From: Josh Date: Mon, 2 Jun 2014 20:22:41 +0000 (-0400) Subject: Adding Codec modules X-Git-Tag: 3.0.0-233~1509^2 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=0da172e39a266fbeda6108ad7d43b0acfe6bfc9b;p=thirdparty%2Fsnort3.git Adding Codec modules --- diff --git a/src/codecs/CMakeLists.txt b/src/codecs/CMakeLists.txt index 46cd61fa5..fd87319fe 100644 --- a/src/codecs/CMakeLists.txt +++ b/src/codecs/CMakeLists.txt @@ -8,9 +8,7 @@ add_subdirectory(misc) add_library( codecs STATIC decode.h - decode.cc decode_module.h - decode_module.cc codec_api.h codec_api.cc ipv6_util.h @@ -32,4 +30,3 @@ target_link_libraries( codecs framework main ) - diff --git a/src/codecs/Makefile.am b/src/codecs/Makefile.am index 289dd9538..d2f0d0704 100644 --- a/src/codecs/Makefile.am +++ b/src/codecs/Makefile.am @@ -6,9 +6,7 @@ noinst_LIBRARIES += libcodec_utils.a libcodecs_a_SOURCES = \ codec_api.cc \ codec_api.h \ -decode.cc \ decode.h \ -decode_module.cc \ decode_module.h \ layer.h \ sf_protocols.h diff --git a/src/codecs/codec_api.cc b/src/codecs/codec_api.cc index 39b6fc0f5..38d16d867 100644 --- a/src/codecs/codec_api.cc +++ b/src/codecs/codec_api.cc @@ -46,7 +46,6 @@ extern const BaseApi* cd_icmp6; extern const BaseApi* cd_tcp; extern const BaseApi* cd_udp; extern const BaseApi* cd_esp; -extern const BaseApi* cd_null; #ifdef STATIC_DECODERS extern const BaseApi* cd_ah; @@ -98,7 +97,6 @@ const BaseApi* codecs[] = cd_tcp, cd_udp, cd_esp, - cd_null, #ifdef STATIC_DECODERS cd_ah, diff --git a/src/codecs/codec_events.cc b/src/codecs/codec_events.cc index 9d395b24e..c06b1d2bf 100644 --- a/src/codecs/codec_events.cc +++ b/src/codecs/codec_events.cc @@ -23,15 +23,8 @@ #endif #include "codecs/codec_events.h" -#include "time/profiler.h" -#include "mempool/mempool.h" -#include "events/event_queue.h" -#include "log/messages.h" #include "snort.h" #include "packet_io/active.h" -#include "utils/stats.h" -#include "codecs/decode_module.h" - void codec_events::exec_udp_chksm_drop (Packet *) { @@ -53,7 +46,7 @@ void codec_events::exec_tcp_chksm_drop (Packet*) } } -void codec_events::decoder_event(Packet *p, int sid) +void codec_events::decoder_event(Packet *p, CodecSid sid) { if ( p->packet_flags & PKT_REBUILT_STREAM ) return; @@ -76,28 +69,6 @@ void codec_events::exec_ip_chksm_drop (Packet*) } } -void codec_events::exec_hop_drop (Packet* p, int sid) -{ - if ( p->packet_flags & PKT_REBUILT_STREAM ) - return; - - if ( ScLogVerbose() ) - ErrorMessage("%d:%d\n", GID_DECODE, sid); - - SnortEventqAdd(GID_DECODE, sid); -} - -void codec_events::exec_ttl_drop (Packet *p, int sid) -{ - if ( p->packet_flags & PKT_REBUILT_STREAM ) - return; - - if ( ScLogVerbose() ) - ErrorMessage("%d:%d\n", GID_DECODE, sid); - - SnortEventqAdd(GID_DECODE, sid); -} - void codec_events::exec_icmp_chksm_drop (Packet*) { if( ScInlineMode() && ScIcmpChecksumDrops() ) @@ -109,7 +80,7 @@ void codec_events::exec_icmp_chksm_drop (Packet*) } void codec_events::decoder_alert_encapsulated( - Packet *p, int sid, const uint8_t *pkt, uint32_t len) + Packet *p, CodecSid sid, const uint8_t *pkt, uint32_t len) { decoder_event(p, sid); diff --git a/src/codecs/codec_events.h b/src/codecs/codec_events.h index 1e4158535..79b0e8ea5 100644 --- a/src/codecs/codec_events.h +++ b/src/codecs/codec_events.h @@ -21,29 +21,20 @@ #ifndef CODEC_EVENTS_H #define CODEC_EVENTS_H -#include - -// included for DECODE_INDEX_MAX -#include "detection/generators.h" -//#include "utils/sfActionQueue.h" -#include "network_inspectors/normalize/normalize.h" #include "protocols/packet.h" -#include "time/profiler.h" #include "codecs/decode_module.h" namespace codec_events { void exec_ip_chksm_drop(Packet*); - void exec_udp_chksm_drop (Packet *); + void exec_udp_chksm_drop (Packet*); void exec_tcp_chksm_drop (Packet*); - void exec_hop_drop(Packet* p, int sid); - void exec_ttl_drop (Packet *data, int sid); void exec_icmp_chksm_drop (Packet*); - - void decoder_event (Packet *, int); + void decoder_event(Packet* p, CodecSid); void decoder_alert_encapsulated( - Packet *p, int sid, const uint8_t *pkt, uint32_t len); + Packet*, CodecSid, const uint8_t* pkt, uint32_t len); + } //namespace codec_events diff --git a/src/codecs/decode.cc b/src/codecs/decode.cc deleted file mode 100644 index 5e4ac4d75..000000000 --- a/src/codecs/decode.cc +++ /dev/null @@ -1,159 +0,0 @@ -/* -** Copyright (C) 2002-2013 Sourcefire, Inc. -** Copyright (C) 1998-2002 Martin Roesch -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif - -#ifdef HAVE_STRINGS_H -#include -#endif - -#include -#include - -#ifdef HAVE_DUMBNET_H -#include -#else -#include -#endif - -#include "main/analyzer.h" -#include "decode.h" -#include "snort.h" -#include "snort_debug.h" -#include "util.h" -#include "detect.h" -#include "log_text.h" -#include "generators.h" -#include "packet_io/active.h" -#include "sfxhash.h" -#include "snort_bounds.h" -#include "sf_iph.h" -#include "fpdetect.h" -#include "profiler.h" -#include "mempool/mempool.h" -#include "normalize/normalize.h" -#include "packet_io/sfdaq.h" - -#include "codecs/decode_module.h" -#include "codecs/codec_events.h" - -void decoder_sum() -{ -// sum_stats((PegCount*)&gdc, (PegCount*)&dc, array_size(dc_pegs)); -// memset(&dc, 0, sizeof(dc)); -} - -void decoder_stats() -{ -// show_percent_stats((PegCount*)&gdc, dc_pegs, array_size(dc_pegs), -// "decoder"); -} - - - - - - - - - - -//-------------------------------------------------------------------- -// decode.c::miscellaneous public methods and helper functions -//-------------------------------------------------------------------- - -#if defined(WORDS_MUSTALIGN) && !defined(__GNUC__) -uint32_t EXTRACT_32BITS (u_char *p) -{ - uint32_t __tmp; - - memmove(&__tmp, p, sizeof(uint32_t)); - return (uint32_t) ntohl(__tmp);#endif -} -#endif /* WORDS_MUSTALIGN && !__GNUC__ */ - -static inline void CheckIPv4_MinTTL(Packet *p, uint8_t ttl) -{ - // this sequence of tests is best for the "normal" case where - // the packet ttl is >= the configured min (the default is 1) - if( ttl < ScMinTTL() ) - { - if ( ttl == 0 ) - { - codec_events::exec_ttl_drop(p, DECODE_ZERO_TTL); - } - else - { - codec_events::exec_ttl_drop(p, DECODE_IP4_MIN_TTL); - } - } -} - -static inline void CheckIPv6_MinTTL(Packet *p, uint8_t hop_limit) -{ - // this sequence of tests is best for the "normal" case where - // the packet ttl is >= the configured min (the default is 1) - if( hop_limit < ScMinTTL() ) - { - if ( hop_limit == 0 ) - { - codec_events::exec_hop_drop(p, DECODE_IP6_ZERO_HOP_LIMIT); - } - else - { - codec_events::exec_hop_drop(p, DECODE_IPV6_MIN_TTL); - } - } -} - -/* Decoding of ttl/hop_limit is based on the policy min_ttl */ -void DecodePolicySpecific(Packet *p) -{ - switch(p->outer_family) - { - case AF_INET: - CheckIPv4_MinTTL( p, p->outer_ip4h.ip_ttl); - return; - - case AF_INET6: - CheckIPv6_MinTTL( p, p->outer_ip6h.hop_lmt); - return; - - default: - break; - } - - switch(p->family) - { - case AF_INET: - CheckIPv4_MinTTL( p, p->ip4h->ip_ttl); - return; - - case AF_INET6: - CheckIPv6_MinTTL( p, p->ip6h->hop_lmt); - return; - - default: - break; - } -} - diff --git a/src/codecs/decode.h b/src/codecs/decode.h index 4caec7af3..903007010 100644 --- a/src/codecs/decode.h +++ b/src/codecs/decode.h @@ -29,6 +29,7 @@ #include #include +#include #ifndef WIN32 #include @@ -57,7 +58,7 @@ extern "C" { /* D E F I N E S ************************************************************/ - +#if 0 #define ETH_DSAP_SNA 0x08 /* SNA */ #define ETH_SSAP_SNA 0x00 /* SNA */ #define ETH_DSAP_STP 0x42 /* Spanning Tree Protocol */ @@ -67,8 +68,7 @@ extern "C" { #define ETH_ORG_CODE_ETHR 0x000000 /* Encapsulated Ethernet */ #define ETH_ORG_CODE_CDP 0x00000c /* Cisco Discovery Proto */ - -#define ETHERNET_MAX_LEN_ENCAP 1518 /* 802.3 (+LLC) or ether II ? */ +#endif #define DEFAULT_MPLS_PAYLOADTYPE MPLS_PAYLOADTYPE_IPV4 @@ -77,6 +77,7 @@ extern "C" { #define MAX_PORTS 65536 +#if 0 /* ppp header structure * * Actually, this is the header for RFC1332 Section 3 @@ -98,13 +99,7 @@ struct ppp_header { #define PPP_MTU 1500 #endif -/* enc interface */ -struct enc_header { - uint32_t af; - uint32_t spi; - uint32_t flags; -}; -#define ENC_HEADER_LEN 12 +#endif #define IP_OPTMAX 40 @@ -115,62 +110,36 @@ struct enc_header { - -#define EXTRACT_16BITS(p) ((uint16_t) ntohs (*(uint16_t *)(p))) +static inline uint16_t EXTRACT_16BITS(const uint8_t* p) +{ + return ntohs(*(uint16_t*)(p)); +} #ifdef WORDS_MUSTALIGN #if defined(__GNUC__) /* force word-aligned ntohl parameter */ - #define EXTRACT_32BITS(p) ({ uint32_t __tmp; memmove(&__tmp, (p), sizeof(uint32_t)); (uint32_t) ntohl(__tmp);}) + static inline uint32_t EXTRACT_32BITS(const uint8_t* p) + { + uint32_t tmp; + memmove(&tmp, p, sizeof(uint32_t)); + return ntohl(tmp); + } #endif /* __GNUC__ */ #else /* allows unaligned ntohl parameter - dies w/SIGBUS on SPARCs */ - #define EXTRACT_32BITS(p) ((uint32_t) ntohl (*(uint32_t *)(p))) - -#endif /* WORDS_MUSTALIGN */ - - -/* Default classification for decoder alerts */ -#define DECODE_CLASS 25 + static inline uint32_t EXTRACT_32BITS(const uint8_t* p) + { + return ntohl(*(uint32_t *)p); + } +#endif /* WORDS_MUSTALIGN */ -#define ALERTMSG_LENGTH 256 - -/* P R O T O T Y P E S ******************************************************/ - -// root decoders - -// chained decoders - - -void BsdFragHashInit(int max); -void BsdFragHashCleanup(void); -void BsdFragHashReset(void); - -#if defined(WORDS_MUSTALIGN) && !defined(__GNUC__) -uint32_t EXTRACT_32BITS (u_char *); -#endif /* WORDS_MUSTALIGN && !__GNUC__ */ - -/*Decode functions that need to be called once the policies are set */ -extern void DecodePolicySpecific(Packet *); - -/* XXX not sure where this guy needs to live at the moment */ -#if 0 -typedef struct _PortList -{ - int ports[32]; /* 32 is kind of arbitrary */ - - int num_entries; - -} PortList; -#endif -#define SFTARGET_UNKNOWN_PROTOCOL -1 -void decoder_sum(); -void decoder_stats(); +const unsigned int ALERTMSG_LENGTH = 256; +const int16_t SFTARGET_UNKNOWN_PROTOCOL = -1; diff --git a/src/codecs/decode_module.cc b/src/codecs/decode_module.cc deleted file mode 100644 index 9aff9f20f..000000000 --- a/src/codecs/decode_module.cc +++ /dev/null @@ -1,297 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -// decode_module.cc author Russ Combs - -#include "decode_module.h" -#include "decode.h" -#include "parser/config_file.h" - -//------------------------------------------------------------------------- -// attributes -//------------------------------------------------------------------------- - -// FIXIT some of these could move to nap / decoder / traffic policy -static const Parameter decode_params[] = -{ - { "decode_data_link", Parameter::PT_BOOL, nullptr, "false", - "display the second layer header info" }, - - { "decode_esp", Parameter::PT_BOOL, nullptr, "false", - "enable for inspection of esp traffic that has authentication but not encryption" }, - - { "deep_teredo_inspection", Parameter::PT_BOOL, nullptr, "false", - "look for Teredo on all UDP ports (default is only 3544)" }, - - { "enable_gtp", Parameter::PT_BOOL, nullptr, "false", - "decode GTP encapsulations" }, - - { "enable_mpls_multicast", Parameter::PT_BOOL, nullptr, "false", - "enables support for MPLS multicast" }, - - { "enable_mpls_overlapping_ip", Parameter::PT_BOOL, nullptr, "false", - "enable if private network addresses overlap and must be differentiated by MPLS label(s)" }, - - // FIXIT use PT_BIT_LIST - { "gtp_ports", Parameter::PT_STRING, nullptr, - "'2152 3386'", "set GTP ports" }, - - { "max_mpls_label_chain_len", Parameter::PT_INT, "-1:", "-1", - "set MPLS stack depth" }, - - { "mpls_payload_type", Parameter::PT_ENUM, "eth | ip4 | ip6", "ip4", - "set encapsulated payload type" }, - - { "snap_len", Parameter::PT_INT, "0:65535", "deflt", - "set snap length (same as -P)" }, - - { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } -}; - -//------------------------------------------------------------------------- -// rule msgs -//------------------------------------------------------------------------- - -static const RuleMap decode_rules[] = -{ - { DECODE_NOT_IPV4_DGRAM, "(decode) Not IPv4 datagram" }, - { DECODE_IPV4_INVALID_HEADER_LEN, "(decode) hlen < IP_HEADER_LEN" }, - { DECODE_IPV4_DGRAM_LT_IPHDR, "(decode) IP dgm len < IP Hdr len" }, - { DECODE_IPV4OPT_BADLEN, "(decode) Ipv4 Options found with bad lengths" }, - { DECODE_IPV4OPT_TRUNCATED, "(decode) Truncated Ipv4 Options" }, - { DECODE_IPV4_DGRAM_GT_CAPLEN, "(decode) IP dgm len > captured len" }, - - { DECODE_TCP_DGRAM_LT_TCPHDR, "(decode) TCP packet len is smaller than 20 bytes" }, - { DECODE_TCP_INVALID_OFFSET, "(decode) TCP Data Offset is less than 5" }, - { DECODE_TCP_LARGE_OFFSET, "(decode) TCP Header length exceeds packet length" }, - - { DECODE_TCPOPT_BADLEN, "(decode) Tcp Options found with bad lengths" }, - { DECODE_TCPOPT_TRUNCATED, "(decode) Truncated Tcp Options" }, - { DECODE_TCPOPT_TTCP, "(decode) T/TCP Detected" }, - { DECODE_TCPOPT_OBSOLETE, "(decode) Obsolete TCP Options found" }, - { DECODE_TCPOPT_EXPERIMENTAL, "(decode) Experimental Tcp Options found" }, - { DECODE_TCPOPT_WSCALE_INVALID, "(decode) Tcp Window Scale Option found with length > 14" }, - - { DECODE_UDP_DGRAM_LT_UDPHDR, "(decode) Truncated UDP Header" }, - { DECODE_UDP_DGRAM_INVALID_LENGTH, "(decode) Invalid UDP header, length field < 8" }, - { DECODE_UDP_DGRAM_SHORT_PACKET, "(decode) Short UDP packet, length field > payload length" }, - { DECODE_UDP_DGRAM_LONG_PACKET, "(decode) Long UDP packet, length field < payload length" }, - - { DECODE_ICMP_DGRAM_LT_ICMPHDR, "(decode) ICMP Header Truncated" }, - { DECODE_ICMP_DGRAM_LT_TIMESTAMPHDR, "(decode) ICMP Timestamp Header Truncated" }, - { DECODE_ICMP_DGRAM_LT_ADDRHDR, "(decode) ICMP Address Header Truncated" }, - { DECODE_ARP_TRUNCATED, "(decode) Truncated ARP" }, - { DECODE_EAPOL_TRUNCATED, "(decode) Truncated EAP Header" }, - { DECODE_EAPKEY_TRUNCATED, "(decode) EAP Key Truncated" }, - { DECODE_EAP_TRUNCATED, "(decode) EAP Header Truncated" }, - { DECODE_BAD_PPPOE, "(decode) Bad PPPOE frame detected" }, - { DECODE_BAD_VLAN, "(decode) Bad VLAN Frame" }, - { DECODE_BAD_VLAN_ETHLLC, "(decode) Bad LLC header" }, - { DECODE_BAD_VLAN_OTHER, "(decode) Bad Extra LLC Info" }, - { DECODE_BAD_80211_ETHLLC, "(decode) Bad 802.11 LLC header" }, - { DECODE_BAD_80211_OTHER, "(decode) Bad 802.11 Extra LLC Info" }, - - { DECODE_BAD_TRH, "(decode) Bad Token Ring Header" }, - { DECODE_BAD_TR_ETHLLC, "(decode) Bad Token Ring ETHLLC Header" }, - { DECODE_BAD_TR_MR_LEN, "(decode) Bad Token Ring MRLENHeader" }, - { DECODE_BAD_TRHMR, "(decode) Bad Token Ring MR Header" }, - - { DECODE_BAD_TRAFFIC_LOOPBACK, "(snort decoder) Bad Traffic Loopback IP" }, - { DECODE_BAD_TRAFFIC_SAME_SRCDST, "(snort decoder) Bad Traffic Same Src/Dst IP" }, - - { DECODE_GRE_DGRAM_LT_GREHDR, "(snort decoder) GRE header length > payload length" }, - { DECODE_GRE_MULTIPLE_ENCAPSULATION, "(snort decoder) Multiple encapsulations in packet" }, - { DECODE_GRE_INVALID_VERSION, "(snort decoder) Invalid GRE version" }, - { DECODE_GRE_INVALID_HEADER, "(snort decoder) Invalid GRE header" }, - { DECODE_GRE_V1_INVALID_HEADER, "(snort decoder) Invalid GRE v.1 PPTP header" }, - { DECODE_GRE_TRANS_DGRAM_LT_TRANSHDR, "(snort decoder) GRE Trans header length > payload length" }, - - { DECODE_ICMP_ORIG_IP_TRUNCATED, "(decode) ICMP Original IP Header Truncated" }, - { DECODE_ICMP_ORIG_IP_VER_MISMATCH, "(decode) ICMP version and Original IP Header versions differ" }, - { DECODE_ICMP_ORIG_DGRAM_LT_ORIG_IP, "(decode) ICMP Original Datagram Length < Original IP Header Length" }, - { DECODE_ICMP_ORIG_PAYLOAD_LT_64, "(decode) ICMP Original IP Payload < 64 bits" }, - { DECODE_ICMP_ORIG_PAYLOAD_GT_576, "(decode) ICMP Origianl IP Payload > 576 bytes" }, - { DECODE_ICMP_ORIG_IP_WITH_FRAGOFFSET, "(decode) ICMP Original IP Fragmented and Offset Not 0" }, - - { DECODE_IPV6_MIN_TTL, "(snort decoder) IPv6 packet below TTL limit" }, - { DECODE_IPV6_IS_NOT, "(snort decoder) IPv6 header claims to not be IPv6" }, - { DECODE_IPV6_TRUNCATED_EXT, "(snort decoder) IPV6 truncated extension header" }, - { DECODE_IPV6_TRUNCATED, "(snort decoder) IPV6 truncated header" }, - { DECODE_IPV6_DGRAM_LT_IPHDR, "(decode) IP dgm len < IP Hdr len" }, - { DECODE_IPV6_DGRAM_GT_CAPLEN, "(decode) IP dgm len > captured len" }, - - { DECODE_IPV6_DST_ZERO, "(decode) IPv6 packet with destination address ::0" }, - { DECODE_IPV6_SRC_MULTICAST, "(decode) IPv6 packet with multicast source address" }, - { DECODE_IPV6_DST_RESERVED_MULTICAST, "(decode) IPv6 packet with reserved multicast destination address" }, - { DECODE_IPV6_BAD_OPT_TYPE, "(decode) IPv6 header includes an undefined option type" }, - { DECODE_IPV6_BAD_MULTICAST_SCOPE, "(decode) IPv6 address includes an unassigned multicast scope value" }, - { DECODE_IPV6_BAD_NEXT_HEADER, "(decode) IPv6 header includes an invalid value for the \"next header\" field" }, - { DECODE_IPV6_ROUTE_AND_HOPBYHOP, "(decode) IPv6 header includes a routing extension header followed by a hop-by-hop header" }, - { DECODE_IPV6_TWO_ROUTE_HEADERS, "(decode) IPv6 header includes two routing extension headers" }, - { DECODE_IPV6_DSTOPTS_WITH_ROUTING, "(decode) IPv6 header has destination options followed by a routing header" }, - { DECODE_ICMPV6_TOO_BIG_BAD_MTU, "(decode) ICMPv6 packet of type 2 (message too big) with MTU field < 1280" }, - { DECODE_ICMPV6_UNREACHABLE_NON_RFC_2463_CODE, "(decode) ICMPv6 packet of type 1 (destination unreachable) with non-RFC 2463 code" }, - { DECODE_ICMPV6_SOLICITATION_BAD_CODE, "(decode) ICMPv6 router solicitation packet with a code not equal to 0" }, - { DECODE_ICMPV6_ADVERT_BAD_CODE, "(decode) ICMPv6 router advertisement packet with a code not equal to 0" }, - { DECODE_ICMPV6_SOLICITATION_BAD_RESERVED, "(decode) ICMPv6 router solicitation packet with the reserved field not equal to 0" }, - { DECODE_ICMPV6_ADVERT_BAD_REACHABLE, "(decode) ICMPv6 router advertisement packet with the reachable time field set > 1 hour" }, - - { DECODE_IPV6_TUNNELED_IPV4_TRUNCATED, "(decode) IPV6 tunneled over IPv4, IPv6 header truncated, possible Linux Kernel attack" }, - - { DECODE_IP_MULTIPLE_ENCAPSULATION, "(decode) Two or more IP (v4 and/or v6) encapsulation layers present" }, - - { DECODE_ESP_HEADER_TRUNC, "(decode) truncated Encapsulated Security Payload (ESP) header" }, - - { DECODE_IPV6_BAD_OPT_LEN, "(decode) IPv6 header includes an option which is too big for the containing header" }, - - { DECODE_IPV6_UNORDERED_EXTENSIONS, "(decode) IPv6 packet includes out-of-order extension headers" }, - { DECODE_GTP_MULTIPLE_ENCAPSULATION, "(decode) Two or more GTP encapsulation layers present" }, - { DECODE_GTP_BAD_LEN, "(decode) GTP header length is invalid" }, - { DECODE_TCP_XMAS, "(decode) XMAS Attack Detected" }, - { DECODE_TCP_NMAP_XMAS, "(decode) Nmap XMAS Attack Detected" }, - - { DECODE_DOS_NAPTHA, "(decode) DOS NAPTHA Vulnerability Detected" }, - { DECODE_SYN_TO_MULTICAST, "(decode) Bad Traffic SYN to multicast address" }, - { DECODE_ZERO_TTL, "(decode) IPV4 packet with zero TTL" }, - { DECODE_BAD_FRAGBITS, "(decode) IPV4 packet with bad frag bits (Both MF and DF set)" }, - { DECODE_UDP_IPV6_ZERO_CHECKSUM, "(decode) Invalid IPv6 UDP packet, checksum zero" }, - { DECODE_IP4_LEN_OFFSET, "(decode) IPV4 packet frag offset + length exceed maximum" }, - { DECODE_IP4_SRC_THIS_NET, "(decode) IPV4 packet from 'current net' source address" }, - { DECODE_IP4_DST_THIS_NET, "(decode) IPV4 packet to 'current net' dest address" }, - { DECODE_IP4_SRC_MULTICAST, "(decode) IPV4 packet from multicast source address" }, - { DECODE_IP4_SRC_RESERVED, "(decode) IPV4 packet from reserved source address" }, - { DECODE_IP4_DST_RESERVED, "(decode) IPV4 packet to reserved dest address" }, - { DECODE_IP4_SRC_BROADCAST, "(decode) IPV4 packet from broadcast source address" }, - { DECODE_IP4_DST_BROADCAST, "(decode) IPV4 packet to broadcast dest address" }, - { DECODE_ICMP4_DST_MULTICAST, "(decode) ICMP4 packet to multicast dest address" }, - { DECODE_ICMP4_DST_BROADCAST, "(decode) ICMP4 packet to broadcast dest address" }, - { DECODE_ICMP4_TYPE_OTHER, "(decode) ICMP4 type other" }, - { DECODE_TCP_BAD_URP, "(decode) TCP urgent pointer exceeds payload length or no payload" }, - { DECODE_TCP_SYN_FIN, "(decode) TCP SYN with FIN" }, - { DECODE_TCP_SYN_RST, "(decode) TCP SYN with RST" }, - { DECODE_TCP_MUST_ACK, "(decode) TCP PDU missing ack for established session" }, - { DECODE_TCP_NO_SYN_ACK_RST, "(decode) TCP has no SYN, ACK, or RST" }, - { DECODE_ETH_HDR_TRUNC, "(decode) truncated eth header" }, - { DECODE_IP4_HDR_TRUNC, "(decode) truncated IP4 header" }, - { DECODE_ICMP4_HDR_TRUNC, "(decode) truncated ICMP4 header" }, - { DECODE_ICMP6_HDR_TRUNC, "(decode) truncated ICMP6 header" }, - { DECODE_IP4_MIN_TTL, "(snort decoder) IPV4 packet below TTL limit" }, - { DECODE_IP6_ZERO_HOP_LIMIT, "(snort decoder) IPV6 packet has zero hop limit" }, - { DECODE_IP4_DF_OFFSET, "(decode) IPV4 packet both DF and offset set" }, - { DECODE_ICMP6_TYPE_OTHER, "(decode) ICMP6 type not decoded" }, - { DECODE_ICMP6_DST_MULTICAST, "(decode) ICMP6 packet to multicast address" }, - { DECODE_TCP_SHAFT_SYNFLOOD, "(decode) DDOS shaft synflood" }, - { DECODE_ICMP_PING_NMAP, "(decode) ICMP PING NMAP" }, - { DECODE_ICMP_ICMPENUM, "(decode) ICMP icmpenum v1.1.1" }, - { DECODE_ICMP_REDIRECT_HOST, "(decode) ICMP redirect host" }, - { DECODE_ICMP_REDIRECT_NET, "(decode) ICMP redirect net" }, - { DECODE_ICMP_TRACEROUTE_IPOPTS, "(decode) ICMP traceroute ipopts" }, - { DECODE_ICMP_SOURCE_QUENCH, "(decode) ICMP Source Quench" }, - { DECODE_ICMP_BROADSCAN_SMURF_SCANNER, "(decode) Broadscan Smurf Scanner" }, - { DECODE_ICMP_DST_UNREACH_ADMIN_PROHIBITED, "(decode) ICMP Destination Unreachable Communication Administratively Prohibited" }, - { DECODE_ICMP_DST_UNREACH_DST_HOST_PROHIBITED, "(decode) ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited" }, - { DECODE_ICMP_DST_UNREACH_DST_NET_PROHIBITED, "(decode) ICMP Destination Unreachable Communication with Destination Network is Administratively Prohibited" }, - { DECODE_IP_OPTION_SET, "(decode) MISC IP option set" }, - { DECODE_UDP_LARGE_PACKET, "(decode) MISC Large UDP Packet" }, - { DECODE_TCP_PORT_ZERO, "(decode) BAD-TRAFFIC TCP port 0 traffic" }, - { DECODE_UDP_PORT_ZERO, "(decode) BAD-TRAFFIC UDP port 0 traffic" }, - { DECODE_IP_RESERVED_FRAG_BIT, "(decode) BAD-TRAFFIC IP reserved bit set" }, - { DECODE_IP_UNASSIGNED_PROTO, "(decode) BAD-TRAFFIC Unassigned/Reserved IP protocol" }, - { DECODE_IP_BAD_PROTO, "(decode) BAD-TRAFFIC Bad IP protocol" }, - { DECODE_ICMP_PATH_MTU_DOS, "(decode) ICMP PATH MTU denial of service attempt" }, - { DECODE_ICMP_DOS_ATTEMPT, "(decode) BAD-TRAFFIC linux ICMP header dos attempt" }, - { DECODE_IPV6_ISATAP_SPOOF, "(decode) BAD-TRAFFIC ISATAP-addressed IPv6 traffic spoofing attempt" }, - { DECODE_PGM_NAK_OVERFLOW, "(decode) BAD-TRAFFIC PGM nak list overflow attempt" }, - { DECODE_IGMP_OPTIONS_DOS, "(decode) DOS IGMP IP Options validation attempt" }, - { DECODE_IP6_EXCESS_EXT_HDR, "(decode) too many IP6 extension headers" }, - { DECODE_ICMPV6_UNREACHABLE_NON_RFC_4443_CODE, "(decode) ICMPv6 packet of type 1 (destination unreachable) with non-RFC 4443 code" }, - { DECODE_IPV6_BAD_FRAG_PKT, "(decode) bogus fragmentation packet. Possible BSD attack" }, - { DECODE_ZERO_LENGTH_FRAG, "(decode) fragment with zero length" }, - { DECODE_ICMPV6_NODE_INFO_BAD_CODE, "(decode) ICMPv6 node info query/response packet with a code greater than 2" }, - { DECODE_IPV6_ROUTE_ZERO, "(snort decoder) IPV6 routing type 0 extension header" }, - { DECODE_ERSPAN_HDR_VERSION_MISMATCH, "(decode) ERSpan Header version mismatch" }, - { DECODE_ERSPAN2_DGRAM_LT_HDR, "(decode) captured < ERSpan Type2 Header Length" }, - { DECODE_ERSPAN3_DGRAM_LT_HDR, "(decode) captured < ERSpan Type3 Header Length" }, - - { DECODE_BAD_MPLS, "(decode) Bad MPLS Frame" }, - { DECODE_BAD_MPLS_LABEL0, "(decode) MPLS Label 0 Appears in Nonbottom Header" }, - { DECODE_BAD_MPLS_LABEL1, "(decode) MPLS Label 1 Appears in Bottom Header" }, - { DECODE_BAD_MPLS_LABEL2, "(decode) MPLS Label 2 Appears in Nonbottom Header" }, - { DECODE_BAD_MPLS_LABEL3, "(decode) MPLS Label 3 Appears in Header" }, - { DECODE_MPLS_RESERVED_LABEL, "(decode) MPLS Label 4, 5,.. or 15 Appears in Header" }, - { DECODE_MPLS_LABEL_STACK, "(decode) Too Many MPLS headers" }, - { DECODE_AUTH_HDR_TRUNC, "(decode) Truncated authentication header"}, - { DECODE_AUTH_HDR_BAD_LEN, "(decode) Bad authentication header length"}, - - { 0, nullptr } -}; - -//------------------------------------------------------------------------- -// decode module -//------------------------------------------------------------------------- - -DecodeModule::DecodeModule() : - Module("decode", decode_params, decode_rules) { } - -bool DecodeModule::set(const char*, Value& v, SnortConfig* sc) -{ - if ( v.is("decode_data_link") ) - { - if ( v.get_bool() ) - ConfigDecodeDataLink(sc, ""); - } - else if ( v.is("decode_esp") ) - sc->enable_esp = v.get_bool(); - - else if ( v.is("enable_deep_teredo_inspection") ) - sc->enable_teredo = v.get_long(); // FIXIT move to existing bitfield - - else if ( v.is("enable_gtp") ) - { - if ( v.get_bool() ) - sc->enable_gtp = 1; // FIXIT move to existing bitfield - } - else if ( v.is("enable_mpls_multicast") ) - { - if ( v.get_bool() ) - sc->run_flags |= RUN_FLAG__MPLS_MULTICAST; // FIXIT move to existing bitfield - } - else if ( v.is("enable_mpls_overlapping_ip") ) - { - if ( v.get_bool() ) - sc->run_flags |= RUN_FLAG__MPLS_OVERLAPPING_IP; // FIXIT move to existing bitfield - } - else if ( v.is("gtp_ports") ) - ConfigGTPDecoding(sc, v.get_string()); - - else if ( v.is("max_mpls_label_chain_len") ) - sc->mpls_stack_depth = v.get_long(); - - else if ( v.is("mpls_payload_type") ) - sc->mpls_payload_type = v.get_long() + 1; - - else if ( v.is("snaplen") ) - ConfigPacketSnaplen(sc, v.get_string()); - - else - return false; - - return true; -} - diff --git a/src/codecs/decode_module.h b/src/codecs/decode_module.h index a4b4590aa..ec33535d3 100644 --- a/src/codecs/decode_module.h +++ b/src/codecs/decode_module.h @@ -1,19 +1,19 @@ /* ** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. ** -** This program is free software; you can redistribute it and/or modify +** This program is free software, you can redistribute it and/or modify ** it under the terms of the GNU General Public License Version 2 as ** published by the Free Software Foundation. You may not use, modify or ** distribute this program under any other version of the GNU General ** Public License. ** ** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of +** but WITHOUT ANY WARRANTY, without even the implied warranty of ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ** GNU General Public License for more details. ** ** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software +** along with this program, if not, write to the Free Software ** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */ @@ -24,118 +24,118 @@ #include "framework/module.h" -#define GID_DECODE 116 - -#define DECODE_NOT_IPV4_DGRAM 1 -#define DECODE_IPV4_INVALID_HEADER_LEN 2 -#define DECODE_IPV4_DGRAM_LT_IPHDR 3 -#define DECODE_IPV4OPT_BADLEN 4 -#define DECODE_IPV4OPT_TRUNCATED 5 -#define DECODE_IPV4_DGRAM_GT_CAPLEN 6 - -#define DECODE_TCP_DGRAM_LT_TCPHDR 45 -#define DECODE_TCP_INVALID_OFFSET 46 -#define DECODE_TCP_LARGE_OFFSET 47 - -#define DECODE_TCPOPT_BADLEN 54 -#define DECODE_TCPOPT_TRUNCATED 55 -#define DECODE_TCPOPT_TTCP 56 -#define DECODE_TCPOPT_OBSOLETE 57 -#define DECODE_TCPOPT_EXPERIMENTAL 58 -#define DECODE_TCPOPT_WSCALE_INVALID 59 - -#define DECODE_UDP_DGRAM_LT_UDPHDR 95 -#define DECODE_UDP_DGRAM_INVALID_LENGTH 96 -#define DECODE_UDP_DGRAM_SHORT_PACKET 97 -#define DECODE_UDP_DGRAM_LONG_PACKET 98 - -#define DECODE_ICMP_DGRAM_LT_ICMPHDR 105 -#define DECODE_ICMP_DGRAM_LT_TIMESTAMPHDR 106 -#define DECODE_ICMP_DGRAM_LT_ADDRHDR 107 - -#define DECODE_ARP_TRUNCATED 109 -#define DECODE_EAPOL_TRUNCATED 110 -#define DECODE_EAPKEY_TRUNCATED 111 -#define DECODE_EAP_TRUNCATED 112 - -#define DECODE_BAD_PPPOE 120 -#define DECODE_BAD_VLAN 130 -#define DECODE_BAD_VLAN_ETHLLC 131 -#define DECODE_BAD_VLAN_OTHER 132 -#define DECODE_BAD_80211_ETHLLC 133 -#define DECODE_BAD_80211_OTHER 134 - -#define DECODE_BAD_TRH 140 -#define DECODE_BAD_TR_ETHLLC 141 -#define DECODE_BAD_TR_MR_LEN 142 -#define DECODE_BAD_TRHMR 143 - -#define DECODE_BAD_TRAFFIC_LOOPBACK 150 -#define DECODE_BAD_TRAFFIC_SAME_SRCDST 151 - -#define DECODE_GRE_DGRAM_LT_GREHDR 160 -#define DECODE_GRE_MULTIPLE_ENCAPSULATION 161 -#define DECODE_GRE_INVALID_VERSION 162 -#define DECODE_GRE_INVALID_HEADER 163 -#define DECODE_GRE_V1_INVALID_HEADER 164 -#define DECODE_GRE_TRANS_DGRAM_LT_TRANSHDR 165 - -#define DECODE_BAD_MPLS 170 -#define DECODE_BAD_MPLS_LABEL0 171 -#define DECODE_BAD_MPLS_LABEL1 172 -#define DECODE_BAD_MPLS_LABEL2 173 -#define DECODE_BAD_MPLS_LABEL3 174 -#define DECODE_MPLS_RESERVED_LABEL 175 -#define DECODE_MPLS_LABEL_STACK 176 - -#define DECODE_ICMP_ORIG_IP_TRUNCATED 250 -#define DECODE_ICMP_ORIG_IP_VER_MISMATCH 251 -#define DECODE_ICMP_ORIG_DGRAM_LT_ORIG_IP 252 -#define DECODE_ICMP_ORIG_PAYLOAD_LT_64 253 -#define DECODE_ICMP_ORIG_PAYLOAD_GT_576 254 -#define DECODE_ICMP_ORIG_IP_WITH_FRAGOFFSET 255 - -#define DECODE_IPV6_MIN_TTL 270 -#define DECODE_IPV6_IS_NOT 271 -#define DECODE_IPV6_TRUNCATED_EXT 272 -#define DECODE_IPV6_TRUNCATED 273 -#define DECODE_IPV6_DGRAM_LT_IPHDR 274 -#define DECODE_IPV6_DGRAM_GT_CAPLEN 275 -#define DECODE_IPV6_DST_ZERO 276 -#define DECODE_IPV6_SRC_MULTICAST 277 -#define DECODE_IPV6_DST_RESERVED_MULTICAST 278 -#define DECODE_IPV6_BAD_OPT_TYPE 279 -#define DECODE_IPV6_BAD_MULTICAST_SCOPE 280 -#define DECODE_IPV6_BAD_NEXT_HEADER 281 -#define DECODE_IPV6_ROUTE_AND_HOPBYHOP 282 -#define DECODE_IPV6_TWO_ROUTE_HEADERS 283 - -#define DECODE_ICMPV6_TOO_BIG_BAD_MTU 285 -#define DECODE_ICMPV6_UNREACHABLE_NON_RFC_2463_CODE 286 -#define DECODE_ICMPV6_SOLICITATION_BAD_CODE 287 -#define DECODE_ICMPV6_ADVERT_BAD_CODE 288 -#define DECODE_ICMPV6_SOLICITATION_BAD_RESERVED 289 -#define DECODE_ICMPV6_ADVERT_BAD_REACHABLE 290 - -#define DECODE_IPV6_TUNNELED_IPV4_TRUNCATED 291 -#define DECODE_IPV6_DSTOPTS_WITH_ROUTING 292 -#define DECODE_IP_MULTIPLE_ENCAPSULATION 293 - -#define DECODE_ESP_HEADER_TRUNC 294 -#define DECODE_IPV6_BAD_OPT_LEN 295 -#define DECODE_IPV6_UNORDERED_EXTENSIONS 296 - -#define DECODE_GTP_MULTIPLE_ENCAPSULATION 297 -#define DECODE_GTP_BAD_LEN 298 +const int GID_DECODE = 116; //----------------------------------------------------- // remember to add rules to preproc_rules/decoder.rules // add the new decoder rules to the following enum. -#define DECODE_START_INDEX 400 -enum { - DECODE_TCP_XMAS = DECODE_START_INDEX, +enum CodecSid { + + DECODE_NOT_IPV4_DGRAM = 1, + DECODE_IPV4_INVALID_HEADER_LEN = 2, + DECODE_IPV4_DGRAM_LT_IPHDR = 3, + DECODE_IPV4OPT_BADLEN = 4, + DECODE_IPV4OPT_TRUNCATED = 5, + DECODE_IPV4_DGRAM_GT_CAPLEN = 6, + + DECODE_TCP_DGRAM_LT_TCPHDR = 45, + DECODE_TCP_INVALID_OFFSET = 46, + DECODE_TCP_LARGE_OFFSET = 47, + + DECODE_TCPOPT_BADLEN = 54, + DECODE_TCPOPT_TRUNCATED = 55, + DECODE_TCPOPT_TTCP = 56, + DECODE_TCPOPT_OBSOLETE = 57, + DECODE_TCPOPT_EXPERIMENTAL = 58, + DECODE_TCPOPT_WSCALE_INVALID = 59, + + DECODE_UDP_DGRAM_LT_UDPHDR = 95, + DECODE_UDP_DGRAM_INVALID_LENGTH = 96, + DECODE_UDP_DGRAM_SHORT_PACKET = 97, + DECODE_UDP_DGRAM_LONG_PACKET = 98, + + DECODE_ICMP_DGRAM_LT_ICMPHDR = 105, + DECODE_ICMP_DGRAM_LT_TIMESTAMPHDR = 106, + DECODE_ICMP_DGRAM_LT_ADDRHDR = 107, + + DECODE_ARP_TRUNCATED = 109, + DECODE_EAPOL_TRUNCATED = 110, + DECODE_EAPKEY_TRUNCATED = 111, + DECODE_EAP_TRUNCATED = 112, + + DECODE_BAD_PPPOE = 120, + DECODE_BAD_VLAN = 130, + DECODE_BAD_VLAN_ETHLLC = 131, + DECODE_BAD_VLAN_OTHER = 132, + DECODE_BAD_80211_ETHLLC = 133, + DECODE_BAD_80211_OTHER = 134, + + DECODE_BAD_TRH = 140, + DECODE_BAD_TR_ETHLLC = 141, + DECODE_BAD_TR_MR_LEN = 142, + DECODE_BAD_TRHMR = 143, + + DECODE_BAD_TRAFFIC_LOOPBACK = 150, + DECODE_BAD_TRAFFIC_SAME_SRCDST = 151, + + DECODE_GRE_DGRAM_LT_GREHDR = 160, + DECODE_GRE_MULTIPLE_ENCAPSULATION = 161, + DECODE_GRE_INVALID_VERSION = 162, + DECODE_GRE_INVALID_HEADER = 163, + DECODE_GRE_V1_INVALID_HEADER = 164, + DECODE_GRE_TRANS_DGRAM_LT_TRANSHDR = 165, + + DECODE_BAD_MPLS = 170, + DECODE_BAD_MPLS_LABEL0 = 171, + DECODE_BAD_MPLS_LABEL1 = 172, + DECODE_BAD_MPLS_LABEL2 = 173, + DECODE_BAD_MPLS_LABEL3 = 174, + DECODE_MPLS_RESERVED_LABEL = 175, + DECODE_MPLS_LABEL_STACK = 176, + + DECODE_ICMP_ORIG_IP_TRUNCATED = 250, + DECODE_ICMP_ORIG_IP_VER_MISMATCH = 251, + DECODE_ICMP_ORIG_DGRAM_LT_ORIG_IP = 252, + DECODE_ICMP_ORIG_PAYLOAD_LT_64 = 253, + DECODE_ICMP_ORIG_PAYLOAD_GT_576 = 254, + DECODE_ICMP_ORIG_IP_WITH_FRAGOFFSET = 255, + + DECODE_IPV6_MIN_TTL = 270, + DECODE_IPV6_IS_NOT = 271, + DECODE_IPV6_TRUNCATED_EXT = 272, + DECODE_IPV6_TRUNCATED = 273, + DECODE_IPV6_DGRAM_LT_IPHDR = 274, + DECODE_IPV6_DGRAM_GT_CAPLEN = 275, + DECODE_IPV6_DST_ZERO = 276, + DECODE_IPV6_SRC_MULTICAST = 277, + DECODE_IPV6_DST_RESERVED_MULTICAST = 278, + DECODE_IPV6_BAD_OPT_TYPE = 279, + DECODE_IPV6_BAD_MULTICAST_SCOPE = 280, + DECODE_IPV6_BAD_NEXT_HEADER = 281, + DECODE_IPV6_ROUTE_AND_HOPBYHOP = 282, + DECODE_IPV6_TWO_ROUTE_HEADERS = 283, + + DECODE_ICMPV6_TOO_BIG_BAD_MTU = 285, + DECODE_ICMPV6_UNREACHABLE_NON_RFC_2463_CODE = 286, + DECODE_ICMPV6_SOLICITATION_BAD_CODE = 287, + DECODE_ICMPV6_ADVERT_BAD_CODE = 288, + DECODE_ICMPV6_SOLICITATION_BAD_RESERVED = 289, + DECODE_ICMPV6_ADVERT_BAD_REACHABLE = 290, + + DECODE_IPV6_TUNNELED_IPV4_TRUNCATED = 291, + DECODE_IPV6_DSTOPTS_WITH_ROUTING = 292, + DECODE_IP_MULTIPLE_ENCAPSULATION = 293, + + DECODE_ESP_HEADER_TRUNC = 294, + DECODE_IPV6_BAD_OPT_LEN = 295, + DECODE_IPV6_UNORDERED_EXTENSIONS = 296, + + DECODE_GTP_MULTIPLE_ENCAPSULATION = 297, + DECODE_GTP_BAD_LEN = 298, + + DECODE_TCP_XMAS = 400, DECODE_TCP_NMAP_XMAS, DECODE_DOS_NAPTHA, DECODE_SYN_TO_MULTICAST, @@ -212,8 +212,7 @@ enum { class DecodeModule : public Module { public: - DecodeModule(); - bool set(const char*, Value&, SnortConfig*); + using Module::Module; // inherit Module's constructors unsigned get_gid() const { return GID_DECODE; }; diff --git a/src/codecs/ip/CMakeLists.txt b/src/codecs/ip/CMakeLists.txt index cb6c59538..57e182f90 100644 --- a/src/codecs/ip/CMakeLists.txt +++ b/src/codecs/ip/CMakeLists.txt @@ -4,28 +4,34 @@ if( STATIC_DECODERS ) set( PLUGIN_SOURCES cd_ah.cc + cd_ah_module.h + cd_ah_module.cc cd_dstopts.cc cd_frag.cc cd_gre.cc + cd_gre_module.h + cd_gre_module.cc cd_hopopts.cc cd_igmp.cc - cd_ipv6.cc + cd_igmp_module.h + cd_igmp_module.cc cd_no_next.cc cd_pgm.cc + cd_pgm_module.h + cd_pgm_module.cc cd_routing.cc cd_swipe.cc ) else() - add_shared_library(cd_ah codecs cd_ah.cc) + add_shared_library(cd_ah codecs cd_ah.cc cd_ah_module.h cd_ah_module.cc) add_shared_library(cd_dstopts codecs cd_dstopts.cc) add_shared_library(cd_frag codecs cd_frag.cc) - add_shared_library(cd_gre codecs cd_gre.cc) + add_shared_library(cd_gre codecs cd_gre.cc cd_gre_module.h cd_gre_module.cc) add_shared_library(cd_hopopts codecs cd_hopopts.cc) - add_shared_library(cd_igmp codecs cd_igmp.cc) - add_shared_library(cd_ipv6 codecs cd_ipv6.cc) + add_shared_library(cd_igmp codecs cd_igmp.cc cd_igmp_module.h cd_igmp_module.cc) add_shared_library(cd_no_next codecs cd_no_next.cc) - add_shared_library(cd_pgm codecs cd_pgm.cc) + add_shared_library(cd_pgm codecs cd_pgm.cc cd_pgm_module.h cd_pgm_module.cc) add_shared_library(cd_routing codecs cd_routing.cc) add_shared_library(cd_swipe codecs cd_swipe.cc) @@ -34,12 +40,26 @@ endif() add_library( ip_codecs STATIC cd_icmp4.cc + cd_icmp4_module.h + cd_icmp4_module.cc cd_icmp6.cc + cd_icmp6_module.h + cd_icmp6_module.cc cd_ipv4.cc + cd_ipv4_module.h + cd_ipv4_module.cc cd_ipv6.cc + cd_ipv6_module.h + cd_ipv6_module.cc cd_tcp.cc + cd_tcp_module.h + cd_tcp_module.cc cd_udp.cc + cd_udp_module.h + cd_udp_module.cc cd_esp.cc # statically linked due to its dependance on the packet manager. + cd_esp_module.h + cd_esp_module.cc ${PLUGIN_SOURCES} ) @@ -50,5 +70,3 @@ target_link_libraries( ip_codecs main managers ) - - diff --git a/src/codecs/ip/Makefile.am b/src/codecs/ip/Makefile.am index 2d68a85a2..10f7fc333 100644 --- a/src/codecs/ip/Makefile.am +++ b/src/codecs/ip/Makefile.am @@ -3,25 +3,46 @@ AUTOMAKE_OPTIONS=foreign no-dependencies noinst_LIBRARIES = libip_codecs.a libip_codecs_a_SOURCES = \ -cd_esp.cc \ cd_icmp4.cc \ +cd_icmp4_module.h \ +cd_icmp4_module.cc \ cd_icmp6.cc \ +cd_icmp6_module.h \ +cd_icmp6_module.cc \ cd_ipv4.cc \ +cd_ipv4_module.h \ +cd_ipv4_module.cc \ cd_ipv6.cc \ +cd_ipv6_module.h \ +cd_ipv6_module.cc \ cd_tcp.cc \ -cd_udp.cc +cd_tcp_module.h \ +cd_tcp_module.cc \ +cd_udp.cc \ +cd_udp_module.h \ +cd_udp_module.cc \ +cd_esp.cc \ +cd_esp_module.h \ +cd_esp_module.cc plugin_list = \ cd_ah.cc \ +cd_ah_module.h \ +cd_ah_module.cc \ cd_dstopts.cc \ cd_frag.cc \ cd_gre.cc \ +cd_gre_module.h \ +cd_gre_module.cc \ cd_hopopts.cc \ cd_igmp.cc \ -cd_ipv6.cc \ +cd_igmp_module.h \ +cd_igmp_module.cc \ cd_no_next.cc \ cd_pgm.cc \ +cd_pgm_module.h \ +cd_pgm_module.cc \ cd_routing.cc \ cd_swipe.cc @@ -36,17 +57,24 @@ ehlibdir = $(pkglibdir)/codecs ehlib_LTLIBRARIES = libcd_ah.la libcd_ah_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO libcd_ah_la_LDFLAGS = -export-dynamic -shared -libcd_ah_la_SOURCES = cd_ah.cc +libcd_ah_la_SOURCES = cd_ah.cc cd_ah_module.h cd_ah_module.cc + +ehlib_LTLIBRARIES += libcd_gre.la +libcd_gre_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO +libcd_gre_la_LDFLAGS = -export-dynamic -shared +libcd_gre_la_SOURCES = cd_gre.cc cd_gre_module.h cd_gre_module.cc + +ehlib_LTLIBRARIES += libcd_pgm.la +libcd_pgm_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO +libcd_pgm_la_LDFLAGS = -export-dynamic -shared +libcd_pgm_la_SOURCES = cd_gre.cc cd_pgm_module.h cd_pgm_module.cc # TODO: PUT THESE IN THE LIST #add_shared_library(cd_dstopts codecs cd_dstopts.cc) #add_shared_library(cd_frag codecs cd_frag.cc) -#add_shared_library(cd_gre codecs cd_gre.cc) #add_shared_library(cd_hopopts codecs cd_hopopts.cc) #add_shared_library(cd_igmp codecs cd_igmp.cc) -#add_shared_library(cd_ipv6 codecs cd_ipv6.cc) #add_shared_library(cd_no_next codecs cd_no_next.cc) -#add_shared_library(cd_pgm codecs cd_pgm.cc) #add_shared_library(cd_routing codecs cd_routing.cc) #add_shared_library(cd_swipe codecs cd_swipe.cc) diff --git a/src/codecs/ip/cd_ah.cc b/src/codecs/ip/cd_ah.cc index 4a9893165..72c1aaeac 100644 --- a/src/codecs/ip/cd_ah.cc +++ b/src/codecs/ip/cd_ah.cc @@ -28,6 +28,7 @@ #include "framework/codec.h" #include "codecs/codec_events.h" +#include "codecs/ip/cd_ah_module.h" #include "protocols/protocol_ids.h" #include "protocols/ipv6.h" @@ -37,7 +38,7 @@ namespace class AhCodec : public Codec { public: - AhCodec() : Codec("ah"){}; + AhCodec() : Codec(CD_AH_NAME){}; ~AhCodec(){}; @@ -91,7 +92,17 @@ bool AhCodec::decode(const uint8_t *raw_pkt, const uint32_t len, // api //------------------------------------------------------------------------- -static Codec* ctor() +static Module* mod_ctor() +{ + return new AhModule; +} + +static void mod_dtor(Module* m) +{ + delete m; +} + +static Codec* ctor(Module*) { return new AhCodec(); } @@ -101,16 +112,15 @@ static void dtor(Codec *cd) delete cd; } -static const char* name = "ah"; static const CodecApi ah_api = { { PT_CODEC, - name, + CD_AH_NAME, CDAPI_PLUGIN_V0, 0, - nullptr, - nullptr, + mod_ctor, + mod_dtor, }, nullptr, // pinit nullptr, // pterm diff --git a/src/codecs/ip/cd_ah_module.cc b/src/codecs/ip/cd_ah_module.cc new file mode 100644 index 000000000..fbd507515 --- /dev/null +++ b/src/codecs/ip/cd_ah_module.cc @@ -0,0 +1,48 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// cd_ah_module.cc author Josh Rosenbaum + +#include "codecs/ip/cd_ah_module.h" + + +static const Parameter ah_params[] = +{ + { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } +}; + + +static const RuleMap ah_rules[] = +{ + { DECODE_AUTH_HDR_TRUNC, "(" CD_AH_NAME ") Truncated authentication header"}, + { DECODE_AUTH_HDR_BAD_LEN, "(" CD_AH_NAME ") Bad authentication header length"}, + { 0, nullptr } +}; + +//------------------------------------------------------------------------- +// rpc module +//------------------------------------------------------------------------- + +AhModule::AhModule() : DecodeModule(CD_AH_NAME, ah_params, ah_rules) +{ } + +bool AhModule::set(const char*, Value&, SnortConfig*) +{ + return true; +} diff --git a/src/codecs/ip/cd_ah_module.h b/src/codecs/ip/cd_ah_module.h new file mode 100644 index 000000000..41d124917 --- /dev/null +++ b/src/codecs/ip/cd_ah_module.h @@ -0,0 +1,38 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// cd_ah_module.h author Josh Rosenbaum + +#ifndef CD_AH_MODULE_H +#define CD_AH_MODULE_H + +#include "codecs/decode_module.h" + + +#define CD_AH_NAME "codec_ah" + +class AhModule : public DecodeModule +{ +public: + AhModule(); + + bool set(const char*, Value&, SnortConfig*); +}; + +#endif diff --git a/src/codecs/ip/cd_dstopts.cc b/src/codecs/ip/cd_dstopts.cc index 4f597c004..1afc4d9ff 100644 --- a/src/codecs/ip/cd_dstopts.cc +++ b/src/codecs/ip/cd_dstopts.cc @@ -37,10 +37,12 @@ namespace { +#define CD_DSTOPTS_NAME "codec_ipv6_dstopts" + class Ipv6DSTOptsCodec : public Codec { public: - Ipv6DSTOptsCodec() : Codec("ipv6_dstopts"){}; + Ipv6DSTOptsCodec() : Codec(CD_DSTOPTS_NAME){}; ~Ipv6DSTOptsCodec() {}; @@ -124,7 +126,7 @@ bool Ipv6DSTOptsCodec::update(Packet* p, Layer* lyr, uint32_t* len) // api //------------------------------------------------------------------------- -static Codec* ctor() +static Codec* ctor(Module*) { return new Ipv6DSTOptsCodec(); } @@ -134,13 +136,11 @@ static void dtor(Codec *cd) delete cd; } -static const char* name = "ipv6_dstopts"; - static const CodecApi ipv6_dstopts_api = { { PT_CODEC, - name, + CD_DSTOPTS_NAME, CDAPI_PLUGIN_V0, 0, nullptr, diff --git a/src/codecs/ip/cd_esp.cc b/src/codecs/ip/cd_esp.cc index 040e9c694..12b4c16da 100644 --- a/src/codecs/ip/cd_esp.cc +++ b/src/codecs/ip/cd_esp.cc @@ -27,7 +27,7 @@ #include "framework/codec.h" #include "snort.h" -#include "codecs/decode_module.h" +#include "codecs/ip/cd_esp_module.h" #include "managers/packet_manager.h" #include "codecs/codec_events.h" #include "protocols/protocol_ids.h" @@ -38,7 +38,7 @@ namespace class EspCodec : public Codec { public: - EspCodec() : Codec("esp"){}; + EspCodec() : Codec(CD_ESP_NAME){}; ~EspCodec(){}; @@ -145,7 +145,22 @@ bool EspCodec::decode(const uint8_t *raw_pkt, const uint32_t len, return true; } -static Codec* ctor() + +//------------------------------------------------------------------------- +// api +//------------------------------------------------------------------------- + +static Module* mod_ctor() +{ + return new EspModule; +} + +static void mod_dtor(Module* m) +{ + delete m; +} + +static Codec* ctor(Module*) { return new EspCodec(); } @@ -155,21 +170,20 @@ static void dtor(Codec *cd) delete cd; } -static const char* name = "esp"; static const CodecApi esp_api = { - { + { PT_CODEC, - name, + CD_ESP_NAME, CDAPI_PLUGIN_V0, 0, - nullptr, - nullptr, + mod_ctor, + mod_dtor, }, - NULL, // pinit - NULL, // pterm - NULL, // tinit - NULL, // tterm + nullptr, // pinit + nullptr, // pterm + nullptr, // tinit + nullptr, // tterm ctor, // ctor dtor, // dtor }; diff --git a/src/codecs/ip/cd_esp_module.cc b/src/codecs/ip/cd_esp_module.cc new file mode 100644 index 000000000..0ab0e7eff --- /dev/null +++ b/src/codecs/ip/cd_esp_module.cc @@ -0,0 +1,61 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// cd_esp_module.cc author Josh Rosenbaum + +#include "codecs/ip/cd_esp_module.h" +#include "main/snort_config.h" + + +static const Parameter esp_params[] = +{ + { "decode_esp", Parameter::PT_BOOL, nullptr, "false", + "enable for inspection of esp traffic that has authentication but not encryption" }, + + { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } +}; + + +// rules which will loaded into snort. +// You can now reference these rules by calling a codec_event +// in your main codec's functions +static const RuleMap esp_rules[] = +{ + { DECODE_ESP_HEADER_TRUNC, "(" CD_ESP_NAME ") truncated Encapsulated Security Payload (ESP) header" }, + { 0, nullptr } +}; + +//------------------------------------------------------------------------- +// rpc module +//------------------------------------------------------------------------- + +EspModule::EspModule() : DecodeModule(CD_ESP_NAME, esp_params, esp_rules) +{ } + +bool EspModule::set(const char*, Value& v, SnortConfig* sc) +{ + if ( v.is("decode_esp") ) + sc->enable_esp = v.get_bool(); + else + return false; + + return true; +} + + diff --git a/src/codecs/ip/cd_esp_module.h b/src/codecs/ip/cd_esp_module.h new file mode 100644 index 000000000..96a98f4be --- /dev/null +++ b/src/codecs/ip/cd_esp_module.h @@ -0,0 +1,39 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// cd_esp_module.h author Josh Rosenbaum + +#ifndef CD_ESP_MODULE_H +#define CD_ESP_MODULE_H + +#include "codecs/decode_module.h" + + +#define CD_ESP_NAME "codec_esp" + +class EspModule : public DecodeModule +{ +public: + EspModule(); + + bool set(const char*, Value&, SnortConfig*); +}; + +#endif + diff --git a/src/codecs/ip/cd_frag.cc b/src/codecs/ip/cd_frag.cc index 7580553af..922ccfe3f 100644 --- a/src/codecs/ip/cd_frag.cc +++ b/src/codecs/ip/cd_frag.cc @@ -38,10 +38,12 @@ namespace { +#define CD_IPV6_FRAG_NAME "codec_ipv6_frag" + class Ipv6FragCodec : public Codec { public: - Ipv6FragCodec() : Codec("ipv6_frag"){}; + Ipv6FragCodec() : Codec(CD_IPV6_FRAG_NAME){}; ~Ipv6FragCodec() {}; @@ -148,7 +150,7 @@ void Ipv6FragCodec::get_protocol_ids(std::vector& v) // api //------------------------------------------------------------------------- -static Codec* ctor() +static Codec* ctor(Module*) { return new Ipv6FragCodec(); } @@ -158,14 +160,12 @@ static void dtor(Codec *cd) delete cd; } - -static const char* name = "ipv6_frag"; static const CodecApi ipv6_frag_api = { - { - PT_CODEC, - name, - CDAPI_PLUGIN_V0, + { + PT_CODEC, + CD_IPV6_FRAG_NAME, + CDAPI_PLUGIN_V0, 0, nullptr, nullptr, diff --git a/src/codecs/ip/cd_gre.cc b/src/codecs/ip/cd_gre.cc index c4aaeb1d9..1eb2a2c2d 100644 --- a/src/codecs/ip/cd_gre.cc +++ b/src/codecs/ip/cd_gre.cc @@ -21,10 +21,9 @@ #include "framework/codec.h" -#include "codecs/decode_module.h" +#include "codecs/ip/cd_gre_module.h" #include "codecs/codec_events.h" #include "protocols/packet.h" - #include "protocols/protocol_ids.h" namespace @@ -33,7 +32,7 @@ namespace class GreCodec : public Codec { public: - GreCodec() : Codec("gre"){}; + GreCodec() : Codec(CD_GRE_NAME){}; ~GreCodec(){}; @@ -160,7 +159,6 @@ bool GreCodec::decode(const uint8_t *raw_pkt, const uint32_t len, sre_addrfamily = ntohs(*((uint16_t *)sre_ptr)); sre_ptr += sizeof(sre_addrfamily); -// sre_offset = *((uint8_t *)sre_ptr); sre_ptr += sizeof(sre_offset); sre_length = *((uint8_t *)sre_ptr); @@ -244,8 +242,17 @@ void GreCodec::format (EncodeFlags, const Packet*, Packet* c, Layer* lyr) // api //------------------------------------------------------------------------- +static Module* mod_ctor() +{ + return new GreModule; +} + +static void mod_dtor(Module* m) +{ + delete m; +} -static Codec* ctor() +static Codec* ctor(Module*) { return new GreCodec(); } @@ -255,16 +262,15 @@ static void dtor(Codec *cd) delete cd; } -static const char* name = "gre"; static const CodecApi gre_api = { { PT_CODEC, - name, + CD_GRE_NAME, CDAPI_PLUGIN_V0, 0, - nullptr, - nullptr, + mod_ctor, + mod_dtor, }, nullptr, // pinit nullptr, // pterm diff --git a/src/codecs/ip/cd_gre_module.cc b/src/codecs/ip/cd_gre_module.cc new file mode 100644 index 000000000..42a48150a --- /dev/null +++ b/src/codecs/ip/cd_gre_module.cc @@ -0,0 +1,52 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// cd_gre_module.cc author Josh Rosenbaum + +#include "codecs/ip/cd_gre_module.h" + + +static const Parameter gre_params[] = +{ + { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } +}; + + +static const RuleMap gre_rules[] = +{ + { DECODE_GRE_DGRAM_LT_GREHDR, "(" CD_GRE_NAME ") GRE header length > payload length" }, + { DECODE_GRE_MULTIPLE_ENCAPSULATION, "(" CD_GRE_NAME ") Multiple encapsulations in packet" }, + { DECODE_GRE_INVALID_VERSION, "(" CD_GRE_NAME ") Invalid GRE version" }, + { DECODE_GRE_INVALID_HEADER, "(" CD_GRE_NAME ") Invalid GRE header" }, + { DECODE_GRE_V1_INVALID_HEADER, "(" CD_GRE_NAME ") Invalid GRE v.1 PPTP header" }, + { DECODE_GRE_TRANS_DGRAM_LT_TRANSHDR, "(" CD_GRE_NAME ") GRE Trans header length > payload length" }, + { 0, nullptr } +}; + +//------------------------------------------------------------------------- +// rpc module +//------------------------------------------------------------------------- + +GreModule::GreModule() : DecodeModule(CD_GRE_NAME, gre_params, gre_rules) +{ } + +bool GreModule::set(const char*, Value&, SnortConfig*) +{ + return true; +} diff --git a/src/codecs/ip/cd_gre_module.h b/src/codecs/ip/cd_gre_module.h new file mode 100644 index 000000000..626d36cce --- /dev/null +++ b/src/codecs/ip/cd_gre_module.h @@ -0,0 +1,38 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// cd_gre_module.h author Josh Rosenbaum + +#ifndef CD_GRE_MODULE_H +#define CD_GRE_MODULE_H + +#include "codecs/decode_module.h" + + +#define CD_GRE_NAME "codec_gre" + +class GreModule : public DecodeModule +{ +public: + GreModule(); + + bool set(const char*, Value&, SnortConfig*); +}; + +#endif diff --git a/src/codecs/ip/cd_hopopts.cc b/src/codecs/ip/cd_hopopts.cc index 057233f9d..00da7c2f4 100644 --- a/src/codecs/ip/cd_hopopts.cc +++ b/src/codecs/ip/cd_hopopts.cc @@ -36,10 +36,12 @@ namespace { +#define CD_HOPOPTS_NAME "codec_ipv6_hopopts" + class Ipv6HopOptsCodec : public Codec { public: - Ipv6HopOptsCodec() : Codec("ipv6_hopopts") {}; + Ipv6HopOptsCodec() : Codec(CD_HOPOPTS_NAME) {}; ~Ipv6HopOptsCodec() {}; virtual void get_protocol_ids(std::vector& v); @@ -61,8 +63,6 @@ struct IP6HopByHop } // anonymous namespace - - /* * Class functions */ @@ -122,8 +122,7 @@ bool Ipv6HopOptsCodec::update(Packet* p, Layer* lyr, uint32_t* len) // api //------------------------------------------------------------------------- - -static Codec* ctor() +static Codec* ctor(Module*) { return new Ipv6HopOptsCodec(); } @@ -133,14 +132,12 @@ static void dtor(Codec *cd) delete cd; } -static const char* name = "ipv6_hopopts"; - static const CodecApi ipv6_hopopts_api = { - { - PT_CODEC, - name, - CDAPI_PLUGIN_V0, + { + PT_CODEC, + CD_HOPOPTS_NAME, + CDAPI_PLUGIN_V0, 0, nullptr, nullptr, diff --git a/src/codecs/ip/cd_icmp4.cc b/src/codecs/ip/cd_icmp4.cc index 29cd54c83..a83521ca7 100644 --- a/src/codecs/ip/cd_icmp4.cc +++ b/src/codecs/ip/cd_icmp4.cc @@ -33,11 +33,11 @@ #include "framework/codec.h" #include "snort.h" -#include "codecs/decode_module.h" #include "protocols/icmp4.h" #include "codecs/codec_events.h" #include "codecs/checksum.h" #include "protocols/protocol_ids.h" +#include "codecs/ip/cd_icmp4_module.h" namespace{ @@ -46,7 +46,7 @@ namespace{ class Icmp4Codec : public Codec{ public: - Icmp4Codec() : Codec("icmp4"){}; + Icmp4Codec() : Codec(CD_ICMP4_NAME){}; ~Icmp4Codec() {}; virtual void get_protocol_ids(std::vector&); @@ -178,7 +178,6 @@ bool Icmp4Codec::decode(const uint8_t* raw_pkt, const uint32_t raw_len, p->error_flags |= PKT_ERR_CKSUM_ICMP; DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Bad ICMP Checksum\n");); codec_events::exec_icmp_chksm_drop(p); -// dc.invalid_checksums++; } else { @@ -530,7 +529,18 @@ void Icmp4Codec::format(EncodeFlags, const Packet*, Packet* c, Layer* lyr) // api //------------------------------------------------------------------------- -static Codec *ctor() + +static Module* mod_ctor() +{ + return new Icmp4Module; +} + +static void mod_dtor(Module* m) +{ + delete m; +} + +static Codec *ctor(Module*) { return new Icmp4Codec(); } @@ -540,21 +550,20 @@ static void dtor(Codec *cd) delete cd; } -static const char* name = "icmp4"; static const CodecApi icmp4_api = { - { + { PT_CODEC, - name, + CD_ICMP4_NAME, CDAPI_PLUGIN_V0, 0, - nullptr, - nullptr + mod_ctor, + mod_dtor }, - NULL, // pinit - NULL, // pterm - NULL, // tinit - NULL, // tterm + nullptr, // pinit + nullptr, // pterm + nullptr, // tinit + nullptr, // tterm ctor, // ctor dtor, // dtor }; diff --git a/src/codecs/ip/cd_icmp4_module.cc b/src/codecs/ip/cd_icmp4_module.cc new file mode 100644 index 000000000..f65b5e677 --- /dev/null +++ b/src/codecs/ip/cd_icmp4_module.cc @@ -0,0 +1,74 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// cd_icmp4_module.cc author Josh Rosenbaum + +#include "codecs/ip/cd_icmp4_module.h" + + +static const Parameter icmp4_params[] = +{ + { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } +}; + + +// rules which will loaded into snort. +// You can now reference these rules by calling a codec_event +// in your main codec's functions +static const RuleMap icmp4_rules[] = +{ + { DECODE_ICMP_DGRAM_LT_ICMPHDR, "(" CD_ICMP4_NAME ") ICMP Header Truncated" }, + { DECODE_ICMP_DGRAM_LT_TIMESTAMPHDR, "(" CD_ICMP4_NAME ") ICMP Timestamp Header Truncated" }, + { DECODE_ICMP_DGRAM_LT_ADDRHDR, "(" CD_ICMP4_NAME ") ICMP Address Header Truncated" }, + { DECODE_ICMP_ORIG_IP_TRUNCATED, "(" CD_ICMP4_NAME ") ICMP Original IP Header Truncated" }, + { DECODE_ICMP_ORIG_IP_VER_MISMATCH, "(" CD_ICMP4_NAME ") ICMP version and Original IP Header versions differ" }, + { DECODE_ICMP_ORIG_DGRAM_LT_ORIG_IP, "(" CD_ICMP4_NAME ") ICMP Original Datagram Length < Original IP Header Length" }, + { DECODE_ICMP_ORIG_PAYLOAD_LT_64, "(" CD_ICMP4_NAME ") ICMP Original IP Payload < 64 bits" }, + { DECODE_ICMP_ORIG_PAYLOAD_GT_576, "(" CD_ICMP4_NAME ") ICMP Origianl IP Payload > 576 bytes" }, + { DECODE_ICMP_ORIG_IP_WITH_FRAGOFFSET, "(" CD_ICMP4_NAME ") ICMP Original IP Fragmented and Offset Not 0" }, + { DECODE_ICMP4_DST_MULTICAST, "(" CD_ICMP4_NAME ") ICMP4 packet to multicast dest address" }, + { DECODE_ICMP4_DST_BROADCAST, "(" CD_ICMP4_NAME ") ICMP4 packet to broadcast dest address" }, + { DECODE_ICMP4_TYPE_OTHER, "(" CD_ICMP4_NAME ") ICMP4 type other" }, + { DECODE_ICMP_PING_NMAP, "(" CD_ICMP4_NAME ") ICMP PING NMAP" }, + { DECODE_ICMP_ICMPENUM, "(" CD_ICMP4_NAME ") ICMP icmpenum v1.1.1" }, + { DECODE_ICMP_REDIRECT_HOST, "(" CD_ICMP4_NAME ") ICMP redirect host" }, + { DECODE_ICMP_REDIRECT_NET, "(" CD_ICMP4_NAME ") ICMP redirect net" }, + { DECODE_ICMP_TRACEROUTE_IPOPTS, "(" CD_ICMP4_NAME ") ICMP traceroute ipopts" }, + { DECODE_ICMP_SOURCE_QUENCH, "(" CD_ICMP4_NAME ") ICMP Source Quench" }, + { DECODE_ICMP_BROADSCAN_SMURF_SCANNER, "(" CD_ICMP4_NAME ") Broadscan Smurf Scanner" }, + { DECODE_ICMP_DST_UNREACH_ADMIN_PROHIBITED, "(" CD_ICMP4_NAME ") ICMP Destination Unreachable Communication Administratively Prohibited" }, + { DECODE_ICMP_DST_UNREACH_DST_HOST_PROHIBITED, "(" CD_ICMP4_NAME ") ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited" }, + { DECODE_ICMP_DST_UNREACH_DST_NET_PROHIBITED, "(" CD_ICMP4_NAME ") ICMP Destination Unreachable Communication with Destination Network is Administratively Prohibited" }, + { DECODE_ICMP_PATH_MTU_DOS, "(" CD_ICMP4_NAME ") ICMP PATH MTU denial of service attempt" }, + { DECODE_ICMP_DOS_ATTEMPT, "(" CD_ICMP4_NAME ") BAD-TRAFFIC linux ICMP header dos attempt" }, + { DECODE_ICMP4_HDR_TRUNC, "(" CD_ICMP4_NAME ") truncated ICMP4 header" }, + { 0, nullptr } +}; + +//------------------------------------------------------------------------- +// rpc module +//------------------------------------------------------------------------- + +Icmp4Module::Icmp4Module() : DecodeModule(CD_ICMP4_NAME, icmp4_params, icmp4_rules) +{ } + +bool Icmp4Module::set(const char*, Value&, SnortConfig*) +{ + return true; +} diff --git a/src/codecs/ip/cd_icmp4_module.h b/src/codecs/ip/cd_icmp4_module.h new file mode 100644 index 000000000..1f4e3bf79 --- /dev/null +++ b/src/codecs/ip/cd_icmp4_module.h @@ -0,0 +1,39 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// cd_icmp4_module.h author Josh Rosenbaum + +#ifndef CD_ICMP4_MODULE_H +#define CD_ICMP4_MODULE_H + +#include "codecs/decode_module.h" + + +#define CD_ICMP4_NAME "codec_icmp4" + +class Icmp4Module : public DecodeModule +{ +public: + Icmp4Module(); + + bool set(const char*, Value&, SnortConfig*); +}; + +#endif + diff --git a/src/codecs/ip/cd_icmp6.cc b/src/codecs/ip/cd_icmp6.cc index 6518a7312..e08a03f46 100644 --- a/src/codecs/ip/cd_icmp6.cc +++ b/src/codecs/ip/cd_icmp6.cc @@ -33,6 +33,7 @@ #include "protocols/icmp6.h" #include "protocols/icmp4.h" +#include "codecs/ip/cd_icmp6_module.h" namespace @@ -41,7 +42,7 @@ namespace class Icmp6Codec : public Codec { public: - Icmp6Codec() : Codec("icmp6"){}; + Icmp6Codec() : Codec(CD_ICMP6_NAME){}; ~Icmp6Codec(){}; @@ -124,7 +125,6 @@ bool Icmp6Codec::decode(const uint8_t* raw_pkt, const uint32_t len, p->error_flags |= PKT_ERR_CKSUM_ICMP; DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Bad ICMP Checksum\n");); codec_events::exec_icmp_chksm_drop(p); -// dc.invalid_checksums++; } else { @@ -162,14 +162,11 @@ bool Icmp6Codec::decode(const uint8_t* raw_pkt, const uint32_t len, p->icmph = NULL; p->icmp6h = NULL; -// dc.discards++; -// dc.icmpdisc++; return false; } break; case ICMP6_BIG: -// case icmp6::Icmp6Types::BIG: --> naming conflict with a different macro in byte_exter.h if (p->dsize >= sizeof(ICMP6TooBig)) { ICMP6TooBig *too_big = (ICMP6TooBig *)raw_pkt; @@ -193,8 +190,6 @@ bool Icmp6Codec::decode(const uint8_t* raw_pkt, const uint32_t len, p->icmph = NULL; p->icmp6h = NULL; -// dc.discards++; -// dc.icmpdisc++; return false; } break; @@ -231,8 +226,6 @@ bool Icmp6Codec::decode(const uint8_t* raw_pkt, const uint32_t len, p->icmph = NULL; p->icmp6h = NULL; -// dc.discards++; -// dc.icmpdisc++; return false; } break; @@ -260,8 +253,6 @@ bool Icmp6Codec::decode(const uint8_t* raw_pkt, const uint32_t len, p->icmph = NULL; p->icmp6h = NULL; -// dc.discards++; -// dc.icmpdisc++; return false; } break; @@ -289,8 +280,6 @@ bool Icmp6Codec::decode(const uint8_t* raw_pkt, const uint32_t len, p->icmph = NULL; p->icmp6h = NULL; -// dc.discards++; -// dc.icmpdisc++; return false; } break; @@ -318,8 +307,6 @@ bool Icmp6Codec::decode(const uint8_t* raw_pkt, const uint32_t len, p->icmph = NULL; p->icmp6h = NULL; -// dc.discards++; -// dc.icmpdisc++; return false; } break; @@ -357,7 +344,6 @@ static void DecodeICMPEmbeddedIP6(const uint8_t *pkt, const uint32_t len, Packet /* lay the IP struct over the raw data */ ipv6::IP6RawHdr* hdr = (ipv6::IP6RawHdr*)pkt; -// dc.embdip++; DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "DecodeICMPEmbeddedIP6: ip header" " starts at: %p, length is %lu\n", hdr, @@ -371,7 +357,6 @@ static void DecodeICMPEmbeddedIP6(const uint8_t *pkt, const uint32_t len, Packet codec_events::decoder_event(p, DECODE_ICMP_ORIG_IP_TRUNCATED); -// dc.discards++; return; } @@ -387,7 +372,6 @@ static void DecodeICMPEmbeddedIP6(const uint8_t *pkt, const uint32_t len, Packet codec_events::decoder_event(p, DECODE_ICMP_ORIG_IP_VER_MISMATCH); -// dc.discards++; return; } @@ -399,7 +383,6 @@ static void DecodeICMPEmbeddedIP6(const uint8_t *pkt, const uint32_t len, Packet codec_events::decoder_event(p, DECODE_ICMP_ORIG_DGRAM_LT_ORIG_IP); -// dc.discards++; return; } sfiph_orig_build(p, pkt, AF_INET6); @@ -638,8 +621,17 @@ static unsigned short in_chksum_icmp6(pseudoheader6 *ph, // api //------------------------------------------------------------------------- +static Module* mod_ctor() +{ + return new Icmp6Module; +} + +static void mod_dtor(Module* m) +{ + delete m; +} -static Codec* ctor() +static Codec* ctor(Module*) { return new Icmp6Codec(); } @@ -649,22 +641,20 @@ static void dtor(Codec *cd) delete cd; } -static const char* name = "icmp6"; - static const CodecApi ipv6_api = { { PT_CODEC, - name, + CD_ICMP6_NAME, CDAPI_PLUGIN_V0, 0, - nullptr, - nullptr, + mod_ctor, + mod_dtor, }, - NULL, // pinit - NULL, // pterm - NULL, // tinit - NULL, // tterm + nullptr, // pinit + nullptr, // pterm + nullptr, // tinit + nullptr, // tterm ctor, // ctor dtor, // dtor }; diff --git a/src/codecs/ip/cd_icmp6_module.cc b/src/codecs/ip/cd_icmp6_module.cc new file mode 100644 index 000000000..7387d95e3 --- /dev/null +++ b/src/codecs/ip/cd_icmp6_module.cc @@ -0,0 +1,60 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// cd_icmp6_module.cc author Josh Rosenbaum + +#include "codecs/ip/cd_icmp6_module.h" + + +static const Parameter icmp6_params[] = +{ + { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } +}; + + +// rules which will loaded into snort. +// You can now reference these rules by calling a codec_event +// in your main codec's functions +static const RuleMap icmp6_rules[] = +{ + { DECODE_ICMP6_HDR_TRUNC, "(" CD_ICMP6_NAME ") truncated ICMP6 header" }, + { DECODE_ICMP6_TYPE_OTHER, "(" CD_ICMP6_NAME ") ICMP6 type not decoded" }, + { DECODE_ICMP6_DST_MULTICAST, "(" CD_ICMP6_NAME ") ICMP6 packet to multicast address" }, + { DECODE_ICMPV6_TOO_BIG_BAD_MTU, "(" CD_ICMP6_NAME ") ICMPv6 packet of type 2 (message too big) with MTU field < 1280" }, + { DECODE_ICMPV6_UNREACHABLE_NON_RFC_2463_CODE, "(" CD_ICMP6_NAME ") ICMPv6 packet of type 1 (destination unreachable) with non-RFC 2463 code" }, + { DECODE_ICMPV6_SOLICITATION_BAD_CODE, "(" CD_ICMP6_NAME ") ICMPv6 router solicitation packet with a code not equal to 0" }, + { DECODE_ICMPV6_ADVERT_BAD_CODE, "(" CD_ICMP6_NAME ") ICMPv6 router advertisement packet with a code not equal to 0" }, + { DECODE_ICMPV6_SOLICITATION_BAD_RESERVED, "(" CD_ICMP6_NAME ") ICMPv6 router solicitation packet with the reserved field not equal to 0" }, + { DECODE_ICMPV6_ADVERT_BAD_REACHABLE, "(" CD_ICMP6_NAME ") ICMPv6 router advertisement packet with the reachable time field set > 1 hour" }, + { DECODE_ICMPV6_UNREACHABLE_NON_RFC_4443_CODE, "(" CD_ICMP6_NAME ") ICMPv6 packet of type 1 (destination unreachable) with non-RFC 4443 code" }, + { DECODE_ICMPV6_NODE_INFO_BAD_CODE, "(" CD_ICMP6_NAME ") ICMPv6 node info query/response packet with a code greater than 2" }, + { 0, nullptr } +}; + +//------------------------------------------------------------------------- +// rpc module +//------------------------------------------------------------------------- + +Icmp6Module::Icmp6Module() : DecodeModule(CD_ICMP6_NAME, icmp6_params, icmp6_rules) +{ } + +bool Icmp6Module::set(const char*, Value&, SnortConfig*) +{ + return true; +} diff --git a/src/codecs/ip/cd_icmp6_module.h b/src/codecs/ip/cd_icmp6_module.h new file mode 100644 index 000000000..42794601c --- /dev/null +++ b/src/codecs/ip/cd_icmp6_module.h @@ -0,0 +1,38 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// cd_icmp6_module.h author Josh Rosenbaum + +#ifndef CD_ICMP6_MODULE_H +#define CD_ICMP6_MODULE_H + +#include "codecs/decode_module.h" + + +#define CD_ICMP6_NAME "codec_icmp6" + +class Icmp6Module : public DecodeModule +{ +public: + Icmp6Module(); + + bool set(const char*, Value&, SnortConfig*); +}; + +#endif diff --git a/src/codecs/ip/cd_igmp.cc b/src/codecs/ip/cd_igmp.cc index e60324640..73071d8e2 100644 --- a/src/codecs/ip/cd_igmp.cc +++ b/src/codecs/ip/cd_igmp.cc @@ -25,7 +25,7 @@ #endif #include "framework/codec.h" -#include "codecs/decode_module.h" +#include "codecs/ip/cd_igmp_module.h" #include "codecs/codec_events.h" @@ -35,7 +35,7 @@ namespace class IgmpCodec : public Codec { public: - IgmpCodec() : Codec("igmp"){}; + IgmpCodec() : Codec(CD_IGMP_NAME){}; ~IgmpCodec() {}; @@ -100,7 +100,17 @@ void IgmpCodec::get_protocol_ids(std::vector& v) // api //------------------------------------------------------------------------- -static Codec* ctor() +static Module* mod_ctor() +{ + return new IgmpModule; +} + +static void mod_dtor(Module* m) +{ + delete m; +} + +static Codec* ctor(Module*) { return new IgmpCodec(); } @@ -110,17 +120,15 @@ static void dtor(Codec *cd) delete cd; } - -static const char* name = "igmp"; static const CodecApi igmp_api = { - { - PT_CODEC, - name, - CDAPI_PLUGIN_V0, + { + PT_CODEC, + CD_IGMP_NAME, + CDAPI_PLUGIN_V0, 0, - nullptr, - nullptr, + mod_ctor, + mod_dtor, }, nullptr, // pinit nullptr, // pterm diff --git a/src/codecs/ip/cd_igmp_module.cc b/src/codecs/ip/cd_igmp_module.cc new file mode 100644 index 000000000..508bae55a --- /dev/null +++ b/src/codecs/ip/cd_igmp_module.cc @@ -0,0 +1,47 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// cd_igmp_module.cc author Josh Rosenbaum + +#include "codecs/ip/cd_igmp_module.h" + + +static const Parameter igmp_params[] = +{ + { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } +}; + + +static const RuleMap igmp_rules[] = +{ + { DECODE_IGMP_OPTIONS_DOS, "(" CD_IGMP_NAME ") DOS IGMP IP Options validation attempt" }, + { 0, nullptr } +}; + +//------------------------------------------------------------------------- +// rpc module +//------------------------------------------------------------------------- + +IgmpModule::IgmpModule() : DecodeModule(CD_IGMP_NAME, igmp_params, igmp_rules) +{ } + +bool IgmpModule::set(const char*, Value&, SnortConfig*) +{ + return true; +} diff --git a/src/codecs/ip/cd_igmp_module.h b/src/codecs/ip/cd_igmp_module.h new file mode 100644 index 000000000..3c2eefce4 --- /dev/null +++ b/src/codecs/ip/cd_igmp_module.h @@ -0,0 +1,38 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// cd_igmp_module.h author Josh Rosenbaum + +#ifndef CD_IGMP_MODULE_H +#define CD_IGMP_MODULE_H + +#include "codecs/decode_module.h" + + +#define CD_IGMP_NAME "codec_igmp" + +class IgmpModule : public DecodeModule +{ +public: + IgmpModule(); + + bool set(const char*, Value&, SnortConfig*); +}; + +#endif diff --git a/src/codecs/ip/cd_ipv4.cc b/src/codecs/ip/cd_ipv4.cc index 2903dd2a9..9282a39e4 100644 --- a/src/codecs/ip/cd_ipv4.cc +++ b/src/codecs/ip/cd_ipv4.cc @@ -46,13 +46,14 @@ #include "codecs/checksum.h" #include "main/thread.h" #include "stream/stream_api.h" +#include "codecs/ip/cd_ipv4_module.h" namespace{ class Ipv4Codec : public Codec { public: - Ipv4Codec() : Codec("ipv4"){}; + Ipv4Codec() : Codec(CD_IPV4_NAME){}; ~Ipv4Codec(){}; virtual void get_protocol_ids(std::vector& v); @@ -167,11 +168,6 @@ bool Ipv4Codec::decode(const uint8_t *raw_pkt, const uint32_t len, uint32_t ip_len; /* length from the start of the ip hdr to the pkt end */ uint16_t hlen; /* ip header length */ -// dc.ip++; - -// if (p->greh != NULL) -// dc.gre_ip++; - DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Packet!\n");); /* do a little validation */ @@ -185,9 +181,6 @@ bool Ipv4Codec::decode(const uint8_t *raw_pkt, const uint32_t len, p->iph = NULL; p->family = NO_IP; - -// dc.discards++; -// dc.ipdisc++; return false; } @@ -223,9 +216,6 @@ bool Ipv4Codec::decode(const uint8_t *raw_pkt, const uint32_t len, p->iph = NULL; p->family = NO_IP; - -// dc.discards++; -// dc.ipdisc++; return false; } @@ -245,9 +235,6 @@ bool Ipv4Codec::decode(const uint8_t *raw_pkt, const uint32_t len, p->iph = NULL; p->family = NO_IP; - -// dc.discards++; -// dc.ipdisc++; return false; } @@ -262,9 +249,6 @@ bool Ipv4Codec::decode(const uint8_t *raw_pkt, const uint32_t len, p->iph = NULL; p->family = NO_IP; - -// dc.discards++; -// dc.ipdisc++; return false; } #if 0 @@ -292,9 +276,6 @@ bool Ipv4Codec::decode(const uint8_t *raw_pkt, const uint32_t len, p->iph = NULL; p->family = NO_IP; - -// dc.discards++; -// dc.ipdisc++; return false; } @@ -317,7 +298,6 @@ bool Ipv4Codec::decode(const uint8_t *raw_pkt, const uint32_t len, DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Bad IP checksum\n");); codec_events::exec_ip_chksm_drop(p); -// dc.invalid_checksums++; } #ifdef DEBUG_MSGS else @@ -391,7 +371,6 @@ bool Ipv4Codec::decode(const uint8_t *raw_pkt, const uint32_t len, p->frag_flag = 1; p->ip_frag_start = raw_pkt + hlen; p->ip_frag_len = (uint16_t)ip_len; -// dc.frags++; } } else @@ -458,12 +437,6 @@ inline void DecodeIPv4Proto(const uint8_t proto, { - case IPPROTO_IPV6: -// dc.ip4ip6++; -// if ( ScTunnelBypassEnabled(TUNNEL_6IN4) ) -// Active_SetTunnelBypass(); - return; - case IPPROTO_IP_MOBILITY: case IPPROTO_SUN_ND: case IPPROTO_PIM: @@ -811,24 +784,20 @@ void Ipv4Codec::format(EncodeFlags f, const Packet* p, Packet* c, Layer* lyr) sfiph_build(c, c->iph, AF_INET); } -/* - * CHECKSUM - */ - - -/* -* checksum IP - header=20+ bytes -* -* w - short words of data -* blen - byte length -* -*/ - //------------------------------------------------------------------------- // api //------------------------------------------------------------------------- +static Module* mod_ctor() +{ + return new Ipv4Module; +} + +static void mod_dtor(Module* m) +{ + delete m; +} //------------------------------------------------------------------------- // ip id considerations: @@ -862,7 +831,7 @@ static void ipv4_codec_gterm() } -static Codec *ctor() +static Codec *ctor(Module*) { return new Ipv4Codec; } @@ -872,17 +841,15 @@ static void dtor(Codec *cd) delete cd; } - -static const char* name = "ipv4"; static const CodecApi ipv4_api = { { PT_CODEC, - name, + CD_IPV4_NAME, CDAPI_PLUGIN_V0, 0, - nullptr, - nullptr + mod_ctor, + mod_dtor }, ipv4_codec_ginit, // pinit ipv4_codec_gterm, // pterm diff --git a/src/codecs/ip/cd_ipv4_module.cc b/src/codecs/ip/cd_ipv4_module.cc new file mode 100644 index 000000000..1ab2352dc --- /dev/null +++ b/src/codecs/ip/cd_ipv4_module.cc @@ -0,0 +1,78 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// cd_ipv4_module.cc author Josh Rosenbaum + +#include "codecs/ip/cd_ipv4_module.h" + + +static const Parameter ipv4_params[] = +{ + { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } +}; + + +// rules which will loaded into snort. +// You can now reference these rules by calling a codec_event +// in your main codec's functions +static const RuleMap ipv4_rules[] = +{ + { DECODE_NOT_IPV4_DGRAM, "(" CD_IPV4_NAME ") Not IPv4 datagram" }, + { DECODE_IPV4_INVALID_HEADER_LEN, "(" CD_IPV4_NAME ") hlen < IP_HEADER_LEN" }, + { DECODE_IPV4_DGRAM_LT_IPHDR, "(" CD_IPV4_NAME ") IP dgm len < IP Hdr len" }, + { DECODE_IPV4OPT_BADLEN, "(" CD_IPV4_NAME ") Ipv4 Options found with bad lengths" }, + { DECODE_IPV4OPT_TRUNCATED, "(" CD_IPV4_NAME ") Truncated Ipv4 Options" }, + { DECODE_IPV4_DGRAM_GT_CAPLEN, "(" CD_IPV4_NAME ") IP dgm len > captured len" }, + { DECODE_ZERO_TTL, "(" CD_IPV4_NAME ") IPV4 packet with zero TTL" }, + { DECODE_BAD_FRAGBITS, "(" CD_IPV4_NAME ") IPV4 packet with bad frag bits (Both MF and DF set)" }, + { DECODE_IP4_LEN_OFFSET, "(" CD_IPV4_NAME ") IPV4 packet frag offset + length exceed maximum" }, + { DECODE_IP4_SRC_THIS_NET, "(" CD_IPV4_NAME ") IPV4 packet from 'current net' source address" }, + { DECODE_IP4_DST_THIS_NET, "(" CD_IPV4_NAME ") IPV4 packet to 'current net' dest address" }, + { DECODE_IP4_SRC_MULTICAST, "(" CD_IPV4_NAME ") IPV4 packet from multicast source address" }, + { DECODE_IP4_SRC_RESERVED, "(" CD_IPV4_NAME ") IPV4 packet from reserved source address" }, + { DECODE_IP4_DST_RESERVED, "(" CD_IPV4_NAME ") IPV4 packet to reserved dest address" }, + { DECODE_IP4_SRC_BROADCAST, "(" CD_IPV4_NAME ") IPV4 packet from broadcast source address" }, + { DECODE_IP4_DST_BROADCAST, "(" CD_IPV4_NAME ") IPV4 packet to broadcast dest address" }, + { DECODE_IP4_MIN_TTL, "(" CD_IPV4_NAME ") IPV4 packet below TTL limit" }, + { DECODE_IP4_DF_OFFSET, "(" CD_IPV4_NAME ") IPV4 packet both DF and offset set" }, + { DECODE_IP_RESERVED_FRAG_BIT, "(decode) BAD-TRAFFIC IP reserved bit set" }, + { DECODE_IP_UNASSIGNED_PROTO, "(decode) BAD-TRAFFIC Unassigned/Reserved IP protocol" }, + { DECODE_IP_BAD_PROTO, "(decode) BAD-TRAFFIC Bad IP protocol" }, + { DECODE_IP_OPTION_SET, "(decode) MISC IP option set" }, + { DECODE_IP_MULTIPLE_ENCAPSULATION, "(decode) Two or more IP (v4 and/or v6) encapsulation layers present" }, + { DECODE_ZERO_LENGTH_FRAG, "(decode) fragment with zero length" }, + { DECODE_IP4_HDR_TRUNC, "(decode) truncated IP4 header" }, + { DECODE_BAD_TRAFFIC_LOOPBACK, "(snort decoder) Bad Traffic Loopback IP" }, + { DECODE_BAD_TRAFFIC_SAME_SRCDST, "(snort decoder) Bad Traffic Same Src/Dst IP" }, + { 0, nullptr } +}; + +//------------------------------------------------------------------------- +// rpc module +//------------------------------------------------------------------------- + +Ipv4Module::Ipv4Module() : DecodeModule(CD_IPV4_NAME, ipv4_params, ipv4_rules) +{ } + +bool Ipv4Module::set(const char*, Value&, SnortConfig*) +{ + return true; +} + + diff --git a/src/codecs/ip/cd_ipv4_module.h b/src/codecs/ip/cd_ipv4_module.h new file mode 100644 index 000000000..3d1608678 --- /dev/null +++ b/src/codecs/ip/cd_ipv4_module.h @@ -0,0 +1,39 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// cd_ipv4_module.h author Josh Rosenbaum + +#ifndef TEMPLATE_MODULE_H +#define TEMPLATE_MODULE_H + +#include "codecs/decode_module.h" + + +#define CD_IPV4_NAME "codec_ipv4" + +class Ipv4Module : public DecodeModule +{ +public: + Ipv4Module(); + + bool set(const char*, Value&, SnortConfig*); +}; + +#endif + diff --git a/src/codecs/ip/cd_ipv6.cc b/src/codecs/ip/cd_ipv6.cc index a66a95cd8..2e192693c 100644 --- a/src/codecs/ip/cd_ipv6.cc +++ b/src/codecs/ip/cd_ipv6.cc @@ -34,6 +34,7 @@ #include "stream/stream_api.h" #include "main/snort.h" #include "packet_io/active.h" +#include "codecs/ip/cd_ipv6_module.h" namespace { @@ -41,7 +42,7 @@ namespace class Ipv6Codec : public Codec { public: - Ipv6Codec() : Codec("ipv6"){}; + Ipv6Codec() : Codec(CD_IPV6_NAME){}; ~Ipv6Codec(){}; virtual void get_protocol_ids(std::vector& v); @@ -668,8 +669,17 @@ void Ipv6Codec::format(EncodeFlags f, const Packet* p, Packet* c, Layer* lyr) // api //------------------------------------------------------------------------- +static Module* mod_ctor() +{ + return new Ipv6Module; +} + +static void mod_dtor(Module* m) +{ + delete m; +} -static Codec* ctor() +static Codec* ctor(Module*) { return new Ipv6Codec(); } @@ -679,16 +689,15 @@ static void dtor(Codec *cd) delete cd; } -static const char* name = "ipv6"; static const CodecApi ipv6_api = { { PT_CODEC, - name, + CD_IPV6_NAME, CDAPI_PLUGIN_V0, 0, - nullptr, - nullptr, + mod_ctor, + mod_dtor, }, nullptr, // pinit nullptr, // pterm diff --git a/src/codecs/ip/cd_ipv6_module.cc b/src/codecs/ip/cd_ipv6_module.cc new file mode 100644 index 000000000..b5ac35f5f --- /dev/null +++ b/src/codecs/ip/cd_ipv6_module.cc @@ -0,0 +1,75 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// cd_ipv6_module.cc author Josh Rosenbaum + +#include "codecs/ip/cd_ipv6_module.h" + + +static const Parameter ipv6_params[] = +{ + { "parameter1", Parameter::PT_BOOL, nullptr, "false", + "This is a boolean parameter" }, + + { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } +}; + + +// rules which will loaded into snort. +// You can now reference these rules by calling a codec_event +// in your main codec's functions +static const RuleMap ipv6_rules[] = +{ + { DECODE_IPV6_MIN_TTL, "(" CD_IPV6_NAME ") IPv6 packet below TTL limit" }, + { DECODE_IPV6_IS_NOT, "(" CD_IPV6_NAME ") IPv6 header claims to not be IPv6" }, + { DECODE_IPV6_TRUNCATED_EXT, "(" CD_IPV6_NAME ") IPV6 truncated extension header" }, + { DECODE_IPV6_TRUNCATED, "(" CD_IPV6_NAME ") IPV6 truncated header" }, + { DECODE_IPV6_DGRAM_LT_IPHDR, "(" CD_IPV6_NAME ") IP dgm len < IP Hdr len" }, + { DECODE_IPV6_DGRAM_GT_CAPLEN, "(" CD_IPV6_NAME ") IP dgm len > captured len" }, + { DECODE_IPV6_DST_ZERO, "(" CD_IPV6_NAME ") IPv6 packet with destination address ::0" }, + { DECODE_IPV6_SRC_MULTICAST, "(" CD_IPV6_NAME ") IPv6 packet with multicast source address" }, + { DECODE_IPV6_DST_RESERVED_MULTICAST, "(" CD_IPV6_NAME ") IPv6 packet with reserved multicast destination address" }, + { DECODE_IPV6_BAD_OPT_TYPE, "(" CD_IPV6_NAME ") IPv6 header includes an undefined option type" }, + { DECODE_IPV6_BAD_MULTICAST_SCOPE, "(" CD_IPV6_NAME ") IPv6 address includes an unassigned multicast scope value" }, + { DECODE_IPV6_BAD_NEXT_HEADER, "(" CD_IPV6_NAME ") IPv6 header includes an invalid value for the \"next header\" field" }, + { DECODE_IPV6_ROUTE_AND_HOPBYHOP, "(" CD_IPV6_NAME ") IPv6 header includes a routing extension header followed by a hop-by-hop header" }, + { DECODE_IPV6_TWO_ROUTE_HEADERS, "(" CD_IPV6_NAME ") IPv6 header includes two routing extension headers" }, + { DECODE_IPV6_DSTOPTS_WITH_ROUTING, "(" CD_IPV6_NAME ") IPv6 header has destination options followed by a routing header" }, + { DECODE_IPV6_TUNNELED_IPV4_TRUNCATED, "(" CD_IPV6_NAME ") IPV6 tunneled over IPv4, IPv6 header truncated, possible Linux Kernel attack" }, + { DECODE_IPV6_BAD_OPT_LEN, "(" CD_IPV6_NAME ") IPv6 header includes an option which is too big for the containing header" }, + { DECODE_IPV6_UNORDERED_EXTENSIONS, "(" CD_IPV6_NAME ") IPv6 packet includes out-of-order extension headers" }, + { DECODE_IP6_ZERO_HOP_LIMIT, "(" CD_IPV6_NAME ") IPV6 packet has zero hop limit" }, + { DECODE_IPV6_ISATAP_SPOOF, "(" CD_IPV6_NAME ") BAD-TRAFFIC ISATAP-addressed IPv6 traffic spoofing attempt" }, + { DECODE_IPV6_BAD_FRAG_PKT, "(" CD_IPV6_NAME ") bogus fragmentation packet. Possible BSD attack" }, + { DECODE_IPV6_ROUTE_ZERO, "(" CD_IPV6_NAME ") IPV6 routing type 0 extension header" }, + { DECODE_IP6_EXCESS_EXT_HDR, "(decode) too many IP6 extension headers" }, + { 0, nullptr } +}; + +//------------------------------------------------------------------------- +// rpc module +//------------------------------------------------------------------------- + +Ipv6Module::Ipv6Module() : DecodeModule(CD_IPV6_NAME, ipv6_params, ipv6_rules) +{ } + +bool Ipv6Module::set(const char*, Value&, SnortConfig*) +{ + return true; +} diff --git a/src/codecs/root/root_ieee80211.h b/src/codecs/ip/cd_ipv6_module.h similarity index 62% rename from src/codecs/root/root_ieee80211.h rename to src/codecs/ip/cd_ipv6_module.h index 3fa762697..95c46043c 100644 --- a/src/codecs/root/root_ieee80211.h +++ b/src/codecs/ip/cd_ipv6_module.h @@ -1,6 +1,5 @@ /* -** Copyright (C) 2002-2013 Sourcefire, Inc. -** Copyright (C) 1998-2002 Martin Roesch +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. ** ** This program is free software; you can redistribute it and/or modify ** it under the terms of the GNU General Public License Version 2 as @@ -18,19 +17,24 @@ ** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */ +// cd_ipv6_module.h author Josh Rosenbaum -#ifndef ROOT_IEEE80211_H -#define ROOT_IEEE80211_H +#ifndef CD_IPV6_MODULE_H +#define CD_IPV6_MODULE_H +#include "codecs/decode_module.h" -#ifndef NO_NON_ETHER_DECODER -#define MINIMAL_IEEE80211_HEADER_LEN 10 /* Ack frames and others */ -#define IEEE802_11_DATA_HDR_LEN 24 /* Header for data packets */ -#endif // NO_NON_ETHER_DECODER +#define CD_IPV6_NAME "codec_ipv6" +class Ipv6Module : public DecodeModule +{ +public: + Ipv6Module(); -void DecodeIEEE80211Pkt(Packet *, const DAQ_PktHdr_t*, const uint8_t *); + bool set(const char*, Value&, SnortConfig*); -#endif /* PROT_TRK_H */ +}; + +#endif diff --git a/src/codecs/ip/cd_no_next.cc b/src/codecs/ip/cd_no_next.cc index 895a222aa..86c35013f 100644 --- a/src/codecs/ip/cd_no_next.cc +++ b/src/codecs/ip/cd_no_next.cc @@ -37,10 +37,12 @@ namespace { +#define CD_NO_NEXT_NAME "codec_ipv6_no_next" + class Ipv6NoNextCodec : public Codec { public: - Ipv6NoNextCodec() : Codec("ipv6_no_next"){}; + Ipv6NoNextCodec() : Codec(CD_NO_NEXT_NAME){}; ~Ipv6NoNextCodec() {}; @@ -77,7 +79,7 @@ void Ipv6NoNextCodec::get_protocol_ids(std::vector& v) // api //------------------------------------------------------------------------- -static Codec* ctor() +static Codec* ctor(Module*) { return new Ipv6NoNextCodec(); } @@ -87,14 +89,12 @@ static void dtor(Codec *cd) delete cd; } - -static const char* name = "ipv6_no_next"; static const CodecApi no_next_api = { - { - PT_CODEC, - name, - CDAPI_PLUGIN_V0, + { + PT_CODEC, + CD_NO_NEXT_NAME, + CDAPI_PLUGIN_V0, 0, nullptr, nullptr, diff --git a/src/codecs/ip/cd_pgm.cc b/src/codecs/ip/cd_pgm.cc index b98bd1585..3e17e2180 100644 --- a/src/codecs/ip/cd_pgm.cc +++ b/src/codecs/ip/cd_pgm.cc @@ -25,7 +25,7 @@ #endif #include "framework/codec.h" -#include "codecs/decode_module.h" +#include "codecs/ip/cd_pgm_module.h" #include "codecs/codec_events.h" #include "protocols/ipv4.h" #include "codecs/checksum.h" @@ -36,7 +36,7 @@ namespace class PgmCodec : public Codec { public: - PgmCodec() : Codec("pgm"){}; + PgmCodec() : Codec(CD_PGM_NAME){}; ~PgmCodec() {}; @@ -160,7 +160,17 @@ void PgmCodec::get_protocol_ids(std::vector& v) // api //------------------------------------------------------------------------- -static Codec* ctor() +static Module* mod_ctor() +{ + return new PgmModule; +} + +static void mod_dtor(Module* m) +{ + delete m; +} + +static Codec* ctor(Module*) { return new PgmCodec(); } @@ -171,16 +181,15 @@ static void dtor(Codec *cd) } -static const char* name = "pgm"; static const CodecApi pgm_api = { - { - PT_CODEC, - name, - CDAPI_PLUGIN_V0, + { + PT_CODEC, + CD_PGM_NAME, + CDAPI_PLUGIN_V0, 0, - nullptr, - nullptr, + mod_ctor, + mod_dtor, }, nullptr, // pinit nullptr, // pterm diff --git a/src/codecs/ip/cd_pgm_module.cc b/src/codecs/ip/cd_pgm_module.cc new file mode 100644 index 000000000..71b9ed721 --- /dev/null +++ b/src/codecs/ip/cd_pgm_module.cc @@ -0,0 +1,47 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// cd_pgm_module.cc author Josh Rosenbaum + +#include "codecs/ip/cd_pgm_module.h" + + +static const Parameter pgm_params[] = +{ + { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } +}; + + +static const RuleMap pgm_rules[] = +{ + { DECODE_PGM_NAK_OVERFLOW, "(" CD_PGM_NAME ") BAD-TRAFFIC PGM nak list overflow attempt" }, + { 0, nullptr } +}; + +//------------------------------------------------------------------------- +// rpc module +//------------------------------------------------------------------------- + +PgmModule::PgmModule() : DecodeModule(CD_PGM_NAME, pgm_params, pgm_rules) +{ } + +bool PgmModule::set(const char*, Value&, SnortConfig*) +{ + return true; +} diff --git a/src/codecs/ip/cd_pgm_module.h b/src/codecs/ip/cd_pgm_module.h new file mode 100644 index 000000000..09613e7cd --- /dev/null +++ b/src/codecs/ip/cd_pgm_module.h @@ -0,0 +1,38 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// cd_pgm_module.h author Josh Rosenbaum + +#ifndef CD_PGM_MODULE_H +#define CD_PGM_MODULE_H + +#include "codecs/decode_module.h" + + +#define CD_PGM_NAME "codec_pgm" + +class PgmModule : public DecodeModule +{ +public: + PgmModule(); + + bool set(const char*, Value&, SnortConfig*); +}; + +#endif diff --git a/src/codecs/ip/cd_routing.cc b/src/codecs/ip/cd_routing.cc index d5ea9aadc..a1d54f4c1 100644 --- a/src/codecs/ip/cd_routing.cc +++ b/src/codecs/ip/cd_routing.cc @@ -37,10 +37,12 @@ namespace { +#define CD_IPV6_ROUTING_NAME "codec_ipv6_routing" + class Ipv6RoutingCodec : public Codec { public: - Ipv6RoutingCodec() : Codec("ipv6_routing"){}; + Ipv6RoutingCodec() : Codec(CD_IPV6_ROUTING_NAME){}; ~Ipv6RoutingCodec() {}; @@ -145,7 +147,7 @@ void Ipv6RoutingCodec::get_protocol_ids(std::vector& v) // api //------------------------------------------------------------------------- -static Codec* ctor() +static Codec* ctor(Module*) { return new Ipv6RoutingCodec(); } @@ -155,14 +157,12 @@ static void dtor(Codec *cd) delete cd; } - -static const char* name = "ipv6_routing"; static const CodecApi ipv6_routing_api = { - { - PT_CODEC, - name, - CDAPI_PLUGIN_V0, + { + PT_CODEC, + CD_IPV6_ROUTING_NAME, + CDAPI_PLUGIN_V0, 0, nullptr, nullptr, diff --git a/src/codecs/ip/cd_swipe.cc b/src/codecs/ip/cd_swipe.cc index a1c7b7daa..12cce3415 100644 --- a/src/codecs/ip/cd_swipe.cc +++ b/src/codecs/ip/cd_swipe.cc @@ -26,22 +26,23 @@ #endif #include "framework/codec.h" -#include "codecs/decode_module.h" #include "codecs/codec_events.h" namespace{ -class SwipeCodec : public Codec{ +#define CD_SWIPE_NAME "codec_swipe" + +class SwipeCodec : public Codec +{ public: - SwipeCodec() : Codec("swipe"){}; + SwipeCodec() : Codec(CD_SWIPE_NAME){}; virtual ~SwipeCodec(){}; virtual void get_protocol_ids(std::vector& v); virtual bool decode(const uint8_t* raw_packet, const uint32_t raw_len, Packet *p, uint16_t &lyr_len, uint16_t &); }; - } // namespace static const uint16_t SWIPE_PROT_ID = 53; @@ -64,7 +65,7 @@ bool SwipeCodec::decode(const uint8_t* /*raw_packet*/, const uint32_t /*raw_len* // api //------------------------------------------------------------------------- -static Codec *ctor() +static Codec *ctor(Module*) { return new SwipeCodec(); } @@ -74,12 +75,11 @@ static void dtor(Codec *cd) delete cd; } -static const char* const name = "swipe"; static const CodecApi swipe_api = { { PT_CODEC, - name, + CD_SWIPE_NAME, CDAPI_PLUGIN_V0, 0, nullptr, diff --git a/src/codecs/ip/cd_tcp.cc b/src/codecs/ip/cd_tcp.cc index 4a6db3ce3..b12a1b1a5 100644 --- a/src/codecs/ip/cd_tcp.cc +++ b/src/codecs/ip/cd_tcp.cc @@ -44,7 +44,7 @@ #include "protocols/tcp.h" #include "protocols/packet.h" #include "framework/codec.h" - +#include "codecs/ip/cd_tcp_module.h" namespace { @@ -52,7 +52,7 @@ namespace class TcpCodec : public Codec { public: - TcpCodec() : Codec("tcp") + TcpCodec() : Codec(CD_TCP_NAME) { }; @@ -143,9 +143,6 @@ bool TcpCodec::decode(const uint8_t *raw_pkt, const uint32_t len, codec_events::decoder_event(p, DECODE_TCP_INVALID_OFFSET); p->tcph = NULL; -// dc.discards++; -// dc.tdisc++; - return false; } @@ -158,9 +155,6 @@ bool TcpCodec::decode(const uint8_t *raw_pkt, const uint32_t len, codec_events::decoder_event(p, DECODE_TCP_LARGE_OFFSET); p->tcph = NULL; -// dc.discards++; -// dc.tdisc++; - return false; } @@ -242,7 +236,6 @@ bool TcpCodec::decode(const uint8_t *raw_pkt, const uint32_t len, ntohs(p->tcph->th_sum));); codec_events::exec_tcp_chksm_drop(p); -// dc.invalid_checksums++; } else { @@ -263,8 +256,6 @@ bool TcpCodec::decode(const uint8_t *raw_pkt, const uint32_t len, // Allowing this packet for further processing // (in case there is a valid data inside it). /*p->tcph = NULL; - dc.discards++; - dc.tdisc++; return;*/ } @@ -1032,6 +1023,16 @@ static inline unsigned short in_chksum_tcp6(pseudoheader6 *ph, // api //------------------------------------------------------------------------- +static Module* mod_ctor() +{ + return new TcpModule; +} + +static void mod_dtor(Module* m) +{ + delete m; +} + /* * Static api functions. there are NOT part of the TCPCodec class, * but provide global initializers and/or destructors to the class @@ -1047,17 +1048,13 @@ static void tcp_codec_ginit() } - - static void tcp_codec_gterm() { if( SynToMulticastDstIp ) sfvar_free(SynToMulticastDstIp); } - - -static Codec* ctor() +static Codec* ctor(Module*) { return new TcpCodec(); } @@ -1067,21 +1064,20 @@ static void dtor(Codec *cd) delete cd; } -static const char* name = "tcp"; static const CodecApi tcp_api = { { PT_CODEC, - name, + CD_TCP_NAME, CDAPI_PLUGIN_V0, 0, - nullptr, - nullptr, + mod_ctor, + mod_dtor, }, tcp_codec_ginit, // pinit tcp_codec_gterm, // pterm - NULL, // tinit - NULL, // tterm + nullptr, // tinit + nullptr, // tterm ctor, // ctor dtor, // dtor }; diff --git a/src/codecs/ip/cd_tcp_module.cc b/src/codecs/ip/cd_tcp_module.cc new file mode 100644 index 000000000..a2ae4c434 --- /dev/null +++ b/src/codecs/ip/cd_tcp_module.cc @@ -0,0 +1,70 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// cd_tcp_module.cc author Josh Rosenbaum + +#include "codecs/ip/cd_tcp_module.h" + + +static const Parameter tcp_params[] = +{ + { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } +}; + + +// rules which will loaded into snort. +// You can now reference these rules by calling a codec_event +// in your main codec's functions +static const RuleMap tcp_rules[] = +{ + { DECODE_TCP_DGRAM_LT_TCPHDR, "(" CD_TCP_NAME ") TCP packet len is smaller than 20 bytes" }, + { DECODE_TCP_INVALID_OFFSET, "(" CD_TCP_NAME ") TCP Data Offset is less than 5" }, + { DECODE_TCP_LARGE_OFFSET, "(" CD_TCP_NAME ") TCP Header length exceeds packet length" }, + + { DECODE_TCPOPT_BADLEN, "(" CD_TCP_NAME ") Tcp Options found with bad lengths" }, + { DECODE_TCPOPT_TRUNCATED, "(" CD_TCP_NAME ") Truncated Tcp Options" }, + { DECODE_TCPOPT_TTCP, "(" CD_TCP_NAME ") T/TCP Detected" }, + { DECODE_TCPOPT_OBSOLETE, "(" CD_TCP_NAME ") Obsolete TCP Options found" }, + { DECODE_TCPOPT_EXPERIMENTAL, "(" CD_TCP_NAME ") Experimental Tcp Options found" }, + { DECODE_TCPOPT_WSCALE_INVALID, "(" CD_TCP_NAME ") Tcp Window Scale Option found with length > 14" }, + { DECODE_TCP_XMAS, "(" CD_TCP_NAME ") XMAS Attack Detected" }, + { DECODE_TCP_NMAP_XMAS, "(" CD_TCP_NAME ") Nmap XMAS Attack Detected" }, + { DECODE_TCP_BAD_URP, "(" CD_TCP_NAME ") TCP urgent pointer exceeds payload length or no payload" }, + { DECODE_TCP_SYN_FIN, "(" CD_TCP_NAME ") TCP SYN with FIN" }, + { DECODE_TCP_SYN_RST, "(" CD_TCP_NAME ") TCP SYN with RST" }, + { DECODE_TCP_MUST_ACK, "(" CD_TCP_NAME ") TCP PDU missing ack for established session" }, + { DECODE_TCP_NO_SYN_ACK_RST, "(" CD_TCP_NAME ") TCP has no SYN, ACK, or RST" }, + { DECODE_TCP_SHAFT_SYNFLOOD, "(" CD_TCP_NAME ") DDOS shaft synflood" }, + { DECODE_TCP_PORT_ZERO, "(" CD_TCP_NAME ") BAD-TRAFFIC TCP port 0 traffic" }, + { DECODE_DOS_NAPTHA, "(decode) DOS NAPTHA Vulnerability Detected" }, + { DECODE_SYN_TO_MULTICAST, "(decode) Bad Traffic SYN to multicast address" }, + { 0, nullptr } +}; + +//------------------------------------------------------------------------- +// rpc module +//------------------------------------------------------------------------- + +TcpModule::TcpModule() : DecodeModule(CD_TCP_NAME, tcp_params, tcp_rules) +{ } + +bool TcpModule::set(const char*, Value&, SnortConfig*) +{ + return true; +} diff --git a/src/codecs/ip/cd_tcp_module.h b/src/codecs/ip/cd_tcp_module.h new file mode 100644 index 000000000..904cacff9 --- /dev/null +++ b/src/codecs/ip/cd_tcp_module.h @@ -0,0 +1,40 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// cd_tcp_module.h author Josh Rosenbaum + +#ifndef CD_TCP_MODULE_H +#define CD_TCP_MODULE_H + +#include "codecs/decode_module.h" + + +#define CD_TCP_NAME "codec_tcp" + +class TcpModule : public DecodeModule +{ +public: + TcpModule(); + + bool set(const char*, Value&, SnortConfig*); + +}; + +#endif + diff --git a/src/codecs/ip/cd_udp.cc b/src/codecs/ip/cd_udp.cc index 31a141973..47488ac73 100644 --- a/src/codecs/ip/cd_udp.cc +++ b/src/codecs/ip/cd_udp.cc @@ -44,6 +44,7 @@ #include "framework/codec.h" #include "packet_io/active.h" #include "codecs/codec_events.h" +#include "codecs/ip/cd_udp_module.h" namespace { @@ -51,7 +52,7 @@ namespace class UdpCodec : public Codec { public: - UdpCodec() : Codec("udp"){}; + UdpCodec() : Codec(CD_UDP_NAME){}; ~UdpCodec(){}; @@ -248,7 +249,13 @@ bool UdpCodec::decode(const uint8_t *raw_pkt, const uint32_t len, p->proto_bits |= PROTO_BIT__UDP; UDPMiscTests(p); - if (teredo::is_teredo_port(p->sp) || + if (ScGTPDecoding() && + (ScIsGTPPort(p->sp)||ScIsGTPPort(p->dp))) + { + if ( !p->frag_flag ) + next_prot_id = PROTOCOL_GTP; + } + else if (teredo::is_teredo_port(p->sp) || teredo::is_teredo_port(p->dp) || ScDeepTeredoInspection()) { @@ -256,12 +263,6 @@ bool UdpCodec::decode(const uint8_t *raw_pkt, const uint32_t len, next_prot_id = PROTOCOL_TEREDO; } - if (ScGTPDecoding() && - (ScIsGTPPort(p->sp)||ScIsGTPPort(p->dp))) - { - if ( !p->frag_flag ) - next_prot_id = PROTOCOL_GTP; - } return true; } @@ -689,7 +690,18 @@ static inline unsigned short in_chksum_udp(pseudoheader *ph, // api //------------------------------------------------------------------------- -static Codec* ctor() + +static Module* mod_ctor() +{ + return new UdpModule; +} + +static void mod_dtor(Module* m) +{ + delete m; +} + +static Codec* ctor(Module*) { return new UdpCodec(); } @@ -699,17 +711,16 @@ static void dtor(Codec *cd) delete cd; } -static const char* name = "udp"; static const CodecApi udp_api = { - { - PT_CODEC, - name, - CDAPI_PLUGIN_V0, - 0, - nullptr, - nullptr + { + PT_CODEC, + CD_UDP_NAME, + CDAPI_PLUGIN_V0, + 0, + mod_ctor, + mod_dtor }, nullptr, // pinit nullptr, // pterm diff --git a/src/codecs/ip/cd_udp_module.cc b/src/codecs/ip/cd_udp_module.cc new file mode 100644 index 000000000..53a03a252 --- /dev/null +++ b/src/codecs/ip/cd_udp_module.cc @@ -0,0 +1,81 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// cd_udp_module.cc author Josh Rosenbaum + +#include "cd_udp_module.h" +#include "snort_config.h" +#include "parser/config_file.h" + +static const Parameter udp_params[] = +{ + { "deep_teredo_inspection", Parameter::PT_BOOL, nullptr, "false", + "look for Teredo on all UDP ports (default is only 3544)" }, + + { "enable_gtp", Parameter::PT_BOOL, nullptr, "false", + "decode GTP encapsulations" }, + + // FIXIT use PT_BIT_LIST + { "gtp_ports", Parameter::PT_STRING, nullptr, + "'2152 3386'", "set GTP ports" }, + + { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } +}; + + +static const RuleMap udp_rules[] = +{ + + { DECODE_UDP_DGRAM_LT_UDPHDR, "(" CD_UDP_NAME ") Truncated UDP Header" }, + { DECODE_UDP_DGRAM_INVALID_LENGTH, "(" CD_UDP_NAME ") Invalid UDP header, length field < 8" }, + { DECODE_UDP_DGRAM_SHORT_PACKET, "(" CD_UDP_NAME ") Short UDP packet, length field > payload length" }, + { DECODE_UDP_DGRAM_LONG_PACKET, "(" CD_UDP_NAME ") Long UDP packet, length field < payload length" }, + { DECODE_UDP_IPV6_ZERO_CHECKSUM, "(" CD_UDP_NAME ") Invalid IPv6 UDP packet, checksum zero" }, + { DECODE_UDP_LARGE_PACKET, "(" CD_UDP_NAME ") MISC Large UDP Packet" }, + { DECODE_UDP_PORT_ZERO, "(" CD_UDP_NAME ") BAD-TRAFFIC UDP port 0 traffic" }, + + + { 0, nullptr } +}; + +//------------------------------------------------------------------------- +// rpc module +//------------------------------------------------------------------------- + +UdpModule::UdpModule() : DecodeModule(CD_UDP_NAME, udp_params, udp_rules) +{ } + +bool UdpModule::set(const char*, Value& v, SnortConfig* sc) +{ + if ( v.is("deep_teredo_inspection") ) + sc->enable_teredo = v.get_long(); // FIXIT move to existing bitfield + + else if ( v.is("enable_gtp") ) + { + if ( v.get_bool() ) + sc->enable_gtp = 1; // FIXIT move to existing bitfield + } + else if ( v.is("gtp_ports") ) + ConfigGTPDecoding(sc, v.get_string()); + + else + return false; + + return true; +} diff --git a/src/codecs/ip/cd_udp_module.h b/src/codecs/ip/cd_udp_module.h new file mode 100644 index 000000000..8ccb2d6f0 --- /dev/null +++ b/src/codecs/ip/cd_udp_module.h @@ -0,0 +1,39 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// cd_udp_module.h author Josh Rosenbaum + +#ifndef CD_UDP_MODULE_H +#define CD_UDP_MODULE_H + +#include "codecs/decode_module.h" + + +#define CD_UDP_NAME "codec_udp" + +class UdpModule : public DecodeModule +{ +public: + UdpModule(); + + bool set(const char*, Value&, SnortConfig*); + +}; + +#endif diff --git a/src/codecs/link/CMakeLists.txt b/src/codecs/link/CMakeLists.txt index 41394aebd..c91f051b5 100644 --- a/src/codecs/link/CMakeLists.txt +++ b/src/codecs/link/CMakeLists.txt @@ -4,31 +4,43 @@ if( STATIC_DECODERS ) set( PLUGIN_SOURCES cd_erspan2.cc + cd_erspan2_module.h + cd_erspan2_module.cc cd_erspan3.cc + cd_erspan3_module.h + cd_erspan3_module.cc cd_ethloopback.cc cd_mpls.cc + cd_mpls_module.h + cd_mpls_module.cc cd_pppencap.cc cd_pppoepkt.cc + cd_pppoepkt_module.h + cd_pppoepkt_module.cc cd_transbridge.cc cd_vlan.cc + cd_vlan_module.h + cd_vlan_module.cc ) if(ENABLE_NON_ETHER_DECODER) set( PLUGIN_SOURCES ${PLUGIN_SOURCES} cd_eapol.cc + cd_eapol_module.h + cd_eapol_module.cc ) endif() else() - add_shared_library(cd_erspan2 codecs cd_erspan2.cc) - add_shared_library(cd_erspan3 codecs cd_erspan3.cc) + add_shared_library(cd_erspan2 codecs cd_erspan2.cc cd_erspan2_module.h cd_erspan2_module.cc) + add_shared_library(cd_erspan3 codecs cd_erspan3.cc cd_erspan3_module.h cd_erspan3_module.cc) add_shared_library(cd_ethloopback codecs cd_ethloopback.cc) - add_shared_library(cd_mpls codecs cd_mpls.cc) + add_shared_library(cd_mpls codecs cd_mpls.cc cd_mpls_module.h cd_mpls_module.cc) add_shared_library(cd_pppencap codecs cd_pppencap.cc) - add_shared_library(cd_pppoepkt codecs cd_pppoepkt.cc) + add_shared_library(cd_pppoepkt codecs cd_pppoepkt.cc cd_pppoepkt_module.h cd_pppoepkt_module.cc) add_shared_library(cd_transbridge codecs cd_transbridge.cc) - add_shared_library(cd_vlan codecs cd_vlan.cc) + add_shared_library(cd_vlan codecs cd_vlan.cc cd_vlan_module.h cd_vlan_module.cc) if(ENABLE_NON_ETHER_DECODER) add_shared_library(cd_eapol codecs cd_eapol.cc) @@ -39,6 +51,8 @@ endif() add_library( link_codecs STATIC cd_arp.cc + cd_arp_module.h + cd_arp_module.cc ${PLUGIN_SOURCES} ) diff --git a/src/codecs/link/Makefile.am b/src/codecs/link/Makefile.am index 997ec178a..2589a724b 100644 --- a/src/codecs/link/Makefile.am +++ b/src/codecs/link/Makefile.am @@ -3,22 +3,34 @@ AUTOMAKE_OPTIONS=foreign no-dependencies noinst_LIBRARIES = liblink_codecs.a liblink_codecs_a_SOURCES = \ -cd_arp.cc +cd_arp.cc \ +cd_arp_module.h \ +cd_arp_module.cc plugin_list = \ cd_erspan2.cc \ +cd_erspan2_module.h \ +cd_erspan2_module.cc \ cd_erspan3.cc \ +cd_erspan3_module.h \ +cd_erspan3_module.cc \ cd_ethloopback.cc \ cd_mpls.cc \ +cd_mpls_module.h \ +cd_mpls_module.cc \ cd_pppencap.cc \ cd_pppoepkt.cc \ +cd_pppoepkt_module.h \ +cd_pppoepkt_module.cc \ cd_transbridge.cc \ -cd_vlan.cc +cd_vlan.cc \ +cd_vlan_module.h \ +cd_vlan_module.cc if ENABLE_NON_ETHER_DECODER -plugin_list += cd_eapol.cc +plugin_list += cd_eapol.cc cd_eapol_module.h cd_eapol_module.cc endif if STATIC_DECODERS @@ -31,17 +43,37 @@ ehlibdir = $(pkglibdir)/codecs ehlib_LTLIBRARIES = libcd_erspan2.la libcd_erspan2_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO libcd_erspan2_la_LDFLAGS = -export-dynamic -shared -libcd_erspan2_la_SOURCES = cd_erspan2.cc +libcd_erspan2_la_SOURCES = cd_erspan2.cc cd_erspan2_module.h cd_erspan2_module.cc -# TODO: PUT THESE IN T LIST -# add_shared_library(cd_eapol codecs cd_eapol.cc) -# add_shared_library(cd_erspan3 codecs cd_erspan3.cc) +ehlib_LTLIBRARIES += libcd_erspan3.la +libcd_erspan3_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO +libcd_erspan3_la_LDFLAGS = -export-dynamic -shared +libcd_erspan3_la_SOURCES = cd_erspan3.cc cd_erspan3_module.h cd_erspan3_module.cc + +ehlib_LTLIBRARIES += libcd_mpls.la +libcd_mpls_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO +libcd_mpls_la_LDFLAGS = -export-dynamic -shared +libcd_mpls_la_SOURCES = cd_mpls.cc cd_mpls_module.h cd_mpls_module.cc + +ehlib_LTLIBRARIES += libcd_vlan.la +libcd_vlan_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO +libcd_vlan_la_LDFLAGS = -export-dynamic -shared +libcd_vlan_la_SOURCES = cd_vlan.cc cd_vlan_module.h cd_vlan_module.cc + +# TODO: CREATE PLUGING LIBRARIES FOR THESE LIBRARIES # add_shared_library(cd_ethloopback codecs cd_ethloopback.cc) # add_shared_library(cd_mpls codecs cd_mpls.cc) # add_shared_library(cd_pppencap codecs cd_pppencap.cc) # add_shared_library(cd_pppoepkt codecs cd_pppoepkt.cc) # add_shared_library(cd_transbridge codecs cd_transbridge.cc) -# add_shared_library(cd_vlan codecs cd_vlan.cc) + +if ENABLE_NON_ETHER_DECODER + +ehlib_LTLIBRARIES += libcd_eapol.la +libcd_eapol_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO +libcd_eapol_la_LDFLAGS = -export-dynamic -shared +libcd_eapol_la_SOURCES = cd_eapol.cc cd_eapol_module.h cd_eapol_module.cc +endif # if(ENABLE_NON_ETHER_DECODER) # add_shared_library(cd_eapol codecs cd_eapol.cc) diff --git a/src/codecs/link/cd_arp.cc b/src/codecs/link/cd_arp.cc index 314d68b2e..d256f0b6e 100644 --- a/src/codecs/link/cd_arp.cc +++ b/src/codecs/link/cd_arp.cc @@ -25,7 +25,7 @@ #include "framework/codec.h" -#include "codecs/decode_module.h" +#include "codecs/link/cd_arp_module.h" #include "codecs/codec_events.h" namespace @@ -34,7 +34,7 @@ namespace class ArpCodec : public Codec { public: - ArpCodec() : Codec("arp"){}; + ArpCodec() : Codec(CD_ARP_NAME){}; ~ArpCodec(){}; @@ -80,9 +80,6 @@ void ArpCodec::get_protocol_ids(std::vector& v) bool ArpCodec::decode(const uint8_t *raw_pkt, const uint32_t len, Packet *p, uint16_t &lyr_len, uint16_t& /* next_prot_id */) { -// if (p->greh != NULL) -// dc.gre_arp++; - p->ah = (EtherARP *) raw_pkt; if(len < sizeof(EtherARP)) @@ -103,8 +100,17 @@ bool ArpCodec::decode(const uint8_t *raw_pkt, const uint32_t len, // api //------------------------------------------------------------------------- +static Module* mod_ctor() +{ + return new ArpModule; +} + +static void mod_dtor(Module* m) +{ + delete m; +} -static Codec* ctor() +static Codec* ctor(Module*) { return new ArpCodec(); } @@ -114,16 +120,15 @@ static void dtor(Codec *cd) delete cd; } -static const char* name = "arp"; static const CodecApi arp_api = { { PT_CODEC, - name, + CD_ARP_NAME, CDAPI_PLUGIN_V0, 0, - nullptr, - nullptr, + mod_ctor, + mod_dtor, }, nullptr, // pinit nullptr, // pterm @@ -133,16 +138,4 @@ static const CodecApi arp_api = dtor, // dtor }; -#ifdef BUILDING_SO -SO_PUBLIC const BaseApi* snort_plugins[] = -{ - &arp_api.base, - nullptr -}; -#else const BaseApi* cd_arp = &arp_api.base; -#endif - - - - diff --git a/src/codecs/link/cd_arp_module.cc b/src/codecs/link/cd_arp_module.cc new file mode 100644 index 000000000..d9daa6313 --- /dev/null +++ b/src/codecs/link/cd_arp_module.cc @@ -0,0 +1,47 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// cd_arp_module.cc author Josh Rosenbaum + +#include "codecs/link/cd_arp_module.h" + + +static const Parameter arp_params[] = +{ + { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } +}; + + +static const RuleMap arp_rules[] = +{ + { DECODE_ARP_TRUNCATED, "(" CD_ARP_NAME ") Truncated ARP" }, + { 0, nullptr } +}; + +//------------------------------------------------------------------------- +// rpc module +//------------------------------------------------------------------------- + +ArpModule::ArpModule() : DecodeModule(CD_ARP_NAME, arp_params, arp_rules) +{ } + +bool ArpModule::set(const char*, Value&, SnortConfig*) +{ + return true; +} diff --git a/src/codecs/link/cd_arp_module.h b/src/codecs/link/cd_arp_module.h new file mode 100644 index 000000000..e73ed7757 --- /dev/null +++ b/src/codecs/link/cd_arp_module.h @@ -0,0 +1,38 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// cd_arp_module.h author Josh Rosenbaum + +#ifndef CD_ARP_MODULE_H +#define CD_ARP_MODULE_H + +#include "codecs/decode_module.h" + + +#define CD_ARP_NAME "codec_arp" + +class ArpModule : public DecodeModule +{ +public: + ArpModule(); + + bool set(const char*, Value&, SnortConfig*); +}; + +#endif diff --git a/src/codecs/link/cd_eapol.cc b/src/codecs/link/cd_eapol.cc index 369f4bf5a..5a199b92a 100644 --- a/src/codecs/link/cd_eapol.cc +++ b/src/codecs/link/cd_eapol.cc @@ -25,7 +25,7 @@ #endif #include "framework/codec.h" -#include "codecs/decode_module.h" +#include "codecs/link/cd_eapol_module.h" #include "codecs/codec_events.h" @@ -35,7 +35,7 @@ namespace class EapolCodec : public Codec { public: - EapolCodec() : Codec("eapol"){}; + EapolCodec() : Codec(CD_EAPOL_NAME){}; ~EapolCodec() {}; @@ -94,6 +94,31 @@ static const uint16_t ETHERTYPE_EAPOL = 0x888e; +struct EtherEapol +{ + uint8_t version; /* EAPOL proto version */ + uint8_t eaptype; /* EAPOL Packet type */ + uint16_t len; /* Packet body length */ +}; + +struct EAPHdr +{ + uint8_t code; + uint8_t id; + uint16_t len; +}; + +struct EapolKey +{ + uint8_t type; + uint8_t length[2]; + uint8_t counter[8]; + uint8_t iv[16]; + uint8_t index; + uint8_t sig[16]; +}; + + } // namespace /************************************************* @@ -113,14 +138,15 @@ static const uint16_t ETHERTYPE_EAPOL = 0x888e; */ void DecodeEAP(const uint8_t * pkt, const uint32_t len, Packet * p) { + const EAPHdr *eaph = reinterpret_cast(pkt); p->eaph = (EAPHdr *) pkt; if(len < sizeof(EAPHdr)) { codec_events::decoder_event(p, DECODE_EAP_TRUNCATED); return; } - if (p->eaph->code == EAP_CODE_REQUEST || - p->eaph->code == EAP_CODE_RESPONSE) { + if (eaph->code == EAP_CODE_REQUEST || + eaph->code == EAP_CODE_RESPONSE) { p->eaptype = pkt + sizeof(EAPHdr); } return; @@ -187,7 +213,17 @@ void EapolCodec::get_protocol_ids(std::vector& v) // api //------------------------------------------------------------------------- -static Codec* ctor() +static Module* mod_ctor() +{ + return new EapolModule; +} + +static void mod_dtor(Module* m) +{ + delete m; +} + +static Codec* ctor(Module*) { return new EapolCodec(); } @@ -198,16 +234,15 @@ static void dtor(Codec *cd) } -static const char* name = "eapol"; static const CodecApi eapol_api = { { PT_CODEC, - name, + CD_NAME_EAPOL, CDAPI_PLUGIN_V0, 0, - nullptr, - nullptr, + mod_ctor, + mod_dtor, }, nullptr, // pinit nullptr, // pterm diff --git a/src/codecs/link/cd_eapol_module.cc b/src/codecs/link/cd_eapol_module.cc new file mode 100644 index 000000000..3678b3647 --- /dev/null +++ b/src/codecs/link/cd_eapol_module.cc @@ -0,0 +1,49 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// cd_eapol_module.cc author Josh Rosenbaum + +#include "codecs/link/cd_eapol_module.h" + + +static const Parameter eapol_params[] = +{ + { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } +}; + + +static const RuleMap eapol_rules[] = +{ + { DECODE_EAPOL_TRUNCATED, "(" CD_EAPOL_NAME ") Truncated EAP Header" }, + { DECODE_EAPKEY_TRUNCATED, "(" CD_EAPOL_NAME ") EAP Key Truncated" }, + { DECODE_EAP_TRUNCATED, "(" CD_EAPOL_NAME ") EAP Header Truncated" }, + { 0, nullptr } +}; + +//------------------------------------------------------------------------- +// rpc module +//------------------------------------------------------------------------- + +EapolModule::EapolModule() : DecodeModule(CD_EAPOL_NAME, eapol_params, eapol_rules) +{ } + +bool EapolModule::set(const char*, Value&, SnortConfig*) +{ + return true; +} diff --git a/src/codecs/link/cd_eapol_module.h b/src/codecs/link/cd_eapol_module.h new file mode 100644 index 000000000..1d419f895 --- /dev/null +++ b/src/codecs/link/cd_eapol_module.h @@ -0,0 +1,38 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// cd_eapol_module.h author Josh Rosenbaum + +#ifndef CD_EAPOL_MODULE_H +#define CD_EAPOL_MODULE_H + +#include "codecs/decode_module.h" + + +#define CD_EAPOL_NAME "codec_eapol" + +class EapolModule : public DecodeModule +{ +public: + EapolModule(); + + bool set(const char*, Value&, SnortConfig*); +}; + +#endif diff --git a/src/codecs/link/cd_erspan2.cc b/src/codecs/link/cd_erspan2.cc index edee08c91..a257d5a52 100644 --- a/src/codecs/link/cd_erspan2.cc +++ b/src/codecs/link/cd_erspan2.cc @@ -21,7 +21,7 @@ #include "framework/codec.h" -#include "codecs/decode_module.h" +#include "codecs/link/cd_erspan2_module.h" #include "codecs/codec_events.h" #include "protocols/protocol_ids.h" @@ -31,7 +31,7 @@ namespace class Erspan2Codec : public Codec { public: - Erspan2Codec() : Codec("erspan2"){}; + Erspan2Codec() : Codec(CD_ERSPAN2_NAME){}; ~Erspan2Codec(){}; virtual void get_protocol_ids(std::vector& v); @@ -112,8 +112,17 @@ bool Erspan2Codec::decode(const uint8_t *raw_pkt, const uint32_t len, // api //------------------------------------------------------------------------- +static Module* mod_ctor() +{ + return new Erspan2Module; +} + +static void mod_dtor(Module* m) +{ + delete m; +} -static Codec* ctor() +static Codec* ctor(Module*) { return new Erspan2Codec(); } @@ -124,16 +133,15 @@ static void dtor(Codec *cd) } -static const char* name = "erspan2"; static const CodecApi erspan2_api = { { PT_CODEC, - name, + CD_ERSPAN2_NAME, CDAPI_PLUGIN_V0, 0, - nullptr, - nullptr, + mod_ctor, + mod_dtor, }, nullptr, // pinit nullptr, // pterm diff --git a/src/codecs/link/cd_erspan2_module.cc b/src/codecs/link/cd_erspan2_module.cc new file mode 100644 index 000000000..24e404079 --- /dev/null +++ b/src/codecs/link/cd_erspan2_module.cc @@ -0,0 +1,48 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// cd_erspan2_module.cc author Josh Rosenbaum + +#include "codecs/link/cd_erspan2_module.h" + + +static const Parameter erspan2_params[] = +{ + { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } +}; + + +static const RuleMap erspan2_rules[] = +{ + { DECODE_ERSPAN_HDR_VERSION_MISMATCH, "(codec_erspan) ERSpan Header version mismatch" }, + { DECODE_ERSPAN2_DGRAM_LT_HDR, "(" CD_ERSPAN2_NAME ") captured < ERSpan Type2 Header Length" }, + { 0, nullptr } +}; + +//------------------------------------------------------------------------- +// rpc module +//------------------------------------------------------------------------- + +Erspan2Module::Erspan2Module() : DecodeModule(CD_ERSPAN2_NAME, erspan2_params, erspan2_rules) +{ } + +bool Erspan2Module::set(const char*, Value&, SnortConfig*) +{ + return true; +} diff --git a/src/codecs/link/cd_erspan2_module.h b/src/codecs/link/cd_erspan2_module.h new file mode 100644 index 000000000..2ff2f6454 --- /dev/null +++ b/src/codecs/link/cd_erspan2_module.h @@ -0,0 +1,38 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// cd_erspan2_module.h author Josh Rosenbaum + +#ifndef CD_ERSPAN2_MODULE_H +#define CD_ERSPAN2_MODULE_H + +#include "codecs/decode_module.h" + + +#define CD_ERSPAN2_NAME "codec_erspan2" + +class Erspan2Module : public DecodeModule +{ +public: + Erspan2Module(); + + bool set(const char*, Value&, SnortConfig*); +}; + +#endif diff --git a/src/codecs/link/cd_erspan3.cc b/src/codecs/link/cd_erspan3.cc index 0f9d67c82..839293074 100644 --- a/src/codecs/link/cd_erspan3.cc +++ b/src/codecs/link/cd_erspan3.cc @@ -22,7 +22,7 @@ #include "framework/codec.h" -#include "codecs/decode_module.h" +#include "codecs/link/cd_erspan3_module.h" #include "codecs/codec_events.h" #include "protocols/protocol_ids.h" @@ -33,7 +33,7 @@ namespace class Erspan3Codec : public Codec { public: - Erspan3Codec() : Codec("erspan3"){}; + Erspan3Codec() : Codec(CD_ERSPAN3_NAME){}; ~Erspan3Codec(){}; @@ -121,7 +121,17 @@ bool Erspan3Codec::decode(const uint8_t *raw_pkt, const uint32_t len, // api //------------------------------------------------------------------------- -static Codec* ctor() +static Module* mod_ctor() +{ + return new Erspan3Module; +} + +static void mod_dtor(Module* m) +{ + delete m; +} + +static Codec* ctor(Module*) { return new Erspan3Codec(); } @@ -132,16 +142,15 @@ static void dtor(Codec *cd) } -static const char* name = "erspan3"; static const CodecApi erspan3_api = { { PT_CODEC, - name, + CD_ERSPAN3_NAME, CDAPI_PLUGIN_V0, 0, - nullptr, - nullptr, + mod_ctor, + mod_dtor, }, nullptr, // pinit nullptr, // pterm diff --git a/src/codecs/link/cd_erspan3_module.cc b/src/codecs/link/cd_erspan3_module.cc new file mode 100644 index 000000000..25fd028bd --- /dev/null +++ b/src/codecs/link/cd_erspan3_module.cc @@ -0,0 +1,47 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// cd_erspan3_module.cc author Josh Rosenbaum + +#include "codecs/link/cd_erspan3_module.h" + + +static const Parameter erspan3_params[] = +{ + { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } +}; + + +static const RuleMap erspan3_rules[] = +{ + { DECODE_ERSPAN3_DGRAM_LT_HDR, "(" CD_ERSPAN3_NAME ") captured < ERSpan Type3 Header Length" }, + { 0, nullptr } +}; + +//------------------------------------------------------------------------- +// rpc module +//------------------------------------------------------------------------- + +Erspan3Module::Erspan3Module() : DecodeModule(CD_ERSPAN3_NAME, erspan3_params, erspan3_rules) +{ } + +bool Erspan3Module::set(const char*, Value&, SnortConfig*) +{ + return true; +} diff --git a/src/codecs/link/cd_erspan3_module.h b/src/codecs/link/cd_erspan3_module.h new file mode 100644 index 000000000..51f8c8f38 --- /dev/null +++ b/src/codecs/link/cd_erspan3_module.h @@ -0,0 +1,38 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// cd_erspan3_module.h author Josh Rosenbaum + +#ifndef CD_ERSPAN3_MODULE_H +#define CD_ERSPAN3_MODULE_H + +#include "codecs/decode_module.h" + + +#define CD_ERSPAN3_NAME "codec_erspan3" + +class Erspan3Module : public DecodeModule +{ +public: + Erspan3Module(); + + bool set(const char*, Value&, SnortConfig*); +}; + +#endif diff --git a/src/codecs/link/cd_ethloopback.cc b/src/codecs/link/cd_ethloopback.cc index 236902ec2..9a98a7bc1 100644 --- a/src/codecs/link/cd_ethloopback.cc +++ b/src/codecs/link/cd_ethloopback.cc @@ -27,10 +27,13 @@ namespace { +#define CD_ETHLOOPBACK_NAME "codec_ethloopback" + + class EthLoopbackCodec : public Codec { public: - EthLoopbackCodec() : Codec("ethloopback"){}; + EthLoopbackCodec() : Codec(CD_ETHLOOPBACK_NAME){}; ~EthLoopbackCodec(){}; @@ -57,12 +60,6 @@ bool EthLoopbackCodec::decode(const uint8_t* /*raw_pkt*/, const uint32_t /*raw_l { DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "EthLoopback is not supported.\n");); - -// loopbackstats.total_packets++; - -// if (p->greh != NULL) -// dc.gre_loopback++; - return true; } @@ -71,9 +68,7 @@ bool EthLoopbackCodec::decode(const uint8_t* /*raw_pkt*/, const uint32_t /*raw_l // api stuff //------------------------------------------------------------------------- - - -static Codec* ctor() +static Codec* ctor(Module*) { return new EthLoopbackCodec(); } @@ -83,12 +78,11 @@ static void dtor(Codec *cd) delete cd; } -static const char* name = "ethloopback"; static const CodecApi ethloopback_api = { { PT_CODEC, - name, + CD_ETHLOOPBACK_NAME, CDAPI_PLUGIN_V0, 0, nullptr, diff --git a/src/codecs/link/cd_mpls.cc b/src/codecs/link/cd_mpls.cc index da71004a9..00d14e450 100644 --- a/src/codecs/link/cd_mpls.cc +++ b/src/codecs/link/cd_mpls.cc @@ -31,6 +31,7 @@ #include "packet_io/active.h" #include "protocols/protocol_ids.h" #include "protocols/mpls.h" +#include "codecs/link/cd_mpls_module.h" namespace { @@ -38,7 +39,7 @@ namespace class MplsCodec : public Codec { public: - MplsCodec() : Codec("mpls"){}; + MplsCodec() : Codec(CD_MPLS_NAME){}; ~MplsCodec(){}; virtual void get_protocol_ids(std::vector& v); @@ -51,9 +52,8 @@ public: }; -const uint16_t ETHERNET_TYPE_MPLS_UNICAST = 0x8847; -const uint16_t ETHERNET_TYPE_MPLS_MULTICAST = 0x8848; - +const static uint16_t ETHERNET_TYPE_MPLS_UNICAST = 0x8847; +const static uint16_t ETHERNET_TYPE_MPLS_MULTICAST = 0x8848; const static uint32_t MPLS_HEADER_LEN = 4; const static uint32_t NUM_RESERVED_LABELS = 16; @@ -85,7 +85,6 @@ bool MplsCodec::decode(const uint8_t *raw_pkt, const uint32_t len, int iRet = 0; -// dc.mpls++; UpdateMPLSStats(&sfBase, len, Active_PacketWasDropped()); tmpMplsHdr = (uint32_t *) raw_pkt; p->mpls = NULL; @@ -96,7 +95,6 @@ bool MplsCodec::decode(const uint8_t *raw_pkt, const uint32_t len, { codec_events::decoder_event(p, DECODE_BAD_MPLS); -// dc.discards++; p->iph = NULL; p->family = NO_IP; return false; @@ -134,7 +132,6 @@ bool MplsCodec::decode(const uint8_t *raw_pkt, const uint32_t len, { codec_events::decoder_event(p, DECODE_MPLS_LABEL_STACK); -// dc.discards++; p->iph = NULL; p->family = NO_IP; return false; @@ -207,7 +204,6 @@ static int checkMplsHdr( else codec_events::decoder_event(p, DECODE_BAD_MPLS_LABEL2); - dc.discards++; p->iph = NULL; p->family = NO_IP; return(-1); @@ -218,7 +214,6 @@ static int checkMplsHdr( codec_events::decoder_event(p, DECODE_BAD_MPLS_LABEL1); -// dc.discards++; p->iph = NULL; p->family = NO_IP; iRet = MPLS_PAYLOADTYPE_ERROR; @@ -227,7 +222,6 @@ static int checkMplsHdr( case 3: codec_events::decoder_event(p, DECODE_BAD_MPLS_LABEL3); -// dc.discards++; p->iph = NULL; p->family = NO_IP; iRet = MPLS_PAYLOADTYPE_ERROR; @@ -260,7 +254,17 @@ static int checkMplsHdr( // api //------------------------------------------------------------------------- -static Codec* ctor() +static Module* mod_ctor() +{ + return new MplsModule; +} + +static void mod_dtor(Module* m) +{ + delete m; +} + +static Codec* ctor(Module*) { return new MplsCodec(); } @@ -270,16 +274,15 @@ static void dtor(Codec *cd) delete cd; } -static const char* name = "mpls"; static const CodecApi mpls_api = { - { - PT_CODEC, - name, - CDAPI_PLUGIN_V0, + { + PT_CODEC, + CD_MPLS_NAME, + CDAPI_PLUGIN_V0, 0, - nullptr, - nullptr, + mod_ctor, + mod_dtor, }, nullptr, // pinit nullptr, // pterm diff --git a/src/codecs/link/cd_mpls_module.cc b/src/codecs/link/cd_mpls_module.cc new file mode 100644 index 000000000..cf46002aa --- /dev/null +++ b/src/codecs/link/cd_mpls_module.cc @@ -0,0 +1,90 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// cd_mpls_module.cc author Josh Rosenbaum + +#include "codecs/link/cd_mpls_module.h" +#include "main/snort_config.h" +#include "main/snort.h" + +static const Parameter mpls_params[] = +{ + { "enable_mpls_multicast", Parameter::PT_BOOL, nullptr, "false", + "enables support for MPLS multicast" }, + + { "enable_mpls_overlapping_ip", Parameter::PT_BOOL, nullptr, "false", + "enable if private network addresses overlap and must be differentiated by MPLS label(s)" }, + + { "max_mpls_label_chain_len", Parameter::PT_INT, "-1:", "-1", + "set MPLS stack depth" }, + + { "mpls_payload_type", Parameter::PT_ENUM, "eth | ip4 | ip6", "ip4", + "set encapsulated payload type" }, + + { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } +}; + + +// rules which will loaded into snort. +// You can now reference these rules by calling a codec_event +// in your main codec's functions +static const RuleMap mpls_rules[] = +{ + { DECODE_BAD_MPLS, "(" CD_MPLS_NAME ") Bad MPLS Frame" }, + { DECODE_BAD_MPLS_LABEL0, "(" CD_MPLS_NAME ") MPLS Label 0 Appears in Nonbottom Header" }, + { DECODE_BAD_MPLS_LABEL1, "(" CD_MPLS_NAME ") MPLS Label 1 Appears in Bottom Header" }, + { DECODE_BAD_MPLS_LABEL2, "(" CD_MPLS_NAME ") MPLS Label 2 Appears in Nonbottom Header" }, + { DECODE_BAD_MPLS_LABEL3, "(" CD_MPLS_NAME ") MPLS Label 3 Appears in Header" }, + { DECODE_MPLS_RESERVED_LABEL, "(" CD_MPLS_NAME ") MPLS Label 4, 5,.. or 15 Appears in Header" }, + { DECODE_MPLS_LABEL_STACK, "(" CD_MPLS_NAME ") Too Many MPLS headers" }, + { 0, nullptr } +}; + +//------------------------------------------------------------------------- +// rpc module +//------------------------------------------------------------------------- + +MplsModule::MplsModule() : DecodeModule(CD_MPLS_NAME, mpls_params, mpls_rules) +{ } + +bool MplsModule::set(const char*, Value& v, SnortConfig* sc) +{ + if ( v.is("enable_mpls_multicast") ) + { + if ( v.get_bool() ) + sc->run_flags |= RUN_FLAG__MPLS_MULTICAST; // FIXIT move to existing bitfield + } + else if ( v.is("enable_mpls_overlapping_ip") ) + { + if ( v.get_bool() ) + sc->run_flags |= RUN_FLAG__MPLS_OVERLAPPING_IP; // FIXIT move to existing bitfield + } + else if ( v.is("max_mpls_label_chain_len") ) + sc->mpls_stack_depth = v.get_long(); + + else if ( v.is("mpls_payload_type") ) + sc->mpls_payload_type = v.get_long() + 1; + + else + return false; + + return true; +} + + diff --git a/src/codecs/link/cd_mpls_module.h b/src/codecs/link/cd_mpls_module.h new file mode 100644 index 000000000..cc64c6bf7 --- /dev/null +++ b/src/codecs/link/cd_mpls_module.h @@ -0,0 +1,40 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// cd_mpls_module.h author Josh Rosenbaum + +#ifndef CD_MPLS_MODULE_H +#define CD_MPLS_MODULE_H + +#include "codecs/decode_module.h" + + +#define CD_MPLS_NAME "codec_mpls" + +class MplsModule : public DecodeModule +{ +public: + MplsModule(); + + bool set(const char*, Value&, SnortConfig*); + +}; + +#endif + diff --git a/src/codecs/link/cd_pppencap.cc b/src/codecs/link/cd_pppencap.cc index c226f77dc..dfd41647d 100644 --- a/src/codecs/link/cd_pppencap.cc +++ b/src/codecs/link/cd_pppencap.cc @@ -24,24 +24,21 @@ #include "config.h" #endif - #include "framework/codec.h" -#include "codecs/decode_module.h" -#include "codecs/codec_events.h" #include "protocols/protocol_ids.h" #include "snort.h" -#include "main/snort_types.h" namespace { +#define CD_PPPENCAP_NAME "codec_ppp_encap" + class PppEncap : public Codec { public: - PppEncap() : Codec("ppp_encap"){}; + PppEncap() : Codec(CD_PPPENCAP_NAME){}; ~PppEncap(){}; - virtual void get_protocol_ids(std::vector& v); virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); @@ -101,8 +98,6 @@ bool PppEncap::decode(const uint8_t *raw_pkt, const uint32_t len, #endif /* WORDS_MUSTALIGN */ -// if (p->greh != NULL) -// dc.gre_ppp++; /* do a little validation: * @@ -181,7 +176,7 @@ bool PppEncap::decode(const uint8_t *raw_pkt, const uint32_t len, // api //------------------------------------------------------------------------- -static Codec* ctor() +static Codec* ctor(Module*) { return new PppEncap(); } @@ -191,12 +186,11 @@ static void dtor(Codec *cd) delete cd; } -static const char* name = "ppp_encap"; static const CodecApi pppencap_api = { { PT_CODEC, - name, + CD_PPPENCAP_NAME, CDAPI_PLUGIN_V0, 0, nullptr, diff --git a/src/codecs/link/cd_pppoepkt.cc b/src/codecs/link/cd_pppoepkt.cc index dd31db739..fd12d1b89 100644 --- a/src/codecs/link/cd_pppoepkt.cc +++ b/src/codecs/link/cd_pppoepkt.cc @@ -22,7 +22,7 @@ #include "framework/codec.h" -#include "codecs/decode_module.h" +#include "codecs/link/cd_pppoepkt_module.h" #include "codecs/codec_events.h" #include "protocols/packet.h" @@ -32,7 +32,7 @@ namespace class PPPoEPktCodec : public Codec { public: - PPPoEPktCodec() : Codec("ppp_over_eth"){}; + PPPoEPktCodec() : Codec(CD_PPPOEPKT_NAME){}; ~PPPoEPktCodec(){}; @@ -293,7 +293,17 @@ bool PPPoEPktCodec::encode(EncState* enc, Buffer* out, const uint8_t* raw_in) // api //------------------------------------------------------------------------- -static Codec* ctor() +static Module* mod_ctor() +{ + return new PPPoEPktModule; +} + +static void mod_dtor(Module* m) +{ + delete m; +} + +static Codec* ctor(Module *) { return new PPPoEPktCodec(); } @@ -303,16 +313,15 @@ static void dtor(Codec *cd) delete cd; } -static const char* name = "ppp_over_eth"; static const CodecApi pppoe_api = { { - PT_CODEC, - name, - CDAPI_PLUGIN_V0, + PT_CODEC, + CD_PPPOEPKT_NAME, + CDAPI_PLUGIN_V0, 0, - nullptr, - nullptr, + mod_ctor, + mod_dtor, }, nullptr, // pinit nullptr, // pterm diff --git a/src/codecs/link/cd_pppoepkt_module.cc b/src/codecs/link/cd_pppoepkt_module.cc new file mode 100644 index 000000000..25120b259 --- /dev/null +++ b/src/codecs/link/cd_pppoepkt_module.cc @@ -0,0 +1,47 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// cd_pppoepkt_module.cc author Josh Rosenbaum + +#include "codecs/link/cd_pppoepkt_module.h" + + +static const Parameter pppoepkt_params[] = +{ + { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } +}; + + +static const RuleMap pppoepkt_rules[] = +{ + { DECODE_BAD_PPPOE, "(" CD_PPPOEPKT_NAME ") Bad PPPOE frame detected" }, + { 0, nullptr } +}; + +//------------------------------------------------------------------------- +// rpc module +//------------------------------------------------------------------------- + +PPPoEPktModule::PPPoEPktModule() : DecodeModule(CD_PPPOEPKT_NAME, pppoepkt_params, pppoepkt_rules) +{ } + +bool PPPoEPktModule::set(const char*, Value&, SnortConfig*) +{ + return true; +} diff --git a/src/codecs/link/cd_pppoepkt_module.h b/src/codecs/link/cd_pppoepkt_module.h new file mode 100644 index 000000000..aa9988c61 --- /dev/null +++ b/src/codecs/link/cd_pppoepkt_module.h @@ -0,0 +1,38 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// cd_pppoepkt_module.h author Josh Rosenbaum + +#ifndef CD_PPPOEPKT_MODULE_H +#define CD_PPPOEPKT_MODULE_H + +#include "codecs/decode_module.h" + + +#define CD_PPPOEPKT_NAME "codec_pppoepkt" + +class PPPoEPktModule : public DecodeModule +{ +public: + PPPoEPktModule(); + + bool set(const char*, Value&, SnortConfig*); +}; + +#endif diff --git a/src/codecs/link/cd_transbridge.cc b/src/codecs/link/cd_transbridge.cc index 2ee44a59e..5e6489554 100644 --- a/src/codecs/link/cd_transbridge.cc +++ b/src/codecs/link/cd_transbridge.cc @@ -36,10 +36,12 @@ namespace { +#define CD_TRANSBRIDGE_NAME "codec_transbridge" + class TransbridgeCodec : public Codec { public: - TransbridgeCodec() : Codec("transbridge"){}; + TransbridgeCodec() : Codec(CD_TRANSBRIDGE_NAME){}; ~TransbridgeCodec(){}; @@ -77,8 +79,6 @@ void TransbridgeCodec::get_protocol_ids(std::vector& v) bool TransbridgeCodec::decode(const uint8_t *raw_pkt, const uint32_t len, Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) { -// dc.gre_eth++; - if(len < eth::hdr_len()) { codec_events::decoder_alert_encapsulated(p, DECODE_GRE_TRANS_DGRAM_LT_TRANSHDR, @@ -102,8 +102,7 @@ bool TransbridgeCodec::decode(const uint8_t *raw_pkt, const uint32_t len, // api //------------------------------------------------------------------------- - -static Codec* ctor() +static Codec* ctor(Module*) { return new TransbridgeCodec(); } @@ -113,12 +112,11 @@ static void dtor(Codec *cd) delete cd; } -static const char* name = "transbridge"; static const CodecApi transbridge_api = { { PT_CODEC, - name, + CD_TRANSBRIDGE_NAME, CDAPI_PLUGIN_V0, 0, nullptr, diff --git a/src/codecs/link/cd_vlan.cc b/src/codecs/link/cd_vlan.cc index 60caeb4bf..e2de8430f 100644 --- a/src/codecs/link/cd_vlan.cc +++ b/src/codecs/link/cd_vlan.cc @@ -27,9 +27,8 @@ #include "protocols/packet.h" #include "framework/codec.h" -#include "codecs/decode_module.h" +#include "codecs/link/cd_vlan_module.h" #include "codecs/codec_events.h" -#include "codecs/decode.h" namespace { @@ -37,12 +36,13 @@ namespace class VlanCodec : public Codec { public: - VlanCodec() : Codec("vlan"){}; + VlanCodec() : Codec(CD_VLAN_NAME){}; ~VlanCodec(){}; virtual void get_protocol_ids(std::vector& v); virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); + virtual void format(EncodeFlags, const Packet* p, Packet* c, Layer*); // DELETE from here and below @@ -53,6 +53,7 @@ public: } // namespace static const uint16_t ETHERNET_TYPE_8021Q = 0x8100; +static const unsigned int ETHERNET_MAX_LEN_ENCAP = 1518; /* 802.3 (+LLC) or ether II ? */ static inline uint32_t len_vlan_llc_other() @@ -70,17 +71,11 @@ void VlanCodec::get_protocol_ids(std::vector& v) bool VlanCodec::decode(const uint8_t *raw_pkt, const uint32_t len, Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) { -// dc.vlan++; - -// if (p->greh != NULL) -// dc.gre_vlan++; - if(len < sizeof(VlanTagHdr)) { codec_events::decoder_event(p, DECODE_BAD_VLAN); // TBD add decoder drop event for VLAN hdr len issue -// dc.discards++; p->iph = NULL; p->family = NO_IP; return false; @@ -107,7 +102,6 @@ bool VlanCodec::decode(const uint8_t *raw_pkt, const uint32_t len, { codec_events::decoder_event(p, DECODE_BAD_VLAN_ETHLLC); -// dc.discards++; p->iph = NULL; p->family = NO_IP; return false; @@ -127,7 +121,6 @@ bool VlanCodec::decode(const uint8_t *raw_pkt, const uint32_t len, { codec_events::decoder_event(p, DECODE_BAD_VLAN_OTHER); -// dc.discards++; p->iph = NULL; p->family = NO_IP; @@ -147,8 +140,6 @@ bool VlanCodec::decode(const uint8_t *raw_pkt, const uint32_t len, ntohs(p->ehllcother->proto_id)); ); -// PushLayer(PROTO_VLAN, p, pkt, sizeof(*p->vh)); - lyr_len = len_vlan_llc_other(); next_prot_id = ntohs(p->ehllcother->proto_id); } @@ -163,22 +154,31 @@ bool VlanCodec::decode(const uint8_t *raw_pkt, const uint32_t len, return true; } -#if 0 /* * ENCODER */ -void VLAN_Format (EncodeFlags, const Packet*, Packet* c, Layer* lyr) +void VlanCodec::format(EncodeFlags, const Packet* /*p*/, Packet* c, Layer*lyr) { c->vh = (VlanTagHdr*)lyr->start; } -#endif + //------------------------------------------------------------------------- // api //------------------------------------------------------------------------- -static Codec* ctor() +static Module* mod_ctor() +{ + return new VlanModule; +} + +static void mod_dtor(Module* m) +{ + delete m; +} + +static Codec* ctor(Module*) { return new VlanCodec(); } @@ -188,16 +188,16 @@ static void dtor(Codec *cd) delete cd; } -static const char* name = "vlan"; + static const CodecApi vlan_api = { { PT_CODEC, - name, + CD_VLAN_NAME, CDAPI_PLUGIN_V0, 0, - nullptr, - nullptr, + mod_ctor, + mod_dtor, }, nullptr, // pinit nullptr, // pterm diff --git a/src/codecs/link/cd_vlan_module.cc b/src/codecs/link/cd_vlan_module.cc new file mode 100644 index 000000000..4a5076f4b --- /dev/null +++ b/src/codecs/link/cd_vlan_module.cc @@ -0,0 +1,49 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// cd_vlan_module.cc author Josh Rosenbaum + +#include "codecs/link/cd_vlan_module.h" + + +static const Parameter vlan_params[] = +{ + { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } +}; + + +static const RuleMap vlan_rules[] = +{ + { DECODE_BAD_VLAN, "(" CD_VLAN_NAME ") Bad VLAN Frame" }, + { DECODE_BAD_VLAN_ETHLLC, "(" CD_VLAN_NAME ") Bad LLC header" }, + { DECODE_BAD_VLAN_OTHER, "(" CD_VLAN_NAME ") Bad Extra LLC Info" }, + { 0, nullptr } +}; + +//------------------------------------------------------------------------- +// rpc module +//------------------------------------------------------------------------- + +VlanModule::VlanModule() : DecodeModule(CD_VLAN_NAME, vlan_params, vlan_rules) +{ } + +bool VlanModule::set(const char*, Value&, SnortConfig*) +{ + return true; +} diff --git a/src/codecs/link/cd_vlan_module.h b/src/codecs/link/cd_vlan_module.h new file mode 100644 index 000000000..d4c5e7557 --- /dev/null +++ b/src/codecs/link/cd_vlan_module.h @@ -0,0 +1,38 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// cd_vlan_module.h author Josh Rosenbaum + +#ifndef CD_VLAN_MODULE_H +#define CD_VLAN_MODULE_H + +#include "codecs/decode_module.h" + + +#define CD_VLAN_NAME "codec_vlan" + +class VlanModule : public DecodeModule +{ +public: + VlanModule(); + + bool set(const char*, Value&, SnortConfig*); +}; + +#endif diff --git a/src/codecs/misc/CMakeLists.txt b/src/codecs/misc/CMakeLists.txt index 6af9b4969..142c34895 100644 --- a/src/codecs/misc/CMakeLists.txt +++ b/src/codecs/misc/CMakeLists.txt @@ -3,17 +3,19 @@ if(STATIC_DECODERS) set(PLUGIN_LIST cd_gtp.cc + cd_gtp_module.h + cd_gtp_module.cc cd_teredo.cc ) else() - add_shared_library(cd_gtp codecs cd_gtp.cc) + add_shared_library(cd_gtp codecs cd_gtp.cc cd_gtp_module.h cd_gtp_module.cc) add_shared_library(cd_teredo codecs cd_teredo.cc) endif() add_library( misc_codecs STATIC - cd_null.cc + cd_default.cc ${PLUGIN_LIST} ) diff --git a/src/codecs/misc/Makefile.am b/src/codecs/misc/Makefile.am index 044a65bb3..387c06f67 100644 --- a/src/codecs/misc/Makefile.am +++ b/src/codecs/misc/Makefile.am @@ -2,12 +2,14 @@ AUTOMAKE_OPTIONS=foreign no-dependencies noinst_LIBRARIES = libmisc_codecs.a libmisc_codecs_a_SOURCES = \ -cd_null.cc +cd_default.cc plugin_list = \ cd_gtp.cc \ +cd_gtp_module.h \ +cd_gtp_module.cc \ cd_teredo.cc if STATIC_DECODERS @@ -20,7 +22,7 @@ ehlibdir = $(pkglibdir)/codecs ehlib_LTLIBRARIES = libcd_gtp.la libcd_gtp_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO libcd_gtp_la_LDFLAGS = -export-dynamic -shared -libcd_gtp_la_SOURCES = cd_gtp.cc +libcd_gtp_la_SOURCES = cd_gtp.cc cd_gtp_module.h cd_gtp_module.cc ehlib_LTLIBRARIES += libcd_teredo.la libcd_teredo_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO diff --git a/src/codecs/misc/cd_null.cc b/src/codecs/misc/cd_default.cc similarity index 78% rename from src/codecs/misc/cd_null.cc rename to src/codecs/misc/cd_default.cc index b97434cfb..60bf01518 100644 --- a/src/codecs/misc/cd_null.cc +++ b/src/codecs/misc/cd_default.cc @@ -32,21 +32,27 @@ namespace { -class NullCodec : public Codec +#define CD_DEFAULT_NAME "codec_default" + +class DefaultCodec : public Codec { public: - NullCodec() : Codec("null"){}; - ~NullCodec(){}; + DefaultCodec() : Codec(CD_DEFAULT_NAME){}; + ~DefaultCodec(){}; virtual void get_protocol_ids(std::vector& v); virtual bool decode(const uint8_t*, const uint32_t, Packet*, uint16_t&, uint16_t&) { return false; }; - virtual bool is_default_codec() { return true; }; }; } // namespace +void DefaultCodec::get_protocol_ids(std::vector& v) +{ + v.push_back(FINISHED_DECODE); +} + //------------------------------------------------------------------------- @@ -54,16 +60,9 @@ public: //------------------------------------------------------------------------- - -void NullCodec::get_protocol_ids(std::vector& v) -{ - v.push_back(FINISHED_DECODE); - // placeholder to avoid error -} - -static Codec* ctor() +static Codec* ctor(Module*) { - return new NullCodec(); + return new DefaultCodec(); } static void dtor(Codec *cd) @@ -72,23 +71,22 @@ static void dtor(Codec *cd) } -static const char* name = "null"; -static const CodecApi null_api = +static const CodecApi default_api = { { PT_CODEC, - name, + CD_DEFAULT_NAME, CDAPI_PLUGIN_V0, 0, nullptr, nullptr, }, - NULL, // pinit - NULL, // pterm - NULL, // tinit - NULL, // tterm + nullptr, // pinit + nullptr, // pterm + nullptr, // tinit + nullptr, // tterm ctor, // ctor dtor, // dtor }; -const BaseApi* cd_null = &null_api.base; +const CodecApi* default_codec = &default_api; diff --git a/src/codecs/misc/cd_gtp.cc b/src/codecs/misc/cd_gtp.cc index b14cd6a26..347a5d351 100644 --- a/src/codecs/misc/cd_gtp.cc +++ b/src/codecs/misc/cd_gtp.cc @@ -28,7 +28,7 @@ #include "packet.h" #include "snort_debug.h" #include "framework/codec.h" -#include "codecs/decode_module.h" +#include "codecs/misc/cd_gtp_module.h" #include "codecs/codec_events.h" #include "snort.h" #include "protocols/ipv4.h" @@ -43,7 +43,7 @@ namespace class GtpCodec : public Codec { public: - GtpCodec() : Codec("gtp"){}; + GtpCodec() : Codec(CD_GTP_NAME){}; ~GtpCodec(){}; virtual void get_protocol_ids(std::vector& v); @@ -284,7 +284,17 @@ bool GtpCodec::update (Packet*, Layer* lyr, uint32_t* len) // api //------------------------------------------------------------------------- -static Codec* ctor() +static Module* mod_ctor() +{ + return new GtpModule; +} + +static void mod_dtor(Module* m) +{ + delete m; +} + +static Codec* ctor(Module*) { return new GtpCodec(); } @@ -294,21 +304,20 @@ static void dtor(Codec *cd) delete cd; } -static const char* name = "gtp"; static const CodecApi gtp_api = { { PT_CODEC, - name, + CD_GTP_NAME, CDAPI_PLUGIN_V0, 0, - nullptr, - nullptr + mod_ctor, + mod_dtor }, - NULL, // pinit - NULL, // pterm - NULL, // tinit - NULL, // tterm + nullptr, // pinit + nullptr, // pterm + nullptr, // tinit + nullptr, // tterm ctor, // ctor dtor, // dtor }; diff --git a/src/codecs/misc/cd_gtp_module.cc b/src/codecs/misc/cd_gtp_module.cc new file mode 100644 index 000000000..34966224f --- /dev/null +++ b/src/codecs/misc/cd_gtp_module.cc @@ -0,0 +1,49 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// cd_gtp_module.cc author Josh Rosenbaum + +#include "codecs/misc/cd_gtp_module.h" + + +static const Parameter gtp_params[] = +{ + { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } +}; + + +static const RuleMap gtp_rules[] = +{ + + { DECODE_GTP_MULTIPLE_ENCAPSULATION, "(" CD_GTP_NAME ") Two or more GTP encapsulation layers present" }, + { DECODE_GTP_BAD_LEN, "(" CD_GTP_NAME ") GTP header length is invalid" }, + { 0, nullptr } +}; + +//------------------------------------------------------------------------- +// rpc module +//------------------------------------------------------------------------- + +GtpModule::GtpModule() : DecodeModule(CD_GTP_NAME, gtp_params, gtp_rules) +{ } + +bool GtpModule::set(const char*, Value&, SnortConfig*) +{ + return true; +} diff --git a/src/codecs/misc/cd_gtp_module.h b/src/codecs/misc/cd_gtp_module.h new file mode 100644 index 000000000..2cc2a0012 --- /dev/null +++ b/src/codecs/misc/cd_gtp_module.h @@ -0,0 +1,38 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// cd_gtp_module.h author Josh Rosenbaum + +#ifndef CD_GTP_MODULE_H +#define CD_GTP_MODULE_H + +#include "codecs/decode_module.h" + + +#define CD_GTP_NAME "codec_gtp" + +class GtpModule : public DecodeModule +{ +public: + GtpModule(); + + bool set(const char*, Value&, SnortConfig*); +}; + +#endif diff --git a/src/codecs/misc/cd_teredo.cc b/src/codecs/misc/cd_teredo.cc index 75764a7b2..af20c9ba3 100644 --- a/src/codecs/misc/cd_teredo.cc +++ b/src/codecs/misc/cd_teredo.cc @@ -40,10 +40,12 @@ namespace { +#define CD_TEREDO_NAME "codec_teredo" + class TeredoCodec : public Codec { public: - TeredoCodec() : Codec("teredo"){}; + TeredoCodec() : Codec(CD_TEREDO_NAME){}; ~TeredoCodec(){}; virtual void get_protocol_ids(std::vector& v); @@ -100,7 +102,7 @@ bool TeredoCodec::decode(const uint8_t *raw_pkt, const uint32_t len, if ( ScTunnelBypassEnabled(TUNNEL_TEREDO) ) Active_SetTunnelBypass(); - if (ScDeepTeredoInspection() && (!teredo::is_teredo_port(p->sp)) && (!teredo::is_teredo_port(p->dp))) + if ((!teredo::is_teredo_port(p->sp)) && (!teredo::is_teredo_port(p->dp))) p->packet_flags |= PKT_UNSURE_ENCAP; next_prot_id = IPPROTO_IPV6; @@ -110,13 +112,11 @@ bool TeredoCodec::decode(const uint8_t *raw_pkt, const uint32_t len, return false; } - - //------------------------------------------------------------------------- // api //------------------------------------------------------------------------- -static Codec* ctor() +static Codec* ctor(Module*) { return new TeredoCodec(); } @@ -126,12 +126,11 @@ static void dtor(Codec *cd) delete cd; } -static const char* name = "teredo"; static const CodecApi teredo_api = { { PT_CODEC, - name, + CD_TEREDO_NAME, CDAPI_PLUGIN_V0, 0, nullptr, diff --git a/src/codecs/root/CMakeLists.txt b/src/codecs/root/CMakeLists.txt index 1a549ce51..4d6b6abc8 100644 --- a/src/codecs/root/CMakeLists.txt +++ b/src/codecs/root/CMakeLists.txt @@ -15,10 +15,14 @@ endif(ENABLE_NON_ETHER_DECODERS) if (ENABLE_NON_ETHER_DECODERS) set(NON_ETHER_DECODERS - root_trk.cc + cd_trk.cc + cd_trk_module.h + cd_trk_module.cc root_fddi.cc root_linuxsll.cc - root_ieee80211.cc + cd_ieee80211.cc + cd_ieee80211_module.h + cd_ieee80211_module.cc root_slip.cc root_i4lrawip.cc root_oldpflog.cc @@ -36,6 +40,8 @@ endif (ENABLE_NON_ETHER_DECODERS) add_library(root_codecs STATIC cd_eth.cc + cd_eth_module.h + cd_eth_module.cc cd_raw4.cc cd_raw6.cc cd_null_root.cc diff --git a/src/codecs/root/Makefile.am b/src/codecs/root/Makefile.am index 97c64fc58..88a2c2bff 100644 --- a/src/codecs/root/Makefile.am +++ b/src/codecs/root/Makefile.am @@ -3,6 +3,8 @@ AUTOMAKE_OPTIONS=foreign no-dependencies noinst_LIBRARIES = libroot_codecs.a libroot_codecs_a_SOURCES = \ cd_eth.cc \ +cd_eth_module.h \ +cd_eth_module.cc \ cd_raw4.cc \ cd_raw6.cc \ cd_null_root.cc @@ -12,10 +14,14 @@ cd_null_root.cc if ENABLE_NON_ETHER_DECODER if STATIC_DECODERS libroot_codecs_a_SOURCES += \ -root_trk.cc \ +cd_trk.cc \ +cd_trk_module.h \ +cd_trk_module.cc \ root_fddi.cc \ root_linuxsll.cc \ -root_ieee80211.cc \ +cd_ieee80211.cc \ +cd_ieee80211_module.h \ +cd_ieee80211_module.cc \ root_slip.cc \ root_i4lrawip.cc \ root_oldpflog.cc \ @@ -34,7 +40,7 @@ ehlibdir = $(pkglibdir)/codecs ehlib_LTLIBRARIES = libcd_trk.la libcd_trk_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO libcd_trk_la_LDFLAGS = -export-dynamic -shared -libcd_trk_la_SOURCES = root_trk.cc +libcd_trk_la_SOURCES = cd_trk.cc cd_trk_module.h cd_trk_module.cc endif endif diff --git a/src/codecs/root/cd_eth.cc b/src/codecs/root/cd_eth.cc index feada7e3b..4ccedb3f9 100644 --- a/src/codecs/root/cd_eth.cc +++ b/src/codecs/root/cd_eth.cc @@ -26,7 +26,7 @@ #endif #include -#include "codecs/decode_module.h" +#include "codecs/root/cd_eth_module.h" #include "framework/codec.h" #include "time/profiler.h" #include "protocols/packet.h" @@ -40,7 +40,7 @@ namespace class EthCodec : public Codec { public: - EthCodec() : Codec("eth"){}; + EthCodec() : Codec(CD_ETH_NAME){}; ~EthCodec(){}; @@ -99,8 +99,6 @@ bool EthCodec::decode(const uint8_t *raw_pkt, const uint32_t len, codec_events::decoder_event(p, DECODE_ETH_HDR_TRUNC); -// dc.discards++; -// dc.ethdisc++; return false; } @@ -127,10 +125,6 @@ bool EthCodec::decode(const uint8_t *raw_pkt, const uint32_t len, return true; } -// add this alert type -// if(len > MAX_LENGTH) { -// CodecEvents::decoder_event(p, DECODE_ETH_INVALID_FRAME); - return false; } @@ -215,7 +209,17 @@ void EthCodec::format(EncodeFlags f, const Packet* p, Packet* c, Layer* lyr) // api //------------------------------------------------------------------------- -static Codec* ctor() +static Module* mod_ctor() +{ + return new EthModule; +} + +static void mod_dtor(Module* m) +{ + delete m; +} + +static Codec* ctor(Module*) { return new EthCodec(); } @@ -225,16 +229,15 @@ static void dtor(Codec *cd) delete cd; } -static const char* name = "eth"; static const CodecApi eth_api = { { PT_CODEC, - name, + CD_ETH_NAME, CDAPI_PLUGIN_V0, 0, - nullptr, - nullptr, + mod_ctor, + mod_dtor, }, nullptr, // pinit nullptr, // pterm diff --git a/src/codecs/root/cd_eth_module.cc b/src/codecs/root/cd_eth_module.cc new file mode 100644 index 000000000..9b0e001ae --- /dev/null +++ b/src/codecs/root/cd_eth_module.cc @@ -0,0 +1,47 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// cd_eth_module.cc author Josh Rosenbaum + +#include "codecs/root/cd_eth_module.h" + + +static const Parameter eth_params[] = +{ + { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } +}; + + +static const RuleMap eth_rules[] = +{ + { DECODE_ETH_HDR_TRUNC, "(" CD_ETH_NAME ") truncated eth header" }, + { 0, nullptr } +}; + +//------------------------------------------------------------------------- +// rpc module +//------------------------------------------------------------------------- + +EthModule::EthModule() : DecodeModule(CD_ETH_NAME, eth_params, eth_rules) +{ } + +bool EthModule::set(const char*, Value&, SnortConfig*) +{ + return true; +} diff --git a/src/codecs/root/cd_eth_module.h b/src/codecs/root/cd_eth_module.h new file mode 100644 index 000000000..e1fef3fdf --- /dev/null +++ b/src/codecs/root/cd_eth_module.h @@ -0,0 +1,38 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// cd_eth_module.h author Josh Rosenbaum + +#ifndef CD_ETH_MODULE_H +#define CD_ETH_MODULE_H + +#include "codecs/decode_module.h" + + +#define CD_ETH_NAME "codec_eth" + +class EthModule : public DecodeModule +{ +public: + EthModule(); + + bool set(const char*, Value&, SnortConfig*); +}; + +#endif diff --git a/src/codecs/root/root_ieee80211.cc b/src/codecs/root/cd_ieee80211.cc similarity index 98% rename from src/codecs/root/root_ieee80211.cc rename to src/codecs/root/cd_ieee80211.cc index 5d47f4c84..64abbc637 100644 --- a/src/codecs/root/root_ieee80211.cc +++ b/src/codecs/root/cd_ieee80211.cc @@ -34,6 +34,10 @@ #include "../decoder_includes.h" + +#define MINIMAL_IEEE80211_HEADER_LEN 10 /* Ack frames and others */ +#define IEEE802_11_DATA_HDR_LEN 24 /* Header for data packets */ + /* * Function: DecodeIEEE80211Pkt(Packet *, char *, DAQ_PktHdr_t*, * uint8_t*) diff --git a/src/codecs/root/cd_ieee80211_module.cc b/src/codecs/root/cd_ieee80211_module.cc new file mode 100644 index 000000000..aa7996b79 --- /dev/null +++ b/src/codecs/root/cd_ieee80211_module.cc @@ -0,0 +1,48 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// cd_ieee8021_module.cc author Josh Rosenbaum + +#include "codecs/root/cd_ieee8021_module.h" + + +static const Parameter ieee80211_params[] = +{ + { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } +}; + + +static const RuleMap iee80211_rules[] = +{ + { DECODE_BAD_80211_ETHLLC, "(" CD_IEEE80211_NAME ") Bad 802.11 LLC header" }, + { DECODE_BAD_80211_OTHER, "(" CD_IEEE80211_NAME ") Bad 802.11 Extra LLC Info" }, + { 0, nullptr } +}; + +//------------------------------------------------------------------------- +// rpc module +//------------------------------------------------------------------------- + +Ieee80211Module::Ieee80211Module() : DecodeModule(CD_IEEE80211_NAME, ieee80211_params, iee80211_rules) +{ } + +bool Ieee80211Module::set(const char*, Value&, SnortConfig*) +{ + return true; +} diff --git a/src/codecs/root/cd_ieee80211_module.h b/src/codecs/root/cd_ieee80211_module.h new file mode 100644 index 000000000..f672716d7 --- /dev/null +++ b/src/codecs/root/cd_ieee80211_module.h @@ -0,0 +1,38 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// cd_ieee8021_module.h author Josh Rosenbaum + +#ifndef CD_IEEE80211_MODULE_H +#define CD_IEEE80211_MODULE_H + +#include "codecs/decode_module.h" + + +#define CD_IEEE80211_NAME "codec_ieee80211" + +class Ieee80211Module : public DecodeModule +{ +public: + Ieee80211Module(); + + bool set(const char*, Value&, SnortConfig*); +}; + +#endif diff --git a/src/codecs/root/cd_null_root.cc b/src/codecs/root/cd_null_root.cc index bcdb1ecf0..4fc68fbbe 100644 --- a/src/codecs/root/cd_null_root.cc +++ b/src/codecs/root/cd_null_root.cc @@ -25,8 +25,6 @@ #endif #include "framework/codec.h" -#include "codecs/decode_module.h" -#include "codecs/codec_events.h" #include "protocols/protocol_ids.h" #include "main/snort.h" #include @@ -35,10 +33,12 @@ namespace { +#define CD_NULL_NAME "codec_null" + class NullRootCodec : public Codec { public: - NullRootCodec() : Codec("null_root"){}; + NullRootCodec() : Codec(CD_NULL_NAME){}; ~NullRootCodec() {}; @@ -93,13 +93,11 @@ void NullRootCodec::get_data_link_type(std::vector&v) v.push_back(DLT_NULL); } - - //------------------------------------------------------------------------- // api //------------------------------------------------------------------------- -static Codec* ctor() +static Codec* ctor(Module*) { return new NullRootCodec(); } @@ -109,14 +107,12 @@ static void dtor(Codec *cd) delete cd; } - -static const char* name = "null_root"; static const CodecApi null_root_api = { - { - PT_CODEC, - name, - CDAPI_PLUGIN_V0, + { + PT_CODEC, + CD_NULL_NAME, + CDAPI_PLUGIN_V0, 0, nullptr, nullptr, diff --git a/src/codecs/root/cd_raw4.cc b/src/codecs/root/cd_raw4.cc index 0f1a6bb10..0258dd5a4 100644 --- a/src/codecs/root/cd_raw4.cc +++ b/src/codecs/root/cd_raw4.cc @@ -20,14 +20,11 @@ // cd_raw4.cc author Josh Rosenbaum - #ifdef HAVE_CONFIG_H #include "config.h" #endif #include "framework/codec.h" -#include "codecs/decode_module.h" -#include "codecs/codec_events.h" #include "protocols/protocol_ids.h" #include @@ -35,10 +32,12 @@ namespace { +#define CD_RAW4_NAME "codec_raw4" + class Raw4Codec : public Codec { public: - Raw4Codec() : Codec("raw4"){}; + Raw4Codec() : Codec(CD_RAW4_NAME){}; ~Raw4Codec() {}; @@ -91,7 +90,7 @@ void Raw4Codec::get_data_link_type(std::vector&v) // api //------------------------------------------------------------------------- -static Codec* ctor() +static Codec* ctor(Module*) { return new Raw4Codec(); } @@ -101,13 +100,11 @@ static void dtor(Codec *cd) delete cd; } - -static const char* name = "raw4"; static const CodecApi raw4_api = { { PT_CODEC, - name, + CD_RAW4_NAME, CDAPI_PLUGIN_V0, 0, nullptr, diff --git a/src/codecs/root/cd_raw6.cc b/src/codecs/root/cd_raw6.cc index e29911d5f..6800a1577 100644 --- a/src/codecs/root/cd_raw6.cc +++ b/src/codecs/root/cd_raw6.cc @@ -25,8 +25,6 @@ #endif #include "framework/codec.h" -#include "codecs/decode_module.h" -#include "codecs/codec_events.h" #include "protocols/protocol_ids.h" #include @@ -34,13 +32,14 @@ namespace { +#define CD_RAW6_NAME "codec_raw6" + class Raw6Codec : public Codec { public: - Raw6Codec() : Codec("raw6"){}; + Raw6Codec() : Codec(CD_RAW6_NAME){}; ~Raw6Codec() {}; - virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); virtual void get_data_link_type(std::vector&); @@ -70,7 +69,7 @@ void Raw6Codec::get_data_link_type(std::vector&v) // api //------------------------------------------------------------------------- -static Codec* ctor() +static Codec* ctor(Module*) { return new Raw6Codec(); } @@ -80,13 +79,11 @@ static void dtor(Codec *cd) delete cd; } - -static const char* name = "raw6"; static const CodecApi raw6_api = { { PT_CODEC, - name, + CD_RAW6_NAME, CDAPI_PLUGIN_V0, 0, nullptr, diff --git a/src/codecs/root/root_trk.cc b/src/codecs/root/cd_trk.cc similarity index 89% rename from src/codecs/root/root_trk.cc rename to src/codecs/root/cd_trk.cc index 0f14e7a37..c9ccfa8a8 100644 --- a/src/codecs/root/root_trk.cc +++ b/src/codecs/root/cd_trk.cc @@ -26,12 +26,32 @@ #include "config.h" #endif -#include "generators.h" -#include "decode.h" -#include "static_include.h" +#include "decode.h" -#include "../decoder_includes.h" + + + +// THESE ARE NEVER USED!! +#define MINIMAL_TOKENRING_HEADER_LEN 22 +#define TR_HLEN MINIMAL_TOKENRING_HEADER_LEN +#define TOKENRING_LLC_LEN 8 +// DELETE FIN + +#define TR_ALEN 6 /* octets in an Ethernet header */ +#define IPARP_SAP 0xaa + +#define AC 0x10 +#define LLC_FRAME 0x40 + +#define TRMTU 2000 /* 2000 bytes */ +#define TR_RII 0x80 +#define TR_RCF_DIR_BIT 0x80 +#define TR_RCF_LEN_MASK 0x1f00 +#define TR_RCF_BROADCAST 0x8000 /* all-routes broadcast */ +#define TR_RCF_LIMITED_BROADCAST 0xC000 /* single-route broadcast */ +#define TR_RCF_FRAME2K 0x20 +#define TR_RCF_BROADCAST_MASK 0xC000 /* * Function: DecodeTRPkt(Packet *, char *, DAQ_PktHdr_t*, uint8_t*) diff --git a/src/codecs/root/cd_trk_module.cc b/src/codecs/root/cd_trk_module.cc new file mode 100644 index 000000000..75abf16a3 --- /dev/null +++ b/src/codecs/root/cd_trk_module.cc @@ -0,0 +1,50 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// cd_arp_module.cc author Josh Rosenbaum + +#include "codecs/root/cd_trk_module.h" + + +static const Parameter trk_params[] = +{ + { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } +}; + + +static const RuleMap trk_rules[] = +{ + { DECODE_BAD_TRH, "(" CD_TRK_NAME ") Bad Token Ring Header" }, + { DECODE_BAD_TR_ETHLLC, "(" CD_TRK_NAME ") Bad Token Ring ETHLLC Header" }, + { DECODE_BAD_TR_MR_LEN, "(" CD_TRK_NAME ") Bad Token Ring MRLENHeader" }, + { DECODE_BAD_TRHMR, "(" CD_TRK_NAME ") Bad Token Ring MR Header" }, + { 0, nullptr } +}; + +//------------------------------------------------------------------------- +// token ring module +//------------------------------------------------------------------------- + +TrkModule::TrkModule() : DecodeModule(CD_TRK_NAME, trk_params, trk_rules) +{ } + +bool TrkModule::set(const char*, Value&, SnortConfig*) +{ + return true; +} diff --git a/src/codecs/root/cd_trk_module.h b/src/codecs/root/cd_trk_module.h new file mode 100644 index 000000000..3f7810416 --- /dev/null +++ b/src/codecs/root/cd_trk_module.h @@ -0,0 +1,38 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// cd_trk_module.h author Josh Rosenbaum + +#ifndef CD_TRK_MODULE_H +#define CD_TRK_MODULE_H + +#include "codecs/decode_module.h" + + +#define CD_TRK_NAME "codec_trk" + +class TrkModule : public DecodeModule +{ +public: + TrkModule(); + + bool set(const char*, Value&, SnortConfig*); +}; + +#endif diff --git a/src/codecs/root/root_enc.cc b/src/codecs/root/root_enc.cc index 8e8640d55..3a8006afc 100644 --- a/src/codecs/root/root_enc.cc +++ b/src/codecs/root/root_enc.cc @@ -34,6 +34,16 @@ #include "../decoder_includes.h" + +/* enc interface */ +struct enc_header { + uint32_t af; + uint32_t spi; + uint32_t flags; +}; +#define ENC_HEADER_LEN 12 + + #ifdef DLT_ENC /* see http://sourceforge.net/mailarchive/message.php?msg_id=1000380 */ /* diff --git a/src/codecs/root/root_trk.h b/src/codecs/root/root_trk.h deleted file mode 100644 index 57e7051a6..000000000 --- a/src/codecs/root/root_trk.h +++ /dev/null @@ -1,50 +0,0 @@ -/* -** Copyright (C) 2002-2013 Sourcefire, Inc. -** Copyright (C) 1998-2002 Martin Roesch -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - - -#ifndef ROOT_TRK_H -#define ROOT_TRK_H - -// THESE ARE NEVER USED!! -#define MINIMAL_TOKENRING_HEADER_LEN 22 -#define TR_HLEN MINIMAL_TOKENRING_HEADER_LEN -#define TOKENRING_LLC_LEN 8 -// DELETE FIN - -#define TR_ALEN 6 /* octets in an Ethernet header */ -#define IPARP_SAP 0xaa - -#define AC 0x10 -#define LLC_FRAME 0x40 - -#define TRMTU 2000 /* 2000 bytes */ -#define TR_RII 0x80 -#define TR_RCF_DIR_BIT 0x80 -#define TR_RCF_LEN_MASK 0x1f00 -#define TR_RCF_BROADCAST 0x8000 /* all-routes broadcast */ -#define TR_RCF_LIMITED_BROADCAST 0xC000 /* single-route broadcast */ -#define TR_RCF_FRAME2K 0x20 -#define TR_RCF_BROADCAST_MASK 0xC000 - - -void DecodeTRPkt(Packet *, const DAQ_PktHdr_t*, const uint8_t *); - -#endif /* PROT_TRK_H */ - diff --git a/src/codecs/template.cc b/src/codecs/template.cc index 135663538..445db72c3 100644 --- a/src/codecs/template.cc +++ b/src/codecs/template.cc @@ -24,18 +24,26 @@ #include "config.h" #endif +#include // memcpy #include "framework/codec.h" -#include "codecs/decode_module.h" -#include "codecs/codec_events.h" +#include "codecs/template_module.h" namespace { +// yes, macros are necessary. The API and class constructor require different strings. +// +// this macros is defined in the module to ensure identical names. However, +// if you don't want a module, define the name here. +#ifndef CODEC_NAME +#define CODEC_NAME "name" +#endif + class NameCodec : public Codec { public: - NameCodec() : Codec("name"){}; + NameCodec() : Codec(CODEC_NAME){}; ~NameCodec() {}; @@ -127,6 +135,22 @@ void NameCodec::format(EncodeFlags, const Packet* p, Packet* c, Layer*) // api //------------------------------------------------------------------------- +/* + * Modules create custom configuration options which can be used in snort.lua. + * If you don't want any configuration options, remove the mod_ctor + * and mod_dtor functions from the api below. See documentation for additional + * details regarding Modules + */ +static Module* mod_ctor() +{ + return new NameModule; +} + +static void mod_dtor(Module* m) +{ + delete m; +} + static void ginit() { // initialize global variables @@ -147,7 +171,7 @@ static void tterm() // cleanup any thread_local variables } -static Codec* ctor() +static Codec* ctor(Module*) { return new NameCodec(); } @@ -158,23 +182,22 @@ static void dtor(Codec *cd) } -static const char* const name = "name"; static const CodecApi name_api = { { PT_CODEC, - name, + CODEC_NAME, CDAPI_PLUGIN_V0, 0, - nullptr, - nullptr, + mod_ctor, // module constructor ( see function for details ) + mod_dtor // module destructor ( see function for details ) }, - ginit, // pinit - gterm, // pterm - tinit, // tinit - tterm, // tterm - ctor, // ctor - dtor, // dtor + ginit, // global initializer + gterm, // global terminate + tinit, // thread local initializer + tterm, // thread local terminate + ctor, // constructor --> REQUIRED. return a newly create Codec + dtor, // desctructor --> REQUIRED. destory the Codec. }; diff --git a/src/codecs/template_module.cc b/src/codecs/template_module.cc new file mode 100644 index 000000000..eb15a7172 --- /dev/null +++ b/src/codecs/template_module.cc @@ -0,0 +1,65 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// template_module.cc author Josh Rosenbaum + +#include "codecs/template_module.h" + + +static const Parameter codec_params[] = +{ + { "parameter1", Parameter::PT_BOOL, nullptr, "false", + "This is a boolean parameter" }, + + { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } +}; + + +// rules which will loaded into snort. +// You can now reference these rules by calling a codec_event +// in your main codec's functions +static const RuleMap codec_rules[] = +{ + { SID, "(" CODEC_NAME ") alert message" }, + { 0, nullptr } +}; + +//------------------------------------------------------------------------- +// rpc module +//------------------------------------------------------------------------- + +NameCodec::NameCodec() : DecodeModule(CODEC_NAME, codec_params, codec_rules) +{ } + +bool NameCodec::set(const char*, Value& v, SnortConfig* sc) +{ + if ( v.is("parameter1") ) + option1 = v.get_bool(); + + else + return false; + + return true; +} + +bool NameCodec::begin(const char*, int, SnortConfig*) +{ + option1 = false; + return true; +} diff --git a/src/codecs/template_module.h b/src/codecs/template_module.h new file mode 100644 index 000000000..09baa2032 --- /dev/null +++ b/src/codecs/template_module.h @@ -0,0 +1,49 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// template_module.h author Josh Rosenbaum + +#ifndef TEMPLATE_MODULE_H +#define TEMPLATE_MODULE_H + +#include "codecs/decode_module.h" + + +#define CODEC_NAME "name" + +// inherit from DecodeModule rather than Module so the GID for +// all codecs are identical. Additionally, all of the SIDS are +// defined in DecodeModule. So, when creating new events, you +// only need to look for codec SID collisions in one locations +class NameModule : public DecodeModule +{ +public: + NameModule(); + + bool set(const char*, Value&, SnortConfig*); + bool begin(const char*, int, SnortConfig*); + +private: + // any structs or options which will be used when constructing + // the Codec + bool option1; + +}; + +#endif diff --git a/src/framework/codec.h b/src/framework/codec.h index 92e1e9803..28b22320f 100644 --- a/src/framework/codec.h +++ b/src/framework/codec.h @@ -131,8 +131,6 @@ public: // Get the codec's name inline const char* get_name(){return name; }; - // used by packet manager to determine the default/null codec - virtual bool is_default_codec() { return false; }; // Registers this Codec's data link type (as defined by libpcap) virtual void get_data_link_type(std::vector&) {}; // Register the code's protocol ID's and Ethertypes @@ -203,7 +201,7 @@ private: // to be useful, these must be explicit (*_V0, *_V1, ...) #define CDAPI_PLUGIN_V0 0 -typedef Codec* (*cd_new_f)(); +typedef Codec* (*cd_new_f)(Module*); typedef void (*cd_del_f)(Codec *); typedef void (*cd_aux_f)(); typedef void (*cd_dlt_f)(std::vector&v); diff --git a/src/main/modules.cc b/src/main/modules.cc index 7885f3f4c..b857c8657 100644 --- a/src/main/modules.cc +++ b/src/main/modules.cc @@ -890,6 +890,12 @@ static const Parameter daq_params[] = { "var", Parameter::PT_STRING, nullptr, nullptr, "list of name=value DAQ-specific parameters" }, + { "snaplen", Parameter::PT_INT, "0:65535", "deflt", + "set snap length (same as -P)" }, + + { "decode_data_link", Parameter::PT_BOOL, nullptr, "false", + "display the second layer header info" }, + { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; @@ -919,6 +925,14 @@ bool DaqModule::set(const char*, Value& v, SnortConfig* sc) else if ( v.is("var") ) ConfigDaqVar(sc, v.get_string()); + else if ( v.is("decode_data_link") ) + { + if ( v.get_bool() ) + ConfigDecodeDataLink(sc, ""); + } + else if ( v.is("snaplen") ) + ConfigPacketSnaplen(sc, v.get_string()); + else return false; @@ -1866,7 +1880,6 @@ void module_init() // these modules could be in traffic policy ModuleManager::add_module(new ActiveModule); - ModuleManager::add_module(new DecodeModule); ModuleManager::add_module(new FileIdModule); #ifdef PPM_MGR diff --git a/src/managers/CMakeLists.txt b/src/managers/CMakeLists.txt index cfc82c2ae..388998892 100644 --- a/src/managers/CMakeLists.txt +++ b/src/managers/CMakeLists.txt @@ -44,4 +44,3 @@ target_link_libraries(managers install (FILES ${LUA_INCLUDES} DESTINATION "${INCLUDE_INSTALL_PATH}/lua" ) - diff --git a/src/managers/packet_manager.cc b/src/managers/packet_manager.cc index e6b509b9b..3b808f366 100644 --- a/src/managers/packet_manager.cc +++ b/src/managers/packet_manager.cc @@ -18,10 +18,11 @@ */ // packet_manager.cc author Josh Rosenbaum -#include #include #include #include +#include + #include "packet_manager.h" #include "framework/codec.h" #include "snort.h" @@ -66,9 +67,11 @@ std::vector gen_peg_names = THREAD_LOCAL PreprocStats decodePerfStats; #endif -static const uint16_t max_protocol_id = 65535; -static std::list s_codecs; +extern const CodecApi* default_codec; + +static const uint16_t max_protocol_id = 65535; +static std::vector s_codecs; // when initialization arrays, although the zero is not required // the compiler complains about a missing-field-initiliezers @@ -96,6 +99,8 @@ static THREAD_LOCAL rand_t* s_rand = NULL; static THREAD_LOCAL std::array s_id_pool{{0}}; static THREAD_LOCAL std::array s_pkt{{0}}; + + //------------------------------------------------------------------------- // Private helper functions //------------------------------------------------------------------------- @@ -264,6 +269,27 @@ static void accumulate() stats_mutex.unlock(); } +static bool api_instantiated(const CodecApi* cd_api) +{ + static std::vector instantiated_api; // all elements initialized to false + + if (instantiated_api.size() != s_codecs.size()) + instantiated_api.resize(s_codecs.size()); + + std::vector::iterator p = std::find(s_codecs.begin(), s_codecs.end(), cd_api); + + if (p == s_codecs.end()) + FatalError("PacketManager:: should never reach this code!!" \ + "Cannot find Codec %s's api", cd_api->base.name); + + int pos = p - s_codecs.begin(); + + if(instantiated_api[pos]) + return true; + + instantiated_api[pos] = true; + return false; +} //------------------------------------------------------------------------- // Initialization and setup //------------------------------------------------------------------------- @@ -274,7 +300,6 @@ void PacketManager::add_plugin(const CodecApi* api) if (!api->ctor) FatalError("Codec %s: ctor() must be implemented. Look at the example code for an example.\n", api->base.name); - if (!api->dtor) FatalError("Codec %s: dtor() must be implemented. Look at the example code for an example.\n", api->base.name); @@ -300,21 +325,22 @@ void PacketManager::release_plugins() s_protocols[0] = nullptr; } -void PacketManager::instantiate(const CodecApi* /*cd_api */, Module* /*m*/, SnortConfig* /*sc*/) +void PacketManager::instantiate(const CodecApi* cd_api , Module* m, SnortConfig* /*sc*/) { -#if 0 - static uint16_t codec_id = 1; + static int codec_id = 1; std::vector ids; - const CodecApi *p = GetApi(cd_api->base.name); - if(!p) - ParseError("Unknown codec: '%s'.", cd_api->base.name); + if (api_instantiated(cd_api)) // automatically marks as instantiated + return; + + if (codec_id >= UINT8_MAX) + FatalError("A maximum of 256 codecs can be registered\n"); // global init here to ensure the global policy has already been configured - if (p->ginit) - p->ginit(); + if (cd_api->ginit) + cd_api->ginit(); - Codec *cd = p->ctor(); + Codec *cd = cd_api->ctor(m); cd->get_protocol_ids(ids); for (auto id : ids) { @@ -327,62 +353,19 @@ void PacketManager::instantiate(const CodecApi* /*cd_api */, Module* /*m*/, Snor s_proto_map[id] = codec_id; } - if(cd->is_default_codec()) - { - if(s_protocols[0]) - FatalError("Only one Codec may be the registered as default, " - "but both the %s and %s return 'true' when " - " the function default_codec().\n", - s_protocols[0]->get_name(), cd->get_name()); - else - s_protocols[0] = cd; - } - s_protocols[codec_id++] = cd; -#endif } void PacketManager::instantiate() { - static uint16_t codec_id = 1; - - if (codec_id >= UINT8_MAX) - FatalError("A maximum of 256 codecs can be registered\n"); + // hard code the default codec into the zero index + add_plugin(default_codec); + instantiate(default_codec, nullptr, nullptr); + s_protocols[0] = s_protocols[get_codec(default_codec->base.name)]; + // and instantiate every codec which does not have a module for (auto p : s_codecs) - { - std::vector ids; - - // global init here to ensure the global policy has already been configured - if (p->ginit) - p->ginit(); - - Codec *cd = p->ctor(); - cd->get_protocol_ids(ids); - for (auto id : ids) - { - if(s_proto_map[id] != 0) - WarningMessage("The Codecs %s and %s have both been registered " - "for protocol_id %d. Codec %s will be used\n", - s_protocols[s_proto_map[id]]->get_name(), cd->get_name(), - id, cd->get_name()); - - s_proto_map[id] = codec_id; - } - - if(cd->is_default_codec()) - { - if(s_protocols[0]) - FatalError("Only one Codec may be the registered as default, " - "but both the %s and %s return 'true' for " - " the function is_default_codec().\n", - s_protocols[0]->get_name(), cd->get_name()); - else - s_protocols[0] = cd; - } - - s_protocols[codec_id++] = cd; - } + instantiate(p, nullptr, nullptr); } void PacketManager::thread_init(void) @@ -414,7 +397,7 @@ void PacketManager::thread_init(void) } if(!grinder) - FatalError("Unable to find a Codec with data link type %d!!\n", daq_dlt); + FatalError("PacketManager: Unable to find a Codec with data link type %d!!\n", daq_dlt); // ENCODER initialization @@ -505,7 +488,7 @@ void PacketManager::decode( mapped_prot = s_proto_map[prot_id]; prev_prot_id = prot_id; - // reset for next call + // set for next call prot_id = FINISHED_DECODE; len -= lyr_len; pkt += lyr_len; @@ -548,11 +531,6 @@ bool PacketManager::has_codec(uint16_t cd_id) //------------------------------------------------------------------------- // encoders operate layer by layer: - - - -//------------------------------------------------------------------------- -// basic setup stuff //------------------------------------------------------------------------- diff --git a/src/protocols/eth.h b/src/protocols/eth.h index c4e33279a..e848f9e0e 100644 --- a/src/protocols/eth.h +++ b/src/protocols/eth.h @@ -26,6 +26,16 @@ #define ETHERNET_HEADER_LEN 14 #define ETHERNET_MTU 1500 +#define ETH_DSAP_SNA 0x08 /* SNA */ +#define ETH_SSAP_SNA 0x00 /* SNA */ +#define ETH_DSAP_STP 0x42 /* Spanning Tree Protocol */ +#define ETH_SSAP_STP 0x42 /* Spanning Tree Protocol */ +#define ETH_DSAP_IP 0xaa /* IP */ +#define ETH_SSAP_IP 0xaa /* IP */ + +#define ETH_ORG_CODE_ETHR 0x000000 /* Encapsulated Ethernet */ +#define ETH_ORG_CODE_CDP 0x00000c /* Cisco Discovery Proto */ + namespace eth { diff --git a/src/utils/stats.cc b/src/utils/stats.cc index f88606550..24c191e16 100644 --- a/src/utils/stats.cc +++ b/src/utils/stats.cc @@ -238,8 +238,6 @@ void pc_sum() sum_stats((PegCount*)&gpc, (PegCount*)&pc, array_size(pc_names)); memset(&pc, 0, sizeof(pc)); - - //decoder_sum(); FIXIT must be moved } //-------------------------------------------------------------------------