From: Josh Date: Thu, 1 May 2014 19:02:22 +0000 (-0400) Subject: fixing warnings. seperating igmp pgm. adding cpack X-Git-Tag: 3.0.0-233~1537 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d444b5ca951e9b80a2ff0245529908a70613c7ab;p=thirdparty%2Fsnort3.git fixing warnings. seperating igmp pgm. adding cpack --- diff --git a/.gitignore b/.gitignore index 35f741da7..9e02e8d1d 100644 --- a/.gitignore +++ b/.gitignore @@ -29,6 +29,7 @@ doc/snort_manual.chunked/ doc/snort_manual.html doc/snort_manual.pdf doc/snort_manual.tgz +doc/snort_manual.xml install-sh libtool ltmain.sh diff --git a/CMakeLists.txt b/CMakeLists.txt index 72410ed9b..201b924b6 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -40,3 +40,30 @@ add_custom_target(uninstall COMMAND ${CMAKE_COMMAND} -P ${CMAKE_CURRENT_BINARY_DIR}/cmake_uninstall.cmake) + +## FOO FOR BUILDING ARCHIVE PACKAGES!! + +set (CPACK_GENERATOR TGZ ZIP TGZ TZ STGZ) +set (CPACK_PACKAGE_NAME "snort") + +# This will always be false unless manually set +if (BUILD_DEBIAN_ARCHIVE) + list(APPEND CPACK_GENERATOR DEB) +endif() + +SET(CPACK_DEBIAN_PACKAGE_MAINTAINER "SNORT-TEAM") #required + +# RPM foo +set( CPACK_RPM_PACKAGE_SUMMARY "The snort RPM package summary") +set( CPACK_RPM_PACKAGE_NAME "snort-rpm") +set( CPACK_RPM_PACKAGE_VERSION "${SNORT_VERSION_MAJOR}.${SNORT_VERSION_MINOR}.${SNORT_VERSION_BUILD}") +set( CPACK_RPM_PACKAGE_ARCHITECTURE "noarch") +set (CPACK_RPM_PACKAGE_RELEASE 1) +set( CPACK_RPM_PACKAGE_LICENSE "unknown") +#set( CPACK_RPM_PACKAGE_GROUP "unknown") +set( CPACK_RPM_PACKAGE_VENDOR "Cisco") +set( CPACK_RPM_PACKAGE_DESCRIPTION "Snort RPM") + + +include(CPack) + diff --git a/src/codecs/basic/cd_eth.cc b/src/codecs/basic/cd_eth.cc index 6fd60a54d..c847dee11 100644 --- a/src/codecs/basic/cd_eth.cc +++ b/src/codecs/basic/cd_eth.cc @@ -42,7 +42,7 @@ public: ~EthCodec(){}; - virtual void get_protocol_ids(std::vector& v) {}; + virtual void get_protocol_ids(std::vector&) {}; virtual void get_data_link_type(std::vector&); virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id); @@ -79,7 +79,7 @@ void EthCodec::get_data_link_type(std::vector&v) * Returns: void function */ bool EthCodec::decode(const uint8_t *raw_pkt, const uint32_t len, - Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) + Packet *p, uint16_t &lyr_len, uint16_t& next_prot_id) { // dc.eth++; diff --git a/src/codecs/basic/cd_icmp4.cc b/src/codecs/basic/cd_icmp4.cc index 54689bcbb..7bcaf0286 100644 --- a/src/codecs/basic/cd_icmp4.cc +++ b/src/codecs/basic/cd_icmp4.cc @@ -90,7 +90,7 @@ void Icmp4Codec::get_protocol_ids(std::vector &v) * Returns: void function */ bool Icmp4Codec::decode(const uint8_t* raw_pkt, const uint32_t raw_len, - Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) + Packet *p, uint16_t &lyr_len, uint16_t& /*next_prot_id*/) { if(raw_len < icmp4::hdr_len()) { diff --git a/src/codecs/basic/cd_ipv4.cc b/src/codecs/basic/cd_ipv4.cc index 76d632f23..fd6548abc 100644 --- a/src/codecs/basic/cd_ipv4.cc +++ b/src/codecs/basic/cd_ipv4.cc @@ -426,6 +426,7 @@ inline void DecodeIPv4Proto(const uint8_t proto, p->dsize = (uint16_t)len; return; +#if 0 case IPPROTO_PGM: p->data = pkt; p->dsize = (uint16_t)len; @@ -438,6 +439,7 @@ inline void DecodeIPv4Proto(const uint8_t proto, p->dsize = (uint16_t)len; CheckIGMPVuln(p); return; +#endif default: if (GET_IPH_PROTO(p) >= MIN_UNASSIGNED_IP_PROTO) @@ -449,102 +451,8 @@ inline void DecodeIPv4Proto(const uint8_t proto, } } -static inline void CheckPGMVuln(Packet *p) -{ - if ( pgm_nak_detect((uint8_t *)p->data, p->dsize) == PGM_NAK_VULN ) - codec_events::decoder_event(p, DECODE_PGM_NAK_OVERFLOW); -} - - -//-------------------------------------------------------------------- -// IP4 vulnerabilities -//-------------------------------------------------------------------- - -/* This PGM NAK function started off as an SO rule, sid 8351. */ -static inline int pgm_nak_detect (uint8_t *data, uint16_t length) { - uint16_t data_left; - uint16_t checksum; - PGM_HEADER *header; - - if (NULL == data) { - return PGM_NAK_ERR; - } - - /* request must be bigger than 44 bytes to cause vuln */ - if (length <= sizeof(PGM_HEADER)) { - return PGM_NAK_ERR; - } - - header = (PGM_HEADER *) data; - - if (8 != header->type) { - return PGM_NAK_ERR; - } - - if (2 != header->nak.opt.type) { - return PGM_NAK_ERR; - } - - - /* - * alert if the amount of data after the options is more than the length - * specified. - */ - - - data_left = length - 36; - if (data_left > header->nak.opt.len) { - - /* checksum is expensive... do that only if the length is bad */ - if (header->checksum != 0) { - checksum = in_chksum_ip((unsigned short*)data, (int)length); - if (checksum != 0) - return PGM_NAK_ERR; - } - - return PGM_NAK_VULN; - } - - return PGM_NAK_OK; -} - -/* This function is a port of an old .so rule, sid 3:8092. */ -static inline void CheckIGMPVuln(Packet *p) -{ - int i, alert = 0; - - if (p->dsize >= 1 && p->data[0] == 0x11) - { - if (p->ip_options_data != NULL) { - if (p->ip_options_len >= 2) { - if (*(p->ip_options_data) == 0 && *(p->ip_options_data+1) == 0) - { - codec_events::decoder_event(p, DECODE_IGMP_OPTIONS_DOS); - return; - } - } - } - - for(i=0; i< (int) p->ip_option_count; i++) { - /* All IGMPv2 packets contain IP option code 148 (router alert). - This vulnerability only applies to IGMPv3, so return early. */ - if (ipv4::is_opt_rtralt(p->ip_options[i].code)) { - return; /* No alert. */ - } - - if (p->ip_options[i].len == 1) { - alert++; - } - } - - if (alert > 0) - codec_events::decoder_event(p, DECODE_IGMP_OPTIONS_DOS); - } -} - - -//-------------------------------------------------------------------- +//------------------------------------------------------------------ // decode.c::IP4 misc //-------------------------------------------------------------------- @@ -902,39 +810,6 @@ void IP4_Format (EncodeFlags f, const Packet* p, Packet* c, Layer* lyr) * blen - byte length * */ -static inline unsigned short in_chksum_ip( unsigned short * w, int blen ) -{ - unsigned int cksum; - - /* IP must be >= 20 bytes */ - cksum = w[0]; - cksum += w[1]; - cksum += w[2]; - cksum += w[3]; - cksum += w[4]; - cksum += w[5]; - cksum += w[6]; - cksum += w[7]; - cksum += w[8]; - cksum += w[9]; - - blen -= 20; - w += 10; - - while( blen ) /* IP-hdr must be an integral number of 4 byte words */ - { - cksum += w[0]; - cksum += w[1]; - w += 2; - blen -= 4; - } - - cksum = (cksum >> 16) + (cksum & 0x0000ffff); - cksum += (cksum >> 16); - - return (unsigned short) (~cksum); -} - //------------------------------------------------------------------------- diff --git a/src/codecs/codec_api.cc b/src/codecs/codec_api.cc index b1ae3aa40..08c2e77da 100644 --- a/src/codecs/codec_api.cc +++ b/src/codecs/codec_api.cc @@ -53,6 +53,8 @@ extern const BaseApi* cd_swipe; extern const BaseApi* cd_teredo; extern const BaseApi* cd_transbridge; extern const BaseApi* cd_vlan; +extern const BaseApi* cd_igmp; +extern const BaseApi* cd_pgm; #endif const BaseApi* codecs[] = diff --git a/src/codecs/plugins/CMakeLists.txt b/src/codecs/plugins/CMakeLists.txt index 9232726f6..15648a03e 100644 --- a/src/codecs/plugins/CMakeLists.txt +++ b/src/codecs/plugins/CMakeLists.txt @@ -14,6 +14,8 @@ add_library( codec_plugins STATIC cd_erspan3.cc cd_pppencap.cc cd_pppoepkt.cc + cd_igmp.cc + cd_pgm.cc ) target_link_libraries( codec_plugins diff --git a/src/codecs/plugins/cd_igmp.cc b/src/codecs/plugins/cd_igmp.cc new file mode 100644 index 000000000..a38ecd194 --- /dev/null +++ b/src/codecs/plugins/cd_igmp.cc @@ -0,0 +1,133 @@ +/* +** Copyright (C) 2002-2013 Sourcefire, Inc. +** Copyright (C) 1998-2002 Martin Roesch +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + + + +#ifdef HAVE_CONFIG_H +#include "config.h" +#endif + +#include "framework/codec.h" +#include "codecs/decode_module.h" +#include "events/codec_events.h" + + +namespace +{ + +class IgmpCodec : public Codec +{ +public: + IgmpCodec() : Codec("igmp"){}; + ~IgmpCodec() {}; + + + virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, + Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); + + virtual void get_protocol_ids(std::vector&); + virtual void get_data_link_type(std::vector&){}; + +}; + + +} // namespace + + + + + +bool IgmpCodec::decode(const uint8_t *raw_pkt, const uint32_t len, + Packet *p, uint16_t& /*lyr_len*/, uint16_t& /*next_prot_id*/) +{ + int i, alert = 0; + + if (len >= 1 && raw_pkt[0] == 0x11) + { + if (p->ip_options_data != NULL) { + if (p->ip_options_len >= 2) { + if (*(p->ip_options_data) == 0 && *(p->ip_options_data+1) == 0) + { + codec_events::decoder_event(p, DECODE_IGMP_OPTIONS_DOS); + return false; + } + } + } + + for(i=0; i< (int) p->ip_option_count; i++) { + /* All IGMPv2 packets contain IP option code 148 (router alert). + This vulnerability only applies to IGMPv3, so return early. */ + if (ipv4::is_opt_rtralt(p->ip_options[i].code)) { + return true; /* No alert. */ + } + + if (p->ip_options[i].len == 1) { + alert++; + } + } + + if (alert > 0) + codec_events::decoder_event(p, DECODE_IGMP_OPTIONS_DOS); + } + return true; +} + +void IgmpCodec::get_protocol_ids(std::vector& v) +{ + v.push_back(IPPROTO_IGMP); +} + + + +//------------------------------------------------------------------------- +// api +//------------------------------------------------------------------------- + +static Codec* ctor() +{ + return new IgmpCodec(); +} + +static void dtor(Codec *cd) +{ + delete cd; +} + + +static const char* name = "igmp"; +static const CodecApi igmp_api = +{ + { + PT_CODEC, + name, + CDAPI_PLUGIN_V0, + 0, + nullptr, + nullptr, + }, + nullptr, // pinit + nullptr, // pterm + nullptr, // tinit + nullptr, // tterm + ctor, // ctor + dtor, // dtor +}; + +const BaseApi* cd_igmp = &igmp_api.base; diff --git a/src/codecs/plugins/cd_pgm.cc b/src/codecs/plugins/cd_pgm.cc new file mode 100644 index 000000000..85bd8ad70 --- /dev/null +++ b/src/codecs/plugins/cd_pgm.cc @@ -0,0 +1,191 @@ +/* +** Copyright (C) 2002-2013 Sourcefire, Inc. +** Copyright (C) 1998-2002 Martin Roesch +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + + + +#ifdef HAVE_CONFIG_H +#include "config.h" +#endif + +#include "framework/codec.h" +#include "codecs/decode_module.h" +#include "events/codec_events.h" +#include "protocols/ipv4.h" + +namespace +{ + +class PgmCodec : public Codec +{ +public: + PgmCodec() : Codec("pgm"){}; + ~PgmCodec() {}; + + + virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, + Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); + + virtual void get_protocol_ids(std::vector&); + +}; + +#define PGM_NAK_ERR -1 +#define PGM_NAK_OK 0 +#define PGM_NAK_VULN 1 + +typedef struct _PGM_NAK_OPT +{ + uint8_t type; /* 02 = vuln */ + uint8_t len; + uint8_t res[2]; + uint32_t seq[1]; /* could be many many more, but 1 is sufficient */ +} PGM_NAK_OPT; + +typedef struct _PGM_NAK +{ + uint32_t seqnum; + uint16_t afil1; + uint16_t res1; + uint32_t src; + uint16_t afi2; + uint16_t res2; + uint32_t multi; + PGM_NAK_OPT opt; +} PGM_NAK; + +typedef struct _PGM_HEADER +{ + uint16_t srcport; + uint16_t dstport; + uint8_t type; + uint8_t opt; + uint16_t checksum; + uint8_t gsd[6]; + uint16_t length; + PGM_NAK nak; +} PGM_HEADER; + + +} // namespace + +/* This PGM NAK function started off as an SO rule, sid 8351. */ +static inline int pgm_nak_detect (uint8_t *data, uint16_t length) { + uint16_t data_left; + uint16_t checksum; + PGM_HEADER *header; + + if (NULL == data) { + return PGM_NAK_ERR; + } + + /* request must be bigger than 44 bytes to cause vuln */ + if (length <= sizeof(PGM_HEADER)) { + return PGM_NAK_ERR; + } + + header = (PGM_HEADER *) data; + + if (8 != header->type) { + return PGM_NAK_ERR; + } + + if (2 != header->nak.opt.type) { + return PGM_NAK_ERR; + } + + + /* + * alert if the amount of data after the options is more than the length + * specified. + */ + + + data_left = length - 36; + if (data_left > header->nak.opt.len) { + + /* checksum is expensive... do that only if the length is bad */ + if (header->checksum != 0) { + checksum = in_chksum_ip((unsigned short*)data, (int)length); + if (checksum != 0) + return PGM_NAK_ERR; + } + + return PGM_NAK_VULN; + } + + return PGM_NAK_OK; +} + + +//------------------------------------------------------------------------- +// private functions +//------------------------------------------------------------------------- + +bool PgmCodec::decode(const uint8_t *raw_pkt, const uint32_t len, + Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) +{ + if ( pgm_nak_detect((uint8_t *)p->data, p->dsize) == PGM_NAK_VULN ) + codec_events::decoder_event(p, DECODE_PGM_NAK_OVERFLOW); + +} + +void PgmCodec::get_protocol_ids(std::vector& v) +{ + v.push_back(IPPROTO_PGM); +} + + + +//------------------------------------------------------------------------- +// api +//------------------------------------------------------------------------- + +static Codec* ctor() +{ + return new PgmCodec(); +} + +static void dtor(Codec *cd) +{ + delete cd; +} + + +static const char* name = "pgm"; +static const CodecApi pgm_api = +{ + { + PT_CODEC, + name, + CDAPI_PLUGIN_V0, + 0, + nullptr, + nullptr, + }, + nullptr, // pinit + nullptr, // pterm + nullptr, // tinit + nullptr, // tterm + ctor, // ctor + dtor, // dtor +}; + +const BaseApi* cd_pgm = &pgm_api.base; + diff --git a/src/codecs/template.cc b/src/codecs/template.cc index a55fd4698..9baac4adc 100644 --- a/src/codecs/template.cc +++ b/src/codecs/template.cc @@ -43,16 +43,13 @@ public: Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); virtual void get_protocol_ids(std::vector&); - virtual void get_data_link_type(std::vector&){}; + virtual void get_data_link_type(std::vector&); }; } // namespace -static THREAD_LOCAL CdPegs counts; -static CdPegs gcounts; - bool NameCodec::decode(const uint8_t *raw_pkt, const uint32_t len, Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) @@ -60,22 +57,22 @@ bool NameCodec::decode(const uint8_t *raw_pkt, const uint32_t len, } - -//------------------------------------------------------------------------- -// api -//------------------------------------------------------------------------- - - -static void get_data_link_type(std::vector&) +void NameCodec::get_data_link_type(std::vector&) { // v.push_back(DLT_ID); } -static void get_protocol_ids(std::vector& v) +void NameCodec::get_protocol_ids(std::vector& v) { // v.push_back(PROTO_TYPE); } + + +//------------------------------------------------------------------------- +// api +//------------------------------------------------------------------------- + static Codec* ctor() { return new NameCodec(); @@ -87,15 +84,24 @@ static void dtor(Codec *cd) } -static const char* name = "name_codec"; -static const CodecApi codec_api = +static const char* name = "name"; +static const CodecApi name_api = { - { PT_CODEC, name, CDAPI_PLUGIN_V0, 0 }, - NULL, // pinit - NULL, // pterm - NULL, // tinit - NULL, // tterm + { + PT_CODEC, + name, + CDAPI_PLUGIN_V0, + 0, + nullptr, + nullptr, + }, + nullptr, // pinit + nullptr, // pterm + nullptr, // tinit + nullptr, // tterm ctor, // ctor dtor, // dtor }; + +const BaseApi* cd_name = &name_api.base; diff --git a/src/events/CMakeLists.txt b/src/events/CMakeLists.txt index 14d0504f2..471b63109 100644 --- a/src/events/CMakeLists.txt +++ b/src/events/CMakeLists.txt @@ -15,6 +15,7 @@ add_library (events STATIC sfeventq.cc sfeventq.h codec_events.cc + ${INCLUDES} ) install (FILES ${INCLUDES} diff --git a/src/main/CMakeLists.txt b/src/main/CMakeLists.txt index 0257cecc5..bec455686 100644 --- a/src/main/CMakeLists.txt +++ b/src/main/CMakeLists.txt @@ -20,6 +20,7 @@ add_library (main STATIC snort_debug.cc snort_config.h snort_config.cc + ${INCLUDES} ) @@ -32,4 +33,3 @@ target_link_libraries(main install (FILES ${INCLUDES} DESTINATION "${INCLUDE_INSTALL_PATH}/main" ) - diff --git a/src/managers/packet_manager.cc b/src/managers/packet_manager.cc index f640f8d65..2c0408581 100644 --- a/src/managers/packet_manager.cc +++ b/src/managers/packet_manager.cc @@ -65,8 +65,8 @@ static std::list s_codecs; //static std::array s_protocols; -static std::array s_proto_map{}; -static std::array s_protocols{}; +static std::array s_proto_map = {}; +static std::array s_protocols = {}; static THREAD_LOCAL uint8_t grinder = 0; // statistics information @@ -140,7 +140,7 @@ void PacketManager::dump_plugins() d.dump(p->base.name, p->base.version); } -void PacketManager::instantiate(const CodecApi* cd_api, Module* m, SnortConfig* sc) +void PacketManager::instantiate(const CodecApi* /*cd_api */, Module* /*m*/, SnortConfig* /*sc*/) { #if 0 static uint16_t codec_id = 1; @@ -275,7 +275,7 @@ void PacketManager::dump_stats() { std::vector pkt_names; - for(int i = 0; i < gen_peg_names.size(); i++) + for(unsigned int i = 0; i < gen_peg_names.size(); i++) pkt_names.push_back(gen_peg_names[i]); diff --git a/src/protocols/ipv4.h b/src/protocols/ipv4.h index d97e4dd09..dfe76b2a2 100644 --- a/src/protocols/ipv4.h +++ b/src/protocols/ipv4.h @@ -248,5 +248,40 @@ const uint8_t IPOPT_ANY = 0xff; #define IP_HEADER_LEN ipv4::hdr_len() + +static inline unsigned short in_chksum_ip( unsigned short * w, int blen ) +{ + unsigned int cksum; + + /* IP must be >= 20 bytes */ + cksum = w[0]; + cksum += w[1]; + cksum += w[2]; + cksum += w[3]; + cksum += w[4]; + cksum += w[5]; + cksum += w[6]; + cksum += w[7]; + cksum += w[8]; + cksum += w[9]; + + blen -= 20; + w += 10; + + while( blen ) /* IP-hdr must be an integral number of 4 byte words */ + { + cksum += w[0]; + cksum += w[1]; + w += 2; + blen -= 4; + } + + cksum = (cksum >> 16) + (cksum & 0x0000ffff); + cksum += (cksum >> 16); + + return (unsigned short) (~cksum); +} + + #endif diff --git a/src/protocols/packet.h b/src/protocols/packet.h index cbd96acaa..163547144 100644 --- a/src/protocols/packet.h +++ b/src/protocols/packet.h @@ -609,43 +609,6 @@ typedef struct _PPPoE_Tag } PPPoE_Tag; -#define PGM_NAK_ERR -1 -#define PGM_NAK_OK 0 -#define PGM_NAK_VULN 1 - -typedef struct _PGM_NAK_OPT -{ - uint8_t type; /* 02 = vuln */ - uint8_t len; - uint8_t res[2]; - uint32_t seq[1]; /* could be many many more, but 1 is sufficient */ -} PGM_NAK_OPT; - -typedef struct _PGM_NAK -{ - uint32_t seqnum; - uint16_t afil1; - uint16_t res1; - uint32_t src; - uint16_t afi2; - uint16_t res2; - uint32_t multi; - PGM_NAK_OPT opt; -} PGM_NAK; - -typedef struct _PGM_HEADER -{ - uint16_t srcport; - uint16_t dstport; - uint8_t type; - uint8_t opt; - uint16_t checksum; - uint8_t gsd[6]; - uint16_t length; - PGM_NAK nak; -} PGM_HEADER; - - #define LAYER_MAX 32 struct Packet