From: Josh Date: Fri, 18 Apr 2014 14:34:05 +0000 (-0400) Subject: Adding transbridge. Created Ethertype and protocol_number files. Updating codec... X-Git-Tag: 3.0.0-233~1559^2~17 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=956ec03ff353218dc8f82d698e93d76cdb5912ba;p=thirdparty%2Fsnort3.git Adding transbridge. Created Ethertype and protocol_number files. Updating codec template --- diff --git a/src/codecs/plugins/cd_gre.cc b/src/codecs/plugins/cd_gre.cc index 61d609ea0..23796942e 100644 --- a/src/codecs/plugins/cd_gre.cc +++ b/src/codecs/plugins/cd_gre.cc @@ -26,6 +26,8 @@ #include "codecs/decode_module.h" #include "protocols/packet.h" +#include "protocols/ethertypes.h" + namespace { @@ -192,7 +194,7 @@ bool GreCodec::decode(const uint8_t *raw_pkt, const uint32_t len, } /* protocol must be 0x880B - PPP */ - if (GRE_PROTO(p->greh) != GRE_TYPE_PPP) + if (GRE_PROTO(p->greh) != PPP_ETHERTYPE) { CodecEvents::decoder_alert_encapsulated(p, DECODE_GRE_V1_INVALID_HEADER, raw_pkt, len); diff --git a/src/codecs/tmp/prot_transbridge.cc b/src/codecs/plugins/cd_transbridge.cc similarity index 57% rename from src/codecs/tmp/prot_transbridge.cc rename to src/codecs/plugins/cd_transbridge.cc index a60fcaf1b..225150060 100644 --- a/src/codecs/tmp/prot_transbridge.cc +++ b/src/codecs/plugins/cd_transbridge.cc @@ -22,21 +22,39 @@ + #ifdef HAVE_CONFIG_H #include "config.h" #endif -#include "generators.h" -#include "decode.h" -#include "static_include.h" +#include "framework/codec.h" +#include "codecs/codec_events.h" +#include "codecs/decode_module.h" + +#include "protocols/eth.h" +#include "protocols/ethertypes.h" + +namespace +{ + +class TransbridgeCodec : public Codec +{ +public: + TransbridgeCodec() : Codec("Transbridge"){}; + ~TransbridgeCodec(); + + + virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, + Packet *, uint16_t &p_hdr_len, int &next_prot_id); + + virtual void get_protocol_ids(std::vector&); + +}; + +} // anonymous namespace + + -#include "prot_transbridge.h" -#include "prot_arp.h" -#include "prot_vlan.h" -#include "prot_ipv6.h" -#include "prot_ipv4.h" -#include "prot_ethloopback.h" -#include "prot_ipx.h" /* * Function: DecodeTransBridging(uint8_t *, const uint32_t, Packet) @@ -54,45 +72,75 @@ * convention needed to be changed and the stuff at the beginning * wasn't needed since we are already deep into the packet */ -bool TransBridging::Decode(const uint8_t *pkt, const uint32_t len, - Packet *p, uint16_t &p_hdr_len, uint16_t &next_prot_id) +bool TransbridgeCodec::decode(const uint8_t *raw_pkt, const uint32_t len, + Packet *p, uint16_t &p_hdr_len, int &next_prot_id) { - dc.gre_eth++; +// dc.gre_eth++; - if(len < ETHERNET_HEADER_LEN) + if(len < eth::hdr_len()) { CodecEvents::decoder_alert_encapsulated(p, DECODE_GRE_TRANS_DGRAM_LT_TRANSHDR, - pkt, len); - return; + raw_pkt, len); + return false; } /* The Packet struct's ethernet header will now point to the inner ethernet * header of the packet */ - p->eh = (eth::EtherHdr *)pkt; -// PushLayer(PROTO_ETH, p, pkt, sizeof(*p->eh)); + p->eh = (eth::EtherHdr *)raw_pkt; - p_hdr_len = ETHERNET_HEADER_LEN; + p_hdr_len = eth::hdr_len(); next_prot_id = ntohs(p->eh->ether_type); return true; } -static const char* name = "transbridge_decode"; + +void TransbridgeCodec::get_protocol_ids(std::vector& v) +{ + v.push_back(TRANS_ETHER_BRIDGING_ETHERTYPE); // defined in ethertypes.h" +} + +static Codec* ctor() +{ + return new TransbridgeCodec(); +} + +static void dtor(Codec *cd) +{ + delete cd; +} + +static void sum() +{ +// sum_stats((PegCount*)&gdc, (PegCount*)&dc, array_size(dc_pegs)); +// memset(&dc, 0, sizeof(dc)); +} + +static void stats() +{ +// show_percent_stats((PegCount*)&gdc, dc_pegs, array_size(dc_pegs), +// "decoder"); +} + + + +static const char* name = "transbridge_codec"; static const CodecApi transbridge_api = { { PT_CODEC, name, CDAPI_PLUGIN_V0, 0 }, - {GRE_TYPE_TRANS_BRIDGING}, NULL, // pinit NULL, // pterm NULL, // tinit NULL, // tterm - NULL, // ctor - NULL, // dtor - GRE::Decode, + ctor, // ctor + dtor, // dtor + sum, // sum + stats // stats }; + diff --git a/src/codecs/tmp/template.cc b/src/codecs/tmp/template.cc index aa6e1110b..f5cda85de 100644 --- a/src/codecs/tmp/template.cc +++ b/src/codecs/tmp/template.cc @@ -25,17 +25,10 @@ #ifdef HAVE_CONFIG_H #include "config.h" #endif -#if 0 - -#ifdef HAVE_DUMBNET_H -#include -#else -#include -#endif -#endif #include "framework/codec.h" #include "codecs/codec_events.h" +#include "codecs/decode_module.h" namespace diff --git a/src/protocols/CMakeLists.txt b/src/protocols/CMakeLists.txt index e6dad368d..1bbfe46e2 100644 --- a/src/protocols/CMakeLists.txt +++ b/src/protocols/CMakeLists.txt @@ -14,5 +14,7 @@ add_library (protocols arp.h wlan.h teredo.h + ethertypes.h + protocol_numbers.h ) diff --git a/src/protocols/ethertypes.h b/src/protocols/ethertypes.h new file mode 100644 index 000000000..918915c2b --- /dev/null +++ b/src/protocols/ethertypes.h @@ -0,0 +1,40 @@ +/* +** Copyright (C) 2002-2013 Sourcefire, Inc. +** Copyright (C) 1998-2002 Martin Roesch +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + + +#ifndef ETHERTYPES_H +#define ETHERTYPES_H + +/* + * this file contained the ethertypes for all of the various protocols. + * + * This is ONLY useful when protocols are chained and specificy the next + * protocol by name rather than by an ID. MOST protocols do NOT need to + * entered into this file. + * + * Defined at: + * http://www.iana.org/assignments/ieee-802-numbers/ieee-802-numbers.xhtml + */ + + +const uint16_t TRANS_ETHER_BRIDGING_ETHERTYPE = 0x6558; +const uint16_t PPP_ETHERTYPE = 0x880B; + +#endif diff --git a/src/protocols/gre.h b/src/protocols/gre.h index 254d2f3b8..0761abc19 100644 --- a/src/protocols/gre.h +++ b/src/protocols/gre.h @@ -43,8 +43,6 @@ struct GREHdr typedef gre::GREHdr GREHdr; -#define GRE_TYPE_TRANS_BRIDGING 0x6558 -#define GRE_TYPE_PPP 0x880B #define GRE_VERSION(x) (x->version & 0x07) diff --git a/src/codecs/tmp/prot_transbridge.h b/src/protocols/protocol_numbers.h similarity index 79% rename from src/codecs/tmp/prot_transbridge.h rename to src/protocols/protocol_numbers.h index dedf8febe..2d44c5328 100644 --- a/src/codecs/tmp/prot_transbridge.h +++ b/src/protocols/protocol_numbers.h @@ -19,11 +19,14 @@ */ -#ifndef PROT_TRANSBRIDING_H -#define PROT_TRANSBRIDING_H +#ifndef PROTOCOL_NUMBERS_H +#define PROTOCOL_NUMBERS_H -void DecodeTransBridging(const uint8_t *, const uint32_t, Packet *); +/* + * this file contained the protocol numbers for all of the various protocols. + * Defined at: + * http://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml + */ -#endif