From: Steve Chew Date: Tue, 12 Apr 2016 14:52:32 +0000 (-0400) Subject: Add IpProtocol and ProtocolId enums. X-Git-Tag: 3.0.0-233~420^2~5 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a2fd7db419682a1ffe0aae3e77cc2d478d3d948f;p=thirdparty%2Fsnort3.git Add IpProtocol and ProtocolId enums. --- diff --git a/src/codecs/ip/cd_auth.cc b/src/codecs/ip/cd_auth.cc index 595312196..68d0c78b6 100644 --- a/src/codecs/ip/cd_auth.cc +++ b/src/codecs/ip/cd_auth.cc @@ -59,14 +59,14 @@ public: AuthCodec() : Codec(CD_AUTH_NAME) { } ~AuthCodec() { } - void get_protocol_ids(std::vector& v) override; + void get_protocol_ids(std::vector& v) override; bool decode(const RawData&, CodecData&, DecodeData&) override; }; /* Valid for both IPv4 and IPv6 */ struct AuthHdr { - uint8_t next; + IpProtocol next; uint8_t len; uint16_t rsv; /* reserved */ uint32_t spi; /* Security Parameters Index */ @@ -78,8 +78,8 @@ constexpr uint8_t MIN_AUTH_LEN = 16; // this is in minimum number of bytes ... // no relatino to the AuthHdr.len field. } // anonymous namespace -void AuthCodec::get_protocol_ids(std::vector& v) -{ v.push_back(IPPROTO_ID_AUTH); } +void AuthCodec::get_protocol_ids(std::vector& v) +{ v.push_back(ProtocolId::AUTH); } bool AuthCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort) { @@ -101,7 +101,7 @@ bool AuthCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort) return false; } - codec.next_prot_id = ah->next; + codec.next_prot_id = (ProtocolId)ah->next; // must be called AFTER setting next_prot_id if (snort.ip_api.is_ip6()) @@ -112,7 +112,7 @@ bool AuthCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort) return false; } - CheckIPv6ExtensionOrder(codec, IPPROTO_ID_AUTH); + CheckIPv6ExtensionOrder(codec, IpProtocol::AUTH); codec.proto_bits |= PROTO_BIT__IP6_EXT; codec.ip6_csum_proto = ah->next; codec.ip6_extension_count++; diff --git a/src/codecs/ip/cd_dst_opts.cc b/src/codecs/ip/cd_dst_opts.cc index c6601ebca..b462c2322 100644 --- a/src/codecs/ip/cd_dst_opts.cc +++ b/src/codecs/ip/cd_dst_opts.cc @@ -38,13 +38,13 @@ public: Ipv6DSTOptsCodec() : Codec(CD_DSTOPTS_NAME) { } ~Ipv6DSTOptsCodec() { } - void get_protocol_ids(std::vector& v) override; + void get_protocol_ids(std::vector& v) override; bool decode(const RawData&, CodecData&, DecodeData&) override; }; struct IP6Dest { - uint8_t ip6dest_nxt; + IpProtocol ip6dest_nxt; uint8_t ip6dest_len; /* options follow */ uint8_t ip6dest_pad[6]; @@ -64,7 +64,7 @@ bool Ipv6DSTOptsCodec::decode(const RawData& raw, CodecData& codec, DecodeData&) if ( snort_conf->hit_ip6_maxopts(codec.ip6_extension_count) ) codec_event(codec, DECODE_IP6_EXCESS_EXT_HDR); - if (dsthdr->ip6dest_nxt == IPPROTO_ROUTING) + if (dsthdr->ip6dest_nxt == IpProtocol::ROUTING) codec_event(codec, DECODE_IPV6_DSTOPTS_WITH_ROUTING); codec.lyr_len = sizeof(IP6Dest) + (dsthdr->ip6dest_len << 3); @@ -77,19 +77,19 @@ bool Ipv6DSTOptsCodec::decode(const RawData& raw, CodecData& codec, DecodeData&) codec.proto_bits |= PROTO_BIT__IP6_EXT; codec.ip6_extension_count++; - codec.next_prot_id = dsthdr->ip6dest_nxt; + codec.next_prot_id = (ProtocolId)dsthdr->ip6dest_nxt; codec.ip6_csum_proto = dsthdr->ip6dest_nxt; // must be called AFTER setting next_prot_id - CheckIPv6ExtensionOrder(codec, IPPROTO_ID_DSTOPTS); + CheckIPv6ExtensionOrder(codec, IpProtocol::DSTOPTS); if ( CheckIPV6HopOptions(raw, codec)) return true; return false; } -void Ipv6DSTOptsCodec::get_protocol_ids(std::vector& v) -{ v.push_back(IPPROTO_ID_DSTOPTS); } +void Ipv6DSTOptsCodec::get_protocol_ids(std::vector& v) +{ v.push_back(ProtocolId::DSTOPTS); } //------------------------------------------------------------------------- // api diff --git a/src/codecs/ip/cd_esp.cc b/src/codecs/ip/cd_esp.cc index 0736ef1bc..b64dc7af2 100644 --- a/src/codecs/ip/cd_esp.cc +++ b/src/codecs/ip/cd_esp.cc @@ -71,7 +71,7 @@ public: EspCodec() : Codec(CD_ESP_NAME) { } ~EspCodec() { } - void get_protocol_ids(std::vector& v) override; + void get_protocol_ids(std::vector& v) override; bool decode(const RawData&, CodecData&, DecodeData&) override; }; @@ -81,8 +81,8 @@ constexpr uint32_t ESP_AUTH_DATA_LEN = 12; constexpr uint32_t ESP_TRAILER_LEN = 2; } // anonymous namespace -void EspCodec::get_protocol_ids(std::vector& v) -{ v.push_back(IPPROTO_ID_ESP); } +void EspCodec::get_protocol_ids(std::vector& v) +{ v.push_back(ProtocolId::ESP); } /* * Attempt to decode Encapsulated Security Payload. @@ -95,6 +95,7 @@ bool EspCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort) { const uint8_t* esp_payload; uint8_t pad_length; + uint8_t ip_proto; if (!SnortConfig::esp_decoding()) return false; @@ -119,7 +120,8 @@ bool EspCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort) codec.lyr_len = ESP_HEADER_LEN; esp_payload = raw.data + ESP_HEADER_LEN; pad_length = *(esp_payload + guessed_len); - codec.next_prot_id = *(esp_payload + guessed_len + 1); + ip_proto = *(esp_payload + guessed_len + 1); + codec.next_prot_id = (ProtocolId)ip_proto; // must be called AFTER setting next_prot_id if (snort.ip_api.is_ip6()) @@ -130,9 +132,9 @@ bool EspCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort) return false; } - CheckIPv6ExtensionOrder(codec, IPPROTO_ID_ESP); + CheckIPv6ExtensionOrder(codec, IpProtocol::ESP); codec.proto_bits |= PROTO_BIT__IP6_EXT; - codec.ip6_csum_proto = codec.next_prot_id; + codec.ip6_csum_proto = (IpProtocol)ip_proto; codec.ip6_extension_count++; } @@ -149,7 +151,7 @@ bool EspCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort) { snort.decode_flags |= DECODE_PKT_TRUST; codec.lyr_len = ESP_HEADER_LEN; // we want data to begin at (pkt + ESP_HEADER_LEN) - codec.next_prot_id = FINISHED_DECODE; + codec.next_prot_id = ProtocolId::FINISHED_DECODE; return true; } @@ -159,9 +161,12 @@ bool EspCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort) decoder stage to silently ignore invalid headers. */ // highest valid protocol id == 255. - if (codec.next_prot_id > 0xFF) + + // FIXIT-M -- The next_prot_id will never be > 0xFF since it came from + // a uint8_t originally... + if (to_utype(codec.next_prot_id) > 0xFF) { - codec.next_prot_id = FINISHED_DECODE; + codec.next_prot_id = ProtocolId::FINISHED_DECODE; snort.decode_flags |= DECODE_PKT_TRUST; } else diff --git a/src/codecs/ip/cd_frag.cc b/src/codecs/ip/cd_frag.cc index 9ae75bc15..3f299f386 100644 --- a/src/codecs/ip/cd_frag.cc +++ b/src/codecs/ip/cd_frag.cc @@ -44,7 +44,7 @@ public: bool decode(const RawData&, CodecData&, DecodeData&) override; void log(TextLog* const, const uint8_t* pkt, const uint16_t len) override; - void get_protocol_ids(std::vector&) override; + void get_protocol_ids(std::vector&) override; }; } // namespace @@ -99,7 +99,7 @@ bool Ipv6FragCodec::decode(const RawData& raw, CodecData& codec, DecodeData& sno codec.ip6_extension_count++; // must be called AFTER setting next_prot_id - CheckIPv6ExtensionOrder(codec, IPPROTO_ID_FRAGMENT); + CheckIPv6ExtensionOrder(codec, IpProtocol::FRAGMENT); // Since the Frag layer is removed from rebuilt packets, ensure // the next layer is correctly order now. @@ -113,18 +113,18 @@ bool Ipv6FragCodec::decode(const RawData& raw, CodecData& codec, DecodeData& sno value may differ from that of the offset zero frag, but only the Next Header of the original frag is used. */ // check DecodeIP(); we handle frags the same way here - codec.next_prot_id = FINISHED_DECODE; + codec.next_prot_id = ProtocolId::FINISHED_DECODE; } else { - codec.next_prot_id = ip6frag_hdr->ip6f_nxt; + codec.next_prot_id = (ProtocolId)ip6frag_hdr->ip6f_nxt; } return true; } -void Ipv6FragCodec::get_protocol_ids(std::vector& v) -{ v.push_back(IPPROTO_ID_FRAGMENT); } +void Ipv6FragCodec::get_protocol_ids(std::vector& v) +{ v.push_back(ProtocolId::FRAGMENT); } void Ipv6FragCodec::log(TextLog* const text_log, const uint8_t* raw_pkt, const uint16_t /*lyr_len*/) diff --git a/src/codecs/ip/cd_gre.cc b/src/codecs/ip/cd_gre.cc index 6667bca87..2cbedba8b 100644 --- a/src/codecs/ip/cd_gre.cc +++ b/src/codecs/ip/cd_gre.cc @@ -61,7 +61,7 @@ public: GreCodec() : Codec(CD_GRE_NAME) { } ~GreCodec() { } - void get_protocol_ids(std::vector& v) override; + void get_protocol_ids(std::vector& v) override; bool decode(const RawData&, CodecData&, DecodeData&) override; void log(TextLog* const, const uint8_t* pkt, const uint16_t len) override; }; @@ -88,8 +88,8 @@ static const uint32_t GRE_V1_ACK_LEN = 4; #define GRE_FLAGS(x) (x->version & 0xF8) } // anonymous namespace -void GreCodec::get_protocol_ids(std::vector& v) -{ v.push_back(IPPROTO_ID_GRE); } +void GreCodec::get_protocol_ids(std::vector& v) +{ v.push_back(ProtocolId::GRE); } /* * see RFCs 1701, 2784 and 2637 @@ -175,7 +175,7 @@ bool GreCodec::decode(const RawData& raw, CodecData& codec, DecodeData&) } /* protocol must be 0x880B - PPP */ - if (greh->proto() != ETHERTYPE_PPP) + if (greh->proto() != ProtocolId::ETHERTYPE_PPP) { codec_event(codec, DECODE_GRE_V1_INVALID_HEADER); return false; diff --git a/src/codecs/ip/cd_hop_opts.cc b/src/codecs/ip/cd_hop_opts.cc index c1758953f..bcfa0c7c6 100644 --- a/src/codecs/ip/cd_hop_opts.cc +++ b/src/codecs/ip/cd_hop_opts.cc @@ -38,13 +38,13 @@ public: Ipv6HopOptsCodec() : Codec(CD_HOPOPTS_NAME) { } ~Ipv6HopOptsCodec() { } - void get_protocol_ids(std::vector& v) override; + void get_protocol_ids(std::vector& v) override; bool decode(const RawData&, CodecData&, DecodeData&) override; }; struct IP6HopByHop { - uint8_t ip6hbh_nxt; + IpProtocol ip6hbh_nxt; uint8_t ip6hbh_len; /* options follow */ uint8_t ip6hbh_pad[6]; @@ -78,22 +78,22 @@ bool Ipv6HopOptsCodec::decode(const RawData& raw, CodecData& codec, DecodeData&) return false; } - codec.next_prot_id = (uint16_t)hbh_hdr->ip6hbh_nxt; + codec.next_prot_id = (ProtocolId)hbh_hdr->ip6hbh_nxt; codec.ip6_csum_proto = hbh_hdr->ip6hbh_nxt; codec.ip6_extension_count++; codec.proto_bits |= PROTO_BIT__IP6_EXT; // must be called AFTER setting next_prot_id - CheckIPv6ExtensionOrder(codec, IPPROTO_ID_HOPOPTS); + CheckIPv6ExtensionOrder(codec, IpProtocol::HOPOPTS); if ( CheckIPV6HopOptions(raw, codec)) return true; return false; } -void Ipv6HopOptsCodec::get_protocol_ids(std::vector& v) +void Ipv6HopOptsCodec::get_protocol_ids(std::vector& v) { - v.push_back(IPPROTO_ID_HOPOPTS); + v.push_back(ProtocolId::HOPOPTS); } //------------------------------------------------------------------------- diff --git a/src/codecs/ip/cd_icmp4.cc b/src/codecs/ip/cd_icmp4.cc index 51558ed2c..0a2ef0ca8 100644 --- a/src/codecs/ip/cd_icmp4.cc +++ b/src/codecs/ip/cd_icmp4.cc @@ -108,7 +108,7 @@ public: Icmp4Codec() : Codec(CD_ICMP4_NAME) { } ~Icmp4Codec() { } - void get_protocol_ids(std::vector&) override; + void get_protocol_ids(std::vector&) override; bool decode(const RawData&, CodecData&, DecodeData&) override; void update(const ip::IpApi&, const EncodeFlags, uint8_t* raw_pkt, uint16_t lyr_len, uint32_t& updated_len) override; @@ -121,8 +121,8 @@ private: }; } // namespace -void Icmp4Codec::get_protocol_ids(std::vector& v) -{ v.push_back(IPPROTO_ID_ICMPV4); } +void Icmp4Codec::get_protocol_ids(std::vector& v) +{ v.push_back(ProtocolId::ICMPV4); } bool Icmp4Codec::decode(const RawData& raw, CodecData& codec,DecodeData& snort) { @@ -222,7 +222,7 @@ bool Icmp4Codec::decode(const RawData& raw, CodecData& codec,DecodeData& snort) case icmp::IcmpType::PARAMETERPROB: /* account for extra 4 bytes in header */ len += 4; - codec.next_prot_id = PROTO_IP_EMBEDDED_IN_ICMP4; + codec.next_prot_id = ProtocolId::IP_EMBEDDED_IN_ICMP4; break; default: diff --git a/src/codecs/ip/cd_icmp6.cc b/src/codecs/ip/cd_icmp6.cc index 297d3812f..0afbf1ba7 100644 --- a/src/codecs/ip/cd_icmp6.cc +++ b/src/codecs/ip/cd_icmp6.cc @@ -98,7 +98,7 @@ public: Icmp6Codec() : Codec(CD_ICMP6_NAME) { } ~Icmp6Codec() { } - void get_protocol_ids(std::vector& v) override; + void get_protocol_ids(std::vector& v) override; bool decode(const RawData&, CodecData&, DecodeData&) override; void update(const ip::IpApi&, const EncodeFlags, uint8_t* raw_pkt, uint16_t lyr_len, uint32_t& updated_len) override; @@ -107,8 +107,8 @@ public: }; } // anonymous namespace -void Icmp6Codec::get_protocol_ids(std::vector& v) -{ v.push_back(IPPROTO_ID_ICMPV6); } +void Icmp6Codec::get_protocol_ids(std::vector& v) +{ v.push_back(ProtocolId::ICMPV6); } bool Icmp6Codec::decode(const RawData& raw, CodecData& codec, DecodeData& snort) { @@ -182,7 +182,7 @@ bool Icmp6Codec::decode(const RawData& raw, CodecData& codec, DecodeData& snort) codec_event(codec, DECODE_ICMPV6_TOO_BIG_BAD_MTU); len = icmp::ICMP6_HEADER_NORMAL_LEN; - codec.next_prot_id = PROTO_IP_EMBEDDED_IN_ICMP6; + codec.next_prot_id = ProtocolId::IP_EMBEDDED_IN_ICMP6; } else { @@ -205,7 +205,7 @@ bool Icmp6Codec::decode(const RawData& raw, CodecData& codec, DecodeData& snort) codec_event(codec, DECODE_ICMPV6_UNREACHABLE_NON_RFC_4443_CODE); } len = icmp::ICMP6_HEADER_NORMAL_LEN; - codec.next_prot_id = PROTO_IP_EMBEDDED_IN_ICMP6; + codec.next_prot_id = ProtocolId::IP_EMBEDDED_IN_ICMP6; } else { @@ -354,7 +354,7 @@ void Icmp6Codec::update(const ip::IpApi& api, const EncodeFlags flags, memcpy(ps6.sip, api.get_src()->ip32, sizeof(ps6.sip)); memcpy(ps6.dip, api.get_dst()->ip32, sizeof(ps6.dip)); ps6.zero = 0; - ps6.protocol = IPPROTO_ICMPV6; + ps6.protocol = IpProtocol::ICMPV6; ps6.len = htons((uint16_t)updated_len); h->cksum = checksum::icmp_cksum((uint16_t*)h, updated_len, &ps6); } diff --git a/src/codecs/ip/cd_igmp.cc b/src/codecs/ip/cd_igmp.cc index 84d34aef6..fd388a937 100644 --- a/src/codecs/ip/cd_igmp.cc +++ b/src/codecs/ip/cd_igmp.cc @@ -53,7 +53,7 @@ public: ~IgmpCodec() { } bool decode(const RawData&, CodecData&, DecodeData&) override; - void get_protocol_ids(std::vector&) override; + void get_protocol_ids(std::vector&) override; }; } // namespace @@ -84,9 +84,9 @@ bool IgmpCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort) return true; } -void IgmpCodec::get_protocol_ids(std::vector& v) +void IgmpCodec::get_protocol_ids(std::vector& v) { - v.push_back(IPPROTO_IGMP); + v.push_back(ProtocolId::IGMP); } //------------------------------------------------------------------------- diff --git a/src/codecs/ip/cd_ipv4.cc b/src/codecs/ip/cd_ipv4.cc index 74e3b3471..1f19237f9 100644 --- a/src/codecs/ip/cd_ipv4.cc +++ b/src/codecs/ip/cd_ipv4.cc @@ -111,7 +111,7 @@ public: Ipv4Codec() : Codec(CD_IPV4_NAME) { } ~Ipv4Codec() { } - void get_protocol_ids(std::vector& v) override; + void get_protocol_ids(std::vector& v) override; bool decode(const RawData&, CodecData&, DecodeData&) override; void log(TextLog* const, const uint8_t* pkt, const uint16_t len) override; bool encode(const uint8_t* const raw_in, const uint16_t raw_len, @@ -134,10 +134,10 @@ static THREAD_LOCAL std::array s_id_pool { }; } // namespace -void Ipv4Codec::get_protocol_ids(std::vector& v) +void Ipv4Codec::get_protocol_ids(std::vector& v) { - v.push_back(ETHERTYPE_IPV4); - v.push_back(IPPROTO_ID_IPIP); + v.push_back(ProtocolId::ETHERTYPE_IPV4); + v.push_back(ProtocolId::IPIP); } bool Ipv4Codec::decode(const RawData& raw, CodecData& codec, DecodeData& snort) @@ -321,12 +321,12 @@ bool Ipv4Codec::decode(const RawData& raw, CodecData& codec, DecodeData& snort) * or if it is, its a UDP packet and offset is 0 */ if (!(snort.decode_flags & DECODE_FRAG) /*|| ((frag_off == 0) && // FIXIT-M this forces flow to udp instead of ip - (iph->proto() == IPPROTO_UDP))*/) + (iph->proto() == IpProtocol::UDP))*/) { - if (iph->proto() >= MIN_UNASSIGNED_IP_PROTO) + if (to_utype(iph->proto()) >= to_utype(ProtocolId::MIN_UNASSIGNED_IP_PROTO)) codec_event(codec, DECODE_IP_UNASSIGNED_PROTO); else - codec.next_prot_id = iph->proto(); + codec.next_prot_id = (ProtocolId)iph->proto(); } return true; @@ -666,8 +666,8 @@ bool Ipv4Codec::encode(const uint8_t* const raw_in, const uint16_t /*raw_len*/, * cycles and use the literal header size for checksum */ ip4h_out->ip_csum = checksum::ip_cksum((uint16_t*)ip4h_out, ip::IP4_HEADER_LEN); - enc.next_proto = IPPROTO_ID_IPIP; - enc.next_ethertype = ETHERTYPE_IPV4; + enc.next_proto = IpProtocol::IPIP; + enc.next_ethertype = ProtocolId::ETHERTYPE_IPV4; return true; } diff --git a/src/codecs/ip/cd_ipv6.cc b/src/codecs/ip/cd_ipv6.cc index d7f88a7f9..962942bbd 100644 --- a/src/codecs/ip/cd_ipv6.cc +++ b/src/codecs/ip/cd_ipv6.cc @@ -91,7 +91,7 @@ public: Ipv6Codec() : Codec(CD_IPV6_NAME) { } ~Ipv6Codec() { } - void get_protocol_ids(std::vector& v) override; + void get_protocol_ids(std::vector& v) override; bool decode(const RawData&, CodecData&, DecodeData&) override; bool encode(const uint8_t* const raw_in, const uint16_t raw_len, EncState&, Buffer&) override; @@ -114,10 +114,10 @@ private: ************************* CLASS FUNCTIONS ************************ ********************************************************************/ -void Ipv6Codec::get_protocol_ids(std::vector& v) +void Ipv6Codec::get_protocol_ids(std::vector& v) { - v.push_back(ETHERTYPE_IPV6); - v.push_back(IPPROTO_ID_IPV6); + v.push_back(ProtocolId::ETHERTYPE_IPV6); + v.push_back(ProtocolId::IPV6); } bool Ipv6Codec::decode(const RawData& raw, CodecData& codec, DecodeData& snort) @@ -199,7 +199,7 @@ bool Ipv6Codec::decode(const RawData& raw, CodecData& codec, DecodeData& snort) const_cast(raw.len) = ip6h->len() + ip::IP6_HEADER_LEN; snort.set_pkt_type(PktType::IP); - codec.next_prot_id = ip6h->next(); + codec.next_prot_id = (ProtocolId)ip6h->next(); codec.lyr_len = ip::IP6_HEADER_LEN; codec.curr_ip6_extension = 0; codec.ip6_extension_count = 0; @@ -215,7 +215,7 @@ void Ipv6Codec::IPV6CheckIsatap(const ip::IP6Hdr* const ip6h, const CodecData& codec) { /* Only check for IPv6 over IPv4 */ - if (snort.ip_api.is_ip4() && snort.ip_api.get_ip4h()->proto() == IPPROTO_ID_IPV6) + if (snort.ip_api.is_ip4() && snort.ip_api.get_ip4h()->proto() == IpProtocol::IPV6) { uint32_t isatap_interface_id = ntohl(ip6h->ip6_src.u6_addr32[2]) & 0xFCFFFFFF; @@ -589,8 +589,8 @@ bool Ipv6Codec::encode(const uint8_t* const raw_in, const uint16_t /*raw_len*/, ipvh_out->ip6_vtf = htonl(ntohl(hi->ip6_vtf) & 0xFFF00000); ipvh_out->ip6_payload_len = htons(buf.size() - sizeof(ip::IP6Hdr)); - enc.next_proto = IPPROTO_ID_IPV6; - enc.next_ethertype = ETHERTYPE_IPV6; + enc.next_proto = IpProtocol::IPV6; + enc.next_ethertype = ProtocolId::ETHERTYPE_IPV6; return true; } diff --git a/src/codecs/ip/cd_mobility.cc b/src/codecs/ip/cd_mobility.cc index 604746ffb..a8bfdc585 100644 --- a/src/codecs/ip/cd_mobility.cc +++ b/src/codecs/ip/cd_mobility.cc @@ -37,14 +37,14 @@ public: MobilityCodec() : Codec(CD_MOBILE_NAME) { } ~MobilityCodec() { } - void get_protocol_ids(std::vector&) override; + void get_protocol_ids(std::vector&) override; bool decode(const RawData&, CodecData&, DecodeData&) override; }; } // namespace -void MobilityCodec::get_protocol_ids(std::vector& v) +void MobilityCodec::get_protocol_ids(std::vector& v) { - v.push_back(IPPROTO_ID_MOBILITY); + v.push_back(ProtocolId::MOBILITY); } bool MobilityCodec::decode(const RawData&, CodecData& codec, DecodeData&) diff --git a/src/codecs/ip/cd_no_next.cc b/src/codecs/ip/cd_no_next.cc index 4886f5cd3..c90ad1a0f 100644 --- a/src/codecs/ip/cd_no_next.cc +++ b/src/codecs/ip/cd_no_next.cc @@ -38,7 +38,7 @@ public: ~Ipv6NoNextCodec() { } bool decode(const RawData&, CodecData&, DecodeData&) override; - void get_protocol_ids(std::vector&) override; + void get_protocol_ids(std::vector&) override; }; } // namespace @@ -64,8 +64,8 @@ bool Ipv6NoNextCodec::decode(const RawData& raw, CodecData& codec, DecodeData&) return true; } -void Ipv6NoNextCodec::get_protocol_ids(std::vector& v) -{ v.push_back(IPPROTO_ID_NONEXT); } +void Ipv6NoNextCodec::get_protocol_ids(std::vector& v) +{ v.push_back(ProtocolId::NONEXT); } //------------------------------------------------------------------------- // api diff --git a/src/codecs/ip/cd_pgm.cc b/src/codecs/ip/cd_pgm.cc index 7eedf583f..56fac1d88 100644 --- a/src/codecs/ip/cd_pgm.cc +++ b/src/codecs/ip/cd_pgm.cc @@ -54,10 +54,9 @@ public: ~PgmCodec() { } bool decode(const RawData&, CodecData&, DecodeData&) override; - void get_protocol_ids(std::vector&) override; + void get_protocol_ids(std::vector&) override; }; -static const uint16_t IPPROTO_ID_PGM = 113; static const int PGM_NAK_ERR = -1; static const int PGM_NAK_OK = 0; static const int PGM_NAK_VULN = 1; @@ -148,9 +147,9 @@ bool PgmCodec::decode(const RawData& raw, CodecData& codec, DecodeData&) return true; } -void PgmCodec::get_protocol_ids(std::vector& v) +void PgmCodec::get_protocol_ids(std::vector& v) { - v.push_back(IPPROTO_ID_PGM); + v.push_back(ProtocolId::PGM); } //------------------------------------------------------------------------- diff --git a/src/codecs/ip/cd_routing.cc b/src/codecs/ip/cd_routing.cc index 029d7f9c1..587953ccd 100644 --- a/src/codecs/ip/cd_routing.cc +++ b/src/codecs/ip/cd_routing.cc @@ -41,12 +41,12 @@ public: bool decode(const RawData&, CodecData&, DecodeData&) override; - void get_protocol_ids(std::vector&) override; + void get_protocol_ids(std::vector&) override; }; struct IP6Route { - uint8_t ip6rte_nxt; + IpProtocol ip6rte_nxt; uint8_t ip6rte_len; uint8_t ip6rte_type; uint8_t ip6rte_seg_left; @@ -68,8 +68,8 @@ struct IP6Route0 #endif } // namespace -void Ipv6RoutingCodec::get_protocol_ids(std::vector& v) -{ v.push_back(IPPROTO_ID_ROUTING); } +void Ipv6RoutingCodec::get_protocol_ids(std::vector& v) +{ v.push_back(ProtocolId::ROUTING); } bool Ipv6RoutingCodec::decode(const RawData& raw, CodecData& codec, DecodeData&) { @@ -97,10 +97,10 @@ bool Ipv6RoutingCodec::decode(const RawData& raw, CodecData& codec, DecodeData&) if (rte->ip6rte_type == 0) codec_event(codec, DECODE_IPV6_ROUTE_ZERO); - if (rte->ip6rte_nxt == IPPROTO_ID_HOPOPTS) + if (rte->ip6rte_nxt == IpProtocol::HOPOPTS) codec_event(codec, DECODE_IPV6_ROUTE_AND_HOPBYHOP); - if (rte->ip6rte_nxt == IPPROTO_ID_ROUTING) + if (rte->ip6rte_nxt == IpProtocol::ROUTING) codec_event(codec, DECODE_IPV6_TWO_ROUTE_HEADERS); codec.lyr_len = ip::MIN_EXT_LEN + (rte->ip6rte_len << 3); @@ -112,11 +112,11 @@ bool Ipv6RoutingCodec::decode(const RawData& raw, CodecData& codec, DecodeData&) codec.proto_bits |= PROTO_BIT__IP6_EXT; // check ip proto rules against this layer codec.ip6_extension_count++; - codec.next_prot_id = rte->ip6rte_nxt; + codec.next_prot_id = (ProtocolId)rte->ip6rte_nxt; codec.ip6_csum_proto = rte->ip6rte_nxt; // must be called AFTER setting next_prot_id - CheckIPv6ExtensionOrder(codec, IPPROTO_ID_ROUTING); + CheckIPv6ExtensionOrder(codec, IpProtocol::ROUTING); return true; } diff --git a/src/codecs/ip/cd_sun_nd.cc b/src/codecs/ip/cd_sun_nd.cc index 44d61a44a..9aeeb5ee4 100644 --- a/src/codecs/ip/cd_sun_nd.cc +++ b/src/codecs/ip/cd_sun_nd.cc @@ -36,16 +36,15 @@ public: SunNdCodec() : Codec(CD_SUN_ND_NAME) { } ~SunNdCodec() { } - void get_protocol_ids(std::vector&) override; + void get_protocol_ids(std::vector&) override; bool decode(const RawData&, CodecData&, DecodeData&) override; }; -const uint16_t IPPROTO_ID_SUN_ND = 77; } // namespace -void SunNdCodec::get_protocol_ids(std::vector& v) +void SunNdCodec::get_protocol_ids(std::vector& v) { - v.push_back(IPPROTO_ID_SUN_ND); + v.push_back(ProtocolId::SUN_ND); } bool SunNdCodec::decode(const RawData&, CodecData& codec, DecodeData&) diff --git a/src/codecs/ip/cd_swipe.cc b/src/codecs/ip/cd_swipe.cc index 55b7f7593..5640ea8f0 100644 --- a/src/codecs/ip/cd_swipe.cc +++ b/src/codecs/ip/cd_swipe.cc @@ -35,15 +35,13 @@ public: SwipeCodec() : Codec(CD_SWIPE_NAME) { } ~SwipeCodec() { } - void get_protocol_ids(std::vector& v) override; + void get_protocol_ids(std::vector& v) override; bool decode(const RawData&, CodecData&, DecodeData&) override; }; } // namespace -static const uint16_t SWIPE_PROT_ID = 53; - -void SwipeCodec::get_protocol_ids(std::vector& proto_ids) -{ proto_ids.push_back(SWIPE_PROT_ID); } +void SwipeCodec::get_protocol_ids(std::vector& proto_ids) +{ proto_ids.push_back(ProtocolId::SWIPE); } bool SwipeCodec::decode(const RawData&, CodecData& codec, DecodeData&) { diff --git a/src/codecs/ip/cd_tcp.cc b/src/codecs/ip/cd_tcp.cc index 80bf8cd71..5e57df1c6 100644 --- a/src/codecs/ip/cd_tcp.cc +++ b/src/codecs/ip/cd_tcp.cc @@ -110,7 +110,7 @@ public: ~TcpCodec() { } - void get_protocol_ids(std::vector& v) override; + void get_protocol_ids(std::vector& v) override; void log(TextLog* const, const uint8_t* pkt, const uint16_t len) override; bool decode(const RawData&, CodecData&, DecodeData&) override; bool encode(const uint8_t* const raw_in, const uint16_t raw_len, @@ -134,9 +134,9 @@ private: static sfip_var_t* SynToMulticastDstIp = NULL; } // namespace -void TcpCodec::get_protocol_ids(std::vector& v) +void TcpCodec::get_protocol_ids(std::vector& v) { - v.push_back(IPPROTO_ID_TCP); + v.push_back(ProtocolId::TCP); } bool TcpCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort) @@ -642,7 +642,7 @@ bool TcpCodec::encode(const uint8_t* const raw_in, const uint16_t /*raw_len*/, } // in case of ip6 extension headers, this gets next correct - enc.next_proto = IPPROTO_ID_TCP; + enc.next_proto = IpProtocol::TCP; tcph_out->th_sum = 0; const ip::IpApi& ip_api = enc.ip_api; @@ -655,7 +655,7 @@ bool TcpCodec::encode(const uint8_t* const raw_in, const uint16_t /*raw_len*/, ps.sip = ip4h->get_src(); ps.dip = ip4h->get_dst(); ps.zero = 0; - ps.protocol = IPPROTO_ID_TCP; + ps.protocol = IpProtocol::TCP; ps.len = htons((uint16_t)len); tcph_out->th_sum = checksum::tcp_cksum((uint16_t*)tcph_out, len, &ps); } @@ -668,7 +668,7 @@ bool TcpCodec::encode(const uint8_t* const raw_in, const uint16_t /*raw_len*/, memcpy(&ps6.sip, ip6h->get_src()->u6_addr8, sizeof(ps6.sip)); memcpy(&ps6.dip, ip6h->get_dst()->u6_addr8, sizeof(ps6.dip)); ps6.zero = 0; - ps6.protocol = IPPROTO_ID_TCP; + ps6.protocol = IpProtocol::TCP; ps6.len = htons((uint16_t)len); tcph_out->th_sum = checksum::tcp_cksum((uint16_t*)tcph_out, len, &ps6); } @@ -694,7 +694,7 @@ void TcpCodec::update(const ip::IpApi& api, const EncodeFlags flags, uint8_t* ra ps.sip = ip4h->get_src(); ps.dip = ip4h->get_dst(); ps.zero = 0; - ps.protocol = IPPROTO_TCP; + ps.protocol = IpProtocol::TCP; ps.len = htons((uint16_t)updated_len); h->th_sum = checksum::tcp_cksum((uint16_t*)h, updated_len, &ps); } @@ -705,7 +705,7 @@ void TcpCodec::update(const ip::IpApi& api, const EncodeFlags flags, uint8_t* ra memcpy(ps6.sip, ip6h->get_src()->u6_addr32, sizeof(ps6.sip)); memcpy(ps6.dip, ip6h->get_dst()->u6_addr32, sizeof(ps6.dip)); ps6.zero = 0; - ps6.protocol = IPPROTO_TCP; + ps6.protocol = IpProtocol::TCP; ps6.len = htons((uint16_t)updated_len); h->th_sum = checksum::tcp_cksum((uint16_t*)h, updated_len, &ps6); } diff --git a/src/codecs/ip/cd_udp.cc b/src/codecs/ip/cd_udp.cc index 134c3da4a..bdabe170c 100644 --- a/src/codecs/ip/cd_udp.cc +++ b/src/codecs/ip/cd_udp.cc @@ -142,7 +142,7 @@ public: UdpCodec() : Codec(CD_UDP_NAME) { } ~UdpCodec() { } - void get_protocol_ids(std::vector& v) override; + void get_protocol_ids(std::vector& v) override; bool decode(const RawData&, CodecData&, DecodeData&) override; bool encode(const uint8_t* const raw_in, const uint16_t raw_len, @@ -158,9 +158,9 @@ private: }; } // anonymous namespace -void UdpCodec::get_protocol_ids(std::vector& v) +void UdpCodec::get_protocol_ids(std::vector& v) { - v.push_back(IPPROTO_ID_UDP); + v.push_back(ProtocolId::UDP); } bool UdpCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort) @@ -307,13 +307,13 @@ bool UdpCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort) (SnortConfig::is_gtp_port(src_port)||SnortConfig::is_gtp_port(dst_port))) { if ( !(snort.decode_flags & DECODE_FRAG) ) - codec.next_prot_id = PROTO_GTP; + codec.next_prot_id = ProtocolId::GTP; } else if (teredo::is_teredo_port(src_port) || teredo::is_teredo_port(dst_port) || SnortConfig::deep_teredo_inspection()) { - codec.next_prot_id = PROTO_TEREDO; + codec.next_prot_id = ProtocolId::TEREDO; } return true; @@ -379,7 +379,7 @@ bool UdpCodec::encode(const uint8_t* const raw_in, const uint16_t /*raw_len*/, ps.sip = ip4h->get_src(); ps.dip = ip4h->get_dst(); ps.zero = 0; - ps.protocol = IPPROTO_ID_UDP; + ps.protocol = IpProtocol::UDP; ps.len = udph_out->uh_len; udph_out->uh_chk = checksum::udp_cksum((uint16_t*)udph_out, len, &ps); } @@ -390,13 +390,13 @@ bool UdpCodec::encode(const uint8_t* const raw_in, const uint16_t /*raw_len*/, memcpy(ps6.sip, ip6h->get_src()->u6_addr8, sizeof(ps6.sip)); memcpy(ps6.dip, ip6h->get_dst()->u6_addr8, sizeof(ps6.dip)); ps6.zero = 0; - ps6.protocol = IPPROTO_ID_UDP; + ps6.protocol = IpProtocol::UDP; ps6.len = udph_out->uh_len; udph_out->uh_chk = checksum::udp_cksum((uint16_t*)udph_out, len, &ps6); } - enc.next_proto = IPPROTO_ID_UDP; - enc.next_ethertype = 0; + enc.next_proto = IpProtocol::UDP; + enc.next_ethertype = ProtocolId::ETHERTYPE_NOT_SET; return true; } @@ -419,7 +419,7 @@ void UdpCodec::update(const ip::IpApi& ip_api, const EncodeFlags flags, ps.sip = ip4h->get_src(); ps.dip = ip4h->get_dst(); ps.zero = 0; - ps.protocol = IPPROTO_ID_UDP; + ps.protocol = IpProtocol::UDP; ps.len = htons((uint16_t)updated_len); h->uh_chk = checksum::udp_cksum((uint16_t*)h, updated_len, &ps); } @@ -430,7 +430,7 @@ void UdpCodec::update(const ip::IpApi& ip_api, const EncodeFlags flags, memcpy(ps6.sip, ip6h->ip6_src.u6_addr32, sizeof(ps6.sip)); memcpy(ps6.dip, ip6h->ip6_dst.u6_addr32, sizeof(ps6.dip)); ps6.zero = 0; - ps6.protocol = IPPROTO_ID_UDP; + ps6.protocol = IpProtocol::UDP; ps6.len = htons((uint16_t)updated_len); h->uh_chk = checksum::udp_cksum((uint16_t*)h, updated_len, &ps6); } diff --git a/src/codecs/ip/checksum.h b/src/codecs/ip/checksum.h index 2b0071c0c..7edebcbb3 100644 --- a/src/codecs/ip/checksum.h +++ b/src/codecs/ip/checksum.h @@ -24,6 +24,8 @@ #include #include +#include + namespace checksum { struct Pseudoheader6 @@ -31,7 +33,7 @@ struct Pseudoheader6 uint32_t sip[4]; uint32_t dip[4]; uint8_t zero; - uint8_t protocol; + IpProtocol protocol; uint16_t len; }; @@ -40,7 +42,7 @@ struct Pseudoheader uint32_t sip; uint32_t dip; uint8_t zero; - uint8_t protocol; + IpProtocol protocol; uint16_t len; }; diff --git a/src/codecs/link/cd_arp.cc b/src/codecs/link/cd_arp.cc index c523fc4de..116cb2de9 100644 --- a/src/codecs/link/cd_arp.cc +++ b/src/codecs/link/cd_arp.cc @@ -51,16 +51,16 @@ public: ArpCodec() : Codec(CD_ARP_NAME) { } ~ArpCodec() { } - void get_protocol_ids(std::vector& v) override; + void get_protocol_ids(std::vector& v) override; bool decode(const RawData&, CodecData&, DecodeData&) override; void format(bool reverse, uint8_t* raw_pkt, DecodeData& snort) override; }; } // anonymous namespace -void ArpCodec::get_protocol_ids(std::vector& v) +void ArpCodec::get_protocol_ids(std::vector& v) { - v.push_back(ETHERTYPE_ARP); - v.push_back(ETHERTYPE_REVARP); + v.push_back(ProtocolId::ETHERTYPE_ARP); + v.push_back(ProtocolId::ETHERTYPE_REVARP); } bool ArpCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort) diff --git a/src/codecs/link/cd_erspan2.cc b/src/codecs/link/cd_erspan2.cc index 8defd620e..89fb78df4 100644 --- a/src/codecs/link/cd_erspan2.cc +++ b/src/codecs/link/cd_erspan2.cc @@ -49,7 +49,7 @@ public: Erspan2Codec() : Codec(CD_ERSPAN2_NAME) { } ~Erspan2Codec() { } - void get_protocol_ids(std::vector& v) override; + void get_protocol_ids(std::vector& v) override; bool decode(const RawData&, CodecData&, DecodeData&) override; }; @@ -63,11 +63,10 @@ struct ERSpanType2Hdr { return ntohs(ver_vlan) >> 12; } }; -constexpr uint16_t ETHERTYPE_ERSPAN_TYPE2 = 0x88be; } // namespace -void Erspan2Codec::get_protocol_ids(std::vector& v) -{ v.push_back(ETHERTYPE_ERSPAN_TYPE2); } +void Erspan2Codec::get_protocol_ids(std::vector& v) +{ v.push_back(ProtocolId::ETHERTYPE_ERSPAN_TYPE2); } bool Erspan2Codec::decode(const RawData& raw, CodecData& codec, DecodeData&) { @@ -89,7 +88,7 @@ bool Erspan2Codec::decode(const RawData& raw, CodecData& codec, DecodeData&) } codec.lyr_len = sizeof(ERSpanType2Hdr); - codec.next_prot_id = ETHERTYPE_TRANS_ETHER_BRIDGING; + codec.next_prot_id = ProtocolId::ETHERTYPE_TRANS_ETHER_BRIDGING; return true; } diff --git a/src/codecs/link/cd_erspan3.cc b/src/codecs/link/cd_erspan3.cc index 284eb9afa..ee40181b1 100644 --- a/src/codecs/link/cd_erspan3.cc +++ b/src/codecs/link/cd_erspan3.cc @@ -49,7 +49,7 @@ public: Erspan3Codec() : Codec(CD_ERSPAN3_NAME) { } ~Erspan3Codec() { } - void get_protocol_ids(std::vector& v) override; + void get_protocol_ids(std::vector& v) override; bool decode(const RawData&, CodecData&, DecodeData&) override; }; @@ -76,11 +76,10 @@ struct ERSpanType3Hdr { return ntohs(time_stamp); } }; -constexpr uint16_t ETHERTYPE_ERSPAN_TYPE3 = 0x22eb; } // anonymous namespace -void Erspan3Codec::get_protocol_ids(std::vector& v) -{ v.push_back(ETHERTYPE_ERSPAN_TYPE3); } +void Erspan3Codec::get_protocol_ids(std::vector& v) +{ v.push_back(ProtocolId::ETHERTYPE_ERSPAN_TYPE3); } bool Erspan3Codec::decode(const RawData& raw, CodecData& codec, DecodeData&) { @@ -100,7 +99,7 @@ bool Erspan3Codec::decode(const RawData& raw, CodecData& codec, DecodeData&) return false; } - codec.next_prot_id = ETHERTYPE_TRANS_ETHER_BRIDGING; + codec.next_prot_id = ProtocolId::ETHERTYPE_TRANS_ETHER_BRIDGING; codec.lyr_len = sizeof(ERSpanType3Hdr); return true; } diff --git a/src/codecs/link/cd_fabricpath.cc b/src/codecs/link/cd_fabricpath.cc index 843757a97..b8bce50ef 100644 --- a/src/codecs/link/cd_fabricpath.cc +++ b/src/codecs/link/cd_fabricpath.cc @@ -48,7 +48,7 @@ public: FabricPathCodec() : Codec(CD_FABRICPATH_NAME) { } ~FabricPathCodec() { } - void get_protocol_ids(std::vector& v) override; + void get_protocol_ids(std::vector& v) override; bool decode(const RawData&, CodecData&, DecodeData&) override; bool encode(const uint8_t* const raw_in, const uint16_t raw_len, EncState&, Buffer&) override; @@ -66,8 +66,8 @@ struct FPathHdr constexpr uint8_t FABRICPATH_HEADER_LEN = 16; } // anonymous namespace -void FabricPathCodec::get_protocol_ids(std::vector& v) -{ v.push_back(ETHERTYPE_FPATH); } +void FabricPathCodec::get_protocol_ids(std::vector& v) +{ v.push_back(ProtocolId::ETHERTYPE_FPATH); } bool FabricPathCodec::decode(const RawData& raw, CodecData& codec, DecodeData&) { @@ -77,7 +77,7 @@ bool FabricPathCodec::decode(const RawData& raw, CodecData& codec, DecodeData&) return false; } - codec.next_prot_id = PROTO_ETHERNET_802_3; + codec.next_prot_id = ProtocolId::ETHERNET_802_3; codec.lyr_len = FABRICPATH_HEADER_LEN; return true; } diff --git a/src/codecs/link/cd_mpls.cc b/src/codecs/link/cd_mpls.cc index 2c44b645f..abd4b8f9f 100644 --- a/src/codecs/link/cd_mpls.cc +++ b/src/codecs/link/cd_mpls.cc @@ -126,7 +126,7 @@ public: MplsCodec() : Codec(CD_MPLS_NAME) { } ~MplsCodec() { } - void get_protocol_ids(std::vector& v) override; + void get_protocol_ids(std::vector& v) override; bool decode(const RawData&, CodecData&, DecodeData&) override; void log(TextLog* const, const uint8_t* pkt, const uint16_t len) override; @@ -134,17 +134,15 @@ private: int checkMplsHdr(const CodecData&, uint32_t label, uint8_t bos); }; -constexpr uint16_t ETHERTYPE_MPLS_UNICAST = 0x8847; -constexpr uint16_t ETHERTYPE_MPLS_MULTICAST = 0x8848; constexpr int MPLS_HEADER_LEN = 4; constexpr int NUM_RESERVED_LABELS = 16; constexpr int MPLS_PAYLOADTYPE_ERROR = -1; } // namespace -void MplsCodec::get_protocol_ids(std::vector& v) +void MplsCodec::get_protocol_ids(std::vector& v) { - v.push_back(ETHERTYPE_MPLS_UNICAST); - v.push_back(ETHERTYPE_MPLS_MULTICAST); + v.push_back(ProtocolId::ETHERTYPE_MPLS_UNICAST); + v.push_back(ProtocolId::ETHERTYPE_MPLS_MULTICAST); } bool MplsCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort) @@ -217,15 +215,15 @@ bool MplsCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort) switch (iRet) { case MPLS_PAYLOADTYPE_IPV4: - codec.next_prot_id = ETHERTYPE_IPV4; + codec.next_prot_id = ProtocolId::ETHERTYPE_IPV4; break; case MPLS_PAYLOADTYPE_IPV6: - codec.next_prot_id = ETHERTYPE_IPV6; + codec.next_prot_id = ProtocolId::ETHERTYPE_IPV6; break; case MPLS_PAYLOADTYPE_ETHERNET: - codec.next_prot_id = ETHERTYPE_TRANS_ETHER_BRIDGING; + codec.next_prot_id = ProtocolId::ETHERTYPE_TRANS_ETHER_BRIDGING; break; default: diff --git a/src/codecs/link/cd_ppp_encap.cc b/src/codecs/link/cd_ppp_encap.cc index c6723a9e2..679884960 100644 --- a/src/codecs/link/cd_ppp_encap.cc +++ b/src/codecs/link/cd_ppp_encap.cc @@ -38,7 +38,7 @@ public: PppEncap() : Codec(CD_PPPENCAP_NAME) { } ~PppEncap() { } - void get_protocol_ids(std::vector& v) override; + void get_protocol_ids(std::vector& v) override; bool decode(const RawData&, CodecData&, DecodeData&) override; }; @@ -49,8 +49,8 @@ static const uint16_t PPP_VJ_UCOMP = 0x002f; /* VJ uncompressed TCP/IP */ static const uint16_t PPP_IPX = 0x002b; /* Novell IPX Protocol */ } // namespace -void PppEncap::get_protocol_ids(std::vector& v) -{ v.push_back(ETHERTYPE_PPP); } +void PppEncap::get_protocol_ids(std::vector& v) +{ v.push_back(ProtocolId::ETHERTYPE_PPP); } bool PppEncap::decode(const RawData& raw, CodecData& codec, DecodeData&) { @@ -102,19 +102,19 @@ bool PppEncap::decode(const RawData& raw, CodecData& codec, DecodeData&) return false; } - ((IP4Hdr*)(raw.data + codec.lyr_len))->set_proto(IPPROTO_TCP); + ((IP4Hdr*)(raw.data + codec.lyr_len))->set_proto(IpProtocol::TCP); /* fall through */ case PPP_IP: - codec.next_prot_id = ETHERTYPE_IPV4; + codec.next_prot_id = ProtocolId::ETHERTYPE_IPV4; break; case PPP_IPV6: - codec.next_prot_id = ETHERTYPE_IPV6; + codec.next_prot_id = ProtocolId::ETHERTYPE_IPV6; break; case PPP_IPX: - codec.next_prot_id = ETHERTYPE_IPX; + codec.next_prot_id = ProtocolId::ETHERTYPE_IPX; break; default: diff --git a/src/codecs/link/cd_pppoe.cc b/src/codecs/link/cd_pppoe.cc index 13b4f467d..422819ba1 100644 --- a/src/codecs/link/cd_pppoe.cc +++ b/src/codecs/link/cd_pppoe.cc @@ -256,7 +256,7 @@ bool PPPoECodec::decode(const RawData& raw, } codec.lyr_len = PPPOE_HEADER_LEN; - codec.next_prot_id = ETHERTYPE_PPP; + codec.next_prot_id = ProtocolId::ETHERTYPE_PPP; return true; } @@ -285,9 +285,6 @@ bool PPPoECodec::encode(const uint8_t* const raw_in, const uint16_t raw_len, namespace { -const uint16_t ETHERNET_TYPE_PPPoE_DISC = 0x8863; /* discovery stage */ -const uint16_t ETHERNET_TYPE_PPPoE_SESS = 0x8864; /* session stage */ - #define CD_PPPOEPKT_DISC_NAME "pppoe_disc" #define CD_PPPOEPKT_DISC_HELP "support for point-to-point discovery" @@ -301,8 +298,8 @@ public: PPPoEDiscCodec() : PPPoECodec(CD_PPPOEPKT_DISC_NAME, PppoepktType::DISCOVERY) { } ~PPPoEDiscCodec() { } - void get_protocol_ids(std::vector& v) override - { v.push_back(ETHERNET_TYPE_PPPoE_DISC); } + void get_protocol_ids(std::vector& v) override + { v.push_back(ProtocolId::ETHERTYPE_PPPOE_DISC); } }; class PPPoESessCodec : public PPPoECodec @@ -311,8 +308,8 @@ public: PPPoESessCodec() : PPPoECodec(CD_PPPOEPKT_SESS_NAME, PppoepktType::SESSION) { } ~PPPoESessCodec() { } - void get_protocol_ids(std::vector& v) override - { v.push_back(ETHERNET_TYPE_PPPoE_SESS); } + void get_protocol_ids(std::vector& v) override + { v.push_back(ProtocolId::ETHERTYPE_PPPOE_SESS); } }; } // namespace diff --git a/src/codecs/link/cd_trans_bridge.cc b/src/codecs/link/cd_trans_bridge.cc index 41fcc74ed..1e3dad45c 100644 --- a/src/codecs/link/cd_trans_bridge.cc +++ b/src/codecs/link/cd_trans_bridge.cc @@ -39,13 +39,13 @@ public: TransbridgeCodec() : Codec(CD_TRANSBRIDGE_NAME) { } ~TransbridgeCodec() { } - void get_protocol_ids(std::vector& v) override; + void get_protocol_ids(std::vector& v) override; bool decode(const RawData&, CodecData&, DecodeData&) override; }; } // anonymous namespace -void TransbridgeCodec::get_protocol_ids(std::vector& v) -{ v.push_back(ETHERTYPE_TRANS_ETHER_BRIDGING); } +void TransbridgeCodec::get_protocol_ids(std::vector& v) +{ v.push_back(ProtocolId::ETHERTYPE_TRANS_ETHER_BRIDGING); } bool TransbridgeCodec::decode(const RawData& raw, CodecData& codec, DecodeData&) { @@ -63,7 +63,7 @@ bool TransbridgeCodec::decode(const RawData& raw, CodecData& codec, DecodeData&) codec.proto_bits |= PROTO_BIT__ETH; codec.lyr_len = eth::ETH_HEADER_LEN; - codec.next_prot_id = ntohs(eh->ether_type); + codec.next_prot_id = eh->ethertype(); return true; } diff --git a/src/codecs/link/cd_vlan.cc b/src/codecs/link/cd_vlan.cc index badaed738..94b007d75 100644 --- a/src/codecs/link/cd_vlan.cc +++ b/src/codecs/link/cd_vlan.cc @@ -58,7 +58,7 @@ public: VlanCodec() : Codec(CD_VLAN_NAME) { } ~VlanCodec() { } - void get_protocol_ids(std::vector& v) override; + void get_protocol_ids(std::vector& v) override; bool decode(const RawData&, CodecData&, DecodeData&) override; void log(TextLog* const, const uint8_t* pkt, const uint16_t len) override; }; @@ -66,9 +66,9 @@ public: constexpr unsigned int ETHERNET_MAX_LEN_ENCAP = 1518; /* 802.3 (+LLC) or ether II ? */ } // namespace -void VlanCodec::get_protocol_ids(std::vector& v) +void VlanCodec::get_protocol_ids(std::vector& v) { - v.push_back(ETHERTYPE_8021Q); + v.push_back(ProtocolId::ETHERTYPE_8021Q); } bool VlanCodec::decode(const RawData& raw, CodecData& codec, DecodeData&) @@ -88,9 +88,9 @@ bool VlanCodec::decode(const RawData& raw, CodecData& codec, DecodeData&) * http://www.geocities.com/billalexander/ethernet.html */ if (proto <= ETHERNET_MAX_LEN_ENCAP) - codec.next_prot_id = PROTO_ETHERNET_LLC; + codec.next_prot_id = ProtocolId::ETHERNET_LLC; else - codec.next_prot_id = proto; + codec.next_prot_id = (ProtocolId)proto; // Vlan IDs 0 and 4095 are reserved. const uint16_t vid = vh->vid(); diff --git a/src/codecs/misc/cd_default.cc b/src/codecs/misc/cd_default.cc index ca88fba49..cafe68c4d 100644 --- a/src/codecs/misc/cd_default.cc +++ b/src/codecs/misc/cd_default.cc @@ -31,8 +31,8 @@ public: DefaultCodec() : Codec(CD_DEFAULT_NAME) { } ~DefaultCodec() { } - void get_protocol_ids(std::vector& v) override - { v.push_back(FINISHED_DECODE); } + void get_protocol_ids(std::vector& v) override + { v.push_back(ProtocolId::FINISHED_DECODE); } bool decode(const RawData&, CodecData&, DecodeData&) override { return false; } diff --git a/src/codecs/misc/cd_gtp.cc b/src/codecs/misc/cd_gtp.cc index 88908c471..f4e1ad2ba 100644 --- a/src/codecs/misc/cd_gtp.cc +++ b/src/codecs/misc/cd_gtp.cc @@ -60,7 +60,7 @@ public: GtpCodec() : Codec(CD_GTP_NAME) { } ~GtpCodec() { } - void get_protocol_ids(std::vector& v) override; + void get_protocol_ids(std::vector& v) override; bool decode(const RawData&, CodecData&, DecodeData&) override; bool encode(const uint8_t* const raw_in, const uint16_t raw_len, EncState&, Buffer&) override; @@ -80,9 +80,9 @@ static const uint32_t GTP_MIN_LEN = 8; static const uint32_t GTP_V0_HEADER_LEN = 20; static const uint32_t GTP_V1_HEADER_LEN = 12; -void GtpCodec::get_protocol_ids(std::vector& v) +void GtpCodec::get_protocol_ids(std::vector& v) { - v.push_back(PROTO_GTP); + v.push_back(ProtocolId::GTP); } bool GtpCodec::decode(const RawData& raw, CodecData& codec, DecodeData& dd) @@ -204,9 +204,9 @@ bool GtpCodec::decode(const RawData& raw, CodecData& codec, DecodeData& dd) ip_ver = *(raw.data + len) & 0xF0; if (ip_ver == 0x40) - codec.next_prot_id = IPPROTO_ID_IPIP; + codec.next_prot_id = ProtocolId::IPIP; else if (ip_ver == 0x60) - codec.next_prot_id = IPPROTO_ID_IPV6; + codec.next_prot_id = ProtocolId::IPV6; } return true; diff --git a/src/codecs/misc/cd_icmp4_ip.cc b/src/codecs/misc/cd_icmp4_ip.cc index 6b12d3a7b..722eb6d71 100644 --- a/src/codecs/misc/cd_icmp4_ip.cc +++ b/src/codecs/misc/cd_icmp4_ip.cc @@ -44,14 +44,14 @@ public: Icmp4IpCodec() : Codec(ICMP4_IP_NAME) { } ~Icmp4IpCodec() { } - void get_protocol_ids(std::vector&) override; + void get_protocol_ids(std::vector&) override; bool decode(const RawData&, CodecData&, DecodeData&) override; void log(TextLog* const, const uint8_t* pkt, const uint16_t len) override; }; } // namespace -void Icmp4IpCodec::get_protocol_ids(std::vector& v) -{ v.push_back(PROTO_IP_EMBEDDED_IN_ICMP4); } +void Icmp4IpCodec::get_protocol_ids(std::vector& v) +{ v.push_back(ProtocolId::IP_EMBEDDED_IN_ICMP4); } bool Icmp4IpCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort) { @@ -110,15 +110,15 @@ bool Icmp4IpCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snor switch (ip4h->proto()) { - case IPPROTO_TCP: /* decode the interesting part of the header */ + case IpProtocol::TCP: /* decode the interesting part of the header */ codec.proto_bits |= PROTO_BIT__TCP_EMBED_ICMP; break; - case IPPROTO_UDP: + case IpProtocol::UDP: codec.proto_bits |= PROTO_BIT__UDP_EMBED_ICMP; break; - case IPPROTO_ICMP: + case IpProtocol::ICMPV4: codec.proto_bits |= PROTO_BIT__ICMP_EMBED_ICMP; break; default: @@ -220,7 +220,7 @@ void Icmp4IpCodec::log(TextLog* const text_log, const uint8_t* raw_pkt, /* EMBEDDED PROTOCOL */ switch (ip4h->proto()) { - case IPPROTO_TCP: /* decode the interesting part of the header */ + case IpProtocol::TCP: /* decode the interesting part of the header */ { const tcp::TCPHdr* tcph = reinterpret_cast (raw_pkt + hlen); @@ -234,7 +234,7 @@ void Icmp4IpCodec::log(TextLog* const text_log, const uint8_t* raw_pkt, break; } - case IPPROTO_UDP: + case IpProtocol::UDP: { const udp::UDPHdr* udph = reinterpret_cast (raw_pkt + hlen); @@ -245,7 +245,7 @@ void Icmp4IpCodec::log(TextLog* const text_log, const uint8_t* raw_pkt, break; } - case IPPROTO_ICMP: + case IpProtocol::ICMPV4: { const icmp::ICMPHdr* icmph = reinterpret_cast (raw_pkt + hlen); diff --git a/src/codecs/misc/cd_icmp6_ip.cc b/src/codecs/misc/cd_icmp6_ip.cc index f242fa0fd..2708a7e68 100644 --- a/src/codecs/misc/cd_icmp6_ip.cc +++ b/src/codecs/misc/cd_icmp6_ip.cc @@ -45,13 +45,13 @@ public: Icmp6IpCodec() : Codec(ICMP6_IP_NAME) { } ~Icmp6IpCodec() { } - void get_protocol_ids(std::vector&) override; + void get_protocol_ids(std::vector&) override; bool decode(const RawData&, CodecData&, DecodeData&) override; }; } // namespace -void Icmp6IpCodec::get_protocol_ids(std::vector& v) -{ v.push_back(PROTO_IP_EMBEDDED_IN_ICMP6); } +void Icmp6IpCodec::get_protocol_ids(std::vector& v) +{ v.push_back(ProtocolId::IP_EMBEDDED_IN_ICMP6); } bool Icmp6IpCodec::decode(const RawData& raw, CodecData& codec, DecodeData&) { @@ -97,15 +97,16 @@ bool Icmp6IpCodec::decode(const RawData& raw, CodecData& codec, DecodeData&) // FIXIT-L Will fail to decode Ipv6 options switch (ip6h->next()) { - case IPPROTO_TCP: /* decode the interesting part of the header */ + case IpProtocol::TCP: /* decode the interesting part of the header */ codec.proto_bits |= PROTO_BIT__TCP_EMBED_ICMP; break; - case IPPROTO_UDP: + case IpProtocol::UDP: codec.proto_bits |= PROTO_BIT__UDP_EMBED_ICMP; break; - case IPPROTO_ICMP: + // FIXIT-M: Do we need to handle ICMPV6 here? + case IpProtocol::ICMPV4: codec.proto_bits |= PROTO_BIT__ICMP_EMBED_ICMP; break; default: diff --git a/src/codecs/misc/cd_llc.cc b/src/codecs/misc/cd_llc.cc index 2a0c3b85d..97352d8f4 100644 --- a/src/codecs/misc/cd_llc.cc +++ b/src/codecs/misc/cd_llc.cc @@ -42,7 +42,7 @@ public: bool decode(const RawData&, CodecData&, DecodeData&) override; void log(TextLog* const, const uint8_t* pkt, const uint16_t len) override; - void get_protocol_ids(std::vector&) override; + void get_protocol_ids(std::vector&) override; }; struct EthLlc @@ -57,15 +57,15 @@ struct EthLlcOther uint8_t org_code[3]; uint8_t proto_id[2]; - uint16_t proto() const + ProtocolId proto() const { #ifdef __GNUC__ // fixing the type_punned pointer problem const uint8_t* tmp1 = &proto_id[0]; const uint16_t* const tmp2 = reinterpret_cast(tmp1); - return ntohs(*tmp2); + return (ProtocolId)ntohs(*tmp2); #else - return ntohs(*((uint16_t*)(&proto_id[0]))); + return (ProtocolId)ntohs(*((uint16_t*)(&proto_id[0]))); #endif } }; @@ -81,8 +81,8 @@ struct EthLlcOther #define ETH_ORG_CODE_CDP 0x00000c /* Cisco Discovery Proto */ } // namespace -void LlcCodec::get_protocol_ids(std::vector& v) -{ v.push_back(PROTO_ETHERNET_LLC); } +void LlcCodec::get_protocol_ids(std::vector& v) +{ v.push_back(ProtocolId::ETHERNET_LLC); } bool LlcCodec::decode(const RawData& raw, CodecData& codec, DecodeData&) { @@ -132,7 +132,7 @@ void LlcCodec::log(TextLog* const text_log, const uint8_t* raw_pkt, ehllc->ssap == ETH_SSAP_IP) { const EthLlcOther* other = reinterpret_cast(raw_pkt + sizeof(EthLlc)); - const uint16_t proto = other->proto(); + const ProtocolId proto = other->proto(); TextLog_Print(text_log, " ORG:0x%02X%02X%02X PROTO:0x%04X", other->org_code[0], other->org_code[1], other->org_code[2], diff --git a/src/codecs/misc/cd_teredo.cc b/src/codecs/misc/cd_teredo.cc index 763854203..78ed8787e 100644 --- a/src/codecs/misc/cd_teredo.cc +++ b/src/codecs/misc/cd_teredo.cc @@ -40,14 +40,14 @@ public: TeredoCodec() : Codec(CD_TEREDO_NAME) { } ~TeredoCodec() { } - void get_protocol_ids(std::vector& v) override; + void get_protocol_ids(std::vector& v) override; bool decode(const RawData&, CodecData&, DecodeData&) override; }; } // anonymous namespace -void TeredoCodec::get_protocol_ids(std::vector& v) +void TeredoCodec::get_protocol_ids(std::vector& v) { - v.push_back(PROTO_TEREDO); + v.push_back(ProtocolId::TEREDO); } bool TeredoCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort) @@ -95,7 +95,7 @@ bool TeredoCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort if ( (!teredo::is_teredo_port(snort.sp)) && (!teredo::is_teredo_port(snort.dp)) ) codec.codec_flags |= CODEC_ENCAP_LAYER; - codec.next_prot_id = IPPROTO_IPV6; + codec.next_prot_id = ProtocolId::IPV6; codec.codec_flags |= CODEC_NON_IP_TUNNEL; return true; } diff --git a/src/codecs/root/cd_eth.cc b/src/codecs/root/cd_eth.cc index d14f1418d..2ead2a16a 100644 --- a/src/codecs/root/cd_eth.cc +++ b/src/codecs/root/cd_eth.cc @@ -57,7 +57,7 @@ public: EthCodec() : Codec(CD_ETH_NAME) { } ~EthCodec() { } - void get_protocol_ids(std::vector&) override; + void get_protocol_ids(std::vector&) override; void get_data_link_type(std::vector&) override; void log(TextLog* const, const uint8_t* pkt, const uint16_t len) override; bool decode(const RawData&, CodecData&, DecodeData&) override; @@ -80,9 +80,9 @@ void EthCodec::get_data_link_type(std::vector& v) v.push_back(DLT_EN10MB); } -void EthCodec::get_protocol_ids(std::vector& v) +void EthCodec::get_protocol_ids(std::vector& v) { - v.push_back(PROTO_ETHERNET_802_3); + v.push_back(ProtocolId::ETHERNET_802_3); } bool EthCodec::decode(const RawData& raw, CodecData& codec, DecodeData&) @@ -96,14 +96,14 @@ bool EthCodec::decode(const RawData& raw, CodecData& codec, DecodeData&) /* lay the ethernet structure over the packet data */ const eth::EtherHdr* eh = reinterpret_cast(raw.data); - uint16_t next_prot = eh->ethertype(); - if ( next_prot <= eth::MIN_ETHERTYPE ) + ProtocolId next_prot = eh->ethertype(); + if ( to_utype(next_prot) <= to_utype(ProtocolId::ETHERTYPE_MINIMUM) ) { - codec.next_prot_id = PROTO_ETHERNET_LLC; + codec.next_prot_id = ProtocolId::ETHERNET_LLC; codec.lyr_len = eth::ETH_HEADER_LEN; codec.proto_bits |= PROTO_BIT__ETH; } - else if ( next_prot == ETHERTYPE_FPATH ) + else if ( next_prot == ProtocolId::ETHERTYPE_FPATH ) { /* If this is FabricPath, the first 16 bytes are FabricPath data * rather than Ethernet data. So, set the length to zero and @@ -138,12 +138,12 @@ void EthCodec::log(TextLog* const text_log, const uint8_t* raw_pkt, eh->ether_dst[1], eh->ether_dst[2], eh->ether_dst[3], eh->ether_dst[4], eh->ether_dst[5]); - const uint16_t prot = ntohs(eh->ether_type); + const ProtocolId prot_id = eh->ethertype(); - if (prot <= eth::MIN_ETHERTYPE) - TextLog_Print(text_log, " len:0x%04X", prot); + if (to_utype(prot_id) <= to_utype(ProtocolId::ETHERTYPE_MINIMUM)) + TextLog_Print(text_log, " len:0x%04X", prot_id); else - TextLog_Print(text_log, " type:0x%04X", prot); + TextLog_Print(text_log, " type:0x%04X", prot_id); } //------------------------------------------------------------------------- @@ -155,7 +155,7 @@ bool EthCodec::encode(const uint8_t* const raw_in, const uint16_t /*raw_len*/, { const eth::EtherHdr* hi = reinterpret_cast(raw_in); - if (hi->ethertype() == ETHERTYPE_FPATH) + if (hi->ethertype() == ProtocolId::ETHERTYPE_FPATH) return true; // not raw ip -> encode layer 2 @@ -178,7 +178,7 @@ bool EthCodec::encode(const uint8_t* const raw_in, const uint16_t /*raw_len*/, return false; eth::EtherHdr* ho = reinterpret_cast(buf.data()); - ho->ether_type = enc.ethertype_set() ? ntohs(enc.next_ethertype) : hi->ether_type; + ho->ether_type = enc.ethertype_set() ? ntohs(to_utype(enc.next_ethertype)) : hi->ether_type; uint8_t* dst_mac = PacketManager::encode_get_dst_mac(); @@ -202,8 +202,8 @@ bool EthCodec::encode(const uint8_t* const raw_in, const uint16_t /*raw_len*/, } } - enc.next_ethertype = 0; - enc.next_proto = ENC_PROTO_UNSET; + enc.next_ethertype = ProtocolId::ETHERTYPE_NOT_SET; + enc.next_proto = IpProtocol::PROTO_NOT_SET; return true; } @@ -212,7 +212,7 @@ void EthCodec::format(bool reverse, uint8_t* raw_pkt, DecodeData&) eth::EtherHdr* ch = reinterpret_cast(raw_pkt); // If the ethertype is FabricPath, then this is not Ethernet Data. - if ( reverse && (ch->ethertype() != ETHERTYPE_FPATH) ) + if ( reverse && (ch->ethertype() != ProtocolId::ETHERTYPE_FPATH) ) { uint8_t tmp_addr[6]; @@ -227,7 +227,7 @@ void EthCodec::update(const ip::IpApi&, const EncodeFlags, uint8_t* raw_pkt, { const eth::EtherHdr* const eth = reinterpret_cast(raw_pkt); - if ( eth->ethertype() != ETHERTYPE_FPATH ) + if ( eth->ethertype() != ProtocolId::ETHERTYPE_FPATH ) updated_len += lyr_len; } diff --git a/src/flow/flow.cc b/src/flow/flow.cc index 45f77c0ea..04d8be82d 100644 --- a/src/flow/flow.cc +++ b/src/flow/flow.cc @@ -56,9 +56,9 @@ Flow::Flow() Flow::~Flow() { } -void Flow::init(PktType proto) +void Flow::init(PktType type) { - protocol = proto; + pkt_type = type; // FIXIT-M getFlowbitSizeInBytes() should be attribute of ??? (or eliminate) bitop = new BitOp(getFlowbitSizeInBytes()); diff --git a/src/flow/flow.h b/src/flow/flow.h index f85b6b4eb..83907d74b 100644 --- a/src/flow/flow.h +++ b/src/flow/flow.h @@ -208,7 +208,7 @@ public: { return (ssn_state.session_flags & SSNFLAG_PROXIED) != 0; } bool is_stream() - { return (unsigned)protocol & (unsigned)PktType::STREAM; } + { return to_utype(pkt_type) & to_utype(PktType::STREAM); } void block() { ssn_state.session_flags |= SSNFLAG_BLOCK; } @@ -286,7 +286,7 @@ public: // FIXIT-M privatize if possible class Session* session; class BitOp* bitop; uint8_t ip_proto; // FIXIT-M -- do we need both of these? - PktType protocol; // ^^ + PktType pkt_type; // ^^ // these fields are always set; not zeroed Flow* prev, * next; diff --git a/src/flow/flow_control.cc b/src/flow/flow_control.cc index 9aa1a507d..9e26bbd5c 100644 --- a/src/flow/flow_control.cc +++ b/src/flow/flow_control.cc @@ -90,9 +90,9 @@ static THREAD_LOCAL PegCount udp_count = 0; static THREAD_LOCAL PegCount user_count = 0; static THREAD_LOCAL PegCount file_count = 0; -uint32_t FlowControl::max_flows(PktType proto) +uint32_t FlowControl::max_flows(PktType type) { - FlowCache* cache = get_cache(proto); + FlowCache* cache = get_cache(type); if ( cache ) return cache->get_max_flows(); @@ -100,9 +100,9 @@ uint32_t FlowControl::max_flows(PktType proto) return 0; } -PegCount FlowControl::get_flows(PktType proto) +PegCount FlowControl::get_flows(PktType type) { - switch ( proto ) + switch ( type ) { case PktType::IP: return ip_count; case PktType::ICMP: return icmp_count; @@ -114,15 +114,15 @@ PegCount FlowControl::get_flows(PktType proto) } } -PegCount FlowControl::get_total_prunes(PktType proto) const +PegCount FlowControl::get_total_prunes(PktType type) const { - auto cache = get_cache(proto); + auto cache = get_cache(type); return cache ? cache->get_total_prunes() : 0; } -PegCount FlowControl::get_prunes(PktType proto, PruneReason reason) const +PegCount FlowControl::get_prunes(PktType type, PruneReason reason) const { - auto cache = get_cache(proto); + auto cache = get_cache(type); return cache ? cache->get_prunes(reason) : 0; } @@ -153,10 +153,10 @@ void FlowControl::clear_counts() cache->reset_stats(); } -Memcap& FlowControl::get_memcap (PktType proto) +Memcap& FlowControl::get_memcap (PktType type) { static Memcap dummy; - FlowCache* cache = get_cache(proto); + FlowCache* cache = get_cache(type); assert(cache); // FIXIT-L dummy is a hack return cache ? cache->get_memcap() : dummy; } @@ -165,9 +165,9 @@ Memcap& FlowControl::get_memcap (PktType proto) // cache foo //------------------------------------------------------------------------- -inline FlowCache* FlowControl::get_cache (PktType proto) +inline FlowCache* FlowControl::get_cache (PktType type) { - switch ( proto ) + switch ( type ) { case PktType::IP: return ip_cache; case PktType::ICMP: return icmp_cache; @@ -180,9 +180,9 @@ inline FlowCache* FlowControl::get_cache (PktType proto) } // FIXIT-L J duplication of non-const method above -inline const FlowCache* FlowControl::get_cache (PktType proto) const +inline const FlowCache* FlowControl::get_cache (PktType type) const { - switch ( proto ) + switch ( type ) { case PktType::IP: return ip_cache; case PktType::ICMP: return icmp_cache; @@ -196,7 +196,7 @@ inline const FlowCache* FlowControl::get_cache (PktType proto) const Flow* FlowControl::find_flow(const FlowKey* key) { - FlowCache* cache = get_cache((PktType)key->protocol); + FlowCache* cache = get_cache(key->pkt_type); if ( cache ) return cache->find(key); @@ -206,7 +206,7 @@ Flow* FlowControl::find_flow(const FlowKey* key) Flow* FlowControl::new_flow(const FlowKey* key) { - FlowCache* cache = get_cache((PktType)key->protocol); + FlowCache* cache = get_cache(key->pkt_type); if ( !cache ) return NULL; @@ -215,10 +215,10 @@ Flow* FlowControl::new_flow(const FlowKey* key) } // FIXIT-L cache* can be put in flow so that lookups by -// protocol are obviated for existing / initialized flows +// packet type are obviated for existing / initialized flows void FlowControl::delete_flow(const FlowKey* key) { - FlowCache* cache = get_cache((PktType)key->protocol); + FlowCache* cache = get_cache(key->pkt_type); if ( !cache ) return; @@ -232,26 +232,26 @@ void FlowControl::delete_flow(const FlowKey* key) void FlowControl::delete_flow(Flow* flow, PruneReason reason) { - FlowCache* cache = get_cache(flow->protocol); + FlowCache* cache = get_cache(flow->pkt_type); if ( cache ) cache->release(flow, reason); } -void FlowControl::purge_flows (PktType proto) +void FlowControl::purge_flows (PktType type) { - FlowCache* cache = get_cache(proto); + FlowCache* cache = get_cache(type); if ( cache ) cache->purge(); } -void FlowControl::prune_flows(PktType proto, const Packet* p) +void FlowControl::prune_flows(PktType type, const Packet* p) { if ( !p ) return; - FlowCache* cache = get_cache(proto); + FlowCache* cache = get_cache(type); if ( !cache ) return; @@ -319,8 +319,8 @@ void FlowControl::set_key(FlowKey* key, Packet* p) uint32_t mplsId; uint16_t vlanId; uint16_t addressSpaceId; - uint8_t type = (uint8_t)p->type(); - uint8_t proto = (uint8_t)p->get_ip_proto_next(); + PktType type = p->type(); + IpProtocol ip_proto = p->get_ip_proto_next(); if ( p->proto_bits & PROTO_BIT__VLAN ) vlanId = layer::get_vlan_layer(p)->vid(); @@ -336,17 +336,17 @@ void FlowControl::set_key(FlowKey* key, Packet* p) if ( (p->ptrs.decode_flags & DECODE_FRAG) ) { - key->init(type, proto, ip_api.get_src(), ip_api.get_dst(), ip_api.id(), + key->init(type, ip_proto, ip_api.get_src(), ip_api.get_dst(), ip_api.id(), vlanId, mplsId, addressSpaceId); } - else if ( type == (uint8_t)PktType::ICMP ) + else if ( type == PktType::ICMP ) { - key->init(type, proto, ip_api.get_src(), p->ptrs.icmph->type, ip_api.get_dst(), 0, + key->init(type, ip_proto, ip_api.get_src(), p->ptrs.icmph->type, ip_api.get_dst(), 0, vlanId, mplsId, addressSpaceId); } else { - key->init(type, proto, ip_api.get_src(), p->ptrs.sp, ip_api.get_dst(), p->ptrs.dp, + key->init(type, ip_proto, ip_api.get_src(), p->ptrs.sp, ip_api.get_dst(), p->ptrs.dp, vlanId, mplsId, addressSpaceId); } } @@ -432,7 +432,7 @@ static void init_roles_user(Packet* p, Flow* flow) static void init_roles(Packet* p, Flow* flow) { - switch ( flow->protocol ) + switch ( flow->pkt_type ) { case PktType::IP: case PktType::ICMP: @@ -847,20 +847,20 @@ char FlowControl::expected_flow(Flow* flow, Packet* p) int FlowControl::add_expected( const sfip_t *srcIP, uint16_t srcPort, const sfip_t *dstIP, uint16_t dstPort, - PktType protocol, char direction, + PktType type, char direction, FlowData* fd) { return exp_cache->add_flow( - srcIP, srcPort, dstIP, dstPort, protocol, direction, fd); + srcIP, srcPort, dstIP, dstPort, type, direction, fd); } int FlowControl::add_expected( const sfip_t *srcIP, uint16_t srcPort, const sfip_t *dstIP, uint16_t dstPort, - PktType protocol, int16_t appId, FlowData* fd) + PktType type, int16_t appId, FlowData* fd) { return exp_cache->add_flow( - srcIP, srcPort, dstIP, dstPort, protocol, SSN_DIR_BOTH, fd, appId); + srcIP, srcPort, dstIP, dstPort, type, SSN_DIR_BOTH, fd, appId); } bool FlowControl::is_expected(Packet* p) diff --git a/src/flow/flow_key.cc b/src/flow/flow_key.cc index 45d3dece4..33b9899c2 100644 --- a/src/flow/flow_key.cc +++ b/src/flow/flow_key.cc @@ -36,7 +36,7 @@ //------------------------------------------------------------------------- inline void FlowKey::init4( - uint8_t proto, + IpProtocol ip_proto, const sfip_t *srcIP, uint16_t srcPort, const sfip_t *dstIP, uint16_t dstPort, uint32_t mplsId, bool order) @@ -44,7 +44,7 @@ inline void FlowKey::init4( const uint32_t* src; const uint32_t* dst; - if ( proto == IPPROTO_ICMP ) + if ( ip_proto == IpProtocol::ICMPV4 ) { if (srcPort == ICMP_ECHOREPLY) { @@ -98,7 +98,7 @@ inline void FlowKey::init4( } inline void FlowKey::init6( - uint8_t proto, + IpProtocol ip_proto, const sfip_t *srcIP, uint16_t srcPort, const sfip_t *dstIP, uint16_t dstPort, uint32_t mplsId, bool order) @@ -106,7 +106,7 @@ inline void FlowKey::init6( const sfip_t* src; const sfip_t* dst; - if ( proto == IPPROTO_ICMP ) + if ( ip_proto == IpProtocol::ICMPV4 ) { if (srcPort == ICMP_ECHOREPLY) { @@ -120,7 +120,7 @@ inline void FlowKey::init6( dstPort = 0; } } - else if ( proto == IPPROTO_ICMPV6 ) + else if ( ip_proto == IpProtocol::ICMPV6 ) { if (srcPort == icmp::Icmp6Types::ECHO_REPLY) { @@ -200,7 +200,7 @@ void FlowKey::init_mpls(uint32_t mplsId) } void FlowKey::init( - uint8_t type, uint8_t proto, + PktType type, IpProtocol ip_proto, const sfip_t *srcIP, uint16_t srcPort, const sfip_t *dstIP, uint16_t dstPort, uint16_t vlanId, uint32_t mplsId, uint16_t addrSpaceId) @@ -213,22 +213,22 @@ void FlowKey::init( if (srcIP->is_ip4()) { version = 4; - init4(proto, srcIP, srcPort, dstIP, dstPort, mplsId); + init4(ip_proto, srcIP, srcPort, dstIP, dstPort, mplsId); } else { version = 6; - init6(proto, srcIP, srcPort, dstIP, dstPort, mplsId); + init6(ip_proto, srcIP, srcPort, dstIP, dstPort, mplsId); } - protocol = type; + pkt_type = type; init_vlan(vlanId); init_address_space(addrSpaceId); } void FlowKey::init( - uint8_t type, uint8_t proto, + PktType type, IpProtocol ip_proto, const sfip_t *srcIP, const sfip_t *dstIP, uint32_t id, uint16_t vlanId, uint32_t mplsId, uint16_t addrSpaceId) @@ -241,14 +241,14 @@ void FlowKey::init( if (srcIP->is_ip4()) { version = 4; - init4(proto, srcIP, srcPort, dstIP, dstPort, mplsId, false); + init4(ip_proto, srcIP, srcPort, dstIP, dstPort, mplsId, false); } else { version = 6; - init6(proto, srcIP, srcPort, dstIP, dstPort, mplsId, false); + init6(ip_proto, srcIP, srcPort, dstIP, dstPort, mplsId, false); } - protocol = type; + pkt_type = type; init_vlan(vlanId); init_address_space(addrSpaceId); diff --git a/src/flow/flow_key.h b/src/flow/flow_key.h index 1ccc539a0..de1ddde86 100644 --- a/src/flow/flow_key.h +++ b/src/flow/flow_key.h @@ -25,6 +25,7 @@ #include "main/snort_types.h" #include "hash/sfhashfcn.h" +#include "framework/decode_data.h" #include "sfip/sfip_t.h" struct FlowKey @@ -34,20 +35,20 @@ struct FlowKey uint16_t port_l; /* Low Port - 0 if ICMP */ uint16_t port_h; /* High Port - 0 if ICMP */ uint16_t vlan_tag; - uint8_t protocol; + PktType pkt_type; uint8_t version; uint32_t mplsLabel; uint16_t addressSpaceId; uint16_t addressSpaceIdPad1; void init( - uint8_t type, uint8_t proto, + PktType, IpProtocol, const sfip_t *srcIP, uint16_t srcPort, const sfip_t *dstIP, uint16_t dstPort, uint16_t vlanId, uint32_t mplsId, uint16_t addrSpaceId); void init( - uint8_t type, uint8_t proto, + PktType, IpProtocol, const sfip_t *srcIP, const sfip_t *dstIP, uint32_t id, uint16_t vlanId, uint32_t mplsId, uint16_t addrSpaceId); @@ -62,13 +63,13 @@ struct FlowKey private: void init4( - uint8_t proto, + IpProtocol, const sfip_t *srcIP, uint16_t srcPort, const sfip_t *dstIP, uint16_t dstPort, uint32_t mplsId, bool order = true); void init6( - uint8_t proto, + IpProtocol, const sfip_t *srcIP, uint16_t srcPort, const sfip_t *dstIP, uint16_t dstPort, uint32_t mplsId, bool order = true); diff --git a/src/framework/codec.cc b/src/framework/codec.cc index cc5f9f29b..5931c4646 100644 --- a/src/framework/codec.cc +++ b/src/framework/codec.cc @@ -22,12 +22,12 @@ #include "codecs/codec_module.h" #include "protocols/ipv6.h" -EncState::EncState(const ip::IpApi& api, EncodeFlags f, uint8_t pr, +EncState::EncState(const ip::IpApi& api, EncodeFlags f, IpProtocol pr, uint8_t t, uint16_t data_size) : ip_api(api), flags(f), dsize(data_size), - next_ethertype(0), + next_ethertype(ProtocolId::ETHERTYPE_NOT_SET), next_proto(pr), ttl(t) { } @@ -138,20 +138,20 @@ bool Codec::CheckIPV6HopOptions(const RawData& raw, CodecData& codec) return true; } -void Codec::CheckIPv6ExtensionOrder(CodecData& codec, const uint8_t proto) +void Codec::CheckIPv6ExtensionOrder(CodecData& codec, const IpProtocol ip_proto) { - const uint8_t current_order = ip::IPV6ExtensionOrder(proto); + const uint8_t current_order = ip::IPV6ExtensionOrder(ip_proto); if (current_order <= codec.curr_ip6_extension) { - const uint8_t next_order = ip::IPV6ExtensionOrder(codec.next_prot_id); + const uint8_t next_order = ip::IPV6IdExtensionOrder(codec.next_prot_id); /* A second "Destination Options" header is allowed iff: 1) A routing header was already seen, and 2) The second destination header is the last one before the upper layer. */ if ( !((codec.codec_flags & CODEC_ROUTING_SEEN) and - (proto == IPPROTO_ID_DSTOPTS) and + (ip_proto == IpProtocol::DSTOPTS) and (next_order == ip::IPV6_ORDER_MAX)) ) { if ( !(codec.codec_flags & CODEC_IP6_EXT_OOO) ) @@ -166,7 +166,7 @@ void Codec::CheckIPv6ExtensionOrder(CodecData& codec, const uint8_t proto) codec.curr_ip6_extension = current_order; } - if (proto == IPPROTO_ID_ROUTING) + if (ip_proto == IpProtocol::ROUTING) codec.codec_flags |= CODEC_ROUTING_SEEN; } diff --git a/src/framework/codec.h b/src/framework/codec.h index 0fd09ad3d..efc3a91ff 100644 --- a/src/framework/codec.h +++ b/src/framework/codec.h @@ -32,6 +32,7 @@ #include "framework/base_api.h" // unfortunately necessary due to use of Ipapi in struct +#include "protocols/protocol_ids.h" #include "protocols/ip.h" #include "protocols/mpls.h" // FIXIT-M remove MPLS from Convenience pointers #include "protocols/layer.h" @@ -121,7 +122,7 @@ constexpr uint16_t CODEC_IPOPT_FLAGS = (CODEC_IPOPT_RR_SEEN | struct CodecData { /* This section will get reset before every decode() function call */ - uint16_t next_prot_id; /* protocol type of the next layer */ + ProtocolId next_prot_id; /* protocol type of the next layer */ uint16_t lyr_len; /* The length of the valid part layer */ uint16_t invalid_bytes; /* the length of the INVALID part of this layer */ @@ -136,9 +137,9 @@ struct CodecData /* The following values have junk values after initialization */ uint8_t ip6_extension_count; /* initialized in cd_ipv6.cc */ uint8_t curr_ip6_extension; /* initialized in cd_ipv6.cc */ - uint8_t ip6_csum_proto; /* initalized in cd_ipv6.cc. Used for IPv6 checksums */ + IpProtocol ip6_csum_proto; /* initalized in cd_ipv6.cc. Used for IPv6 checksums */ - CodecData(uint16_t init_prot) : next_prot_id(init_prot), lyr_len(0), + CodecData(ProtocolId init_prot) : next_prot_id(init_prot), lyr_len(0), invalid_bytes(0), proto_bits(0), codec_flags(0), ip_layer_cnt(0) { } @@ -176,18 +177,18 @@ struct SO_PUBLIC EncState const ip::IpApi& ip_api; /* IP related information. Good for checksums */ EncodeFlags flags; const uint16_t dsize; /* for non-inline, TCP sequence numbers */ - uint16_t next_ethertype; /* set the next encoder 'proto' field to this value. */ - uint8_t next_proto; /* set the next encoder 'proto' field to this value. */ + ProtocolId next_ethertype; /* set the next encoder 'proto' field to this value. */ + IpProtocol next_proto; /* set the next encoder 'proto' field to this value. */ const uint8_t ttl; - EncState(const ip::IpApi& api, EncodeFlags f, uint8_t pr, + EncState(const ip::IpApi& api, EncodeFlags f, IpProtocol pr, uint8_t t, uint16_t data_size); inline bool next_proto_set() const - { return (next_proto != ENC_PROTO_UNSET); } + { return (next_proto != IpProtocol::PROTO_NOT_SET); } inline bool ethertype_set() const - { return next_ethertype != 0; } + { return next_ethertype != ProtocolId::ETHERTYPE_NOT_SET; } inline bool forward() const { return flags & ENC_FLAG_FWD; } @@ -263,7 +264,7 @@ public: // c++11 { } // Register the code's protocol ID's and Ethertypes - virtual void get_protocol_ids(std::vector&) // FIXIT-M return a vector == + virtual void get_protocol_ids(std::vector&) // FIXIT-M return a vector == // efficient in c++11 { } @@ -359,7 +360,7 @@ protected: // Check the Hop and DST IPv6 extension bool CheckIPV6HopOptions(const RawData&, CodecData&); // NOTE:: data.next_prot_id MUST be set before calling this!! - void CheckIPv6ExtensionOrder(CodecData&, const uint8_t proto); + void CheckIPv6ExtensionOrder(CodecData&, const IpProtocol); private: const char* name; diff --git a/src/ips_options/ips_ip_proto.cc b/src/ips_options/ips_ip_proto.cc index bc9e0ecb9..2039b8281 100644 --- a/src/ips_options/ips_ip_proto.cc +++ b/src/ips_options/ips_ip_proto.cc @@ -50,7 +50,7 @@ static THREAD_LOCAL ProfileStats ipProtoPerfStats; typedef struct _IpProtoData { - uint8_t protocol; + IpProtocol protocol; uint8_t comparison_flag; } IpProtoData; @@ -82,7 +82,7 @@ uint32_t IpProtoOption::hash() const uint32_t a,b,c; const IpProtoData* data = &config; - a = data->protocol; + a = to_utype(data->protocol); b = data->comparison_flag; c = 0; @@ -122,7 +122,7 @@ int IpProtoOption::eval(Cursor&, Packet* p) return DETECTION_OPTION_NO_MATCH; } - const uint8_t ip_proto = p->get_ip_proto_next(); + const IpProtocol ip_proto = p->get_ip_proto_next(); switch (ipd->comparison_flag) { @@ -203,16 +203,15 @@ static void ip_proto_parse(const char* data, IpProtoData* ds_ptr) return; } - ds_ptr->protocol = (uint8_t)ip_proto; + ds_ptr->protocol = (IpProtocol)ip_proto; } else { struct protoent* pt = getprotobyname(data); // main thread only - if (pt != NULL) + if (pt != NULL || pt->p_proto >= NUM_IP_PROTOS) { - /* p_proto should be a number less than 256 */ - ds_ptr->protocol = (uint8_t)pt->p_proto; + ds_ptr->protocol = (IpProtocol)pt->p_proto; } else { diff --git a/src/log/log_text.cc b/src/log/log_text.cc index 2f9a40248..4e16ab8dc 100644 --- a/src/log/log_text.cc +++ b/src/log/log_text.cc @@ -392,7 +392,7 @@ void LogIPHeader(TextLog* log, Packet* p) (is_ip6 ? layer::get_inner_ip6_frag() : nullptr); TextLog_Print(log, "%s TTL:%u TOS:0x%X ID:%u IpLen:%u DgmLen:%u", - protocol_names[p->get_ip_proto_next()], + protocol_names[to_utype(p->get_ip_proto_next())], ip6h->hop_lim(), ip6h->tos(), (ip6_frag ? ip6_frag->id() : 0), @@ -417,7 +417,7 @@ void LogIPHeader(TextLog* log, Packet* p) else { TextLog_Print(log, "%s TTL:%u TOS:0x%X ID:%u IpLen:%u DgmLen:%u", - protocol_names[ip4h->proto()], + protocol_names[to_utype(ip4h->proto())], ip4h->ttl(), ip4h->tos(), ip4h->id(), @@ -1266,8 +1266,8 @@ void LogNetData(TextLog* log, const uint8_t* data, const int len, Packet* p) const uint8_t* pb = data; const uint8_t* end = data + len; - const uint8_t ipv4_id = PacketManager::proto_id(IPPROTO_ID_IPIP); - const uint8_t ipv6_id = PacketManager::proto_id(IPPROTO_ID_IPV6); + const ProtocolIndex ipv4_idx = PacketManager::proto_idx(ProtocolId::IPIP); + const ProtocolIndex ipv6_idx = PacketManager::proto_idx(ProtocolId::IPV6); int offset = 0; char conv[] = "0123456789ABCDEF"; /* xlation lookup table */ @@ -1283,13 +1283,13 @@ void LogNetData(TextLog* log, const uint8_t* data, const int len, Packet* p) if (p && SnortConfig::obfuscate() ) { int num_layers = p->num_layers; - uint8_t lyr_proto = 0; + ProtocolIndex lyr_idx = 0; for ( i = 0; i < num_layers; i++ ) { - lyr_proto = PacketManager::proto_id(p->layers[i].prot_id); + lyr_idx = PacketManager::proto_idx(p->layers[i].prot_id); - if ( lyr_proto == ipv4_id || lyr_proto == ipv6_id) + if ( lyr_idx == ipv4_idx || lyr_idx == ipv6_idx) { if (p->layers[i].length && p->layers[i].start) break; @@ -1301,7 +1301,7 @@ void LogNetData(TextLog* log, const uint8_t* data, const int len, Packet* p) if (ip_start > 0 ) { ip_ob_start = ip_start + 10; - if (lyr_proto == ipv4_id) + if (lyr_idx == ipv4_idx) ip_ob_end = ip_ob_start + 2 + 2*(sizeof(struct in_addr)); else ip_ob_end = ip_ob_start + 2 + 2*(sizeof(struct in6_addr)); @@ -1400,7 +1400,7 @@ void LogIPPkt(TextLog* log, Packet* p) // FIXIT-L --> log everything in order!! ip::IpApi tmp_api = p->ptrs.ip_api; int8_t num_layer = 0; - uint8_t tmp_next = p->get_ip_proto_next(); + IpProtocol tmp_next = p->get_ip_proto_next(); bool first = true; while (layer::set_outer_ip_api(p, p->ptrs.ip_api, p->ip_proto_next, num_layer) && diff --git a/src/loggers/alert_sf_socket.cc b/src/loggers/alert_sf_socket.cc index bf3de09d4..0834980a8 100644 --- a/src/loggers/alert_sf_socket.cc +++ b/src/loggers/alert_sf_socket.cc @@ -283,7 +283,7 @@ struct SnortActionRequest uint32_t dest_ip; uint16_t sport; uint16_t dport; - uint8_t protocol; + IpProtocol ip_proto; }; static void load_sar(Packet* packet, Event* event, SnortActionRequest& sar) @@ -311,7 +311,7 @@ static void load_sar(Packet* packet, Event* event, SnortActionRequest& sar) // and only 1st 8 used for ip4 sar.src_ip = ntohl(packet->ptrs.ip_api.get_src()->ip32[0]); sar.dest_ip = ntohl(packet->ptrs.ip_api.get_dst()->ip32[0]); - sar.protocol = packet->get_ip_proto_next(); + sar.ip_proto = packet->get_ip_proto_next(); if (packet->is_tcp() || packet->is_udp()) { diff --git a/src/loggers/alert_syslog.cc b/src/loggers/alert_syslog.cc index 771a22757..b4ec54e58 100644 --- a/src/loggers/alert_syslog.cc +++ b/src/loggers/alert_syslog.cc @@ -242,21 +242,21 @@ static void AlertSyslog( } if ((p != NULL) && p->ptrs.ip_api.is_ip()) { - uint16_t proto = p->get_ip_proto_next(); - if (protocol_names[proto] != NULL) + IpProtocol ip_proto = p->get_ip_proto_next(); + if (protocol_names[to_utype(ip_proto)] != NULL) { SnortSnprintfAppend(event_string, sizeof(event_string), - "{%s} ", protocol_names[proto]); + "{%s} ", protocol_names[to_utype(ip_proto)]); } else { SnortSnprintfAppend(event_string, sizeof(event_string), - "{%d} ", proto); + "{%d} ", ip_proto); } if ((p->ptrs.decode_flags & DECODE_FRAG) - || ((proto != IPPROTO_TCP) - && (proto != IPPROTO_UDP))) + || ((ip_proto != IpProtocol::TCP) + && (ip_proto != IpProtocol::UDP))) { const char* ip_fmt = "%s -> %s"; diff --git a/src/loggers/unified2.cc b/src/loggers/unified2.cc index c0edb51cf..1a958b4b7 100644 --- a/src/loggers/unified2.cc +++ b/src/loggers/unified2.cc @@ -264,11 +264,11 @@ static void _AlertIP4_v2(Packet* p, const char*, Unified2Config* config, Event* if (p->is_portscan()) { - alertdata.protocol = p->ps_proto; + alertdata.ip_proto = p->ps_proto; } else { - alertdata.protocol = p->get_ip_proto_next(); + alertdata.ip_proto = p->get_ip_proto_next(); if ( p->type() == PktType::ICMP) { @@ -358,11 +358,11 @@ static void _AlertIP6_v2(Packet* p, const char*, Unified2Config* config, Event* if (p->is_portscan()) { - alertdata.protocol = p->ps_proto; + alertdata.ip_proto = p->ps_proto; } else { - alertdata.protocol = p->get_ip_proto_next(); + alertdata.ip_proto = p->get_ip_proto_next(); if ( p->type() == PktType::ICMP) { diff --git a/src/loggers/unified2_common.h b/src/loggers/unified2_common.h index 18389c7da..d969a9b01 100644 --- a/src/loggers/unified2_common.h +++ b/src/loggers/unified2_common.h @@ -31,6 +31,8 @@ #endif #include +#include + // SNORT DEFINES // Long time ago... #define UNIFIED2_EVENT 1 @@ -69,7 +71,7 @@ struct Unified2IDSEvent uint32_t ip_destination; uint16_t sport_itype; uint16_t dport_icode; - uint8_t protocol; + IpProtocol ip_proto; uint8_t impact_flag; // overloads packet_action uint8_t impact; uint8_t blocked; @@ -94,7 +96,7 @@ typedef struct _Unified2IDSEventIPv6 struct in6_addr ip_destination; uint16_t sport_itype; uint16_t dport_icode; - uint8_t protocol; + IpProtocol ip_proto; uint8_t impact_flag; uint8_t impact; uint8_t blocked; diff --git a/src/managers/codec_manager.cc b/src/managers/codec_manager.cc index ff8a0eabb..09c6eda48 100644 --- a/src/managers/codec_manager.cc +++ b/src/managers/codec_manager.cc @@ -50,7 +50,7 @@ std::array CodecManager::s_protocols { { 0 } }; -THREAD_LOCAL uint16_t CodecManager::grinder_id = 0; +THREAD_LOCAL ProtocolId CodecManager::grinder_id = ProtocolId::ETHERTYPE_NOT_SET; THREAD_LOCAL uint8_t CodecManager::grinder = 0; THREAD_LOCAL uint8_t CodecManager::max_layers = DEFAULT_LAYERMAX; @@ -151,7 +151,7 @@ void CodecManager::instantiate(CodecApiWrapper& wrap, Module* m, SnortConfig*) if (!wrap.init) { - std::vector ids; + std::vector ids; const CodecApi* const cd_api = wrap.api; if (codec_id >= s_protocols.size()) @@ -164,13 +164,13 @@ void CodecManager::instantiate(CodecApiWrapper& wrap, Module* m, SnortConfig*) cd->get_protocol_ids(ids); for (auto id : ids) { - if (s_proto_map[id] != 0) + if (s_proto_map[to_utype(id)] != 0) ParseError("The Codecs %s and %s have both been registered " "for protocol_id %d. Codec %s will be used\n", - s_protocols[s_proto_map[id]]->get_name(), cd->get_name(), + s_protocols[s_proto_map[to_utype(id)]]->get_name(), cd->get_name(), id, cd->get_name()); - s_proto_map[id] = (decltype(s_proto_map[id]))codec_id; // future proofing + s_proto_map[to_utype(id)] = (decltype(s_proto_map[to_utype(id)]))codec_id; // future proofing } wrap.init = true; @@ -224,10 +224,10 @@ void CodecManager::thread_init(SnortConfig* sc) s_protocols[grinder]->get_name(), cd->get_name(), cd->get_name()); - std::vector ids; + std::vector ids; s_protocols[i]->get_protocol_ids(ids); - grinder_id = ( ids.size() > 0 ) ? ids[0] : FINISHED_DECODE; + grinder_id = ( ids.size() > 0 ) ? ids[0] : ProtocolId::FINISHED_DECODE; grinder = (uint8_t)i; } } diff --git a/src/managers/codec_manager.h b/src/managers/codec_manager.h index 770c54eb2..d1e195685 100644 --- a/src/managers/codec_manager.h +++ b/src/managers/codec_manager.h @@ -33,6 +33,7 @@ #include #include "main/thread.h" +#include "protocols/protocol_ids.h" #ifdef PIGLET #include "framework/codec.h" @@ -50,8 +51,6 @@ struct ProfileStats; extern THREAD_LOCAL ProfileStats decodePerfStats; -static const uint16_t max_protocol_id = 65535; - #ifdef PIGLET struct CodecWrapper { @@ -100,11 +99,11 @@ private: struct CodecApiWrapper; static std::vector s_codecs; - static std::array s_proto_map; + static std::array s_proto_map; static std::array s_protocols; - static THREAD_LOCAL uint16_t grinder_id; - static THREAD_LOCAL uint8_t grinder; + static THREAD_LOCAL ProtocolId grinder_id; + static THREAD_LOCAL ProtocolIndex grinder; static THREAD_LOCAL uint8_t max_layers; /* diff --git a/src/network_inspectors/binder/binder.cc b/src/network_inspectors/binder/binder.cc index e0f9cfe45..0fc566da4 100644 --- a/src/network_inspectors/binder/binder.cc +++ b/src/network_inspectors/binder/binder.cc @@ -109,7 +109,7 @@ bool Binding::check_addr(const Flow* flow) const bool Binding::check_proto(const Flow* flow) const { - if ( when.protos & (unsigned)flow->protocol ) + if ( when.protos & (unsigned)flow->pkt_type ) return true; return false; @@ -319,7 +319,7 @@ void Stuff::apply_session(Flow* flow, const HostAttributeEntry* host) return; } - switch ( flow->protocol ) + switch ( flow->pkt_type ) { case PktType::IP: set_session(flow, INS_IP); diff --git a/src/network_inspectors/normalize/norm.cc b/src/network_inspectors/normalize/norm.cc index da33ada2e..d17c97138 100644 --- a/src/network_inspectors/normalize/norm.cc +++ b/src/network_inspectors/normalize/norm.cc @@ -114,8 +114,8 @@ int Norm_Packet(NormalizerConfig* c, Packet* p) while ( lyr > 0 ) { - uint16_t proto = p->layers[--lyr].prot_id; - NormalFunc n = c->normalizers[PacketManager::proto_id(proto)]; + ProtocolId proto_id = p->layers[--lyr].prot_id; + NormalFunc n = c->normalizers[PacketManager::proto_idx(proto_id)]; if ( n ) changes = n(c, p, lyr, changes); @@ -630,25 +630,25 @@ int Norm_SetConfig(NormalizerConfig* nc) } if ( Norm_IsEnabled(nc, (NormFlags)NORM_IP4_ANY) ) { - nc->normalizers[PacketManager::proto_id(ETHERTYPE_IPV4)] = Norm_IP4; + nc->normalizers[PacketManager::proto_idx(ProtocolId::ETHERTYPE_IPV4)] = Norm_IP4; } if ( Norm_IsEnabled(nc, NORM_ICMP4) ) { - nc->normalizers[PacketManager::proto_id(IPPROTO_ID_ICMPV4)] = Norm_ICMP4; + nc->normalizers[PacketManager::proto_idx(ProtocolId::ICMPV4)] = Norm_ICMP4; } if ( Norm_IsEnabled(nc, (NormFlags)NORM_IP6_ANY) ) { - nc->normalizers[PacketManager::proto_id(IPPROTO_ID_IPV6)] = Norm_IP6; - nc->normalizers[PacketManager::proto_id(IPPROTO_ID_HOPOPTS)] = Norm_IP6_Opts; - nc->normalizers[PacketManager::proto_id(IPPROTO_ID_DSTOPTS)] = Norm_IP6_Opts; + nc->normalizers[PacketManager::proto_idx(ProtocolId::IPV6)] = Norm_IP6; + nc->normalizers[PacketManager::proto_idx(ProtocolId::HOPOPTS)] = Norm_IP6_Opts; + nc->normalizers[PacketManager::proto_idx(ProtocolId::DSTOPTS)] = Norm_IP6_Opts; } if ( Norm_IsEnabled(nc, NORM_ICMP6) ) { - nc->normalizers[PacketManager::proto_id(IPPROTO_ID_ICMPV6)] = Norm_ICMP6; + nc->normalizers[PacketManager::proto_idx(ProtocolId::ICMPV6)] = Norm_ICMP6; } if ( Norm_IsEnabled(nc, (NormFlags)NORM_TCP_ANY) ) { - nc->normalizers[PacketManager::proto_id(IPPROTO_ID_TCP)] = Norm_TCP; + nc->normalizers[PacketManager::proto_idx(ProtocolId::TCP)] = Norm_TCP; } return 0; } diff --git a/src/network_inspectors/perf_monitor/perf_flow.h b/src/network_inspectors/perf_monitor/perf_flow.h new file mode 100644 index 000000000..b6bcbae85 --- /dev/null +++ b/src/network_inspectors/perf_monitor/perf_flow.h @@ -0,0 +1,142 @@ +//-------------------------------------------------------------------------- +// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved. +// Copyright (C) 2002-2013 Sourcefire, Inc. +// +// This program is free software; you can redistribute it and/or modify it +// under the terms of the GNU General Public License Version 2 as published +// by the Free Software Foundation. You may not use, modify or distribute +// this program under any other version of the GNU General Public License. +// +// This program is distributed in the hope that it will be useful, but +// WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +// General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +//-------------------------------------------------------------------------- +/* +** Marc Norton +** Dan Roelker +** +*/ + +#ifndef PERF_FLOW_H +#define PERF_FLOW_H + +#include "perf_module.h" +#include "main/snort_types.h" +#include "hash/sfxhash.h" +#include "sfip/sfip_t.h" +#include "protocols/packet.h" + +#define MAX_PKT_LEN 9000 +#define MAX_PORT UINT16_MAX + +enum FlowType +{ + SFS_TYPE_TCP = 0, + SFS_TYPE_UDP, + SFS_TYPE_OTHER, + SFS_TYPE_MAX +}; + +enum FlowState +{ + SFS_STATE_TCP_ESTABLISHED = 0, + SFS_STATE_TCP_CLOSED, + SFS_STATE_UDP_CREATED, + SFS_STATE_MAX +}; + +struct PortFlow +{ + double tot_perc[MAX_PORT+1]; + double sport_rate[MAX_PORT+1]; + double dport_rate[MAX_PORT+1]; +}; + +struct IcmpFlow +{ + double tot_perc[256]; + int display[256]; +}; + +/* Raw flow statistics */ +struct RawFlowStats +{ + time_t time; + uint64_t* pkt_len_cnt; + uint64_t pkt_total; + + uint64_t byte_total; + + uint64_t* pkt_len_percent; + + uint64_t* port_tcp_src; + uint64_t* port_tcp_dst; + uint64_t* port_udp_src; + uint64_t* port_udp_dst; + + uint64_t* type_icmp; + + uint64_t port_tcp_high; + uint64_t port_tcp_total; + + uint64_t port_udp_high; + uint64_t port_udp_total; + + uint64_t type_icmp_total; +}; + +/* Processed flow statistics */ +struct FlowStats +{ + time_t time; + double pkt_len_percent[MAX_PKT_LEN + 2]; + int pkt_len_percent_count; + + double traffic_tcp; + double traffic_udp; + double traffic_icmp; + double traffic_other; + + PortFlow port_flow_tcp; + double port_flow_high_tcp; + int port_flow_tcp_count; + + PortFlow port_flow_udp; + double port_flow_high_udp; + int port_flow_udp_count; + + IcmpFlow flow_icmp; + int flow_icmp_count; +}; + +struct TrafficStats +{ + uint64_t packets_a_to_b; + uint64_t bytes_a_to_b; + uint64_t packets_b_to_a; + uint64_t bytes_b_to_a; +}; + +struct FlowStateValue +{ + TrafficStats traffic_stats[SFS_TYPE_MAX]; + uint64_t total_packets; + uint64_t total_bytes; + uint32_t state_changes[SFS_STATE_MAX]; +}; + +/* +** Functions for the performance functions to call +*/ +void update_flow_stats(RawFlowStats*, Packet*); +void process_flow_stats(RawFlowStats*, FILE*, PerfFormat, time_t); +void free_flow_stats(RawFlowStats*); +void log_flow_perf_header(FILE*); + +#endif + diff --git a/src/network_inspectors/port_scan/port_scan.cc b/src/network_inspectors/port_scan/port_scan.cc index 1a7fd7941..e7d6b2f18 100644 --- a/src/network_inspectors/port_scan/port_scan.cc +++ b/src/network_inspectors/port_scan/port_scan.cc @@ -69,7 +69,6 @@ #include "detection/detect.h" #define PROTO_BUFFER_SIZE 256 -#define IPPROTO_PS 0xFF static THREAD_LOCAL Packet* g_tmp_pkt = NULL; static THREAD_LOCAL FILE* g_logfile = NULL; @@ -357,16 +356,16 @@ static int MakePortscanPkt(PS_PKT* ps_pkt, PS_PROTO* proto, int proto_type, switch (proto_type) { case PS_PROTO_TCP: - g_tmp_pkt->ps_proto = IPPROTO_TCP; + g_tmp_pkt->ps_proto = IpProtocol::TCP; break; case PS_PROTO_UDP: - g_tmp_pkt->ps_proto = IPPROTO_UDP; + g_tmp_pkt->ps_proto = IpProtocol::UDP; break; case PS_PROTO_ICMP: - g_tmp_pkt->ps_proto = IPPROTO_ICMP; + g_tmp_pkt->ps_proto = IpProtocol::ICMPV4; break; case PS_PROTO_IP: - g_tmp_pkt->ps_proto = IPPROTO_IP; + g_tmp_pkt->ps_proto = IpProtocol::IP; break; case PS_PROTO_OPEN_PORT: g_tmp_pkt->ps_proto = p->get_ip_proto_next(); @@ -377,12 +376,12 @@ static int MakePortscanPkt(PS_PKT* ps_pkt, PS_PROTO* proto, int proto_type, if (g_tmp_pkt->is_ip4()) { - ((IP4Hdr*)g_tmp_pkt->ptrs.ip_api.get_ip4h())->set_proto(IPPROTO_PS); + ((IP4Hdr*)g_tmp_pkt->ptrs.ip_api.get_ip4h())->set_proto(IpProtocol::PORT_SCAN); } else { // since ip_api.is_ip() && !ip4h, this is automatically ip6h - ((ip::IP6Hdr*)g_tmp_pkt->ptrs.ip_api.get_ip6h())->set_proto(IPPROTO_PS); + ((ip::IP6Hdr*)g_tmp_pkt->ptrs.ip_api.get_ip6h())->set_proto(IpProtocol::PORT_SCAN); } switch (proto_type) diff --git a/src/network_inspectors/reputation/reputation_inspect.cc b/src/network_inspectors/reputation/reputation_inspect.cc index 1100152bc..62c82890f 100644 --- a/src/network_inspectors/reputation/reputation_inspect.cc +++ b/src/network_inspectors/reputation/reputation_inspect.cc @@ -264,7 +264,7 @@ static IPdecision ReputationDecision(ReputationConfig* config, Packet* p) ip::IpApi tmp_api = p->ptrs.ip_api; int8_t num_layer = 0; - uint8_t tmp_next = p->get_ip_proto_next(); + IpProtocol tmp_next = p->get_ip_proto_next(); bool outer_layer_only = (config->nestedIP == OUTER)? true: false; bool outer_layer = false; diff --git a/src/piglet_plugins/pp_codec_data_iface.cc b/src/piglet_plugins/pp_codec_data_iface.cc index abe2430b9..ed1a84cc0 100644 --- a/src/piglet_plugins/pp_codec_data_iface.cc +++ b/src/piglet_plugins/pp_codec_data_iface.cc @@ -64,13 +64,20 @@ static const luaL_Reg methods[] = { Lua::Args args(L); - auto& self = CodecDataIface.create(L, 0); + auto& self = CodecDataIface.create(L, ProtocolId::ETHERTYPE_NOT_SET); memset(&self, 0, sizeof(self)); if ( args[1].is_table() ) args[1].check_table(set_fields, self); else if ( args[1].is_size() ) - self.next_prot_id = args[1].check_size(); + { + // FIXIT-L: Can check_size limit size to short? + unsigned int tmp = args[1].check_size(); + if(tmp > UINT16_MAX) + self.next_prot_id = ProtocolId::ETHERTYPE_NOT_SET; + else + self.next_prot_id = (ProtocolId)args[1].check_size(); + } return 1; } diff --git a/src/piglet_plugins/pp_codec_iface.cc b/src/piglet_plugins/pp_codec_iface.cc index e5473e0f4..16ba835b8 100644 --- a/src/piglet_plugins/pp_codec_iface.cc +++ b/src/piglet_plugins/pp_codec_iface.cc @@ -81,7 +81,7 @@ static const luaL_Reg methods[] = { auto& self = CodecIface.get(L); - std::vector ret; + std::vector ret; self.get_protocol_ids(ret); lua_newtable(L); diff --git a/src/piglet_plugins/pp_enc_state_iface.cc b/src/piglet_plugins/pp_enc_state_iface.cc index 8a09938f0..d35a16325 100644 --- a/src/piglet_plugins/pp_enc_state_iface.cc +++ b/src/piglet_plugins/pp_enc_state_iface.cc @@ -41,7 +41,7 @@ static const luaL_Reg methods[] = uint32_t efl_hi = args[1].opt_size(); uint32_t efl_lo = args[2].opt_size(); - uint8_t next_proto = args[3].opt_size(); + IpProtocol next_proto = (IpProtocol)args[3].opt_size(); uint8_t ttl = args[4].opt_size(); uint16_t dsize = args[5].opt_int(); diff --git a/src/protocols/eth.h b/src/protocols/eth.h index da6f7d640..976e14620 100644 --- a/src/protocols/eth.h +++ b/src/protocols/eth.h @@ -21,6 +21,7 @@ #define PROTOCOLS_ETH_H #include +#include "protocols/protocol_ids.h" #define ETHERNET_HEADER_LEN 14 #define ETHERNET_MTU 1500 @@ -29,7 +30,6 @@ namespace eth { constexpr uint16_t MTU_LEN = 1500; constexpr uint16_t MAX_FRAME_LENGTH = 1500; -constexpr uint16_t MIN_ETHERTYPE = 1536; constexpr uint16_t ETH_HEADER_LEN = 14; struct EtherHdr @@ -39,8 +39,8 @@ struct EtherHdr uint16_t ether_type; /* return data in byte order */ - inline uint16_t ethertype() const - { return ntohs(ether_type); } + inline ProtocolId ethertype() const + { return (ProtocolId)ntohs(ether_type); } /* return data in network order */ inline uint16_t raw_ethertype() const diff --git a/src/protocols/gre.h b/src/protocols/gre.h index bb731e911..66c9ff02a 100644 --- a/src/protocols/gre.h +++ b/src/protocols/gre.h @@ -34,8 +34,8 @@ struct GREHdr inline uint8_t get_version() const { return version & 0x07; } - inline uint16_t proto() const - { return ntohs(ether_type); } + inline ProtocolId proto() const + { return (ProtocolId)ntohs(ether_type); } inline uint16_t raw_proto() const { return ether_type; } diff --git a/src/protocols/ip.cc b/src/protocols/ip.cc index 95fba97f2..f565a21a4 100644 --- a/src/protocols/ip.cc +++ b/src/protocols/ip.cc @@ -114,7 +114,7 @@ uint8_t IpApi::ttl() const * variable hold the first non-ip and non-ipv6 extension protocols, * while proto() returns the next or proto() field of the raw IP * header */ -uint8_t IpApi::proto() const +IpProtocol IpApi::proto() const { switch ( type ) { @@ -122,7 +122,7 @@ uint8_t IpApi::proto() const case IAT_6: return ((IP6Hdr*)iph)->next(); default: break; } - return 0xFF; + return IpProtocol::PROTO_NOT_SET; } // header length field: datagram/payload-only length for 4/6 diff --git a/src/protocols/ip.h b/src/protocols/ip.h index 97dc8c870..949eea3bc 100644 --- a/src/protocols/ip.h +++ b/src/protocols/ip.h @@ -123,7 +123,7 @@ public: uint16_t tos() const; uint8_t ttl() const; - uint8_t proto() const; + IpProtocol proto() const; uint16_t raw_len() const; uint8_t hlen() const; uint8_t ver() const; diff --git a/src/protocols/ipv4.h b/src/protocols/ipv4.h index 7dd017178..9db897758 100644 --- a/src/protocols/ipv4.h +++ b/src/protocols/ipv4.h @@ -56,7 +56,7 @@ struct IP4Hdr uint16_t ip_id; /* identification */ uint16_t ip_off; /* fragment offset */ uint8_t ip_ttl; /* time to live field */ - uint8_t ip_proto; /* datagram protocol */ + IpProtocol ip_proto; /* datagram protocol */ uint16_t ip_csum; /* checksum */ uint32_t ip_src; /* source IP */ uint32_t ip_dst; /* dest IP */ @@ -77,7 +77,7 @@ struct IP4Hdr inline uint8_t ttl() const { return ip_ttl; } - inline uint8_t proto() const + inline IpProtocol proto() const { return ip_proto; } inline uint16_t off_w_flags() const @@ -137,7 +137,7 @@ struct IP4Hdr inline void set_hlen(uint8_t value) { ip_verhl = (ip_verhl & 0xf0) | (value & 0x0f); } - inline void set_proto(uint8_t prot) + inline void set_proto(IpProtocol prot) { ip_proto = prot; } inline void set_ip_len(uint16_t new_len) diff --git a/src/protocols/ipv6.h b/src/protocols/ipv6.h index 97b386965..5fbbc1685 100644 --- a/src/protocols/ipv6.h +++ b/src/protocols/ipv6.h @@ -69,7 +69,7 @@ struct IP6Hdr uint32_t ip6_vtf; /* 4 bits version, 8 bits TC,len 20 bits flow-ID */ uint16_t ip6_payload_len; /* payload length */ - uint8_t ip6_next; /* next header */ + IpProtocol ip6_next; /* next header */ uint8_t ip6_hoplim; /* hop limit */ snort_in6_addr ip6_src; /* source address */ @@ -79,10 +79,10 @@ struct IP6Hdr { return ntohs(ip6_payload_len); } /* Same function as ipv4 */ - inline uint8_t proto() const + inline IpProtocol proto() const { return ip6_next; } - inline uint8_t next() const + inline IpProtocol next() const { return ip6_next; } inline uint8_t hop_lim() const @@ -136,14 +136,14 @@ struct IP6Hdr { switch (ip6_next) { - case IPPROTO_NONE: - case IPPROTO_TCP: - case IPPROTO_UDP: - case IPPROTO_ICMPV6: - case IPPROTO_HOPOPTS: - case IPPROTO_DSTOPTS: - case IPPROTO_ROUTING: - case IPPROTO_FRAGMENT: + case IpProtocol::NONEXT: + case IpProtocol::TCP: + case IpProtocol::UDP: + case IpProtocol::ICMPV6: + case IpProtocol::HOPOPTS: + case IpProtocol::DSTOPTS: + case IpProtocol::ROUTING: + case IpProtocol::FRAGMENT: return true; default: break; @@ -155,7 +155,7 @@ struct IP6Hdr inline void set_len(uint16_t new_len) { ip6_payload_len = htons(new_len); } - inline void set_proto(uint8_t prot) + inline void set_proto(IpProtocol prot) { ip6_next = prot; } inline void set_raw_len(uint16_t new_len) @@ -191,7 +191,7 @@ struct IP6Option /* Generic Extension Header */ struct IP6Extension { - uint8_t ip6e_nxt; + IpProtocol ip6e_nxt; uint8_t ip6e_len; /* options follow */ uint8_t ip6e_pad[6]; @@ -200,12 +200,12 @@ struct IP6Extension /* Fragment header */ struct IP6Frag { - uint8_t ip6f_nxt; /* next header */ + IpProtocol ip6f_nxt; /* next header */ uint8_t ip6f_reserved; /* reserved field */ uint16_t ip6f_offlg; /* offset, reserved, and flag */ uint32_t ip6f_ident; /* identification */ - inline uint8_t next() const + inline IpProtocol next() const { return ip6f_nxt; } inline uint16_t off_w_flags() const @@ -235,19 +235,24 @@ struct IP6Frag // Reflects the recomended IPv6 order in RFC 2460 4.1 constexpr int IPV6_ORDER_MAX = 7; -inline int IPV6ExtensionOrder(uint8_t type) +inline int IPV6IdExtensionOrder(const ProtocolId prot_id) { - switch (type) + switch (prot_id) { - case IPPROTO_ID_HOPOPTS: return 1; - case IPPROTO_ID_DSTOPTS: return 2; - case IPPROTO_ID_ROUTING: return 3; - case IPPROTO_ID_FRAGMENT: return 4; - case IPPROTO_ID_AUTH: return 5; - case IPPROTO_ID_ESP: return 6; + case ProtocolId::HOPOPTS: return 1; + case ProtocolId::DSTOPTS: return 2; + case ProtocolId::ROUTING: return 3; + case ProtocolId::FRAGMENT: return 4; + case ProtocolId::AUTH: return 5; + case ProtocolId::ESP: return 6; default: return IPV6_ORDER_MAX; } } +inline int IPV6ExtensionOrder(const IpProtocol ip_proto) +{ + return IPV6IdExtensionOrder((ProtocolId)ip_proto); +} + } // namespace ipv6 #endif diff --git a/src/protocols/layer.cc b/src/protocols/layer.cc index 6715d23cb..2f66bb3cb 100644 --- a/src/protocols/layer.cc +++ b/src/protocols/layer.cc @@ -34,7 +34,7 @@ static THREAD_LOCAL const Packet* curr_pkt; static inline const uint8_t* find_outer_layer(const Layer* lyr, uint8_t num_layers, - uint16_t prot_id) + ProtocolId prot_id) { for (int i = 0; i < num_layers; i++) { @@ -47,7 +47,7 @@ static inline const uint8_t* find_outer_layer(const Layer* lyr, static inline const uint8_t* find_inner_layer(const Layer* lyr, uint8_t num_layers, - uint16_t prot_id) + ProtocolId prot_id) { int tmp = num_layers-1; lyr = &lyr[tmp]; @@ -63,8 +63,8 @@ static inline const uint8_t* find_inner_layer(const Layer* lyr, static inline const uint8_t* find_inner_layer(const Layer* lyr, uint8_t num_layers, - uint16_t prot_id1, - uint16_t prot_id2) + ProtocolId prot_id1, + ProtocolId prot_id2) { int tmp = num_layers-1; lyr = &lyr[tmp]; @@ -82,11 +82,11 @@ static inline const uint8_t* find_inner_layer(const Layer* lyr, void set_packet_pointer(const Packet* const p) { curr_pkt = p; } -const uint8_t* get_inner_layer(const Packet* p, uint16_t proto) -{ return find_inner_layer(p->layers, p->num_layers, proto); } +const uint8_t* get_inner_layer(const Packet* p, ProtocolId prot_id) +{ return find_inner_layer(p->layers, p->num_layers, prot_id); } -const uint8_t* get_outer_layer(const Packet* p, uint16_t proto) -{ return find_outer_layer(p->layers, p->num_layers, proto); } +const uint8_t* get_outer_layer(const Packet* p, ProtocolId prot_id) +{ return find_outer_layer(p->layers, p->num_layers, prot_id); } const arp::EtherARP* get_arp_layer(const Packet* const p) { @@ -94,7 +94,7 @@ const arp::EtherARP* get_arp_layer(const Packet* const p) const Layer* lyr = p->layers; return reinterpret_cast( - find_inner_layer(lyr, num_layers, ETHERTYPE_ARP, ETHERTYPE_REVARP)); + find_inner_layer(lyr, num_layers, ProtocolId::ETHERTYPE_ARP, ProtocolId::ETHERTYPE_REVARP)); } const gre::GREHdr* get_gre_layer(const Packet* const p) @@ -103,7 +103,7 @@ const gre::GREHdr* get_gre_layer(const Packet* const p) const Layer* lyr = p->layers; return reinterpret_cast( - find_inner_layer(lyr, num_layers, IPPROTO_ID_GRE)); + find_inner_layer(lyr, num_layers, ProtocolId::GRE)); } const eapol::EtherEapol* get_eapol_layer(const Packet* const p) @@ -112,7 +112,7 @@ const eapol::EtherEapol* get_eapol_layer(const Packet* const p) const Layer* lyr = p->layers; return reinterpret_cast( - find_inner_layer(lyr, num_layers, ETHERTYPE_EAPOL)); + find_inner_layer(lyr, num_layers, ProtocolId::ETHERTYPE_EAPOL)); } const vlan::VlanTagHdr* get_vlan_layer(const Packet* const p) @@ -121,7 +121,7 @@ const vlan::VlanTagHdr* get_vlan_layer(const Packet* const p) const Layer* lyr = p->layers; return reinterpret_cast( - find_inner_layer(lyr, num_layers, ETHERTYPE_8021Q)); + find_inner_layer(lyr, num_layers, ProtocolId::ETHERTYPE_8021Q)); } const eth::EtherHdr* get_eth_layer(const Packet* const p) @@ -131,7 +131,7 @@ const eth::EtherHdr* get_eth_layer(const Packet* const p) // First, search for the inner eth layer (transbridging) const eth::EtherHdr* eh = reinterpret_cast( - find_inner_layer(lyr, num_layers, ETHERTYPE_TRANS_ETHER_BRIDGING)); + find_inner_layer(lyr, num_layers, ProtocolId::ETHERTYPE_TRANS_ETHER_BRIDGING)); // if no inner eth layer, assume root layer is eth (callers job to confirm) return eh ? eh : reinterpret_cast(get_root_layer(p)); @@ -152,7 +152,7 @@ const ip::IP6Frag* get_inner_ip6_frag(const Packet* const pkt) for (int i = max_layer; i >= 0; i--) { - if (lyr->prot_id == IPPROTO_ID_FRAGMENT) + if (lyr->prot_id == ProtocolId::FRAGMENT) return reinterpret_cast(lyr->start); // Only check until current ip6h header @@ -178,7 +178,7 @@ int get_inner_ip6_frag_index(const Packet* const pkt) for (int i = max_layer; i >= 0; i--) { - if (lyr->prot_id == IPPROTO_ID_FRAGMENT) + if (lyr->prot_id == ProtocolId::FRAGMENT) return i; lyr--; @@ -190,7 +190,7 @@ int get_inner_ip6_frag_index(const Packet* const pkt) const udp::UDPHdr* get_outer_udp_lyr(const Packet* const p) { return reinterpret_cast( - find_outer_layer(p->layers, p->num_layers, IPPROTO_UDP)); + find_outer_layer(p->layers, p->num_layers, ProtocolId::UDP)); } const uint8_t* get_root_layer(const Packet* const p) @@ -209,10 +209,10 @@ int get_inner_ip_lyr_index(const Packet* const p) { switch (layers[i].prot_id) { - case ETHERTYPE_IPV4: - case ETHERTYPE_IPV6: - case IPPROTO_ID_IPIP: - case IPPROTO_ID_IPV6: + case ProtocolId::ETHERTYPE_IPV4: + case ProtocolId::ETHERTYPE_IPV6: + case ProtocolId::IPIP: + case ProtocolId::IPV6: return i; default: break; @@ -225,13 +225,13 @@ bool set_inner_ip_api(const Packet* const p, ip::IpApi& api, int8_t& curr_layer) { - uint8_t tmp; + IpProtocol tmp; return set_inner_ip_api(p, api, tmp, curr_layer); } bool set_inner_ip_api(const Packet* const p, ip::IpApi& api, - uint8_t& next_ip_proto, + IpProtocol& next_ip_proto, int8_t& curr_layer) { if (curr_layer < 0 || curr_layer >= p->num_layers) @@ -251,8 +251,8 @@ bool set_inner_ip_api(const Packet* const p, switch (lyr.prot_id) { - case ETHERTYPE_IPV4: - case IPPROTO_ID_IPIP: + case ProtocolId::ETHERTYPE_IPV4: + case ProtocolId::IPIP: { const ip::IP4Hdr* ip4h = reinterpret_cast(lyr.start); @@ -261,8 +261,8 @@ bool set_inner_ip_api(const Packet* const p, return true; } - case ETHERTYPE_IPV6: - case IPPROTO_ID_IPV6: + case ProtocolId::ETHERTYPE_IPV6: + case ProtocolId::IPV6: { const ip::IP6Hdr* ip6h = reinterpret_cast(lyr.start); @@ -271,18 +271,18 @@ bool set_inner_ip_api(const Packet* const p, return true; } - case IPPROTO_ID_HOPOPTS: - case IPPROTO_ID_DSTOPTS: - case IPPROTO_ID_ROUTING: - case IPPROTO_ID_FRAGMENT: - case IPPROTO_ID_AUTH: - case IPPROTO_ID_ESP: - case IPPROTO_ID_MOBILITY: - case IPPROTO_ID_NONEXT: + case ProtocolId::HOPOPTS: + case ProtocolId::DSTOPTS: + case ProtocolId::ROUTING: + case ProtocolId::FRAGMENT: + case ProtocolId::AUTH: + case ProtocolId::ESP: + case ProtocolId::MOBILITY: + case ProtocolId::NONEXT: break; default: - next_ip_proto = lyr.prot_id; + next_ip_proto = convert_protocolid_to_ipprotocol(lyr.prot_id); } } while (--curr_layer >= 0); @@ -292,7 +292,7 @@ bool set_inner_ip_api(const Packet* const p, bool set_outer_ip_api(const Packet* const p, ip::IpApi& api, - uint8_t& ip_proto_next, + IpProtocol& ip_proto_next, int8_t& curr_layer) { if (set_outer_ip_api(p, api, curr_layer)) @@ -318,7 +318,7 @@ bool set_outer_ip_api(const Packet* const p, } } - ip_proto_next = p->layers[curr_layer].prot_id; + ip_proto_next = convert_protocolid_to_ipprotocol(p->layers[curr_layer].prot_id); return true; } @@ -339,8 +339,8 @@ bool set_outer_ip_api(const Packet* const p, switch (lyr.prot_id) { - case ETHERTYPE_IPV4: - case IPPROTO_ID_IPIP: + case ProtocolId::ETHERTYPE_IPV4: + case ProtocolId::IPIP: { const ip::IP4Hdr* ip4h = reinterpret_cast(lyr.start); @@ -348,8 +348,8 @@ bool set_outer_ip_api(const Packet* const p, curr_layer++; return true; } - case ETHERTYPE_IPV6: - case IPPROTO_ID_IPV6: + case ProtocolId::ETHERTYPE_IPV6: + case ProtocolId::IPV6: { const ip::IP6Hdr* ip6h = reinterpret_cast(lyr.start); @@ -357,8 +357,8 @@ bool set_outer_ip_api(const Packet* const p, curr_layer++; return true; } - //default: - // don't care about this layer if its not IP. + default: + ; // don't care about this layer if its not IP. } } while (++curr_layer < num_layers); @@ -377,14 +377,14 @@ bool set_api_ip_embed_icmp(const Packet* p, ip::IpApi& api) { const Layer& lyr = p->layers[i]; - if (lyr.prot_id == PROTO_IP_EMBEDDED_IN_ICMP4) + if (lyr.prot_id == ProtocolId::IP_EMBEDDED_IN_ICMP4) { const ip::IP4Hdr* ip4h = reinterpret_cast(lyr.start); api.set(ip4h); return true; } - else if (lyr.prot_id == PROTO_IP_EMBEDDED_IN_ICMP6) + else if (lyr.prot_id == ProtocolId::IP_EMBEDDED_IN_ICMP6) { const ip::IP6Hdr* ip6h = reinterpret_cast(lyr.start); diff --git a/src/protocols/layer.h b/src/protocols/layer.h index 659e8791f..202d618e2 100644 --- a/src/protocols/layer.h +++ b/src/protocols/layer.h @@ -22,11 +22,12 @@ #include #include "main/snort_types.h" +#include "protocol_ids.h" struct Layer { const uint8_t* start; - uint16_t prot_id; + ProtocolId prot_id; uint16_t length; }; @@ -86,8 +87,8 @@ namespace layer // Set by PacketManager. Ensure you can call layer:: without a packet pointers void set_packet_pointer(const Packet* const); -SO_PUBLIC const uint8_t* get_inner_layer(const Packet*, uint16_t proto); -SO_PUBLIC const uint8_t* get_outer_layer(const Packet*, uint16_t proto); +SO_PUBLIC const uint8_t* get_inner_layer(const Packet*, ProtocolId proto); +SO_PUBLIC const uint8_t* get_outer_layer(const Packet*, ProtocolId proto); SO_PUBLIC const arp::EtherARP* get_arp_layer(const Packet*); SO_PUBLIC const vlan::VlanTagHdr* get_vlan_layer(const Packet*); @@ -160,7 +161,7 @@ SO_PUBLIC const icmp::ICMPHdr* get_icmp_embed_icmp(const ip::IpApi&); */ SO_PUBLIC bool set_inner_ip_api(const Packet* const, ip::IpApi&, int8_t& curr_layer); SO_PUBLIC bool set_inner_ip_api(const Packet* const, ip::IpApi&, - uint8_t& next_ip_proto, int8_t& curr_layer); + IpProtocol& next_ip_proto, int8_t& curr_layer); /* * Identical to above function except will begin searching from the @@ -172,7 +173,7 @@ SO_PUBLIC bool set_inner_ip_api(const Packet* const, ip::IpApi&, */ SO_PUBLIC bool set_outer_ip_api(const Packet* const, ip::IpApi&, int8_t& curr_layer); SO_PUBLIC bool set_outer_ip_api(const Packet* const, ip::IpApi&, - uint8_t& next_ip_proto, int8_t& curr_layer); + IpProtocol& next_ip_proto, int8_t& curr_layer); } // namespace layer #endif diff --git a/src/protocols/packet.cc b/src/protocols/packet.cc index c21149a41..d7989fe34 100644 --- a/src/protocols/packet.cc +++ b/src/protocols/packet.cc @@ -61,7 +61,7 @@ uint8_t Packet::ip_proto_next() const #endif -bool Packet::get_ip_proto_next(uint8_t& lyr, uint8_t& proto) const +bool Packet::get_ip_proto_next(uint8_t& lyr, IpProtocol& proto) const { if (lyr > num_layers) return false; @@ -70,22 +70,22 @@ bool Packet::get_ip_proto_next(uint8_t& lyr, uint8_t& proto) const { switch (layers[lyr].prot_id) { - case IPPROTO_ID_IPV6: - case ETHERTYPE_IPV6: + case ProtocolId::IPV6: + case ProtocolId::ETHERTYPE_IPV6: // move past this IP layer and any IPv6 extensions. while ( ((lyr + 1) < num_layers) && is_ip6_extension(layers[lyr+1].prot_id) ) ++lyr; - if ( (layers[lyr].prot_id == IPPROTO_ID_IPV6) || (layers[lyr].prot_id == - ETHERTYPE_IPV6) ) + if ( (layers[lyr].prot_id == ProtocolId::IPV6) || (layers[lyr].prot_id == + ProtocolId::ETHERTYPE_IPV6) ) proto = reinterpret_cast(layers[lyr++].start)->next(); else proto = reinterpret_cast(layers[lyr++].start)->ip6e_nxt; return true; - case ETHERTYPE_IPV4: - case IPPROTO_ID_IPIP: + case ProtocolId::ETHERTYPE_IPV4: + case ProtocolId::IPIP: proto = reinterpret_cast(layers[lyr++].start)->proto(); return true; diff --git a/src/protocols/packet.h b/src/protocols/packet.h index 15d732734..2d5145623 100644 --- a/src/protocols/packet.h +++ b/src/protocols/packet.h @@ -134,7 +134,7 @@ struct SO_PUBLIC Packet uint16_t alt_dsize; /* the dsize of a packet before munging (used for log)*/ uint8_t num_layers; /* index into layers for next encap */ - uint8_t ip_proto_next; /* the protocol ID after IP and all IP6 extension */ + IpProtocol ip_proto_next; /* the protocol ID after IP and all IP6 extension */ bool disable_inspect; class Endianness* endianness; @@ -157,7 +157,7 @@ struct SO_PUBLIC Packet // for correlating configuration with event output uint16_t user_policy_id; - uint8_t ps_proto; // Used for portscan and unified2 logging + IpProtocol ps_proto; // Used for portscan and unified2 logging // IP_MAXPACKET is the minimum allowable max_dsize // there is no requirement that all data fit into an IP datagram @@ -220,7 +220,7 @@ struct SO_PUBLIC Packet * eth::ip4::udp::teredo::ip6::hop_opts::ipv6_routing::tcp * this function return 6 == IPPROTO_TCP == IPPROTO_ID_TCP */ - inline uint8_t get_ip_proto_next() const + inline IpProtocol get_ip_proto_next() const { return ip_proto_next; } /* Similar to above. However, this function @@ -241,7 +241,7 @@ struct SO_PUBLIC Packet * .... * } */ - bool get_ip_proto_next(uint8_t& lyr, uint8_t& proto) const; + bool get_ip_proto_next(uint8_t& lyr, IpProtocol& proto) const; inline void reset() { diff --git a/src/protocols/packet_manager.cc b/src/protocols/packet_manager.cc index 42ab61858..0236ebf1f 100644 --- a/src/protocols/packet_manager.cc +++ b/src/protocols/packet_manager.cc @@ -87,7 +87,7 @@ static THREAD_LOCAL uint8_t* dst_mac = nullptr; //------------------------------------------------------------------------- static inline void push_layer(Packet* p, - uint16_t prot_id, + ProtocolId prot_id, const uint8_t* hdr_start, uint32_t len) { @@ -105,7 +105,7 @@ void PacketManager::pop_teredo(Packet* p, RawData& raw) if ( SnortConfig::tunnel_bypass_enabled(TUNNEL_TEREDO) ) Active::clear_tunnel_bypass(); - const uint8_t mapped_prot = CodecManager::s_proto_map[PROTO_TEREDO]; + const ProtocolIndex mapped_prot = CodecManager::s_proto_map[to_utype(ProtocolId::TEREDO)]; s_stats[mapped_prot + stat_offset]--; p->num_layers--; @@ -189,11 +189,11 @@ void PacketManager::decode( DecodeData unsure_encap_ptrs; - uint8_t mapped_prot = CodecManager::grinder; - uint16_t prev_prot_id = CodecManager::grinder_id; + ProtocolIndex mapped_prot = CodecManager::grinder; + ProtocolId prev_prot_id = CodecManager::grinder_id; RawData raw(pkthdr, pkt); - CodecData codec_data(FINISHED_DECODE); + CodecData codec_data(ProtocolId::FINISHED_DECODE); if ( cooked ) codec_data.codec_flags |= CODEC_STREAM_REBUILT; @@ -236,7 +236,7 @@ void PacketManager::decode( // FIXIT-M refactor when ip_proto's become an array if ( p->is_fragment() ) { - if ( prev_prot_id == IPPROTO_ID_FRAGMENT ) + if ( prev_prot_id == ProtocolId::FRAGMENT ) { const ip::IP6Frag* const fragh = reinterpret_cast(raw.data); @@ -249,7 +249,7 @@ void PacketManager::decode( } else { - p->ip_proto_next = (uint8_t)codec_data.next_prot_id; + p->ip_proto_next = convert_protocolid_to_ipprotocol(codec_data.next_prot_id); } } @@ -262,7 +262,7 @@ void PacketManager::decode( // internal statistics and record keeping s_stats[mapped_prot + stat_offset]++; // add correct decode for previous layer - mapped_prot = CodecManager::s_proto_map[codec_data.next_prot_id]; + mapped_prot = CodecManager::s_proto_map[to_utype(codec_data.next_prot_id)]; prev_prot_id = codec_data.next_prot_id; // set for next call @@ -271,7 +271,7 @@ void PacketManager::decode( raw.len -= curr_lyr_len; raw.data += curr_lyr_len; p->proto_bits |= codec_data.proto_bits; - codec_data.next_prot_id = FINISHED_DECODE; + codec_data.next_prot_id = ProtocolId::FINISHED_DECODE; codec_data.lyr_len = 0; codec_data.invalid_bytes = 0; codec_data.proto_bits = 0; @@ -285,7 +285,7 @@ void PacketManager::decode( s_stats[mapped_prot + stat_offset]++; // if the final protocol ID is not the default codec, a Codec failed - if (prev_prot_id != FINISHED_DECODE) + if (prev_prot_id != ProtocolId::FINISHED_DECODE) { if (codec_data.codec_flags & CODEC_UNSURE_ENCAP) { @@ -293,30 +293,32 @@ void PacketManager::decode( switch (p->layers[p->num_layers-1].prot_id) { - case IPPROTO_ID_ESP: + case ProtocolId::ESP: // Hardcoding ESP because we trust iff the layer // immediately preceding the fail is ESP. p->ptrs.decode_flags |= DECODE_PKT_TRUST; break; - case PROTO_TEREDO: + case ProtocolId::TEREDO: // if we just decoded teredo and the next // layer fails, we made a mistake. Therefore, // remove this bit. pop_teredo(p, raw); break; + default: + ; } /* switch */ } else { - if ( (p->num_layers > 0) && (p->layers[p->num_layers-1].prot_id == PROTO_TEREDO) && - (prev_prot_id == IPPROTO_IPV6) ) + if ( (p->num_layers > 0) && (p->layers[p->num_layers-1].prot_id == ProtocolId::TEREDO) && + (prev_prot_id == ProtocolId::IPV6) ) { pop_teredo(p, raw); } // if the codec exists, it failed - if (CodecManager::s_proto_map[prev_prot_id]) + if (CodecManager::s_proto_map[to_utype(prev_prot_id)]) { s_stats[discards]++; } @@ -324,8 +326,8 @@ void PacketManager::decode( { s_stats[other_codecs]++; - if ( (MIN_UNASSIGNED_IP_PROTO <= prev_prot_id) && - (prev_prot_id <= std::numeric_limits::max()) && + if ( (to_utype(ProtocolId::MIN_UNASSIGNED_IP_PROTO) <= to_utype(prev_prot_id)) && + (to_utype(prev_prot_id) <= std::numeric_limits::max()) && !(codec_data.codec_flags & CODEC_STREAM_REBUILT) ) { SnortEventqAdd(GID_DECODE, DECODE_IP_UNASSIGNED_PROTO); @@ -402,7 +404,7 @@ static inline uint8_t GetTTL(const Packet* const p, bool forward) bool PacketManager::encode(const Packet* p, EncodeFlags flags, uint8_t lyr_start, - uint8_t next_prot, + IpProtocol next_prot, Buffer& buf) { if ( encode_pkt ) @@ -431,7 +433,7 @@ bool PacketManager::encode(const Packet* p, for (int i = outer_layer; i > inner_layer; --i) { const Layer& l = lyrs[i]; - uint8_t mapped_prot = i ? CodecManager::s_proto_map[l.prot_id] : CodecManager::grinder; + ProtocolIndex mapped_prot = i ? CodecManager::s_proto_map[to_utype(l.prot_id)] : CodecManager::grinder; if (!CodecManager::s_protocols[mapped_prot]->encode(l.start, l.length, enc, buf)) { return false; @@ -447,7 +449,7 @@ bool PacketManager::encode(const Packet* p, for (int i = outer_layer; i >= 0; --i) { const Layer& l = lyrs[i]; - uint8_t mapped_prot = i ? CodecManager::s_proto_map[l.prot_id] : CodecManager::grinder; + ProtocolIndex mapped_prot = i ? CodecManager::s_proto_map[to_utype(l.prot_id)] : CodecManager::grinder; if (!CodecManager::s_protocols[mapped_prot]->encode(l.start, l.length, enc, buf)) { @@ -496,7 +498,7 @@ const uint8_t* PacketManager::encode_response( } // FIXIT-M -- check flags if we should skip something - if (encode(p, flags, p->num_layers-1, ENC_PROTO_UNSET, buf)) + if (encode(p, flags, p->num_layers-1, IpProtocol::PROTO_NOT_SET, buf)) { len = buf.size(); return buf.data() + buf.off; @@ -561,7 +563,7 @@ const uint8_t* PacketManager::encode_reject(UnreachResponse type, icmph->csum = checksum::icmp_cksum((uint16_t*)buf.data(), buf.size()); - if (encode(p, flags, inner_ip_index, IPPROTO_ID_ICMPV4, buf)) + if (encode(p, flags, inner_ip_index, IpProtocol::ICMPV4, buf)) { len = buf.size(); return buf.data() + buf.off; @@ -620,12 +622,12 @@ const uint8_t* PacketManager::encode_reject(UnreachResponse type, memcpy(ps6.sip, ip6h->get_src()->u6_addr8, sizeof(ps6.sip)); memcpy(ps6.dip, ip6h->get_dst()->u6_addr8, sizeof(ps6.dip)); ps6.zero = 0; - ps6.protocol = IPPROTO_ICMPV6; + ps6.protocol = IpProtocol::ICMPV6; ps6.len = htons((uint16_t)(ip_len)); icmph->csum = checksum::icmp_cksum((uint16_t*)buf.data(), ip_len, &ps6); - if (encode(p, flags, inner_ip_index, IPPROTO_ICMPV6, buf)) + if (encode(p, flags, inner_ip_index, IpProtocol::ICMPV6, buf)) { len = buf.size(); return buf.data() + buf.off; @@ -761,7 +763,7 @@ int PacketManager::encode_format( // NOTE: this must always go from outer to inner // to ensure a valid ip header - uint8_t mapped_prot = i ? CodecManager::s_proto_map[lyr->prot_id] : CodecManager::grinder; + ProtocolIndex mapped_prot = i ? CodecManager::s_proto_map[to_utype(lyr->prot_id)] : CodecManager::grinder; CodecManager::s_protocols[mapped_prot]->format( reverse, const_cast(lyr->start), c->ptrs); @@ -828,8 +830,8 @@ void PacketManager::encode_update(Packet* p) for (int i = outer_layer; i > inner_layer; --i) { const Layer& l = lyr[i]; - uint8_t mapped_prot = i ? - CodecManager::s_proto_map[l.prot_id] : CodecManager::grinder; + ProtocolIndex mapped_prot = i ? + CodecManager::s_proto_map[to_utype(l.prot_id)] : CodecManager::grinder; CodecManager::s_protocols[mapped_prot]->update( tmp_api, flags, const_cast(l.start), l.length, len); @@ -842,7 +844,7 @@ void PacketManager::encode_update(Packet* p) for (int i = outer_layer; i >= 0; --i) { const Layer& l = lyr[i]; - uint8_t mapped_prot = CodecManager::s_proto_map[l.prot_id]; + ProtocolIndex mapped_prot = CodecManager::s_proto_map[to_utype(l.prot_id)]; CodecManager::s_protocols[mapped_prot]->update( tmp_api, flags, const_cast(l.start), l.length, len); } @@ -891,7 +893,7 @@ void PacketManager::dump_stats() // zero out the default codecs g_stats[3] = 0; - g_stats[CodecManager::s_proto_map[FINISHED_DECODE] + stat_offset] = 0; + g_stats[CodecManager::s_proto_map[to_utype(ProtocolId::FINISHED_DECODE)] + stat_offset] = 0; for (unsigned int i = 0; i < stat_names.size(); i++) pkt_names.push_back(stat_names[i]); @@ -913,11 +915,11 @@ void PacketManager::accumulate() // mutex is automatically unlocked } -const char* PacketManager::get_proto_name(uint16_t protocol) -{ return CodecManager::s_protocols[CodecManager::s_proto_map[protocol]]->get_name(); } +const char* PacketManager::get_proto_name(ProtocolId protocol) +{ return CodecManager::s_protocols[CodecManager::s_proto_map[to_utype(protocol)]]->get_name(); } -const char* PacketManager::get_proto_name(uint8_t protocol) -{ return CodecManager::s_protocols[CodecManager::s_proto_map[protocol]]->get_name(); } +const char* PacketManager::get_proto_name(IpProtocol protocol) +{ return CodecManager::s_protocols[CodecManager::s_proto_map[to_utype(protocol)]]->get_name(); } void PacketManager::log_protocols(TextLog* const text_log, const Packet* const p) @@ -935,18 +937,16 @@ void PacketManager::log_protocols(TextLog* const text_log, for (int i = 1; i < num_layers; i++) { - const uint16_t protocol = lyr[i].prot_id; + const auto protocol = to_utype(lyr[i].prot_id); const uint8_t codec_offset = CodecManager::s_proto_map[protocol]; cd = CodecManager::s_protocols[codec_offset]; TextLog_NewLine(text_log); TextLog_Print(text_log, "%-.*s", 6, cd->get_name()); - // don't print the type if this is a custom type. Look - // in protocol_ids.h for more details. if (protocol <= 0xFF) TextLog_Print(text_log, "(0x%02x)", protocol); - else if (protocol >= eth::MIN_ETHERTYPE) + else TextLog_Print(text_log, "(0x%04x)", protocol); TextLog_Puts(text_log, ": "); diff --git a/src/protocols/packet_manager.h b/src/protocols/packet_manager.h index 078c8b48a..24d80b4d9 100644 --- a/src/protocols/packet_manager.h +++ b/src/protocols/packet_manager.h @@ -123,11 +123,11 @@ public: // print codec information. MUST be called after thread_term. static void dump_stats(); - // Get the name of the given protocol - static const char* get_proto_name(uint16_t protocol); + // Get the name of the given protocol ID + static const char* get_proto_name(ProtocolId); - // Get the name of the given protocol - static const char* get_proto_name(uint8_t protocol); + // Get the name of the given IP protocol + static const char* get_proto_name(IpProtocol); // print this packets information, layer by layer static void log_protocols(TextLog* const, const Packet* const); @@ -140,11 +140,11 @@ public: { return CodecManager::s_protocols.size(); } /* If a proto was registered in a Codec's get_protocol_ids() function, - * this function will return the 'ID' of the Codec to which the proto belongs. + * this function will return the 'ProtocolIndex' of the Codec to which the proto belongs. * If none of the loaded Codecs registered that proto, this function will * return zero. */ - static uint8_t proto_id(uint16_t proto) - { return CodecManager::s_proto_map[proto]; } + static ProtocolIndex proto_idx(ProtocolId prot_id) + { return CodecManager::s_proto_map[to_utype(prot_id)]; } private: // The only time we should accumulate is when CodecManager tells us too @@ -153,7 +153,7 @@ private: static void pop_teredo(Packet*, RawData&); static bool encode(const Packet* p, EncodeFlags, - uint8_t lyr_start, uint8_t next_prot, Buffer& buf); + uint8_t lyr_start, IpProtocol next_prot, Buffer& buf); // constant offsets into the s_stats array. Notice the stat_offset // constant which is used when adding a protocol specific codec diff --git a/src/protocols/protocol_ids.h b/src/protocols/protocol_ids.h index 497dcbc69..53c797db1 100644 --- a/src/protocols/protocol_ids.h +++ b/src/protocols/protocol_ids.h @@ -20,13 +20,14 @@ #ifndef PROTOCOLS_PROTOCOL_IDS_H #define PROTOCOLS_PROTOCOL_IDS_H +#include +#include +#include +#include + /***************************************************************** ***** NOTE: Protocols are only included in this file when **** - ***** their IDs are needed throughout multiple **** - ***** files. If a protocol ID is only needed in **** - ***** one file, define that number as a **** - ***** static const uint16_t ID_NAME = ZZZZ **** - ***** in the specific file. **** + ***** their IDs are needed. **** ****************************************************************/ /* @@ -36,11 +37,126 @@ * 1536 (0x6000) - 65536 (0xFFFF) --> Ethertypes */ +// Convert enum to a value cast to the enum's underlying type. +template +constexpr auto to_utype(En t) -> typename std::underlying_type::type +{ + return static_cast::type>(t); +} + + +using ProtocolIndex = uint8_t; + /* * Below is a partial list of protocol numbers for the IP protocols. * Defined at: * http://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml */ +enum class IpProtocol : std::uint8_t +{ + IP = 0, + HOPOPTS = 0, + ICMPV4 = 1, + IGMP = 2, + IPIP = 4, + TCP = 6, + UDP = 17, + IPV6 = 41, + ROUTING = 43, + FRAGMENT = 44, + GRE = 47, + ESP = 50, + AUTH = 51, // RFC 4302 + SWIPE = 53, + MOBILITY = 55, + ICMPV6 = 58, + NONEXT = 59, + DSTOPTS = 60, + SUN_ND = 77, + PGM = 113, + + /* Last updated 3/31/2016. + Source: http://www.iana.org/assignments/protocol-numbers/protocol-numbers.xml */ + MIN_UNASSIGNED_IP_PROTO = 143, + + RESERVED = 255, // == 0xFF + PORT_SCAN = 255, + PROTO_NOT_SET = 255, // Indicates protocol has not been set. +}; + + +// Values up to 255 MUST be identical to those in IpProtocol. +enum class ProtocolId : std::uint16_t +{ + ETHERTYPE_NOT_SET = 0, + IP = 0, + HOPOPTS = 0, + ICMPV4 = 1, + IGMP = 2, + IPIP = 4, + TCP = 6, + UDP = 17, + IPV6 = 41, + ROUTING = 43, + FRAGMENT = 44, + GRE = 47, + ESP = 50, + AUTH = 51, // RFC 4302 + SWIPE = 53, + MOBILITY = 55, + ICMPV6 = 58, + NONEXT = 59, + DSTOPTS = 60, + SUN_ND = 77, + PGM = 113, + + /* Last updated 3/31/2016. + Source: http://www.iana.org/assignments/protocol-numbers/protocol-numbers.xml */ + MIN_UNASSIGNED_IP_PROTO = 143, + + RESERVED = 255, // == 0xFF + PORT_SCAN = 255, + PROTO_NOT_SET = 255, // Indicates protocol has not been set. + + /* + * Undefined Protocol! + */ + FINISHED_DECODE = 0x0100, // Indicates Codecs have succesfully decoded packet + TEREDO = 0x0101, + GTP = 0x0102, + IP_EMBEDDED_IN_ICMP4 = 0x0103, + IP_EMBEDDED_IN_ICMP6 = 0x0104, + ETHERNET_802_3 = 0x0105, + ETHERNET_802_11 = 0x0106, + ETHERNET_LLC = 0x0107, + + /* + * Below is a partial list of ethertypes. + * Defined at: + * http://www.iana.org/assignments/ieee-802-numbers/ieee-802-numbers.xhtml + */ + ETHERTYPE_MINIMUM = 0x0600, // 1536 - lowest ethertype value. + ETHERTYPE_ERSPAN_TYPE3 = 0x22eb, + ETHERTYPE_TRANS_ETHER_BRIDGING = 0x6558, + ETHERTYPE_IPV4 = 0x0800, + ETHERTYPE_REVARP = 0x8035, + ETHERTYPE_ARP = 0x0806, + ETHERTYPE_8021Q = 0x8100, + ETHERTYPE_IPX = 0x8137, + ETHERTYPE_IPV6 = 0x86dd, + ETHERTYPE_PPP = 0x880B, + ETHERTYPE_MPLS_UNICAST = 0x8847, + ETHERTYPE_MPLS_MULTICAST = 0x8848, + ETHERTYPE_PPPOE_DISC = 0x8863, + ETHERTYPE_PPPOE_SESS = 0x8864, + ETHERTYPE_EAPOL = 0x888e, + ETHERTYPE_ERSPAN_TYPE2 = 0x88be, + ETHERTYPE_FPATH = 0x8903, +}; + +static const auto max_protocol_id = std::numeric_limits::type>::max(); + +#if 0 constexpr uint16_t IPPROTO_ID_HOPOPTS = 0; constexpr uint16_t IPPROTO_ID_ICMPV4 = 1; constexpr uint16_t IPPROTO_ID_IPIP = 4; @@ -58,8 +174,6 @@ constexpr uint16_t IPPROTO_ID_NONEXT = 59; constexpr uint16_t IPPROTO_ID_DSTOPTS = 60; constexpr uint16_t IPPROTO_ID_RESERVED = 255; // == 0xFF -/* Last updated 2/4/2015. - Source: http://www.iana.org/assignments/protocol-numbers/protocol-numbers.xml */ constexpr uint16_t MIN_UNASSIGNED_IP_PROTO = 143; /* @@ -91,22 +205,30 @@ constexpr uint16_t ETHERTYPE_IPV6 = 0x86dd; constexpr uint16_t ETHERTYPE_PPP = 0x880B; constexpr uint16_t ETHERTYPE_EAPOL = 0x888e; constexpr uint16_t ETHERTYPE_FPATH = 0x8903; +#endif + +inline IpProtocol convert_protocolid_to_ipprotocol(const ProtocolId prot_id) +{ + assert(to_utype(prot_id) <= UINT8_MAX); + + return IpProtocol(prot_id); +} -inline bool is_ip6_extension(const uint16_t proto) +inline bool is_ip6_extension(const ProtocolId prot_id) { - if(proto > UINT8_MAX) + if(to_utype(prot_id) > UINT8_MAX) return false; - switch (proto) + switch (prot_id) { - case IPPROTO_ID_HOPOPTS: - case IPPROTO_ID_DSTOPTS: - case IPPROTO_ID_ROUTING: - case IPPROTO_ID_FRAGMENT: - case IPPROTO_ID_AUTH: - case IPPROTO_ID_ESP: - case IPPROTO_ID_MOBILITY: - case IPPROTO_ID_NONEXT: + case ProtocolId::HOPOPTS: + case ProtocolId::DSTOPTS: + case ProtocolId::ROUTING: + case ProtocolId::FRAGMENT: + case ProtocolId::AUTH: + case ProtocolId::ESP: + case ProtocolId::MOBILITY: + case ProtocolId::NONEXT: return true; default: return false; diff --git a/src/service_inspectors/sip/sip_dialog.cc b/src/service_inspectors/sip/sip_dialog.cc index 13fc18879..8a802b9ed 100644 --- a/src/service_inspectors/sip/sip_dialog.cc +++ b/src/service_inspectors/sip/sip_dialog.cc @@ -409,7 +409,7 @@ static int SIP_ignoreChannels(SIP_DialogData* dialog, Packet* p, SIP_PROTO_CONF* /* Call into Streams to mark data channel as something to ignore. */ FlowData* fd = stream.get_application_data_from_ip_port( - (uint8_t)PktType::UDP, IPPROTO_UDP, &mdataA->maddress,mdataA->mport, + PktType::UDP, IpProtocol::UDP, &mdataA->maddress,mdataA->mport, &mdataB->maddress, mdataB->mport, 0, 0, p->pkth->address_space_id, SipFlowData::flow_id); if ( fd ) diff --git a/src/stream/icmp/icmp_session.cc b/src/stream/icmp/icmp_session.cc index 7ae84e0f8..c9bb0a618 100644 --- a/src/stream/icmp/icmp_session.cc +++ b/src/stream/icmp/icmp_session.cc @@ -91,7 +91,7 @@ static int ProcessIcmpUnreach(Packet* p) src = iph.get_src(); dst = iph.get_dst(); - skey.protocol = p->get_ip_proto_next(); + skey.pkt_type = p->type(); skey.version = src->is_ip4() ? 4 : 6; if (p->proto_bits & PROTO_BIT__TCP_EMBED_ICMP) diff --git a/src/stream/ip/ip_defrag.cc b/src/stream/ip/ip_defrag.cc index 6971f4bdf..68acfffdc 100644 --- a/src/stream/ip/ip_defrag.cc +++ b/src/stream/ip/ip_defrag.cc @@ -646,7 +646,7 @@ int drop_all_fragments( Packet* p ) { - if ( !p->flow || p->flow->protocol != PktType::IP ) + if ( !p->flow || p->flow->pkt_type != PktType::IP ) return -1; FragTracker* ft = &((IpSession*)p->flow->session)->tracker; @@ -868,18 +868,19 @@ static void FragRebuild(FragTracker* ft, Packet* p) const Layer& lyr = dpkt->layers[dpkt->num_layers-1]; - if ((lyr.prot_id == ETHERTYPE_IPV6) || (lyr.prot_id == IPPROTO_ID_IPV6)) + if ((lyr.prot_id == ProtocolId::ETHERTYPE_IPV6) || (lyr.prot_id == ProtocolId::IPV6)) { ip::IP6Hdr* const rawHdr = const_cast(dpkt->ptrs.ip_api.get_ip6h()); - rawHdr->ip6_next = ft->protocol; + const_cast(dpkt->ptrs.ip_api.get_ip6h()); + rawHdr->ip6_next = ft->ip_proto; } else { ip::IP6Extension* const ip6_ext = const_cast( reinterpret_cast(lyr.start)); - ip6_ext->ip6e_nxt = ft->protocol; + ip6_ext->ip6e_nxt = ft->ip_proto; } dpkt->dsize = (uint16_t)ft->calculated_size; @@ -1139,7 +1140,7 @@ void Defrag::process(Packet* p, FragTracker* ft) */ // FIXIT-M Since we no longer let UDP through, does this detection still work? if ((frag_offset != 0)) /* || - ((p->get_ip_proto_next() != IPPROTO_UDP) && (p->ptrs.decode_flags & DECODE_MF))) */ + ((p->get_ip_proto_next() != IpProtocol::UDP) && (p->ptrs.decode_flags & DECODE_MF))) */ { DisableDetect(); } @@ -1280,7 +1281,7 @@ void Defrag::process(Packet* p, FragTracker* ft) FragRebuild(ft, p); if (frag_offset != 0 || - (p->get_ip_proto_next() != IPPROTO_UDP && ft->frag_flags & FRAG_REBUILT)) + (p->get_ip_proto_next() != IpProtocol::UDP && ft->frag_flags & FRAG_REBUILT)) { // Need to reset some things here because the rebuilt packet // will have reset the do_detect flag when it hits Inspect. @@ -1346,9 +1347,9 @@ int Defrag::insert(Packet* p, FragTracker* ft, FragEngine* fe) if (p->is_ip6() && (net_frag_offset == 0)) { const ip::IP6Frag* const fragHdr = layer::get_inner_ip6_frag(); - if (ft->protocol != fragHdr->ip6f_nxt) + if (ft->ip_proto != fragHdr->ip6f_nxt) { - ft->protocol = fragHdr->ip6f_nxt; + ft->ip_proto = fragHdr->ip6f_nxt; } } @@ -2069,7 +2070,7 @@ int Defrag::new_tracker(Packet* p, FragTracker* ft) if ( p->is_ip4() ) { const ip::IP4Hdr* const ip4h = p->ptrs.ip_api.get_ip4h(); - ft->protocol = ip4h->proto(); + ft->ip_proto = ip4h->proto(); frag_off = ip4h->off(); } else /* IPv6 */ @@ -2079,7 +2080,7 @@ int Defrag::new_tracker(Packet* p, FragTracker* ft) frag_off = fragHdr->off(); if (frag_off == 0) - ft->protocol = fragHdr->ip6f_nxt; + ft->ip_proto = fragHdr->ip6f_nxt; } ft->ttl = p->ptrs.ip_api.ttl(); /* store the first ttl we got */ diff --git a/src/stream/ip/ip_session.h b/src/stream/ip/ip_session.h index 69b833a69..618c2f11d 100644 --- a/src/stream/ip/ip_session.h +++ b/src/stream/ip/ip_session.h @@ -35,7 +35,7 @@ struct FragEngine; /* tracker for a fragmented packet set */ struct FragTracker { - uint8_t protocol; /* IP protocol */ + IpProtocol ip_proto; /* IP protocol */ uint8_t ttl; /* ttl used to detect evasions */ uint8_t alerted; @@ -68,6 +68,8 @@ struct FragTracker FragEngine* engine; int ordinal; + + // FIXIT-M: Why do we have this ipprotocol? Is this ProtocolId? int ipprotocol; int application_protocol; uint32_t frag_policy; diff --git a/src/stream/libtcp/tcp_stream_session.cc b/src/stream/libtcp/tcp_stream_session.cc index 2f60b5992..062334c92 100644 --- a/src/stream/libtcp/tcp_stream_session.cc +++ b/src/stream/libtcp/tcp_stream_session.cc @@ -49,7 +49,7 @@ TcpStreamSession::~TcpStreamSession(void) void TcpStreamSession::init_new_tcp_session(TcpSegmentDescriptor& tsd) { - flow->protocol = tsd.get_pkt()->type(); + flow->pkt_type = tsd.get_pkt()->type(); /* New session, previous was marked as reset. Clear the reset flag. */ flow->clear_session_flags(SSNFLAG_RESET); diff --git a/src/stream/stream_api.cc b/src/stream/stream_api.cc index 26d45a3ed..c9c2d660f 100644 --- a/src/stream/stream_api.cc +++ b/src/stream/stream_api.cc @@ -87,7 +87,7 @@ void Stream::delete_session(const FlowKey* key) //------------------------------------------------------------------------- Flow* Stream::get_session_ptr_from_ip_port( - uint8_t type, uint8_t proto, + PktType type, IpProtocol proto, const sfip_t* srcIP, uint16_t srcPort, const sfip_t* dstIP, uint16_t dstPort, uint16_t vlan, uint32_t mplsId, uint16_t addressSpaceId) @@ -105,7 +105,7 @@ void Stream::populate_session_key(Packet* p, FlowKey* key) return; key->init( - (uint8_t)p->type(), p->get_ip_proto_next(), + p->type(), p->get_ip_proto_next(), p->ptrs.ip_api.get_src(), p->ptrs.sp, p->ptrs.ip_api.get_dst(), p->ptrs.dp, // if the vlan protocol bit is defined, vlan layer gauranteed to exist @@ -138,7 +138,7 @@ FlowData* Stream::get_application_data_from_key( } FlowData* Stream::get_application_data_from_ip_port( - uint8_t type, uint8_t proto, + PktType type, IpProtocol proto, const sfip_t* srcIP, uint16_t srcPort, const sfip_t* dstIP, uint16_t dstPort, uint16_t vlan, uint32_t mplsId, @@ -228,7 +228,7 @@ void Stream::stop_inspection( } /* Flush any queued data on the client and/or server */ - if (flow->protocol == PktType::TCP) + if (flow->pkt_type == PktType::TCP) { if (flow->ssn_state.ignore_direction & SSN_DIR_FROM_CLIENT) flow->session->flush_client(p); @@ -661,7 +661,7 @@ bool Stream::expired_session(Flow* flow, Packet* p) /* This should preferably only be called when ipprotocol is 0. */ void Stream::set_ip_protocol(Flow* flow) { - switch (flow->protocol) + switch (flow->pkt_type) { case PktType::TCP: flow->ssn_state.ipprotocol = SNORT_PROTO_TCP; diff --git a/src/stream/stream_api.h b/src/stream/stream_api.h index 133e17102..3cd203158 100644 --- a/src/stream/stream_api.h +++ b/src/stream/stream_api.h @@ -204,7 +204,7 @@ public: // Get pointer to application data for a flow based on the lookup tuples for cases where // Snort does not have an active packet that is relevant. static FlowData* get_application_data_from_ip_port( - uint8_t type, uint8_t proto, + PktType type, IpProtocol proto, const sfip_t *a1, uint16_t p1, const sfip_t *a2, uint16_t p2, uint16_t vlanId, uint32_t mplsId, uint16_t addrSpaceId, unsigned flow_id); @@ -223,7 +223,7 @@ public: // Get pointer to a session flow instance for a flow based on the lookup tuples for // cases where Snort does not have an active packet that is relevant. static Flow* get_session_ptr_from_ip_port( - uint8_t type, uint8_t proto, + PktType type, IpProtocol proto, const sfip_t *a1, uint16_t p1, const sfip_t *a2, uint16_t p2, uint16_t vlanId, uint32_t mplsId, uint16_t addrSpaceId); diff --git a/src/stream/tcp/tcp_session.cc b/src/stream/tcp/tcp_session.cc index 534d9e5be..19aa4b04a 100644 --- a/src/stream/tcp/tcp_session.cc +++ b/src/stream/tcp/tcp_session.cc @@ -1046,7 +1046,7 @@ bool TcpSession::is_flow_handling_packets(Packet* p) bool flow_ready = true; // FIXIT-L can't get here without protocol being set to TCP, is this really needed?? - if (flow->protocol != PktType::TCP) + if (flow->pkt_type != PktType::TCP) { DebugMessage(DEBUG_STREAM_STATE, "Lightweight session not TCP on TCP packet\n"); flow_ready = false; diff --git a/src/stream/udp/udp_session.cc b/src/stream/udp/udp_session.cc index f8c43c7d8..459557c75 100644 --- a/src/stream/udp/udp_session.cc +++ b/src/stream/udp/udp_session.cc @@ -70,7 +70,7 @@ static void UdpSessionCleanup(Flow* lwssn) static int ProcessUdp( Flow* lwssn, Packet* p, StreamUdpConfig*, SFXHASH_NODE*) { - assert(lwssn->protocol == PktType::UDP); + assert(lwssn->pkt_type == PktType::UDP); if ( stream.blocked_session(lwssn, p) ) return 0; @@ -123,7 +123,7 @@ bool UdpSession::setup(Packet* p) ssn_time.tv_usec = p->pkth->ts.tv_usec; flow->ssn_state.session_flags |= SSNFLAG_SEEN_SENDER; - flow->protocol = p->type(); + flow->pkt_type = p->type(); flow->ssn_state.direction = FROM_CLIENT; StreamUdpConfig* pc = get_udp_cfg(flow->ssn_server); diff --git a/src/stream/user/user_session.cc b/src/stream/user/user_session.cc index 7698af677..db80f0a10 100644 --- a/src/stream/user/user_session.cc +++ b/src/stream/user/user_session.cc @@ -315,7 +315,7 @@ void UserSession::start(Packet* p, Flow* flow) } { - flow->protocol = p->type(); + flow->pkt_type = p->type(); if (flow->ssn_state.session_flags & SSNFLAG_RESET) flow->ssn_state.session_flags &= ~SSNFLAG_RESET;