From: Josh Date: Tue, 16 Sep 2014 16:56:00 +0000 (-0400) Subject: fixing extra. Packet now has a 'type' which correlates to Snort's proto()' X-Git-Tag: 3.0.0-233~1411^2~3^2~3 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6742f4e4e108c8047e43b0d4a1eb6c0d77e14c60;p=thirdparty%2Fsnort3.git fixing extra. Packet now has a 'type' which correlates to Snort's proto()' --- diff --git a/extra/src/codecs/pim.cc b/extra/src/codecs/pim.cc index 149d25b83..e45436927 100644 --- a/extra/src/codecs/pim.cc +++ b/extra/src/codecs/pim.cc @@ -44,8 +44,7 @@ public: virtual void get_protocol_ids(std::vector&); - virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len, - Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); + virtual bool decode(const RawData&, CodecData&, SnortData&); }; @@ -59,10 +58,9 @@ void PimCodec::get_protocol_ids(std::vector& v) v.push_back(IPPROTO_ID_PIM); } -bool PimCodec::decode(const uint8_t* /*raw_pkt*/, const uint32_t& /*raw_len*/, - Packet* p, uint16_t& /*lyr_len*/, uint16_t& /*next_prot_id*/) +bool PimCodec::decode(const RawData&, CodecData&, SnortData&) { - codec_events::decoder_event(p, DECODE_IP_BAD_PROTO); + codec_events::decoder_event(DECODE_IP_BAD_PROTO); return true; } diff --git a/extra/src/codecs/token_ring.cc b/extra/src/codecs/token_ring.cc index bc4645478..f03e0a7fd 100644 --- a/extra/src/codecs/token_ring.cc +++ b/extra/src/codecs/token_ring.cc @@ -27,12 +27,14 @@ #endif #include -#include "protocols/packet.h" #include "protocols/token_ring.h" #include "framework/codec.h" #include "codecs/codec_events.h" #include "codecs/decode_module.h" + +#ifdef DLT_IEEE802 + namespace { @@ -69,8 +71,7 @@ public: virtual void get_data_link_type(std::vector&); - virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len, - Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); + virtual bool decode(const RawData&, CodecData&, SnortData&); }; @@ -99,23 +100,20 @@ public: void TrCodec::get_data_link_type(std::vector&v) { -#ifdef DLT_IEEE802 v.push_back(DLT_IEEE802); -#endif } //void DecodeTRPkt(Packet * p, const DAQ_PktHdr_t * pkthdr, const uint8_t * pkt) -bool TrCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len, - Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) +bool TrCodec::decode(const RawData& raw, CodecData& codec, SnortData&) { - uint32_t cap_len = raw_len; + const uint32_t cap_len = raw.len; uint32_t dataoff; /* data offset is variable here */ if(cap_len < sizeof(token_ring::Trh_hdr)) { - codec_events::decoder_event(p, DECODE_BAD_TRH); + codec_events::decoder_event(DECODE_BAD_TRH); return false; } @@ -141,12 +139,12 @@ bool TrCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len, */ if(cap_len < (sizeof(token_ring::Trh_hdr) + sizeof(token_ring::Trh_llc))) { - codec_events::decoder_event(p, DECODE_BAD_TR_ETHLLC); + codec_events::decoder_event(DECODE_BAD_TR_ETHLLC); return false; } const token_ring::Trh_llc *trhllc = - reinterpret_cast(raw_pkt + sizeof(token_ring::Trh_hdr)); + reinterpret_cast(raw.data + sizeof(token_ring::Trh_hdr)); if(trhllc->dsap != IPARP_SAP && trhllc->ssap != IPARP_SAP) { @@ -158,22 +156,22 @@ bool TrCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len, if(cap_len < (sizeof(token_ring::Trh_hdr) + sizeof(token_ring::Trh_llc) + sizeof(token_ring::Trh_mr))) { - codec_events::decoder_event(p, DECODE_BAD_TRHMR); + codec_events::decoder_event(DECODE_BAD_TRHMR); return false; } - const token_ring::Trh_mr* trhmr = - reinterpret_cast(raw_pkt + sizeof(token_ring::Trh_hdr)); + const token_ring::Trh_mr* const trhmr = + reinterpret_cast(raw.data + sizeof(token_ring::Trh_hdr)); if(cap_len < (sizeof(token_ring::Trh_hdr) + sizeof(token_ring::Trh_llc) + sizeof(token_ring::Trh_mr) + TRH_MR_LEN(trhmr))) { - codec_events::decoder_event(p, DECODE_BAD_TR_MR_LEN); + codec_events::decoder_event(DECODE_BAD_TR_MR_LEN); return false; } - dataoff = sizeof(token_ring::Trh_hdr) + TRH_MR_LEN(trhmr) + sizeof(token_ring::Trh_llc); + dataoff = sizeof(token_ring::Trh_hdr) + TRH_MR_LEN(trhmr) + sizeof(token_ring::Trh_llc); } else @@ -196,8 +194,8 @@ bool TrCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len, return false; } - lyr_len = dataoff; - next_prot_id = htons(trhllc->ethertype); + codec.lyr_len = dataoff; + codec.next_prot_id = htons(trhllc->ethertype); return true; } @@ -209,24 +207,16 @@ bool TrCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len, static Module* mod_ctor() -{ - return new TrCodecModule; -} +{ return new TrCodecModule; } static void mod_dtor(Module* m) -{ - delete m; -} +{ delete m; } static Codec* ctor(Module*) -{ - return new TrCodec(); -} +{ return new TrCodec(); } static void dtor(Codec *cd) -{ - delete cd; -} +{ delete cd; } static const CodecApi tr_api = @@ -254,3 +244,5 @@ SO_PUBLIC const BaseApi* snort_plugins[] = &tr_api.base, nullptr }; + +#endif diff --git a/extra/src/inspectors/dpx.cc b/extra/src/inspectors/dpx.cc index 8d0530bc7..8da9d4328 100644 --- a/extra/src/inspectors/dpx.cc +++ b/extra/src/inspectors/dpx.cc @@ -96,7 +96,7 @@ void DpxPH::eval(Packet* p) // precondition - what we registered for assert(IsUDP(p)); - if ( p->dp == port && p->dsize > max ) + if ( p->ptrs.dp == port && p->dsize > max ) SnortEventqAdd(DPX_GID, DPX_SID); ++dpxstats.total_packets; diff --git a/extra/src/ips_options/ips_urg.cc b/extra/src/ips_options/ips_urg.cc index 3236454e9..918377e6b 100644 --- a/extra/src/ips_options/ips_urg.cc +++ b/extra/src/ips_options/ips_urg.cc @@ -97,7 +97,7 @@ int TcpUrgOption::eval(Packet *p) int rval = DETECTION_OPTION_NO_MATCH; - if ( p->tcph && config.eval(p->tcph->th_ack) ) + if ( p->ptrs.tcph && config.eval(p->ptrs.tcph->th_ack) ) rval = DETECTION_OPTION_MATCH; //MODULE_PROFILE_END(tcpUrgPerfStats); diff --git a/src/codecs/ip/cd_icmp4.cc b/src/codecs/ip/cd_icmp4.cc index 3499986d3..b9012c7f5 100644 --- a/src/codecs/ip/cd_icmp4.cc +++ b/src/codecs/ip/cd_icmp4.cc @@ -242,6 +242,7 @@ bool Icmp4Codec::decode(const RawData& raw, CodecData& codec,SnortData& snort) /* Run a bunch of ICMP decoder rules */ ICMP4MiscTests(icmph, codec, (uint16_t)raw.len - len); + snort.packet_type = PKT_TYPE__ICMP4; snort.icmph = icmph; codec.proto_bits |= PROTO_BIT__ICMP; codec.lyr_len = len; diff --git a/src/codecs/ip/cd_icmp6.cc b/src/codecs/ip/cd_icmp6.cc index 71450fb82..6e935d89d 100644 --- a/src/codecs/ip/cd_icmp6.cc +++ b/src/codecs/ip/cd_icmp6.cc @@ -277,6 +277,7 @@ bool Icmp6Codec::decode(const RawData& raw, CodecData& codec, SnortData& snort) codec.lyr_len = len; codec.proto_bits |= PROTO_BIT__ICMP; snort.icmph = reinterpret_cast(icmp6h); + snort.packet_type = PKT_TYPE__ICMP6; return true; } diff --git a/src/codecs/ip/cd_ipv4.cc b/src/codecs/ip/cd_ipv4.cc index 364703cbb..8709238b1 100644 --- a/src/codecs/ip/cd_ipv4.cc +++ b/src/codecs/ip/cd_ipv4.cc @@ -367,6 +367,7 @@ bool Ipv4Codec::decode(const RawData& raw, CodecData& codec, SnortData& snort) codec_events::decoder_event(DECODE_BAD_FRAGBITS); + snort.packet_type = PKT_TYPE__IP; codec.proto_bits |= PROTO_BIT__IP; IPMiscTests(iph, ip::IP4_HEADER_LEN + ip_opt_len); codec.lyr_len = hlen; diff --git a/src/codecs/ip/cd_ipv6.cc b/src/codecs/ip/cd_ipv6.cc index 87610fdba..3551313d1 100644 --- a/src/codecs/ip/cd_ipv6.cc +++ b/src/codecs/ip/cd_ipv6.cc @@ -258,6 +258,7 @@ bool Ipv6Codec::decode(const RawData& raw, CodecData& codec, SnortData& snort) IPV6MiscTests(snort); CheckIPV6Multicast(ip6h); + snort.packet_type = PKT_TYPE__IP; codec.next_prot_id = ip6h->get_next(); codec.lyr_len = ip::IP6_HEADER_LEN; diff --git a/src/codecs/ip/cd_tcp.cc b/src/codecs/ip/cd_tcp.cc index c894abb61..12d569b6e 100644 --- a/src/codecs/ip/cd_tcp.cc +++ b/src/codecs/ip/cd_tcp.cc @@ -279,6 +279,7 @@ bool TcpCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort) snort.tcph = tcph; snort.sp = tcph->src_port(); snort.dp = tcph->dst_port(); + snort.packet_type = PKT_TYPE__TCP; TCPMiscTests(snort, tcph); diff --git a/src/codecs/ip/cd_udp.cc b/src/codecs/ip/cd_udp.cc index 972cdcb6e..789db0e68 100644 --- a/src/codecs/ip/cd_udp.cc +++ b/src/codecs/ip/cd_udp.cc @@ -290,6 +290,7 @@ bool UdpCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort) snort.dp = dst_port; codec.lyr_len = udp::UDP_HEADER_LEN; codec.proto_bits |= PROTO_BIT__UDP; + snort.packet_type = PKT_TYPE__UDP; // set in packet manager UDPMiscTests(snort, uhlen - udp::UDP_HEADER_LEN); diff --git a/src/codecs/link/cd_arp.cc b/src/codecs/link/cd_arp.cc index 206677352..88a57aa84 100644 --- a/src/codecs/link/cd_arp.cc +++ b/src/codecs/link/cd_arp.cc @@ -89,7 +89,7 @@ void ArpCodec::get_protocol_ids(std::vector& v) * * Returns: void function */ -bool ArpCodec::decode(const RawData& raw, CodecData& codec, SnortData&) +bool ArpCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort) { if(raw.len < sizeof(arp::EtherARP)) { @@ -99,7 +99,8 @@ bool ArpCodec::decode(const RawData& raw, CodecData& codec, SnortData&) codec.proto_bits |= PROTO_BIT__ARP; codec.lyr_len = sizeof(arp::EtherARP); - + snort.packet_type = PKT_TYPE__ARP; + return true; } diff --git a/src/framework/codec.h b/src/framework/codec.h index c4de7221f..e34fb6b42 100644 --- a/src/framework/codec.h +++ b/src/framework/codec.h @@ -23,6 +23,7 @@ #include #include #include +#include // static_assert #include "main/snort_types.h" #include "framework/base_api.h" @@ -133,6 +134,36 @@ struct RawData uint32_t len; }; +/* SnortData Flags */ + +/* error flags */ +constexpr uint8_t DECODE_ERR_CKSUM_IP = 0x01; +constexpr uint8_t DECODE_ERR_CKSUM_TCP = 0x02; +constexpr uint8_t DECODE_ERR_CKSUM_UDP = 0x04; +constexpr uint8_t DECODE_ERR_CKSUM_ICMP = 0x08; +constexpr uint8_t DECODE_ERR_CKSUM_ANY = 0x0F; +constexpr uint8_t DECODE_ERR_BAD_TTL = 0x10; +constexpr uint8_t DECODE_PKT_TRUST = 0x20; /* Tell Snort++ to whitelist this packet */ +constexpr uint8_t DECODE_FRAG = 0x40; /* flag to indicate a fragmented packet */ +constexpr uint8_t DECODE_MF = 0x80; + +constexpr uint8_t DECODE_ERR_FLAGS = DECODE_ERR_CKSUM_IP | + DECODE_ERR_CKSUM_TCP | + DECODE_ERR_CKSUM_UDP | + DECODE_ERR_CKSUM_UDP | + DECODE_ERR_CKSUM_ICMP | + DECODE_ERR_CKSUM_ANY | + DECODE_ERR_BAD_TTL; + + +constexpr uint8_t PKT_TYPE__UNKOWN = 0x00; +constexpr uint8_t PKT_TYPE__IP = 0x01; +constexpr uint8_t PKT_TYPE__TCP = 0x02; +constexpr uint8_t PKT_TYPE__UDP = 0x04; +constexpr uint8_t PKT_TYPE__ICMP4 = 0x08; +constexpr uint8_t PKT_TYPE__ICMP6 = 0x10; +constexpr uint8_t PKT_TYPE__ARP = 0x10; + struct SnortData { /* Pointers which will be used by Snort++. (starting with uint16_t so tcph is 64 bytes from start*/ @@ -147,36 +178,19 @@ struct SnortData uint16_t sp; /* source port (TCP/UDP) */ uint16_t dp; /* dest port (TCP/UDP) */ uint8_t decode_flags; /* decoder flags including checksum errors, bad TTLs, frag, etc. */ + uint8_t packet_type; ip::IpApi ip_api; mpls::MplsHdr mplsHdr; inline void reset() { + static_assert(PKT_TYPE__UNKOWN == 0, "PKT_TYPE__UNKOWN must be zero!!"); memset((char*)tcph, '\0', offsetof(SnortData, ip_api)); ip_api.reset(); } }; -/* error flags */ -constexpr uint8_t DECODE_ERR_CKSUM_IP = 0x01; -constexpr uint8_t DECODE_ERR_CKSUM_TCP = 0x02; -constexpr uint8_t DECODE_ERR_CKSUM_UDP = 0x04; -constexpr uint8_t DECODE_ERR_CKSUM_ICMP = 0x08; -constexpr uint8_t DECODE_ERR_CKSUM_ANY = 0x0F; -constexpr uint8_t DECODE_ERR_BAD_TTL = 0x10; -constexpr uint8_t DECODE_PKT_TRUST = 0x20; /* Tell Snort++ to whitelist this packet */ -constexpr uint8_t DECODE_FRAG = 0x40; /* flag to indicate a fragmented packet */ -constexpr uint8_t DECODE_MF = 0x80; - -constexpr uint8_t DECODE_ERR_FLAGS = DECODE_ERR_CKSUM_IP | - DECODE_ERR_CKSUM_TCP | - DECODE_ERR_CKSUM_UDP | - DECODE_ERR_CKSUM_UDP | - DECODE_ERR_CKSUM_ICMP | - DECODE_ERR_CKSUM_ANY | - DECODE_ERR_BAD_TTL; - struct CodecData { @@ -224,6 +238,8 @@ struct CodecData #define PROTO_BIT__ALL 0xffff + + /* Decode Flags */ constexpr uint8_t CODEC_DF = 0x01; /* don't fragment flag */ constexpr uint8_t CODEC_UNSURE_ENCAP = 0x02; /* packet may have incorrect encapsulation layer. diff --git a/src/protocols/packet.h b/src/protocols/packet.h index 12678baff..5967ca98e 100644 --- a/src/protocols/packet.h +++ b/src/protocols/packet.h @@ -202,6 +202,11 @@ struct Packet uint32_t iplist_id; uint8_t ps_proto; // Used for portscan and unified2 logging + + /* Access methods */ + + inline uint8_t type() const + { return ptrs.packet_type; } }; #define PKT_ZERO_LEN offsetof(Packet, pkth) diff --git a/src/protocols/token_ring.h b/src/protocols/token_ring.h index e94161823..1cf3053fe 100644 --- a/src/protocols/token_ring.h +++ b/src/protocols/token_ring.h @@ -23,6 +23,8 @@ #ifndef PROTOCOLS_TOKEN_RING_H #define PROTOCOLS_TOKEN_RING_H +#include + namespace token_ring{ /* LLC structure */