From: Josh Date: Fri, 21 Nov 2014 02:30:38 +0000 (-0600) Subject: fixing GTP tunneling. Fixing a couple of DAQ output statistics bugs X-Git-Tag: 3.0.0-233~1171 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4a0844b41431feb51dfdef176b92b7ee83335519;p=thirdparty%2Fsnort3.git fixing GTP tunneling. Fixing a couple of DAQ output statistics bugs --- diff --git a/src/codecs/ip/cd_udp.cc b/src/codecs/ip/cd_udp.cc index f1d80ffcb..dcad75382 100644 --- a/src/codecs/ip/cd_udp.cc +++ b/src/codecs/ip/cd_udp.cc @@ -94,10 +94,13 @@ static const RuleMap udp_rules[] = { 0, nullptr } }; +constexpr uint16_t GTP_U_PORT = 2152; +constexpr uint16_t GTP_U_PORT_V0 = 3386; + class UdpModule : public CodecModule { public: - UdpModule() : CodecModule(CD_UDP_NAME, CD_UDP_HELP, udp_params) {} + UdpModule() : CodecModule(CD_UDP_NAME, CD_UDP_HELP, udp_params), gtp_ports_set(false) {} const RuleMap* get_rules() const override { return udp_rules; } @@ -116,12 +119,25 @@ public: } else if ( v.is("gtp_ports") ) { - ConfigGTPDecoding(sc, v.get_string()); + if ( !gtp_ports_set ) + { + gtp_ports_set = true; + sc->gtp_ports.reset(GTP_U_PORT); + sc->gtp_ports.reset(GTP_U_PORT_V0); + } + v.get_bits(sc->gtp_ports); } else if ( v.is("enable_gtp") ) { if ( v.get_bool() ) + { + if ( !gtp_ports_set ) + { + sc->gtp_ports.set(GTP_U_PORT); + sc->gtp_ports.set(GTP_U_PORT_V0); + } sc->enable_gtp = 1; // FIXIT-L move to existing bitfield + } } else { @@ -130,6 +146,9 @@ public: return true; } + +private: + bool gtp_ports_set; }; diff --git a/src/main/snort.h b/src/main/snort.h index ddc7b4b5a..d2e96bdd3 100644 --- a/src/main/snort.h +++ b/src/main/snort.h @@ -521,8 +521,7 @@ static inline int ScGTPDecoding(void) static inline int ScIsGTPPort(uint16_t port) { - // FIXIT-H-J check for gtp_ports should not be necessary - return snort_conf->gtp_ports && snort_conf->gtp_ports[port]; + return snort_conf->gtp_ports.test(port); } static inline int ScESPDecoding(void) diff --git a/src/main/snort_config.cc b/src/main/snort_config.cc index fdc4ef77e..b3844f79e 100644 --- a/src/main/snort_config.cc +++ b/src/main/snort_config.cc @@ -180,6 +180,7 @@ SnortConfig * SnortConfNew(void) sc->num_layers = DEFAULT_LAYERMAX; sc->max_ip6_extensions = 0; sc->max_ip_layers = 0; + sc->gtp_ports.reset(); /*user_id and group_id should be initialized to -1 by default, because * chown() use this later, -1 means no change to user_id/group_id*/ @@ -324,9 +325,6 @@ void SnortConfFree(SnortConfig *sc) if (sc->eth_dst ) free(sc->eth_dst); - if (sc->gtp_ports) - free(sc->gtp_ports); - if ( sc->output ) free(sc->output); diff --git a/src/main/snort_config.h b/src/main/snort_config.h index f3e291071..6f3712b0a 100644 --- a/src/main/snort_config.h +++ b/src/main/snort_config.h @@ -35,6 +35,7 @@ #include "utils/util.h" #include "protocols/packet.h" #include "main/thread.h" +#include "framework/bits.h" #define DEFAULT_LOG_DIR "." @@ -156,7 +157,7 @@ struct SnortConfig uint8_t enable_teredo; uint8_t enable_gtp; - char *gtp_ports; + PortList gtp_ports; uint8_t enable_esp; uint8_t num_layers; diff --git a/src/parser/config_file.cc b/src/parser/config_file.cc index 8287269ed..b1af58ae3 100644 --- a/src/parser/config_file.cc +++ b/src/parser/config_file.cc @@ -256,30 +256,6 @@ void ConfigDumpPayloadVerbose(SnortConfig *sc, const char*) sc->output_flags |= OUTPUT_FLAG__VERBOSE_DUMP; } -#define GTP_U_PORT 2152 -#define GTP_U_PORT_V0 3386 -void ConfigGTPDecoding(SnortConfig *sc, const char*) -{ - PortObject *portObject; - int numberOfPorts = 0; - - /*Set the ports*/ - portObject = PortVarTableFind(get_ips_policy()->portVarTable, "GTP_PORTS"); - - if (portObject) - { - sc->gtp_ports = PortObjectCharPortArray(sc->gtp_ports,portObject, &numberOfPorts); - } - - if (!sc->gtp_ports || (0 == numberOfPorts)) - { - /*No ports defined, use default GTP ports*/ - sc->gtp_ports = (char *)SnortAlloc(UINT16_MAX); - sc->gtp_ports[GTP_U_PORT] = 1; - sc->gtp_ports[GTP_U_PORT_V0] = 1; - } -} - void ConfigDstMac(SnortConfig* sc, const char* s) { eth_addr_t dst; diff --git a/src/parser/config_file.h b/src/parser/config_file.h index 58a5e1be5..626991efe 100644 --- a/src/parser/config_file.h +++ b/src/parser/config_file.h @@ -59,7 +59,6 @@ void ConfigPluginPath(SnortConfig*, const char*); void ConfigScriptPath(SnortConfig*, const char*); void ConfigDstMac(SnortConfig*, const char*); -SO_PUBLIC void ConfigGTPDecoding(SnortConfig*sc, const char*args); void ConfigSetGid(SnortConfig*, const char*); void ConfigSetUid(SnortConfig*, const char*); void ConfigUmask(SnortConfig*, const char*); diff --git a/src/stream/tcp/tcp_session.cc b/src/stream/tcp/tcp_session.cc index ca4d57d8e..3cc99b10a 100644 --- a/src/stream/tcp/tcp_session.cc +++ b/src/stream/tcp/tcp_session.cc @@ -430,7 +430,7 @@ static const char* const reassembly_policy_names[] = { "MACOS", "HPUX10", "WINDOWS VISTA", - "WINDOWS 2003" + "WINDOWS 2003", "IPS" }; diff --git a/src/utils/stats.cc b/src/utils/stats.cc index 513fea5c7..304451b81 100644 --- a/src/utils/stats.cc +++ b/src/utils/stats.cc @@ -198,6 +198,7 @@ const char* const verdict_names[] = "whitelist", "blacklist", "ignore", + "retry", "internal blacklist", "internal whitelist" }; @@ -298,8 +299,8 @@ void DropStats() for ( unsigned i = 0; i < MAX_DAQ_VERDICT; i++ ) daq_verdicts.verdicts[i] = pkt_stats->verdicts[i]; - daq_verdicts.internal_blacklist = pc.internal_blacklist; - daq_verdicts.internal_whitelist = pc.internal_whitelist; + daq_verdicts.internal_blacklist = gpc.internal_blacklist; + daq_verdicts.internal_whitelist = gpc.internal_whitelist; show_stats((PegCount*)&daq_verdicts, verdict_names, array_size(verdict_names)); }