#include "framework/codec.h"
#include "snort.h"
-#include "managers/packet_manager.h"
+#include "protocols/packet_manager.h"
#include "codecs/codec_events.h"
#include "protocols/protocol_ids.h"
#include "detection/fpdetect.h"
#include "codecs/ip/ip_util.h"
#include "protocols/packet.h"
+#include "log/text_log.h"
+#include "protocols/packet_manager.h"
namespace
virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
+ virtual void log(TextLog*, const uint8_t* /*raw_pkt*/,
+ const Packet* const);
virtual void get_protocol_ids(std::vector<uint16_t>&);
};
#endif
// three least signifigant bits are all flags
- p->frag_offset = ntohs(ip6frag_hdr->get_off()) >> 3;
- if (p->frag_offset || (p->decode_flags & DECODE__MF))
+ const uint16_t frag_offset = ntohs(ip6frag_hdr->get_off()) >> 3;
+ p->frag_offset = frag_offset;
+ if (frag_offset || (p->decode_flags & DECODE__MF))
{
p->decode_flags |= DECODE__FRAG;
}
{
codec_events::decoder_event(p, DECODE_IPV6_BAD_FRAG_PKT);
}
- if (!(p->frag_offset))
+ if (!(frag_offset))
{
// check header ordering of fragged (next) header
if ( ip_util::IPV6ExtensionOrder(ip6frag_hdr->ip6f_nxt) <
lyr_len = sizeof(ip::IP6Frag);
p->ip_frag_len = (uint16_t)(raw_len - lyr_len);
- if ( (p->decode_flags & DECODE__FRAG) && ((p->frag_offset > 0) ||
+ if ( (p->decode_flags & DECODE__FRAG) && ((frag_offset > 0) ||
(ip6frag_hdr->ip6f_nxt != IPPROTO_UDP)) )
{
/* For non-zero offset frags, we stop decoding after the
void Ipv6FragCodec::get_protocol_ids(std::vector<uint16_t>& v)
+{ v.push_back(IPPROTO_ID_FRAGMENT); }
+
+
+void Ipv6FragCodec::log(TextLog* log, const uint8_t* raw_pkt,
+ const Packet* const)
{
- v.push_back(IPPROTO_ID_FRAGMENT);
-}
+ const ip::IP6Frag* fragh = reinterpret_cast<const ip::IP6Frag*>(raw_pkt);
+ const uint16_t offlg = ntohs(fragh->get_off());
+
+
+ TextLog_Print(log, "Frag6: Next:%s(%02X) Off:%u ID:%u",
+ PacketManager::get_proto_name(fragh->ip6f_nxt), fragh->ip6f_nxt,
+ (offlg >> 3), ntohl(fragh->get_id()));
+ if (offlg & ip::IP6F_MF_MASK)
+ TextLog_Puts(log, " MF");
+ TextLog_NewLine(log);
+}
//-------------------------------------------------------------------------
// api
//-------------------------------------------------------------------------
static Codec* ctor(Module*)
-{
- return new Ipv6FragCodec();
-}
+{ return new Ipv6FragCodec(); }
static void dtor(Codec *cd)
-{
- delete cd;
-}
+{ delete cd; }
static const CodecApi ipv6_frag_api =
{
/*
-** Copyright (C) 2002-2013 Sourcefire, Inc.
-** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
**
** This program is free software; you can redistribute it and/or modify
** it under the terms of the GNU General Public License Version 2 as
#include "protocols/protocol_ids.h"
#include "codecs/sf_protocols.h"
#include "protocols/gre.h"
+#include "log/text_log.h"
+#include "protocols/packet_manager.h"
namespace
{
virtual void get_protocol_ids(std::vector<uint16_t>& v);
virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
+ void log(TextLog* /*log*/, const uint8_t* /*raw_pkt*/,
+ const Packet* const);
};
void GreCodec::get_protocol_ids(std::vector<uint16_t>& v)
-{
- v.push_back(IPPROTO_ID_GRE);
-}
+{ v.push_back(IPPROTO_ID_GRE); }
/*
}
+void GreCodec::log(TextLog* log, const uint8_t* raw_pkt,
+ const Packet* const)
+{
+ const gre::GREHdr *greh = reinterpret_cast<const gre::GREHdr *>(raw_pkt);
+
+ TextLog_Print(log, "GRE version:%u flags:0x%02X ether-type:%s(0x%04X)\n",
+ greh->get_version(), greh->flags,
+ PacketManager::get_proto_name(greh->get_proto()),
+ greh->get_proto());
+}
+
//-------------------------------------------------------------------------
// api
//-------------------------------------------------------------------------
static Module* mod_ctor()
-{
- return new GreModule;
-}
+{ return new GreModule; }
static void mod_dtor(Module* m)
-{
- delete m;
-}
+{ delete m; }
static Codec* ctor(Module*)
-{
- return new GreCodec();
-}
+{ return new GreCodec(); }
static void dtor(Codec *cd)
-{
- delete cd;
-}
+{ delete cd; }
static const CodecApi gre_api =
{
#endif
#include <array>
-#include "snort.h"
+#include "main/snort.h"
#include "fpdetect.h"
#include "protocols/tcp.h"
#include "protocols/ipv4.h"
+#include "protocols/packet_manager.h"
#include "utils/stats.h"
#include "packet_io/active.h"
#include "codecs/decode_module.h"
#include "codecs/sf_protocols.h"
#include "protocols/ip.h"
+#include "log/text_log.h"
+#include "log/log_text.h"
namespace{
virtual void get_protocol_ids(std::vector<uint16_t>& v);
virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
+ virtual void log(TextLog*, const uint8_t* /*raw_pkt*/,
+ const Packet* const);
virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in);
virtual bool update(Packet*, Layer*, uint32_t* len);
virtual void format(EncodeFlags, const Packet* p, Packet* c, Layer*);
static uint8_t RevTTL (const EncState* enc, uint8_t ttl);
static uint8_t FwdTTL (const EncState* enc, uint8_t ttl);
static uint8_t GetTTL (const EncState* enc);
-
};
/* Last updated 5/2/2014.
codec_events::decoder_event(p, DECODE_IP_MULTIPLE_ENCAPSULATION);
/* lay the IP struct over the raw data */
- IP4Hdr* iph = reinterpret_cast<IP4Hdr*>(const_cast<uint8_t *>(raw_pkt));
+ const IP4Hdr* const iph = reinterpret_cast<const IP4Hdr*>(raw_pkt);
/*
* with datalink DLT_RAW it's impossible to differ ARP datagrams from IP.
return 0;
}
+/******************************************************************
+ ********************* L O G G E R ******************************
+*******************************************************************/
+
+struct ip4_addr
+{
+ union
+ {
+ uint32_t addr32;
+ uint8_t addr8[4];
+ };
+};
+
+void Ipv4Codec::log(TextLog* log, const uint8_t* raw_pkt, const Packet* const p)
+{
+ const IP4Hdr* const ip4h = reinterpret_cast<const IP4Hdr*>(raw_pkt);
+
+ // FIXIT-H --> This does NOT obfuscate correctly
+ if (ScObfuscate())
+ {
+ TextLog_Print(log, "IPv4 xxx.xxx.xxx.xxx -> xxx.xxx.xxx.xxx");
+ }
+ else
+ {
+ ip4_addr src, dst;
+ src.addr32 = ip4h->get_src();
+ dst.addr32 = ip4h->get_dst();
+
+ TextLog_Print(log, "%d.%d.%d.%d -> %d.%d.%d.%d",
+ (int)src.addr8[0], (int)src.addr8[1],
+ (int)src.addr8[2], (int)src.addr8[3],
+ (int)dst.addr8[0], (int)dst.addr8[1],
+ (int)dst.addr8[2], (int)dst.addr8[3]);
+ }
+
+ TextLog_NewLine(log);
+
+ const uint16_t hlen = ip4h->get_hlen() << 2;
+ const uint16_t len = ntohs(ip4h->get_len());
+ const uint16_t frag_off = ntohs(ip4h->get_off());
+
+ TextLog_Print(log, "\tNext:%s(%02X) TTL:%u TOS:0x%X ID:%u IpLen:%u DgmLen:%u",
+ PacketManager::get_proto_name(ip4h->get_proto()),
+ ip4h->get_proto(), ip4h->get_ttl(), ip4h->get_tos(),
+ ip4h->get_id(), hlen, len);
+
+
+ /* print the reserved bit if it's set */
+ if(frag_off & 0x8000)
+ TextLog_Puts(log, " RB");
+
+ /* printf more frags/don't frag bits */
+ if(frag_off & 0x4000)
+ TextLog_Puts(log, " DF");
+
+ if(frag_off & 0x2000)
+ TextLog_Puts(log, " MF");
+
+ TextLog_NewLine(log);
+
+ /* print IP options */
+ if(p->ip_option_count > 0)
+ {
+ LogIpOptions(log, p);
+ }
+
+
+ if( p->decode_flags & DECODE__FRAG)
+ {
+ TextLog_Print(log, "Frag Offset: 0x%04X Frag Size: 0x%04X\n",
+ (frag_off & 0x1FFF), (len - hlen));
+ }
+}
/******************************************************************
******************** E N C O D E R ******************************
//-------------------------------------------------------------------------
static Module* mod_ctor()
-{
- return new Ipv4Module;
-}
+{ return new Ipv4Module; }
static void mod_dtor(Module* m)
-{
- delete m;
-}
+{ delete m; }
//-------------------------------------------------------------------------
// ip id considerations:
static Codec *ctor(Module*)
-{
- return new Ipv4Codec;
-}
+{ return new Ipv4Codec; }
static void dtor(Codec *cd)
-{
- delete cd;
-}
+{ delete cd; }
static const CodecApi ipv4_api =
{
#include "codecs/decode_module.h"
#include "codecs/sf_protocols.h"
#include "protocols/protocol_ids.h"
+#include "protocols/packet_manager.h"
+#include "log/text_log.h"
namespace
{
virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in);
virtual bool update(Packet*, Layer*, uint32_t* len);
virtual void format(EncodeFlags, const Packet* p, Packet* c, Layer*);
+ virtual void log(TextLog*, const uint8_t* /*raw_pkt*/,
+ const Packet* const) ;
private:
/* lay the IP struct over the raw data */
const ip::IP6Hdr* const ip6h =
- reinterpret_cast<ip::IP6Hdr*>(const_cast<uint8_t*>(raw_pkt));
+ reinterpret_cast<const ip::IP6Hdr*>(raw_pkt);
if(raw_len < ip::IP6_HEADER_LEN)
{
return 0;
}
-/*
- * Encoders
- */
+
+/******************************************************************
+ ********************* L O G G E R ******************************
+*******************************************************************/
+
+void Ipv6Codec::log(TextLog* log, const uint8_t* raw_pkt,
+ const Packet* const)
+{
+ const ip::IP6Hdr* const ip6h = reinterpret_cast<const ip::IP6Hdr*>(raw_pkt);
+
+
+ TextLog_NewLine(log);
+
+ //FIXIT-H --> This does NOT obfuscate correctly
+
+ // FIXIT-H --> This does NOT obfuscate correctly
+ if (ScObfuscate())
+ {
+ TextLog_Print(log, "IPv6 x:x:x:x::x:x:x:x -> x:x:x:x::x:x:x:x");
+ }
+ else
+ {
+ const ip::snort_in6_addr* const src = ip6h->get_src();
+ const ip::snort_in6_addr* const dst = ip6h->get_dst();
+
+ TextLog_Print(log, "%02X%02X:%02X%02X:%02X%02X:%02X%02X:%02X%02X:"
+ "%02X%02X:%02X%02X:%02X%02X -> %02X%02X:%02X%02X:"
+ "%02X%02X:%02X%02X:%02X%02X:%02X%02X",
+ (int)src->u6_addr8[0], (int)src->u6_addr8[1], (int)src->u6_addr8[2],
+ (int)src->u6_addr8[3], (int)src->u6_addr8[4], (int)src->u6_addr8[5],
+ (int)src->u6_addr8[6], (int)src->u6_addr8[7], (int)src->u6_addr8[8],
+ (int)src->u6_addr8[9], (int)src->u6_addr8[10], (int)src->u6_addr8[11],
+ (int)src->u6_addr8[12], (int)src->u6_addr8[13], (int)src->u6_addr8[14],
+ (int)src->u6_addr8[15], (int)dst->u6_addr8[0], (int)dst->u6_addr8[1],
+ (int)dst->u6_addr8[2], (int)dst->u6_addr8[3], (int)dst->u6_addr8[4],
+ (int)dst->u6_addr8[5], (int)dst->u6_addr8[6], (int)dst->u6_addr8[7],
+ (int)dst->u6_addr8[8], (int)dst->u6_addr8[9], (int)dst->u6_addr8[10],
+ (int)dst->u6_addr8[11], (int)dst->u6_addr8[12], (int)dst->u6_addr8[13],
+ (int)dst->u6_addr8[14], (int)dst->u6_addr8[15]);
+ }
+
+
+ TextLog_NewLine(log);
+
+
+ TextLog_Print(log, "\tNext:%s(%02X) TTL:%u TOS:0x%X DgmLen:%u",
+ PacketManager::get_proto_name(ip6h->get_next()),
+ ip6h->get_next(), ip6h->get_hop_lim(), ip6h->get_tos(),
+ ntohs(ip6h->get_len()));
+
+ TextLog_NewLine(log);
+}
+
+
+/******************************************************************
+ ************************* E N C O D E R ************************
+ ******************************************************************/
bool Ipv6Codec::encode(EncState* enc, Buffer* out, const uint8_t* raw_in)
{
//-------------------------------------------------------------------------
static Module* mod_ctor()
-{
- return new Ipv6Module;
-}
+{ return new Ipv6Module; }
static void mod_dtor(Module* m)
-{
- delete m;
-}
+{ delete m; }
static Codec* ctor(Module*)
-{
- return new Ipv6Codec();
-}
+{ return new Ipv6Codec(); }
static void dtor(Codec *cd)
-{
- delete cd;
-}
+{ delete cd; }
static const CodecApi ipv6_api =
{
#include "packet_io/sfdaq.h"
#include "parser/parse_ip.h"
#include "sfip/sf_ipvar.h"
+#include "log/text_log.h"
+#include "log/log_text.h"
+#include "log/log.h"
+#include "protocols/packet_manager.h"
namespace
virtual PROTO_ID get_proto_id() { return PROTO_TCP; };
virtual void get_protocol_ids(std::vector<uint16_t>& v);
+ virtual void log(TextLog*, const uint8_t* /*raw_pkt*/,
+ const Packet* const) ;
virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *, uint16_t &lyr_len, uint16_t &);
virtual bool encode(EncState*, Buffer* out, const uint8_t *raw_in);
}
/* lay TCP on top of the data cause there is enough of it! */
- tcp::TCPHdr* tcph = reinterpret_cast<tcp::TCPHdr*>(const_cast<uint8_t*>(raw_pkt));
+ const tcp::TCPHdr* tcph = reinterpret_cast<const tcp::TCPHdr*>(raw_pkt);
p->tcph = tcph;
/* multiply the payload offset value by 4 */
codec_events::decoder_event(p, DECODE_TCP_PORT_ZERO);
}
+/******************************************************************
+ ************************ L O G G E R **************************
+ ******************************************************************/
+
+
+void TcpCodec::log(TextLog* log, const uint8_t* raw_pkt,
+ const Packet* const p)
+{
+ char tcpFlags[9];
+
+ const tcp::TCPHdr* tcph = reinterpret_cast<const tcp::TCPHdr*>(raw_pkt);
+ TextLog_Puts(log, "TCP ");
+
+ /* print TCP flags */
+ CreateTCPFlagString(tcph, tcpFlags);
+ TextLog_Puts(log, tcpFlags); /* We don't care about the NULL */
+
+ /* print other TCP info */
+ TextLog_Print(log, " SrcPort:%u DstPort:%u Seq: 0x%lX Ack: 0x%lX "
+ "Win: 0x%X TcpLen: %d",ntohs(tcph->th_sport),
+ ntohs(tcph->th_dport), (u_long) ntohl(tcph->th_seq),
+ (u_long) ntohl(tcph->th_ack),
+ ntohs(tcph->th_win), TCP_OFFSET(tcph) << 2);
+
+ if((tcph->th_flags & TH_URG) != 0)
+ TextLog_Print(log, " UrgPtr: 0x%X\n", (uint16_t) ntohs(tcph->th_urp));
+
+ TextLog_NewLine(log);
+
+ /* dump the TCP options */
+ if(p->tcp_option_count > 0)
+ {
+ LogTcpOptions(log, p);
+ }
+}
+
/******************************************************************
- ******************** E N C O D E R ******************************
+ ************************* E N C O D E R *************************
******************************************************************/
//-------------------------------------------------------------------------
//-------------------------------------------------------------------------
static Module* mod_ctor()
-{
- return new TcpModule;
-}
+{ return new TcpModule; }
static void mod_dtor(Module* m)
-{
- delete m;
-}
+{ delete m; }
/*
* Static api functions. there are NOT part of the TCPCodec class,
#include "protocols/ipv4.h"
#include "protocols/protocol_ids.h"
#include "codecs/ip/checksum.h"
+#include "log/text_log.h"
#include "framework/codec.h"
#include "packet_io/active.h"
virtual bool encode(EncState*, Buffer* out, const uint8_t *raw_in);
virtual bool update(Packet*, Layer*, uint32_t* len);
virtual void format(EncodeFlags, const Packet* p, Packet* c, Layer*);
+ virtual void log(TextLog*, const uint8_t* /*raw_pkt*/, const Packet* const);
};
p->dsize = p->ip_api.pay_len();
}
+void UdpCodec::log(TextLog* log, const uint8_t* raw_pkt, const Packet* const)
+{
+ const udp::UDPHdr* udph = reinterpret_cast<const udp::UDPHdr*>(raw_pkt);
+
+ TextLog_Print(log, "UDP SourcePort:%d DestPort:%d Len:%d\n",
+ ntohs(udph->uh_sport), ntohs(udph->uh_dport),
+ ntohs(udph->uh_len) - udp::UDP_HEADER_LEN);
+}
+
/******************************************************************
******************** E N C O D E R ******************************
******************************************************************/
-/*
-** Copyright (C) 2002-2013 Sourcefire, Inc.
-** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public LicenseUpdateMPLSStats
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
+/****************************************************************************
+ *
+ * Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+ * Copyright (C) 2003-2013 Sourcefire, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License Version 2 as
+ * published by the Free Software Foundation. You may not use, modify or
+ * distribute this program under any other version of the GNU General
+ * Public License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+ *
+ ****************************************************************************/
// cd_mpls.cc author Josh Rosenbaum <jrosenba@cisco.com>
#include "codecs/sf_protocols.h"
#include "main/snort_config.h"
#include "main/snort.h"
+#include "log/text_log.h"
namespace
{
virtual PROTO_ID get_proto_id() { return PROTO_MPLS; };
virtual void get_protocol_ids(std::vector<uint16_t>& v);
virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
- Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
+ Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
+ virtual void log(TextLog*, const uint8_t* /*raw_pkt*/, const Packet* const);
};
int iRet = 0;
UpdateMPLSStats(&sfBase, raw_len, Active_PacketWasDropped());
- tmpMplsHdr = (const uint32_t *) raw_pkt;
+ tmpMplsHdr = reinterpret_cast<const uint32_t *>(raw_pkt);
while (!bos)
{
return iRet;
}
+void MplsCodec::log(TextLog* log, const uint8_t* /*raw_pkt*/,
+ const Packet* const p)
+{
+ TextLog_Print(log,"MPLS label:0x%05X exp:0x%X bos:0x%X ttl:0x%X\n",
+ p->mplsHdr.label, p->mplsHdr.exp, p->mplsHdr.bos, p->mplsHdr.ttl);
+}
+
//-------------------------------------------------------------------------
// api
//-------------------------------------------------------------------------
static Module* mod_ctor()
-{
- return new MplsModule;
-}
+{ return new MplsModule; }
static void mod_dtor(Module* m)
-{
- delete m;
-}
+{ delete m; }
static Codec* ctor(Module*)
-{
- return new MplsCodec();
-}
+{ return new MplsCodec(); }
static void dtor(Codec *cd)
-{
- delete cd;
-}
+{ delete cd; }
static const CodecApi mpls_api =
{
namespace
{
-#define CD_DEFAULT_NAME "default_codec"
+#define CD_DEFAULT_NAME "unknown"
class DefaultCodec : public Codec
{
#include "protocols/packet.h"
#include "protocols/eth.h"
#include "codecs/codec_events.h"
-#include "managers/packet_manager.h"
+#include "protocols/packet_manager.h"
#include "codecs/sf_protocols.h"
+#include "log/text_log.h"
namespace
{
virtual PROTO_ID get_proto_id() { return PROTO_ETH; };
- virtual void get_protocol_ids(std::vector<uint16_t>&) {};
+ virtual void get_protocol_ids(std::vector<uint16_t>&);
virtual void get_data_link_type(std::vector<int>&);
+ virtual void log(TextLog* /*log*/, const uint8_t* /*raw_pkt*/, const Packet*const );
virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id);
virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in);
v.push_back(DLT_EN10MB);
}
+void EthCodec::get_protocol_ids(std::vector<uint16_t>&v)
+{
+ v.push_back(ETHERNET_802_3);
+}
+
//--------------------------------------------------------------------
// decode.c::Ethernet
}
+void EthCodec::log(TextLog* log, const uint8_t* raw_pkt, const Packet* const)
+{
+ const eth::EtherHdr *eh = reinterpret_cast<const eth::EtherHdr *>(raw_pkt);
+
+ /* src addr */
+ TextLog_Print(log, "%02X:%02X:%02X:%02X:%02X:%02X -> ", eh->ether_src[0],
+ eh->ether_src[1], eh->ether_src[2], eh->ether_src[3],
+ eh->ether_src[4], eh->ether_src[5]);
+
+ /* dest addr */
+ TextLog_Print(log, "%02X:%02X:%02X:%02X:%02X:%02X ", eh->ether_dst[0],
+ eh->ether_dst[1], eh->ether_dst[2], eh->ether_dst[3],
+ eh->ether_dst[4], eh->ether_dst[5]);
+
+ /* protocol and pkt size */
+ TextLog_Print(log, "type:0x%X", ntohs(eh->ether_type));
+
+ // FIXIT-L - J Log length in PacketManager
+}
+
//-------------------------------------------------------------------------
// ethernet
//-------------------------------------------------------------------------
virtual bool decode(const uint8_t *raw_pkt, const uint32_t &raw_len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
+ virtual void log(TextLog*, const uint8_t* /*raw_pkt*/,const Packet* const);
virtual void get_protocol_ids(std::vector<uint16_t>&);
virtual void get_data_link_type(std::vector<int>&);
virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in);
#include "framework/ips_option.h"
#include "framework/cursor.h"
#include "managers/ips_manager.h"
-#include "managers/packet_manager.h"
+#include "protocols/packet_manager.h"
#include "detection/detection_defines.h"
typedef struct _detection_option_key
#include "detection_util.h"
#include "detection_options.h"
#include "actions/actions.h"
-#include "managers/packet_manager.h"
+#include "protocols/packet_manager.h"
#include "managers/action_manager.h"
/*
#include "framework/base_api.h"
#include "codecs/sf_protocols.h"
-
+struct TextLog;
struct Packet;
struct Layer;
* ETHERNET_MTU == 1500
* IP_MAXPACKET == 65535
*/
- static constexpr uint32_t PKT_MAX = 14 + 4 + 1500 + 65535;
+ static const uint32_t PKT_MAX = 14 + 4 + 1500 + 65535;
+
+ /* Codec Initialization */
// Get the codec's name
inline const char* get_name(){return name; };
virtual void get_data_link_type(std::vector<int>&) {};
// Register the code's protocol ID's and Ethertypes
virtual void get_protocol_ids(std::vector<uint16_t>&) {};
- // decode function
+
+ /* Maom decodomg fimctopm */
virtual bool decode(const uint8_t* raw_packet, const uint32_t& raw_len,
- Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) = 0;
-
- //
- // Encode the current packet. Encoding starts with the innermost
- // layer and working outwards. All encoders MUST call the update
- // bound function before writing to output buffer.
- // PARAMS:
- // EncStats * = The current EncState struct
- // Buffer *out = the buffer struct. When called, out->base pointers
- // to the already encoded packet! to create more memory, call
- // update_buffer function!
- // uint8_t* raw_in = A pointer to the raw input which was decoded
+ Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)=0;
+
+ /*
+ * Log this layer's information
+ * PARAMS:
+ * TextLog* = the logger. Defined in "text_log.h"
+ * const uint8_t *raw_pkt = the same data seen during decode
+ * Packet *p = pointer to the packet struct.
+ */
+ virtual void log(TextLog* /*log*/, const uint8_t* /*raw_pkt*/,
+ const Packet* const) {}
+
+
+ /*
+ * Encoding -- active response!!
+ *
+ * Encode the current packet. Encoding starts with the innermost
+ * layer and working outwards. All encoders MUST call the update
+ * bound function before writing to output buffer.
+ * PARAMS:
+ * EncStats * = The current EncState struct
+ * Buffer *out = the buffer struct. When called, out->base pointers
+ * to the already encoded packet! to create more memory, call
+ * update_buffer function!
+ * uint8_t* raw_in = A pointer to the raw input which was decoded
+ */
virtual bool encode(EncState*, Buffer* /*out*/, const uint8_t* /*raw_in*/)
{ return true; };
// update function
set (LOG_INCLUDES
messages.h
obfuscation.h
+ text_log.h
)
add_library ( log STATIC
${LOG_INCLUDES}
- log.cc
- log.h
- log_text.cc
- log_text.h
+ log.cc
+ log.h
+ log_text.cc
+ log_text.h
messages.cc
- obfuscation.cc
- obfuscation.h
- text_log.cc
- text_log.h
+ obfuscation.cc
+ text_log.cc
)
set_default_visibility_compile_flag( log )
x_include_HEADERS = \
messages.h \
-obfuscation.h
+obfuscation.h \
+text_log.h
liblog_a_SOURCES = \
log.cc \
log_text.h \
messages.cc \
obfuscation.cc \
-text_log.cc \
-text_log.h
+text_log.cc
liblog_a_CXXFLAGS = $(AM_CXXFLAGS) -fvisibility=default
/* Input is packet and an nine-byte (including NULL) character array. Results
* are put into the character array.
*/
-void CreateTCPFlagString(Packet * p, char *flagBuffer)
+void CreateTCPFlagString(const tcp::TCPHdr* const tcph, char *flagBuffer)
{
/* parse TCP flags */
- *flagBuffer++ = (char) ((p->tcph->th_flags & TH_RES1) ? '1' : '*');
- *flagBuffer++ = (char) ((p->tcph->th_flags & TH_RES2) ? '2' : '*');
- *flagBuffer++ = (char) ((p->tcph->th_flags & TH_URG) ? 'U' : '*');
- *flagBuffer++ = (char) ((p->tcph->th_flags & TH_ACK) ? 'A' : '*');
- *flagBuffer++ = (char) ((p->tcph->th_flags & TH_PUSH) ? 'P' : '*');
- *flagBuffer++ = (char) ((p->tcph->th_flags & TH_RST) ? 'R' : '*');
- *flagBuffer++ = (char) ((p->tcph->th_flags & TH_SYN) ? 'S' : '*');
- *flagBuffer++ = (char) ((p->tcph->th_flags & TH_FIN) ? 'F' : '*');
+ *flagBuffer++ = (char) ((tcph->th_flags & TH_RES1) ? '1' : '*');
+ *flagBuffer++ = (char) ((tcph->th_flags & TH_RES2) ? '2' : '*');
+ *flagBuffer++ = (char) ((tcph->th_flags & TH_URG) ? 'U' : '*');
+ *flagBuffer++ = (char) ((tcph->th_flags & TH_ACK) ? 'A' : '*');
+ *flagBuffer++ = (char) ((tcph->th_flags & TH_PUSH) ? 'P' : '*');
+ *flagBuffer++ = (char) ((tcph->th_flags & TH_RST) ? 'R' : '*');
+ *flagBuffer++ = (char) ((tcph->th_flags & TH_SYN) ? 'S' : '*');
+ *flagBuffer++ = (char) ((tcph->th_flags & TH_FIN) ? 'F' : '*');
*flagBuffer = '\0';
}
#define LOG_H
#include "protocols/packet.h"
+#include "main/snort_types.h"
-void CreateTCPFlagString(Packet *, char *);
+namespace tcp
+{
+struct TCPHdr;
+} // namespace tcp
+
+
+SO_PUBLIC void CreateTCPFlagString(const tcp::TCPHdr* const, char *);
FILE *OpenAlertFile(const char *);
int RollAlertFile(const char *);
* IP stuff cloned from log.c
*-------------------------------------------------------------------
*/
-static void LogIpOptions(TextLog* log, Packet * p)
+
+void LogIpOptions(TextLog* log, const Packet* const p)
{
- int i;
- int j;
+ uint8_t i, j;
u_long init_offset;
u_long print_offset;
+ const uint8_t option_count = p->ip_option_count;
init_offset = TextLog_Tell(log);
+ TextLog_Print(log, "IP Options (%d) => ", option_count);
- if(!p->ip_option_count || p->ip_option_count > 40)
- return;
-
- TextLog_Print(log, "IP Options (%d) => ", p->ip_option_count);
-
- for(i = 0; i < (int) p->ip_option_count; i++)
+ for(i = 0; i < option_count; i++)
{
print_offset = TextLog_Tell(log);
default:
TextLog_Print(log, "Opt %d: ", p->ip_options[i].code);
- if(p->ip_options[i].len)
+ const ip::IpOptions* const ip_opt = &(p->ip_options[i]);
+ const uint8_t opt_len = ip_opt->len;
+
+ if(opt_len)
{
- for(j = 0; j < p->ip_options[i].len; j++)
+ if (ip_opt->data)
{
- if (p->ip_options[i].data)
- TextLog_Print(log, "%02X", p->ip_options[i].data[j]);
- else
- TextLog_Print(log, "%02X", 0);
-
- if((j % 2) == 0)
- TextLog_Putc(log, ' ');
+ for(j = 0; (j + 1) < opt_len; j += 2)
+ {
+ TextLog_Print(log, "%02X%02X ",ip_opt->data[j],
+ ip_opt->data[j+1]);
+ }
+
+ // since we're skipping by two, if (j+1) == opt_len,
+ // we will not have printed j
+ if (j < opt_len)
+ TextLog_Print(log, "%02X",ip_opt->data[j]);
+ }
+ else
+ {
+ for(j = 0; (j + 1) < opt_len; j += 2)
+ {
+ TextLog_Print(log, "%02X%02X ", 0, 0);
+ }
+
+ // since we're skipping by two, if (j+1) == opt_len,
+ // we will not have printed j
+ if (j < opt_len)
+ TextLog_Print(log, "%02X",0);
}
}
break;
* TCP stuff cloned from log.c
*-------------------------------------------------------------------
*/
-static void LogTcpOptions(TextLog* log, Packet * p)
-{
- int i;
- int j;
- uint8_t tmp[5];
-#if 0
- u_long init_offset;
- u_long print_offset;
+inline uint16_t extract_16_bits(const uint8_t* const buf)
+{ return ntohs(* ((uint16_t*)(buf)) ); }
- init_offset = TextLog_Tell(log);
-#endif
+inline uint32_t extract_32_bits(const uint8_t* const buf)
+{ return ntohl(* ((uint32_t*)(buf)) ); }
- TextLog_Print(log, "TCP Options (%d) => ", p->tcp_option_count);
+void LogTcpOptions(TextLog* log, const Packet* const p)
+{
+ uint8_t i;
+ int j;
+ const uint8_t option_count = p->tcp_option_count;
+ const Options* const opts = p->tcp_options;
- if(p->tcp_option_count > 40 || !p->tcp_option_count)
- return;
+ TextLog_Print(log, "TCP Options (%d) => ", option_count);
- for(i = 0; i < (int) p->tcp_option_count; i++)
+ for(i = 0; i < option_count; i++)
{
#if 0
print_offset = TextLog_Tell(log);
init_offset = TextLog_Tell(log);
}
#endif
- switch(p->tcp_options[i].code)
+ switch(opts[i].code)
{
case TCPOPT_MAXSEG:
- memset((char*)tmp, 0, sizeof(tmp));
+ {
+ uint16_t val;
TextLog_Puts(log, "MSS: ");
- if (p->tcp_options[i].data)
- memcpy(tmp, p->tcp_options[i].data, 2);
- TextLog_Print(log, "%u ", EXTRACT_16BITS(tmp));
- break;
+ if (opts[i].data)
+ val = extract_16_bits(opts[i].data);
+ else
+ val = 0;
+
+ TextLog_Print(log, "%u ", val);
+ break;
+ }
case TCPOPT_EOL:
TextLog_Puts(log, "EOL ");
break;
break;
case TCPOPT_WSCALE:
- if (p->tcp_options[i].data)
- TextLog_Print(log, "WS: %u ", p->tcp_options[i].data[0]);
+ {
+ uint8_t val;
+
+ if (opts[i].data)
+ val = opts[i].data[0];
else
- TextLog_Print(log, "WS: %u ", 0);
+ val = 0;
+
+ TextLog_Print(log, "WS: %u ", val);
break;
+ }
case TCPOPT_SACK:
- memset((char*)tmp, 0, sizeof(tmp));
- if (p->tcp_options[i].data && (p->tcp_options[i].len >= 2))
- memcpy(tmp, p->tcp_options[i].data, 2);
- TextLog_Print(log, "Sack: %u@", EXTRACT_16BITS(tmp));
- memset((char*)tmp, 0, sizeof(tmp));
- if (p->tcp_options[i].data && (p->tcp_options[i].len >= 4))
- memcpy(tmp, (p->tcp_options[i].data) + 2, 2);
- TextLog_Print(log, "%u ", EXTRACT_16BITS(tmp));
- break;
+ {
+ uint16_t val1, val2;
+
+ if (opts[i].data && (opts[i].len >= 4))
+ {
+ val1 = extract_16_bits(opts[i].data);
+ val2 = extract_16_bits(opts[i].data + 2);
+ }
+ else if (opts[i].data && (opts[i].len >= 2))
+ {
+ val1 = extract_16_bits(opts[i].data);
+ val2 = 0;
+ }
+ else
+ {
+ val1 = 0;
+ val2 = 0;
+ }
+ TextLog_Print(log, "Sack: %u@%u", val1, val2);
+ break;
+ }
case TCPOPT_SACKOK:
TextLog_Puts(log, "SackOK ");
break;
case TCPOPT_ECHO:
- memset((char*)tmp, 0, sizeof(tmp));
- if (p->tcp_options[i].data)
- memcpy(tmp, p->tcp_options[i].data, 4);
- TextLog_Print(log, "Echo: %u ", EXTRACT_32BITS(tmp));
- break;
+ {
+ uint32_t val;
- case TCPOPT_ECHOREPLY:
- memset((char*)tmp, 0, sizeof(tmp));
- if (p->tcp_options[i].data)
- memcpy(tmp, p->tcp_options[i].data, 4);
- TextLog_Print(log, "Echo Rep: %u ", EXTRACT_32BITS(tmp));
+ if (opts[i].data)
+ val = extract_32_bits(opts[i].data);
+ else
+ val = 0;
+
+ TextLog_Print(log, "Echo: %u ", val);
break;
+ }
+ case TCPOPT_ECHOREPLY:
+ {
+ uint32_t val;
- case TCPOPT_TIMESTAMP:
- memset((char*)tmp, 0, sizeof(tmp));
- if (p->tcp_options[i].data)
- memcpy(tmp, p->tcp_options[i].data, 4);
- TextLog_Print(log, "TS: %u ", EXTRACT_32BITS(tmp));
- memset((char*)tmp, 0, sizeof(tmp));
- if (p->tcp_options[i].data)
- memcpy(tmp, (p->tcp_options[i].data) + 4, 4);
- TextLog_Print(log, "%u ", EXTRACT_32BITS(tmp));
+ if (opts[i].data)
+ val = extract_32_bits(opts[i].data);
+ else
+ val = 0;
+
+ TextLog_Print(log, "Echo Rep: %u ", val);
break;
+ }
+ case TCPOPT_TIMESTAMP:
+ {
+ uint32_t val1, val2;
- case TCPOPT_CC:
- memset((char*)tmp, 0, sizeof(tmp));
- if (p->tcp_options[i].data)
- memcpy(tmp, p->tcp_options[i].data, 4);
- TextLog_Print(log, "CC %u ", EXTRACT_32BITS(tmp));
+ if (opts[i].data)
+ {
+ val1 = extract_32_bits(opts[i].data);
+ val2 = extract_32_bits(opts[i].data + 4);
+ }
+ else
+ {
+ val1 = 0;
+ val2 = 0;
+ }
+ TextLog_Print(log, "TS: %u %u ", val1, val2);
break;
+ }
+ case TCPOPT_CC:
+ {
+ uint32_t val;
- case TCPOPT_CC_NEW:
- memset((char*)tmp, 0, sizeof(tmp));
- if (p->tcp_options[i].data)
- memcpy(tmp, p->tcp_options[i].data, 4);
- TextLog_Print(log, "CCNEW: %u ", EXTRACT_32BITS(tmp));
+ if (opts[i].data)
+ val = extract_32_bits(opts[i].data);
+ else
+ val = 0;
+
+ TextLog_Print(log, "CC %u ", val);
break;
+ }
+ case TCPOPT_CC_NEW:
+ {
+ uint32_t val;
- case TCPOPT_CC_ECHO:
- memset((char*)tmp, 0, sizeof(tmp));
- if (p->tcp_options[i].data)
- memcpy(tmp, p->tcp_options[i].data, 4);
- TextLog_Print(log, "CCECHO: %u ", EXTRACT_32BITS(tmp));
+ if (opts[i].data)
+ val = extract_32_bits(opts[i].data);
+ else
+ val = 0;
+
+ TextLog_Print(log, "CCNEW: %u ", val);
break;
+ }
+ case TCPOPT_CC_ECHO:
+ {
+ uint32_t val;
+ if (opts[i].data)
+ val = extract_32_bits(opts[i].data);
+ else
+ val = 0;
+
+ TextLog_Print(log, "CCECHO: %u ", val);
+ break;
+ }
default:
- if(p->tcp_options[i].len)
+ {
+ const uint8_t opts_len = opts[i].len;
+
+ if(opts_len)
{
- TextLog_Print(log, "Opt %d (%d): ", p->tcp_options[i].code,
- (int) p->tcp_options[i].len);
+ TextLog_Print(log, "Opt %d (%d): ", opts[i].code,
+ (int) opts_len);
- for(j = 0; j < p->tcp_options[i].len; j++)
+ if (opts[i].data)
{
- if (p->tcp_options[i].data)
- TextLog_Print(log, "%02X", p->tcp_options[i].data[j]);
- else
- TextLog_Print(log, "%02X", 0);
+ for(j = 0; (j +1) < opts_len; j += 2)
+ {
+ TextLog_Print(log, "%02X%02X ", opts[i].data[j],
+ opts[i].data[j+1]);
+ }
+
+ if (j < opts_len)
+ TextLog_Print(log, "%02x", opts[i].data[j]);
+ }
+ else
+ {
+ for(j = 0; (j +1) < opts_len; j += 2)
+ {
+ TextLog_Print(log, "%02X%02X ", 0, 0);
+ }
- if ((j + 1) % 2 == 0)
- TextLog_Putc(log, ' ');
+ if (j < opts_len)
+ TextLog_Print(log, "%02x", opts[i].data[j]);
}
TextLog_Putc(log, ' ');
TextLog_Print(log, "Opt %d ", p->tcp_options[i].code);
}
break;
+ }
}
}
-
TextLog_NewLine(log);
}
+
/*--------------------------------------------------------------------
* Function: LogTCPHeader(TextLog* )
*
return;
}
/* print TCP flags */
- CreateTCPFlagString(p, tcpFlags);
+ CreateTCPFlagString(p->tcph, tcpFlags);
TextLog_Puts(log, tcpFlags); /* We don't care about the NULL */
/* print other TCP info */
#include <stdint.h>
#include "log/text_log.h"
+#include "main/snort_types.h"
struct Packet;
struct Event;
void LogTrHeader(TextLog*, Packet*);
void Log2ndHeader(TextLog*, Packet*);
void LogIpAddrs(TextLog*, Packet*);
+SO_PUBLIC void LogIpOptions(TextLog*, const Packet* const);
void LogIPHeader(TextLog*, Packet*);
void LogTCPHeader(TextLog*, Packet*);
+SO_PUBLIC void LogTcpOptions(TextLog*, const Packet* const);
void LogUDPHeader(TextLog*, Packet*);
void LogICMPHeader(TextLog*, Packet*);
void LogArpHeader(TextLog*, Packet*);
// FIXIT-M do not call FatalError() during runtime
NORETURN void FatalError(const char*, ...) __attribute__((format (printf, 1, 2)));
-void PrintPacketData(const uint8_t*, const uint32_t);
-char* ObfuscateIpToText(const sfip_t*);
+SO_PUBLIC void PrintPacketData(const uint8_t*, const uint32_t);
+SO_PUBLIC char* ObfuscateIpToText(const sfip_t*);
class Dumper
{
{
if (p->tcph != NULL)
{
- CreateTCPFlagString(p, tcpFlags);
+ CreateTCPFlagString(p->tcph, tcpFlags);
TextLog_Print(csv_log, "%s", tcpFlags);
}
}
#include "managers/inspector_manager.h"
#include "managers/ips_manager.h"
#include "managers/mpse_manager.h"
-#include "managers/packet_manager.h"
+#include "protocols/packet_manager.h"
#include "managers/codec_manager.h"
#include "managers/action_manager.h"
#include "detection/sfrim.h"
module_manager.h
mpse_manager.cc
mpse_manager.h
- packet_manager.cc
- packet_manager.h
plugin_manager.cc
plugin_manager.h
script_manager.cc
ips_manager.cc ips_manager.h \
module_manager.cc module_manager.h \
mpse_manager.cc mpse_manager.h \
-packet_manager.cc packet_manager.h \
plugin_manager.cc plugin_manager.h \
script_manager.cc script_manager.h \
so_manager.cc so_manager.h
#include <algorithm>
#include "framework/codec.h"
#include "managers/codec_manager.h"
-#include "managers/packet_manager.h"
+#include "protocols/packet_manager.h"
#include "log/messages.h"
#include "parser/parser.h"
#include "packet_io/sfdaq.h"
}
- ParseAbort("Attempting to instantiate Codec '%s',"
+ ParseAbort("Attempting to instantiate Codec '%s', "
"but codec has not been added!!", cd_api->base.name);
}
for ( CodecApiWrapper& wrap : s_codecs )
{
if(wrap.api->pterm)
+ {
wrap.api->pterm();
+ wrap.init = false; // Future proofing this functin.
+ }
uint8_t index = get_codec(wrap.api->base.name);
if( index != 0)
}
// The default codec is NOT part of the plugin list
- // Free this memory seperately
- CodecApiWrapper& wrap = get_api_wrapper(default_codec);
+ if(default_codec->pterm)
+ default_codec->pterm();
- if(wrap.api->pterm)
- wrap.api->pterm();
-
- uint8_t index = get_codec(wrap.api->base.name);
- if( index != 0)
+ if (s_protocols[0])
{
- wrap.api->dtor(s_protocols[index]);
- s_protocols[index] = nullptr;
+ default_codec->dtor(s_protocols[0]);
+ s_protocols[0] = nullptr;
}
+
s_codecs.clear();
- s_protocols[0] = nullptr;
s_proto_map.fill(0);
}
void CodecManager::instantiate()
{
// hard code the default codec into the zero index
- add_plugin(default_codec);
- instantiate(default_codec, nullptr, nullptr);
+ CodecApiWrapper tmp_wrap;
+ tmp_wrap.api = default_codec;
+ tmp_wrap.init = false;
+ instantiate(tmp_wrap, nullptr, nullptr);
s_protocols[0] = s_protocols[get_codec(default_codec->base.name)];
// and instantiate every codec which does not have a module
#include "main/analyzer.h"
#include "protocols/packet.h"
#include "managers/data_manager.h"
-#include "managers/packet_manager.h"
+#include "protocols/packet_manager.h"
#include "event.h"
#include "event_wrapper.h"
#include "util.h"
#include "snort.h"
#include "managers/action_manager.h"
-#include "managers/packet_manager.h"
+#include "protocols/packet_manager.h"
#include "packet_io/sfdaq.h"
#include "protocols/tcp.h"
linux_sll.h
mpls.h
packet.h
+ packet_manager.h
protocol_ids.h
tcp.h
teredo.h
${PROTOCOL_HEADERS}
layer.cc
ip.cc
+ packet_manager.cc
)
install (FILES ${PROTOCOL_HEADERS}
layer.h \
mpls.h \
packet.h \
+packet_manager.h \
protocol_ids.h \
tcp.h \
teredo.h \
libprotocols_a_SOURCES = \
layer.cc \
+packet_manager.cc \
ip.cc
/*
-** Copyright (C) 2002-2013 Sourcefire, Inc.
-** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
**
** This program is free software; you can redistribute it and/or modify
** it under the terms of the GNU General Public License Version 2 as
uint16_t IpApi::off(const Packet* const p) const
{
if (ip4h)
- return ip4h->get_id();
+ return (uint32_t)ip4h->get_id();
// ensure we have an ipv6 frag
if (p->ip6_extension_count == 0 || p->ip_frag_start == 0 || !ip6h)
#include "framework/codec.h"
#include "managers/codec_manager.h"
-#include "managers/packet_manager.h"
+#include "protocols/packet_manager.h"
#include "main/snort.h"
#include "main/thread.h"
#include "log/messages.h"
stats_mutex.unlock();
}
+
+const char* PacketManager::get_proto_name(uint16_t protocol)
+{ return CodecManager::s_protocols[CodecManager::s_proto_map[protocol]]->get_name(); }
+
+const char* PacketManager::get_proto_name(uint8_t protocol)
+{ return CodecManager::s_protocols[CodecManager::s_proto_map[protocol]]->get_name(); }
// print codec information. MUST be called after thread_term.
static void dump_stats();
+ // Get the name of the given protocol
+ static const char* get_proto_name(uint16_t protocol);
+ // Get the name of the given protocol
+ static const char* get_proto_name(uint8_t protocol);
private:
// STATISTICS!!
constexpr uint16_t PROTOCOL_GTP = 0x0102;
constexpr uint16_t IP_EMBEDDED_IN_ICMP4 = 0x0103;
constexpr uint16_t IP_EMBEDDED_IN_ICMP6 = 0x0104;
+constexpr uint16_t ETHERNET_802_3 = 0x0105; // CAPWAP sends data back to eth layer
#include "log_text.h"
#include "detect.h"
#include "protocols/packet.h"
-#include "managers/packet_manager.h"
+#include "protocols/packet_manager.h"
#include "event.h"
#include "util.h"
#include "snort_debug.h"
#include "snort.h"
#include "time/packet_time.h"
#include "protocols/packet.h"
-#include "managers/packet_manager.h"
+#include "protocols/packet_manager.h"
#include "log_text.h"
#include "packet_io/active.h"
#include "normalize/normalize.h"
STREAM5_DEBUG_WRAP(
char flagbuf[9];
- CreateTCPFlagString(p, flagbuf);
+ CreateTCPFlagString(p->tcph, flagbuf);
DebugMessage((DEBUG_STREAM|DEBUG_STREAM_STATE),
"Got TCP Packet 0x%X:%d -> 0x%X:%d %s\nseq: 0x%X ack:0x%X dsize: %u\n",
p->ip_api.get_src(), p->sp, p->ip_api.get_dst(), p->dp, flagbuf,
#include "packet_io/trough.h"
#include "target_based/sftarget_reader.h"
#include "managers/module_manager.h"
-#include "managers/packet_manager.h"
+#include "protocols/packet_manager.h"
#include "managers/codec_manager.h"
#include "detection/fpcreate.h"
#include "filters/sfthreshold.h"
projects / thirdparty / snort3.git / commitdiff
