From: Josh Date: Wed, 1 Oct 2014 22:58:11 +0000 (-0500) Subject: Making Snort++ PktType basedy() X-Git-Tag: 3.0.0-233~1397^2~24^2~7 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=940713352da3dadd689bb082f5dd68477e36f57c;p=thirdparty%2Fsnort3.git Making Snort++ PktType basedy() --- diff --git a/src/detection/detect.cc b/src/detection/detect.cc index d2dde04f5..25bc60b9c 100644 --- a/src/detection/detect.cc +++ b/src/detection/detect.cc @@ -329,6 +329,7 @@ int Detect(Packet * p) while (layer::set_inner_ip_api(p, tmp_api, curr_layer)) { + // FIXIT-H J We may be checking for an IP6 extension! if (snort_conf->ip_proto_array[tmp_api.proto()]) { proto_found = true; diff --git a/src/detection/fpdetect.cc b/src/detection/fpdetect.cc index c3b66bbb5..d52746927 100644 --- a/src/detection/fpdetect.cc +++ b/src/detection/fpdetect.cc @@ -1476,7 +1476,6 @@ static inline int fpEvalHeaderIp(Packet *p, int ip_proto, OTNX_MATCH_DATA *omd) */ int fpEvalPacket(Packet *p) { - int ip_proto = p->ptrs.ip_api.proto(); OTNX_MATCH_DATA *omd = &t_omd; /* Run UDP rules against the UDP header of Teredo packets */ @@ -1516,53 +1515,27 @@ int fpEvalPacket(Packet *p) do_detect_content = tmp_do_detect_content; } - switch(ip_proto) + switch(p->type()) { - case IPPROTO_TCP: - DEBUG_WRAP(DebugMessage(DEBUG_DETECT, - "Detecting on TcpList\n");); - - if(p->ptrs.tcph == NULL) - { - ip_proto = -1; - break; - } - + case PktType::TCP: return fpEvalHeaderTcp(p, omd); - case IPPROTO_UDP: - DEBUG_WRAP(DebugMessage(DEBUG_DETECT, - "Detecting on UdpList\n");); - - if(p->ptrs.udph == NULL) - { - ip_proto = -1; - break; - } - + case PktType::UDP: return fpEvalHeaderUdp(p, omd); - case IPPROTO_ICMPV6: - case IPPROTO_ICMP: + case PktType::ICMP: DEBUG_WRAP(DebugMessage(DEBUG_DETECT, "Detecting on IcmpList\n");); - - if(p->ptrs.icmph == NULL) - { - ip_proto = -1; - break; - } - return fpEvalHeaderIcmp(p, omd); + /* + ** No Match on TCP/UDP, Do IP + */ default: + return fpEvalHeaderIp(p, -1, omd); break; } - /* - ** No Match on TCP/UDP, Do IP - */ - return fpEvalHeaderIp(p, ip_proto, omd); } void fpEvalIpProtoOnlyRules(Packet *p, uint8_t proto_id) diff --git a/src/ips_options/ips_ip_proto.cc b/src/ips_options/ips_ip_proto.cc index c4155461c..0258045e8 100644 --- a/src/ips_options/ips_ip_proto.cc +++ b/src/ips_options/ips_ip_proto.cc @@ -132,7 +132,7 @@ int IpProtoOption::eval(Cursor&, Packet *p) MODULE_PROFILE_START(ipProtoPerfStats); - const uint8_t ip_proto = p->ip_next_proto(); + const uint8_t ip_proto = p->ip_proto_next(); switch (ipd->comparison_flag) { diff --git a/src/log/log_text.cc b/src/log/log_text.cc index a80723204..fc9e092db 100644 --- a/src/log/log_text.cc +++ b/src/log/log_text.cc @@ -1002,7 +1002,7 @@ static void LogICMPEmbeddedIP(TextLog* log, Packet *p) { case PROTO_BIT__TCP_EMBED_ICMP: { - const tcp::TCPHdr* tcph = layer::get_tcp_embed_icmp(op.ptrs.ip_api); + const tcp::TCPHdr* const tcph = layer::get_tcp_embed_icmp(op.ptrs.ip_api); if (tcph) { orig_p->ptrs.sp = tcph->src_port(); @@ -1020,7 +1020,7 @@ static void LogICMPEmbeddedIP(TextLog* log, Packet *p) case PROTO_BIT__UDP_EMBED_ICMP: { - const udp::UDPHdr* udph = layer::get_udp_embed_icmp(op.ptrs.ip_api); + const udp::UDPHdr* const udph = layer::get_udp_embed_icmp(op.ptrs.ip_api); if (udph) { orig_p->ptrs.sp = udph->src_port(); @@ -1031,8 +1031,9 @@ static void LogICMPEmbeddedIP(TextLog* log, Packet *p) LogIPHeader(log, orig_p); TextLog_Print(log, "Len: %d Csum: %d\n", - ntohs(orig_p->ptrs.udph->uh_len) - udp::UDP_HEADER_LEN, - ntohs(orig_p->ptrs.udph->uh_chk)); + udph->len() - udp::UDP_HEADER_LEN, + udph->cksum()); + } break; } diff --git a/src/loggers/alert_fast.cc b/src/loggers/alert_fast.cc index d2fc4577e..3780d1f0e 100644 --- a/src/loggers/alert_fast.cc +++ b/src/loggers/alert_fast.cc @@ -238,10 +238,10 @@ void FastLogger::alert(Packet *p, const char *msg, Event *event) } /* print the packet header to the alert file */ - if (p->ptrs.ip_api.is_valid()) + if (p->has_ip()) { LogPriorityData(fast_log, event, 0); - TextLog_Print(fast_log, "{%s} ", protocol_names[p->ptrs.ip_api.proto()]); + TextLog_Print(fast_log, "{%s} ", protocol_names[p->ip_proto_next()]); LogIpAddrs(fast_log, p); } diff --git a/src/loggers/alert_sf_socket.cc b/src/loggers/alert_sf_socket.cc index 06bb0e837..443d37a7b 100644 --- a/src/loggers/alert_sf_socket.cc +++ b/src/loggers/alert_sf_socket.cc @@ -316,7 +316,7 @@ void load_sar(Packet *packet, Event *event, SnortActionRequest& sar) // and only 1st 8 used for ip4 sar.src_ip = ntohl(packet->ptrs.ip_api.get_src()->ip32[0]); sar.dest_ip = ntohl(packet->ptrs.ip_api.get_dst()->ip32[0]); - sar.protocol = packet->ptrs.ip_api.proto(); + sar.protocol = packet->ip_proto_next(); if(packet->is_tcp() || packet->is_udp()) { diff --git a/src/loggers/alert_syslog.cc b/src/loggers/alert_syslog.cc index c318f8fbc..a14d823fa 100644 --- a/src/loggers/alert_syslog.cc +++ b/src/loggers/alert_syslog.cc @@ -241,7 +241,7 @@ static void AlertSyslog( "<%s> ", PRINT_INTERFACE(DAQ_GetInterfaceSpec())); } - uint16_t proto = p->ptrs.ip_api.proto(); + uint16_t proto = p->ip_proto_next(); if (protocol_names[proto] != NULL) { SnortSnprintfAppend(event_string, sizeof(event_string), diff --git a/src/loggers/unified2.cc b/src/loggers/unified2.cc index d5bed6efa..951631aaa 100644 --- a/src/loggers/unified2.cc +++ b/src/loggers/unified2.cc @@ -271,7 +271,7 @@ static void _AlertIP4_v2(Packet *p, const char*, Unified2Config *config, Event * } else { - alertdata.protocol = p->ptrs.ip_api.proto();; + alertdata.protocol = p->ip_proto_next(); if ( p->type() == PktType::ICMP) { @@ -382,7 +382,7 @@ static void _AlertIP6_v2(Packet *p, const char*, Unified2Config *config, Event * } else { - alertdata.protocol = p->ptrs.ip_api.proto();; + alertdata.protocol = p->ip_proto_next(); if ( p->type() == PktType::ICMP) { diff --git a/src/main/snort.cc b/src/main/snort.cc index bcf37ed21..1ed206ea2 100644 --- a/src/main/snort.cc +++ b/src/main/snort.cc @@ -328,7 +328,7 @@ static void SnortInit(int argc, char **argv) OrderRuleLists(snort_conf, "drop sdrop reject alert pass log"); } - // Must be after CodecManagers + // Must be after CodecManager::instantiate() if ( !InspectorManager::configure(snort_conf) ) FatalError("can't initialize inspectors\n"); diff --git a/src/network_inspectors/port_scan/port_scan.cc b/src/network_inspectors/port_scan/port_scan.cc index ff6ccbfbe..965160dea 100644 --- a/src/network_inspectors/port_scan/port_scan.cc +++ b/src/network_inspectors/port_scan/port_scan.cc @@ -377,7 +377,7 @@ static int MakePortscanPkt(PS_PKT *ps_pkt, PS_PROTO *proto, int proto_type, g_tmp_pkt->ps_proto = IPPROTO_IP; break; case PS_PROTO_OPEN_PORT: - g_tmp_pkt->ps_proto = p->ptrs.ip_api.proto(); + g_tmp_pkt->ps_proto = p->ip_proto_next(); break; default: return -1; diff --git a/src/protocols/packet.h b/src/protocols/packet.h index 35fe28c5a..0090ab335 100644 --- a/src/protocols/packet.h +++ b/src/protocols/packet.h @@ -227,7 +227,7 @@ struct SO_PUBLIC Packet * eth::ip6::hop_opts::ipv6_routing::UDP * this function return 17 == IPPROTO_UDP == IPPROTO_ID_UDP */ - uint8_t ip_next_proto() const; + uint8_t ip_proto_next() const; inline void reset() { diff --git a/src/stream/ip/ip_defrag.cc b/src/stream/ip/ip_defrag.cc index 77d11f308..f656ef39a 100644 --- a/src/stream/ip/ip_defrag.cc +++ b/src/stream/ip/ip_defrag.cc @@ -1366,7 +1366,7 @@ void Defrag::process(Packet* p, FragTracker* ft) * a rebuilt packet later. So don't process it further. */ if ((frag_offset != 0) || - ((p->ptrs.ip_api.proto() != IPPROTO_UDP) && (p->ptrs.decode_flags & DECODE_MF))) + ((p->ip_proto_next() != IPPROTO_UDP) && (p->ptrs.decode_flags & DECODE_MF))) { DisableDetect(p); } @@ -1503,7 +1503,7 @@ void Defrag::process(Packet* p, FragTracker* ft) FragRebuild(ft, p); if (frag_offset != 0 || - (p->ptrs.ip_api.proto() != IPPROTO_UDP && ft->frag_flags & FRAG_REBUILT)) + (p->ip_proto_next() != IPPROTO_UDP && ft->frag_flags & FRAG_REBUILT)) { /* Need to reset some things here because the * rebuilt packet will have reset the do_detect @@ -2322,7 +2322,7 @@ int Defrag::new_tracker(Packet *p, FragTracker* ft) if (p->ptrs.ip_api.is_ip4()) { - ft->protocol = p->ptrs.ip_api.proto(); + ft->protocol = p->ptrs.ip_api.get_ip4h()->get_proto(); const ip::IP4Hdr *ip4h = reinterpret_cast(lyr.start); frag_off = ntohs(ip4h->get_off());