From: Josh Date: Fri, 19 Sep 2014 22:13:57 +0000 (-0400) Subject: fixing log_text of TCP options. decoder_event no longer occur on stream_rebuilt... X-Git-Tag: 3.0.0-233~1404^2~10^2~8 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=65be1ad41c248927532bd6432054351cdf332def;p=thirdparty%2Fsnort3.git fixing log_text of TCP options. decoder_event no longer occur on stream_rebuilt packet --- diff --git a/src/codecs/codec_events.h b/src/codecs/codec_events.h index 218f8029a..0440722a4 100644 --- a/src/codecs/codec_events.h +++ b/src/codecs/codec_events.h @@ -21,6 +21,7 @@ #ifndef CODEC_EVENTS_H #define CODEC_EVENTS_H +#include "framework/codec.h" #include "codecs/decode_module.h" #include "events/event_queue.h" @@ -28,15 +29,10 @@ namespace codec_events { -inline void decoder_event(CodecSid const sid) +inline void decoder_event(const CodecData& codec, CodecSid const sid) { -#if 0 - // FIXIT-H -J Remove this function if PacketManager::decode() - assert never occurs - /* Can this return statement ever be true? */ - /* Remove function if so */ - if ( p->packet_flags & PKT_REBUILT_STREAM ) + if ( codec.codec_flags & CODEC_STREAM_REBUILT ) return; -#endif SnortEventqAdd(GID_DECODE, sid); } diff --git a/src/codecs/ip/cd_auth.cc b/src/codecs/ip/cd_auth.cc index 23f1c64d0..eecb2d925 100644 --- a/src/codecs/ip/cd_auth.cc +++ b/src/codecs/ip/cd_auth.cc @@ -99,7 +99,7 @@ bool AuthCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort) if (raw.len < MIN_AUTH_LEN) { - codec_events::decoder_event(DECODE_AUTH_HDR_TRUNC); + codec_events::decoder_event(codec, DECODE_AUTH_HDR_TRUNC); return false; } @@ -109,7 +109,7 @@ bool AuthCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort) if (codec.lyr_len > raw.len) { - codec_events::decoder_event(DECODE_AUTH_HDR_BAD_LEN); + codec_events::decoder_event(codec, DECODE_AUTH_HDR_BAD_LEN); return false; } @@ -118,7 +118,11 @@ bool AuthCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort) // must be called AFTER setting next_prot_id if (snort.ip_api.is_ip6()) + { ip_util::CheckIPv6ExtensionOrder(codec, IPPROTO_ID_AUTH); + codec.proto_bits |= PROTO_BIT__IP6_EXT; + codec.ip6_csum_proto = ah->next; + } return true; } diff --git a/src/codecs/ip/cd_dst_opts.cc b/src/codecs/ip/cd_dst_opts.cc index 46e4bc4ec..66244e394 100644 --- a/src/codecs/ip/cd_dst_opts.cc +++ b/src/codecs/ip/cd_dst_opts.cc @@ -68,36 +68,37 @@ bool Ipv6DSTOptsCodec::decode(const RawData& raw, CodecData& codec, SnortData&) if(raw.len < sizeof(IP6Dest)) { - codec_events::decoder_event(DECODE_IPV6_TRUNCATED_EXT); + codec_events::decoder_event(codec, DECODE_IPV6_TRUNCATED_EXT); return false; } if ( codec.ip6_extension_count >= IP6_EXTMAX ) { - codec_events::decoder_event(DECODE_IP6_EXCESS_EXT_HDR); + codec_events::decoder_event(codec, DECODE_IP6_EXCESS_EXT_HDR); return false; } if (dsthdr->ip6dest_nxt == IPPROTO_ROUTING) - codec_events::decoder_event(DECODE_IPV6_DSTOPTS_WITH_ROUTING); + codec_events::decoder_event(codec, DECODE_IPV6_DSTOPTS_WITH_ROUTING); codec.lyr_len = sizeof(IP6Dest) + (dsthdr->ip6dest_len << 3); if(codec.lyr_len > raw.len) { - codec_events::decoder_event(DECODE_IPV6_TRUNCATED_EXT); + codec_events::decoder_event(codec, DECODE_IPV6_TRUNCATED_EXT); return false; } codec.proto_bits |= PROTO_BIT__IP6_EXT; codec.ip6_extension_count++; codec.next_prot_id = dsthdr->ip6dest_nxt; + codec.ip6_csum_proto = dsthdr->ip6dest_nxt; // must be called AFTER setting next_prot_id ip_util::CheckIPv6ExtensionOrder(codec, IPPROTO_ID_DSTOPTS); - if ( ip_util::CheckIPV6HopOptions(raw)) + if ( ip_util::CheckIPV6HopOptions(raw, codec)) return true; return false; } diff --git a/src/codecs/ip/cd_esp.cc b/src/codecs/ip/cd_esp.cc index e06505f8d..6b3edc1b1 100644 --- a/src/codecs/ip/cd_esp.cc +++ b/src/codecs/ip/cd_esp.cc @@ -125,7 +125,7 @@ bool EspCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort) if (raw.len < (ESP_HEADER_LEN + ESP_AUTH_DATA_LEN + ESP_TRAILER_LEN)) { /* Truncated ESP traffic. Bail out here and inspect the rest as payload. */ - codec_events::decoder_event(DECODE_ESP_HEADER_TRUNC); + codec_events::decoder_event(codec, DECODE_ESP_HEADER_TRUNC); return false; } @@ -145,8 +145,11 @@ bool EspCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort) // must be called AFTER setting next_prot_id if (snort.ip_api.is_ip6()) + { ip_util::CheckIPv6ExtensionOrder(codec, IPPROTO_ID_ESP); - + codec.proto_bits |= PROTO_BIT__IP6_EXT; + codec.ip6_csum_proto = codec.next_prot_id; + } // TODO: Leftover from Snort. Do we really want thsi? diff --git a/src/codecs/ip/cd_frag.cc b/src/codecs/ip/cd_frag.cc index b5a71ff88..3313f873d 100644 --- a/src/codecs/ip/cd_frag.cc +++ b/src/codecs/ip/cd_frag.cc @@ -67,20 +67,20 @@ bool Ipv6FragCodec::decode(const RawData& raw, CodecData& codec, SnortData& snor if(raw.len < ip::MIN_EXT_LEN ) { - codec_events::decoder_event(DECODE_IPV6_TRUNCATED_EXT); + codec_events::decoder_event(codec, DECODE_IPV6_TRUNCATED_EXT); return false; } if ( codec.ip6_extension_count >= IP6_EXTMAX ) { - codec_events::decoder_event(DECODE_IP6_EXCESS_EXT_HDR); + codec_events::decoder_event(codec, DECODE_IP6_EXCESS_EXT_HDR); return false; } // already checked for short pacekt above if (raw.len == sizeof(ip::IP6Frag)) { - codec_events::decoder_event(DECODE_ZERO_LENGTH_FRAG); + codec_events::decoder_event(codec, DECODE_ZERO_LENGTH_FRAG); return false; } @@ -102,11 +102,12 @@ bool Ipv6FragCodec::decode(const RawData& raw, CodecData& codec, SnortData& snor if (frag_offset || (snort.decode_flags & DECODE_MF)) snort.decode_flags |= DECODE_FRAG; else - codec_events::decoder_event(DECODE_IPV6_BAD_FRAG_PKT); + codec_events::decoder_event(codec, DECODE_IPV6_BAD_FRAG_PKT); codec.lyr_len = sizeof(ip::IP6Frag); codec.next_prot_id = ip6frag_hdr->ip6f_nxt; + codec.ip6_csum_proto = ip6frag_hdr->ip6f_nxt; codec.proto_bits |= PROTO_BIT__IP6_EXT; codec.ip6_extension_count++; diff --git a/src/codecs/ip/cd_gre.cc b/src/codecs/ip/cd_gre.cc index 85979a703..9d7a11a96 100644 --- a/src/codecs/ip/cd_gre.cc +++ b/src/codecs/ip/cd_gre.cc @@ -115,7 +115,7 @@ bool GreCodec::decode(const RawData& raw, CodecData& codec, SnortData&) { if (raw.len < GRE_HEADER_LEN) { - codec_events::decoder_event(DECODE_GRE_DGRAM_LT_GREHDR); + codec_events::decoder_event(codec, DECODE_GRE_DGRAM_LT_GREHDR); return false; } @@ -133,7 +133,7 @@ bool GreCodec::decode(const RawData& raw, CodecData& codec, SnortData&) /* these must not be set */ if (GRE_RECUR(greh) || GRE_FLAGS(greh)) { - codec_events::decoder_event(DECODE_GRE_INVALID_HEADER); + codec_events::decoder_event(codec, DECODE_GRE_INVALID_HEADER); return false; } @@ -187,21 +187,21 @@ bool GreCodec::decode(const RawData& raw, CodecData& codec, SnortData&) if (GRE_CHKSUM(greh) || GRE_ROUTE(greh) || GRE_SSR(greh) || GRE_RECUR(greh) || GRE_V1_FLAGS(greh)) { - codec_events::decoder_event(DECODE_GRE_V1_INVALID_HEADER); + codec_events::decoder_event(codec, DECODE_GRE_V1_INVALID_HEADER); return false; } /* protocol must be 0x880B - PPP */ if (greh->get_proto() != ETHERTYPE_PPP) { - codec_events::decoder_event(DECODE_GRE_V1_INVALID_HEADER); + codec_events::decoder_event(codec, DECODE_GRE_V1_INVALID_HEADER); return false; } /* this flag should always be present */ if (!(GRE_KEY(greh))) { - codec_events::decoder_event(DECODE_GRE_V1_INVALID_HEADER); + codec_events::decoder_event(codec, DECODE_GRE_V1_INVALID_HEADER); return false; } @@ -216,13 +216,13 @@ bool GreCodec::decode(const RawData& raw, CodecData& codec, SnortData&) break; default: - codec_events::decoder_event(DECODE_GRE_INVALID_VERSION); + codec_events::decoder_event(codec, DECODE_GRE_INVALID_VERSION); return false; } if (len > raw.len) { - codec_events::decoder_event(DECODE_GRE_DGRAM_LT_GREHDR); + codec_events::decoder_event(codec, DECODE_GRE_DGRAM_LT_GREHDR); return false; } diff --git a/src/codecs/ip/cd_hop_opts.cc b/src/codecs/ip/cd_hop_opts.cc index 2d3c17c30..66bfd290c 100644 --- a/src/codecs/ip/cd_hop_opts.cc +++ b/src/codecs/ip/cd_hop_opts.cc @@ -74,13 +74,13 @@ bool Ipv6HopOptsCodec::decode(const RawData& raw, CodecData& codec, SnortData&) if (raw.len < sizeof(IP6HopByHop)) { - codec_events::decoder_event(DECODE_IPV6_TRUNCATED_EXT); + codec_events::decoder_event(codec, DECODE_IPV6_TRUNCATED_EXT); return false; } if ( codec.ip6_extension_count >= IP6_EXTMAX ) { - codec_events::decoder_event(DECODE_IP6_EXCESS_EXT_HDR); + codec_events::decoder_event(codec, DECODE_IP6_EXCESS_EXT_HDR); return false; } @@ -88,17 +88,18 @@ bool Ipv6HopOptsCodec::decode(const RawData& raw, CodecData& codec, SnortData&) codec.lyr_len = sizeof(IP6HopByHop) + (hbh_hdr->ip6hbh_len << 3); if(codec.lyr_len > raw.len) { - codec_events::decoder_event(DECODE_IPV6_TRUNCATED_EXT); + codec_events::decoder_event(codec, DECODE_IPV6_TRUNCATED_EXT); return false; } codec.next_prot_id = (uint16_t) hbh_hdr->ip6hbh_nxt; + codec.ip6_csum_proto = hbh_hdr->ip6hbh_nxt; codec.ip6_extension_count++; codec.proto_bits |= PROTO_BIT__IP6_EXT; // must be called AFTER setting next_prot_id ip_util::CheckIPv6ExtensionOrder(codec, IPPROTO_ID_HOPOPTS); - if ( ip_util::CheckIPV6HopOptions(raw)) + if ( ip_util::CheckIPV6HopOptions(raw, codec)) return true; return false; diff --git a/src/codecs/ip/cd_icmp4.cc b/src/codecs/ip/cd_icmp4.cc index 1e74479a2..ace3a5103 100644 --- a/src/codecs/ip/cd_icmp4.cc +++ b/src/codecs/ip/cd_icmp4.cc @@ -98,7 +98,7 @@ public: const Packet* const); private: - void ICMP4AddrTests(const SnortData&); + void ICMP4AddrTests(const SnortData& snort, const CodecData& codec); void ICMP4MiscTests(const ICMPHdr* const, const CodecData&, const uint16_t); }; @@ -131,7 +131,7 @@ bool Icmp4Codec::decode(const RawData& raw, CodecData& codec,SnortData& snort) if(raw.len < icmp::ICMP_HEADER_LEN) { - codec_events::decoder_event(DECODE_ICMP4_HDR_TRUNC); + codec_events::decoder_event(codec, DECODE_ICMP4_HDR_TRUNC); return false; } @@ -155,7 +155,7 @@ bool Icmp4Codec::decode(const RawData& raw, CodecData& codec,SnortData& snort) case icmp::IcmpType::INFO_REPLY: if (raw.len < 8) { - codec_events::decoder_event(DECODE_ICMP_DGRAM_LT_ICMPHDR); + codec_events::decoder_event(codec, DECODE_ICMP_DGRAM_LT_ICMPHDR); return false; } break; @@ -164,7 +164,7 @@ bool Icmp4Codec::decode(const RawData& raw, CodecData& codec,SnortData& snort) case icmp::IcmpType::TIMESTAMPREPLY: if (raw.len < 20) { - codec_events::decoder_event(DECODE_ICMP_DGRAM_LT_TIMESTAMPHDR); + codec_events::decoder_event(codec, DECODE_ICMP_DGRAM_LT_TIMESTAMPHDR); return false; } break; @@ -173,13 +173,13 @@ bool Icmp4Codec::decode(const RawData& raw, CodecData& codec,SnortData& snort) case icmp::IcmpType::ADDRESSREPLY: if (raw.len < 12) { - codec_events::decoder_event(DECODE_ICMP_DGRAM_LT_ADDRHDR); + codec_events::decoder_event(codec, DECODE_ICMP_DGRAM_LT_ADDRHDR); return false; } break; default: - codec_events::decoder_event(DECODE_ICMP4_TYPE_OTHER); + codec_events::decoder_event(codec, DECODE_ICMP4_TYPE_OTHER); break; } @@ -203,7 +203,7 @@ bool Icmp4Codec::decode(const RawData& raw, CodecData& codec,SnortData& snort) switch(icmph->type) { case icmp::IcmpType::ECHO_4: - ICMP4AddrTests(snort); + ICMP4AddrTests(snort, codec); // fall through ... case icmp::IcmpType::ECHOREPLY: @@ -217,7 +217,7 @@ bool Icmp4Codec::decode(const RawData& raw, CodecData& codec,SnortData& snort) if ((icmph->code == icmp::IcmpCode::FRAG_NEEDED) && (ntohs(icmph->s_icmp_nextmtu) < 576)) { - codec_events::decoder_event(DECODE_ICMP_PATH_MTU_DOS); + codec_events::decoder_event(codec, DECODE_ICMP_PATH_MTU_DOS); } /* Fall through */ @@ -246,13 +246,13 @@ bool Icmp4Codec::decode(const RawData& raw, CodecData& codec,SnortData& snort) return true; } -void Icmp4Codec::ICMP4AddrTests(const SnortData& snort) +void Icmp4Codec::ICMP4AddrTests(const SnortData& snort, const CodecData& codec) { uint32_t dst = snort.ip_api.get_dst()->ip32[0]; // check all 32 bits; all set so byte order is irrelevant ... if ( dst == ip::IP4_BROADCAST ) - codec_events::decoder_event(DECODE_ICMP4_DST_BROADCAST); + codec_events::decoder_event(codec, DECODE_ICMP4_DST_BROADCAST); /* - don't use htonl for speed reasons - * s_addr is always in network order */ @@ -266,7 +266,7 @@ void Icmp4Codec::ICMP4AddrTests(const SnortData& snort) msb_dst >>= 4; if( msb_dst == ip::IP4_MULTICAST ) - codec_events::decoder_event(DECODE_ICMP4_DST_MULTICAST); + codec_events::decoder_event(codec, DECODE_ICMP4_DST_MULTICAST); } @@ -276,45 +276,45 @@ void Icmp4Codec::ICMP4MiscTests(const ICMPHdr* const icmph, { if ((dsize == 0) && (icmph->type == icmp::IcmpType::ECHO_4)) - codec_events::decoder_event(DECODE_ICMP_PING_NMAP); + codec_events::decoder_event(codec, DECODE_ICMP_PING_NMAP); if ((dsize == 0) && (icmph->s_icmp_seq == 666)) - codec_events::decoder_event(DECODE_ICMP_ICMPENUM); + codec_events::decoder_event(codec, DECODE_ICMP_ICMPENUM); if ((icmph->type == icmp::IcmpType::REDIRECT) && (icmph->code == icmp::IcmpCode::REDIR_HOST)) - codec_events::decoder_event(DECODE_ICMP_REDIRECT_HOST); + codec_events::decoder_event(codec, DECODE_ICMP_REDIRECT_HOST); if ((icmph->type == icmp::IcmpType::REDIRECT) && (icmph->code == icmp::IcmpCode::REDIR_NET)) - codec_events::decoder_event(DECODE_ICMP_REDIRECT_NET); + codec_events::decoder_event(codec, DECODE_ICMP_REDIRECT_NET); if ((icmph->type == icmp::IcmpType::ECHOREPLY) && (codec.codec_flags & CODEC_IPOPT_RR_SEEN)) - codec_events::decoder_event(DECODE_ICMP_TRACEROUTE_IPOPTS); + codec_events::decoder_event(codec, DECODE_ICMP_TRACEROUTE_IPOPTS); if ((icmph->type == icmp::IcmpType::SOURCE_QUENCH) && (icmph->code == icmp::IcmpCode::SOURCE_QUENCH_CODE)) - codec_events::decoder_event(DECODE_ICMP_SOURCE_QUENCH); + codec_events::decoder_event(codec, DECODE_ICMP_SOURCE_QUENCH); if ((dsize == 4) && (icmph->type == icmp::IcmpType::ECHO_4) && (icmph->s_icmp_seq == 0) && (icmph->code == icmp::IcmpCode::ECHO_CODE)) - codec_events::decoder_event(DECODE_ICMP_BROADSCAN_SMURF_SCANNER); + codec_events::decoder_event(codec, DECODE_ICMP_BROADSCAN_SMURF_SCANNER); if ((icmph->type == icmp::IcmpType::DEST_UNREACH) && (icmph->code == icmp::IcmpCode::PKT_FILTERED)) - codec_events::decoder_event(DECODE_ICMP_DST_UNREACH_ADMIN_PROHIBITED); + codec_events::decoder_event(codec, DECODE_ICMP_DST_UNREACH_ADMIN_PROHIBITED); if ((icmph->type == icmp::IcmpType::DEST_UNREACH) && (icmph->code == icmp::IcmpCode::PKT_FILTERED_HOST)) - codec_events::decoder_event(DECODE_ICMP_DST_UNREACH_DST_HOST_PROHIBITED); + codec_events::decoder_event(codec, DECODE_ICMP_DST_UNREACH_DST_HOST_PROHIBITED); if ((icmph->type == icmp::IcmpType::DEST_UNREACH) && (icmph->code == icmp::IcmpCode::PKT_FILTERED_NET)) - codec_events::decoder_event(DECODE_ICMP_DST_UNREACH_DST_NET_PROHIBITED); + codec_events::decoder_event(codec, DECODE_ICMP_DST_UNREACH_DST_NET_PROHIBITED); } /****************************************************************** diff --git a/src/codecs/ip/cd_icmp6.cc b/src/codecs/ip/cd_icmp6.cc index 8afed0ae2..a26438f20 100644 --- a/src/codecs/ip/cd_icmp6.cc +++ b/src/codecs/ip/cd_icmp6.cc @@ -103,7 +103,7 @@ bool Icmp6Codec::decode(const RawData& raw, CodecData& codec, SnortData& snort) DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "WARNING: Truncated ICMP6 header (%d bytes).\n", raw.len);); - codec_events::decoder_event(DECODE_ICMP6_HDR_TRUNC); + codec_events::decoder_event(codec, DECODE_ICMP6_HDR_TRUNC); return false; } @@ -126,7 +126,7 @@ bool Icmp6Codec::decode(const RawData& raw, CodecData& codec, SnortData& snort) COPY4(ph6.sip, snort.ip_api.get_src()->ip32); COPY4(ph6.dip, snort.ip_api.get_dst()->ip32); ph6.zero = 0; - ph6.protocol = snort.ip_api.proto(); + ph6.protocol = codec.ip6_csum_proto; ph6.len = htons((u_short)raw.len); csum = checksum::icmp_cksum((uint16_t *)(icmp6h), raw.len, &ph6); @@ -153,11 +153,11 @@ bool Icmp6Codec::decode(const RawData& raw, CodecData& codec, SnortData& snort) len = icmp::ICMP6_HEADER_NORMAL_LEN; if ( snort.ip_api.get_ip6h()->is_dst_multicast() ) - codec_events::decoder_event(DECODE_ICMP6_DST_MULTICAST); + codec_events::decoder_event(codec, DECODE_ICMP6_DST_MULTICAST); } else { - codec_events::decoder_event(DECODE_ICMP_DGRAM_LT_ICMPHDR); + codec_events::decoder_event(codec, DECODE_ICMP_DGRAM_LT_ICMPHDR); return false; } break; @@ -168,14 +168,14 @@ bool Icmp6Codec::decode(const RawData& raw, CodecData& codec, SnortData& snort) icmp::ICMP6TooBig *too_big = (icmp::ICMP6TooBig *)raw.data; if (ntohl(too_big->mtu) < 1280) - codec_events::decoder_event(DECODE_ICMPV6_TOO_BIG_BAD_MTU); + codec_events::decoder_event(codec, DECODE_ICMPV6_TOO_BIG_BAD_MTU); len = icmp::ICMP6_HEADER_NORMAL_LEN; codec.next_prot_id = IP_EMBEDDED_IN_ICMP6; } else { - codec_events::decoder_event(DECODE_ICMP_DGRAM_LT_ICMPHDR); + codec_events::decoder_event(codec, DECODE_ICMP_DGRAM_LT_ICMPHDR); return false; } break; @@ -188,17 +188,17 @@ bool Icmp6Codec::decode(const RawData& raw, CodecData& codec, SnortData& snort) if (icmp6h->type == icmp::Icmp6Types::UNREACH) { if (icmp6h->code == icmp::Icmp6Code::UNREACH_INVALID) // UNREACH_INVALID == 2 - codec_events::decoder_event(DECODE_ICMPV6_UNREACHABLE_NON_RFC_2463_CODE); + codec_events::decoder_event(codec, DECODE_ICMPV6_UNREACHABLE_NON_RFC_2463_CODE); else if (static_cast(icmp6h->code) > 6) - codec_events::decoder_event(DECODE_ICMPV6_UNREACHABLE_NON_RFC_4443_CODE); + codec_events::decoder_event(codec, DECODE_ICMPV6_UNREACHABLE_NON_RFC_4443_CODE); } len = icmp::ICMP6_HEADER_NORMAL_LEN; codec.next_prot_id = IP_EMBEDDED_IN_ICMP6; } else { - codec_events::decoder_event(DECODE_ICMP_DGRAM_LT_ICMPHDR); + codec_events::decoder_event(codec, DECODE_ICMP_DGRAM_LT_ICMPHDR); return false; } break; @@ -209,16 +209,16 @@ bool Icmp6Codec::decode(const RawData& raw, CodecData& codec, SnortData& snort) icmp::ICMP6RouterAdvertisement *ra = (icmp::ICMP6RouterAdvertisement *)raw.data; if (icmp6h->code != icmp::Icmp6Code::ADVERTISEMENT) - codec_events::decoder_event(DECODE_ICMPV6_ADVERT_BAD_CODE); + codec_events::decoder_event(codec, DECODE_ICMPV6_ADVERT_BAD_CODE); if (ntohl(ra->reachable_time) > 3600000) - codec_events::decoder_event(DECODE_ICMPV6_ADVERT_BAD_REACHABLE); + codec_events::decoder_event(codec, DECODE_ICMPV6_ADVERT_BAD_REACHABLE); len = icmp::ICMP6_HEADER_MIN_LEN; } else { - codec_events::decoder_event(DECODE_ICMP_DGRAM_LT_ICMPHDR); + codec_events::decoder_event(codec, DECODE_ICMP_DGRAM_LT_ICMPHDR); return false; } break; @@ -228,16 +228,16 @@ bool Icmp6Codec::decode(const RawData& raw, CodecData& codec, SnortData& snort) { icmp::ICMP6RouterSolicitation *rs = (icmp::ICMP6RouterSolicitation *)raw.data; if (rs->code != 0) - codec_events::decoder_event(DECODE_ICMPV6_SOLICITATION_BAD_CODE); + codec_events::decoder_event(codec, DECODE_ICMPV6_SOLICITATION_BAD_CODE); if (ntohl(rs->reserved) != 0) - codec_events::decoder_event(DECODE_ICMPV6_SOLICITATION_BAD_RESERVED); + codec_events::decoder_event(codec, DECODE_ICMPV6_SOLICITATION_BAD_RESERVED); len = icmp::ICMP6_HEADER_MIN_LEN; } else { - codec_events::decoder_event(DECODE_ICMP_DGRAM_LT_ICMPHDR); + codec_events::decoder_event(codec, DECODE_ICMP_DGRAM_LT_ICMPHDR); return false; } break; @@ -248,7 +248,7 @@ bool Icmp6Codec::decode(const RawData& raw, CodecData& codec, SnortData& snort) { icmp::ICMP6NodeInfo *ni = (icmp::ICMP6NodeInfo *)raw.data; if (ni->code > 2) - codec_events::decoder_event(DECODE_ICMPV6_NODE_INFO_BAD_CODE); + codec_events::decoder_event(codec, DECODE_ICMPV6_NODE_INFO_BAD_CODE); /* TODO: Add alert for INFO Response, code == 1 || code == 2) * and there is data. @@ -257,13 +257,13 @@ bool Icmp6Codec::decode(const RawData& raw, CodecData& codec, SnortData& snort) } else { - codec_events::decoder_event(DECODE_ICMP_DGRAM_LT_ICMPHDR); + codec_events::decoder_event(codec, DECODE_ICMP_DGRAM_LT_ICMPHDR); return false; } break; default: - codec_events::decoder_event(DECODE_ICMP6_TYPE_OTHER); + codec_events::decoder_event(codec, DECODE_ICMP6_TYPE_OTHER); len = icmp::ICMP6_HEADER_MIN_LEN; break; } diff --git a/src/codecs/ip/cd_igmp.cc b/src/codecs/ip/cd_igmp.cc index 808ff1a5e..9062f3296 100644 --- a/src/codecs/ip/cd_igmp.cc +++ b/src/codecs/ip/cd_igmp.cc @@ -86,7 +86,7 @@ bool IgmpCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort) if (snort.ip_api.get_ip_opt_len() >= 2) { if (*(ip_opt_data) == 0 && *(ip_opt_data+1) == 0) { - codec_events::decoder_event(DECODE_IGMP_OPTIONS_DOS); + codec_events::decoder_event(codec, DECODE_IGMP_OPTIONS_DOS); return false; } } @@ -96,7 +96,7 @@ bool IgmpCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort) if ((!(codec.codec_flags & CODEC_IPOPT_RTRALT_SEEN)) && (codec.codec_flags & CODEC_IPOPT_LEN_THREE)) { - codec_events::decoder_event(DECODE_IGMP_OPTIONS_DOS); + codec_events::decoder_event(codec, DECODE_IGMP_OPTIONS_DOS); } } return true; diff --git a/src/codecs/ip/cd_ipv4.cc b/src/codecs/ip/cd_ipv4.cc index 15cec186e..3bcf700ce 100644 --- a/src/codecs/ip/cd_ipv4.cc +++ b/src/codecs/ip/cd_ipv4.cc @@ -122,8 +122,8 @@ static THREAD_LOCAL std::array s_id_pool{{0}}; } // namespace -static inline void IP4AddrTests (const IP4Hdr*); -static inline void IPMiscTests(const IP4Hdr* const, uint16_t len); +static inline void IP4AddrTests(const IP4Hdr*, const CodecData&); +static inline void IPMiscTests(const IP4Hdr* const ip4h, const CodecData& codec, uint16_t len); static void DecodeIPOptions(const uint8_t *start, uint8_t& o_len, CodecData& data); @@ -147,7 +147,7 @@ bool Ipv4Codec::decode(const RawData& raw, CodecData& codec, SnortData& snort) "WARNING: Truncated IP4 header (%d bytes).\n", raw.len);); if ((codec.codec_flags & CODEC_UNSURE_ENCAP) == 0) - codec_events::decoder_event(DECODE_IP4_HDR_TRUNC); + codec_events::decoder_event(codec, DECODE_IP4_HDR_TRUNC); return false; } @@ -155,7 +155,7 @@ bool Ipv4Codec::decode(const RawData& raw, CodecData& codec, SnortData& snort) codec.ip_layer_cnt++; // FIXIT-H -j allow configure IP and IP6 encapsulation limits if (codec.ip_layer_cnt > 1) - codec_events::decoder_event(DECODE_IP_MULTIPLE_ENCAPSULATION); + codec_events::decoder_event(codec, DECODE_IP_MULTIPLE_ENCAPSULATION); /* lay the IP struct over the raw data */ const IP4Hdr* const iph = reinterpret_cast(raw.data); @@ -167,7 +167,7 @@ bool Ipv4Codec::decode(const RawData& raw, CodecData& codec, SnortData& snort) if (iph->get_ver() != 4) { if ((codec.codec_flags & CODEC_UNSURE_ENCAP) == 0) - codec_events::decoder_event(DECODE_NOT_IPV4_DGRAM); + codec_events::decoder_event(codec, DECODE_NOT_IPV4_DGRAM); return false; } @@ -181,7 +181,7 @@ bool Ipv4Codec::decode(const RawData& raw, CodecData& codec, SnortData& snort) DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Bogus IP header length of %i bytes\n", hlen);); - codec_events::decoder_event(DECODE_IPV4_INVALID_HEADER_LEN); + codec_events::decoder_event(codec, DECODE_IPV4_INVALID_HEADER_LEN); return false; } @@ -192,7 +192,7 @@ bool Ipv4Codec::decode(const RawData& raw, CodecData& codec, SnortData& snort) " (ip.len: %lu, cap.len: %lu)\n", ip_len - raw.len, ip_len, raw.len);); - codec_events::decoder_event(DECODE_IPV4_DGRAM_GT_CAPLEN); + codec_events::decoder_event(codec, DECODE_IPV4_DGRAM_GT_CAPLEN); return false; } #if 0 @@ -216,7 +216,7 @@ bool Ipv4Codec::decode(const RawData& raw, CodecData& codec, SnortData& snort) "IP dgm len (%d bytes) < IP hdr " "len (%d bytes), packet discarded\n", ip_len, hlen);); - codec_events::decoder_event(DECODE_IPV4_DGRAM_LT_IPHDR); + codec_events::decoder_event(codec, DECODE_IPV4_DGRAM_LT_IPHDR); return false; } @@ -226,7 +226,7 @@ bool Ipv4Codec::decode(const RawData& raw, CodecData& codec, SnortData& snort) /* * IP Header tests: Land attack, and Loop back test */ - IP4AddrTests(iph); + IP4AddrTests(iph, codec); if (ScIpChecksums()) { @@ -286,16 +286,16 @@ bool Ipv4Codec::decode(const RawData& raw, CodecData& codec, SnortData& snort) frag_off &= 0x1FFF; if ((codec.codec_flags & CODEC_DF) && frag_off ) - codec_events::decoder_event(DECODE_IP4_DF_OFFSET); + codec_events::decoder_event(codec, DECODE_IP4_DF_OFFSET); if ( frag_off + ip_len > IP_MAXPACKET ) - codec_events::decoder_event(DECODE_IP4_LEN_OFFSET); + codec_events::decoder_event(codec, DECODE_IP4_LEN_OFFSET); if(frag_off || (snort.decode_flags & DECODE_MF)) { if ( !ip_len) { - codec_events::decoder_event(DECODE_ZERO_LENGTH_FRAG); + codec_events::decoder_event(codec, DECODE_ZERO_LENGTH_FRAG); snort.decode_flags &= ~DECODE_FRAG; } else @@ -310,12 +310,12 @@ bool Ipv4Codec::decode(const RawData& raw, CodecData& codec, SnortData& snort) } if( (snort.decode_flags & DECODE_MF) && (codec.codec_flags & CODEC_DF)) - codec_events::decoder_event(DECODE_BAD_FRAGBITS); + codec_events::decoder_event(codec, DECODE_BAD_FRAGBITS); snort.set_pkt_type(PktType::IP); codec.proto_bits |= PROTO_BIT__IP; - IPMiscTests(iph, ip::IP4_HEADER_LEN + ip_opt_len); + IPMiscTests(iph, codec, ip::IP4_HEADER_LEN + ip_opt_len); codec.lyr_len = hlen; @@ -326,7 +326,7 @@ bool Ipv4Codec::decode(const RawData& raw, CodecData& codec, SnortData& snort) (iph->get_proto() == IPPROTO_UDP))) { if (iph->get_proto() >= MIN_UNASSIGNED_IP_PROTO) - codec_events::decoder_event(DECODE_IP_UNASSIGNED_PROTO); + codec_events::decoder_event(codec, DECODE_IP_UNASSIGNED_PROTO); else codec.next_prot_id = iph->get_proto(); } @@ -341,22 +341,22 @@ bool Ipv4Codec::decode(const RawData& raw, CodecData& codec, SnortData& snort) //-------------------------------------------------------------------- -static inline void IP4AddrTests(const IP4Hdr* iph) +static inline void IP4AddrTests(const IP4Hdr* iph, const CodecData& codec) { uint8_t msb_src, msb_dst; // check all 32 bits ... if( iph->ip_src == iph->ip_dst ) { - codec_events::decoder_event(DECODE_BAD_TRAFFIC_SAME_SRCDST); + codec_events::decoder_event(codec, DECODE_BAD_TRAFFIC_SAME_SRCDST); } // check all 32 bits ... if (iph->is_src_broadcast()) - codec_events::decoder_event(DECODE_IP4_SRC_BROADCAST); + codec_events::decoder_event(codec, DECODE_IP4_SRC_BROADCAST); if (iph->is_dst_broadcast()) - codec_events::decoder_event(DECODE_IP4_DST_BROADCAST); + codec_events::decoder_event(codec, DECODE_IP4_DST_BROADCAST); /* Loopback traffic - don't use htonl for speed reasons - * s_addr is always in network order */ @@ -370,32 +370,32 @@ static inline void IP4AddrTests(const IP4Hdr* iph) // check the msb ... if ( (msb_src == ip::IP4_LOOPBACK) || (msb_dst == ip::IP4_LOOPBACK) ) { - codec_events::decoder_event(DECODE_BAD_TRAFFIC_LOOPBACK); + codec_events::decoder_event(codec, DECODE_BAD_TRAFFIC_LOOPBACK); } // check the msb ... if ( msb_src == ip::IP4_THIS_NET ) - codec_events::decoder_event(DECODE_IP4_SRC_THIS_NET); + codec_events::decoder_event(codec, DECODE_IP4_SRC_THIS_NET); if ( msb_dst == ip::IP4_THIS_NET ) - codec_events::decoder_event(DECODE_IP4_DST_THIS_NET); + codec_events::decoder_event(codec, DECODE_IP4_DST_THIS_NET); // check the 'msn' (most significant nibble) ... msb_src >>= 4; msb_dst >>= 4; if ( msb_src == ip::IP4_MULTICAST ) - codec_events::decoder_event(DECODE_IP4_SRC_MULTICAST); + codec_events::decoder_event(codec, DECODE_IP4_SRC_MULTICAST); if ( msb_src == ip::IP4_RESERVED ) - codec_events::decoder_event(DECODE_IP4_SRC_RESERVED); + codec_events::decoder_event(codec, DECODE_IP4_SRC_RESERVED); if ( msb_dst == ip::IP4_RESERVED ) - codec_events::decoder_event(DECODE_IP4_DST_RESERVED); + codec_events::decoder_event(codec, DECODE_IP4_DST_RESERVED); } /* IPv4-layer decoder rules */ -static inline void IPMiscTests(const IP4Hdr* const ip4h, uint16_t len) +static inline void IPMiscTests(const IP4Hdr* const ip4h, const CodecData& codec, uint16_t len) { /* Yes, it's an ICMP-related vuln in IP options. */ @@ -422,7 +422,7 @@ static inline void IPMiscTests(const IP4Hdr* const ip4h, uint16_t len) /* If the remaining space in the option isn't a multiple of 4 bytes, alert. */ if (((length + 1) - pointer) % 4) - codec_events::decoder_event(DECODE_ICMP_DOS_ATTEMPT); + codec_events::decoder_event(codec, DECODE_ICMP_DOS_ATTEMPT); } else if (opt.code == ip::IPOptionCodes::TS) { @@ -439,12 +439,12 @@ static inline void IPMiscTests(const IP4Hdr* const ip4h, uint16_t len) /* If the remaining space in the option isn't a multiple of 4 bytes, alert. */ if (((length + 1) - pointer) % 4) - codec_events::decoder_event(DECODE_ICMP_DOS_ATTEMPT); + codec_events::decoder_event(codec, DECODE_ICMP_DOS_ATTEMPT); /* If there is a timestamp + address, we need a multiple of 8 bytes instead. */ if ((opt.data[1] & 0x01) && /* address flag */ (((length + 1) - pointer) % 8)) - codec_events::decoder_event(DECODE_ICMP_DOS_ATTEMPT); + codec_events::decoder_event(codec, DECODE_ICMP_DOS_ATTEMPT); } } } @@ -515,9 +515,9 @@ default_case: { /* Yes, we use TCP_OPT_* for the IP option decoder. */ if(code == tcp::OPT_BADLEN) - codec_events::decoder_event(DECODE_IPV4OPT_BADLEN); + codec_events::decoder_event(codec, DECODE_IPV4OPT_BADLEN); else if(code == tcp::OPT_TRUNC) - codec_events::decoder_event(DECODE_IPV4OPT_TRUNCATED); + codec_events::decoder_event(codec, DECODE_IPV4OPT_TRUNCATED); codec.invalid_bytes = o_len - tot_len; o_len = tot_len; diff --git a/src/codecs/ip/cd_ipv6.cc b/src/codecs/ip/cd_ipv6.cc index e70307c76..12efac1a3 100644 --- a/src/codecs/ip/cd_ipv6.cc +++ b/src/codecs/ip/cd_ipv6.cc @@ -106,10 +106,12 @@ public: } // namespace -static inline void IPV6CheckIsatap(const ip::IP6Hdr* const, const SnortData&); -static inline void IPV6MiscTests(const SnortData&); -static void CheckIPV6Multicast(const ip::IP6Hdr* const); -static inline int CheckTeredoPrefix(const ip::IP6Hdr* const hdr); +static inline void IPV6CheckIsatap(const ip::IP6Hdr* const, + const SnortData&, + const CodecData&); +static inline void IPV6MiscTests(const SnortData&, const CodecData&); +static void CheckIPV6Multicast(const ip::IP6Hdr* const, const CodecData&); +static inline bool CheckTeredoPrefix(const ip::IP6Hdr* const hdr); /******************************************************************** ************************* CLASS FUNCTIONS ************************ @@ -133,10 +135,10 @@ bool Ipv6Codec::decode(const RawData& raw, CodecData& codec, SnortData& snort) if(raw.len < ip::IP6_HEADER_LEN) { if ((codec.codec_flags & CODEC_UNSURE_ENCAP) == 0) - codec_events::decoder_event(DECODE_IPV6_TRUNCATED); + codec_events::decoder_event(codec, DECODE_IPV6_TRUNCATED); // Taken from prot_ipv4.cc - codec_events::decoder_event(DECODE_IPV6_TUNNELED_IPV4_TRUNCATED); + codec_events::decoder_event(codec, DECODE_IPV6_TUNNELED_IPV4_TRUNCATED); goto decodeipv6_fail; } @@ -145,14 +147,14 @@ bool Ipv6Codec::decode(const RawData& raw, CodecData& codec, SnortData& snort) if(ip6h->get_ver() != 6) { if ((codec.codec_flags & CODEC_UNSURE_ENCAP) == 0) - codec_events::decoder_event(DECODE_IPV6_IS_NOT); + codec_events::decoder_event(codec, DECODE_IPV6_IS_NOT); goto decodeipv6_fail; } // FIXIT-H -J alert on user configured encapsulated - if (codec.ip_layer_cnt > 1) - codec_events::decoder_event(DECODE_IP_MULTIPLE_ENCAPSULATION); + if (codec.ip_layer_cnt++ > 1) + codec_events::decoder_event(codec, DECODE_IP_MULTIPLE_ENCAPSULATION); const uint32_t payload_len = ntohs(ip6h->ip6_payload_len) + ip::IP6_HEADER_LEN; @@ -162,7 +164,7 @@ bool Ipv6Codec::decode(const RawData& raw, CodecData& codec, SnortData& snort) if (payload_len > raw.len) { if ((codec.codec_flags & CODEC_UNSURE_ENCAP) == 0) - codec_events::decoder_event(DECODE_IPV6_DGRAM_GT_CAPLEN); + codec_events::decoder_event(codec, DECODE_IPV6_DGRAM_GT_CAPLEN); goto decodeipv6_fail; } @@ -178,7 +180,7 @@ bool Ipv6Codec::decode(const RawData& raw, CodecData& codec, SnortData& snort) If we ever start decoding more than 2 layers of IP in a packet, this check against snort.proto_bits will need to be refactored. */ - if ((codec.codec_flags & CODEC_TEREDO_SEEN) && (CheckTeredoPrefix(ip6h) == 0)) + if ((codec.codec_flags & CODEC_TEREDO_SEEN) && (!CheckTeredoPrefix(ip6h))) { goto decodeipv6_fail; } @@ -190,23 +192,23 @@ bool Ipv6Codec::decode(const RawData& raw, CodecData& codec, SnortData& snort) const_cast(raw.len) = ntohs(ip6h->get_len()) + ip::IP6_HEADER_LEN; // check for isatap before overwriting the ip_api. - IPV6CheckIsatap(ip6h, snort); + IPV6CheckIsatap(ip6h, snort, codec); snort.ip_api.set(ip6h); - codec.curr_ip6_extension = 0; - codec.ip6_extension_count = 0; - codec.codec_flags &= ~CODEC_ROUTING_SEEN; - IPV6MiscTests(snort); - CheckIPV6Multicast(ip6h); + IPV6MiscTests(snort, codec); + CheckIPV6Multicast(ip6h, codec); snort.set_pkt_type(PktType::IP); codec.next_prot_id = ip6h->get_next(); codec.lyr_len = ip::IP6_HEADER_LEN; + codec.curr_ip6_extension = 0; + codec.ip6_extension_count = 0; + codec.ip6_csum_proto = ip6h->get_next(); + codec.codec_flags &= ~CODEC_ROUTING_SEEN; // FIXIT-M J tunnel-byppas is NOT checked!! return true; - } decodeipv6_fail: @@ -222,7 +224,9 @@ decodeipv6_fail: return false; } -static inline void IPV6CheckIsatap(const ip::IP6Hdr* const ip6h, const SnortData& snort) +static inline void IPV6CheckIsatap(const ip::IP6Hdr* const ip6h, + const SnortData& snort, + const CodecData& codec) { /* Only check for IPv6 over IPv4 */ if (snort.ip_api.is_ip4() && snort.ip_api.proto() == IPPROTO_ID_IPV6) @@ -234,7 +238,7 @@ static inline void IPV6CheckIsatap(const ip::IP6Hdr* const ip6h, const SnortData if (isatap_interface_id == 0x00005EFE) { if (snort.ip_api.get_src()->ip32[0] != ip6h->ip6_src.u6_addr32[3]) - codec_events::decoder_event(DECODE_IPV6_ISATAP_SPOOF); + codec_events::decoder_event(codec, DECODE_IPV6_ISATAP_SPOOF); } } } @@ -247,7 +251,7 @@ static inline void IPV6CheckIsatap(const ip::IP6Hdr* const ip6h, const SnortData * * Returns: void function */ -static inline void IPV6MiscTests(const SnortData& snort) +static inline void IPV6MiscTests(const SnortData& snort, const CodecData& codec) { const sfip_t *ip_src = snort.ip_api.get_src(); const sfip_t *ip_dst = snort.ip_api.get_dst(); @@ -263,32 +267,32 @@ static inline void IPV6MiscTests(const SnortData& snort) * is used here in the interrim. */ if( sfip_contains(ip_src, ip_dst) == SFIP_CONTAINS) { - codec_events::decoder_event(DECODE_BAD_TRAFFIC_SAME_SRCDST); + codec_events::decoder_event(codec, DECODE_BAD_TRAFFIC_SAME_SRCDST); } if(sfip_is_loopback(ip_src) || sfip_is_loopback(ip_dst)) { - codec_events::decoder_event(DECODE_BAD_TRAFFIC_LOOPBACK); + codec_events::decoder_event(codec, DECODE_BAD_TRAFFIC_LOOPBACK); } /* Other decoder alerts for IPv6 addresses Added: 5/24/10 (Snort 2.9.0) */ if (!sfip_is_set(ip_dst)) { - codec_events::decoder_event(DECODE_IPV6_DST_ZERO); + codec_events::decoder_event(codec, DECODE_IPV6_DST_ZERO); } } /* Check for multiple IPv6 Multicast-related alerts */ -static void CheckIPV6Multicast(const ip::IP6Hdr* const ip6h) +static void CheckIPV6Multicast(const ip::IP6Hdr* const ip6h, const CodecData& codec) { ip::MulticastScope multicast_scope; if (ip6h->is_src_multicast()) { - codec_events::decoder_event(DECODE_IPV6_SRC_MULTICAST); + codec_events::decoder_event(codec, DECODE_IPV6_SRC_MULTICAST); } if (!ip6h->is_dst_multicast()) { @@ -308,7 +312,7 @@ static void CheckIPV6Multicast(const ip::IP6Hdr* const ip6h) break; default: - codec_events::decoder_event(DECODE_IPV6_BAD_MULTICAST_SCOPE); + codec_events::decoder_event(codec, DECODE_IPV6_BAD_MULTICAST_SCOPE); } /* Check against assigned multicast addresses. These are listed at: @@ -322,7 +326,7 @@ static void CheckIPV6Multicast(const ip::IP6Hdr* const ip6h) (ip6h->ip6_dst.u6_addr16[4] != 0) || (ip6h->ip6_dst.u6_addr8[10] != 0)) { - codec_events::decoder_event(DECODE_IPV6_DST_RESERVED_MULTICAST); + codec_events::decoder_event(codec, DECODE_IPV6_DST_RESERVED_MULTICAST); return; } @@ -337,7 +341,7 @@ static void CheckIPV6Multicast(const ip::IP6Hdr* const ip6h) (ip6h->ip6_dst.u6_addr16[6] != 0)) { - codec_events::decoder_event(DECODE_IPV6_DST_RESERVED_MULTICAST); + codec_events::decoder_event(codec, DECODE_IPV6_DST_RESERVED_MULTICAST); } else { @@ -348,7 +352,7 @@ static void CheckIPV6Multicast(const ip::IP6Hdr* const ip6h) case 0x000000FB: // mDNSv6 break; default: - codec_events::decoder_event(DECODE_IPV6_DST_RESERVED_MULTICAST); + codec_events::decoder_event(codec, DECODE_IPV6_DST_RESERVED_MULTICAST); } } } @@ -396,7 +400,7 @@ static void CheckIPV6Multicast(const ip::IP6Hdr* const ip6h) { break; // Node Information Queries } - codec_events::decoder_event(DECODE_IPV6_DST_RESERVED_MULTICAST); + codec_events::decoder_event(codec, DECODE_IPV6_DST_RESERVED_MULTICAST); } } else if (ip6h->is_dst_multicast_scope_site()) @@ -411,7 +415,7 @@ static void CheckIPV6Multicast(const ip::IP6Hdr* const ip6h) case 0x00010005: // SL-MANET-ROUTERS break; default: - codec_events::decoder_event(DECODE_IPV6_DST_RESERVED_MULTICAST); + codec_events::decoder_event(codec, DECODE_IPV6_DST_RESERVED_MULTICAST); } } else if ((ip6h->ip6_dst.u6_addr8[1] & 0xF0) == 0) @@ -464,7 +468,7 @@ static void CheckIPV6Multicast(const ip::IP6Hdr* const ip6h) break; // SAP Dynamic Assignments } - codec_events::decoder_event(DECODE_IPV6_DST_RESERVED_MULTICAST); + codec_events::decoder_event(codec, DECODE_IPV6_DST_RESERVED_MULTICAST); } } else if ((ip6h->ip6_dst.u6_addr8[1] & 0xF0) == 0x30) @@ -483,27 +487,27 @@ static void CheckIPV6Multicast(const ip::IP6Hdr* const ip6h) else { // Other addresses in this block are reserved. - codec_events::decoder_event(DECODE_IPV6_DST_RESERVED_MULTICAST); + codec_events::decoder_event(codec, DECODE_IPV6_DST_RESERVED_MULTICAST); } } else { /* Addresses not listed above are reserved. */ - codec_events::decoder_event(DECODE_IPV6_DST_RESERVED_MULTICAST); + codec_events::decoder_event(codec, DECODE_IPV6_DST_RESERVED_MULTICAST); } } /* Teredo packets need to have one of their IPs use either the Teredo prefix, or a link-local prefix (in the case of Router Solicitation messages) */ -static inline int CheckTeredoPrefix(const ip::IP6Hdr* const hdr) +static inline bool CheckTeredoPrefix(const ip::IP6Hdr* const hdr) { /* Check if src address matches 2001::/32 */ if ((hdr->ip6_src.u6_addr8[0] == 0x20) && (hdr->ip6_src.u6_addr8[1] == 0x01) && (hdr->ip6_src.u6_addr8[2] == 0x00) && (hdr->ip6_src.u6_addr8[3] == 0x00)) - return 1; + return true; /* Check if src address matches fe80::/64 */ if ((hdr->ip6_src.u6_addr8[0] == 0xfe) && @@ -514,14 +518,14 @@ static inline int CheckTeredoPrefix(const ip::IP6Hdr* const hdr) (hdr->ip6_src.u6_addr8[5] == 0x00) && (hdr->ip6_src.u6_addr8[6] == 0x00) && (hdr->ip6_src.u6_addr8[7] == 0x00)) - return 1; + return true; /* Check if dst address matches 2001::/32 */ if ((hdr->ip6_dst.u6_addr8[0] == 0x20) && (hdr->ip6_dst.u6_addr8[1] == 0x01) && (hdr->ip6_dst.u6_addr8[2] == 0x00) && (hdr->ip6_dst.u6_addr8[3] == 0x00)) - return 1; + return true; /* Check if dst address matches fe80::/64 */ if ((hdr->ip6_dst.u6_addr8[0] == 0xfe) && @@ -532,10 +536,10 @@ static inline int CheckTeredoPrefix(const ip::IP6Hdr* const hdr) (hdr->ip6_dst.u6_addr8[5] == 0x00) && (hdr->ip6_dst.u6_addr8[6] == 0x00) && (hdr->ip6_dst.u6_addr8[7] == 0x00)) - return 1; + return true; /* No Teredo prefix found. */ - return 0; + return false; } diff --git a/src/codecs/ip/cd_mobility.cc b/src/codecs/ip/cd_mobility.cc index 15205b360..ad25c6b35 100644 --- a/src/codecs/ip/cd_mobility.cc +++ b/src/codecs/ip/cd_mobility.cc @@ -57,7 +57,7 @@ void MobilityCodec::get_protocol_ids(std::vector& v) bool MobilityCodec::decode(const RawData&, CodecData& codec, SnortData&) { - codec_events::decoder_event(DECODE_IP_BAD_PROTO); + codec_events::decoder_event(codec, DECODE_IP_BAD_PROTO); codec.proto_bits |= PROTO_BIT__IP6_EXT; // check for any IP related rules return true; } diff --git a/src/codecs/ip/cd_pgm.cc b/src/codecs/ip/cd_pgm.cc index 2d1bab255..cda4988f7 100644 --- a/src/codecs/ip/cd_pgm.cc +++ b/src/codecs/ip/cd_pgm.cc @@ -151,10 +151,10 @@ static inline int pgm_nak_detect (const RawData& raw) // private functions //------------------------------------------------------------------------- -bool PgmCodec::decode(const RawData& raw, CodecData&, SnortData&) +bool PgmCodec::decode(const RawData& raw, CodecData& codec, SnortData&) { if ( pgm_nak_detect(raw) == PGM_NAK_VULN ) - codec_events::decoder_event(DECODE_PGM_NAK_OVERFLOW); + codec_events::decoder_event(codec, DECODE_PGM_NAK_OVERFLOW); return true; } diff --git a/src/codecs/ip/cd_routing.cc b/src/codecs/ip/cd_routing.cc index 6770991e6..294cf5f0c 100644 --- a/src/codecs/ip/cd_routing.cc +++ b/src/codecs/ip/cd_routing.cc @@ -85,37 +85,37 @@ bool Ipv6RoutingCodec::decode(const RawData& raw, CodecData& codec, SnortData&) if(raw.len < ip::MIN_EXT_LEN) { - codec_events::decoder_event(DECODE_IPV6_TRUNCATED_EXT); + codec_events::decoder_event(codec, DECODE_IPV6_TRUNCATED_EXT); return false; } if ( codec.ip6_extension_count >= IP6_EXTMAX) { - codec_events::decoder_event(DECODE_IP6_EXCESS_EXT_HDR); + codec_events::decoder_event(codec, DECODE_IP6_EXCESS_EXT_HDR); return false; } if (raw.len < sizeof(IP6Route)) { - codec_events::decoder_event(DECODE_IPV6_TRUNCATED_EXT); + codec_events::decoder_event(codec, DECODE_IPV6_TRUNCATED_EXT); return false; } /* Routing type 0 extension headers are evil creatures. */ if (rte->ip6rte_type == 0) - codec_events::decoder_event(DECODE_IPV6_ROUTE_ZERO); + codec_events::decoder_event(codec, DECODE_IPV6_ROUTE_ZERO); if (rte->ip6rte_nxt == IPPROTO_ID_HOPOPTS) - codec_events::decoder_event(DECODE_IPV6_ROUTE_AND_HOPBYHOP); + codec_events::decoder_event(codec, DECODE_IPV6_ROUTE_AND_HOPBYHOP); if (rte->ip6rte_nxt == IPPROTO_ID_ROUTING) - codec_events::decoder_event(DECODE_IPV6_TWO_ROUTE_HEADERS); + codec_events::decoder_event(codec, DECODE_IPV6_TWO_ROUTE_HEADERS); codec.lyr_len = ip::MIN_EXT_LEN + (rte->ip6rte_len << 3); if(codec.lyr_len > raw.len) { - codec_events::decoder_event(DECODE_IPV6_TRUNCATED_EXT); + codec_events::decoder_event(codec, DECODE_IPV6_TRUNCATED_EXT); return false; } @@ -123,6 +123,7 @@ bool Ipv6RoutingCodec::decode(const RawData& raw, CodecData& codec, SnortData&) codec.proto_bits |= PROTO_BIT__IP6_EXT; // check ip proto rules against this layer codec.ip6_extension_count++; codec.next_prot_id = rte->ip6rte_nxt; + codec.ip6_csum_proto = rte->ip6rte_nxt; // must be called AFTER setting next_prot_id ip_util::CheckIPv6ExtensionOrder(codec, IPPROTO_ID_ROUTING); diff --git a/src/codecs/ip/cd_sun_nd.cc b/src/codecs/ip/cd_sun_nd.cc index 934451e4a..a03c36b88 100644 --- a/src/codecs/ip/cd_sun_nd.cc +++ b/src/codecs/ip/cd_sun_nd.cc @@ -57,9 +57,9 @@ void SunNdCodec::get_protocol_ids(std::vector& v) v.push_back(IPPROTO_ID_SUN_ND); } -bool SunNdCodec::decode(const RawData&, CodecData&, SnortData&) +bool SunNdCodec::decode(const RawData&, CodecData& codec, SnortData&) { - codec_events::decoder_event(DECODE_IP_BAD_PROTO); + codec_events::decoder_event(codec, DECODE_IP_BAD_PROTO); return true; } diff --git a/src/codecs/ip/cd_swipe.cc b/src/codecs/ip/cd_swipe.cc index 2d9b52495..6d98acb9c 100644 --- a/src/codecs/ip/cd_swipe.cc +++ b/src/codecs/ip/cd_swipe.cc @@ -53,10 +53,10 @@ void SwipeCodec::get_protocol_ids(std::vector &proto_ids) } -bool SwipeCodec::decode(const RawData&, CodecData&, SnortData&) +bool SwipeCodec::decode(const RawData&, CodecData& codec, SnortData&) { // currently unsupported - codec_events::decoder_event(DECODE_IP_BAD_PROTO); + codec_events::decoder_event(codec, DECODE_IP_BAD_PROTO); return true; } diff --git a/src/codecs/ip/cd_tcp.cc b/src/codecs/ip/cd_tcp.cc index 463a66077..fd62a23fe 100644 --- a/src/codecs/ip/cd_tcp.cc +++ b/src/codecs/ip/cd_tcp.cc @@ -116,8 +116,9 @@ static int OptLenValidate(const tcp::TcpOption* const opt, static void DecodeTCPOptions(const uint8_t *, uint32_t, CodecData&); -static inline void TCPMiscTests(const SnortData& codec, - const tcp::TCPHdr* const tcph); +static inline void TCPMiscTests(const tcp::TCPHdr* const tcph, + const SnortData& snort, + const CodecData& codec); void TcpCodec::get_protocol_ids(std::vector& v) { @@ -128,7 +129,7 @@ bool TcpCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort) { if(raw.len < tcp::TCP_HEADER_LEN) { - codec_events::decoder_event(DECODE_TCP_DGRAM_LT_TCPHDR); + codec_events::decoder_event(codec, DECODE_TCP_DGRAM_LT_TCPHDR); return false; } @@ -138,13 +139,13 @@ bool TcpCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort) if(tcph_len < tcp::TCP_HEADER_LEN) { - codec_events::decoder_event(DECODE_TCP_INVALID_OFFSET); + codec_events::decoder_event(codec, DECODE_TCP_INVALID_OFFSET); return false; } if(tcph_len > raw.len) { - codec_events::decoder_event(DECODE_TCP_LARGE_OFFSET); + codec_events::decoder_event(codec, DECODE_TCP_LARGE_OFFSET); return false; } @@ -179,7 +180,7 @@ bool TcpCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort) COPY4(ph6.sip, ip6h->get_src()->u6_addr32); COPY4(ph6.dip, ip6h->get_dst()->u6_addr32); ph6.zero = 0; - ph6.protocol = ip6h->get_next(); + ph6.protocol = codec.ip6_csum_proto; ph6.len = htons((uint16_t)raw.len); @@ -212,9 +213,9 @@ bool TcpCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort) if(tcph->are_flags_set(TH_FIN|TH_PUSH|TH_URG)) { if(tcph->are_flags_set(TH_SYN|TH_ACK|TH_RST)) - codec_events::decoder_event(DECODE_TCP_XMAS); + codec_events::decoder_event(codec, DECODE_TCP_XMAS); else - codec_events::decoder_event(DECODE_TCP_NMAP_XMAS); + codec_events::decoder_event(codec, DECODE_TCP_NMAP_XMAS); // Allowing this packet for further processing // (in case there is a valid data inside it). @@ -230,30 +231,30 @@ bool TcpCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort) { if( snort.ip_api.id() == 413 ) { - codec_events::decoder_event(DECODE_DOS_NAPTHA); + codec_events::decoder_event(codec, DECODE_DOS_NAPTHA); } } } if( sfvar_ip_in(SynToMulticastDstIp, snort.ip_api.get_dst()) ) { - codec_events::decoder_event(DECODE_SYN_TO_MULTICAST); + codec_events::decoder_event(codec, DECODE_SYN_TO_MULTICAST); } if ( (tcph->th_flags & TH_RST) ) - codec_events::decoder_event(DECODE_TCP_SYN_RST); + codec_events::decoder_event(codec, DECODE_TCP_SYN_RST); if ( (tcph->th_flags & TH_FIN) ) - codec_events::decoder_event(DECODE_TCP_SYN_FIN); + codec_events::decoder_event(codec, DECODE_TCP_SYN_FIN); } else { // we already know there is no SYN if ( !(tcph->th_flags & (TH_ACK|TH_RST)) ) - codec_events::decoder_event(DECODE_TCP_NO_SYN_ACK_RST); + codec_events::decoder_event(codec, DECODE_TCP_NO_SYN_ACK_RST); } if ( (tcph->th_flags & (TH_FIN|TH_PUSH|TH_URG)) && !(tcph->th_flags & TH_ACK) ) - codec_events::decoder_event(DECODE_TCP_MUST_ACK); + codec_events::decoder_event(codec, DECODE_TCP_MUST_ACK); /* if options are present, decode them */ @@ -269,7 +270,7 @@ bool TcpCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort) if ( (tcph->th_flags & TH_URG) && ((dsize == 0) || ntohs(tcph->th_urp) > dsize) ) - codec_events::decoder_event(DECODE_TCP_BAD_URP); + codec_events::decoder_event(codec, DECODE_TCP_BAD_URP); // Now that we are returning true, set the tcp header codec.lyr_len = tcph_len; @@ -279,7 +280,7 @@ bool TcpCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort) snort.dp = tcph->dst_port(); snort.set_pkt_type(PktType::TCP); - TCPMiscTests(snort, tcph); + TCPMiscTests(tcph, snort, codec); return true; } @@ -385,7 +386,7 @@ void DecodeTCPOptions(const uint8_t *start, uint32_t o_len, CodecData& codec) if (((uint16_t) opt->data[0] > 14)) { /* LOG INVALID WINDOWSCALE alert */ - codec_events::decoder_event(DECODE_TCPOPT_WSCALE_INVALID); + codec_events::decoder_event(codec, DECODE_TCPOPT_WSCALE_INVALID); } } break; @@ -418,7 +419,7 @@ void DecodeTCPOptions(const uint8_t *start, uint32_t o_len, CodecData& codec) break; case tcp::TcpOptCode::CC_ECHO: - codec_events::decoder_event(DECODE_TCPOPT_TTCP); + codec_events::decoder_event(codec, DECODE_TCPOPT_TTCP); /* fall through */ case tcp::TcpOptCode::CC: /* all 3 use the same lengths / T/TCP */ case tcp::TcpOptCode::CC_NEW: @@ -459,11 +460,11 @@ void DecodeTCPOptions(const uint8_t *start, uint32_t o_len, CodecData& codec) { if(code == tcp::OPT_BADLEN) { - codec_events::decoder_event(DECODE_TCPOPT_BADLEN); + codec_events::decoder_event(codec, DECODE_TCPOPT_BADLEN); } else if(code == tcp::OPT_TRUNC) { - codec_events::decoder_event(DECODE_TCPOPT_TRUNCATED); + codec_events::decoder_event(codec, DECODE_TCPOPT_TRUNCATED); } /* set the option count to the number of valid @@ -481,11 +482,11 @@ void DecodeTCPOptions(const uint8_t *start, uint32_t o_len, CodecData& codec) if (experimental_option_found) { - codec_events::decoder_event(DECODE_TCPOPT_EXPERIMENTAL); + codec_events::decoder_event(codec, DECODE_TCPOPT_EXPERIMENTAL); } else if (obsolete_option_found) { - codec_events::decoder_event(DECODE_TCPOPT_OBSOLETE); + codec_events::decoder_event(codec, DECODE_TCPOPT_OBSOLETE); } return; @@ -525,14 +526,16 @@ static int OptLenValidate(const tcp::TcpOption* const opt, /* TCP-layer decoder alerts */ -static inline void TCPMiscTests(const SnortData& snort, const tcp::TCPHdr* const tcph) +static inline void TCPMiscTests(const tcp::TCPHdr* const tcph, + const SnortData& snort, + const CodecData& codec) { if ( ((tcph->th_flags & TH_NORESERVED) == TH_SYN ) && (tcph->seq() == 674711609) ) - codec_events::decoder_event(DECODE_TCP_SHAFT_SYNFLOOD); + codec_events::decoder_event(codec, DECODE_TCP_SHAFT_SYNFLOOD); if (snort.sp == 0 || snort.dp == 0) - codec_events::decoder_event(DECODE_TCP_PORT_ZERO); + codec_events::decoder_event(codec, DECODE_TCP_PORT_ZERO); } diff --git a/src/codecs/ip/cd_udp.cc b/src/codecs/ip/cd_udp.cc index 31a47a101..ab41538ac 100644 --- a/src/codecs/ip/cd_udp.cc +++ b/src/codecs/ip/cd_udp.cc @@ -137,7 +137,9 @@ public: -static inline void UDPMiscTests(SnortData& snort, uint32_t pay_len); +static inline void UDPMiscTests(const SnortData&, + const CodecData&, + uint32_t pay_len); @@ -155,7 +157,7 @@ bool UdpCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort) if(raw.len < sizeof(udp::UDPHdr)) { - codec_events::decoder_event(DECODE_UDP_DGRAM_LT_UDPHDR); + codec_events::decoder_event(codec, DECODE_UDP_DGRAM_LT_UDPHDR); return false; } @@ -186,19 +188,19 @@ bool UdpCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort) /* verify that the header raw.len is a valid value */ if(uhlen < udp::UDP_HEADER_LEN) { - codec_events::decoder_event(DECODE_UDP_DGRAM_INVALID_LENGTH); + codec_events::decoder_event(codec, DECODE_UDP_DGRAM_INVALID_LENGTH); return false; } /* make sure there are enough bytes as designated by length field */ if(uhlen > raw.len) { - codec_events::decoder_event(DECODE_UDP_DGRAM_SHORT_PACKET); + codec_events::decoder_event(codec, DECODE_UDP_DGRAM_SHORT_PACKET); return false; } else if(uhlen < raw.len) { - codec_events::decoder_event(DECODE_UDP_DGRAM_LONG_PACKET); + codec_events::decoder_event(codec, DECODE_UDP_DGRAM_LONG_PACKET); return false; } @@ -235,7 +237,7 @@ bool UdpCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort) if(!udph->uh_chk) { csum = 1; - codec_events::decoder_event(DECODE_UDP_IPV6_ZERO_CHECKSUM); + codec_events::decoder_event(codec, DECODE_UDP_IPV6_ZERO_CHECKSUM); } /* Don't do checksum calculation if * 1) Fragmented @@ -248,7 +250,7 @@ bool UdpCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort) COPY4(ph6.sip, ip6h->ip6_src.u6_addr32); COPY4(ph6.dip, ip6h->ip6_dst.u6_addr32); ph6.zero = 0; - ph6.protocol = ip6h->get_next(); + ph6.protocol = codec.ip6_csum_proto; ph6.len = htons((u_short)raw.len); csum = checksum::udp_cksum((uint16_t *)(udph), uhlen, &ph6); @@ -292,7 +294,7 @@ bool UdpCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort) snort.set_pkt_type(PktType::UDP); // set in packet manager - UDPMiscTests(snort, uhlen - udp::UDP_HEADER_LEN); + UDPMiscTests(snort, codec, uhlen - udp::UDP_HEADER_LEN); if (ScGTPDecoding() && (ScIsGTPPort(src_port)||ScIsGTPPort(dst_port))) @@ -314,13 +316,15 @@ bool UdpCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort) /* UDP-layer decoder alerts */ -static inline void UDPMiscTests(SnortData& snort, uint32_t pay_len) +static inline void UDPMiscTests(const SnortData& snort, + const CodecData& codec, + uint32_t pay_len) { if (pay_len > 4000) - codec_events::decoder_event(DECODE_UDP_LARGE_PACKET); + codec_events::decoder_event(codec, DECODE_UDP_LARGE_PACKET); if (snort.sp == 0 || snort.dp == 0) - codec_events::decoder_event(DECODE_UDP_PORT_ZERO); + codec_events::decoder_event(codec, DECODE_UDP_PORT_ZERO); } void UdpCodec::log(TextLog* const text_log, const uint8_t* raw_pkt, const Packet* const) diff --git a/src/codecs/ip/ip_util.cc b/src/codecs/ip/ip_util.cc index e41ef0847..8f95cc1ba 100644 --- a/src/codecs/ip/ip_util.cc +++ b/src/codecs/ip/ip_util.cc @@ -43,7 +43,7 @@ static inline int IPV6ExtensionOrder(uint8_t type) } -bool CheckIPV6HopOptions(const RawData& raw) +bool CheckIPV6HopOptions(const RawData& raw, const CodecData& codec) { const ip::IP6Extension* const exthdr = reinterpret_cast(raw.data); @@ -56,7 +56,7 @@ bool CheckIPV6HopOptions(const RawData& raw) uint8_t oplen; if (raw.len < total_octets) - codec_events::decoder_event(DECODE_IPV6_TRUNCATED_EXT); + codec_events::decoder_event(codec, DECODE_IPV6_TRUNCATED_EXT); /* Skip to the options */ pkt += 2; @@ -81,13 +81,13 @@ bool CheckIPV6HopOptions(const RawData& raw) oplen = *(++pkt); if ((pkt + oplen + 1) > hdr_end) { - codec_events::decoder_event(DECODE_IPV6_BAD_OPT_LEN); + codec_events::decoder_event(codec, DECODE_IPV6_BAD_OPT_LEN); return false; } pkt += oplen + 1; break; default: - codec_events::decoder_event(DECODE_IPV6_BAD_OPT_TYPE); + codec_events::decoder_event(codec, DECODE_IPV6_BAD_OPT_TYPE); return false; } } @@ -111,7 +111,7 @@ void CheckIPv6ExtensionOrder(CodecData& codec, const uint8_t proto) (proto == IPPROTO_ID_DSTOPTS) && (next_order == IPV6_ORDER_MAX))) { - codec_events::decoder_event(DECODE_IPV6_UNORDERED_EXTENSIONS); + codec_events::decoder_event(codec, DECODE_IPV6_UNORDERED_EXTENSIONS); } } else @@ -151,7 +151,7 @@ void CheckIPv6ExtensionOrder(Packet *p) !(p->ip6_extensions[i].type == IPPROTO_DSTOPTS) || !(i+1 == p->ip6_extension_count)) { - codec_events::decoder_event(DECODE_IPV6_UNORDERED_EXTENSIONS); + codec_events::decoder_event(codec, DECODE_IPV6_UNORDERED_EXTENSIONS); } } diff --git a/src/codecs/ip/ip_util.h b/src/codecs/ip/ip_util.h index 3663689be..1b6c52c1c 100644 --- a/src/codecs/ip/ip_util.h +++ b/src/codecs/ip/ip_util.h @@ -33,7 +33,7 @@ namespace ip_util { -SO_PUBLIC bool CheckIPV6HopOptions(const RawData&); +SO_PUBLIC bool CheckIPV6HopOptions(const RawData&, const CodecData& codec); // NOTE:: data.next_prot_id MUST be set before calling this!! void CheckIPv6ExtensionOrder(CodecData& codec, const uint8_t proto); diff --git a/src/codecs/link/cd_arp.cc b/src/codecs/link/cd_arp.cc index 6dd2adaa9..c59f7aa0a 100644 --- a/src/codecs/link/cd_arp.cc +++ b/src/codecs/link/cd_arp.cc @@ -90,7 +90,7 @@ bool ArpCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort) { if(raw.len < sizeof(arp::EtherARP)) { - codec_events::decoder_event(DECODE_ARP_TRUNCATED); + codec_events::decoder_event(codec, DECODE_ARP_TRUNCATED); return false; } diff --git a/src/codecs/link/cd_eapol.cc b/src/codecs/link/cd_eapol.cc index c156c9b30..81b672886 100644 --- a/src/codecs/link/cd_eapol.cc +++ b/src/codecs/link/cd_eapol.cc @@ -82,10 +82,10 @@ public: * * Returns: void function */ -void DecodeEAP(const RawData& raw) +void DecodeEAP(const RawData& raw, const CodecData& codec) { if(raw.len < sizeof(eapol::EAPHdr)) - codec_events::decoder_event(DECODE_EAP_TRUNCATED); + codec_events::decoder_event(codec, DECODE_EAP_TRUNCATED); } @@ -100,10 +100,10 @@ void DecodeEAP(const RawData& raw) * * Returns: void function */ -void DecodeEapolKey(const RawData& raw) +void DecodeEapolKey(const RawData& raw, const CodecData& codec) { if(raw.len < sizeof(eapol::EapolKey)) - codec_events::decoder_event(DECODE_EAPKEY_TRUNCATED); + codec_events::decoder_event(codec, DECODE_EAPKEY_TRUNCATED); } @@ -111,22 +111,22 @@ void DecodeEapolKey(const RawData& raw) ************** main codec functions ************ *************************************************/ -bool EapolCodec::decode(const RawData& raw, CodecData&, SnortData&) +bool EapolCodec::decode(const RawData& raw, CodecData& codec, SnortData&) { const eapol::EtherEapol* const eplh = reinterpret_cast(raw.data); if(raw.len < sizeof(eapol::EtherEapol)) { - codec_events::decoder_event(DECODE_EAPOL_TRUNCATED); + codec_events::decoder_event(codec, DECODE_EAPOL_TRUNCATED); return false; } if (eplh->eaptype == EAPOL_TYPE_EAP) - DecodeEAP(raw); + DecodeEAP(raw, codec); else if(eplh->eaptype == EAPOL_TYPE_KEY) - DecodeEapolKey(raw); + DecodeEapolKey(raw, codec); return true; } diff --git a/src/codecs/link/cd_erspan2.cc b/src/codecs/link/cd_erspan2.cc index e5aeea3ab..9b3313875 100644 --- a/src/codecs/link/cd_erspan2.cc +++ b/src/codecs/link/cd_erspan2.cc @@ -102,7 +102,7 @@ bool Erspan2Codec::decode(const RawData& raw, CodecData& codec, SnortData& ) if (raw.len < sizeof(ERSpanType2Hdr)) { - codec_events::decoder_event(DECODE_ERSPAN2_DGRAM_LT_HDR); + codec_events::decoder_event(codec, DECODE_ERSPAN2_DGRAM_LT_HDR); return false; } @@ -110,7 +110,7 @@ bool Erspan2Codec::decode(const RawData& raw, CodecData& codec, SnortData& ) */ if (erSpan2Hdr->version() != 0x01) /* Type 2 == version 0x01 */ { - codec_events::decoder_event(DECODE_ERSPAN_HDR_VERSION_MISMATCH); + codec_events::decoder_event(codec, DECODE_ERSPAN_HDR_VERSION_MISMATCH); return false; } diff --git a/src/codecs/link/cd_erspan3.cc b/src/codecs/link/cd_erspan3.cc index 92a80dec3..e75d40b35 100644 --- a/src/codecs/link/cd_erspan3.cc +++ b/src/codecs/link/cd_erspan3.cc @@ -114,7 +114,7 @@ bool Erspan3Codec::decode(const RawData& raw, CodecData& codec, SnortData&) if (raw.len < sizeof(ERSpanType3Hdr)) { - codec_events::decoder_event(DECODE_ERSPAN3_DGRAM_LT_HDR); + codec_events::decoder_event(codec, DECODE_ERSPAN3_DGRAM_LT_HDR); return false; } @@ -122,7 +122,7 @@ bool Erspan3Codec::decode(const RawData& raw, CodecData& codec, SnortData&) */ if (erSpan3Hdr->version() != 0x02) /* Type 3 == version 0x02 */ { - codec_events::decoder_event(DECODE_ERSPAN_HDR_VERSION_MISMATCH); + codec_events::decoder_event(codec, DECODE_ERSPAN_HDR_VERSION_MISMATCH); return false; } diff --git a/src/codecs/link/cd_mpls.cc b/src/codecs/link/cd_mpls.cc index b8d4006e0..aa0e4b464 100644 --- a/src/codecs/link/cd_mpls.cc +++ b/src/codecs/link/cd_mpls.cc @@ -130,7 +130,7 @@ constexpr int MPLS_PAYLOADTYPE_ERROR = -1; } // namespace -static int checkMplsHdr(uint32_t label, uint8_t bos); +static int checkMplsHdr(const CodecData&, uint32_t label, uint8_t bos); void MplsCodec::get_protocol_ids(std::vector& v) @@ -161,7 +161,7 @@ bool MplsCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort) { if(stack_len < MPLS_HEADER_LEN) { - codec_events::decoder_event(DECODE_BAD_MPLS); + codec_events::decoder_event(codec, DECODE_BAD_MPLS); return false; } @@ -172,7 +172,7 @@ bool MplsCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort) exp = (uint8_t)(mpls_h & 0x0000000E); label = (mpls_h>>4) & 0x000FFFFF; - if((label= ScMplsStackDepth())) { - codec_events::decoder_event(DECODE_MPLS_LABEL_STACK); + codec_events::decoder_event(codec, DECODE_MPLS_LABEL_STACK); codec.proto_bits &= ~PROTO_BIT__MPLS; return false; @@ -229,7 +229,7 @@ bool MplsCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort) /* * check if reserved labels are used properly */ -static int checkMplsHdr(uint32_t label, uint8_t bos) +static int checkMplsHdr(const CodecData& codec, uint32_t label, uint8_t bos) { int iRet = 0; switch(label) @@ -251,9 +251,9 @@ static int checkMplsHdr(uint32_t label, uint8_t bos) ||((!label)&&(ScMplsPayloadType() != MPLS_PAYLOADTYPE_IPV4))) { if( !label ) - codec_events::decoder_event(DECODE_BAD_MPLS_LABEL0); + codec_events::decoder_event(codec, DECODE_BAD_MPLS_LABEL0); else - codec_events::decoder_event(DECODE_BAD_MPLS_LABEL2); + codec_events::decoder_event(codec, DECODE_BAD_MPLS_LABEL2); } break; } @@ -263,9 +263,9 @@ static int checkMplsHdr(uint32_t label, uint8_t bos) * and move on to the next one. */ if( !label ) - codec_events::decoder_event(DECODE_BAD_MPLS_LABEL0); + codec_events::decoder_event(codec, DECODE_BAD_MPLS_LABEL0); else - codec_events::decoder_event(DECODE_BAD_MPLS_LABEL2); + codec_events::decoder_event(codec, DECODE_BAD_MPLS_LABEL2); p->iph = NULL; p->family = NO_IP; @@ -275,13 +275,13 @@ static int checkMplsHdr(uint32_t label, uint8_t bos) case 1: if(!bos) break; - codec_events::decoder_event(DECODE_BAD_MPLS_LABEL1); + codec_events::decoder_event(codec, DECODE_BAD_MPLS_LABEL1); iRet = MPLS_PAYLOADTYPE_ERROR; break; case 3: - codec_events::decoder_event(DECODE_BAD_MPLS_LABEL3); + codec_events::decoder_event(codec, DECODE_BAD_MPLS_LABEL3); iRet = MPLS_PAYLOADTYPE_ERROR; break; @@ -297,7 +297,7 @@ static int checkMplsHdr(uint32_t label, uint8_t bos) case 13: case 14: case 15: - codec_events::decoder_event(DECODE_MPLS_RESERVED_LABEL); + codec_events::decoder_event(codec, DECODE_MPLS_RESERVED_LABEL); break; default: break; diff --git a/src/codecs/link/cd_pppoe.cc b/src/codecs/link/cd_pppoe.cc index 611f5dd9c..5dcd0b8ae 100644 --- a/src/codecs/link/cd_pppoe.cc +++ b/src/codecs/link/cd_pppoe.cc @@ -112,7 +112,7 @@ static inline bool pppoepkt_decode(const RawData& raw, /* do a little validation */ if(raw.len < PPPOE_HEADER_LEN) { - codec_events::decoder_event(DECODE_BAD_PPPOE); + codec_events::decoder_event(codec, DECODE_BAD_PPPOE); return false; } diff --git a/src/codecs/link/cd_trans_bridge.cc b/src/codecs/link/cd_trans_bridge.cc index 3959d0faa..5cb77f25c 100644 --- a/src/codecs/link/cd_trans_bridge.cc +++ b/src/codecs/link/cd_trans_bridge.cc @@ -81,7 +81,7 @@ bool TransbridgeCodec::decode(const RawData& raw, CodecData& codec, SnortData&) { if(raw.len < eth::ETH_HEADER_LEN) { - codec_events::decoder_event(DECODE_GRE_TRANS_DGRAM_LT_TRANSHDR); + codec_events::decoder_event(codec, DECODE_GRE_TRANS_DGRAM_LT_TRANSHDR); return false; } diff --git a/src/codecs/link/cd_vlan.cc b/src/codecs/link/cd_vlan.cc index 31cfcf54b..35a907765 100644 --- a/src/codecs/link/cd_vlan.cc +++ b/src/codecs/link/cd_vlan.cc @@ -87,7 +87,7 @@ bool VlanCodec::decode(const RawData& raw, CodecData& codec, SnortData&) { if(raw.len < sizeof(vlan::VlanTagHdr)) { - codec_events::decoder_event(DECODE_BAD_VLAN); + codec_events::decoder_event(codec, DECODE_BAD_VLAN); return false; } @@ -109,7 +109,7 @@ bool VlanCodec::decode(const RawData& raw, CodecData& codec, SnortData&) // Vlan IDs 0 and 4095 are reserved. const uint16_t vid = vh->vid(); if (vid == 0 || vid == 4095) - codec_events::decoder_event(DECODE_BAD_VLAN); + codec_events::decoder_event(codec, DECODE_BAD_VLAN); codec.lyr_len = sizeof(vlan::VlanTagHdr); diff --git a/src/codecs/misc/cd_gtp.cc b/src/codecs/misc/cd_gtp.cc index e79129c0a..6d5ad8721 100644 --- a/src/codecs/misc/cd_gtp.cc +++ b/src/codecs/misc/cd_gtp.cc @@ -138,7 +138,7 @@ bool GtpCodec::decode(const RawData& raw, CodecData& codec, SnortData&) /*Check header fields*/ if (raw.len < len) { - codec_events::decoder_event(DECODE_GTP_BAD_LEN); + codec_events::decoder_event(codec, DECODE_GTP_BAD_LEN); return false; } @@ -147,7 +147,7 @@ bool GtpCodec::decode(const RawData& raw, CodecData& codec, SnortData&) { DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Calculated length %d != %d in header.\n", raw.len - len, ntohs(hdr->length));); - codec_events::decoder_event(DECODE_GTP_BAD_LEN); + codec_events::decoder_event(codec, DECODE_GTP_BAD_LEN); return false; } @@ -164,7 +164,7 @@ bool GtpCodec::decode(const RawData& raw, CodecData& codec, SnortData&) /*Check optional fields*/ if (raw.len < GTP_V1_HEADER_LEN) { - codec_events::decoder_event(DECODE_GTP_BAD_LEN); + codec_events::decoder_event(codec, DECODE_GTP_BAD_LEN); return false; } next_hdr_type = *(raw.data + len - 1); @@ -176,7 +176,7 @@ bool GtpCodec::decode(const RawData& raw, CodecData& codec, SnortData&) /*check length before reading data*/ if (raw.len < (uint32_t)(len + 4)) { - codec_events::decoder_event(DECODE_GTP_BAD_LEN); + codec_events::decoder_event(codec, DECODE_GTP_BAD_LEN); return false; } @@ -184,7 +184,7 @@ bool GtpCodec::decode(const RawData& raw, CodecData& codec, SnortData&) if (!ext_hdr_len) { - codec_events::decoder_event(DECODE_GTP_BAD_LEN); + codec_events::decoder_event(codec, DECODE_GTP_BAD_LEN); return false; } /*Extension header length is a unit of 4 octets*/ @@ -193,7 +193,7 @@ bool GtpCodec::decode(const RawData& raw, CodecData& codec, SnortData&) /*check length before reading data*/ if (raw.len < len) { - codec_events::decoder_event(DECODE_GTP_BAD_LEN); + codec_events::decoder_event(codec, DECODE_GTP_BAD_LEN); return false; } next_hdr_type = *(raw.data + len - 1); @@ -211,7 +211,7 @@ bool GtpCodec::decode(const RawData& raw, CodecData& codec, SnortData&) { DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Calculated length %d != %d in header.\n", raw.len - GTP_MIN_LEN, ntohs(hdr->length));); - codec_events::decoder_event(DECODE_GTP_BAD_LEN); + codec_events::decoder_event(codec, DECODE_GTP_BAD_LEN); return false; } diff --git a/src/codecs/misc/cd_icmp4_ip.cc b/src/codecs/misc/cd_icmp4_ip.cc index 1a2f288ee..55de33624 100644 --- a/src/codecs/misc/cd_icmp4_ip.cc +++ b/src/codecs/misc/cd_icmp4_ip.cc @@ -69,7 +69,7 @@ bool Icmp4IpCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort /* do a little validation */ if(raw.len < ip::IP4_HEADER_LEN) { - codec_events::decoder_event(DECODE_ICMP_ORIG_IP_TRUNCATED); + codec_events::decoder_event(codec, DECODE_ICMP_ORIG_IP_TRUNCATED); return false; } @@ -82,7 +82,7 @@ bool Icmp4IpCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort */ if((ip4h->get_ver() != 4) && !snort.ip_api.is_ip6()) { - codec_events::decoder_event(DECODE_ICMP_ORIG_IP_VER_MISMATCH); + codec_events::decoder_event(codec, DECODE_ICMP_ORIG_IP_VER_MISMATCH); return false; } @@ -90,7 +90,7 @@ bool Icmp4IpCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort if(raw.len < hlen) { - codec_events::decoder_event(DECODE_ICMP_ORIG_DGRAM_LT_ORIG_IP); + codec_events::decoder_event(codec, DECODE_ICMP_ORIG_DGRAM_LT_ORIG_IP); return false; } @@ -105,7 +105,7 @@ bool Icmp4IpCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort /* Original IP payload should be 64 bits */ if (ip_len < 8) { - codec_events::decoder_event(DECODE_ICMP_ORIG_PAYLOAD_LT_64); + codec_events::decoder_event(codec, DECODE_ICMP_ORIG_PAYLOAD_LT_64); return false; } @@ -114,13 +114,13 @@ bool Icmp4IpCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort */ else if (ntohs(snort.ip_api.len()) > 576) { - codec_events::decoder_event(DECODE_ICMP_ORIG_PAYLOAD_GT_576); + codec_events::decoder_event(codec, DECODE_ICMP_ORIG_PAYLOAD_GT_576); } } else { /* RFC states that only first frag will get an ICMP response */ - codec_events::decoder_event(DECODE_ICMP_ORIG_IP_WITH_FRAGOFFSET); + codec_events::decoder_event(codec, DECODE_ICMP_ORIG_IP_WITH_FRAGOFFSET); return false; } diff --git a/src/codecs/misc/cd_icmp6_ip.cc b/src/codecs/misc/cd_icmp6_ip.cc index 8a2293da2..fdd1ad8a3 100644 --- a/src/codecs/misc/cd_icmp6_ip.cc +++ b/src/codecs/misc/cd_icmp6_ip.cc @@ -75,7 +75,7 @@ bool Icmp6IpCodec::decode(const RawData& raw, CodecData& codec, SnortData&) /* do a little validation */ if ( raw.len < ip::IP6_HEADER_LEN ) { - codec_events::decoder_event(DECODE_ICMP_ORIG_IP_TRUNCATED); + codec_events::decoder_event(codec, DECODE_ICMP_ORIG_IP_TRUNCATED); return false; } @@ -85,13 +85,13 @@ bool Icmp6IpCodec::decode(const RawData& raw, CodecData& codec, SnortData&) */ if(ip6h->get_ver() != 6) { - codec_events::decoder_event(DECODE_ICMP_ORIG_IP_VER_MISMATCH); + codec_events::decoder_event(codec, DECODE_ICMP_ORIG_IP_VER_MISMATCH); return false; } if ( raw.len < ip::IP6_HEADER_LEN ) { - codec_events::decoder_event(DECODE_ICMP_ORIG_DGRAM_LT_ORIG_IP); + codec_events::decoder_event(codec, DECODE_ICMP_ORIG_DGRAM_LT_ORIG_IP); return false; } diff --git a/src/codecs/misc/cd_llc.cc b/src/codecs/misc/cd_llc.cc index 726cfdfd1..19e3416bf 100644 --- a/src/codecs/misc/cd_llc.cc +++ b/src/codecs/misc/cd_llc.cc @@ -94,7 +94,7 @@ bool LlcCodec::decode(const RawData& raw, CodecData& codec, SnortData&) if(raw.len < sizeof(EthLlc)) { // FIXIT-L - J - Need a better alert - codec_events::decoder_event(DECODE_BAD_VLAN_ETHLLC); + codec_events::decoder_event(codec, DECODE_BAD_VLAN_ETHLLC); return false; } @@ -107,7 +107,7 @@ bool LlcCodec::decode(const RawData& raw, CodecData& codec, SnortData&) { if (raw.len < sizeof(EthLlc) + sizeof(EthLlcOther)) { - codec_events::decoder_event(DECODE_BAD_VLAN_ETHLLC); + codec_events::decoder_event(codec, DECODE_BAD_VLAN_ETHLLC); return false; } diff --git a/src/codecs/root/cd_eth.cc b/src/codecs/root/cd_eth.cc index b9546927e..793e3afb1 100644 --- a/src/codecs/root/cd_eth.cc +++ b/src/codecs/root/cd_eth.cc @@ -114,7 +114,7 @@ bool EthCodec::decode(const RawData& raw, CodecData& codec, SnortData&) /* do a little validation */ if(raw.len < eth::ETH_HEADER_LEN) { - codec_events::decoder_event(DECODE_ETH_HDR_TRUNC); + codec_events::decoder_event(codec, DECODE_ETH_HDR_TRUNC); return false; } diff --git a/src/framework/codec.h b/src/framework/codec.h index dec62872a..56cb349fd 100644 --- a/src/framework/codec.h +++ b/src/framework/codec.h @@ -293,10 +293,13 @@ struct CodecData /* Codec specific fields. These fields are only relevent to codecs. */ uint16_t proto_bits; /* protocols contained within this packet */ /* -- will be propogated to Snort++ Packet struct*/ - uint8_t codec_flags; /* flags used while decoding */ + uint16_t codec_flags; /* flags used while decoding */ uint8_t ip_layer_cnt; + + /* The following values have junk values after initialization */ uint8_t ip6_extension_count; /* initialized in cd_ipv6.cc */ uint8_t curr_ip6_extension; /* initialized in cd_ipv6.cc */ + uint8_t ip6_csum_proto; /* initalized in cd_ipv6.cc. Used for IPv6 checksums */ // FIXIT-H-J - most of these don't needs to be zeroed CodecData(uint16_t init_prot) : lyr_len(0), @@ -330,31 +333,32 @@ struct CodecData /* Decode Flags */ -constexpr uint8_t CODEC_DF = 0x01; /* don't fragment flag */ -constexpr uint8_t CODEC_UNSURE_ENCAP = 0x02; /* packet may have incorrect encapsulation layer. - * don't alert if "next layer" is invalid. - * If decode fails with this bit set, PacketManager - * will back out to the previous layer. - * IMPORTANT: This bit can ONLY be set if the - * DECODE_ENCAP_LAYER flag was - * was previously set. - */ -constexpr uint8_t CODEC_SAVE_LAYER = 0x04; /* DO NOT USE THIS LAYER!! - * -- use DECODE_ENCAP_LAYER - */ -constexpr uint8_t CODEC_ENCAP_LAYER = (CODEC_SAVE_LAYER | CODEC_UNSURE_ENCAP ); +constexpr uint16_t CODEC_DF = 0x0001; /* don't fragment flag */ +constexpr uint16_t CODEC_UNSURE_ENCAP = 0x0002; /* packet may have incorrect encapsulation layer. + * don't alert if "next layer" is invalid. + * If decode fails with this bit set, PacketManager + * will back out to the previous layer. + * IMPORTANT: This bit can ONLY be set if the + * DECODE_ENCAP_LAYER flag was + * was previously set. + */ +constexpr uint16_t CODEC_SAVE_LAYER = 0x0004; /* DO NOT USE THIS LAYER!! + * -- use DECODE_ENCAP_LAYER + */ +constexpr uint16_t CODEC_ENCAP_LAYER = (CODEC_SAVE_LAYER | CODEC_UNSURE_ENCAP ); /* If encapsulation decode fails, back out to this layer * This will be cleared by PacketManager between decodes * This flag automatically sets DECODE_ENCAP_LAYER for * the next layer (and only the next layer). */ -constexpr uint8_t CODEC_ROUTING_SEEN = 0X08; /* used to check ip6 extensino order */ -constexpr uint8_t CODEC_IPOPT_RR_SEEN = 0x10; /* used by icmp4 for alerting */ -constexpr uint8_t CODEC_IPOPT_RTRALT_SEEN = 0x20; /* used by IGMP for alerting */ -constexpr uint8_t CODEC_IPOPT_LEN_THREE = 0x40; /* used by IGMP for alerting */ -constexpr uint8_t CODEC_TEREDO_SEEN = 0x80; /* used in IPv6 Codec */ - -constexpr uint8_t CODEC_IPOPT_FLAGS = (CODEC_IPOPT_RR_SEEN | +constexpr uint16_t CODEC_ROUTING_SEEN = 0x0008; /* used to check ip6 extensino order */ +constexpr uint16_t CODEC_IPOPT_RR_SEEN = 0x0010; /* used by icmp4 for alerting */ +constexpr uint16_t CODEC_IPOPT_RTRALT_SEEN = 0x0020; /* used by IGMP for alerting */ +constexpr uint16_t CODEC_IPOPT_LEN_THREE = 0x0040; /* used by IGMP for alerting */ +constexpr uint16_t CODEC_TEREDO_SEEN = 0x0080; /* used in IPv6 Codec */ +constexpr uint16_t CODEC_STREAM_REBUILT = 0x0100; /* Set by PacketManager. used by codec_event */ + +constexpr uint16_t CODEC_IPOPT_FLAGS = (CODEC_IPOPT_RR_SEEN | CODEC_IPOPT_RTRALT_SEEN | CODEC_IPOPT_LEN_THREE); diff --git a/src/protocols/packet.h b/src/protocols/packet.h index b09d9a812..0ee4f77e1 100644 --- a/src/protocols/packet.h +++ b/src/protocols/packet.h @@ -64,54 +64,45 @@ extern "C" { /* D E F I N E S ************************************************************/ /* packet status flags */ -#if 0 -#define PKT_TRUST 0x00000001 /* this packet should fallback to being whitelisted if no other verdict was specified */ - /* this flag must equal DECODE_PKT_TRUST*/ -#define PKT_FRAG 0x00000002 /* flag to indicate a fragmented packet */ - /* this flag must equal DECODE_FRAG */ -#define PKT_FRAG_MF 0x00000004 /* flag to indicate the 'more frag' flag is set */ - /* this flag must be equal to DECODE_MF */ -#endif - -#define PKT_REBUILT_FRAG 0x00000008 /* is a rebuilt fragment */ -#define PKT_REBUILT_STREAM 0x00000010 /* is a rebuilt stream */ -#define PKT_STREAM_UNEST_UNI 0x00000020 /* is from an unestablished stream and +#define PKT_REBUILT_FRAG 0x00000001 /* is a rebuilt fragment */ +#define PKT_REBUILT_STREAM 0x00000002 /* is a rebuilt stream */ +#define PKT_STREAM_UNEST_UNI 0x00000004 /* is from an unestablished stream and * we've only seen traffic in one direction */ -#define PKT_STREAM_EST 0x00000040 /* is from an established stream */ +#define PKT_STREAM_EST 0x00000008 /* is from an established stream */ -#define PKT_STREAM_INSERT 0x00000080 /* this packet has been queued for stream reassembly */ -#define PKT_STREAM_TWH 0x00000100 /* packet completes the 3-way handshake */ -#define PKT_FROM_SERVER 0x00000200 /* this packet came from the server +#define PKT_STREAM_INSERT 0x00000010 /* this packet has been queued for stream reassembly */ +#define PKT_STREAM_TWH 0x00000020 /* packet completes the 3-way handshake */ +#define PKT_FROM_SERVER 0x00000040 /* this packet came from the server side of a connection (TCP) */ -#define PKT_FROM_CLIENT 0x00000400 /* this packet came from the client +#define PKT_FROM_CLIENT 0x00000080 /* this packet came from the client side of a connection (TCP) */ -#define PKT_PDU_HEAD 0x00000800 /* start of PDU */ -#define PKT_PDU_TAIL 0x00001000 /* end of PDU */ -#define PKT_HTTP_DECODE 0x00002000 /* this packet has normalized http */ +#define PKT_PDU_HEAD 0x00000100 /* start of PDU */ +#define PKT_PDU_TAIL 0x00000200 /* end of PDU */ +#define PKT_HTTP_DECODE 0x00000400 /* this packet has normalized http */ -#define PKT_ALLOW_MULTIPLE_DETECT 0x00004000 /* packet has either pipelined mime attachements */ +#define PKT_ALLOW_MULTIPLE_DETECT 0x00000800 /* packet has either pipelined mime attachements */ /* or pipeline http requests */ -#define PKT_PAYLOAD_OBFUSCATE 0x00008000 +#define PKT_PAYLOAD_OBFUSCATE 0x00001000 -#define PKT_STATELESS 0x00010000 /* Packet has matched a stateless rule */ -#define PKT_PASS_RULE 0x00020000 /* this packet has matched a pass rule */ -#define PKT_IP_RULE 0x00040000 /* this packet is being evaluated against an IP rule */ -#define PKT_IP_RULE_2ND 0x00080000 /* this packet is being evaluated against an IP rule */ +#define PKT_STATELESS 0x00002000 /* Packet has matched a stateless rule */ +#define PKT_PASS_RULE 0x00004000 /* this packet has matched a pass rule */ +#define PKT_IP_RULE 0x00008000 /* this packet is being evaluated against an IP rule */ +#define PKT_IP_RULE_2ND 0x00010000 /* this packet is being evaluated against an IP rule */ -#define PKT_PSEUDO 0x00100000 /* is a pseudo packet */ -#define PKT_MODIFIED 0x00200000 /* packet had normalizations, etc. */ -#define PKT_RESIZED 0x00600000 /* packet has new size; must set modified too */ +#define PKT_PSEUDO 0x00020000 /* is a pseudo packet */ +#define PKT_MODIFIED 0x00040000 /* packet had normalizations, etc. */ +#define PKT_RESIZED 0x000c0000 /* packet has new size; must set modified too */ // neither of these flags will be set for (full) retransmissions or non-data segments // a partial overlap results in out of sequence condition // out of sequence condition is sticky -#define PKT_STREAM_ORDER_OK 0x00800000 /* this segment is in order, w/o gaps */ -#define PKT_STREAM_ORDER_BAD 0x01000000 /* this stream had at least one gap */ +#define PKT_STREAM_ORDER_OK 0x00100000 /* this segment is in order, w/o gaps */ +#define PKT_STREAM_ORDER_BAD 0x00200000 /* this stream had at least one gap */ -#define PKT_FILE_EVENT_SET 0x02000000 -#define PKT_IGNORE 0x04000000 /* this packet should be ignored, based on port */ -#define PKT_UNUSED_FLAGS 0xf8000000 +#define PKT_FILE_EVENT_SET 0x00400000 +#define PKT_IGNORE 0x00800000 /* this packet should be ignored, based on port */ +#define PKT_UNUSED_FLAGS 0xff000000 // 0x40000000 are available #define PKT_PDU_FULL (PKT_PDU_HEAD | PKT_PDU_TAIL) diff --git a/src/protocols/packet_manager.cc b/src/protocols/packet_manager.cc index d817c360a..b4163273b 100644 --- a/src/protocols/packet_manager.cc +++ b/src/protocols/packet_manager.cc @@ -162,6 +162,9 @@ void PacketManager::decode( RawData raw{pkt, pkthdr->caplen}; CodecData codec_data(FINISHED_DECODE); + if (p->packet_flags & PKT_REBUILT_STREAM) + codec_data.codec_flags |= CODEC_STREAM_REBUILT; + MODULE_PROFILE_START(decodePerfStats); s_stats[total_processed]++; diff --git a/src/protocols/tcp.h b/src/protocols/tcp.h index d654c9fa3..d94be233b 100644 --- a/src/protocols/tcp.h +++ b/src/protocols/tcp.h @@ -107,7 +107,7 @@ struct TCPHdr { return ntohl(th_seq); } inline bool has_options() const - { return (th_offx2 & 0xf0) == 0x50; } + { return ((th_offx2 & 0xf0) > 0x50); } inline bool are_flags_set(uint8_t flags) const { return (th_flags & flags) == flags; }