From: Josh Date: Wed, 17 Sep 2014 16:38:10 +0000 (-0400) Subject: Adding Packet Type support to packet X-Git-Tag: 3.0.0-233~1410^2^2~2^2~1 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=edba50cc3f774e2f2ce9197fc4c524ae6f809994;p=thirdparty%2Fsnort3.git Adding Packet Type support to packet --- diff --git a/src/codecs/ip/cd_icmp4.cc b/src/codecs/ip/cd_icmp4.cc index b9012c7f5..d0b96d82b 100644 --- a/src/codecs/ip/cd_icmp4.cc +++ b/src/codecs/ip/cd_icmp4.cc @@ -242,7 +242,7 @@ bool Icmp4Codec::decode(const RawData& raw, CodecData& codec,SnortData& snort) /* Run a bunch of ICMP decoder rules */ ICMP4MiscTests(icmph, codec, (uint16_t)raw.len - len); - snort.packet_type = PKT_TYPE__ICMP4; + snort.set_pkt_type(PktType::ICMP4); snort.icmph = icmph; codec.proto_bits |= PROTO_BIT__ICMP; codec.lyr_len = len; diff --git a/src/codecs/ip/cd_icmp6.cc b/src/codecs/ip/cd_icmp6.cc index 6e935d89d..d30f04ce4 100644 --- a/src/codecs/ip/cd_icmp6.cc +++ b/src/codecs/ip/cd_icmp6.cc @@ -277,7 +277,7 @@ bool Icmp6Codec::decode(const RawData& raw, CodecData& codec, SnortData& snort) codec.lyr_len = len; codec.proto_bits |= PROTO_BIT__ICMP; snort.icmph = reinterpret_cast(icmp6h); - snort.packet_type = PKT_TYPE__ICMP6; + snort.set_pkt_type(PktType::ICMP6); return true; } diff --git a/src/codecs/ip/cd_ipv4.cc b/src/codecs/ip/cd_ipv4.cc index 8709238b1..094cbaed8 100644 --- a/src/codecs/ip/cd_ipv4.cc +++ b/src/codecs/ip/cd_ipv4.cc @@ -367,7 +367,7 @@ bool Ipv4Codec::decode(const RawData& raw, CodecData& codec, SnortData& snort) codec_events::decoder_event(DECODE_BAD_FRAGBITS); - snort.packet_type = PKT_TYPE__IP; + snort.set_pkt_type(PktType::IP); codec.proto_bits |= PROTO_BIT__IP; IPMiscTests(iph, ip::IP4_HEADER_LEN + ip_opt_len); codec.lyr_len = hlen; diff --git a/src/codecs/ip/cd_ipv6.cc b/src/codecs/ip/cd_ipv6.cc index 3551313d1..da8bfc74d 100644 --- a/src/codecs/ip/cd_ipv6.cc +++ b/src/codecs/ip/cd_ipv6.cc @@ -258,7 +258,7 @@ bool Ipv6Codec::decode(const RawData& raw, CodecData& codec, SnortData& snort) IPV6MiscTests(snort); CheckIPV6Multicast(ip6h); - snort.packet_type = PKT_TYPE__IP; + snort.set_pkt_type(PktType::IP); codec.next_prot_id = ip6h->get_next(); codec.lyr_len = ip::IP6_HEADER_LEN; @@ -270,6 +270,7 @@ bool Ipv6Codec::decode(const RawData& raw, CodecData& codec, SnortData& snort) decodeipv6_fail: /* If this was Teredo, back up and treat the packet as normal UDP. */ + // FIXIT-L handle active bypass without a global variable if (codec.codec_flags & CODEC_TEREDO_SEEN) { if ( ScTunnelBypassEnabled(TUNNEL_TEREDO) ) diff --git a/src/codecs/ip/cd_tcp.cc b/src/codecs/ip/cd_tcp.cc index 12d569b6e..a1ad4c84d 100644 --- a/src/codecs/ip/cd_tcp.cc +++ b/src/codecs/ip/cd_tcp.cc @@ -279,7 +279,7 @@ bool TcpCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort) snort.tcph = tcph; snort.sp = tcph->src_port(); snort.dp = tcph->dst_port(); - snort.packet_type = PKT_TYPE__TCP; + snort.set_pkt_type(PktType::TCP); TCPMiscTests(snort, tcph); diff --git a/src/codecs/ip/cd_udp.cc b/src/codecs/ip/cd_udp.cc index 789db0e68..70ed190f1 100644 --- a/src/codecs/ip/cd_udp.cc +++ b/src/codecs/ip/cd_udp.cc @@ -290,7 +290,7 @@ bool UdpCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort) snort.dp = dst_port; codec.lyr_len = udp::UDP_HEADER_LEN; codec.proto_bits |= PROTO_BIT__UDP; - snort.packet_type = PKT_TYPE__UDP; + snort.set_pkt_type(PktType::UDP); // set in packet manager UDPMiscTests(snort, uhlen - udp::UDP_HEADER_LEN); diff --git a/src/codecs/link/cd_arp.cc b/src/codecs/link/cd_arp.cc index 88a57aa84..e446c84c2 100644 --- a/src/codecs/link/cd_arp.cc +++ b/src/codecs/link/cd_arp.cc @@ -99,7 +99,7 @@ bool ArpCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort) codec.proto_bits |= PROTO_BIT__ARP; codec.lyr_len = sizeof(arp::EtherARP); - snort.packet_type = PKT_TYPE__ARP; + snort.set_pkt_type(PktType::ARP); return true; } diff --git a/src/framework/codec.h b/src/framework/codec.h index b185f1e9a..e4dbf2d74 100644 --- a/src/framework/codec.h +++ b/src/framework/codec.h @@ -134,35 +134,62 @@ struct RawData uint32_t len; }; -/* SnortData Flags */ - -/* error flags */ -constexpr uint8_t DECODE_ERR_CKSUM_IP = 0x01; -constexpr uint8_t DECODE_ERR_CKSUM_TCP = 0x02; -constexpr uint8_t DECODE_ERR_CKSUM_UDP = 0x04; -constexpr uint8_t DECODE_ERR_CKSUM_ICMP = 0x08; -constexpr uint8_t DECODE_ERR_CKSUM_ANY = 0x0F; -constexpr uint8_t DECODE_ERR_BAD_TTL = 0x10; -constexpr uint8_t DECODE_PKT_TRUST = 0x20; /* Tell Snort++ to whitelist this packet */ -constexpr uint8_t DECODE_FRAG = 0x40; /* flag to indicate a fragmented packet */ -constexpr uint8_t DECODE_MF = 0x80; - -constexpr uint8_t DECODE_ERR_FLAGS = DECODE_ERR_CKSUM_IP | - DECODE_ERR_CKSUM_TCP | - DECODE_ERR_CKSUM_UDP | - DECODE_ERR_CKSUM_UDP | - DECODE_ERR_CKSUM_ICMP | - DECODE_ERR_CKSUM_ANY | - DECODE_ERR_BAD_TTL; - - -constexpr uint8_t PKT_TYPE__UNKOWN = 0x00; -constexpr uint8_t PKT_TYPE__IP = 0x01; -constexpr uint8_t PKT_TYPE__TCP = 0x02; -constexpr uint8_t PKT_TYPE__UDP = 0x04; -constexpr uint8_t PKT_TYPE__ICMP4 = 0x08; -constexpr uint8_t PKT_TYPE__ICMP6 = 0x10; -constexpr uint8_t PKT_TYPE__ARP = 0x20; + +enum DecodeFlags : std::uint16_t +{ + /* + * DO NOT USE PKT_TYPE_* directly!! Use PktType enum and + * access methods to get/set. + * + * NOTE: While using the first bits as an + * enumerated type (i.e., not as flags) is asking + * for trouble, creating a seperate PktType entity would + * waste five perfectly good bits. Additionally, + * those wated bits would be needlesly zero before + * decoding every packet. So, I'm living dangerously + * and going with the bad idea .. I'm also hoping this + * grouping shows the connection betwee PktTypes + * and regular DecodeFlags + */ + PKT_TYPE_UNKOWN = 0x00, + PKT_TYPE_IP = 0x01, + PKT_TYPE_TCP = 0x02, + PKT_TYPE_UDP = 0x03, + PKT_TYPE_ICMP4 = 0x04, + PKT_TYPE_ICMP6 = 0x05, + PKT_TYPE_ARP = 0x06, + PKT_TYPE_FREE = 0x07, /* If protocol is added, update enum class PktType below. */ + PKT_TYPE_MASK = 0x07, + + /* error flags */ + DECODE_ERR_CKSUM_IP = 0x0008, + DECODE_ERR_CKSUM_TCP = 0x0010, + DECODE_ERR_CKSUM_UDP = 0x0020, + DECODE_ERR_CKSUM_ICMP = 0x0040, + DECODE_ERR_CKSUM_ANY = 0x0080, + DECODE_ERR_BAD_TTL = 0x0100, + DECODE_ERR_FLAGS = (DECODE_ERR_CKSUM_IP | DECODE_ERR_CKSUM_TCP | + DECODE_ERR_CKSUM_UDP | DECODE_ERR_CKSUM_UDP | + DECODE_ERR_CKSUM_ICMP | DECODE_ERR_CKSUM_ANY | + DECODE_ERR_BAD_TTL), + + + DECODE_PKT_TRUST = 0x0200, /* Tell Snort++ to whitelist this packet */ + DECODE_FRAG = 0x0400, /* flag to indicate a fragmented packet */ + DECODE_MF = 0x0800, +}; + +/* NOTE: if A protocol is added, update DecodeFlags! */ +enum class PktType : std::uint8_t +{ + UNKOWN = PKT_TYPE_UNKOWN, + IP = PKT_TYPE_IP, + TCP = PKT_TYPE_TCP, + UDP = PKT_TYPE_UDP, + ICMP4 = PKT_TYPE_ICMP4, + ICMP6 = PKT_TYPE_ICMP6, + ARP = PKT_TYPE_ARP, +}; struct SnortData { @@ -175,20 +202,31 @@ struct SnortData const tcp::TCPHdr* tcph; const udp::UDPHdr* udph; const icmp::ICMPHdr* icmph; - uint16_t sp; /* source port (TCP/UDP) */ - uint16_t dp; /* dest port (TCP/UDP) */ - uint8_t decode_flags; /* decoder flags including checksum errors, bad TTLs, frag, etc. */ - uint8_t packet_type; + uint16_t sp; /* source port (TCP/UDP) */ + uint16_t dp; /* dest port (TCP/UDP) */ + uint16_t decode_flags; /* First bits (currently 3), which are masked using the constant + * DECODE_PKT_TYPE_MASK defined above, are specifically + * for the PktType. Everything else is fair game flag. + * + */ ip::IpApi ip_api; mpls::MplsHdr mplsHdr; inline void reset() { - static_assert(PKT_TYPE__UNKOWN == 0, "PKT_TYPE__UNKOWN must be zero!!"); + static_assert(PKT_TYPE_UNKOWN == 0, + "The Packets 'type' gets resets to zero - " + "which means zero is unkown"); memset((char*)&tcph, '\0', offsetof(SnortData, ip_api)); ip_api.reset(); } + + inline void set_pkt_type(PktType pkt_type) + { decode_flags = (decode_flags & ~PKT_TYPE_MASK) | static_cast(pkt_type); } + + inline PktType get_pkt_type() const + { return static_cast(decode_flags & PKT_TYPE_MASK); } }; diff --git a/src/protocols/ipv4_options.h b/src/protocols/ipv4_options.h index 3ddd4c2cd..f8d64c280 100644 --- a/src/protocols/ipv4_options.h +++ b/src/protocols/ipv4_options.h @@ -32,7 +32,8 @@ namespace ip struct IP4Hdr; -enum class IPOptionCodes : std::uint8_t { +enum class IPOptionCodes : std::uint8_t +{ EOL = 0x00, NOP = 0x01, RR = 0x07, diff --git a/src/protocols/packet.h b/src/protocols/packet.h index 5967ca98e..47ccbf278 100644 --- a/src/protocols/packet.h +++ b/src/protocols/packet.h @@ -156,7 +156,6 @@ constexpr uint8_t MAX_TTL = 255; constexpr uint8_t LAYER_MAX = 32; - /* D A T A S T R U C T U R E S *********************************************/ class Flow; @@ -205,8 +204,8 @@ struct Packet /* Access methods */ - inline uint8_t type() const - { return ptrs.packet_type; } + inline PktType type() const + { return ptrs.get_pkt_type(); } // defined in codec.h }; #define PKT_ZERO_LEN offsetof(Packet, pkth) diff --git a/src/stream/tcp/tcp_session.cc b/src/stream/tcp/tcp_session.cc index 4c548a0a1..fb6ca9871 100644 --- a/src/stream/tcp/tcp_session.cc +++ b/src/stream/tcp/tcp_session.cc @@ -137,7 +137,8 @@ const char* tcp_pegs[] = "gaps", "internal events", "client cleanup flushes", - "server cleanup flushes" + "server cleanup flushes", + nullptr }; THREAD_LOCAL TcpStats tcpStats; diff --git a/src/test/sfip_test.cc b/src/test/sfip_test.cc index aa8227cf7..5a1b01fa2 100644 --- a/src/test/sfip_test.cc +++ b/src/test/sfip_test.cc @@ -25,10 +25,18 @@ #include + +#if defined(__clang__) #pragma clang diagnostic push #pragma clang diagnostic ignored "-Wgnu-zero-variadic-macro-arguments" +#endif + #include + + +#if defined(__clang__) #pragma clang diagnostic pop +#endif #include "snort_types.h" #include "sfip/sf_ip.h" diff --git a/src/test/sfrf_test.cc b/src/test/sfrf_test.cc index 57c4c3e04..e40a22d72 100644 --- a/src/test/sfrf_test.cc +++ b/src/test/sfrf_test.cc @@ -28,10 +28,17 @@ #include #include +#if defined(__clang__) #pragma clang diagnostic push #pragma clang diagnostic ignored "-Wgnu-zero-variadic-macro-arguments" +#endif + #include + + +#if defined(__clang__) #pragma clang diagnostic pop +#endif #include "snort_types.h" #include "snort.h" diff --git a/src/test/sfrt_test.cc b/src/test/sfrt_test.cc index 41476423c..5ded80560 100644 --- a/src/test/sfrt_test.cc +++ b/src/test/sfrt_test.cc @@ -24,10 +24,18 @@ #include #include + +#if defined(__clang__) #pragma clang diagnostic push #pragma clang diagnostic ignored "-Wgnu-zero-variadic-macro-arguments" +#endif + #include + + +#if defined(__clang__) #pragma clang diagnostic pop +#endif #include "snort_types.h" #include "sfrt/sfrt.h" diff --git a/src/test/sfthd_test.cc b/src/test/sfthd_test.cc index 423159b73..1746d1432 100644 --- a/src/test/sfthd_test.cc +++ b/src/test/sfthd_test.cc @@ -26,11 +26,16 @@ #include +#if defined(__clang__) #pragma clang diagnostic push #pragma clang diagnostic ignored "-Wgnu-zero-variadic-macro-arguments" +#endif + #include -#pragma clang diagnostic pop +#if defined(__clang__) +#pragma clang diagnostic pop +#endif #include "snort.h" #include "sfip/sf_ip.h" diff --git a/src/test/unit_test.cc b/src/test/unit_test.cc index a32a7205c..5274d1a9c 100644 --- a/src/test/unit_test.cc +++ b/src/test/unit_test.cc @@ -21,8 +21,18 @@ #include "unit_test.h" #include + +#if defined(__clang__) +#pragma clang diagnostic push +#pragma clang diagnostic ignored "-Wgnu-zero-variadic-macro-arguments" +#endif + #include +#if defined(__clang__) +#pragma clang diagnostic pop +#endif + #include "suite_decl.h" static print_output s_mode = CK_LAST;