_protocol_ids(std::vector<uint16_t>& v)
-{ v.push_back(PROTO_IP_EMBEDDED_IN_ICMP4); }
+void Icmp4IpCodec::get_protocol_ids(std::vector<ProtocolId>& v)
+{ v.push_back(ProtocolId::IP_EMBEDDED_IN_ICMP4); }
bool Icmp4IpCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort)
{
switch (ip4h->proto())
{
- case IPPROTO_TCP: /* decode the interesting part of the header */
+ case IpProtocol::TCP: /* decode the interesting part of the header */
codec.proto_bits |= PROTO_BIT__TCP_EMBED_ICMP;
break;
- case IPPROTO_UDP:
+ case IpProtocol::UDP:
codec.proto_bits |= PROTO_BIT__UDP_EMBED_ICMP;
break;
- case IPPROTO_ICMP:
+ case IpProtocol::ICMPV4:
codec.proto_bits |= PROTO_BIT__ICMP_EMBED_ICMP;
break;
default:
/* EMBEDDED PROTOCOL */
switch (ip4h->proto())
{
- case IPPROTO_TCP: /* decode the interesting part of the header */
+ case IpProtocol::TCP: /* decode the interesting part of the header */
{
const tcp::TCPHdr* tcph = reinterpret_cast<const tcp::TCPHdr*>
(raw_pkt + hlen);
break;
}
- case IPPROTO_UDP:
+ case IpProtocol::UDP:
{
const udp::UDPHdr* udph = reinterpret_cast<const udp::UDPHdr*>
(raw_pkt + hlen);
break;
}
- case IPPROTO_ICMP:
+ case IpProtocol::ICMPV4:
{
const icmp::ICMPHdr* icmph = reinterpret_cast<const icmp::ICMPHdr*>
(raw_pkt + hlen);
Icmp6IpCodec() : Codec(ICMP6_IP_NAME) { }
~Icmp6IpCodec() { }
- void get_protocol_ids(std::vector<uint16_t>&) override;
+ void get_protocol_ids(std::vector<ProtocolId>&) override;
bool decode(const RawData&, CodecData&, DecodeData&) override;
};
} // namespace
-void Icmp6IpCodec::get_protocol_ids(std::vector<uint16_t>& v)
-{ v.push_back(PROTO_IP_EMBEDDED_IN_ICMP6); }
+void Icmp6IpCodec::get_protocol_ids(std::vector<ProtocolId>& v)
+{ v.push_back(ProtocolId::IP_EMBEDDED_IN_ICMP6); }
bool Icmp6IpCodec::decode(const RawData& raw, CodecData& codec, DecodeData&)
{
// FIXIT-L Will fail to decode Ipv6 options
switch (ip6h->next())
{
- case IPPROTO_TCP: /* decode the interesting part of the header */
+ case IpProtocol::TCP: /* decode the interesting part of the header */
codec.proto_bits |= PROTO_BIT__TCP_EMBED_ICMP;
break;
- case IPPROTO_UDP:
+ case IpProtocol::UDP:
codec.proto_bits |= PROTO_BIT__UDP_EMBED_ICMP;
break;
- case IPPROTO_ICMP:
+ // FIXIT-M: Do we need to handle ICMPV6 here?
+ case IpProtocol::ICMPV4:
codec.proto_bits |= PROTO_BIT__ICMP_EMBED_ICMP;
break;
default:
bool decode(const RawData&, CodecData&, DecodeData&) override;
void log(TextLog* const, const uint8_t* pkt, const uint16_t len) override;
- void get_protocol_ids(std::vector<uint16_t>&) override;
+ void get_protocol_ids(std::vector<ProtocolId>&) override;
};
struct EthLlc
uint8_t org_code[3];
uint8_t proto_id[2];
- uint16_t proto() const
+ ProtocolId proto() const
{
#ifdef __GNUC__
// fixing the type_punned pointer problem
const uint8_t* tmp1 = &proto_id[0];
const uint16_t* const tmp2 = reinterpret_cast<const uint16_t*>(tmp1);
- return ntohs(*tmp2);
+ return (ProtocolId)ntohs(*tmp2);
#else
- return ntohs(*((uint16_t*)(&proto_id[0])));
+ return (ProtocolId)ntohs(*((uint16_t*)(&proto_id[0])));
#endif
}
};
#define ETH_ORG_CODE_CDP 0x00000c /* Cisco Discovery Proto */
} // namespace
-void LlcCodec::get_protocol_ids(std::vector<uint16_t>& v)
-{ v.push_back(PROTO_ETHERNET_LLC); }
+void LlcCodec::get_protocol_ids(std::vector<ProtocolId>& v)
+{ v.push_back(ProtocolId::ETHERNET_LLC); }
bool LlcCodec::decode(const RawData& raw, CodecData& codec, DecodeData&)
{
ehllc->ssap == ETH_SSAP_IP)
{
const EthLlcOther* other = reinterpret_cast<const EthLlcOther*>(raw_pkt + sizeof(EthLlc));
- const uint16_t proto = other->proto();
+ const ProtocolId proto = other->proto();
TextLog_Print(text_log, " ORG:0x%02X%02X%02X PROTO:0x%04X",
other->org_code[0], other->org_code[1], other->org_code[2],
TeredoCodec() : Codec(CD_TEREDO_NAME) { }
~TeredoCodec() { }
- void get_protocol_ids(std::vector<uint16_t>& v) override;
+ void get_protocol_ids(std::vector<ProtocolId>& v) override;
bool decode(const RawData&, CodecData&, DecodeData&) override;
};
} // anonymous namespace
-void TeredoCodec::get_protocol_ids(std::vector<uint16_t>& v)
+void TeredoCodec::get_protocol_ids(std::vector<ProtocolId>& v)
{
- v.push_back(PROTO_TEREDO);
+ v.push_back(ProtocolId::TEREDO);
}
bool TeredoCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort)
if ( (!teredo::is_teredo_port(snort.sp)) && (!teredo::is_teredo_port(snort.dp)) )
codec.codec_flags |= CODEC_ENCAP_LAYER;
- codec.next_prot_id = IPPROTO_IPV6;
+ codec.next_prot_id = ProtocolId::IPV6;
codec.codec_flags |= CODEC_NON_IP_TUNNEL;
return true;
}
EthCodec() : Codec(CD_ETH_NAME) { }
~EthCodec() { }
- void get_protocol_ids(std::vector<uint16_t>&) override;
+ void get_protocol_ids(std::vector<ProtocolId>&) override;
void get_data_link_type(std::vector<int>&) override;
void log(TextLog* const, const uint8_t* pkt, const uint16_t len) override;
bool decode(const RawData&, CodecData&, DecodeData&) override;
v.push_back(DLT_EN10MB);
}
-void EthCodec::get_protocol_ids(std::vector<uint16_t>& v)
+void EthCodec::get_protocol_ids(std::vector<ProtocolId>& v)
{
- v.push_back(PROTO_ETHERNET_802_3);
+ v.push_back(ProtocolId::ETHERNET_802_3);
}
bool EthCodec::decode(const RawData& raw, CodecData& codec, DecodeData&)
/* lay the ethernet structure over the packet data */
const eth::EtherHdr* eh = reinterpret_cast<const eth::EtherHdr*>(raw.data);
- uint16_t next_prot = eh->ethertype();
- if ( next_prot <= eth::MIN_ETHERTYPE )
+ ProtocolId next_prot = eh->ethertype();
+ if ( to_utype(next_prot) <= to_utype(ProtocolId::ETHERTYPE_MINIMUM) )
{
- codec.next_prot_id = PROTO_ETHERNET_LLC;
+ codec.next_prot_id = ProtocolId::ETHERNET_LLC;
codec.lyr_len = eth::ETH_HEADER_LEN;
codec.proto_bits |= PROTO_BIT__ETH;
}
- else if ( next_prot == ETHERTYPE_FPATH )
+ else if ( next_prot == ProtocolId::ETHERTYPE_FPATH )
{
/* If this is FabricPath, the first 16 bytes are FabricPath data
* rather than Ethernet data. So, set the length to zero and
eh->ether_dst[1], eh->ether_dst[2], eh->ether_dst[3],
eh->ether_dst[4], eh->ether_dst[5]);
- const uint16_t prot = ntohs(eh->ether_type);
+ const ProtocolId prot_id = eh->ethertype();
- if (prot <= eth::MIN_ETHERTYPE)
- TextLog_Print(text_log, " len:0x%04X", prot);
+ if (to_utype(prot_id) <= to_utype(ProtocolId::ETHERTYPE_MINIMUM))
+ TextLog_Print(text_log, " len:0x%04X", prot_id);
else
- TextLog_Print(text_log, " type:0x%04X", prot);
+ TextLog_Print(text_log, " type:0x%04X", prot_id);
}
//-------------------------------------------------------------------------
{
const eth::EtherHdr* hi = reinterpret_cast<const eth::EtherHdr*>(raw_in);
- if (hi->ethertype() == ETHERTYPE_FPATH)
+ if (hi->ethertype() == ProtocolId::ETHERTYPE_FPATH)
return true;
// not raw ip -> encode layer 2
return false;
eth::EtherHdr* ho = reinterpret_cast<eth::EtherHdr*>(buf.data());
- ho->ether_type = enc.ethertype_set() ? ntohs(enc.next_ethertype) : hi->ether_type;
+ ho->ether_type = enc.ethertype_set() ? ntohs(to_utype(enc.next_ethertype)) : hi->ether_type;
uint8_t* dst_mac = PacketManager::encode_get_dst_mac();
}
}
- enc.next_ethertype = 0;
- enc.next_proto = ENC_PROTO_UNSET;
+ enc.next_ethertype = ProtocolId::ETHERTYPE_NOT_SET;
+ enc.next_proto = IpProtocol::PROTO_NOT_SET;
return true;
}
eth::EtherHdr* ch = reinterpret_cast<eth::EtherHdr*>(raw_pkt);
// If the ethertype is FabricPath, then this is not Ethernet Data.
- if ( reverse && (ch->ethertype() != ETHERTYPE_FPATH) )
+ if ( reverse && (ch->ethertype() != ProtocolId::ETHERTYPE_FPATH) )
{
uint8_t tmp_addr[6];
{
const eth::EtherHdr* const eth = reinterpret_cast<eth::EtherHdr*>(raw_pkt);
- if ( eth->ethertype() != ETHERTYPE_FPATH )
+ if ( eth->ethertype() != ProtocolId::ETHERTYPE_FPATH )
updated_len += lyr_len;
}
Flow::~Flow()
{ }
-void Flow::init(PktType proto)
+void Flow::init(PktType type)
{
- protocol = proto;
+ pkt_type = type;
// FIXIT-M getFlowbitSizeInBytes() should be attribute of ??? (or eliminate)
bitop = new BitOp(getFlowbitSizeInBytes());
{ return (ssn_state.session_flags & SSNFLAG_PROXIED) != 0; }
bool is_stream()
- { return (unsigned)protocol & (unsigned)PktType::STREAM; }
+ { return to_utype(pkt_type) & to_utype(PktType::STREAM); }
void block()
{ ssn_state.session_flags |= SSNFLAG_BLOCK; }
class Session* session;
class BitOp* bitop;
uint8_t ip_proto; // FIXIT-M -- do we need both of these?
- PktType protocol; // ^^
+ PktType pkt_type; // ^^
// these fields are always set; not zeroed
Flow* prev, * next;
static THREAD_LOCAL PegCount user_count = 0;
static THREAD_LOCAL PegCount file_count = 0;
-uint32_t FlowControl::max_flows(PktType proto)
+uint32_t FlowControl::max_flows(PktType type)
{
- FlowCache* cache = get_cache(proto);
+ FlowCache* cache = get_cache(type);
if ( cache )
return cache->get_max_flows();
return 0;
}
-PegCount FlowControl::get_flows(PktType proto)
+PegCount FlowControl::get_flows(PktType type)
{
- switch ( proto )
+ switch ( type )
{
case PktType::IP: return ip_count;
case PktType::ICMP: return icmp_count;
}
}
-PegCount FlowControl::get_total_prunes(PktType proto) const
+PegCount FlowControl::get_total_prunes(PktType type) const
{
- auto cache = get_cache(proto);
+ auto cache = get_cache(type);
return cache ? cache->get_total_prunes() : 0;
}
-PegCount FlowControl::get_prunes(PktType proto, PruneReason reason) const
+PegCount FlowControl::get_prunes(PktType type, PruneReason reason) const
{
- auto cache = get_cache(proto);
+ auto cache = get_cache(type);
return cache ? cache->get_prunes(reason) : 0;
}
cache->reset_stats();
}
-Memcap& FlowControl::get_memcap (PktType proto)
+Memcap& FlowControl::get_memcap (PktType type)
{
static Memcap dummy;
- FlowCache* cache = get_cache(proto);
+ FlowCache* cache = get_cache(type);
assert(cache); // FIXIT-L dummy is a hack
return cache ? cache->get_memcap() : dummy;
}
// cache foo
//-------------------------------------------------------------------------
-inline FlowCache* FlowControl::get_cache (PktType proto)
+inline FlowCache* FlowControl::get_cache (PktType type)
{
- switch ( proto )
+ switch ( type )
{
case PktType::IP: return ip_cache;
case PktType::ICMP: return icmp_cache;
}
// FIXIT-L J duplication of non-const method above
-inline const FlowCache* FlowControl::get_cache (PktType proto) const
+inline const FlowCache* FlowControl::get_cache (PktType type) const
{
- switch ( proto )
+ switch ( type )
{
case PktType::IP: return ip_cache;
case PktType::ICMP: return icmp_cache;
Flow* FlowControl::find_flow(const FlowKey* key)
{
- FlowCache* cache = get_cache((PktType)key->protocol);
+ FlowCache* cache = get_cache(key->pkt_type);
if ( cache )
return cache->find(key);
Flow* FlowControl::new_flow(const FlowKey* key)
{
- FlowCache* cache = get_cache((PktType)key->protocol);
+ FlowCache* cache = get_cache(key->pkt_type);
if ( !cache )
return NULL;
}
// FIXIT-L cache* can be put in flow so that lookups by
-// protocol are obviated for existing / initialized flows
+// packet type are obviated for existing / initialized flows
void FlowControl::delete_flow(const FlowKey* key)
{
- FlowCache* cache = get_cache((PktType)key->protocol);
+ FlowCache* cache = get_cache(key->pkt_type);
if ( !cache )
return;
void FlowControl::delete_flow(Flow* flow, PruneReason reason)
{
- FlowCache* cache = get_cache(flow->protocol);
+ FlowCache* cache = get_cache(flow->pkt_type);
if ( cache )
cache->release(flow, reason);
}
-void FlowControl::purge_flows (PktType proto)
+void FlowControl::purge_flows (PktType type)
{
- FlowCache* cache = get_cache(proto);
+ FlowCache* cache = get_cache(type);
if ( cache )
cache->purge();
}
-void FlowControl::prune_flows(PktType proto, const Packet* p)
+void FlowControl::prune_flows(PktType type, const Packet* p)
{
if ( !p )
return;
- FlowCache* cache = get_cache(proto);
+ FlowCache* cache = get_cache(type);
if ( !cache )
return;
uint32_t mplsId;
uint16_t vlanId;
uint16_t addressSpaceId;
- uint8_t type = (uint8_t)p->type();
- uint8_t proto = (uint8_t)p->get_ip_proto_next();
+ PktType type = p->type();
+ IpProtocol ip_proto = p->get_ip_proto_next();
if ( p->proto_bits & PROTO_BIT__VLAN )
vlanId = layer::get_vlan_layer(p)->vid();
if ( (p->ptrs.decode_flags & DECODE_FRAG) )
{
- key->init(type, proto, ip_api.get_src(), ip_api.get_dst(), ip_api.id(),
+ key->init(type, ip_proto, ip_api.get_src(), ip_api.get_dst(), ip_api.id(),
vlanId, mplsId, addressSpaceId);
}
- else if ( type == (uint8_t)PktType::ICMP )
+ else if ( type == PktType::ICMP )
{
- key->init(type, proto, ip_api.get_src(), p->ptrs.icmph->type, ip_api.get_dst(), 0,
+ key->init(type, ip_proto, ip_api.get_src(), p->ptrs.icmph->type, ip_api.get_dst(), 0,
vlanId, mplsId, addressSpaceId);
}
else
{
- key->init(type, proto, ip_api.get_src(), p->ptrs.sp, ip_api.get_dst(), p->ptrs.dp,
+ key->init(type, ip_proto, ip_api.get_src(), p->ptrs.sp, ip_api.get_dst(), p->ptrs.dp,
vlanId, mplsId, addressSpaceId);
}
}
static void init_roles(Packet* p, Flow* flow)
{
- switch ( flow->protocol )
+ switch ( flow->pkt_type )
{
case PktType::IP:
case PktType::ICMP:
int FlowControl::add_expected(
const sfip_t *srcIP, uint16_t srcPort,
const sfip_t *dstIP, uint16_t dstPort,
- PktType protocol, char direction,
+ PktType type, char direction,
FlowData* fd)
{
return exp_cache->add_flow(
- srcIP, srcPort, dstIP, dstPort, protocol, direction, fd);
+ srcIP, srcPort, dstIP, dstPort, type, direction, fd);
}
int FlowControl::add_expected(
const sfip_t *srcIP, uint16_t srcPort,
const sfip_t *dstIP, uint16_t dstPort,
- PktType protocol, int16_t appId, FlowData* fd)
+ PktType type, int16_t appId, FlowData* fd)
{
return exp_cache->add_flow(
- srcIP, srcPort, dstIP, dstPort, protocol, SSN_DIR_BOTH, fd, appId);
+ srcIP, srcPort, dstIP, dstPort, type, SSN_DIR_BOTH, fd, appId);
}
bool FlowControl::is_expected(Packet* p)
//-------------------------------------------------------------------------
inline void FlowKey::init4(
- uint8_t proto,
+ IpProtocol ip_proto,
const sfip_t *srcIP, uint16_t srcPort,
const sfip_t *dstIP, uint16_t dstPort,
uint32_t mplsId, bool order)
const uint32_t* src;
const uint32_t* dst;
- if ( proto == IPPROTO_ICMP )
+ if ( ip_proto == IpProtocol::ICMPV4 )
{
if (srcPort == ICMP_ECHOREPLY)
{
}
inline void FlowKey::init6(
- uint8_t proto,
+ IpProtocol ip_proto,
const sfip_t *srcIP, uint16_t srcPort,
const sfip_t *dstIP, uint16_t dstPort,
uint32_t mplsId, bool order)
const sfip_t* src;
const sfip_t* dst;
- if ( proto == IPPROTO_ICMP )
+ if ( ip_proto == IpProtocol::ICMPV4 )
{
if (srcPort == ICMP_ECHOREPLY)
{
dstPort = 0;
}
}
- else if ( proto == IPPROTO_ICMPV6 )
+ else if ( ip_proto == IpProtocol::ICMPV6 )
{
if (srcPort == icmp::Icmp6Types::ECHO_REPLY)
{
}
void FlowKey::init(
- uint8_t type, uint8_t proto,
+ PktType type, IpProtocol ip_proto,
const sfip_t *srcIP, uint16_t srcPort,
const sfip_t *dstIP, uint16_t dstPort,
uint16_t vlanId, uint32_t mplsId, uint16_t addrSpaceId)
if (srcIP->is_ip4())
{
version = 4;
- init4(proto, srcIP, srcPort, dstIP, dstPort, mplsId);
+ init4(ip_proto, srcIP, srcPort, dstIP, dstPort, mplsId);
}
else
{
version = 6;
- init6(proto, srcIP, srcPort, dstIP, dstPort, mplsId);
+ init6(ip_proto, srcIP, srcPort, dstIP, dstPort, mplsId);
}
- protocol = type;
+ pkt_type = type;
init_vlan(vlanId);
init_address_space(addrSpaceId);
}
void FlowKey::init(
- uint8_t type, uint8_t proto,
+ PktType type, IpProtocol ip_proto,
const sfip_t *srcIP, const sfip_t *dstIP,
uint32_t id, uint16_t vlanId,
uint32_t mplsId, uint16_t addrSpaceId)
if (srcIP->is_ip4())
{
version = 4;
- init4(proto, srcIP, srcPort, dstIP, dstPort, mplsId, false);
+ init4(ip_proto, srcIP, srcPort, dstIP, dstPort, mplsId, false);
}
else
{
version = 6;
- init6(proto, srcIP, srcPort, dstIP, dstPort, mplsId, false);
+ init6(ip_proto, srcIP, srcPort, dstIP, dstPort, mplsId, false);
}
- protocol = type;
+ pkt_type = type;
init_vlan(vlanId);
init_address_space(addrSpaceId);
#include "main/snort_types.h"
#include "hash/sfhashfcn.h"
+#include "framework/decode_data.h"
#include "sfip/sfip_t.h"
struct FlowKey
uint16_t port_l; /* Low Port - 0 if ICMP */
uint16_t port_h; /* High Port - 0 if ICMP */
uint16_t vlan_tag;
- uint8_t protocol;
+ PktType pkt_type;
uint8_t version;
uint32_t mplsLabel;
uint16_t addressSpaceId;
uint16_t addressSpaceIdPad1;
void init(
- uint8_t type, uint8_t proto,
+ PktType, IpProtocol,
const sfip_t *srcIP, uint16_t srcPort,
const sfip_t *dstIP, uint16_t dstPort,
uint16_t vlanId, uint32_t mplsId, uint16_t addrSpaceId);
void init(
- uint8_t type, uint8_t proto,
+ PktType, IpProtocol,
const sfip_t *srcIP, const sfip_t *dstIP,
uint32_t id, uint16_t vlanId,
uint32_t mplsId, uint16_t addrSpaceId);
private:
void init4(
- uint8_t proto,
+ IpProtocol,
const sfip_t *srcIP, uint16_t srcPort,
const sfip_t *dstIP, uint16_t dstPort,
uint32_t mplsId, bool order = true);
void init6(
- uint8_t proto,
+ IpProtocol,
const sfip_t *srcIP, uint16_t srcPort,
const sfip_t *dstIP, uint16_t dstPort,
uint32_t mplsId, bool order = true);
#include "codecs/codec_module.h"
#include "protocols/ipv6.h"
-EncState::EncState(const ip::IpApi& api, EncodeFlags f, uint8_t pr,
+EncState::EncState(const ip::IpApi& api, EncodeFlags f, IpProtocol pr,
uint8_t t, uint16_t data_size) :
ip_api(api),
flags(f),
dsize(data_size),
- next_ethertype(0),
+ next_ethertype(ProtocolId::ETHERTYPE_NOT_SET),
next_proto(pr),
ttl(t)
{ }
return true;
}
-void Codec::CheckIPv6ExtensionOrder(CodecData& codec, const uint8_t proto)
+void Codec::CheckIPv6ExtensionOrder(CodecData& codec, const IpProtocol ip_proto)
{
- const uint8_t current_order = ip::IPV6ExtensionOrder(proto);
+ const uint8_t current_order = ip::IPV6ExtensionOrder(ip_proto);
if (current_order <= codec.curr_ip6_extension)
{
- const uint8_t next_order = ip::IPV6ExtensionOrder(codec.next_prot_id);
+ const uint8_t next_order = ip::IPV6IdExtensionOrder(codec.next_prot_id);
/* A second "Destination Options" header is allowed iff:
1) A routing header was already seen, and
2) The second destination header is the last one before the upper layer.
*/
if ( !((codec.codec_flags & CODEC_ROUTING_SEEN) and
- (proto == IPPROTO_ID_DSTOPTS) and
+ (ip_proto == IpProtocol::DSTOPTS) and
(next_order == ip::IPV6_ORDER_MAX)) )
{
if ( !(codec.codec_flags & CODEC_IP6_EXT_OOO) )
codec.curr_ip6_extension = current_order;
}
- if (proto == IPPROTO_ID_ROUTING)
+ if (ip_proto == IpProtocol::ROUTING)
codec.codec_flags |= CODEC_ROUTING_SEEN;
}
#include "framework/base_api.h"
// unfortunately necessary due to use of Ipapi in struct
+#include "protocols/protocol_ids.h"
#include "protocols/ip.h"
#include "protocols/mpls.h" // FIXIT-M remove MPLS from Convenience pointers
#include "protocols/layer.h"
struct CodecData
{
/* This section will get reset before every decode() function call */
- uint16_t next_prot_id; /* protocol type of the next layer */
+ ProtocolId next_prot_id; /* protocol type of the next layer */
uint16_t lyr_len; /* The length of the valid part layer */
uint16_t invalid_bytes; /* the length of the INVALID part of this layer */
/* The following values have junk values after initialization */
uint8_t ip6_extension_count; /* initialized in cd_ipv6.cc */
uint8_t curr_ip6_extension; /* initialized in cd_ipv6.cc */
- uint8_t ip6_csum_proto; /* initalized in cd_ipv6.cc. Used for IPv6 checksums */
+ IpProtocol ip6_csum_proto; /* initalized in cd_ipv6.cc. Used for IPv6 checksums */
- CodecData(uint16_t init_prot) : next_prot_id(init_prot), lyr_len(0),
+ CodecData(ProtocolId init_prot) : next_prot_id(init_prot), lyr_len(0),
invalid_bytes(0), proto_bits(0), codec_flags(0), ip_layer_cnt(0)
{ }
const ip::IpApi& ip_api; /* IP related information. Good for checksums */
EncodeFlags flags;
const uint16_t dsize; /* for non-inline, TCP sequence numbers */
- uint16_t next_ethertype; /* set the next encoder 'proto' field to this value. */
- uint8_t next_proto; /* set the next encoder 'proto' field to this value. */
+ ProtocolId next_ethertype; /* set the next encoder 'proto' field to this value. */
+ IpProtocol next_proto; /* set the next encoder 'proto' field to this value. */
const uint8_t ttl;
- EncState(const ip::IpApi& api, EncodeFlags f, uint8_t pr,
+ EncState(const ip::IpApi& api, EncodeFlags f, IpProtocol pr,
uint8_t t, uint16_t data_size);
inline bool next_proto_set() const
- { return (next_proto != ENC_PROTO_UNSET); }
+ { return (next_proto != IpProtocol::PROTO_NOT_SET); }
inline bool ethertype_set() const
- { return next_ethertype != 0; }
+ { return next_ethertype != ProtocolId::ETHERTYPE_NOT_SET; }
inline bool forward() const
{ return flags & ENC_FLAG_FWD; }
// c++11
{ }
// Register the code's protocol ID's and Ethertypes
- virtual void get_protocol_ids(std::vector<uint16_t>&) // FIXIT-M return a vector ==
+ virtual void get_protocol_ids(std::vector<ProtocolId>&) // FIXIT-M return a vector ==
// efficient in c++11
{ }
// Check the Hop and DST IPv6 extension
bool CheckIPV6HopOptions(const RawData&, CodecData&);
// NOTE:: data.next_prot_id MUST be set before calling this!!
- void CheckIPv6ExtensionOrder(CodecData&, const uint8_t proto);
+ void CheckIPv6ExtensionOrder(CodecData&, const IpProtocol);
private:
const char* name;
typedef struct _IpProtoData
{
- uint8_t protocol;
+ IpProtocol protocol;
uint8_t comparison_flag;
} IpProtoData;
uint32_t a,b,c;
const IpProtoData* data = &config;
- a = data->protocol;
+ a = to_utype(data->protocol);
b = data->comparison_flag;
c = 0;
return DETECTION_OPTION_NO_MATCH;
}
- const uint8_t ip_proto = p->get_ip_proto_next();
+ const IpProtocol ip_proto = p->get_ip_proto_next();
switch (ipd->comparison_flag)
{
return;
}
- ds_ptr->protocol = (uint8_t)ip_proto;
+ ds_ptr->protocol = (IpProtocol)ip_proto;
}
else
{
struct protoent* pt = getprotobyname(data); // main thread only
- if (pt != NULL)
+ if (pt != NULL || pt->p_proto >= NUM_IP_PROTOS)
{
- /* p_proto should be a number less than 256 */
- ds_ptr->protocol = (uint8_t)pt->p_proto;
+ ds_ptr->protocol = (IpProtocol)pt->p_proto;
}
else
{
(is_ip6 ? layer::get_inner_ip6_frag() : nullptr);
TextLog_Print(log, "%s TTL:%u TOS:0x%X ID:%u IpLen:%u DgmLen:%u",
- protocol_names[p->get_ip_proto_next()],
+ protocol_names[to_utype(p->get_ip_proto_next())],
ip6h->hop_lim(),
ip6h->tos(),
(ip6_frag ? ip6_frag->id() : 0),
else
{
TextLog_Print(log, "%s TTL:%u TOS:0x%X ID:%u IpLen:%u DgmLen:%u",
- protocol_names[ip4h->proto()],
+ protocol_names[to_utype(ip4h->proto())],
ip4h->ttl(),
ip4h->tos(),
ip4h->id(),
const uint8_t* pb = data;
const uint8_t* end = data + len;
- const uint8_t ipv4_id = PacketManager::proto_id(IPPROTO_ID_IPIP);
- const uint8_t ipv6_id = PacketManager::proto_id(IPPROTO_ID_IPV6);
+ const ProtocolIndex ipv4_idx = PacketManager::proto_idx(ProtocolId::IPIP);
+ const ProtocolIndex ipv6_idx = PacketManager::proto_idx(ProtocolId::IPV6);
int offset = 0;
char conv[] = "0123456789ABCDEF"; /* xlation lookup table */
if (p && SnortConfig::obfuscate() )
{
int num_layers = p->num_layers;
- uint8_t lyr_proto = 0;
+ ProtocolIndex lyr_idx = 0;
for ( i = 0; i < num_layers; i++ )
{
- lyr_proto = PacketManager::proto_id(p->layers[i].prot_id);
+ lyr_idx = PacketManager::proto_idx(p->layers[i].prot_id);
- if ( lyr_proto == ipv4_id || lyr_proto == ipv6_id)
+ if ( lyr_idx == ipv4_idx || lyr_idx == ipv6_idx)
{
if (p->layers[i].length && p->layers[i].start)
break;
if (ip_start > 0 )
{
ip_ob_start = ip_start + 10;
- if (lyr_proto == ipv4_id)
+ if (lyr_idx == ipv4_idx)
ip_ob_end = ip_ob_start + 2 + 2*(sizeof(struct in_addr));
else
ip_ob_end = ip_ob_start + 2 + 2*(sizeof(struct in6_addr));
// FIXIT-L --> log everything in order!!
ip::IpApi tmp_api = p->ptrs.ip_api;
int8_t num_layer = 0;
- uint8_t tmp_next = p->get_ip_proto_next();
+ IpProtocol tmp_next = p->get_ip_proto_next();
bool first = true;
while (layer::set_outer_ip_api(p, p->ptrs.ip_api, p->ip_proto_next, num_layer) &&
uint32_t dest_ip;
uint16_t sport;
uint16_t dport;
- uint8_t protocol;
+ IpProtocol ip_proto;
};
static void load_sar(Packet* packet, Event* event, SnortActionRequest& sar)
// and only 1st 8 used for ip4
sar.src_ip = ntohl(packet->ptrs.ip_api.get_src()->ip32[0]);
sar.dest_ip = ntohl(packet->ptrs.ip_api.get_dst()->ip32[0]);
- sar.protocol = packet->get_ip_proto_next();
+ sar.ip_proto = packet->get_ip_proto_next();
if (packet->is_tcp() || packet->is_udp())
{
}
if ((p != NULL) && p->ptrs.ip_api.is_ip())
{
- uint16_t proto = p->get_ip_proto_next();
- if (protocol_names[proto] != NULL)
+ IpProtocol ip_proto = p->get_ip_proto_next();
+ if (protocol_names[to_utype(ip_proto)] != NULL)
{
SnortSnprintfAppend(event_string, sizeof(event_string),
- "{%s} ", protocol_names[proto]);
+ "{%s} ", protocol_names[to_utype(ip_proto)]);
}
else
{
SnortSnprintfAppend(event_string, sizeof(event_string),
- "{%d} ", proto);
+ "{%d} ", ip_proto);
}
if ((p->ptrs.decode_flags & DECODE_FRAG)
- || ((proto != IPPROTO_TCP)
- && (proto != IPPROTO_UDP)))
+ || ((ip_proto != IpProtocol::TCP)
+ && (ip_proto != IpProtocol::UDP)))
{
const char* ip_fmt = "%s -> %s";
if (p->is_portscan())
{
- alertdata.protocol = p->ps_proto;
+ alertdata.ip_proto = p->ps_proto;
}
else
{
- alertdata.protocol = p->get_ip_proto_next();
+ alertdata.ip_proto = p->get_ip_proto_next();
if ( p->type() == PktType::ICMP)
{
if (p->is_portscan())
{
- alertdata.protocol = p->ps_proto;
+ alertdata.ip_proto = p->ps_proto;
}
else
{
- alertdata.protocol = p->get_ip_proto_next();
+ alertdata.ip_proto = p->get_ip_proto_next();
if ( p->type() == PktType::ICMP)
{
#endif
#include <netinet/in.h>
+#include <protocols/protocol_ids.h>
+
// SNORT DEFINES
// Long time ago...
#define UNIFIED2_EVENT 1
uint32_t ip_destination;
uint16_t sport_itype;
uint16_t dport_icode;
- uint8_t protocol;
+ IpProtocol ip_proto;
uint8_t impact_flag; // overloads packet_action
uint8_t impact;
uint8_t blocked;
struct in6_addr ip_destination;
uint16_t sport_itype;
uint16_t dport_icode;
- uint8_t protocol;
+ IpProtocol ip_proto;
uint8_t impact_flag;
uint8_t impact;
uint8_t blocked;
{ 0 }
};
-THREAD_LOCAL uint16_t CodecManager::grinder_id = 0;
+THREAD_LOCAL ProtocolId CodecManager::grinder_id = ProtocolId::ETHERTYPE_NOT_SET;
THREAD_LOCAL uint8_t CodecManager::grinder = 0;
THREAD_LOCAL uint8_t CodecManager::max_layers = DEFAULT_LAYERMAX;
if (!wrap.init)
{
- std::vector<uint16_t> ids;
+ std::vector<ProtocolId> ids;
const CodecApi* const cd_api = wrap.api;
if (codec_id >= s_protocols.size())
cd->get_protocol_ids(ids);
for (auto id : ids)
{
- if (s_proto_map[id] != 0)
+ if (s_proto_map[to_utype(id)] != 0)
ParseError("The Codecs %s and %s have both been registered "
"for protocol_id %d. Codec %s will be used\n",
- s_protocols[s_proto_map[id]]->get_name(), cd->get_name(),
+ s_protocols[s_proto_map[to_utype(id)]]->get_name(), cd->get_name(),
id, cd->get_name());
- s_proto_map[id] = (decltype(s_proto_map[id]))codec_id; // future proofing
+ s_proto_map[to_utype(id)] = (decltype(s_proto_map[to_utype(id)]))codec_id; // future proofing
}
wrap.init = true;
s_protocols[grinder]->get_name(), cd->get_name(),
cd->get_name());
- std::vector<uint16_t> ids;
+ std::vector<ProtocolId> ids;
s_protocols[i]->get_protocol_ids(ids);
- grinder_id = ( ids.size() > 0 ) ? ids[0] : FINISHED_DECODE;
+ grinder_id = ( ids.size() > 0 ) ? ids[0] : ProtocolId::FINISHED_DECODE;
grinder = (uint8_t)i;
}
}
#include <cstdint>
#include "main/thread.h"
+#include "protocols/protocol_ids.h"
#ifdef PIGLET
#include "framework/codec.h"
extern THREAD_LOCAL ProfileStats decodePerfStats;
-static const uint16_t max_protocol_id = 65535;
-
#ifdef PIGLET
struct CodecWrapper
{
struct CodecApiWrapper;
static std::vector<CodecApiWrapper> s_codecs;
- static std::array<uint8_t, max_protocol_id> s_proto_map;
+ static std::array<ProtocolIndex, max_protocol_id> s_proto_map;
static std::array<Codec*, UINT8_MAX> s_protocols;
- static THREAD_LOCAL uint16_t grinder_id;
- static THREAD_LOCAL uint8_t grinder;
+ static THREAD_LOCAL ProtocolId grinder_id;
+ static THREAD_LOCAL ProtocolIndex grinder;
static THREAD_LOCAL uint8_t max_layers;
/*
bool Binding::check_proto(const Flow* flow) const
{
- if ( when.protos & (unsigned)flow->protocol )
+ if ( when.protos & (unsigned)flow->pkt_type )
return true;
return false;
return;
}
- switch ( flow->protocol )
+ switch ( flow->pkt_type )
{
case PktType::IP:
set_session(flow, INS_IP);
while ( lyr > 0 )
{
- uint16_t proto = p->layers[--lyr].prot_id;
- NormalFunc n = c->normalizers[PacketManager::proto_id(proto)];
+ ProtocolId proto_id = p->layers[--lyr].prot_id;
+ NormalFunc n = c->normalizers[PacketManager::proto_idx(proto_id)];
if ( n )
changes = n(c, p, lyr, changes);
}
if ( Norm_IsEnabled(nc, (NormFlags)NORM_IP4_ANY) )
{
- nc->normalizers[PacketManager::proto_id(ETHERTYPE_IPV4)] = Norm_IP4;
+ nc->normalizers[PacketManager::proto_idx(ProtocolId::ETHERTYPE_IPV4)] = Norm_IP4;
}
if ( Norm_IsEnabled(nc, NORM_ICMP4) )
{
- nc->normalizers[PacketManager::proto_id(IPPROTO_ID_ICMPV4)] = Norm_ICMP4;
+ nc->normalizers[PacketManager::proto_idx(ProtocolId::ICMPV4)] = Norm_ICMP4;
}
if ( Norm_IsEnabled(nc, (NormFlags)NORM_IP6_ANY) )
{
- nc->normalizers[PacketManager::proto_id(IPPROTO_ID_IPV6)] = Norm_IP6;
- nc->normalizers[PacketManager::proto_id(IPPROTO_ID_HOPOPTS)] = Norm_IP6_Opts;
- nc->normalizers[PacketManager::proto_id(IPPROTO_ID_DSTOPTS)] = Norm_IP6_Opts;
+ nc->normalizers[PacketManager::proto_idx(ProtocolId::IPV6)] = Norm_IP6;
+ nc->normalizers[PacketManager::proto_idx(ProtocolId::HOPOPTS)] = Norm_IP6_Opts;
+ nc->normalizers[PacketManager::proto_idx(ProtocolId::DSTOPTS)] = Norm_IP6_Opts;
}
if ( Norm_IsEnabled(nc, NORM_ICMP6) )
{
- nc->normalizers[PacketManager::proto_id(IPPROTO_ID_ICMPV6)] = Norm_ICMP6;
+ nc->normalizers[PacketManager::proto_idx(ProtocolId::ICMPV6)] = Norm_ICMP6;
}
if ( Norm_IsEnabled(nc, (NormFlags)NORM_TCP_ANY) )
{
- nc->normalizers[PacketManager::proto_id(IPPROTO_ID_TCP)] = Norm_TCP;
+ nc->normalizers[PacketManager::proto_idx(ProtocolId::TCP)] = Norm_TCP;
}
return 0;
}
--- /dev/null
+//--------------------------------------------------------------------------
+// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved.
+// Copyright (C) 2002-2013 Sourcefire, Inc.
+//
+// This program is free software; you can redistribute it and/or modify it
+// under the terms of the GNU General Public License Version 2 as published
+// by the Free Software Foundation. You may not use, modify or distribute
+// this program under any other version of the GNU General Public License.
+//
+// This program is distributed in the hope that it will be useful, but
+// WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+// General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+//--------------------------------------------------------------------------
+/*
+** Marc Norton <mnorton@sourcefire.com>
+** Dan Roelker <droelker@sourcefire.com>
+**
+*/
+
+#ifndef PERF_FLOW_H
+#define PERF_FLOW_H
+
+#include "perf_module.h"
+#include "main/snort_types.h"
+#include "hash/sfxhash.h"
+#include "sfip/sfip_t.h"
+#include "protocols/packet.h"
+
+#define MAX_PKT_LEN 9000
+#define MAX_PORT UINT16_MAX
+
+enum FlowType
+{
+ SFS_TYPE_TCP = 0,
+ SFS_TYPE_UDP,
+ SFS_TYPE_OTHER,
+ SFS_TYPE_MAX
+};
+
+enum FlowState
+{
+ SFS_STATE_TCP_ESTABLISHED = 0,
+ SFS_STATE_TCP_CLOSED,
+ SFS_STATE_UDP_CREATED,
+ SFS_STATE_MAX
+};
+
+struct PortFlow
+{
+ double tot_perc[MAX_PORT+1];
+ double sport_rate[MAX_PORT+1];
+ double dport_rate[MAX_PORT+1];
+};
+
+struct IcmpFlow
+{
+ double tot_perc[256];
+ int display[256];
+};
+
+/* Raw flow statistics */
+struct RawFlowStats
+{
+ time_t time;
+ uint64_t* pkt_len_cnt;
+ uint64_t pkt_total;
+
+ uint64_t byte_total;
+
+ uint64_t* pkt_len_percent;
+
+ uint64_t* port_tcp_src;
+ uint64_t* port_tcp_dst;
+ uint64_t* port_udp_src;
+ uint64_t* port_udp_dst;
+
+ uint64_t* type_icmp;
+
+ uint64_t port_tcp_high;
+ uint64_t port_tcp_total;
+
+ uint64_t port_udp_high;
+ uint64_t port_udp_total;
+
+ uint64_t type_icmp_total;
+};
+
+/* Processed flow statistics */
+struct FlowStats
+{
+ time_t time;
+ double pkt_len_percent[MAX_PKT_LEN + 2];
+ int pkt_len_percent_count;
+
+ double traffic_tcp;
+ double traffic_udp;
+ double traffic_icmp;
+ double traffic_other;
+
+ PortFlow port_flow_tcp;
+ double port_flow_high_tcp;
+ int port_flow_tcp_count;
+
+ PortFlow port_flow_udp;
+ double port_flow_high_udp;
+ int port_flow_udp_count;
+
+ IcmpFlow flow_icmp;
+ int flow_icmp_count;
+};
+
+struct TrafficStats
+{
+ uint64_t packets_a_to_b;
+ uint64_t bytes_a_to_b;
+ uint64_t packets_b_to_a;
+ uint64_t bytes_b_to_a;
+};
+
+struct FlowStateValue
+{
+ TrafficStats traffic_stats[SFS_TYPE_MAX];
+ uint64_t total_packets;
+ uint64_t total_bytes;
+ uint32_t state_changes[SFS_STATE_MAX];
+};
+
+/*
+** Functions for the performance functions to call
+*/
+void update_flow_stats(RawFlowStats*, Packet*);
+void process_flow_stats(RawFlowStats*, FILE*, PerfFormat, time_t);
+void free_flow_stats(RawFlowStats*);
+void log_flow_perf_header(FILE*);
+
+#endif
+
#include "detection/detect.h"
#define PROTO_BUFFER_SIZE 256
-#define IPPROTO_PS 0xFF
static THREAD_LOCAL Packet* g_tmp_pkt = NULL;
static THREAD_LOCAL FILE* g_logfile = NULL;
switch (proto_type)
{
case PS_PROTO_TCP:
- g_tmp_pkt->ps_proto = IPPROTO_TCP;
+ g_tmp_pkt->ps_proto = IpProtocol::TCP;
break;
case PS_PROTO_UDP:
- g_tmp_pkt->ps_proto = IPPROTO_UDP;
+ g_tmp_pkt->ps_proto = IpProtocol::UDP;
break;
case PS_PROTO_ICMP:
- g_tmp_pkt->ps_proto = IPPROTO_ICMP;
+ g_tmp_pkt->ps_proto = IpProtocol::ICMPV4;
break;
case PS_PROTO_IP:
- g_tmp_pkt->ps_proto = IPPROTO_IP;
+ g_tmp_pkt->ps_proto = IpProtocol::IP;
break;
case PS_PROTO_OPEN_PORT:
g_tmp_pkt->ps_proto = p->get_ip_proto_next();
if (g_tmp_pkt->is_ip4())
{
- ((IP4Hdr*)g_tmp_pkt->ptrs.ip_api.get_ip4h())->set_proto(IPPROTO_PS);
+ ((IP4Hdr*)g_tmp_pkt->ptrs.ip_api.get_ip4h())->set_proto(IpProtocol::PORT_SCAN);
}
else
{
// since ip_api.is_ip() && !ip4h, this is automatically ip6h
- ((ip::IP6Hdr*)g_tmp_pkt->ptrs.ip_api.get_ip6h())->set_proto(IPPROTO_PS);
+ ((ip::IP6Hdr*)g_tmp_pkt->ptrs.ip_api.get_ip6h())->set_proto(IpProtocol::PORT_SCAN);
}
switch (proto_type)
ip::IpApi tmp_api = p->ptrs.ip_api;
int8_t num_layer = 0;
- uint8_t tmp_next = p->get_ip_proto_next();
+ IpProtocol tmp_next = p->get_ip_proto_next();
bool outer_layer_only = (config->nestedIP == OUTER)? true: false;
bool outer_layer = false;
{
Lua::Args args(L);
- auto& self = CodecDataIface.create(L, 0);
+ auto& self = CodecDataIface.create(L, ProtocolId::ETHERTYPE_NOT_SET);
memset(&self, 0, sizeof(self));
if ( args[1].is_table() )
args[1].check_table(set_fields, self);
else if ( args[1].is_size() )
- self.next_prot_id = args[1].check_size();
+ {
+ // FIXIT-L: Can check_size limit size to short?
+ unsigned int tmp = args[1].check_size();
+ if(tmp > UINT16_MAX)
+ self.next_prot_id = ProtocolId::ETHERTYPE_NOT_SET;
+ else
+ self.next_prot_id = (ProtocolId)args[1].check_size();
+ }
return 1;
}
{
auto& self = CodecIface.get(L);
- std::vector<uint16_t> ret;
+ std::vector<ProtocolId> ret;
self.get_protocol_ids(ret);
lua_newtable(L);
uint32_t efl_hi = args[1].opt_size();
uint32_t efl_lo = args[2].opt_size();
- uint8_t next_proto = args[3].opt_size();
+ IpProtocol next_proto = (IpProtocol)args[3].opt_size();
uint8_t ttl = args[4].opt_size();
uint16_t dsize = args[5].opt_int();
#define PROTOCOLS_ETH_H
#include <arpa/inet.h>
+#include "protocols/protocol_ids.h"
#define ETHERNET_HEADER_LEN 14
#define ETHERNET_MTU 1500
{
constexpr uint16_t MTU_LEN = 1500;
constexpr uint16_t MAX_FRAME_LENGTH = 1500;
-constexpr uint16_t MIN_ETHERTYPE = 1536;
constexpr uint16_t ETH_HEADER_LEN = 14;
struct EtherHdr
uint16_t ether_type;
/* return data in byte order */
- inline uint16_t ethertype() const
- { return ntohs(ether_type); }
+ inline ProtocolId ethertype() const
+ { return (ProtocolId)ntohs(ether_type); }
/* return data in network order */
inline uint16_t raw_ethertype() const
inline uint8_t get_version() const
{ return version & 0x07; }
- inline uint16_t proto() const
- { return ntohs(ether_type); }
+ inline ProtocolId proto() const
+ { return (ProtocolId)ntohs(ether_type); }
inline uint16_t raw_proto() const
{ return ether_type; }
* variable hold the first non-ip and non-ipv6 extension protocols,
* while proto() returns the next or proto() field of the raw IP
* header */
-uint8_t IpApi::proto() const
+IpProtocol IpApi::proto() const
{
switch ( type )
{
case IAT_6: return ((IP6Hdr*)iph)->next();
default: break;
}
- return 0xFF;
+ return IpProtocol::PROTO_NOT_SET;
}
// header length field: datagram/payload-only length for 4/6
uint16_t tos() const;
uint8_t ttl() const;
- uint8_t proto() const;
+ IpProtocol proto() const;
uint16_t raw_len() const;
uint8_t hlen() const;
uint8_t ver() const;
uint16_t ip_id; /* identification */
uint16_t ip_off; /* fragment offset */
uint8_t ip_ttl; /* time to live field */
- uint8_t ip_proto; /* datagram protocol */
+ IpProtocol ip_proto; /* datagram protocol */
uint16_t ip_csum; /* checksum */
uint32_t ip_src; /* source IP */
uint32_t ip_dst; /* dest IP */
inline uint8_t ttl() const
{ return ip_ttl; }
- inline uint8_t proto() const
+ inline IpProtocol proto() const
{ return ip_proto; }
inline uint16_t off_w_flags() const
inline void set_hlen(uint8_t value)
{ ip_verhl = (ip_verhl & 0xf0) | (value & 0x0f); }
- inline void set_proto(uint8_t prot)
+ inline void set_proto(IpProtocol prot)
{ ip_proto = prot; }
inline void set_ip_len(uint16_t new_len)
uint32_t ip6_vtf; /* 4 bits version, 8 bits TC,len
20 bits flow-ID */
uint16_t ip6_payload_len; /* payload length */
- uint8_t ip6_next; /* next header */
+ IpProtocol ip6_next; /* next header */
uint8_t ip6_hoplim; /* hop limit */
snort_in6_addr ip6_src; /* source address */
{ return ntohs(ip6_payload_len); }
/* Same function as ipv4 */
- inline uint8_t proto() const
+ inline IpProtocol proto() const
{ return ip6_next; }
- inline uint8_t next() const
+ inline IpProtocol next() const
{ return ip6_next; }
inline uint8_t hop_lim() const
{
switch (ip6_next)
{
- case IPPROTO_NONE:
- case IPPROTO_TCP:
- case IPPROTO_UDP:
- case IPPROTO_ICMPV6:
- case IPPROTO_HOPOPTS:
- case IPPROTO_DSTOPTS:
- case IPPROTO_ROUTING:
- case IPPROTO_FRAGMENT:
+ case IpProtocol::NONEXT:
+ case IpProtocol::TCP:
+ case IpProtocol::UDP:
+ case IpProtocol::ICMPV6:
+ case IpProtocol::HOPOPTS:
+ case IpProtocol::DSTOPTS:
+ case IpProtocol::ROUTING:
+ case IpProtocol::FRAGMENT:
return true;
default:
break;
inline void set_len(uint16_t new_len)
{ ip6_payload_len = htons(new_len); }
- inline void set_proto(uint8_t prot)
+ inline void set_proto(IpProtocol prot)
{ ip6_next = prot; }
inline void set_raw_len(uint16_t new_len)
/* Generic Extension Header */
struct IP6Extension
{
- uint8_t ip6e_nxt;
+ IpProtocol ip6e_nxt;
uint8_t ip6e_len;
/* options follow */
uint8_t ip6e_pad[6];
/* Fragment header */
struct IP6Frag
{
- uint8_t ip6f_nxt; /* next header */
+ IpProtocol ip6f_nxt; /* next header */
uint8_t ip6f_reserved; /* reserved field */
uint16_t ip6f_offlg; /* offset, reserved, and flag */
uint32_t ip6f_ident; /* identification */
- inline uint8_t next() const
+ inline IpProtocol next() const
{ return ip6f_nxt; }
inline uint16_t off_w_flags() const
// Reflects the recomended IPv6 order in RFC 2460 4.1
constexpr int IPV6_ORDER_MAX = 7;
-inline int IPV6ExtensionOrder(uint8_t type)
+inline int IPV6IdExtensionOrder(const ProtocolId prot_id)
{
- switch (type)
+ switch (prot_id)
{
- case IPPROTO_ID_HOPOPTS: return 1;
- case IPPROTO_ID_DSTOPTS: return 2;
- case IPPROTO_ID_ROUTING: return 3;
- case IPPROTO_ID_FRAGMENT: return 4;
- case IPPROTO_ID_AUTH: return 5;
- case IPPROTO_ID_ESP: return 6;
+ case ProtocolId::HOPOPTS: return 1;
+ case ProtocolId::DSTOPTS: return 2;
+ case ProtocolId::ROUTING: return 3;
+ case ProtocolId::FRAGMENT: return 4;
+ case ProtocolId::AUTH: return 5;
+ case ProtocolId::ESP: return 6;
default: return IPV6_ORDER_MAX;
}
}
+inline int IPV6ExtensionOrder(const IpProtocol ip_proto)
+{
+ return IPV6IdExtensionOrder((ProtocolId)ip_proto);
+}
+
} // namespace ipv6
#endif
static inline const uint8_t* find_outer_layer(const Layer* lyr,
uint8_t num_layers,
- uint16_t prot_id)
+ ProtocolId prot_id)
{
for (int i = 0; i < num_layers; i++)
{
static inline const uint8_t* find_inner_layer(const Layer* lyr,
uint8_t num_layers,
- uint16_t prot_id)
+ ProtocolId prot_id)
{
int tmp = num_layers-1;
lyr = &lyr[tmp];
static inline const uint8_t* find_inner_layer(const Layer* lyr,
uint8_t num_layers,
- uint16_t prot_id1,
- uint16_t prot_id2)
+ ProtocolId prot_id1,
+ ProtocolId prot_id2)
{
int tmp = num_layers-1;
lyr = &lyr[tmp];
void set_packet_pointer(const Packet* const p)
{ curr_pkt = p; }
-const uint8_t* get_inner_layer(const Packet* p, uint16_t proto)
-{ return find_inner_layer(p->layers, p->num_layers, proto); }
+const uint8_t* get_inner_layer(const Packet* p, ProtocolId prot_id)
+{ return find_inner_layer(p->layers, p->num_layers, prot_id); }
-const uint8_t* get_outer_layer(const Packet* p, uint16_t proto)
-{ return find_outer_layer(p->layers, p->num_layers, proto); }
+const uint8_t* get_outer_layer(const Packet* p, ProtocolId prot_id)
+{ return find_outer_layer(p->layers, p->num_layers, prot_id); }
const arp::EtherARP* get_arp_layer(const Packet* const p)
{
const Layer* lyr = p->layers;
return reinterpret_cast<const arp::EtherARP*>(
- find_inner_layer(lyr, num_layers, ETHERTYPE_ARP, ETHERTYPE_REVARP));
+ find_inner_layer(lyr, num_layers, ProtocolId::ETHERTYPE_ARP, ProtocolId::ETHERTYPE_REVARP));
}
const gre::GREHdr* get_gre_layer(const Packet* const p)
const Layer* lyr = p->layers;
return reinterpret_cast<const gre::GREHdr*>(
- find_inner_layer(lyr, num_layers, IPPROTO_ID_GRE));
+ find_inner_layer(lyr, num_layers, ProtocolId::GRE));
}
const eapol::EtherEapol* get_eapol_layer(const Packet* const p)
const Layer* lyr = p->layers;
return reinterpret_cast<const eapol::EtherEapol*>(
- find_inner_layer(lyr, num_layers, ETHERTYPE_EAPOL));
+ find_inner_layer(lyr, num_layers, ProtocolId::ETHERTYPE_EAPOL));
}
const vlan::VlanTagHdr* get_vlan_layer(const Packet* const p)
const Layer* lyr = p->layers;
return reinterpret_cast<const vlan::VlanTagHdr*>(
- find_inner_layer(lyr, num_layers, ETHERTYPE_8021Q));
+ find_inner_layer(lyr, num_layers, ProtocolId::ETHERTYPE_8021Q));
}
const eth::EtherHdr* get_eth_layer(const Packet* const p)
// First, search for the inner eth layer (transbridging)
const eth::EtherHdr* eh = reinterpret_cast<const eth::EtherHdr*>(
- find_inner_layer(lyr, num_layers, ETHERTYPE_TRANS_ETHER_BRIDGING));
+ find_inner_layer(lyr, num_layers, ProtocolId::ETHERTYPE_TRANS_ETHER_BRIDGING));
// if no inner eth layer, assume root layer is eth (callers job to confirm)
return eh ? eh : reinterpret_cast<const eth::EtherHdr*>(get_root_layer(p));
for (int i = max_layer; i >= 0; i--)
{
- if (lyr->prot_id == IPPROTO_ID_FRAGMENT)
+ if (lyr->prot_id == ProtocolId::FRAGMENT)
return reinterpret_cast<const ip::IP6Frag*>(lyr->start);
// Only check until current ip6h header
for (int i = max_layer; i >= 0; i--)
{
- if (lyr->prot_id == IPPROTO_ID_FRAGMENT)
+ if (lyr->prot_id == ProtocolId::FRAGMENT)
return i;
lyr--;
const udp::UDPHdr* get_outer_udp_lyr(const Packet* const p)
{
return reinterpret_cast<const udp::UDPHdr*>(
- find_outer_layer(p->layers, p->num_layers, IPPROTO_UDP));
+ find_outer_layer(p->layers, p->num_layers, ProtocolId::UDP));
}
const uint8_t* get_root_layer(const Packet* const p)
{
switch (layers[i].prot_id)
{
- case ETHERTYPE_IPV4:
- case ETHERTYPE_IPV6:
- case IPPROTO_ID_IPIP:
- case IPPROTO_ID_IPV6:
+ case ProtocolId::ETHERTYPE_IPV4:
+ case ProtocolId::ETHERTYPE_IPV6:
+ case ProtocolId::IPIP:
+ case ProtocolId::IPV6:
return i;
default:
break;
ip::IpApi& api,
int8_t& curr_layer)
{
- uint8_t tmp;
+ IpProtocol tmp;
return set_inner_ip_api(p, api, tmp, curr_layer);
}
bool set_inner_ip_api(const Packet* const p,
ip::IpApi& api,
- uint8_t& next_ip_proto,
+ IpProtocol& next_ip_proto,
int8_t& curr_layer)
{
if (curr_layer < 0 || curr_layer >= p->num_layers)
switch (lyr.prot_id)
{
- case ETHERTYPE_IPV4:
- case IPPROTO_ID_IPIP:
+ case ProtocolId::ETHERTYPE_IPV4:
+ case ProtocolId::IPIP:
{
const ip::IP4Hdr* ip4h =
reinterpret_cast<const ip::IP4Hdr*>(lyr.start);
return true;
}
- case ETHERTYPE_IPV6:
- case IPPROTO_ID_IPV6:
+ case ProtocolId::ETHERTYPE_IPV6:
+ case ProtocolId::IPV6:
{
const ip::IP6Hdr* ip6h =
reinterpret_cast<const ip::IP6Hdr*>(lyr.start);
return true;
}
- case IPPROTO_ID_HOPOPTS:
- case IPPROTO_ID_DSTOPTS:
- case IPPROTO_ID_ROUTING:
- case IPPROTO_ID_FRAGMENT:
- case IPPROTO_ID_AUTH:
- case IPPROTO_ID_ESP:
- case IPPROTO_ID_MOBILITY:
- case IPPROTO_ID_NONEXT:
+ case ProtocolId::HOPOPTS:
+ case ProtocolId::DSTOPTS:
+ case ProtocolId::ROUTING:
+ case ProtocolId::FRAGMENT:
+ case ProtocolId::AUTH:
+ case ProtocolId::ESP:
+ case ProtocolId::MOBILITY:
+ case ProtocolId::NONEXT:
break;
default:
- next_ip_proto = lyr.prot_id;
+ next_ip_proto = convert_protocolid_to_ipprotocol(lyr.prot_id);
}
}
while (--curr_layer >= 0);
bool set_outer_ip_api(const Packet* const p,
ip::IpApi& api,
- uint8_t& ip_proto_next,
+ IpProtocol& ip_proto_next,
int8_t& curr_layer)
{
if (set_outer_ip_api(p, api, curr_layer))
}
}
- ip_proto_next = p->layers[curr_layer].prot_id;
+ ip_proto_next = convert_protocolid_to_ipprotocol(p->layers[curr_layer].prot_id);
return true;
}
switch (lyr.prot_id)
{
- case ETHERTYPE_IPV4:
- case IPPROTO_ID_IPIP:
+ case ProtocolId::ETHERTYPE_IPV4:
+ case ProtocolId::IPIP:
{
const ip::IP4Hdr* ip4h =
reinterpret_cast<const ip::IP4Hdr*>(lyr.start);
curr_layer++;
return true;
}
- case ETHERTYPE_IPV6:
- case IPPROTO_ID_IPV6:
+ case ProtocolId::ETHERTYPE_IPV6:
+ case ProtocolId::IPV6:
{
const ip::IP6Hdr* ip6h =
reinterpret_cast<const ip::IP6Hdr*>(lyr.start);
curr_layer++;
return true;
}
- //default:
- // don't care about this layer if its not IP.
+ default:
+ ; // don't care about this layer if its not IP.
}
}
while (++curr_layer < num_layers);
{
const Layer& lyr = p->layers[i];
- if (lyr.prot_id == PROTO_IP_EMBEDDED_IN_ICMP4)
+ if (lyr.prot_id == ProtocolId::IP_EMBEDDED_IN_ICMP4)
{
const ip::IP4Hdr* ip4h =
reinterpret_cast<const ip::IP4Hdr*>(lyr.start);
api.set(ip4h);
return true;
}
- else if (lyr.prot_id == PROTO_IP_EMBEDDED_IN_ICMP6)
+ else if (lyr.prot_id == ProtocolId::IP_EMBEDDED_IN_ICMP6)
{
const ip::IP6Hdr* ip6h =
reinterpret_cast<const ip::IP6Hdr*>(lyr.start);
#include <cstdint>
#include "main/snort_types.h"
+#include "protocol_ids.h"
struct Layer
{
const uint8_t* start;
- uint16_t prot_id;
+ ProtocolId prot_id;
uint16_t length;
};
// Set by PacketManager. Ensure you can call layer:: without a packet pointers
void set_packet_pointer(const Packet* const);
-SO_PUBLIC const uint8_t* get_inner_layer(const Packet*, uint16_t proto);
-SO_PUBLIC const uint8_t* get_outer_layer(const Packet*, uint16_t proto);
+SO_PUBLIC const uint8_t* get_inner_layer(const Packet*, ProtocolId proto);
+SO_PUBLIC const uint8_t* get_outer_layer(const Packet*, ProtocolId proto);
SO_PUBLIC const arp::EtherARP* get_arp_layer(const Packet*);
SO_PUBLIC const vlan::VlanTagHdr* get_vlan_layer(const Packet*);
*/
SO_PUBLIC bool set_inner_ip_api(const Packet* const, ip::IpApi&, int8_t& curr_layer);
SO_PUBLIC bool set_inner_ip_api(const Packet* const, ip::IpApi&,
- uint8_t& next_ip_proto, int8_t& curr_layer);
+ IpProtocol& next_ip_proto, int8_t& curr_layer);
/*
* Identical to above function except will begin searching from the
*/
SO_PUBLIC bool set_outer_ip_api(const Packet* const, ip::IpApi&, int8_t& curr_layer);
SO_PUBLIC bool set_outer_ip_api(const Packet* const, ip::IpApi&,
- uint8_t& next_ip_proto, int8_t& curr_layer);
+ IpProtocol& next_ip_proto, int8_t& curr_layer);
} // namespace layer
#endif
#endif
-bool Packet::get_ip_proto_next(uint8_t& lyr, uint8_t& proto) const
+bool Packet::get_ip_proto_next(uint8_t& lyr, IpProtocol& proto) const
{
if (lyr > num_layers)
return false;
{
switch (layers[lyr].prot_id)
{
- case IPPROTO_ID_IPV6:
- case ETHERTYPE_IPV6:
+ case ProtocolId::IPV6:
+ case ProtocolId::ETHERTYPE_IPV6:
// move past this IP layer and any IPv6 extensions.
while ( ((lyr + 1) < num_layers) && is_ip6_extension(layers[lyr+1].prot_id) )
++lyr;
- if ( (layers[lyr].prot_id == IPPROTO_ID_IPV6) || (layers[lyr].prot_id ==
- ETHERTYPE_IPV6) )
+ if ( (layers[lyr].prot_id == ProtocolId::IPV6) || (layers[lyr].prot_id ==
+ ProtocolId::ETHERTYPE_IPV6) )
proto = reinterpret_cast<const ip::IP6Hdr*>(layers[lyr++].start)->next();
else
proto = reinterpret_cast<const ip::IP6Extension*>(layers[lyr++].start)->ip6e_nxt;
return true;
- case ETHERTYPE_IPV4:
- case IPPROTO_ID_IPIP:
+ case ProtocolId::ETHERTYPE_IPV4:
+ case ProtocolId::IPIP:
proto = reinterpret_cast<const ip::IP4Hdr*>(layers[lyr++].start)->proto();
return true;
uint16_t alt_dsize; /* the dsize of a packet before munging (used for log)*/
uint8_t num_layers; /* index into layers for next encap */
- uint8_t ip_proto_next; /* the protocol ID after IP and all IP6 extension */
+ IpProtocol ip_proto_next; /* the protocol ID after IP and all IP6 extension */
bool disable_inspect;
class Endianness* endianness;
// for correlating configuration with event output
uint16_t user_policy_id;
- uint8_t ps_proto; // Used for portscan and unified2 logging
+ IpProtocol ps_proto; // Used for portscan and unified2 logging
// IP_MAXPACKET is the minimum allowable max_dsize
// there is no requirement that all data fit into an IP datagram
* eth::ip4::udp::teredo::ip6::hop_opts::ipv6_routing::tcp
* this function return 6 == IPPROTO_TCP == IPPROTO_ID_TCP
*/
- inline uint8_t get_ip_proto_next() const
+ inline IpProtocol get_ip_proto_next() const
{ return ip_proto_next; }
/* Similar to above. However, this function
* ....
* }
*/
- bool get_ip_proto_next(uint8_t& lyr, uint8_t& proto) const;
+ bool get_ip_proto_next(uint8_t& lyr, IpProtocol& proto) const;
inline void reset()
{
//-------------------------------------------------------------------------
static inline void push_layer(Packet* p,
- uint16_t prot_id,
+ ProtocolId prot_id,
const uint8_t* hdr_start,
uint32_t len)
{
if ( SnortConfig::tunnel_bypass_enabled(TUNNEL_TEREDO) )
Active::clear_tunnel_bypass();
- const uint8_t mapped_prot = CodecManager::s_proto_map[PROTO_TEREDO];
+ const ProtocolIndex mapped_prot = CodecManager::s_proto_map[to_utype(ProtocolId::TEREDO)];
s_stats[mapped_prot + stat_offset]--;
p->num_layers--;
DecodeData unsure_encap_ptrs;
- uint8_t mapped_prot = CodecManager::grinder;
- uint16_t prev_prot_id = CodecManager::grinder_id;
+ ProtocolIndex mapped_prot = CodecManager::grinder;
+ ProtocolId prev_prot_id = CodecManager::grinder_id;
RawData raw(pkthdr, pkt);
- CodecData codec_data(FINISHED_DECODE);
+ CodecData codec_data(ProtocolId::FINISHED_DECODE);
if ( cooked )
codec_data.codec_flags |= CODEC_STREAM_REBUILT;
// FIXIT-M refactor when ip_proto's become an array
if ( p->is_fragment() )
{
- if ( prev_prot_id == IPPROTO_ID_FRAGMENT )
+ if ( prev_prot_id == ProtocolId::FRAGMENT )
{
const ip::IP6Frag* const fragh =
reinterpret_cast<const ip::IP6Frag*>(raw.data);
}
else
{
- p->ip_proto_next = (uint8_t)codec_data.next_prot_id;
+ p->ip_proto_next = convert_protocolid_to_ipprotocol(codec_data.next_prot_id);
}
}
// internal statistics and record keeping
s_stats[mapped_prot + stat_offset]++; // add correct decode for previous layer
- mapped_prot = CodecManager::s_proto_map[codec_data.next_prot_id];
+ mapped_prot = CodecManager::s_proto_map[to_utype(codec_data.next_prot_id)];
prev_prot_id = codec_data.next_prot_id;
// set for next call
raw.len -= curr_lyr_len;
raw.data += curr_lyr_len;
p->proto_bits |= codec_data.proto_bits;
- codec_data.next_prot_id = FINISHED_DECODE;
+ codec_data.next_prot_id = ProtocolId::FINISHED_DECODE;
codec_data.lyr_len = 0;
codec_data.invalid_bytes = 0;
codec_data.proto_bits = 0;
s_stats[mapped_prot + stat_offset]++;
// if the final protocol ID is not the default codec, a Codec failed
- if (prev_prot_id != FINISHED_DECODE)
+ if (prev_prot_id != ProtocolId::FINISHED_DECODE)
{
if (codec_data.codec_flags & CODEC_UNSURE_ENCAP)
{
switch (p->layers[p->num_layers-1].prot_id)
{
- case IPPROTO_ID_ESP:
+ case ProtocolId::ESP:
// Hardcoding ESP because we trust iff the layer
// immediately preceding the fail is ESP.
p->ptrs.decode_flags |= DECODE_PKT_TRUST;
break;
- case PROTO_TEREDO:
+ case ProtocolId::TEREDO:
// if we just decoded teredo and the next
// layer fails, we made a mistake. Therefore,
// remove this bit.
pop_teredo(p, raw);
break;
+ default:
+ ;
} /* switch */
}
else
{
- if ( (p->num_layers > 0) && (p->layers[p->num_layers-1].prot_id == PROTO_TEREDO) &&
- (prev_prot_id == IPPROTO_IPV6) )
+ if ( (p->num_layers > 0) && (p->layers[p->num_layers-1].prot_id == ProtocolId::TEREDO) &&
+ (prev_prot_id == ProtocolId::IPV6) )
{
pop_teredo(p, raw);
}
// if the codec exists, it failed
- if (CodecManager::s_proto_map[prev_prot_id])
+ if (CodecManager::s_proto_map[to_utype(prev_prot_id)])
{
s_stats[discards]++;
}
{
s_stats[other_codecs]++;
- if ( (MIN_UNASSIGNED_IP_PROTO <= prev_prot_id) &&
- (prev_prot_id <= std::numeric_limits<uint8_t>::max()) &&
+ if ( (to_utype(ProtocolId::MIN_UNASSIGNED_IP_PROTO) <= to_utype(prev_prot_id)) &&
+ (to_utype(prev_prot_id) <= std::numeric_limits<uint8_t>::max()) &&
!(codec_data.codec_flags & CODEC_STREAM_REBUILT) )
{
SnortEventqAdd(GID_DECODE, DECODE_IP_UNASSIGNED_PROTO);
bool PacketManager::encode(const Packet* p,
EncodeFlags flags,
uint8_t lyr_start,
- uint8_t next_prot,
+ IpProtocol next_prot,
Buffer& buf)
{
if ( encode_pkt )
for (int i = outer_layer; i > inner_layer; --i)
{
const Layer& l = lyrs[i];
- uint8_t mapped_prot = i ? CodecManager::s_proto_map[l.prot_id] : CodecManager::grinder;
+ ProtocolIndex mapped_prot = i ? CodecManager::s_proto_map[to_utype(l.prot_id)] : CodecManager::grinder;
if (!CodecManager::s_protocols[mapped_prot]->encode(l.start, l.length, enc, buf))
{
return false;
for (int i = outer_layer; i >= 0; --i)
{
const Layer& l = lyrs[i];
- uint8_t mapped_prot = i ? CodecManager::s_proto_map[l.prot_id] : CodecManager::grinder;
+ ProtocolIndex mapped_prot = i ? CodecManager::s_proto_map[to_utype(l.prot_id)] : CodecManager::grinder;
if (!CodecManager::s_protocols[mapped_prot]->encode(l.start, l.length, enc, buf))
{
}
// FIXIT-M -- check flags if we should skip something
- if (encode(p, flags, p->num_layers-1, ENC_PROTO_UNSET, buf))
+ if (encode(p, flags, p->num_layers-1, IpProtocol::PROTO_NOT_SET, buf))
{
len = buf.size();
return buf.data() + buf.off;
icmph->csum = checksum::icmp_cksum((uint16_t*)buf.data(), buf.size());
- if (encode(p, flags, inner_ip_index, IPPROTO_ID_ICMPV4, buf))
+ if (encode(p, flags, inner_ip_index, IpProtocol::ICMPV4, buf))
{
len = buf.size();
return buf.data() + buf.off;
memcpy(ps6.sip, ip6h->get_src()->u6_addr8, sizeof(ps6.sip));
memcpy(ps6.dip, ip6h->get_dst()->u6_addr8, sizeof(ps6.dip));
ps6.zero = 0;
- ps6.protocol = IPPROTO_ICMPV6;
+ ps6.protocol = IpProtocol::ICMPV6;
ps6.len = htons((uint16_t)(ip_len));
icmph->csum = checksum::icmp_cksum((uint16_t*)buf.data(), ip_len, &ps6);
- if (encode(p, flags, inner_ip_index, IPPROTO_ICMPV6, buf))
+ if (encode(p, flags, inner_ip_index, IpProtocol::ICMPV6, buf))
{
len = buf.size();
return buf.data() + buf.off;
// NOTE: this must always go from outer to inner
// to ensure a valid ip header
- uint8_t mapped_prot = i ? CodecManager::s_proto_map[lyr->prot_id] : CodecManager::grinder;
+ ProtocolIndex mapped_prot = i ? CodecManager::s_proto_map[to_utype(lyr->prot_id)] : CodecManager::grinder;
CodecManager::s_protocols[mapped_prot]->format(
reverse, const_cast<uint8_t*>(lyr->start), c->ptrs);
for (int i = outer_layer; i > inner_layer; --i)
{
const Layer& l = lyr[i];
- uint8_t mapped_prot = i ?
- CodecManager::s_proto_map[l.prot_id] : CodecManager::grinder;
+ ProtocolIndex mapped_prot = i ?
+ CodecManager::s_proto_map[to_utype(l.prot_id)] : CodecManager::grinder;
CodecManager::s_protocols[mapped_prot]->update(
tmp_api, flags, const_cast<uint8_t*>(l.start), l.length, len);
for (int i = outer_layer; i >= 0; --i)
{
const Layer& l = lyr[i];
- uint8_t mapped_prot = CodecManager::s_proto_map[l.prot_id];
+ ProtocolIndex mapped_prot = CodecManager::s_proto_map[to_utype(l.prot_id)];
CodecManager::s_protocols[mapped_prot]->update(
tmp_api, flags, const_cast<uint8_t*>(l.start), l.length, len);
}
// zero out the default codecs
g_stats[3] = 0;
- g_stats[CodecManager::s_proto_map[FINISHED_DECODE] + stat_offset] = 0;
+ g_stats[CodecManager::s_proto_map[to_utype(ProtocolId::FINISHED_DECODE)] + stat_offset] = 0;
for (unsigned int i = 0; i < stat_names.size(); i++)
pkt_names.push_back(stat_names[i]);
// mutex is automatically unlocked
}
-const char* PacketManager::get_proto_name(uint16_t protocol)
-{ return CodecManager::s_protocols[CodecManager::s_proto_map[protocol]]->get_name(); }
+const char* PacketManager::get_proto_name(ProtocolId protocol)
+{ return CodecManager::s_protocols[CodecManager::s_proto_map[to_utype(protocol)]]->get_name(); }
-const char* PacketManager::get_proto_name(uint8_t protocol)
-{ return CodecManager::s_protocols[CodecManager::s_proto_map[protocol]]->get_name(); }
+const char* PacketManager::get_proto_name(IpProtocol protocol)
+{ return CodecManager::s_protocols[CodecManager::s_proto_map[to_utype(protocol)]]->get_name(); }
void PacketManager::log_protocols(TextLog* const text_log,
const Packet* const p)
for (int i = 1; i < num_layers; i++)
{
- const uint16_t protocol = lyr[i].prot_id;
+ const auto protocol = to_utype(lyr[i].prot_id);
const uint8_t codec_offset = CodecManager::s_proto_map[protocol];
cd = CodecManager::s_protocols[codec_offset];
TextLog_NewLine(text_log);
TextLog_Print(text_log, "%-.*s", 6, cd->get_name());
- // don't print the type if this is a custom type. Look
- // in protocol_ids.h for more details.
if (protocol <= 0xFF)
TextLog_Print(text_log, "(0x%02x)", protocol);
- else if (protocol >= eth::MIN_ETHERTYPE)
+ else
TextLog_Print(text_log, "(0x%04x)", protocol);
TextLog_Puts(text_log, ": ");
// print codec information. MUST be called after thread_term.
static void dump_stats();
- // Get the name of the given protocol
- static const char* get_proto_name(uint16_t protocol);
+ // Get the name of the given protocol ID
+ static const char* get_proto_name(ProtocolId);
- // Get the name of the given protocol
- static const char* get_proto_name(uint8_t protocol);
+ // Get the name of the given IP protocol
+ static const char* get_proto_name(IpProtocol);
// print this packets information, layer by layer
static void log_protocols(TextLog* const, const Packet* const);
{ return CodecManager::s_protocols.size(); }
/* If a proto was registered in a Codec's get_protocol_ids() function,
- * this function will return the 'ID' of the Codec to which the proto belongs.
+ * this function will return the 'ProtocolIndex' of the Codec to which the proto belongs.
* If none of the loaded Codecs registered that proto, this function will
* return zero. */
- static uint8_t proto_id(uint16_t proto)
- { return CodecManager::s_proto_map[proto]; }
+ static ProtocolIndex proto_idx(ProtocolId prot_id)
+ { return CodecManager::s_proto_map[to_utype(prot_id)]; }
private:
// The only time we should accumulate is when CodecManager tells us too
static void pop_teredo(Packet*, RawData&);
static bool encode(const Packet* p, EncodeFlags,
- uint8_t lyr_start, uint8_t next_prot, Buffer& buf);
+ uint8_t lyr_start, IpProtocol next_prot, Buffer& buf);
// constant offsets into the s_stats array. Notice the stat_offset
// constant which is used when adding a protocol specific codec
#ifndef PROTOCOLS_PROTOCOL_IDS_H
#define PROTOCOLS_PROTOCOL_IDS_H
+#include <assert.h>
+#include <cstdint>
+#include <type_traits>
+#include <limits>
+
/*****************************************************************
***** NOTE: Protocols are only included in this file when ****
- ***** their IDs are needed throughout multiple ****
- ***** files. If a protocol ID is only needed in ****
- ***** one file, define that number as a ****
- ***** static const uint16_t ID_NAME = ZZZZ ****
- ***** in the specific file. ****
+ ***** their IDs are needed. ****
****************************************************************/
/*
* 1536 (0x6000) - 65536 (0xFFFF) --> Ethertypes
*/
+// Convert enum to a value cast to the enum's underlying type.
+template<typename En>
+constexpr auto to_utype(En t) -> typename std::underlying_type<En>::type
+{
+ return static_cast<typename std::underlying_type<En>::type>(t);
+}
+
+
+using ProtocolIndex = uint8_t;
+
/*
* Below is a partial list of protocol numbers for the IP protocols.
* Defined at:
* http://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml
*/
+enum class IpProtocol : std::uint8_t
+{
+ IP = 0,
+ HOPOPTS = 0,
+ ICMPV4 = 1,
+ IGMP = 2,
+ IPIP = 4,
+ TCP = 6,
+ UDP = 17,
+ IPV6 = 41,
+ ROUTING = 43,
+ FRAGMENT = 44,
+ GRE = 47,
+ ESP = 50,
+ AUTH = 51, // RFC 4302
+ SWIPE = 53,
+ MOBILITY = 55,
+ ICMPV6 = 58,
+ NONEXT = 59,
+ DSTOPTS = 60,
+ SUN_ND = 77,
+ PGM = 113,
+
+ /* Last updated 3/31/2016.
+ Source: http://www.iana.org/assignments/protocol-numbers/protocol-numbers.xml */
+ MIN_UNASSIGNED_IP_PROTO = 143,
+
+ RESERVED = 255, // == 0xFF
+ PORT_SCAN = 255,
+ PROTO_NOT_SET = 255, // Indicates protocol has not been set.
+};
+
+
+// Values up to 255 MUST be identical to those in IpProtocol.
+enum class ProtocolId : std::uint16_t
+{
+ ETHERTYPE_NOT_SET = 0,
+ IP = 0,
+ HOPOPTS = 0,
+ ICMPV4 = 1,
+ IGMP = 2,
+ IPIP = 4,
+ TCP = 6,
+ UDP = 17,
+ IPV6 = 41,
+ ROUTING = 43,
+ FRAGMENT = 44,
+ GRE = 47,
+ ESP = 50,
+ AUTH = 51, // RFC 4302
+ SWIPE = 53,
+ MOBILITY = 55,
+ ICMPV6 = 58,
+ NONEXT = 59,
+ DSTOPTS = 60,
+ SUN_ND = 77,
+ PGM = 113,
+
+ /* Last updated 3/31/2016.
+ Source: http://www.iana.org/assignments/protocol-numbers/protocol-numbers.xml */
+ MIN_UNASSIGNED_IP_PROTO = 143,
+
+ RESERVED = 255, // == 0xFF
+ PORT_SCAN = 255,
+ PROTO_NOT_SET = 255, // Indicates protocol has not been set.
+
+ /*
+ * Undefined Protocol!
+ */
+ FINISHED_DECODE = 0x0100, // Indicates Codecs have succesfully decoded packet
+ TEREDO = 0x0101,
+ GTP = 0x0102,
+ IP_EMBEDDED_IN_ICMP4 = 0x0103,
+ IP_EMBEDDED_IN_ICMP6 = 0x0104,
+ ETHERNET_802_3 = 0x0105,
+ ETHERNET_802_11 = 0x0106,
+ ETHERNET_LLC = 0x0107,
+
+ /*
+ * Below is a partial list of ethertypes.
+ * Defined at:
+ * http://www.iana.org/assignments/ieee-802-numbers/ieee-802-numbers.xhtml
+ */
+ ETHERTYPE_MINIMUM = 0x0600, // 1536 - lowest ethertype value.
+ ETHERTYPE_ERSPAN_TYPE3 = 0x22eb,
+ ETHERTYPE_TRANS_ETHER_BRIDGING = 0x6558,
+ ETHERTYPE_IPV4 = 0x0800,
+ ETHERTYPE_REVARP = 0x8035,
+ ETHERTYPE_ARP = 0x0806,
+ ETHERTYPE_8021Q = 0x8100,
+ ETHERTYPE_IPX = 0x8137,
+ ETHERTYPE_IPV6 = 0x86dd,
+ ETHERTYPE_PPP = 0x880B,
+ ETHERTYPE_MPLS_UNICAST = 0x8847,
+ ETHERTYPE_MPLS_MULTICAST = 0x8848,
+ ETHERTYPE_PPPOE_DISC = 0x8863,
+ ETHERTYPE_PPPOE_SESS = 0x8864,
+ ETHERTYPE_EAPOL = 0x888e,
+ ETHERTYPE_ERSPAN_TYPE2 = 0x88be,
+ ETHERTYPE_FPATH = 0x8903,
+};
+
+static const auto max_protocol_id = std::numeric_limits<std::underlying_type<ProtocolId>::type>::max();
+
+#if 0
constexpr uint16_t IPPROTO_ID_HOPOPTS = 0;
constexpr uint16_t IPPROTO_ID_ICMPV4 = 1;
constexpr uint16_t IPPROTO_ID_IPIP = 4;
constexpr uint16_t IPPROTO_ID_DSTOPTS = 60;
constexpr uint16_t IPPROTO_ID_RESERVED = 255; // == 0xFF
-/* Last updated 2/4/2015.
- Source: http://www.iana.org/assignments/protocol-numbers/protocol-numbers.xml */
constexpr uint16_t MIN_UNASSIGNED_IP_PROTO = 143;
/*
constexpr uint16_t ETHERTYPE_PPP = 0x880B;
constexpr uint16_t ETHERTYPE_EAPOL = 0x888e;
constexpr uint16_t ETHERTYPE_FPATH = 0x8903;
+#endif
+
+inline IpProtocol convert_protocolid_to_ipprotocol(const ProtocolId prot_id)
+{
+ assert(to_utype(prot_id) <= UINT8_MAX);
+
+ return IpProtocol(prot_id);
+}
-inline bool is_ip6_extension(const uint16_t proto)
+inline bool is_ip6_extension(const ProtocolId prot_id)
{
- if(proto > UINT8_MAX)
+ if(to_utype(prot_id) > UINT8_MAX)
return false;
- switch (proto)
+ switch (prot_id)
{
- case IPPROTO_ID_HOPOPTS:
- case IPPROTO_ID_DSTOPTS:
- case IPPROTO_ID_ROUTING:
- case IPPROTO_ID_FRAGMENT:
- case IPPROTO_ID_AUTH:
- case IPPROTO_ID_ESP:
- case IPPROTO_ID_MOBILITY:
- case IPPROTO_ID_NONEXT:
+ case ProtocolId::HOPOPTS:
+ case ProtocolId::DSTOPTS:
+ case ProtocolId::ROUTING:
+ case ProtocolId::FRAGMENT:
+ case ProtocolId::AUTH:
+ case ProtocolId::ESP:
+ case ProtocolId::MOBILITY:
+ case ProtocolId::NONEXT:
return true;
default:
return false;
/* Call into Streams to mark data channel as something to ignore. */
FlowData* fd = stream.get_application_data_from_ip_port(
- (uint8_t)PktType::UDP, IPPROTO_UDP, &mdataA->maddress,mdataA->mport,
+ PktType::UDP, IpProtocol::UDP, &mdataA->maddress,mdataA->mport,
&mdataB->maddress, mdataB->mport, 0, 0, p->pkth->address_space_id,
SipFlowData::flow_id);
if ( fd )
src = iph.get_src();
dst = iph.get_dst();
- skey.protocol = p->get_ip_proto_next();
+ skey.pkt_type = p->type();
skey.version = src->is_ip4() ? 4 : 6;
if (p->proto_bits & PROTO_BIT__TCP_EMBED_ICMP)
Packet* p
)
{
- if ( !p->flow || p->flow->protocol != PktType::IP )
+ if ( !p->flow || p->flow->pkt_type != PktType::IP )
return -1;
FragTracker* ft = &((IpSession*)p->flow->session)->tracker;
const Layer& lyr = dpkt->layers[dpkt->num_layers-1];
- if ((lyr.prot_id == ETHERTYPE_IPV6) || (lyr.prot_id == IPPROTO_ID_IPV6))
+ if ((lyr.prot_id == ProtocolId::ETHERTYPE_IPV6) || (lyr.prot_id == ProtocolId::IPV6))
{
ip::IP6Hdr* const rawHdr =
const_cast<ip::IP6Hdr*>(dpkt->ptrs.ip_api.get_ip6h());
- rawHdr->ip6_next = ft->protocol;
+ const_cast<ip::IP6Hdr*>(dpkt->ptrs.ip_api.get_ip6h());
+ rawHdr->ip6_next = ft->ip_proto;
}
else
{
ip::IP6Extension* const ip6_ext = const_cast<ip::IP6Extension*>(
reinterpret_cast<const ip::IP6Extension*>(lyr.start));
- ip6_ext->ip6e_nxt = ft->protocol;
+ ip6_ext->ip6e_nxt = ft->ip_proto;
}
dpkt->dsize = (uint16_t)ft->calculated_size;
*/
// FIXIT-M Since we no longer let UDP through, does this detection still work?
if ((frag_offset != 0)) /* ||
- ((p->get_ip_proto_next() != IPPROTO_UDP) && (p->ptrs.decode_flags & DECODE_MF))) */
+ ((p->get_ip_proto_next() != IpProtocol::UDP) && (p->ptrs.decode_flags & DECODE_MF))) */
{
DisableDetect();
}
FragRebuild(ft, p);
if (frag_offset != 0 ||
- (p->get_ip_proto_next() != IPPROTO_UDP && ft->frag_flags & FRAG_REBUILT))
+ (p->get_ip_proto_next() != IpProtocol::UDP && ft->frag_flags & FRAG_REBUILT))
{
// Need to reset some things here because the rebuilt packet
// will have reset the do_detect flag when it hits Inspect.
if (p->is_ip6() && (net_frag_offset == 0))
{
const ip::IP6Frag* const fragHdr = layer::get_inner_ip6_frag();
- if (ft->protocol != fragHdr->ip6f_nxt)
+ if (ft->ip_proto != fragHdr->ip6f_nxt)
{
- ft->protocol = fragHdr->ip6f_nxt;
+ ft->ip_proto = fragHdr->ip6f_nxt;
}
}
if ( p->is_ip4() )
{
const ip::IP4Hdr* const ip4h = p->ptrs.ip_api.get_ip4h();
- ft->protocol = ip4h->proto();
+ ft->ip_proto = ip4h->proto();
frag_off = ip4h->off();
}
else /* IPv6 */
frag_off = fragHdr->off();
if (frag_off == 0)
- ft->protocol = fragHdr->ip6f_nxt;
+ ft->ip_proto = fragHdr->ip6f_nxt;
}
ft->ttl = p->ptrs.ip_api.ttl(); /* store the first ttl we got */
/* tracker for a fragmented packet set */
struct FragTracker
{
- uint8_t protocol; /* IP protocol */
+ IpProtocol ip_proto; /* IP protocol */
uint8_t ttl; /* ttl used to detect evasions */
uint8_t alerted;
FragEngine* engine;
int ordinal;
+
+ // FIXIT-M: Why do we have this ipprotocol? Is this ProtocolId?
int ipprotocol;
int application_protocol;
uint32_t frag_policy;
void TcpStreamSession::init_new_tcp_session(TcpSegmentDescriptor& tsd)
{
- flow->protocol = tsd.get_pkt()->type();
+ flow->pkt_type = tsd.get_pkt()->type();
/* New session, previous was marked as reset. Clear the reset flag. */
flow->clear_session_flags(SSNFLAG_RESET);
//-------------------------------------------------------------------------
Flow* Stream::get_session_ptr_from_ip_port(
- uint8_t type, uint8_t proto,
+ PktType type, IpProtocol proto,
const sfip_t* srcIP, uint16_t srcPort,
const sfip_t* dstIP, uint16_t dstPort,
uint16_t vlan, uint32_t mplsId, uint16_t addressSpaceId)
return;
key->init(
- (uint8_t)p->type(), p->get_ip_proto_next(),
+ p->type(), p->get_ip_proto_next(),
p->ptrs.ip_api.get_src(), p->ptrs.sp,
p->ptrs.ip_api.get_dst(), p->ptrs.dp,
// if the vlan protocol bit is defined, vlan layer gauranteed to exist
}
FlowData* Stream::get_application_data_from_ip_port(
- uint8_t type, uint8_t proto,
+ PktType type, IpProtocol proto,
const sfip_t* srcIP, uint16_t srcPort,
const sfip_t* dstIP, uint16_t dstPort,
uint16_t vlan, uint32_t mplsId,
}
/* Flush any queued data on the client and/or server */
- if (flow->protocol == PktType::TCP)
+ if (flow->pkt_type == PktType::TCP)
{
if (flow->ssn_state.ignore_direction & SSN_DIR_FROM_CLIENT)
flow->session->flush_client(p);
/* This should preferably only be called when ipprotocol is 0. */
void Stream::set_ip_protocol(Flow* flow)
{
- switch (flow->protocol)
+ switch (flow->pkt_type)
{
case PktType::TCP:
flow->ssn_state.ipprotocol = SNORT_PROTO_TCP;
// Get pointer to application data for a flow based on the lookup tuples for cases where
// Snort does not have an active packet that is relevant.
static FlowData* get_application_data_from_ip_port(
- uint8_t type, uint8_t proto,
+ PktType type, IpProtocol proto,
const sfip_t *a1, uint16_t p1, const sfip_t *a2, uint16_t p2,
uint16_t vlanId, uint32_t mplsId, uint16_t addrSpaceId, unsigned flow_id);
// Get pointer to a session flow instance for a flow based on the lookup tuples for
// cases where Snort does not have an active packet that is relevant.
static Flow* get_session_ptr_from_ip_port(
- uint8_t type, uint8_t proto,
+ PktType type, IpProtocol proto,
const sfip_t *a1, uint16_t p1, const sfip_t *a2, uint16_t p2,
uint16_t vlanId, uint32_t mplsId, uint16_t addrSpaceId);
bool flow_ready = true;
// FIXIT-L can't get here without protocol being set to TCP, is this really needed??
- if (flow->protocol != PktType::TCP)
+ if (flow->pkt_type != PktType::TCP)
{
DebugMessage(DEBUG_STREAM_STATE, "Lightweight session not TCP on TCP packet\n");
flow_ready = false;
static int ProcessUdp(
Flow* lwssn, Packet* p, StreamUdpConfig*, SFXHASH_NODE*)
{
- assert(lwssn->protocol == PktType::UDP);
+ assert(lwssn->pkt_type == PktType::UDP);
if ( stream.blocked_session(lwssn, p) )
return 0;
ssn_time.tv_usec = p->pkth->ts.tv_usec;
flow->ssn_state.session_flags |= SSNFLAG_SEEN_SENDER;
- flow->protocol = p->type();
+ flow->pkt_type = p->type();
flow->ssn_state.direction = FROM_CLIENT;
StreamUdpConfig* pc = get_udp_cfg(flow->ssn_server);
}
{
- flow->protocol = p->type();
+ flow->pkt_type = p->type();
if (flow->ssn_state.session_flags & SSNFLAG_RESET)
flow->ssn_state.session_flags &= ~SSNFLAG_RESET;
projects / thirdparty / snort3.git / commitdiff
