From: Josh Date: Wed, 30 Apr 2014 20:46:24 +0000 (-0400) Subject: Refactor packet manager X-Git-Tag: 3.0.0-233~1542^2~2 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=13c7deea6d416c8e5e4956ab38fa97b96ece5d04;p=thirdparty%2Fsnort3.git Refactor packet manager --- diff --git a/src/codecs/basic/cd_icmp4.cc b/src/codecs/basic/cd_icmp4.cc index e8cbe1016..54689bcbb 100644 --- a/src/codecs/basic/cd_icmp4.cc +++ b/src/codecs/basic/cd_icmp4.cc @@ -39,9 +39,6 @@ namespace{ -const uint32_t ICMP_HEADER_LEN = 4; -const uint32_t ICMP_NORMAL_LEN = 8; - class Icmp4Codec : public Codec{ @@ -95,7 +92,7 @@ void Icmp4Codec::get_protocol_ids(std::vector &v) bool Icmp4Codec::decode(const uint8_t* raw_pkt, const uint32_t raw_len, Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) { - if(raw_len < ICMP_HEADER_LEN) + if(raw_len < icmp4::hdr_len()) { DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "WARNING: Truncated ICMP4 header (%d bytes).\n", raw_len);); @@ -200,10 +197,7 @@ bool Icmp4Codec::decode(const uint8_t* raw_pkt, const uint32_t raw_len, } } - lyr_len = ICMP_HEADER_LEN; - - p->dsize = (u_short)(raw_len - ICMP_HEADER_LEN); - p->data = raw_pkt + ICMP_HEADER_LEN; + lyr_len = icmp4::hdr_len(); DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "ICMP type: %d code: %d\n", p->icmph->type, p->icmph->code);); @@ -245,14 +239,11 @@ bool Icmp4Codec::decode(const uint8_t* raw_pkt, const uint32_t raw_len, /* Run a bunch of ICMP decoder rules */ - p->dsize = (u_short)(raw_len - lyr_len); - p->data = raw_pkt + lyr_len; + p->dsize = (u_short)(raw_len - lyr_len); // setting for use in ICMP4MiscTests ICMP4MiscTests(p); p->proto_bits |= PROTO_BIT__ICMP; p->proto_bits &= ~(PROTO_BIT__UDP | PROTO_BIT__TCP); - - next_prot_id = -1; return true; } diff --git a/src/codecs/basic/cd_icmp6.cc b/src/codecs/basic/cd_icmp6.cc index 6568fb851..33f8d63e5 100644 --- a/src/codecs/basic/cd_icmp6.cc +++ b/src/codecs/basic/cd_icmp6.cc @@ -321,6 +321,8 @@ bool Icmp6Codec::decode(const uint8_t* raw_pkt, const uint32_t len, break; default: + DEBUG_WRAP(DebugMessage(DEBUG_DECODE, + "WARNING: ICMP6_TYPE (type %d).\n", p->icmp6h->type);); codec_events::decoder_event(p, DECODE_ICMP6_TYPE_OTHER); lyr_len = icmp6::hdr_min_len(); @@ -516,7 +518,6 @@ void ICMP6_Format (EncodeFlags, const Packet*, Packet* c, Layer* lyr) c->icmp6h = (ICMP6Hdr*)lyr->start; } -#endif /* * CHECKSUM @@ -605,6 +606,7 @@ static unsigned short in_chksum_icmp6(pseudoheader6 *ph, return (unsigned short)(~cksum); } +#endif static Codec* ctor() { diff --git a/src/codecs/basic/cd_ipv4.cc b/src/codecs/basic/cd_ipv4.cc index a1606c74b..76d632f23 100644 --- a/src/codecs/basic/cd_ipv4.cc +++ b/src/codecs/basic/cd_ipv4.cc @@ -117,6 +117,7 @@ bool Ipv4Codec::decode(const uint8_t *raw_packet, const uint32_t len, Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) { uint32_t ip_len; /* length from the start of the ip hdr to the pkt end */ + uint16_t hlen; /* ip header length */ // dc.ip++; @@ -187,13 +188,13 @@ bool Ipv4Codec::decode(const uint8_t *raw_packet, const uint32_t len, ip_len = ntohs(p->iph->ip_len); /* get the IP header length */ - lyr_len = ipv4::get_pkt_hdr_len(p->iph) << 2; + hlen = ipv4::get_pkt_hdr_len(p->iph) << 2; /* header length sanity check */ - if(lyr_len < ipv4::hdr_len()) + if(hlen < ipv4::hdr_len()) { DEBUG_WRAP(DebugMessage(DEBUG_DECODE, - "Bogus IP header length of %i bytes\n", lyr_len);); + "Bogus IP header length of %i bytes\n", hlen);); codec_events::decoder_event(p, DECODE_IPV4_INVALID_HEADER_LEN); @@ -236,11 +237,11 @@ bool Ipv4Codec::decode(const uint8_t *raw_packet, const uint32_t len, } #endif - if(ip_len < lyr_len) + if(ip_len < hlen) { DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "IP dgm len (%d bytes) < IP hdr " - "len (%d bytes), packet discarded\n", ip_len, lyr_len);); + "len (%d bytes), packet discarded\n", ip_len, hlen);); codec_events::decoder_event(p, DECODE_IPV4_DGRAM_LT_IPHDR); @@ -263,7 +264,7 @@ bool Ipv4Codec::decode(const uint8_t *raw_packet, const uint32_t len, * need to check them (should make this a command line/config * option */ - int16_t csum = in_chksum_ip((u_short *)p->iph, lyr_len); + int16_t csum = in_chksum_ip((u_short *)p->iph, hlen); if(csum) { @@ -282,7 +283,7 @@ bool Ipv4Codec::decode(const uint8_t *raw_packet, const uint32_t len, } /* test for IP options */ - p->ip_options_len = (uint16_t)(lyr_len - ipv4::hdr_len()); + p->ip_options_len = (uint16_t)(hlen - ipv4::hdr_len()); if(p->ip_options_len > 0) { @@ -309,7 +310,7 @@ bool Ipv4Codec::decode(const uint8_t *raw_packet, const uint32_t len, p->actual_ip_len = (uint16_t) ip_len; /* set the remaining packet length */ - ip_len -= lyr_len; + ip_len -= hlen; /* check for fragmented packets */ p->frag_offset = ntohs(p->iph->ip_off); @@ -342,7 +343,7 @@ bool Ipv4Codec::decode(const uint8_t *raw_packet, const uint32_t len, { /* set the packet fragment flag */ p->frag_flag = 1; - p->ip_frag_start = raw_packet + lyr_len; + p->ip_frag_start = raw_packet + hlen; p->ip_frag_len = (uint16_t)ip_len; // dc.frags++; } @@ -358,7 +359,7 @@ bool Ipv4Codec::decode(const uint8_t *raw_packet, const uint32_t len, } /* Set some convienience pointers */ - p->ip_data = raw_packet + lyr_len; + p->ip_data = raw_packet + hlen; p->ip_dsize = (u_short) ip_len; /* See if there are any ip_proto only rules that match */ @@ -367,6 +368,7 @@ bool Ipv4Codec::decode(const uint8_t *raw_packet, const uint32_t len, p->proto_bits |= PROTO_BIT__IP; IPMiscTests(p); + lyr_len = hlen; /* if this packet isn't a fragment * or if it is, its a UDP packet and offset is 0 */ @@ -375,15 +377,14 @@ bool Ipv4Codec::decode(const uint8_t *raw_packet, const uint32_t len, (p->iph->ip_proto == IPPROTO_UDP))) { DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "IP header length: %lu\n", - (unsigned long)lyr_len);); + (unsigned long)hlen);); next_prot_id = p->iph->ip_proto; - return true; } else { /* set the payload pointer and payload size */ - p->data = raw_packet + lyr_len; + p->data = raw_packet + hlen; p->dsize = (u_short) ip_len; } @@ -416,39 +417,32 @@ inline void DecodeIPv4Proto(const uint8_t proto, #if 0 +#endif case IPPROTO_IP_MOBILITY: case IPPROTO_SUN_ND: case IPPROTO_PIM: - if ( Event_Enabled(DECODE_IP_BAD_PROTO) ) - codec_events::decoder_event(p, DECODE_IP_BAD_PROTO)); -// dc.other++; + codec_events::decoder_event(p, DECODE_IP_BAD_PROTO); p->data = pkt; p->dsize = (uint16_t)len; return; case IPPROTO_PGM: -// dc.other++; p->data = pkt; p->dsize = (uint16_t)len; - if ( Event_Enabled(DECODE_PGM_NAK_OVERFLOW) ) CheckPGMVuln(p); return; case IPPROTO_IGMP: -// dc.other++; p->data = pkt; p->dsize = (uint16_t)len; - - if ( Event_Enabled(DECODE_IGMP_OPTIONS_DOS) ) - CheckIGMPVuln(p); + CheckIGMPVuln(p); return; -#endif + default: if (GET_IPH_PROTO(p) >= MIN_UNASSIGNED_IP_PROTO) codec_events::decoder_event(p, DECODE_IP_UNASSIGNED_PROTO); -// dc.other++; p->data = pkt; p->dsize = (uint16_t)len; return; diff --git a/src/codecs/encode.cc b/src/codecs/encode.cc index 335ef35af..b84059436 100644 --- a/src/codecs/encode.cc +++ b/src/codecs/encode.cc @@ -66,12 +66,6 @@ static THREAD_LOCAL uint8_t* dst_mac = NULL; Packet* encode_pkt = NULL; uint64_t total_rebuilt_pkts = 0; -static inline int IsIcmp (int type) -{ - static constexpr int s_icmp[ENC_MAX] = { 0, 0, 1, 1, 1 }; - return ( s_icmp[type] ); -} - //------------------------------------------------------------------------- // encoders operate layer by layer: // * base+off is start of packet diff --git a/src/codecs/plugins/cd_erspan2.cc b/src/codecs/plugins/cd_erspan2.cc index 8cd5870a1..ddb3e1eef 100644 --- a/src/codecs/plugins/cd_erspan2.cc +++ b/src/codecs/plugins/cd_erspan2.cc @@ -77,7 +77,6 @@ bool Erspan2Codec::decode(const uint8_t *raw_pkt, const uint32_t len, Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) { lyr_len = sizeof(ERSpanType2Hdr); - uint32_t payload_len; ERSpanType2Hdr *erSpan2Hdr = (ERSpanType2Hdr *)raw_pkt; if (len < sizeof(ERSpanType2Hdr)) diff --git a/src/codecs/plugins/cd_erspan3.cc b/src/codecs/plugins/cd_erspan3.cc index 980220808..5ccf2893a 100644 --- a/src/codecs/plugins/cd_erspan3.cc +++ b/src/codecs/plugins/cd_erspan3.cc @@ -84,8 +84,7 @@ void Erspan3Codec::get_protocol_ids(std::vector& v) bool Erspan3Codec::decode(const uint8_t *raw_pkt, const uint32_t len, Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) { - lyr_len= sizeof(ERSpanType3Hdr); - uint32_t payload_len; + lyr_len = sizeof(ERSpanType3Hdr); ERSpanType3Hdr *erSpan3Hdr = (ERSpanType3Hdr *)raw_pkt; if (len < sizeof(ERSpanType3Hdr)) diff --git a/src/codecs/plugins/cd_gre.cc b/src/codecs/plugins/cd_gre.cc index c9dd04b36..1a95d1a2e 100644 --- a/src/codecs/plugins/cd_gre.cc +++ b/src/codecs/plugins/cd_gre.cc @@ -56,7 +56,7 @@ static const uint32_t GRE_SEQ_LEN = 4; static const uint32_t GRE_SRE_HEADER_LEN = 4; /* GRE version 1 used with PPTP */ -static const uint32_t GRE_V1_HEADER_LEN =8; +/* static const uint32_t GRE_V1_HEADER_LEN == GRE_HEADER_LEN + GRE_KEY_LEN; */ static const uint32_t GRE_V1_ACK_LEN = 4; #define GRE_V1_FLAGS(x) (x->version & 0x78) diff --git a/src/codecs/plugins/cd_gtp.cc b/src/codecs/plugins/cd_gtp.cc index ee249b854..592f625c8 100644 --- a/src/codecs/plugins/cd_gtp.cc +++ b/src/codecs/plugins/cd_gtp.cc @@ -75,7 +75,6 @@ void GtpCodec::get_protocol_ids(std::vector& v) bool GtpCodec::decode(const uint8_t *raw_pkt, const uint32_t len, Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) { - uint32_t header_len; uint8_t next_hdr_type; uint8_t version; uint8_t ip_ver; @@ -214,6 +213,8 @@ bool GtpCodec::decode(const uint8_t *raw_pkt, const uint32_t len, else if (ip_ver == 0x60) next_prot_id = ipv6::prot_id(); } + + return true; } diff --git a/src/codecs/plugins/cd_pppoepkt.cc b/src/codecs/plugins/cd_pppoepkt.cc index 8b2b962e0..99f721c36 100644 --- a/src/codecs/plugins/cd_pppoepkt.cc +++ b/src/codecs/plugins/cd_pppoepkt.cc @@ -58,7 +58,9 @@ const uint16_t PPPoE_CODE_PADR = 0x19; /* PPPoE Active Discovery Request */ const uint16_t PPPoE_CODE_PADS = 0x65; /* PPPoE Active Discovery Session-confirmation */ const uint16_t PPPoE_CODE_PADT = 0xa7; /* PPPoE Active Discovery Terminate */ -/* PPPoE tag types */ +#if 0 +/* PPPoE tag types - currently not used*/ + const uint16_t PPPoE_TAG_END_OF_LIST = 0x0000; const uint16_t PPPoE_TAG_SERVICE_NAME = 0x0101; const uint16_t PPPoE_TAG_AC_NAME = 0x0102; @@ -69,7 +71,7 @@ const uint16_t PPPoE_TAG_RELAY_SESSION_ID = 0x0110; const uint16_t PPPoE_TAG_SERVICE_NAME_ERROR = 0x0201; const uint16_t PPPoE_TAG_AC_SYSTEM_ERROR = 0x0202; const uint16_t PPPoE_TAG_GENERIC_ERROR = 0x0203; - +#endif } // namespace diff --git a/src/codecs/plugins/cd_swipe.cc b/src/codecs/plugins/cd_swipe.cc index 4dda224fc..c1c6eb900 100644 --- a/src/codecs/plugins/cd_swipe.cc +++ b/src/codecs/plugins/cd_swipe.cc @@ -1,6 +1,3 @@ - -/* $Id: decode.c,v 1.285 2013-06-29 03:03:00 rcombs Exp $ */ - /* ** Copyright (C) 2002-2013 Sourcefire, Inc. ** Copyright (C) 1998-2002 Martin Roesch @@ -20,6 +17,7 @@ ** along with this program; if not, write to the Free Software ** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */ +// cd_swipe.cc author Josh Rosenbaum @@ -32,8 +30,6 @@ namespace{ -const uint32_t ICMP_HEADER_LEN = 4; -const uint32_t ICMP_NORMAL_LEN = 8; const uint16_t SWIPE_PROT_ID = 53; class SwipeCodec : public Codec{ @@ -59,14 +55,8 @@ void SwipeCodec::get_protocol_ids(std::vector &proto_ids) bool SwipeCodec::decode(const uint8_t* raw_packet, const uint32_t raw_len, Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) { - + // currently unsupported codec_events::decoder_event(p, DECODE_IP_BAD_PROTO); -// dc.other++; - p->data = raw_packet; - p->dsize = (uint16_t)raw_len; - - lyr_len = 0; - next_prot_id = -1; return true; } diff --git a/src/ips_options/ips_icmp_id.cc b/src/ips_options/ips_icmp_id.cc index 49c03b37c..63ff5fd68 100644 --- a/src/ips_options/ips_icmp_id.cc +++ b/src/ips_options/ips_icmp_id.cc @@ -146,7 +146,7 @@ int IcmpIdOption::eval(Packet *p) PREPROC_PROFILE_START(icmpIdPerfStats); if( (p->icmph->type == ICMP_ECHO || p->icmph->type == ICMP_ECHOREPLY) - || (p->icmph->type == ICMP6_ECHO || p->icmph->type == ICMP6_REPLY) + || (p->icmph->type == (uint16_t)ICMP6_ECHO || p->icmph->type == (uint16_t)ICMP6_REPLY) ) { /* test the rule ID value against the ICMP extension ID field */ diff --git a/src/ips_options/ips_icmp_seq.cc b/src/ips_options/ips_icmp_seq.cc index 0da965311..445f7ed27 100644 --- a/src/ips_options/ips_icmp_seq.cc +++ b/src/ips_options/ips_icmp_seq.cc @@ -145,7 +145,7 @@ int IcmpSeqOption::eval(Packet *p) PREPROC_PROFILE_START(icmpSeqPerfStats); if( (p->icmph->type == ICMP_ECHO || p->icmph->type == ICMP_ECHOREPLY) - || (p->icmph->type == ICMP6_ECHO || p->icmph->type == ICMP6_REPLY) + || (p->icmph->type == (uint16_t)ICMP6_ECHO || p->icmph->type == (uint16_t)ICMP6_REPLY) ) { /* test the rule ID value against the ICMP extension ID field */ diff --git a/src/managers/packet_manager.cc b/src/managers/packet_manager.cc index 39d40f542..389893f41 100644 --- a/src/managers/packet_manager.cc +++ b/src/managers/packet_manager.cc @@ -78,10 +78,8 @@ static THREAD_LOCAL CdGenPegs pkt_cnt; // helper functions //------------------------------------------------------------------------- -// note that we now have multiple preproc configs saved by parser -// (s5-global, s5-tcp, ..., etc.) but just one ppapi. that means -// we must call the config func multiple times but add only the 1st -// instance to the policy list. +#if 0 +// not need until instatiate && codec modules implemented static inline const CodecApi* GetApi(const char* keyword) { for ( auto* p : s_codecs ) @@ -89,6 +87,7 @@ static inline const CodecApi* GetApi(const char* keyword) return p; return NULL; } +#endif //------------------------------------------------------------------------- @@ -345,9 +344,9 @@ void PacketManager::decode( if (prev_prot_id != FINISHED_DECODE) { if(s_proto_map[prev_prot_id]) - pkt_cnt.other_codecs++; - else pkt_cnt.discards++; + else + pkt_cnt.other_codecs++; } s_stats[mapped_prot + stat_offset]++; diff --git a/src/network_inspectors/normalize/norm.cc b/src/network_inspectors/normalize/norm.cc index bca8eb72c..80cc26a73 100644 --- a/src/network_inspectors/normalize/norm.cc +++ b/src/network_inspectors/normalize/norm.cc @@ -283,7 +283,7 @@ static int Norm_ICMP6 ( { ICMPHdr* h = (ICMPHdr*)(p->layers[layer].start); - if ( (h->type == ICMP6_ECHO || h->type == ICMP6_REPLY) && + if ( (h->type == (uint16_t)ICMP6_ECHO || h->type == (uint16_t)ICMP6_REPLY) && (h->code != 0) ) { h->code = static_cast(0); diff --git a/src/protocols/icmp4.h b/src/protocols/icmp4.h index 74b92b1b9..aa33b6010 100644 --- a/src/protocols/icmp4.h +++ b/src/protocols/icmp4.h @@ -28,14 +28,12 @@ namespace icmp4 { - // class to hold any data which should be hidden - namespace detail - { - - +namespace detail +{ +const uint32_t ICMP_HEADER_LEN = 4; - } +} // namespace // do NOT add 'ICMP_' to the begining of these const because they @@ -217,7 +215,10 @@ inline bool is_echo(uint32_t type) return (type == (uint32_t) IcmpType::ECHO); } - +inline uint32_t hdr_len() +{ + return detail::ICMP_HEADER_LEN; +} /* * CHECKSUM