Adding Packet Type support to packet

diff --git a/src/codecs/ip/cd_icmp4.cc b/src/codecs/ip/cd_icmp4.cc
index b9012c7f56fb2d05c097324e48b50243e66bf25c..d0b96d82b7db3279e450a41b472e076c3257fdda 100644 (file)
--- a/src/codecs/ip/cd_icmp4.cc
+++ b/src/codecs/ip/cd_icmp4.cc
@@ -242,7 +242,7 @@ bool Icmp4Codec::decode(const RawData& raw, CodecData& codec,SnortData& snort)
     /* Run a bunch of ICMP decoder rules */
     ICMP4MiscTests(icmph, codec, (uint16_t)raw.len - len);
 
-    snort.packet_type = PKT_TYPE__ICMP4;
+    snort.set_pkt_type(PktType::ICMP4);
     snort.icmph = icmph;
     codec.proto_bits |= PROTO_BIT__ICMP;
     codec.lyr_len = len;

diff --git a/src/codecs/ip/cd_icmp6.cc b/src/codecs/ip/cd_icmp6.cc
index 6e935d89d3e218c5bdfe83cc98ea2f320ad9d805..d30f04ce4d431e8ff03afe83a69e6c0177cb00ee 100644 (file)
--- a/src/codecs/ip/cd_icmp6.cc
+++ b/src/codecs/ip/cd_icmp6.cc
@@ -277,7 +277,7 @@ bool Icmp6Codec::decode(const RawData& raw, CodecData& codec, SnortData& snort)
     codec.lyr_len = len;
     codec.proto_bits |= PROTO_BIT__ICMP;
     snort.icmph = reinterpret_cast<const icmp::ICMPHdr*>(icmp6h);
-    snort.packet_type = PKT_TYPE__ICMP6;
+    snort.set_pkt_type(PktType::ICMP6);
     return true;
 }
 

diff --git a/src/codecs/ip/cd_ipv4.cc b/src/codecs/ip/cd_ipv4.cc
index 8709238b1a054d36e5eeb22f115f6d7d586a43da..094cbaed840afea802b9ff8d38ed66b50e07415d 100644 (file)
--- a/src/codecs/ip/cd_ipv4.cc
+++ b/src/codecs/ip/cd_ipv4.cc
@@ -367,7 +367,7 @@ bool Ipv4Codec::decode(const RawData& raw, CodecData& codec, SnortData& snort)
         codec_events::decoder_event(DECODE_BAD_FRAGBITS);
 
 
-    snort.packet_type = PKT_TYPE__IP;
+    snort.set_pkt_type(PktType::IP);
     codec.proto_bits |= PROTO_BIT__IP;
     IPMiscTests(iph, ip::IP4_HEADER_LEN + ip_opt_len);
     codec.lyr_len = hlen;

diff --git a/src/codecs/ip/cd_ipv6.cc b/src/codecs/ip/cd_ipv6.cc
index 3551313d1529da4c3ba5323bfe7762d395965ae9..da8bfc74d138f842014cd36a7ecb758ce2ff5303 100644 (file)
--- a/src/codecs/ip/cd_ipv6.cc
+++ b/src/codecs/ip/cd_ipv6.cc
@@ -258,7 +258,7 @@ bool Ipv6Codec::decode(const RawData& raw, CodecData& codec, SnortData& snort)
         IPV6MiscTests(snort);
         CheckIPV6Multicast(ip6h);
 
-        snort.packet_type = PKT_TYPE__IP;
+        snort.set_pkt_type(PktType::IP);
         codec.next_prot_id = ip6h->get_next();
         codec.lyr_len = ip::IP6_HEADER_LEN;
 
@@ -270,6 +270,7 @@ bool Ipv6Codec::decode(const RawData& raw, CodecData& codec, SnortData& snort)
 decodeipv6_fail:
     /* If this was Teredo, back up and treat the packet as normal UDP. */
 
+    // FIXIT-L  handle active bypass without a global variable
     if (codec.codec_flags & CODEC_TEREDO_SEEN)
     {
         if ( ScTunnelBypassEnabled(TUNNEL_TEREDO) )

diff --git a/src/codecs/ip/cd_tcp.cc b/src/codecs/ip/cd_tcp.cc
index 12d569b6e40a2e2888a72532932f3559b088a00c..a1ad4c84defcae7fb2cbc973aaed0441fec658ba 100644 (file)
--- a/src/codecs/ip/cd_tcp.cc
+++ b/src/codecs/ip/cd_tcp.cc
@@ -279,7 +279,7 @@ bool TcpCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort)
     snort.tcph = tcph;
     snort.sp = tcph->src_port();
     snort.dp = tcph->dst_port();
-    snort.packet_type = PKT_TYPE__TCP;
+    snort.set_pkt_type(PktType::TCP);
 
     TCPMiscTests(snort, tcph);
 

diff --git a/src/codecs/ip/cd_udp.cc b/src/codecs/ip/cd_udp.cc
index 789db0e6848c698a73ac1c2883898df55d97b76d..70ed190f1b1c658f32d571da4255969b1752c0f5 100644 (file)
--- a/src/codecs/ip/cd_udp.cc
+++ b/src/codecs/ip/cd_udp.cc
@@ -290,7 +290,7 @@ bool UdpCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort)
     snort.dp = dst_port;
     codec.lyr_len = udp::UDP_HEADER_LEN;
     codec.proto_bits |= PROTO_BIT__UDP;
-    snort.packet_type = PKT_TYPE__UDP;
+    snort.set_pkt_type(PktType::UDP);
 
     // set in packet manager
     UDPMiscTests(snort, uhlen - udp::UDP_HEADER_LEN);

diff --git a/src/codecs/link/cd_arp.cc b/src/codecs/link/cd_arp.cc
index 88a57aa84de5d94268d94750f7830e2c131c85b6..e446c84c2c3a178b51a28ad561d09dca09b2a382 100644 (file)
--- a/src/codecs/link/cd_arp.cc
+++ b/src/codecs/link/cd_arp.cc
@@ -99,7 +99,7 @@ bool ArpCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort)
 
     codec.proto_bits |= PROTO_BIT__ARP;
     codec.lyr_len = sizeof(arp::EtherARP);
-    snort.packet_type = PKT_TYPE__ARP;
+    snort.set_pkt_type(PktType::ARP);
 
     return true;
 }

diff --git a/src/framework/codec.h b/src/framework/codec.h
index b185f1e9a543f44032a74590467f8ee8daf7bd45..e4dbf2d740355f74ae1463b7b99523b6fe1561f5 100644 (file)
--- a/src/framework/codec.h
+++ b/src/framework/codec.h
@@ -134,35 +134,62 @@ struct RawData
     uint32_t len;
 };
 
-/*  SnortData Flags */
-
-/* error flags */
-constexpr uint8_t DECODE_ERR_CKSUM_IP = 0x01;
-constexpr uint8_t DECODE_ERR_CKSUM_TCP = 0x02;
-constexpr uint8_t DECODE_ERR_CKSUM_UDP = 0x04;
-constexpr uint8_t DECODE_ERR_CKSUM_ICMP = 0x08;
-constexpr uint8_t DECODE_ERR_CKSUM_ANY = 0x0F;
-constexpr uint8_t DECODE_ERR_BAD_TTL = 0x10;
-constexpr uint8_t DECODE_PKT_TRUST = 0x20;    /* Tell Snort++ to whitelist this packet */
-constexpr uint8_t DECODE_FRAG = 0x40;  /* flag to indicate a fragmented packet */
-constexpr uint8_t DECODE_MF = 0x80;
-
-constexpr uint8_t DECODE_ERR_FLAGS = DECODE_ERR_CKSUM_IP |
-    DECODE_ERR_CKSUM_TCP |
-    DECODE_ERR_CKSUM_UDP |
-    DECODE_ERR_CKSUM_UDP |
-    DECODE_ERR_CKSUM_ICMP |
-    DECODE_ERR_CKSUM_ANY |
-    DECODE_ERR_BAD_TTL;
-
-
-constexpr uint8_t PKT_TYPE__UNKOWN = 0x00;
-constexpr uint8_t PKT_TYPE__IP = 0x01;
-constexpr uint8_t PKT_TYPE__TCP = 0x02;
-constexpr uint8_t PKT_TYPE__UDP = 0x04;
-constexpr uint8_t PKT_TYPE__ICMP4 = 0x08;
-constexpr uint8_t PKT_TYPE__ICMP6 = 0x10;
-constexpr uint8_t PKT_TYPE__ARP = 0x20;
+
+enum DecodeFlags : std::uint16_t
+{
+    /*
+     * DO NOT USE PKT_TYPE_* directly!! Use PktType enum and
+     *      access methods to get/set.
+     *
+     * NOTE: While using the first bits as an
+     *      enumerated type (i.e., not as flags) is asking
+     *      for trouble, creating a seperate PktType entity would
+     *      waste five perfectly good bits. Additionally,
+     *      those wated bits would be needlesly zero before
+     *      decoding every packet.  So, I'm living dangerously
+     *      and going with the bad idea .. I'm also hoping this
+     *      grouping shows the connection betwee PktTypes
+     *      and regular DecodeFlags
+     */
+    PKT_TYPE_UNKOWN = 0x00,
+    PKT_TYPE_IP = 0x01,
+    PKT_TYPE_TCP = 0x02,
+    PKT_TYPE_UDP = 0x03,
+    PKT_TYPE_ICMP4 = 0x04,
+    PKT_TYPE_ICMP6 = 0x05,
+    PKT_TYPE_ARP = 0x06,
+    PKT_TYPE_FREE = 0x07, /* If protocol is added, update enum class PktType below. */
+    PKT_TYPE_MASK = 0x07,
+
+    /* error flags */
+    DECODE_ERR_CKSUM_IP = 0x0008,
+    DECODE_ERR_CKSUM_TCP = 0x0010,
+    DECODE_ERR_CKSUM_UDP = 0x0020,
+    DECODE_ERR_CKSUM_ICMP = 0x0040,
+    DECODE_ERR_CKSUM_ANY = 0x0080,
+    DECODE_ERR_BAD_TTL = 0x0100,
+    DECODE_ERR_FLAGS = (DECODE_ERR_CKSUM_IP | DECODE_ERR_CKSUM_TCP |
+                        DECODE_ERR_CKSUM_UDP | DECODE_ERR_CKSUM_UDP |
+                        DECODE_ERR_CKSUM_ICMP | DECODE_ERR_CKSUM_ANY |
+                        DECODE_ERR_BAD_TTL),
+
+
+    DECODE_PKT_TRUST = 0x0200,    /* Tell Snort++ to whitelist this packet */
+    DECODE_FRAG = 0x0400,  /* flag to indicate a fragmented packet */
+    DECODE_MF = 0x0800,
+};
+
+/* NOTE: if A protocol is added, update DecodeFlags! */
+enum class PktType : std::uint8_t
+{
+    UNKOWN = PKT_TYPE_UNKOWN,
+    IP = PKT_TYPE_IP,
+    TCP = PKT_TYPE_TCP,
+    UDP = PKT_TYPE_UDP,
+    ICMP4 = PKT_TYPE_ICMP4,
+    ICMP6 = PKT_TYPE_ICMP6,
+    ARP = PKT_TYPE_ARP,
+};
 
 struct SnortData
 {
@@ -175,20 +202,31 @@ struct SnortData
     const tcp::TCPHdr* tcph;
     const udp::UDPHdr* udph;
     const icmp::ICMPHdr* icmph;
-    uint16_t sp;                /* source port (TCP/UDP) */
-    uint16_t dp;                /* dest port (TCP/UDP) */
-    uint8_t decode_flags;       /* decoder flags including checksum errors, bad TTLs, frag, etc. */
-    uint8_t packet_type;
+    uint16_t sp;            /* source port (TCP/UDP) */
+    uint16_t dp;            /* dest port (TCP/UDP) */
+    uint16_t decode_flags;  /* First bits (currently 3), which are masked using the constant
+                             * DECODE_PKT_TYPE_MASK defined above, are specifically
+                             * for the PktType. Everything else is fair game flag.
+                             *
+                             */
 
     ip::IpApi ip_api;
     mpls::MplsHdr mplsHdr;
 
     inline void reset()
     {
-        static_assert(PKT_TYPE__UNKOWN == 0, "PKT_TYPE__UNKOWN must be zero!!");
+        static_assert(PKT_TYPE_UNKOWN == 0,
+            "The Packets 'type' gets resets to zero - "
+            "which means zero is unkown");
         memset((char*)&tcph, '\0', offsetof(SnortData, ip_api));
         ip_api.reset();
     }
+
+    inline void set_pkt_type(PktType pkt_type)
+    { decode_flags = (decode_flags & ~PKT_TYPE_MASK) | static_cast<uint16_t>(pkt_type); }
+
+    inline PktType get_pkt_type() const
+    { return static_cast<PktType>(decode_flags & PKT_TYPE_MASK); }
 };
 
 

diff --git a/src/protocols/ipv4_options.h b/src/protocols/ipv4_options.h
index 3ddd4c2cd34c9b9ee88f21c5af527a298b952325..f8d64c280d480e551ec22e320c1e42e38144d4cc 100644 (file)
--- a/src/protocols/ipv4_options.h
+++ b/src/protocols/ipv4_options.h
@@ -32,7 +32,8 @@ namespace ip
 
 struct IP4Hdr;
 
-enum class IPOptionCodes : std::uint8_t {
+enum class IPOptionCodes : std::uint8_t
+{
     EOL = 0x00,
     NOP = 0x01,
     RR = 0x07,

diff --git a/src/protocols/packet.h b/src/protocols/packet.h
index 5967ca98eb15ae9ab99574b0217c66c0c65896ea..47ccbf2789b219fb59c9180d60d0c4329fcf3207 100644 (file)
--- a/src/protocols/packet.h
+++ b/src/protocols/packet.h
@@ -156,7 +156,6 @@ constexpr uint8_t MAX_TTL = 255;
 constexpr uint8_t LAYER_MAX = 32;
 
 
-
 /*  D A T A  S T R U C T U R E S  *********************************************/
 class Flow;
 
@@ -205,8 +204,8 @@ struct Packet
 
     /*  Access methods */
 
-    inline uint8_t type() const
-    { return ptrs.packet_type; }
+    inline PktType type() const
+    { return ptrs.get_pkt_type(); } // defined in codec.h
 };
 
 #define PKT_ZERO_LEN offsetof(Packet, pkth)

diff --git a/src/stream/tcp/tcp_session.cc b/src/stream/tcp/tcp_session.cc
index 4c548a0a19672b5af84f96e62182f41e20dbb45f..fb6ca9871b6e145d0ab014202e836c6ddb8647af 100644 (file)
--- a/src/stream/tcp/tcp_session.cc
+++ b/src/stream/tcp/tcp_session.cc
@@ -137,7 +137,8 @@ const char* tcp_pegs[] =
     "gaps",
     "internal events",
     "client cleanup flushes",
-    "server cleanup flushes"
+    "server cleanup flushes",
+    nullptr
 };
 
 THREAD_LOCAL TcpStats tcpStats;

diff --git a/src/test/sfip_test.cc b/src/test/sfip_test.cc
index aa8227cf7316a713b9f69cc0dea3c4ad9f6991e0..5a1b01fa2aa9b2fd46277ae77df474b812d1bf3e 100644 (file)
--- a/src/test/sfip_test.cc
+++ b/src/test/sfip_test.cc
@@ -25,10 +25,18 @@
 #include <stdlib.h>
 
 
+
+#if defined(__clang__)
 #pragma clang diagnostic push
 #pragma clang diagnostic ignored "-Wgnu-zero-variadic-macro-arguments"
+#endif
+
 #include <check.h>
+
+
+#if defined(__clang__)
 #pragma clang diagnostic pop
+#endif
 
 #include "snort_types.h"
 #include "sfip/sf_ip.h"

diff --git a/src/test/sfrf_test.cc b/src/test/sfrf_test.cc
index 57c4c3e048c3ffb433056c6190d89eef6e70d695..e40a22d7286d272db5faf2b192fcab1b249bfc17 100644 (file)
--- a/src/test/sfrf_test.cc
+++ b/src/test/sfrf_test.cc
@@ -28,10 +28,17 @@
 #include <stdio.h>
 #include <stdlib.h>
 
+#if defined(__clang__)
 #pragma clang diagnostic push
 #pragma clang diagnostic ignored "-Wgnu-zero-variadic-macro-arguments"
+#endif
+
 #include <check.h>
+
+
+#if defined(__clang__)
 #pragma clang diagnostic pop
+#endif
 
 #include "snort_types.h"
 #include "snort.h"

diff --git a/src/test/sfrt_test.cc b/src/test/sfrt_test.cc
index 41476423c70bf04ea284f7c3e88ef488295dc494..5ded80560a4f3de803df97cc069a3680d75031d0 100644 (file)
--- a/src/test/sfrt_test.cc
+++ b/src/test/sfrt_test.cc
@@ -24,10 +24,18 @@
 #include <stdio.h>
 #include <stdlib.h>
 
+
+#if defined(__clang__)
 #pragma clang diagnostic push
 #pragma clang diagnostic ignored "-Wgnu-zero-variadic-macro-arguments"
+#endif
+
 #include <check.h>
+
+
+#if defined(__clang__)
 #pragma clang diagnostic pop
+#endif
 
 #include "snort_types.h"
 #include "sfrt/sfrt.h"

diff --git a/src/test/sfthd_test.cc b/src/test/sfthd_test.cc
index 423159b73bbea6ae4f917babf42494de500d71ee..1746d1432bcb5fd39db741e17782029ef09b7be6 100644 (file)
--- a/src/test/sfthd_test.cc
+++ b/src/test/sfthd_test.cc
@@ -26,11 +26,16 @@
 #include <string.h>
 
 
+#if defined(__clang__)
 #pragma clang diagnostic push
 #pragma clang diagnostic ignored "-Wgnu-zero-variadic-macro-arguments"
+#endif
+
 #include <check.h>
-#pragma clang diagnostic pop
 
+#if defined(__clang__)
+#pragma clang diagnostic pop
+#endif
 
 #include "snort.h"
 #include "sfip/sf_ip.h"

diff --git a/src/test/unit_test.cc b/src/test/unit_test.cc
index a32a7205c685422e7b22f15d4ca0cec1e94308bc..5274d1a9cf72d7a09c65f5f043c63e035512107b 100644 (file)
--- a/src/test/unit_test.cc
+++ b/src/test/unit_test.cc
@@ -21,8 +21,18 @@
 #include "unit_test.h"
 
 #include <stdlib.h>
+
+#if defined(__clang__)
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wgnu-zero-variadic-macro-arguments"
+#endif
+
 #include <check.h>
 
+#if defined(__clang__)
+#pragma clang diagnostic pop
+#endif
+
 #include "suite_decl.h"
 
 static print_output s_mode = CK_LAST;