various logging patches

diff --git a/src/codecs/ip/cd_tcp.cc b/src/codecs/ip/cd_tcp.cc
index 72cfc6b54f0d7a49c55d6682b239746f5cb50b67..b4728aac72389f9a7f26763c625e781b1241849c 100644 (file)
--- a/src/codecs/ip/cd_tcp.cc
+++ b/src/codecs/ip/cd_tcp.cc
@@ -149,7 +149,7 @@ void TcpCodec::get_protocol_ids(std::vector<uint16_t>& v)
 
 bool TcpCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort)
 {
-    if(raw.len < tcp::TCP_HEADER_LEN)
+    if(raw.len < tcp::TCP_MIN_HEADER_LEN)
     {
         codec_events::decoder_event(codec, DECODE_TCP_DGRAM_LT_TCPHDR);
         return false;
@@ -159,7 +159,7 @@ bool TcpCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort)
     const tcp::TCPHdr* tcph = reinterpret_cast<const tcp::TCPHdr*>(raw.data);
     const uint16_t tcph_len = tcph->hdr_len();
 
-    if(tcph_len < tcp::TCP_HEADER_LEN)
+    if(tcph_len < tcp::TCP_MIN_HEADER_LEN)
     {
         codec_events::decoder_event(codec, DECODE_TCP_INVALID_OFFSET);
         return false;
@@ -283,10 +283,10 @@ bool TcpCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort)
 
 
     /* if options are present, decode them */
-    uint16_t tcp_opt_len = (uint16_t)(tcph->hdr_len() - tcp::TCP_HEADER_LEN);
+    uint16_t tcp_opt_len = (uint16_t)(tcph->hdr_len() - tcp::TCP_MIN_HEADER_LEN);
 
     if(tcp_opt_len > 0)
-        DecodeTCPOptions((uint8_t *) (raw.data + tcp::TCP_HEADER_LEN), tcp_opt_len, codec);
+        DecodeTCPOptions((uint8_t *) (raw.data + tcp::TCP_MIN_HEADER_LEN), tcp_opt_len, codec);
 
 
     int dsize = raw.len - tcph->hdr_len();
@@ -381,7 +381,7 @@ void DecodeTCPOptions(const uint8_t *start, uint32_t o_len, CodecData& codec)
      * 4) increment option code ptr
      *
      * TCP_OPTLENMAX = 40 because of
-     *        (((2^4) - 1) * 4  - tcp::TCP_HEADER_LEN
+     *        (((2^4) - 1) * 4  - tcp::TCP_MIN_HEADER_LEN
      *
      */
 
@@ -617,7 +617,7 @@ bool TcpCodec::encode(const uint8_t* const raw_in, const uint16_t /*raw_len*/,
 {
     const tcp::TCPHdr* const hi = reinterpret_cast<const tcp::TCPHdr*>(raw_in);
 
-    if (!buf.allocate(tcp::TCP_HEADER_LEN))
+    if (!buf.allocate(tcp::TCP_MIN_HEADER_LEN))
         return false;
 
     tcp::TCPHdr* tcph_out = reinterpret_cast<tcp::TCPHdr*>(buf.base);
@@ -653,7 +653,7 @@ bool TcpCodec::encode(const uint8_t* const raw_in, const uint16_t /*raw_len*/,
     }
 
     tcph_out->th_offx2 = 0;
-    tcph_out->set_offset(tcp::TCP_HEADER_LEN >> 2);
+    tcph_out->set_offset(tcp::TCP_MIN_HEADER_LEN >> 2);
     tcph_out->th_win = 0;
     tcph_out->th_urp = 0;
 

diff --git a/src/log/log_text.cc b/src/log/log_text.cc
index 86a7cb8e6bb2de107790c1b23bca9396dd34ecc8..7b8d94cc9b3179085d0c3d5889ea0af2fbc23bbb 100644 (file)
--- a/src/log/log_text.cc
+++ b/src/log/log_text.cc
@@ -719,7 +719,12 @@ static void LogOuterIPHeader(TextLog *log, Packet *p)
         p->ptrs.dp = save_dp;
     }
     else
+    {
+        PktType tmp_type = p->type();
+        p->ptrs.set_pkt_type(PktType::IP);
         LogIPHeader(log, p);
+        p->ptrs.set_pkt_type(tmp_type);
+    }
 
     p->ptrs.ip_api = save_ip_api;
     p->packet_flags |= save_frag_flag;
@@ -808,7 +813,7 @@ void LogTcpOptions(TextLog*  log, const Packet* const p)
             break;
 
         case tcp::TcpOptCode::TIMESTAMP:
-            TextLog_Print(log, "TS: %u %u", extract_32_bits(opt.data), opt.data + 4);
+            TextLog_Print(log, "TS: %u %u", extract_32_bits(opt.data), extract_32_bits(opt.data + 4));
             break;
 
         case tcp::TcpOptCode::CC:
@@ -1647,8 +1652,8 @@ static int LogObfuscatedData(TextLog* log, Packet *p)
         LogNetData(log, buf, dlen + payload_len, NULL);
     }
 
-    free(payload);
 
+    free(payload);
     return 0;
 }
 
@@ -1736,6 +1741,12 @@ void LogIPPkt(TextLog* log, Packet * p)
         while (layer::set_outer_ip_api(p, p->ptrs.ip_api, num_layer) &&
             tmp_api != p->ptrs.ip_api)
         {
+#ifdef REG_TEST
+            // In Snort, cooked packets should not print an outer IP Header
+            if (p->is_cooked())
+              break;
+#endif
+
             LogOuterIPHeader(log, p);
 
             if (first)
@@ -1834,7 +1845,7 @@ void LogIPPkt(TextLog* log, Packet * p)
         LogNetData(log, p->pkt, p->pkth->caplen, p);
     }
 #ifdef REG_TEST
-    TextLog_Print(log, "\n%s\n", SEPARATOR);
+    TextLog_Print(log, "\n%s\n\n", SEPARATOR);
 #endif
 }
 

diff --git a/src/network_inspectors/normalize/norm.cc b/src/network_inspectors/normalize/norm.cc
index 38959bc2fdbd43aef41c201cccc87fc33ae99329..5b9b9ba04e160fb0f6f68b2cff77877b07d2bb89 100644 (file)
--- a/src/network_inspectors/normalize/norm.cc
+++ b/src/network_inspectors/normalize/norm.cc
@@ -508,9 +508,9 @@ static int Norm_TCP (
     if ( tcp_options_len > 0 )
     {
         const Layer& lyr = p->layers[layer];
-        uint8_t* opts = const_cast<uint8_t*>(lyr.start) + tcp::TCP_HEADER_LEN;
+        uint8_t* opts = const_cast<uint8_t*>(lyr.start) + tcp::TCP_MIN_HEADER_LEN;
         // lyr.length only includes valid tcp options
-        uint8_t valid_opts_len = lyr.length - tcp::TCP_HEADER_LEN;
+        uint8_t valid_opts_len = lyr.length - tcp::TCP_MIN_HEADER_LEN;
 
         if ( Norm_IsEnabled(c, NORM_TCP_OPT) )
         {

diff --git a/src/protocols/packet.h b/src/protocols/packet.h
index 9c6d502f5bd6f576c29fa59fb868e2d578be2f2e..88dfca0c69063dcf1073cafdbeb899cbe5545e25 100644 (file)
--- a/src/protocols/packet.h
+++ b/src/protocols/packet.h
@@ -195,6 +195,9 @@ struct SO_PUBLIC Packet
     inline bool is_udp() const
     { return ptrs.get_pkt_type() == PktType::UDP; }
 
+    inline bool is_cooked() const
+    { return packet_flags & PKT_PSEUDO; }
+
     /* Get general, non-boolean information */
     inline PktType type() const
     { return ptrs.get_pkt_type(); } // defined in codec.h

diff --git a/src/protocols/tcp.h b/src/protocols/tcp.h
index c672a267c812ce5e8f56f5d78083b1ed80cb7c80..db5f5c069faf91cae922a11c85c598503d1f9c3b 100644 (file)
--- a/src/protocols/tcp.h
+++ b/src/protocols/tcp.h
@@ -66,7 +66,7 @@ namespace tcp
 {
 
 
-constexpr uint8_t TCP_HEADER_LEN = 20; // this is actually the minimal TCP header lenght
+constexpr uint8_t TCP_MIN_HEADER_LEN = 20; // this is actually the minimal TCP header lenght
 constexpr int OPT_TRUNC = -1;
 constexpr int OPT_BADLEN = -2;
 
@@ -90,7 +90,7 @@ struct TCPHdr
     { return th_offx2 >> 4; }
 
     inline uint8_t options_len() const
-    { return hdr_len() - TCP_HEADER_LEN; }
+    { return hdr_len() - TCP_MIN_HEADER_LEN; }
 
     inline uint16_t src_port() const
     { return ntohs(th_sport); }

diff --git a/src/protocols/tcp_options.cc b/src/protocols/tcp_options.cc
index 71ddf42c77a8de450c8ddca9d6789f02b90e3ae7..c6b7f95d9dbcc3c46f0212e81fa98b9fcc27eb8e 100644 (file)
--- a/src/protocols/tcp_options.cc
+++ b/src/protocols/tcp_options.cc
@@ -39,7 +39,7 @@ const TcpOption& TcpOptIteratorIter::operator* () const
 TcpOptIterator::TcpOptIterator(const TCPHdr* const tcp_header, const Packet* const p)
 {
     const uint8_t* const hdr = (const uint8_t* const)tcp_header;
-    start_ptr = hdr + TCP_HEADER_LEN;
+    start_ptr = hdr + TCP_MIN_HEADER_LEN;
     end_ptr = start_ptr; // == begin()
 
     for (int i = p->num_layers-1; i >= 0; --i)
@@ -61,9 +61,9 @@ TcpOptIterator::TcpOptIterator(const TCPHdr* const tcp_header, const Packet* con
 TcpOptIterator::TcpOptIterator(const TCPHdr* const tcp_header, const uint32_t valid_hdr_len)
 {
     const uint8_t* const hdr = (const uint8_t* const)tcp_header;
-    start_ptr = hdr + TCP_HEADER_LEN;
+    start_ptr = hdr + TCP_MIN_HEADER_LEN;
 
-    if (valid_hdr_len < TCP_HEADER_LEN)
+    if (valid_hdr_len < TCP_MIN_HEADER_LEN)
         end_ptr = start_ptr;
     else
         end_ptr = hdr + valid_hdr_len;