From: Josh Date: Fri, 12 Dec 2014 14:59:09 +0000 (-0600) Subject: updating two Snort2Lua typos. adding 'some' CAPWAP logging X-Git-Tag: 3.0.0-233~1089^2~13 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7bace329697b78a70a23e9b15b23a49c9ae6281e;p=thirdparty%2Fsnort3.git updating two Snort2Lua typos. adding 'some' CAPWAP logging --- diff --git a/src/codecs/misc/cd_capwap.cc b/src/codecs/misc/cd_capwap.cc index 17e625a59..d15fda346 100644 --- a/src/codecs/misc/cd_capwap.cc +++ b/src/codecs/misc/cd_capwap.cc @@ -34,6 +34,7 @@ #include "protocols/protocol_ids.h" #include "codecs/codec_module.h" #include "codecs/codec_events.h" +#include "log/text_log.h" #define CD_CAPWAP_NAME "capwap" #define CD_CAPWAP_HELP "support for capwap" @@ -65,6 +66,7 @@ public: void get_protocol_ids(std::vector& v) override; bool decode(const RawData&, CodecData&, DecodeData&) override; + void log(TextLog* const, const uint8_t* pkt, const uint16_t len) override; }; @@ -100,19 +102,19 @@ struct Capwap uint16_t frag_off; // last 3 bits are reserved. // returns the number of bytes in this header. - uint8_t get_version() const + uint8_t version() const { return (ntohl(preamble_hlen_flags) & MASK_PRE_VER) >> 28; } - uint8_t get_preamble_type() const + uint8_t preamble_type() const { return (ntohl(preamble_hlen_flags) & MASK_PRE_TYPE) >> 24; } - uint8_t get_hlen() const + uint8_t hlen() const { return (ntohl(preamble_hlen_flags) & MASK_HLEN) >> 17; } - uint8_t get_rid() const + uint8_t rid() const { return (ntohl(preamble_hlen_flags) & MASK_RID) >> 14; } - uint8_t get_wbid() const + uint8_t wbid() const { return (ntohl(preamble_hlen_flags) & MASK_WBID) >> 9; } bool is_type_set() const @@ -133,13 +135,16 @@ struct Capwap bool is_keep_alive_set() const { return ntohl(preamble_hlen_flags) & MASK_KEEP_ALIVE; } - uint8_t get_res_flags() const + uint8_t res_flags() const { return ntohl(preamble_hlen_flags) & MASK_FLAGS; } - uint16_t get_frag_off() const + uint16_t id() const + { return ntohs(frag_id); } + + uint16_t off() const { return ntohs(frag_off) & MASK_FRAG_OFFSET; } - uint16_t get_reserved() const + uint16_t reserved() const { return ntohs(frag_off) & MASK_RESERVED; } }; @@ -173,29 +178,39 @@ bool CapwapCodec::decode(const RawData& raw, CodecData& codec, DecodeData&) const Capwap* const capwaph = reinterpret_cast(raw.data); - const uint8_t hlen = capwaph->get_hlen(); + const uint8_t hlen = capwaph->hlen(); if ( hlen < MIN_HDR_LEN ) { codec_events::decoder_event(codec, DECODE_CAPWAP_TRUNC); return false; } - if ( capwaph->get_version() != 0 ) + if ( capwaph->version() != 0 ) return false; // unsupported version - if ( capwaph->get_preamble_type() != 0) + if ( capwaph->preamble_type() != 0) return false; // don't support DTL if ( capwaph->is_fragment() ) return false; // don't support fragments + const uint8_t* ptr = raw.data + MIN_HDR_LEN; + if ( capwaph->is_radio_mac_set() ) + { + const RadioMacAddr* mac = reinterpret_cast(ptr); + + if ( (MIN_HDR_LEN + mac->len) > hlen) + return false; + ptr += mac->len; + } + if ( !capwaph->is_type_set() ) { codec.next_prot_id = PROTO_ETHERNET_802_3; } else { - const uint8_t wbid = capwaph->get_wbid(); + const uint8_t wbid = capwaph->wbid(); if ( wbid == WBID_IEEE_802_11 ) codec.next_prot_id = PROTO_ETHERNET_802_11; @@ -207,6 +222,71 @@ bool CapwapCodec::decode(const RawData& raw, CodecData& codec, DecodeData&) return true; } +#if 0 + TextLog_Puts(text_log, " RB"); + TextLog_Putc(text_log, '\t'); + TextLog_NewLine(text_log); + TextLog_Print(text_log, "xxx.xxx.xxx.xxx -> xxx.xxx.xxx.xxx"); + TextLog_Print(text_log, "Next:0x%02X TTL:%u TOS:0x%X ID:%u IpLen:%u DgmLen:%u", +#endif + +static inline void addFlag(TextLog* const log, bool set, char flag) +{ + if ( set ) + TextLog_Putc(log, flag); + else + TextLog_Putc(log, 'X'); +} + +void CapwapCodec::log(TextLog* const log, const uint8_t* raw_pkt, + const uint16_t /*lyr_len*/) +{ + const Capwap* const capwaph = reinterpret_cast(raw_pkt); + + uint32_t preamble_hlen_flags; + uint16_t frag_id; + uint16_t frag_off; // last 3 bits are reserved. + + TextLog_Print(log, "Version:%01X Type:%01X hlen:d RID:%02X " + "WBID:%02X ", capwaph->version(), capwaph->preamble_type(), + capwaph->hlen(), capwaph->rid(), capwaph->wbid()); + + addFlag(log, capwaph->is_type_set(), 'T'); + addFlag(log, capwaph->is_fragment(), 'F'); + addFlag(log, capwaph->is_last_set(), 'L'); + addFlag(log, capwaph->is_wireless_set(), 'W'); + addFlag(log, capwaph->is_radio_mac_set(), 'M'); + addFlag(log, capwaph->is_keep_alive_set(), 'K'); + + const uint8_t reserved = capwaph->res_flags(); + if ( !reserved ) + TextLog_Print(log, "xxx"); + else + { + addFlag(log, reserved & 0x4, 'R'); + addFlag(log, reserved & 0x2, 'R'); + addFlag(log, reserved & 0x1, 'R'); + } + + TextLog_NewLine(log); + TextLog_Putc(log, '\t'); + + if ( capwaph->is_fragment() ) + { + TextLog_Print(log, "Frag ID:%04X Frag Off:%04x", + capwaph->id(), capwaph->off()); + } + + + if ( capwaph->is_radio_mac_set() ) + { + const uint8_t len = capwaph->hlen(); + TextLog_Print(log, "MAC length:%d Frag Off:%04x", + capwaph->id(), capwaph->off()); + } + +} + //------------------------------------------------------------------------- // api //------------------------------------------------------------------------- diff --git a/tools/snort2lua/data/dt_rule_api.cc b/tools/snort2lua/data/dt_rule_api.cc index a9ffa5c0b..95ad74262 100644 --- a/tools/snort2lua/data/dt_rule_api.cc +++ b/tools/snort2lua/data/dt_rule_api.cc @@ -103,7 +103,7 @@ void RuleApi::bad_rule(std::istringstream& stream, std::string bad_option) curr_data_bad = true; error_count++; } - bad_rules->add_text("^^^^ unknown_option=" + bad_option); + bad_rules->add_text("^^^^ invalid_syntax=" + bad_option); } void RuleApi::include_rule_file(std::string file_name) diff --git a/tools/snort2lua/helpers/converter.cc b/tools/snort2lua/helpers/converter.cc index d36c7d530..10705809b 100644 --- a/tools/snort2lua/helpers/converter.cc +++ b/tools/snort2lua/helpers/converter.cc @@ -377,7 +377,7 @@ int Converter::convert(std::string input, if (failed_conversions()) { std::size_t errors = data_api.num_errors() + rule_api.num_errors(); - std::cerr << "ERROR: " << errors << " errors occured during conversion\n"; + std::cerr << "ERROR: " << errors << " errors occurred while converting\n"; std::cerr << "ERROR: see " << error_file << " for details" << std::endl; }