doc/snort_manual.html
doc/snort_manual.pdf
doc/snort_manual.tgz
+doc/snort_manual.xml
install-sh
libtool
ltmain.sh
COMMAND ${CMAKE_COMMAND} -P ${CMAKE_CURRENT_BINARY_DIR}/cmake_uninstall.cmake)
+
+## FOO FOR BUILDING ARCHIVE PACKAGES!!
+
+set (CPACK_GENERATOR TGZ ZIP TGZ TZ STGZ)
+set (CPACK_PACKAGE_NAME "snort")
+
+# This will always be false unless manually set
+if (BUILD_DEBIAN_ARCHIVE)
+ list(APPEND CPACK_GENERATOR DEB)
+endif()
+
+SET(CPACK_DEBIAN_PACKAGE_MAINTAINER "SNORT-TEAM") #required
+
+# RPM foo
+set( CPACK_RPM_PACKAGE_SUMMARY "The snort RPM package summary")
+set( CPACK_RPM_PACKAGE_NAME "snort-rpm")
+set( CPACK_RPM_PACKAGE_VERSION "${SNORT_VERSION_MAJOR}.${SNORT_VERSION_MINOR}.${SNORT_VERSION_BUILD}")
+set( CPACK_RPM_PACKAGE_ARCHITECTURE "noarch")
+set (CPACK_RPM_PACKAGE_RELEASE 1)
+set( CPACK_RPM_PACKAGE_LICENSE "unknown")
+#set( CPACK_RPM_PACKAGE_GROUP "unknown")
+set( CPACK_RPM_PACKAGE_VENDOR "Cisco")
+set( CPACK_RPM_PACKAGE_DESCRIPTION "Snort RPM")
+
+
+include(CPack)
+
~EthCodec(){};
- virtual void get_protocol_ids(std::vector<uint16_t>& v) {};
+ virtual void get_protocol_ids(std::vector<uint16_t>&) {};
virtual void get_data_link_type(std::vector<int>&);
virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id);
* Returns: void function
*/
bool EthCodec::decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
+ Packet *p, uint16_t &lyr_len, uint16_t& next_prot_id)
{
// dc.eth++;
* Returns: void function
*/
bool Icmp4Codec::decode(const uint8_t* raw_pkt, const uint32_t raw_len,
- Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
+ Packet *p, uint16_t &lyr_len, uint16_t& /*next_prot_id*/)
{
if(raw_len < icmp4::hdr_len())
{
p->dsize = (uint16_t)len;
return;
+#if 0
case IPPROTO_PGM:
p->data = pkt;
p->dsize = (uint16_t)len;
p->dsize = (uint16_t)len;
CheckIGMPVuln(p);
return;
+#endif
default:
if (GET_IPH_PROTO(p) >= MIN_UNASSIGNED_IP_PROTO)
}
}
-static inline void CheckPGMVuln(Packet *p)
-{
- if ( pgm_nak_detect((uint8_t *)p->data, p->dsize) == PGM_NAK_VULN )
- codec_events::decoder_event(p, DECODE_PGM_NAK_OVERFLOW);
-}
-
-
-//--------------------------------------------------------------------
-// IP4 vulnerabilities
-//--------------------------------------------------------------------
-
-/* This PGM NAK function started off as an SO rule, sid 8351. */
-static inline int pgm_nak_detect (uint8_t *data, uint16_t length) {
- uint16_t data_left;
- uint16_t checksum;
- PGM_HEADER *header;
-
- if (NULL == data) {
- return PGM_NAK_ERR;
- }
-
- /* request must be bigger than 44 bytes to cause vuln */
- if (length <= sizeof(PGM_HEADER)) {
- return PGM_NAK_ERR;
- }
-
- header = (PGM_HEADER *) data;
-
- if (8 != header->type) {
- return PGM_NAK_ERR;
- }
-
- if (2 != header->nak.opt.type) {
- return PGM_NAK_ERR;
- }
-
-
- /*
- * alert if the amount of data after the options is more than the length
- * specified.
- */
-
-
- data_left = length - 36;
- if (data_left > header->nak.opt.len) {
-
- /* checksum is expensive... do that only if the length is bad */
- if (header->checksum != 0) {
- checksum = in_chksum_ip((unsigned short*)data, (int)length);
- if (checksum != 0)
- return PGM_NAK_ERR;
- }
-
- return PGM_NAK_VULN;
- }
-
- return PGM_NAK_OK;
-}
-
-/* This function is a port of an old .so rule, sid 3:8092. */
-static inline void CheckIGMPVuln(Packet *p)
-{
- int i, alert = 0;
-
- if (p->dsize >= 1 && p->data[0] == 0x11)
- {
- if (p->ip_options_data != NULL) {
- if (p->ip_options_len >= 2) {
- if (*(p->ip_options_data) == 0 && *(p->ip_options_data+1) == 0)
- {
- codec_events::decoder_event(p, DECODE_IGMP_OPTIONS_DOS);
- return;
- }
- }
- }
-
- for(i=0; i< (int) p->ip_option_count; i++) {
- /* All IGMPv2 packets contain IP option code 148 (router alert).
- This vulnerability only applies to IGMPv3, so return early. */
- if (ipv4::is_opt_rtralt(p->ip_options[i].code)) {
- return; /* No alert. */
- }
-
- if (p->ip_options[i].len == 1) {
- alert++;
- }
- }
-
- if (alert > 0)
- codec_events::decoder_event(p, DECODE_IGMP_OPTIONS_DOS);
- }
-}
-
-
-//--------------------------------------------------------------------
+//------------------------------------------------------------------
// decode.c::IP4 misc
//--------------------------------------------------------------------
* blen - byte length
*
*/
-static inline unsigned short in_chksum_ip( unsigned short * w, int blen )
-{
- unsigned int cksum;
-
- /* IP must be >= 20 bytes */
- cksum = w[0];
- cksum += w[1];
- cksum += w[2];
- cksum += w[3];
- cksum += w[4];
- cksum += w[5];
- cksum += w[6];
- cksum += w[7];
- cksum += w[8];
- cksum += w[9];
-
- blen -= 20;
- w += 10;
-
- while( blen ) /* IP-hdr must be an integral number of 4 byte words */
- {
- cksum += w[0];
- cksum += w[1];
- w += 2;
- blen -= 4;
- }
-
- cksum = (cksum >> 16) + (cksum & 0x0000ffff);
- cksum += (cksum >> 16);
-
- return (unsigned short) (~cksum);
-}
-
//-------------------------------------------------------------------------
extern const BaseApi* cd_teredo;
extern const BaseApi* cd_transbridge;
extern const BaseApi* cd_vlan;
+extern const BaseApi* cd_igmp;
+extern const BaseApi* cd_pgm;
#endif
const BaseApi* codecs[] =
cd_erspan3.cc
cd_pppencap.cc
cd_pppoepkt.cc
+ cd_igmp.cc
+ cd_pgm.cc
)
target_link_libraries( codec_plugins
--- /dev/null
+/*
+** Copyright (C) 2002-2013 Sourcefire, Inc.
+** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include "framework/codec.h"
+#include "codecs/decode_module.h"
+#include "events/codec_events.h"
+
+
+namespace
+{
+
+class IgmpCodec : public Codec
+{
+public:
+ IgmpCodec() : Codec("igmp"){};
+ ~IgmpCodec() {};
+
+
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
+ Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
+
+ virtual void get_protocol_ids(std::vector<uint16_t>&);
+ virtual void get_data_link_type(std::vector<int>&){};
+
+};
+
+
+} // namespace
+
+
+
+
+
+bool IgmpCodec::decode(const uint8_t *raw_pkt, const uint32_t len,
+ Packet *p, uint16_t& /*lyr_len*/, uint16_t& /*next_prot_id*/)
+{
+ int i, alert = 0;
+
+ if (len >= 1 && raw_pkt[0] == 0x11)
+ {
+ if (p->ip_options_data != NULL) {
+ if (p->ip_options_len >= 2) {
+ if (*(p->ip_options_data) == 0 && *(p->ip_options_data+1) == 0)
+ {
+ codec_events::decoder_event(p, DECODE_IGMP_OPTIONS_DOS);
+ return false;
+ }
+ }
+ }
+
+ for(i=0; i< (int) p->ip_option_count; i++) {
+ /* All IGMPv2 packets contain IP option code 148 (router alert).
+ This vulnerability only applies to IGMPv3, so return early. */
+ if (ipv4::is_opt_rtralt(p->ip_options[i].code)) {
+ return true; /* No alert. */
+ }
+
+ if (p->ip_options[i].len == 1) {
+ alert++;
+ }
+ }
+
+ if (alert > 0)
+ codec_events::decoder_event(p, DECODE_IGMP_OPTIONS_DOS);
+ }
+ return true;
+}
+
+void IgmpCodec::get_protocol_ids(std::vector<uint16_t>& v)
+{
+ v.push_back(IPPROTO_IGMP);
+}
+
+
+
+//-------------------------------------------------------------------------
+// api
+//-------------------------------------------------------------------------
+
+static Codec* ctor()
+{
+ return new IgmpCodec();
+}
+
+static void dtor(Codec *cd)
+{
+ delete cd;
+}
+
+
+static const char* name = "igmp";
+static const CodecApi igmp_api =
+{
+ {
+ PT_CODEC,
+ name,
+ CDAPI_PLUGIN_V0,
+ 0,
+ nullptr,
+ nullptr,
+ },
+ nullptr, // pinit
+ nullptr, // pterm
+ nullptr, // tinit
+ nullptr, // tterm
+ ctor, // ctor
+ dtor, // dtor
+};
+
+const BaseApi* cd_igmp = &igmp_api.base;
--- /dev/null
+/*
+** Copyright (C) 2002-2013 Sourcefire, Inc.
+** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include "framework/codec.h"
+#include "codecs/decode_module.h"
+#include "events/codec_events.h"
+#include "protocols/ipv4.h"
+
+namespace
+{
+
+class PgmCodec : public Codec
+{
+public:
+ PgmCodec() : Codec("pgm"){};
+ ~PgmCodec() {};
+
+
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
+ Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
+
+ virtual void get_protocol_ids(std::vector<uint16_t>&);
+
+};
+
+#define PGM_NAK_ERR -1
+#define PGM_NAK_OK 0
+#define PGM_NAK_VULN 1
+
+typedef struct _PGM_NAK_OPT
+{
+ uint8_t type; /* 02 = vuln */
+ uint8_t len;
+ uint8_t res[2];
+ uint32_t seq[1]; /* could be many many more, but 1 is sufficient */
+} PGM_NAK_OPT;
+
+typedef struct _PGM_NAK
+{
+ uint32_t seqnum;
+ uint16_t afil1;
+ uint16_t res1;
+ uint32_t src;
+ uint16_t afi2;
+ uint16_t res2;
+ uint32_t multi;
+ PGM_NAK_OPT opt;
+} PGM_NAK;
+
+typedef struct _PGM_HEADER
+{
+ uint16_t srcport;
+ uint16_t dstport;
+ uint8_t type;
+ uint8_t opt;
+ uint16_t checksum;
+ uint8_t gsd[6];
+ uint16_t length;
+ PGM_NAK nak;
+} PGM_HEADER;
+
+
+} // namespace
+
+/* This PGM NAK function started off as an SO rule, sid 8351. */
+static inline int pgm_nak_detect (uint8_t *data, uint16_t length) {
+ uint16_t data_left;
+ uint16_t checksum;
+ PGM_HEADER *header;
+
+ if (NULL == data) {
+ return PGM_NAK_ERR;
+ }
+
+ /* request must be bigger than 44 bytes to cause vuln */
+ if (length <= sizeof(PGM_HEADER)) {
+ return PGM_NAK_ERR;
+ }
+
+ header = (PGM_HEADER *) data;
+
+ if (8 != header->type) {
+ return PGM_NAK_ERR;
+ }
+
+ if (2 != header->nak.opt.type) {
+ return PGM_NAK_ERR;
+ }
+
+
+ /*
+ * alert if the amount of data after the options is more than the length
+ * specified.
+ */
+
+
+ data_left = length - 36;
+ if (data_left > header->nak.opt.len) {
+
+ /* checksum is expensive... do that only if the length is bad */
+ if (header->checksum != 0) {
+ checksum = in_chksum_ip((unsigned short*)data, (int)length);
+ if (checksum != 0)
+ return PGM_NAK_ERR;
+ }
+
+ return PGM_NAK_VULN;
+ }
+
+ return PGM_NAK_OK;
+}
+
+
+//-------------------------------------------------------------------------
+// private functions
+//-------------------------------------------------------------------------
+
+bool PgmCodec::decode(const uint8_t *raw_pkt, const uint32_t len,
+ Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
+{
+ if ( pgm_nak_detect((uint8_t *)p->data, p->dsize) == PGM_NAK_VULN )
+ codec_events::decoder_event(p, DECODE_PGM_NAK_OVERFLOW);
+
+}
+
+void PgmCodec::get_protocol_ids(std::vector<uint16_t>& v)
+{
+ v.push_back(IPPROTO_PGM);
+}
+
+
+
+//-------------------------------------------------------------------------
+// api
+//-------------------------------------------------------------------------
+
+static Codec* ctor()
+{
+ return new PgmCodec();
+}
+
+static void dtor(Codec *cd)
+{
+ delete cd;
+}
+
+
+static const char* name = "pgm";
+static const CodecApi pgm_api =
+{
+ {
+ PT_CODEC,
+ name,
+ CDAPI_PLUGIN_V0,
+ 0,
+ nullptr,
+ nullptr,
+ },
+ nullptr, // pinit
+ nullptr, // pterm
+ nullptr, // tinit
+ nullptr, // tterm
+ ctor, // ctor
+ dtor, // dtor
+};
+
+const BaseApi* cd_pgm = &pgm_api.base;
+
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
virtual void get_protocol_ids(std::vector<uint16_t>&);
- virtual void get_data_link_type(std::vector<int>&){};
+ virtual void get_data_link_type(std::vector<int>&);
};
} // namespace
-static THREAD_LOCAL CdPegs counts;
-static CdPegs gcounts;
-
bool NameCodec::decode(const uint8_t *raw_pkt, const uint32_t len,
Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
}
-
-//-------------------------------------------------------------------------
-// api
-//-------------------------------------------------------------------------
-
-
-static void get_data_link_type(std::vector<int>&)
+void NameCodec::get_data_link_type(std::vector<int>&)
{
// v.push_back(DLT_ID);
}
-static void get_protocol_ids(std::vector<uint16_t>& v)
+void NameCodec::get_protocol_ids(std::vector<uint16_t>& v)
{
// v.push_back(PROTO_TYPE);
}
+
+
+//-------------------------------------------------------------------------
+// api
+//-------------------------------------------------------------------------
+
static Codec* ctor()
{
return new NameCodec();
}
-static const char* name = "name_codec";
-static const CodecApi codec_api =
+static const char* name = "name";
+static const CodecApi name_api =
{
- { PT_CODEC, name, CDAPI_PLUGIN_V0, 0 },
- NULL, // pinit
- NULL, // pterm
- NULL, // tinit
- NULL, // tterm
+ {
+ PT_CODEC,
+ name,
+ CDAPI_PLUGIN_V0,
+ 0,
+ nullptr,
+ nullptr,
+ },
+ nullptr, // pinit
+ nullptr, // pterm
+ nullptr, // tinit
+ nullptr, // tterm
ctor, // ctor
dtor, // dtor
};
+
+const BaseApi* cd_name = &name_api.base;
sfeventq.cc
sfeventq.h
codec_events.cc
+ ${INCLUDES}
)
install (FILES ${INCLUDES}
snort_debug.cc
snort_config.h
snort_config.cc
+ ${INCLUDES}
)
install (FILES ${INCLUDES}
DESTINATION "${INCLUDE_INSTALL_PATH}/main"
)
-
//static std::array<Codec*, max_protocol_id> s_protocols;
-static std::array<uint8_t, max_protocol_id> s_proto_map{};
-static std::array<Codec*, 256> s_protocols{};
+static std::array<uint8_t, max_protocol_id> s_proto_map = {};
+static std::array<Codec*, 256> s_protocols = {};
static THREAD_LOCAL uint8_t grinder = 0;
// statistics information
d.dump(p->base.name, p->base.version);
}
-void PacketManager::instantiate(const CodecApi* cd_api, Module* m, SnortConfig* sc)
+void PacketManager::instantiate(const CodecApi* /*cd_api */, Module* /*m*/, SnortConfig* /*sc*/)
{
#if 0
static uint16_t codec_id = 1;
{
std::vector<const char*> pkt_names;
- for(int i = 0; i < gen_peg_names.size(); i++)
+ for(unsigned int i = 0; i < gen_peg_names.size(); i++)
pkt_names.push_back(gen_peg_names[i]);
#define IP_HEADER_LEN ipv4::hdr_len()
+
+static inline unsigned short in_chksum_ip( unsigned short * w, int blen )
+{
+ unsigned int cksum;
+
+ /* IP must be >= 20 bytes */
+ cksum = w[0];
+ cksum += w[1];
+ cksum += w[2];
+ cksum += w[3];
+ cksum += w[4];
+ cksum += w[5];
+ cksum += w[6];
+ cksum += w[7];
+ cksum += w[8];
+ cksum += w[9];
+
+ blen -= 20;
+ w += 10;
+
+ while( blen ) /* IP-hdr must be an integral number of 4 byte words */
+ {
+ cksum += w[0];
+ cksum += w[1];
+ w += 2;
+ blen -= 4;
+ }
+
+ cksum = (cksum >> 16) + (cksum & 0x0000ffff);
+ cksum += (cksum >> 16);
+
+ return (unsigned short) (~cksum);
+}
+
+
#endif
} PPPoE_Tag;
-#define PGM_NAK_ERR -1
-#define PGM_NAK_OK 0
-#define PGM_NAK_VULN 1
-
-typedef struct _PGM_NAK_OPT
-{
- uint8_t type; /* 02 = vuln */
- uint8_t len;
- uint8_t res[2];
- uint32_t seq[1]; /* could be many many more, but 1 is sufficient */
-} PGM_NAK_OPT;
-
-typedef struct _PGM_NAK
-{
- uint32_t seqnum;
- uint16_t afil1;
- uint16_t res1;
- uint32_t src;
- uint16_t afi2;
- uint16_t res2;
- uint32_t multi;
- PGM_NAK_OPT opt;
-} PGM_NAK;
-
-typedef struct _PGM_HEADER
-{
- uint16_t srcport;
- uint16_t dstport;
- uint8_t type;
- uint8_t opt;
- uint16_t checksum;
- uint8_t gsd[6];
- uint16_t length;
- PGM_NAK nak;
-} PGM_HEADER;
-
-
#define LAYER_MAX 32
struct Packet
projects / thirdparty / snort3.git / commitdiff
