removing a few more fields from packet

diff --git a/src/codecs/ip/cd_frag.cc b/src/codecs/ip/cd_frag.cc
index 9dfc4015b6d6d1b8063431bc2a476c27ad307ab6..027596404e290ff770092b088824436b849befa2 100644 (file)
--- a/src/codecs/ip/cd_frag.cc
+++ b/src/codecs/ip/cd_frag.cc
@@ -97,8 +97,8 @@ bool Ipv6FragCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
     if (ipv6::is_res_set(ip6frag_hdr))
         p->decode_flags |= DECODE__RF;
 
-
-    p->frag_offset = IP6F_OFFSET(ip6frag_hdr);
+    // three least signifigant bits are all flags
+    p->frag_offset = ntohs(ip6frag_hdr->get_off()) >> 3;
     if (p->frag_offset || (p->decode_flags & DECODE__MF))
     {
         p->decode_flags |= DECODE__FRAG;

diff --git a/src/codecs/ip/cd_igmp.cc b/src/codecs/ip/cd_igmp.cc
index 9a3670651285f11e0755a94099a8073a74748a6c..6d2eb558b17cf176c9dcd0335d81e2fde221ec87 100644 (file)
--- a/src/codecs/ip/cd_igmp.cc
+++ b/src/codecs/ip/cd_igmp.cc
@@ -61,9 +61,11 @@ bool IgmpCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
 
     if (raw_len >= 1 && raw_pkt[0] == 0x11)
     {
-        if (p->ip_options_data != NULL) {
-            if (p->ip_options_len >= 2) {
-                if (*(p->ip_options_data) == 0 && *(p->ip_options_data+1) == 0)
+        const uint8_t* ip_opt_data = p->ip_api.get_ip_opt_data();
+
+        if (ip_opt_data != nullptr) {
+            if (p->ip_api.get_ip_opt_len() >= 2) {
+                if (*(ip_opt_data) == 0 && *(ip_opt_data+1) == 0)
                 {
                     codec_events::decoder_event(p, DECODE_IGMP_OPTIONS_DOS);
                     return false;

diff --git a/src/codecs/ip/cd_ipv4.cc b/src/codecs/ip/cd_ipv4.cc
index 97559026393e0ac09526fa6ce46ea4e008aefe8d..3973cc9984b9816de459cc965c0133373890119a 100644 (file)
--- a/src/codecs/ip/cd_ipv4.cc
+++ b/src/codecs/ip/cd_ipv4.cc
@@ -189,7 +189,6 @@ bool Ipv4Codec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
 
     /* lay the IP struct over the raw data */
     IPHdr* iph = reinterpret_cast<IPHdr*>(const_cast<uint8_t *>(raw_pkt));
-    p->ip_api.set(iph);
 
     /*
      * with datalink DLT_RAW it's impossible to differ ARP datagrams from IP.
@@ -251,6 +250,9 @@ bool Ipv4Codec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
         return false;
     }
 
+    // set the api now since this layer has been verified as valid
+    p->ip_api.set(iph);
+
     /*
      * IP Header tests: Land attack, and Loop back test
      */
@@ -272,12 +274,11 @@ bool Ipv4Codec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
     }
 
     /* test for IP options */
-    p->ip_options_len = (uint16_t)(hlen - ip::IP4_HEADER_LEN);
+    uint16_t ip_opt_len = (uint16_t)(hlen - ip::IP4_HEADER_LEN);
 
-    if(p->ip_options_len > 0)
+    if(ip_opt_len > 0)
     {
-        p->ip_options_data = raw_pkt + ip::IP4_HEADER_LEN;
-        DecodeIPOptions((raw_pkt + ip::IP4_HEADER_LEN), p->ip_options_len, p);
+        DecodeIPOptions((raw_pkt + ip::IP4_HEADER_LEN), ip_opt_len, p);
     }
     else
     {
@@ -287,11 +288,6 @@ bool Ipv4Codec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
          * Zero these options so they aren't associated with this inner IP
          * since p->iph will be pointing to this inner IP
          */
-        if (p->encapsulations)
-        {
-            p->ip_options_data = NULL;
-            p->ip_options_len = 0;
-        }
         p->ip_option_count = 0;
     }
 
@@ -300,31 +296,31 @@ bool Ipv4Codec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
     ip_len -= hlen;
 
     /* check for fragmented packets */
-    p->frag_offset = ntohs(iph->get_off());
+    uint16_t frag_off = ntohs(iph->get_off());
 
     /*
      * get the values of the reserved, more
      * fragments and don't fragment flags
      */
-    if (p->frag_offset & 0x8000)
+    if (frag_off & 0x8000)
         p->decode_flags |= DECODE__RF;
 
-    if (p->frag_offset & 0x4000)
+    if (frag_off & 0x4000)
         p->decode_flags |= DECODE__DF;
 
-    if (p->frag_offset & 0x2000)
+    if (frag_off & 0x2000)
         p->decode_flags |= DECODE__MF;
 
     /* mask off the high bits in the fragment offset field */
-    p->frag_offset &= 0x1FFF;
+    frag_off &= 0x1FFF;
 
-    if ((p->decode_flags & DECODE__DF) && p->frag_offset )
+    if ((p->decode_flags & DECODE__DF) && frag_off )
         codec_events::decoder_event(p, DECODE_IP4_DF_OFFSET);
 
-    if ( p->frag_offset + ip_len > IP_MAXPACKET )
+    if ( frag_off + ip_len > IP_MAXPACKET )
         codec_events::decoder_event(p, DECODE_IP4_LEN_OFFSET);
 
-    if(p->frag_offset || (p->decode_flags & DECODE__MF))
+    if(frag_off || (p->decode_flags & DECODE__MF))
     {
         if ( !ip_len)
         {
@@ -349,19 +345,19 @@ bool Ipv4Codec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
         codec_events::decoder_event(p, DECODE_BAD_FRAGBITS);
     }
 
+    p->frag_offset = frag_off;
 
     /* See if there are any ip_proto only rules that match */
     fpEvalIpProtoOnlyRules(snort_conf->ip_proto_only_lists, p, iph->get_proto());
 
     p->proto_bits |= PROTO_BIT__IP;
-
     IPMiscTests(p);
     lyr_len = hlen;
 
     /* if this packet isn't a fragment
      * or if it is, its a UDP packet and offset is 0 */
     if(!(p->decode_flags & DECODE__FRAG) ||
-            ((p->decode_flags & DECODE__FRAG) && (p->frag_offset == 0) &&
+            ((p->decode_flags & DECODE__FRAG) && (frag_off == 0) &&
             (iph->get_proto() == IPPROTO_UDP)))
     {
         DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "IP header length: %lu\n",

diff --git a/src/codecs/ip/cd_ipv6.cc b/src/codecs/ip/cd_ipv6.cc
index 5ab6770df536205c38df387f2246f69458fc2fed..3569cbb4ca5d535a98b17bbbf33c018cb578a692 100644 (file)
--- a/src/codecs/ip/cd_ipv6.cc
+++ b/src/codecs/ip/cd_ipv6.cc
@@ -201,11 +201,6 @@ bool Ipv6Codec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
 
 
     /* Remove outer IP options */
-    if (p->encapsulations)
-    {
-        p->ip_options_data = NULL;
-        p->ip_options_len = 0;
-    }
     p->ip_option_count = 0;
 
     /* set the real IP length for logging */

diff --git a/src/codecs/ip/cd_tcp.cc b/src/codecs/ip/cd_tcp.cc
index fbdffabdbddb01b64558bdda01091d4ae8ff54fa..7efd856ea6a6a49fe8611998804b2764b9c0b48e 100644 (file)
--- a/src/codecs/ip/cd_tcp.cc
+++ b/src/codecs/ip/cd_tcp.cc
@@ -111,7 +111,7 @@ void TcpCodec::get_protocol_ids(std::vector<uint16_t>& v)
 bool TcpCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
         Packet *p, uint16_t &lyr_len, uint16_t& /*next_prot_id*/)
 {
-    if(raw_len < tcp::hdr_len())
+    if(raw_len < tcp::TCP_HEADER_LEN)
     {
         DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
             "TCP packet (len = %d) cannot contain " "20 byte header\n", raw_len););
@@ -123,15 +123,16 @@ bool TcpCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
     }
 
     /* lay TCP on top of the data cause there is enough of it! */
-    p->tcph = reinterpret_cast<tcp::TCPHdr*>(const_cast<uint8_t*>(raw_pkt));
+    tcp::TCPHdr* tcph = reinterpret_cast<tcp::TCPHdr*>(const_cast<uint8_t*>(raw_pkt));
+    p->tcph = tcph;
 
     /* multiply the payload offset value by 4 */
-    lyr_len = TCP_OFFSET(p->tcph) << 2;
+    lyr_len = tcph->hdr_len();
 
     DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "TCP th_off is %d, passed len is %lu\n",
                 TCP_OFFSET(p->tcph), (unsigned long)raw_len););
 
-    if(lyr_len < tcp::hdr_len())
+    if(lyr_len < tcp::TCP_HEADER_LEN)
     {
         DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
             "TCP Data Offset (%d) < lyr_len (%d) \n",
@@ -269,18 +270,16 @@ bool TcpCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
     p->dp = ntohs(p->tcph->th_dport);
 
 
-    DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "tcp header starts at: %p\n", p->tcph););
-
     /* if options are present, decode them */
-    p->tcp_options_len = (uint16_t)(lyr_len - tcp::hdr_len());
+    uint16_t tcp_opt_len = (uint16_t)(tcph->hdr_len() - tcp::TCP_HEADER_LEN);
 
-    if(p->tcp_options_len > 0)
+    if(tcp_opt_len > 0)
     {
         DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "%lu bytes of tcp options....\n",
-                    (unsigned long)(p->tcp_options_len)););
+                    (unsigned long)(tcp_opt_len)););
 
-        p->tcp_options_data = raw_pkt + tcp::hdr_len();
-        DecodeTCPOptions((uint8_t *) (raw_pkt + tcp::hdr_len()), p->tcp_options_len, p);
+        p->tcp_options_data = raw_pkt + tcp::TCP_HEADER_LEN;
+        DecodeTCPOptions((uint8_t *) (raw_pkt + tcp::TCP_HEADER_LEN), tcp_opt_len, p);
     }
     else
     {
@@ -383,7 +382,7 @@ void DecodeTCPOptions(const uint8_t *start, uint32_t o_len, Packet *p)
      * 4) increment option code ptr
      *
      * TCP_OPTLENMAX = 40 because of
-     *        (((2^4) - 1) * 4  - tcp::hdr_len)
+     *        (((2^4) - 1) * 4  - tcp::TCP_HEADER_LEN
      *
      */
 
@@ -690,7 +689,7 @@ bool TcpCodec::update(Packet* p, Layer* lyr, uint32_t* len)
 {
     tcp::TCPHdr* h = reinterpret_cast<tcp::TCPHdr*>(lyr->start);
 
-    *len += tcp::get_tcp_hdr_len(h) + p->dsize;
+    *len += h->hdr_len() + p->dsize;
 
     if ( !PacketWasCooked(p) || (p->packet_flags & PKT_REBUILT_FRAG) )
     {

diff --git a/src/codecs/link/cd_pppoe.cc b/src/codecs/link/cd_pppoe.cc
index 67625028c221f7dace2d5a05168d83535eeabc5d..da351029a4c8877cd15226cc7b4366d2dd28474b 100644 (file)
--- a/src/codecs/link/cd_pppoe.cc
+++ b/src/codecs/link/cd_pppoe.cc
@@ -40,10 +40,10 @@ enum class PppoepktType
 /* PPPoEHdr Header; eth::EtherHdr plus the PPPoE Header */
 struct PPPoEHdr
 {
-    unsigned char ver_type;     /* pppoe version/type */
-    unsigned char code;         /* pppoe code CODE_* */
-    unsigned short session;     /* session id */
-    unsigned short length;      /* payload length */
+    uint8_t ver_type;     /* pppoe version/type */
+    uint8_t code;         /* pppoe code CODE_* */
+    uint16_t session;     /* session id */
+    uint16_t length;      /* payload length */
                                 /* payload follows */
 };
 

diff --git a/src/framework/codec.h b/src/framework/codec.h
index 2332cae550d3de71f20c86bc4dd6c3b28a359cd7..4b2d3c6f41c44b43c2958895c24755f64166f94f 100644 (file)
--- a/src/framework/codec.h
+++ b/src/framework/codec.h
@@ -45,14 +45,14 @@ enum EncodeType{
 
 
 typedef uint32_t EncodeFlags;
-const uint32_t ENC_FLAG_FWD = 0x80000000;  // send in forward direction
-const uint32_t ENC_FLAG_SEQ = 0x40000000;  // VAL bits contain seq adj
-const uint32_t ENC_FLAG_ID  = 0x20000000;  // use randomized IP ID
-const uint32_t ENC_FLAG_NET = 0x10000000;  // stop after innermost network (ip4/6) layer
-const uint32_t ENC_FLAG_DEF = 0x08000000;  // stop before innermost ip4 opts or ip6 frag header
-const uint32_t ENC_FLAG_RAW = 0x04000000;  // don't encode outer eth header (this is raw ip)
-const uint32_t ENC_FLAG_RES = 0x03000000;  // bits reserved for future use
-const uint32_t ENC_FLAG_VAL = 0x00FFFFFF;  // bits for adjusting seq and/or ack
+constexpr uint32_t ENC_FLAG_FWD = 0x80000000;  // send in forward direction
+constexpr uint32_t ENC_FLAG_SEQ = 0x40000000;  // VAL bits contain seq adj
+constexpr uint32_t ENC_FLAG_ID  = 0x20000000;  // use randomized IP ID
+constexpr uint32_t ENC_FLAG_NET = 0x10000000;  // stop after innermost network (ip4/6) layer
+constexpr uint32_t ENC_FLAG_DEF = 0x08000000;  // stop before innermost ip4 opts or ip6 frag header
+constexpr uint32_t ENC_FLAG_RAW = 0x04000000;  // don't encode outer eth header (this is raw ip)
+constexpr uint32_t ENC_FLAG_RES = 0x03000000;  // bits reserved for future use
+constexpr uint32_t ENC_FLAG_VAL = 0x00FFFFFF;  // bits for adjusting seq and/or ack
 
 
 struct EncState{

diff --git a/src/main/snort.cc b/src/main/snort.cc
index bb06d27d25a43dbbb6ac940b89e22abdc89e70ef..a3541a221eb2fdd38a8b017ef353c3e5a55eec02 100644 (file)
--- a/src/main/snort.cc
+++ b/src/main/snort.cc
@@ -816,10 +816,6 @@ DAQ_Verdict ProcessPacket(
     if ( !p->proto_bits )
         p->proto_bits = PROTO_BIT__OTHER;
 
-    // FIXIT required until decoders are fixed
-    else if ( !p->family && (p->proto_bits & PROTO_BIT__IP) )
-        p->proto_bits &= ~PROTO_BIT__IP;
-
     set_policy(p);
 
     p->user_policy_id = get_ips_policy()->user_policy_id;

diff --git a/src/managers/packet_manager.cc b/src/managers/packet_manager.cc
index 805edc14912860bfac7b730762d5ce9267138f0c..ff7d57e14261bba819d775774ba2141389f70e75 100644 (file)
--- a/src/managers/packet_manager.cc
+++ b/src/managers/packet_manager.cc
@@ -431,6 +431,8 @@ void PacketManager::decode(
         if ( p->num_layers == LAYER_MAX )
         {
             codec_events::decoder_event(p, DECODE_TOO_MANY_LAYERS);
+            p->dsize = (uint16_t)len;
+            p->data = pkt;
             MODULE_PROFILE_END(decodePerfStats);
             return /*false */;
         }
@@ -480,6 +482,12 @@ void PacketManager::decode(
         ipv6_util::CheckIPv6ExtensionOrder(p);
 
     s_stats[mapped_prot + stat_offset]++;
+
+    /*
+     * NOTE:  NEVER RETURN BEFORE SETTING THESE TWO VARIABLES!!
+     *        they are no longer zeroed above, which means if they
+     *        unset, undefined behavior will ensure
+     */
     p->dsize = (uint16_t)len;
     p->data = pkt;
 

diff --git a/src/network_inspectors/normalize/norm.cc b/src/network_inspectors/normalize/norm.cc
index f2c4ebb8ed5cc3dc5b4ec0df1a762e45a0699582..2bae380bf10f7ab8c4536a6819db2d3d031e59d9 100644 (file)
--- a/src/network_inspectors/normalize/norm.cc
+++ b/src/network_inspectors/normalize/norm.cc
@@ -494,18 +494,20 @@ static int Norm_TCP (
         sfBase.iPegs[PERF_COUNT_TCP_URG]++;
         changes++;
     }
-    if ( p->tcp_options_len > 0 )
+
+    uint8_t tcp_options_len = p->tcph->options_len();
+    if ( tcp_options_len > 0 )
     {
-        uint8_t* opts = p->layers[layer].start + TCP_HEADER_LEN;
+        uint8_t* opts = p->layers[layer].start + tcp::TCP_HEADER_LEN;
 
         if ( Norm_IsEnabled(c, NORM_TCP_OPT) )
         {
-            changes = Norm_TCPOptions(c, opts, p->tcp_options_len,
+            changes = Norm_TCPOptions(c, opts, tcp_options_len,
                 h, p->tcp_option_count, changes);
         }
         else
         {
-            changes = Norm_TCPPadding(opts, p->tcp_options_len,
+            changes = Norm_TCPPadding(opts, tcp_options_len,
                 p->tcp_option_count, changes);
         }
     }

diff --git a/src/protocols/ip.cc b/src/protocols/ip.cc
index e3f5b44ec887f7538a15cbdbd6735dc3c424ca0f..057947d30f8583df8310b3c71281e0d24119b504 100644 (file)
--- a/src/protocols/ip.cc
+++ b/src/protocols/ip.cc
@@ -138,7 +138,7 @@ uint32_t IpApi::id(const Packet* const p) const
         return ip4h->get_id();
 
     // ensure we have an ipv6 frag
-    if (p->ip6_extension_count == 0 || p->ip_frag_start == 0)
+    if (p->ip6_extension_count == 0 || p->ip_frag_start == 0 || !ip6h )
         return 0;
 
     const IP6Frag* const frag_hdr = reinterpret_cast<const IP6Frag* const>(
@@ -153,7 +153,7 @@ uint16_t IpApi::off(const Packet* const p) const
         return ip4h->get_id();
 
     // ensure we have an ipv6 frag
-    if (p->ip6_extension_count == 0 || p->ip_frag_start == 0)
+    if (p->ip6_extension_count == 0 || p->ip_frag_start == 0 || !ip6h)
         return 0;
 
     const IP6Frag* const frag_hdr = reinterpret_cast<const IP6Frag* const>(

diff --git a/src/protocols/ip.h b/src/protocols/ip.h
index b631c78526a8a65acbb9812f13fa2548b08508b1..43dab8f74caf52ee82bfa8435673674a1a2b7b57 100644 (file)
--- a/src/protocols/ip.h
+++ b/src/protocols/ip.h
@@ -116,6 +116,14 @@ public:
     inline uint32_t get_ip4_dst() const
     { return ip4h ? ip4h->get_dst() : 0; }
 
+    // only relevent to IP4.
+    inline uint8_t get_ip_opt_len() const
+    { return ip4h ? ip4h->get_opt_len() : 0; }
+
+    // only relevent to IP4.
+    inline const uint8_t* get_ip_opt_data() const
+    { return ip4h ? reinterpret_cast<const uint8_t*>(ip4h + IP4_HEADER_LEN) : nullptr; }
+
     inline const ipv6::snort_in6_addr* get_ip6_src() const
     { return ip6h ? ip6h->get_src() : nullptr; }
 

diff --git a/src/protocols/ipv4.h b/src/protocols/ipv4.h
index 1c412e4c4ebed0945c263a79dd60af4c34785551..2866b959e29519cdd53c76989e3d25ddfdb7385d 100644 (file)
--- a/src/protocols/ipv4.h
+++ b/src/protocols/ipv4.h
@@ -146,6 +146,9 @@ struct IPHdr
     inline uint32_t get_dst() const
     { return ip_dst; }
 
+    inline uint8_t get_opt_len() const
+    { return (get_hlen() << 2) - IP4_HEADER_LEN; }
+
     /* booleans */
     inline bool is_src_broadcast() const
     { return ip_src == detail::IP4_BROADCAST; }

diff --git a/src/protocols/ipv6.h b/src/protocols/ipv6.h
index f47f41d26ef0656163fa5ccda0407f0bee36fb65..f4de91c616672264a7fa3d049d705e71ff677385 100644 (file)
--- a/src/protocols/ipv6.h
+++ b/src/protocols/ipv6.h
@@ -61,10 +61,8 @@ constexpr uint8_t IP6_HEADER_LEN = 40;
    (ntohl(p_rawiph->ip6_vtf) >> 28)
 
 
-#define IP6F_OFFSET_MASK    0xfff8  /* mask out offset from _offlg */
 #define IP6F_MF_MASK        0x0001  /* more-fragments flag */
 
-#define IP6F_OFFSET(fh) ((ntohs((fh)->ip6f_offlg) & IP6F_OFFSET_MASK) >> 3)
 
 
 enum class MulticastScope : uint8_t

diff --git a/src/protocols/packet.h b/src/protocols/packet.h
index 604252c08f5aa8e482415c6a84ff76f5975f0361..40655354381002a32af680172c827da1c8ee5397 100644 (file)
--- a/src/protocols/packet.h
+++ b/src/protocols/packet.h
@@ -175,47 +175,31 @@ struct Options
 struct Packet
 {
 
-    //vvv------------------------------------------------
-    // TODO convenience stuff to be refactored for layers
-    //^^^------------------------------------------------
-
-    //vvv-----------------------------
-
+    /* these four pounters are each referenced literally
+     * hundreds of times.  NOTHING else should be added!!
+     */
     const tcp::TCPHdr* tcph;
     const udp::UDPHdr* udph;
     const ICMPHdr* icmph;
-
-    //^^^-----------------------------
-
     Flow* flow;   /* for session tracking */
 
-    //vvv-----------------------------
-    int family;
-    //^^^-----------------------------
+
 
     uint32_t packet_flags;      /* special flags for the packet */
     uint32_t xtradata_mask;
+    uint16_t proto_bits;        /* protocols contained within this packet */
+    int16_t application_protocol_ordinal;
 
-    uint16_t proto_bits;
 
-    //vvv-----------------------------
-    const uint8_t* data;        /* packet payload pointer */
-    uint16_t dsize;             /* packet payload size */
     uint16_t alt_dsize;         /* the dsize of a packet before munging (used for log)*/
-    //^^^-----------------------------
+    uint16_t sp;                /* source port (TCP/UDP) */
+    uint16_t dp;                /* dest port (TCP/UDP) */
+
 
     uint16_t frag_offset;       /* fragment offset number */
     uint16_t ip_frag_len;
-    uint16_t ip_options_len;
-    uint16_t tcp_options_len;
 
-    //vvv-----------------------------
-    uint16_t sp;                /* source port (TCP/UDP) */
-    uint16_t dp;                /* dest port (TCP/UDP) */
-    //^^^-----------------------------
-    // and so on ...
 
-    int16_t application_protocol_ordinal;
 
     uint8_t ip_option_count;    /* number of options in this packet */
     uint8_t tcp_option_count;
@@ -225,12 +209,16 @@ struct Packet
     uint8_t error_flags;        /* flags indicate checksum errors, bad TTLs, etc. */
     uint8_t num_layers;         /* index into layers for next encap */
     uint8_t decode_flags;       /* flags used while decoding */
-    uint8_t encapsulations;     /* thh curent number of encapsulations */
+    uint8_t encapsulations;     /* the curent number of encapsulations */
 
     // nothing after this point is zeroed ...
     const DAQ_PktHdr_t *pkth;    // packet meta data
     const uint8_t *pkt;         // raw packet data
 
+    // These are both set before PacketManager::decode() returns
+    const uint8_t* data;        /* packet payload pointer */
+    uint16_t dsize;             /* packet payload size */
+
     ip::IpOptions ip_options[IP_OPTMAX];         /* ip options decode structure */
     Options tcp_options[TCP_OPTLENMAX];    /* tcp options decode struct */
     IP6Option ip6_extensions[IP6_EXTMAX];  /* IPv6 Extension References */
@@ -238,13 +226,11 @@ struct Packet
 
 
     const uint8_t *ip_frag_start;
-    const uint8_t *ip_options_data;
     const uint8_t *tcp_options_data;
 
     Layer layers[LAYER_MAX];    /* decoded encapsulations */
 
     ip::IpApi ip_api;
-
     mpls::MplsHdr mplsHdr;
 
     PseudoPacketType pseudo_type;    // valid only when PKT_PSEUDO is set
@@ -348,16 +334,6 @@ static inline void SetExtraData (Packet* p, uint32_t xid)
     p->xtradata_mask |= BIT(xid);
 }
 
-static inline bool is_ip4(const Packet *p)
-{
-  return p->family == AF_INET;
-}
-
-static inline bool is_ip6(const Packet *p)
-{
-  return p->family == AF_INET6;
-}
-
 static inline uint16_t EXTRACT_16BITS(const uint8_t* p)
 {
     return ntohs(*(uint16_t*)(p));

diff --git a/src/protocols/tcp.h b/src/protocols/tcp.h
index 48a5e845a33a38b9583b0444cc911ebdf3f52b0a..172c03131aa563bc7f86726c4933d38704b12618 100644 (file)
--- a/src/protocols/tcp.h
+++ b/src/protocols/tcp.h
@@ -76,13 +76,10 @@
 namespace tcp
 {
 
-namespace detail
-{
-
-constexpr uint8_t TCP_HEADER_LEN = 20;
-
-} // namespace detail
 
+constexpr uint8_t TCP_HEADER_LEN = 20; // this is actually the minimal TCP header lenght
+constexpr int OPT_TRUNC = -1;
+constexpr int OPT_BADLEN = -2;
 
 struct TCPHdr
 {
@@ -95,15 +92,24 @@ struct TCPHdr
     uint16_t th_win;       /* window */
     uint16_t th_sum;       /* checksum */
     uint16_t th_urp;       /* urgent pointer */
+
+    inline uint8_t hdr_len() const
+    { return (th_offx2 & 0xf0) >> 2; }
+
+    inline uint8_t off() const
+    { return th_offx2 >> 4; }
+
+    inline uint8_t options_len() const
+    { return hdr_len() - TCP_HEADER_LEN; }
 };
 
-const int OPT_TRUNC = -1;
-const int OPT_BADLEN = -2;
 
+#if 0
 inline uint8_t hdr_len()
 {
     return detail::TCP_HEADER_LEN;
 }
+#endif
 
 inline uint8_t get_tcp_hdr_len(const TCPHdr *h)
 {
@@ -189,7 +195,7 @@ inline void set_tcp_x2(TCPHdr* tcph, uint8_t value)
 #define TCP_ISFLAGSET(tcph, flags) (((tcph)->th_flags & (flags)) == (flags))
 
 
-}  // namespace Tcp
+}  // namespace tcp
 
 
 
@@ -259,7 +265,4 @@ inline void set_tcp_x2(TCPHdr* tcph, uint8_t value)
 #define TCPOPT_AUTH   29  /* [RFC5925] - The TCP Authentication Option
                              Intended to replace MD5 Signature Option [RFC2385] */
 
-#define TCP_HEADER_LEN tcp::hdr_len()
-
-
 #endif /* TCP_H */

diff --git a/src/sfip/sfip_t.h b/src/sfip/sfip_t.h
index 5d1ba16199473d256e107b6fe3b3788a270f2c11..43978a0f38c8e52e506661f5eb1b7946dfe22693 100644 (file)
--- a/src/sfip/sfip_t.h
+++ b/src/sfip/sfip_t.h
@@ -70,19 +70,8 @@ struct sfip_t {
 
 };
 
-
-// because we can --- and this is leftover from Snort which we're stuck with
-#ifdef inet_ntoa
-#undef inet_ntoa
-#endif
-
-char *sfip_to_str(const sfip_t *ip);
-#define sfip_ntoa(x) sfip_to_str(x)
-#define inet_ntoa sfip_ntoa
-
-
 /*
- * Implementing these functions rather than opeators since
+ * Implementing these functions rather than implenting opeators since
  * the Google style guide recomends staying away from
  * operators.  Most of these are a copy and paste from sf_ip.h
  */
@@ -98,6 +87,16 @@ static inline void sfip_copy(sfip_t& lhs, const sfip_t* const rhs);
 
 
 
+// because we can --- and this is leftover from Snort which we're stuck with
+#ifdef inet_ntoa
+#undef inet_ntoa
+#endif
+
+char *sfip_to_str(const sfip_t *ip);
+#define sfip_ntoa(x) sfip_to_str(x)
+#define inet_ntoa sfip_ntoa
+
+
 /* Returns 1 if the IP is non-zero. 0 otherwise *
  * XXX This is a performance critical function,
  *  need to determine if it's safe to not check these pointers

diff --git a/src/stream/ip/ip_defrag.cc b/src/stream/ip/ip_defrag.cc
index 4f518c78f725a89a301bcf9e48da30fa97b70029..8505b86e0322c1b48c88f2738780d29593c7fb67 100644 (file)
--- a/src/stream/ip/ip_defrag.cc
+++ b/src/stream/ip/ip_defrag.cc
@@ -653,7 +653,8 @@ static int FragHandleIPOptions(FragTracker *ft,
          * This is the first packet.  If it has IP options,
          * save them off, so we can set them on the reassembled packet.
          */
-        if (p->ip_options_len)
+        uint16_t ip_options_len = p->ip_api.get_ip_opt_len();
+        if (ip_options_len)
         {
             if (ft->ip_options_data)
             {
@@ -667,9 +668,9 @@ static int FragHandleIPOptions(FragTracker *ft,
             else
             {
                 /* Allocate and copy in the options */
-                ft->ip_options_data = (uint8_t*)SnortAlloc(p->ip_options_len);
-                memcpy(ft->ip_options_data, p->ip_options_data, p->ip_options_len);
-                ft->ip_options_len = p->ip_options_len;
+                ft->ip_options_data = (uint8_t*)SnortAlloc(ip_options_len);
+                memcpy(ft->ip_options_data, p->ip_api.get_ip_opt_data(), ip_options_len);
+                ft->ip_options_len = ip_options_len;
                 ft->ip_option_count = p->ip_option_count;
             }
         }