From: Russ Combs (rucombs) Date: Fri, 7 Jul 2017 16:16:42 +0000 (-0400) Subject: Merge pull request #946 in SNORT/snort3 from user_dax to master X-Git-Tag: 3.0.0-239~27 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d39c32c41a84b39e45f18fdbc053356bbed515cc;p=thirdparty%2Fsnort3.git Merge pull request #946 in SNORT/snort3 from user_dax to master Squashed commit of the following: commit 6dae979e555eeec63b16f1c494cc075479119ace Author: Russ Combs Date: Thu Jul 6 21:20:04 2017 -0400 review: not sup and size check commit b23ad2fb260560fcd980a1a456d998c354068535 Author: Russ Combs Date: Thu Jul 6 21:13:48 2017 -0400 decode: fix counts when no layers are decoded commit 22596bc64fe69d91e0edf18db55f144ed80e784f Author: Russ Combs Date: Wed Jul 5 15:29:14 2017 -0400 daq_file: update for pci query commit 3f3fbd6bc99ae44532080f49d995ac2e27f3fe97 Author: Russ Combs Date: Wed Jul 5 14:54:11 2017 -0400 daq_hext: cleanup commit 6692812227307ff76064fbb7f6f4c76eb9111791 Author: Russ Combs Date: Wed Jul 5 14:49:16 2017 -0400 daq_hext, cd_user: query for pci --- diff --git a/daqs/daq_file.c b/daqs/daq_file.c index da46ae2dd..0447d88cb 100644 --- a/daqs/daq_file.c +++ b/daqs/daq_file.c @@ -24,6 +24,7 @@ #include "daq_user.h" +#include #include #include #include @@ -362,6 +363,20 @@ static int file_daq_set_filter (void* handle, const char* filter) return DAQ_ERROR_NOTSUP; } +static int file_query_flow(void *handle, const DAQ_PktHdr_t *hdr, DAQ_QueryFlow_t *query) +{ + FileImpl* impl = (FileImpl*)handle; + assert(hdr->priv_ptr == &impl->pci); // sanity check + + if ( query->type == DAQ_USR_QUERY_PCI ) + { + query->value = &impl->pci; + query->length = sizeof(impl->pci); + return DAQ_SUCCESS; + } + return DAQ_ERROR_NOTSUP; +} + //------------------------------------------------------------------------- #ifdef BUILDING_SO @@ -395,6 +410,7 @@ DAQ_Module_t file_daq_module_data = .hup_prep = NULL, .hup_apply = NULL, .hup_post = NULL, - .dp_add_dc = NULL + .dp_add_dc = NULL, + .query_flow = file_query_flow }; diff --git a/daqs/daq_hext.c b/daqs/daq_hext.c index e1c9814b0..ba74139cb 100644 --- a/daqs/daq_hext.c +++ b/daqs/daq_hext.c @@ -24,6 +24,7 @@ #include "daq_user.h" +#include #include #include #include @@ -67,13 +68,13 @@ typedef struct { DAQ_State state; DAQ_Stats_t stats; -} FileImpl; +} HextImpl; //------------------------------------------------------------------------- // utility functions //------------------------------------------------------------------------- -static void set_c2s(FileImpl* impl, int c2s) +static void set_c2s(HextImpl* impl, int c2s) { if ( c2s ) { @@ -109,7 +110,7 @@ static void parse_host(const char* s, uint32_t* addr, uint16_t* port) *port = atoi(s); } -static void parse_pci(FileImpl* impl, const char* s) +static void parse_pci(HextImpl* impl, const char* s) { parse_host(s, &impl->pci.src_addr, &impl->pci.src_port); @@ -127,7 +128,7 @@ static void parse_pci(FileImpl* impl, const char* s) impl->pci.flags &= ~DAQ_USR_FLAG_TO_SERVER; } -static unsigned flush(FileImpl* impl) +static unsigned flush(HextImpl* impl) { unsigned n = impl->idx; impl->idx = 0; @@ -174,7 +175,7 @@ static int unescape(char c, char* u) // $packet -> server // $client // $server -static void parse_command(FileImpl* impl, char* s) +static void parse_command(HextImpl* impl, char* s) { if ( !strncmp(s, "packet -> client", 16) ) set_c2s(impl, 0); @@ -193,7 +194,7 @@ static void parse_command(FileImpl* impl, char* s) } // load quoted string data into buffer up to snaplen -static void parse_string(FileImpl* impl, char* s) +static void parse_string(HextImpl* impl, char* s) { char t; @@ -205,7 +206,7 @@ static void parse_string(FileImpl* impl, char* s) } // load hex data into buffer up to snaplen -static void parse_hex(FileImpl* impl, char* s) +static void parse_hex(HextImpl* impl, char* s) { char* t = s; long x = strtol(t, &s, 16); @@ -217,7 +218,7 @@ static void parse_hex(FileImpl* impl, char* s) } } -static int parse(FileImpl* impl) +static int parse(HextImpl* impl) { char* s = impl->line; @@ -256,7 +257,7 @@ static int parse(FileImpl* impl) // file functions //------------------------------------------------------------------------- -static int hext_setup(FileImpl* impl) +static int hext_setup(HextImpl* impl) { if ( !strcmp(impl->name, "tty") ) { @@ -278,7 +279,7 @@ static int hext_setup(FileImpl* impl) return 0; } -static void hext_cleanup(FileImpl* impl) +static void hext_cleanup(HextImpl* impl) { if ( impl->fyle != stdin ) fclose(impl->fyle); @@ -286,7 +287,7 @@ static void hext_cleanup(FileImpl* impl) impl->fyle = NULL; } -static int hext_read(FileImpl* impl) +static int hext_read(HextImpl* impl) { int n = 0; @@ -326,7 +327,7 @@ static int hext_read(FileImpl* impl) //------------------------------------------------------------------------- static int get_vars ( - FileImpl* impl, const DAQ_Config_t* cfg, char* errBuf, size_t errMax + HextImpl* impl, const DAQ_Config_t* cfg, char* errBuf, size_t errMax ) { const char* s = NULL; DAQ_Dict* entry; @@ -348,7 +349,7 @@ static int get_vars ( return 1; } -static void set_pkt_hdr(FileImpl* impl, DAQ_PktHdr_t* phdr, ssize_t len) +static void set_pkt_hdr(HextImpl* impl, DAQ_PktHdr_t* phdr, ssize_t len) { struct timeval t; gettimeofday(&t, NULL); @@ -383,7 +384,7 @@ static void set_pkt_hdr(FileImpl* impl, DAQ_PktHdr_t* phdr, ssize_t len) } static int hext_daq_process( - FileImpl* impl, DAQ_Analysis_Func_t cb, void* user) + HextImpl* impl, DAQ_Analysis_Func_t cb, void* user) { DAQ_PktHdr_t hdr; int n = hext_read(impl); @@ -407,7 +408,7 @@ static int hext_daq_process( static void hext_daq_shutdown (void* handle) { - FileImpl* impl = (FileImpl*)handle; + HextImpl* impl = (HextImpl*)handle; if ( impl->name ) free(impl->name); @@ -423,7 +424,7 @@ static void hext_daq_shutdown (void* handle) static int hext_daq_initialize ( const DAQ_Config_t* cfg, void** handle, char* errBuf, size_t errMax) { - FileImpl* impl = calloc(1, sizeof(*impl)); + HextImpl* impl = calloc(1, sizeof(*impl)); if ( !impl ) { @@ -467,7 +468,7 @@ static int hext_daq_initialize ( static int hext_daq_start (void* handle) { - FileImpl* impl = (FileImpl*)handle; + HextImpl* impl = (HextImpl*)handle; if ( hext_setup(impl) ) return DAQ_ERROR; @@ -478,7 +479,7 @@ static int hext_daq_start (void* handle) static int hext_daq_stop (void* handle) { - FileImpl* impl = (FileImpl*)handle; + HextImpl* impl = (HextImpl*)handle; hext_cleanup(impl); impl->state = DAQ_STATE_STOPPED; return DAQ_SUCCESS; @@ -504,7 +505,7 @@ static int hext_daq_acquire ( { (void)meta; - FileImpl* impl = (FileImpl*)handle; + HextImpl* impl = (HextImpl*)handle; int hit = 0, miss = 0; impl->stop = 0; @@ -530,33 +531,33 @@ static int hext_daq_acquire ( static int hext_daq_breakloop (void* handle) { - FileImpl* impl = (FileImpl*)handle; + HextImpl* impl = (HextImpl*)handle; impl->stop = 1; return DAQ_SUCCESS; } static DAQ_State hext_daq_check_status (void* handle) { - FileImpl* impl = (FileImpl*)handle; + HextImpl* impl = (HextImpl*)handle; return impl->state; } static int hext_daq_get_stats (void* handle, DAQ_Stats_t* stats) { - FileImpl* impl = (FileImpl*)handle; + HextImpl* impl = (HextImpl*)handle; *stats = impl->stats; return DAQ_SUCCESS; } static void hext_daq_reset_stats (void* handle) { - FileImpl* impl = (FileImpl*)handle; + HextImpl* impl = (HextImpl*)handle; memset(&impl->stats, 0, sizeof(impl->stats)); } static int hext_daq_get_snaplen (void* handle) { - FileImpl* impl = (FileImpl*)handle; + HextImpl* impl = (HextImpl*)handle; return impl->snaplen; } @@ -569,19 +570,19 @@ static uint32_t hext_daq_get_capabilities (void* handle) static int hext_daq_get_datalink_type(void *handle) { - FileImpl* impl = (FileImpl*)handle; + HextImpl* impl = (HextImpl*)handle; return impl->dlt; } static const char* hext_daq_get_errbuf (void* handle) { - FileImpl* impl = (FileImpl*)handle; + HextImpl* impl = (HextImpl*)handle; return impl->error; } static void hext_daq_set_errbuf (void* handle, const char* s) { - FileImpl* impl = (FileImpl*)handle; + HextImpl* impl = (HextImpl*)handle; DPE(impl->error, "%s", s ? s : ""); } @@ -599,6 +600,20 @@ static int hext_daq_set_filter (void* handle, const char* filter) return DAQ_ERROR_NOTSUP; } +static int hext_query_flow(void *handle, const DAQ_PktHdr_t *hdr, DAQ_QueryFlow_t *query) +{ + HextImpl* impl = (HextImpl*)handle; + assert(hdr->priv_ptr == &impl->pci); // sanity check + + if ( query->type == DAQ_USR_QUERY_PCI ) + { + query->value = &impl->pci; + query->length = sizeof(impl->pci); + return DAQ_SUCCESS; + } + return DAQ_ERROR_NOTSUP; +} + //------------------------------------------------------------------------- #ifdef BUILDING_SO @@ -632,6 +647,7 @@ DAQ_Module_t hext_daq_module_data = .hup_prep = NULL, .hup_apply = NULL, .hup_post = NULL, - .dp_add_dc = NULL + .dp_add_dc = NULL, + .query_flow = hext_query_flow }; diff --git a/daqs/daq_user.h b/daqs/daq_user.h index 233637070..4fdcf955d 100644 --- a/daqs/daq_user.h +++ b/daqs/daq_user.h @@ -27,11 +27,15 @@ /* for raw payload only */ #define DLT_USER 230 +/* in: DAQ_QueryFlow_t.type */ +#define DAQ_USR_QUERY_PCI 1000 + +/* DAQ_UsrHdr_t.flags */ #define DAQ_USR_FLAG_TO_SERVER 0x01 #define DAQ_USR_FLAG_START_FLOW 0x02 #define DAQ_USR_FLAG_END_FLOW 0x04 -/* user-related DAQs set priv_ptr to this */ +/* out: DAQ_QueryFlow_t.value */ typedef struct { uint32_t src_addr; diff --git a/src/codecs/misc/cd_user.cc b/src/codecs/misc/cd_user.cc index 3029b24c6..fccdc6e2c 100644 --- a/src/codecs/misc/cd_user.cc +++ b/src/codecs/misc/cd_user.cc @@ -25,6 +25,7 @@ #include "daqs/daq_user.h" #include "framework/codec.h" +#include "packet_io/sfdaq.h" #define CD_NAME "user" #define CD_HELP_STR "support for user sessions" @@ -96,7 +97,18 @@ static void set_flags( bool UserCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort) { - const DAQ_UsrHdr_t* pci = (DAQ_UsrHdr_t*)raw.pkth->priv_ptr; + DAQ_QueryFlow_t query { DAQ_USR_QUERY_PCI, 0, nullptr }; + + if ( SFDAQ::get_local_instance()->query_flow(raw.pkth, &query) != DAQ_SUCCESS or + query.length != sizeof(DAQ_UsrHdr_t) ) + { + return false; + } + + const DAQ_UsrHdr_t* pci = (DAQ_UsrHdr_t*)query.value; + + if ( !pci ) + return false; if ( pci->ip_proto ) { diff --git a/src/packet_io/sfdaq.cc b/src/packet_io/sfdaq.cc index 94102372d..c725af124 100644 --- a/src/packet_io/sfdaq.cc +++ b/src/packet_io/sfdaq.cc @@ -547,6 +547,11 @@ const DAQ_Stats_t* SFDAQInstance::get_stats() return &daq_stats; } +int SFDAQInstance::query_flow(const DAQ_PktHdr_t* hdr, DAQ_QueryFlow_t* query) +{ + return daq_query_flow(daq_mod, daq_hand, hdr, query); +} + int SFDAQInstance::modify_flow_opaque(const DAQ_PktHdr_t* hdr, uint32_t opaque) { DAQ_ModFlow_t mod; diff --git a/src/packet_io/sfdaq.h b/src/packet_io/sfdaq.h index 4b7709eca..69c15c7f0 100644 --- a/src/packet_io/sfdaq.h +++ b/src/packet_io/sfdaq.h @@ -38,28 +38,36 @@ class SFDAQInstance public: SFDAQInstance(const char* intf); ~SFDAQInstance(); + bool configure(const SnortConfig*); + void set_metacallback(DAQ_Meta_Func_t); + + bool start(); + bool was_started(); + bool stop(); + void reload(); void abort(); - const char* get_interface_spec(); + int get_base_protocol(); + const char* get_interface_spec(); + const DAQ_Stats_t* get_stats(); + bool can_inject(); bool can_inject_raw(); bool can_replace(); bool can_start_unprivileged(); bool can_whitelist(); - bool start(); - bool was_started(); - bool stop(); - void reload(); - void set_metacallback(DAQ_Meta_Func_t); + int acquire(int max, DAQ_Analysis_Func_t); int inject(const DAQ_PktHdr_t*, int rev, const uint8_t* buf, uint32_t len); bool break_loop(int error); - const DAQ_Stats_t* get_stats(); + + SO_PUBLIC int query_flow(const DAQ_PktHdr_t*, DAQ_QueryFlow_t*); int modify_flow_opaque(const DAQ_PktHdr_t*, uint32_t opaque); int add_expected(const Packet* ctrlPkt, const SfIp* cliIP, uint16_t cliPort, const SfIp* srvIP, uint16_t srvPort, IpProtocol, unsigned timeout_ms, unsigned /* flags */); + private: bool set_filter(const char*); std::string interface_spec; @@ -75,26 +83,32 @@ class SFDAQ public: static void load(const SnortConfig*); static void unload(); + static void print_types(std::ostream&); static void init(const SnortConfig*); static void term(); - static bool forwarding_packet(const DAQ_PktHdr_t*); + static const char* get_type(); - SO_PUBLIC static uint32_t get_snap_len(); - static bool unprivileged(); static const char* get_input_spec(const SnortConfig*, unsigned instance_id); static const char* default_type(); + static const DAQ_Stats_t* get_stats(); + + static bool unprivileged(); + static bool can_inject(); + static bool can_inject_raw(); + static bool can_replace(); + // FIXIT-M X Temporary thread-local instance helpers to be removed when no longer needed static void set_local_instance(SFDAQInstance*); - static SFDAQInstance* get_local_instance(); + + SO_PUBLIC static SFDAQInstance* get_local_instance(); SO_PUBLIC static const char* get_interface_spec(); SO_PUBLIC static int get_base_protocol(); - static bool can_inject(); - static bool can_inject_raw(); - static bool can_replace(); + SO_PUBLIC static uint32_t get_snap_len(); + static int inject(const DAQ_PktHdr_t*, int rev, const uint8_t* buf, uint32_t len); + static bool forwarding_packet(const DAQ_PktHdr_t*); static bool break_loop(int error); - static const DAQ_Stats_t* get_stats(); }; #endif diff --git a/src/protocols/packet_manager.cc b/src/protocols/packet_manager.cc index bf126c93b..09a5158c7 100644 --- a/src/protocols/packet_manager.cc +++ b/src/protocols/packet_manager.cc @@ -232,10 +232,11 @@ void PacketManager::decode( CodecManager::s_protocols[mapped_prot]->get_name(), static_cast(prev_prot_id), pkt, (unsigned long)codec_data.lyr_len); - s_stats[mapped_prot + stat_offset]++; + if ( p->num_layers > 0 ) + s_stats[mapped_prot + stat_offset]++; // if the final protocol ID is not the default codec, a Codec failed - if (prev_prot_id != ProtocolId::FINISHED_DECODE) + if (prev_prot_id != ProtocolId::FINISHED_DECODE or p->num_layers == 0 ) { if (codec_data.codec_flags & CODEC_UNSURE_ENCAP) {