From: Josh Date: Wed, 29 Oct 2014 19:19:06 +0000 (-0700) Subject: various logging patches X-Git-Tag: 3.0.0-233~1307 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=faa704e6f4a0dc7dfdb729992f16aa7e46bae3b4;p=thirdparty%2Fsnort3.git various logging patches --- diff --git a/src/codecs/ip/cd_tcp.cc b/src/codecs/ip/cd_tcp.cc index 72cfc6b54..b4728aac7 100644 --- a/src/codecs/ip/cd_tcp.cc +++ b/src/codecs/ip/cd_tcp.cc @@ -149,7 +149,7 @@ void TcpCodec::get_protocol_ids(std::vector& v) bool TcpCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort) { - if(raw.len < tcp::TCP_HEADER_LEN) + if(raw.len < tcp::TCP_MIN_HEADER_LEN) { codec_events::decoder_event(codec, DECODE_TCP_DGRAM_LT_TCPHDR); return false; @@ -159,7 +159,7 @@ bool TcpCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort) const tcp::TCPHdr* tcph = reinterpret_cast(raw.data); const uint16_t tcph_len = tcph->hdr_len(); - if(tcph_len < tcp::TCP_HEADER_LEN) + if(tcph_len < tcp::TCP_MIN_HEADER_LEN) { codec_events::decoder_event(codec, DECODE_TCP_INVALID_OFFSET); return false; @@ -283,10 +283,10 @@ bool TcpCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort) /* if options are present, decode them */ - uint16_t tcp_opt_len = (uint16_t)(tcph->hdr_len() - tcp::TCP_HEADER_LEN); + uint16_t tcp_opt_len = (uint16_t)(tcph->hdr_len() - tcp::TCP_MIN_HEADER_LEN); if(tcp_opt_len > 0) - DecodeTCPOptions((uint8_t *) (raw.data + tcp::TCP_HEADER_LEN), tcp_opt_len, codec); + DecodeTCPOptions((uint8_t *) (raw.data + tcp::TCP_MIN_HEADER_LEN), tcp_opt_len, codec); int dsize = raw.len - tcph->hdr_len(); @@ -381,7 +381,7 @@ void DecodeTCPOptions(const uint8_t *start, uint32_t o_len, CodecData& codec) * 4) increment option code ptr * * TCP_OPTLENMAX = 40 because of - * (((2^4) - 1) * 4 - tcp::TCP_HEADER_LEN + * (((2^4) - 1) * 4 - tcp::TCP_MIN_HEADER_LEN * */ @@ -617,7 +617,7 @@ bool TcpCodec::encode(const uint8_t* const raw_in, const uint16_t /*raw_len*/, { const tcp::TCPHdr* const hi = reinterpret_cast(raw_in); - if (!buf.allocate(tcp::TCP_HEADER_LEN)) + if (!buf.allocate(tcp::TCP_MIN_HEADER_LEN)) return false; tcp::TCPHdr* tcph_out = reinterpret_cast(buf.base); @@ -653,7 +653,7 @@ bool TcpCodec::encode(const uint8_t* const raw_in, const uint16_t /*raw_len*/, } tcph_out->th_offx2 = 0; - tcph_out->set_offset(tcp::TCP_HEADER_LEN >> 2); + tcph_out->set_offset(tcp::TCP_MIN_HEADER_LEN >> 2); tcph_out->th_win = 0; tcph_out->th_urp = 0; diff --git a/src/log/log_text.cc b/src/log/log_text.cc index 86a7cb8e6..7b8d94cc9 100644 --- a/src/log/log_text.cc +++ b/src/log/log_text.cc @@ -719,7 +719,12 @@ static void LogOuterIPHeader(TextLog *log, Packet *p) p->ptrs.dp = save_dp; } else + { + PktType tmp_type = p->type(); + p->ptrs.set_pkt_type(PktType::IP); LogIPHeader(log, p); + p->ptrs.set_pkt_type(tmp_type); + } p->ptrs.ip_api = save_ip_api; p->packet_flags |= save_frag_flag; @@ -808,7 +813,7 @@ void LogTcpOptions(TextLog* log, const Packet* const p) break; case tcp::TcpOptCode::TIMESTAMP: - TextLog_Print(log, "TS: %u %u", extract_32_bits(opt.data), opt.data + 4); + TextLog_Print(log, "TS: %u %u", extract_32_bits(opt.data), extract_32_bits(opt.data + 4)); break; case tcp::TcpOptCode::CC: @@ -1647,8 +1652,8 @@ static int LogObfuscatedData(TextLog* log, Packet *p) LogNetData(log, buf, dlen + payload_len, NULL); } - free(payload); + free(payload); return 0; } @@ -1736,6 +1741,12 @@ void LogIPPkt(TextLog* log, Packet * p) while (layer::set_outer_ip_api(p, p->ptrs.ip_api, num_layer) && tmp_api != p->ptrs.ip_api) { +#ifdef REG_TEST + // In Snort, cooked packets should not print an outer IP Header + if (p->is_cooked()) + break; +#endif + LogOuterIPHeader(log, p); if (first) @@ -1834,7 +1845,7 @@ void LogIPPkt(TextLog* log, Packet * p) LogNetData(log, p->pkt, p->pkth->caplen, p); } #ifdef REG_TEST - TextLog_Print(log, "\n%s\n", SEPARATOR); + TextLog_Print(log, "\n%s\n\n", SEPARATOR); #endif } diff --git a/src/network_inspectors/normalize/norm.cc b/src/network_inspectors/normalize/norm.cc index 38959bc2f..5b9b9ba04 100644 --- a/src/network_inspectors/normalize/norm.cc +++ b/src/network_inspectors/normalize/norm.cc @@ -508,9 +508,9 @@ static int Norm_TCP ( if ( tcp_options_len > 0 ) { const Layer& lyr = p->layers[layer]; - uint8_t* opts = const_cast(lyr.start) + tcp::TCP_HEADER_LEN; + uint8_t* opts = const_cast(lyr.start) + tcp::TCP_MIN_HEADER_LEN; // lyr.length only includes valid tcp options - uint8_t valid_opts_len = lyr.length - tcp::TCP_HEADER_LEN; + uint8_t valid_opts_len = lyr.length - tcp::TCP_MIN_HEADER_LEN; if ( Norm_IsEnabled(c, NORM_TCP_OPT) ) { diff --git a/src/protocols/packet.h b/src/protocols/packet.h index 9c6d502f5..88dfca0c6 100644 --- a/src/protocols/packet.h +++ b/src/protocols/packet.h @@ -195,6 +195,9 @@ struct SO_PUBLIC Packet inline bool is_udp() const { return ptrs.get_pkt_type() == PktType::UDP; } + inline bool is_cooked() const + { return packet_flags & PKT_PSEUDO; } + /* Get general, non-boolean information */ inline PktType type() const { return ptrs.get_pkt_type(); } // defined in codec.h diff --git a/src/protocols/tcp.h b/src/protocols/tcp.h index c672a267c..db5f5c069 100644 --- a/src/protocols/tcp.h +++ b/src/protocols/tcp.h @@ -66,7 +66,7 @@ namespace tcp { -constexpr uint8_t TCP_HEADER_LEN = 20; // this is actually the minimal TCP header lenght +constexpr uint8_t TCP_MIN_HEADER_LEN = 20; // this is actually the minimal TCP header lenght constexpr int OPT_TRUNC = -1; constexpr int OPT_BADLEN = -2; @@ -90,7 +90,7 @@ struct TCPHdr { return th_offx2 >> 4; } inline uint8_t options_len() const - { return hdr_len() - TCP_HEADER_LEN; } + { return hdr_len() - TCP_MIN_HEADER_LEN; } inline uint16_t src_port() const { return ntohs(th_sport); } diff --git a/src/protocols/tcp_options.cc b/src/protocols/tcp_options.cc index 71ddf42c7..c6b7f95d9 100644 --- a/src/protocols/tcp_options.cc +++ b/src/protocols/tcp_options.cc @@ -39,7 +39,7 @@ const TcpOption& TcpOptIteratorIter::operator* () const TcpOptIterator::TcpOptIterator(const TCPHdr* const tcp_header, const Packet* const p) { const uint8_t* const hdr = (const uint8_t* const)tcp_header; - start_ptr = hdr + TCP_HEADER_LEN; + start_ptr = hdr + TCP_MIN_HEADER_LEN; end_ptr = start_ptr; // == begin() for (int i = p->num_layers-1; i >= 0; --i) @@ -61,9 +61,9 @@ TcpOptIterator::TcpOptIterator(const TCPHdr* const tcp_header, const Packet* con TcpOptIterator::TcpOptIterator(const TCPHdr* const tcp_header, const uint32_t valid_hdr_len) { const uint8_t* const hdr = (const uint8_t* const)tcp_header; - start_ptr = hdr + TCP_HEADER_LEN; + start_ptr = hdr + TCP_MIN_HEADER_LEN; - if (valid_hdr_len < TCP_HEADER_LEN) + if (valid_hdr_len < TCP_MIN_HEADER_LEN) end_ptr = start_ptr; else end_ptr = hdr + valid_hdr_len;