add_library( codecs STATIC
decode.h
- decode.cc
decode_module.h
- decode_module.cc
codec_api.h
codec_api.cc
ipv6_util.h
framework
main
)
-
libcodecs_a_SOURCES = \
codec_api.cc \
codec_api.h \
-decode.cc \
decode.h \
-decode_module.cc \
decode_module.h \
layer.h \
sf_protocols.h
extern const BaseApi* cd_tcp;
extern const BaseApi* cd_udp;
extern const BaseApi* cd_esp;
-extern const BaseApi* cd_null;
#ifdef STATIC_DECODERS
extern const BaseApi* cd_ah;
cd_tcp,
cd_udp,
cd_esp,
- cd_null,
#ifdef STATIC_DECODERS
cd_ah,
#endif
#include "codecs/codec_events.h"
-#include "time/profiler.h"
-#include "mempool/mempool.h"
-#include "events/event_queue.h"
-#include "log/messages.h"
#include "snort.h"
#include "packet_io/active.h"
-#include "utils/stats.h"
-#include "codecs/decode_module.h"
-
void codec_events::exec_udp_chksm_drop (Packet *)
{
}
}
-void codec_events::decoder_event(Packet *p, int sid)
+void codec_events::decoder_event(Packet *p, CodecSid sid)
{
if ( p->packet_flags & PKT_REBUILT_STREAM )
return;
}
}
-void codec_events::exec_hop_drop (Packet* p, int sid)
-{
- if ( p->packet_flags & PKT_REBUILT_STREAM )
- return;
-
- if ( ScLogVerbose() )
- ErrorMessage("%d:%d\n", GID_DECODE, sid);
-
- SnortEventqAdd(GID_DECODE, sid);
-}
-
-void codec_events::exec_ttl_drop (Packet *p, int sid)
-{
- if ( p->packet_flags & PKT_REBUILT_STREAM )
- return;
-
- if ( ScLogVerbose() )
- ErrorMessage("%d:%d\n", GID_DECODE, sid);
-
- SnortEventqAdd(GID_DECODE, sid);
-}
-
void codec_events::exec_icmp_chksm_drop (Packet*)
{
if( ScInlineMode() && ScIcmpChecksumDrops() )
}
void codec_events::decoder_alert_encapsulated(
- Packet *p, int sid, const uint8_t *pkt, uint32_t len)
+ Packet *p, CodecSid sid, const uint8_t *pkt, uint32_t len)
{
decoder_event(p, sid);
#ifndef CODEC_EVENTS_H
#define CODEC_EVENTS_H
-#include <array>
-
-// included for DECODE_INDEX_MAX
-#include "detection/generators.h"
-//#include "utils/sfActionQueue.h"
-#include "network_inspectors/normalize/normalize.h"
#include "protocols/packet.h"
-#include "time/profiler.h"
#include "codecs/decode_module.h"
namespace codec_events
{
void exec_ip_chksm_drop(Packet*);
- void exec_udp_chksm_drop (Packet *);
+ void exec_udp_chksm_drop (Packet*);
void exec_tcp_chksm_drop (Packet*);
- void exec_hop_drop(Packet* p, int sid);
- void exec_ttl_drop (Packet *data, int sid);
void exec_icmp_chksm_drop (Packet*);
-
- void decoder_event (Packet *, int);
+ void decoder_event(Packet* p, CodecSid);
void decoder_alert_encapsulated(
- Packet *p, int sid, const uint8_t *pkt, uint32_t len);
+ Packet*, CodecSid, const uint8_t* pkt, uint32_t len);
+
} //namespace codec_events
+++ /dev/null
-/*
-** Copyright (C) 2002-2013 Sourcefire, Inc.
-** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-#ifdef HAVE_CONFIG_H
-#include "config.h"
-#endif
-
-#ifdef HAVE_STRINGS_H
-#include <strings.h>
-#endif
-
-#include <string.h>
-#include <stdlib.h>
-
-#ifdef HAVE_DUMBNET_H
-#include <dumbnet.h>
-#else
-#include <dnet.h>
-#endif
-
-#include "main/analyzer.h"
-#include "decode.h"
-#include "snort.h"
-#include "snort_debug.h"
-#include "util.h"
-#include "detect.h"
-#include "log_text.h"
-#include "generators.h"
-#include "packet_io/active.h"
-#include "sfxhash.h"
-#include "snort_bounds.h"
-#include "sf_iph.h"
-#include "fpdetect.h"
-#include "profiler.h"
-#include "mempool/mempool.h"
-#include "normalize/normalize.h"
-#include "packet_io/sfdaq.h"
-
-#include "codecs/decode_module.h"
-#include "codecs/codec_events.h"
-
-void decoder_sum()
-{
-// sum_stats((PegCount*)&gdc, (PegCount*)&dc, array_size(dc_pegs));
-// memset(&dc, 0, sizeof(dc));
-}
-
-void decoder_stats()
-{
-// show_percent_stats((PegCount*)&gdc, dc_pegs, array_size(dc_pegs),
-// "decoder");
-}
-
-
-
-
-
-
-
-
-
-
-//--------------------------------------------------------------------
-// decode.c::miscellaneous public methods and helper functions
-//--------------------------------------------------------------------
-
-#if defined(WORDS_MUSTALIGN) && !defined(__GNUC__)
-uint32_t EXTRACT_32BITS (u_char *p)
-{
- uint32_t __tmp;
-
- memmove(&__tmp, p, sizeof(uint32_t));
- return (uint32_t) ntohl(__tmp);#endif
-}
-#endif /* WORDS_MUSTALIGN && !__GNUC__ */
-
-static inline void CheckIPv4_MinTTL(Packet *p, uint8_t ttl)
-{
- // this sequence of tests is best for the "normal" case where
- // the packet ttl is >= the configured min (the default is 1)
- if( ttl < ScMinTTL() )
- {
- if ( ttl == 0 )
- {
- codec_events::exec_ttl_drop(p, DECODE_ZERO_TTL);
- }
- else
- {
- codec_events::exec_ttl_drop(p, DECODE_IP4_MIN_TTL);
- }
- }
-}
-
-static inline void CheckIPv6_MinTTL(Packet *p, uint8_t hop_limit)
-{
- // this sequence of tests is best for the "normal" case where
- // the packet ttl is >= the configured min (the default is 1)
- if( hop_limit < ScMinTTL() )
- {
- if ( hop_limit == 0 )
- {
- codec_events::exec_hop_drop(p, DECODE_IP6_ZERO_HOP_LIMIT);
- }
- else
- {
- codec_events::exec_hop_drop(p, DECODE_IPV6_MIN_TTL);
- }
- }
-}
-
-/* Decoding of ttl/hop_limit is based on the policy min_ttl */
-void DecodePolicySpecific(Packet *p)
-{
- switch(p->outer_family)
- {
- case AF_INET:
- CheckIPv4_MinTTL( p, p->outer_ip4h.ip_ttl);
- return;
-
- case AF_INET6:
- CheckIPv6_MinTTL( p, p->outer_ip6h.hop_lmt);
- return;
-
- default:
- break;
- }
-
- switch(p->family)
- {
- case AF_INET:
- CheckIPv4_MinTTL( p, p->ip4h->ip_ttl);
- return;
-
- case AF_INET6:
- CheckIPv6_MinTTL( p, p->ip6h->hop_lmt);
- return;
-
- default:
- break;
- }
-}
-
#include <stddef.h>
#include <sys/types.h>
+#include <string.h>
#ifndef WIN32
#include <sys/socket.h>
/* D E F I N E S ************************************************************/
-
+#if 0
#define ETH_DSAP_SNA 0x08 /* SNA */
#define ETH_SSAP_SNA 0x00 /* SNA */
#define ETH_DSAP_STP 0x42 /* Spanning Tree Protocol */
#define ETH_ORG_CODE_ETHR 0x000000 /* Encapsulated Ethernet */
#define ETH_ORG_CODE_CDP 0x00000c /* Cisco Discovery Proto */
-
-#define ETHERNET_MAX_LEN_ENCAP 1518 /* 802.3 (+LLC) or ether II ? */
+#endif
#define DEFAULT_MPLS_PAYLOADTYPE MPLS_PAYLOADTYPE_IPV4
#define MAX_PORTS 65536
+#if 0
/* ppp header structure
*
* Actually, this is the header for RFC1332 Section 3
#define PPP_MTU 1500
#endif
-/* enc interface */
-struct enc_header {
- uint32_t af;
- uint32_t spi;
- uint32_t flags;
-};
-#define ENC_HEADER_LEN 12
+#endif
#define IP_OPTMAX 40
-
-#define EXTRACT_16BITS(p) ((uint16_t) ntohs (*(uint16_t *)(p)))
+static inline uint16_t EXTRACT_16BITS(const uint8_t* p)
+{
+ return ntohs(*(uint16_t*)(p));
+}
#ifdef WORDS_MUSTALIGN
#if defined(__GNUC__)
/* force word-aligned ntohl parameter */
- #define EXTRACT_32BITS(p) ({ uint32_t __tmp; memmove(&__tmp, (p), sizeof(uint32_t)); (uint32_t) ntohl(__tmp);})
+ static inline uint32_t EXTRACT_32BITS(const uint8_t* p)
+ {
+ uint32_t tmp;
+ memmove(&tmp, p, sizeof(uint32_t));
+ return ntohl(tmp);
+ }
#endif /* __GNUC__ */
#else
/* allows unaligned ntohl parameter - dies w/SIGBUS on SPARCs */
- #define EXTRACT_32BITS(p) ((uint32_t) ntohl (*(uint32_t *)(p)))
-
-#endif /* WORDS_MUSTALIGN */
-
-
-/* Default classification for decoder alerts */
-#define DECODE_CLASS 25
+ static inline uint32_t EXTRACT_32BITS(const uint8_t* p)
+ {
+ return ntohl(*(uint32_t *)p);
+ }
+#endif /* WORDS_MUSTALIGN */
-#define ALERTMSG_LENGTH 256
-
-/* P R O T O T Y P E S ******************************************************/
-
-// root decoders
-
-// chained decoders
-
-
-void BsdFragHashInit(int max);
-void BsdFragHashCleanup(void);
-void BsdFragHashReset(void);
-
-#if defined(WORDS_MUSTALIGN) && !defined(__GNUC__)
-uint32_t EXTRACT_32BITS (u_char *);
-#endif /* WORDS_MUSTALIGN && !__GNUC__ */
-
-/*Decode functions that need to be called once the policies are set */
-extern void DecodePolicySpecific(Packet *);
-
-/* XXX not sure where this guy needs to live at the moment */
-#if 0
-typedef struct _PortList
-{
- int ports[32]; /* 32 is kind of arbitrary */
-
- int num_entries;
-
-} PortList;
-#endif
-#define SFTARGET_UNKNOWN_PROTOCOL -1
-void decoder_sum();
-void decoder_stats();
+const unsigned int ALERTMSG_LENGTH = 256;
+const int16_t SFTARGET_UNKNOWN_PROTOCOL = -1;
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-// decode_module.cc author Russ Combs <rucombs@cisco.com>
-
-#include "decode_module.h"
-#include "decode.h"
-#include "parser/config_file.h"
-
-//-------------------------------------------------------------------------
-// attributes
-//-------------------------------------------------------------------------
-
-// FIXIT some of these could move to nap / decoder / traffic policy
-static const Parameter decode_params[] =
-{
- { "decode_data_link", Parameter::PT_BOOL, nullptr, "false",
- "display the second layer header info" },
-
- { "decode_esp", Parameter::PT_BOOL, nullptr, "false",
- "enable for inspection of esp traffic that has authentication but not encryption" },
-
- { "deep_teredo_inspection", Parameter::PT_BOOL, nullptr, "false",
- "look for Teredo on all UDP ports (default is only 3544)" },
-
- { "enable_gtp", Parameter::PT_BOOL, nullptr, "false",
- "decode GTP encapsulations" },
-
- { "enable_mpls_multicast", Parameter::PT_BOOL, nullptr, "false",
- "enables support for MPLS multicast" },
-
- { "enable_mpls_overlapping_ip", Parameter::PT_BOOL, nullptr, "false",
- "enable if private network addresses overlap and must be differentiated by MPLS label(s)" },
-
- // FIXIT use PT_BIT_LIST
- { "gtp_ports", Parameter::PT_STRING, nullptr,
- "'2152 3386'", "set GTP ports" },
-
- { "max_mpls_label_chain_len", Parameter::PT_INT, "-1:", "-1",
- "set MPLS stack depth" },
-
- { "mpls_payload_type", Parameter::PT_ENUM, "eth | ip4 | ip6", "ip4",
- "set encapsulated payload type" },
-
- { "snap_len", Parameter::PT_INT, "0:65535", "deflt",
- "set snap length (same as -P)" },
-
- { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
-};
-
-//-------------------------------------------------------------------------
-// rule msgs
-//-------------------------------------------------------------------------
-
-static const RuleMap decode_rules[] =
-{
- { DECODE_NOT_IPV4_DGRAM, "(decode) Not IPv4 datagram" },
- { DECODE_IPV4_INVALID_HEADER_LEN, "(decode) hlen < IP_HEADER_LEN" },
- { DECODE_IPV4_DGRAM_LT_IPHDR, "(decode) IP dgm len < IP Hdr len" },
- { DECODE_IPV4OPT_BADLEN, "(decode) Ipv4 Options found with bad lengths" },
- { DECODE_IPV4OPT_TRUNCATED, "(decode) Truncated Ipv4 Options" },
- { DECODE_IPV4_DGRAM_GT_CAPLEN, "(decode) IP dgm len > captured len" },
-
- { DECODE_TCP_DGRAM_LT_TCPHDR, "(decode) TCP packet len is smaller than 20 bytes" },
- { DECODE_TCP_INVALID_OFFSET, "(decode) TCP Data Offset is less than 5" },
- { DECODE_TCP_LARGE_OFFSET, "(decode) TCP Header length exceeds packet length" },
-
- { DECODE_TCPOPT_BADLEN, "(decode) Tcp Options found with bad lengths" },
- { DECODE_TCPOPT_TRUNCATED, "(decode) Truncated Tcp Options" },
- { DECODE_TCPOPT_TTCP, "(decode) T/TCP Detected" },
- { DECODE_TCPOPT_OBSOLETE, "(decode) Obsolete TCP Options found" },
- { DECODE_TCPOPT_EXPERIMENTAL, "(decode) Experimental Tcp Options found" },
- { DECODE_TCPOPT_WSCALE_INVALID, "(decode) Tcp Window Scale Option found with length > 14" },
-
- { DECODE_UDP_DGRAM_LT_UDPHDR, "(decode) Truncated UDP Header" },
- { DECODE_UDP_DGRAM_INVALID_LENGTH, "(decode) Invalid UDP header, length field < 8" },
- { DECODE_UDP_DGRAM_SHORT_PACKET, "(decode) Short UDP packet, length field > payload length" },
- { DECODE_UDP_DGRAM_LONG_PACKET, "(decode) Long UDP packet, length field < payload length" },
-
- { DECODE_ICMP_DGRAM_LT_ICMPHDR, "(decode) ICMP Header Truncated" },
- { DECODE_ICMP_DGRAM_LT_TIMESTAMPHDR, "(decode) ICMP Timestamp Header Truncated" },
- { DECODE_ICMP_DGRAM_LT_ADDRHDR, "(decode) ICMP Address Header Truncated" },
- { DECODE_ARP_TRUNCATED, "(decode) Truncated ARP" },
- { DECODE_EAPOL_TRUNCATED, "(decode) Truncated EAP Header" },
- { DECODE_EAPKEY_TRUNCATED, "(decode) EAP Key Truncated" },
- { DECODE_EAP_TRUNCATED, "(decode) EAP Header Truncated" },
- { DECODE_BAD_PPPOE, "(decode) Bad PPPOE frame detected" },
- { DECODE_BAD_VLAN, "(decode) Bad VLAN Frame" },
- { DECODE_BAD_VLAN_ETHLLC, "(decode) Bad LLC header" },
- { DECODE_BAD_VLAN_OTHER, "(decode) Bad Extra LLC Info" },
- { DECODE_BAD_80211_ETHLLC, "(decode) Bad 802.11 LLC header" },
- { DECODE_BAD_80211_OTHER, "(decode) Bad 802.11 Extra LLC Info" },
-
- { DECODE_BAD_TRH, "(decode) Bad Token Ring Header" },
- { DECODE_BAD_TR_ETHLLC, "(decode) Bad Token Ring ETHLLC Header" },
- { DECODE_BAD_TR_MR_LEN, "(decode) Bad Token Ring MRLENHeader" },
- { DECODE_BAD_TRHMR, "(decode) Bad Token Ring MR Header" },
-
- { DECODE_BAD_TRAFFIC_LOOPBACK, "(snort decoder) Bad Traffic Loopback IP" },
- { DECODE_BAD_TRAFFIC_SAME_SRCDST, "(snort decoder) Bad Traffic Same Src/Dst IP" },
-
- { DECODE_GRE_DGRAM_LT_GREHDR, "(snort decoder) GRE header length > payload length" },
- { DECODE_GRE_MULTIPLE_ENCAPSULATION, "(snort decoder) Multiple encapsulations in packet" },
- { DECODE_GRE_INVALID_VERSION, "(snort decoder) Invalid GRE version" },
- { DECODE_GRE_INVALID_HEADER, "(snort decoder) Invalid GRE header" },
- { DECODE_GRE_V1_INVALID_HEADER, "(snort decoder) Invalid GRE v.1 PPTP header" },
- { DECODE_GRE_TRANS_DGRAM_LT_TRANSHDR, "(snort decoder) GRE Trans header length > payload length" },
-
- { DECODE_ICMP_ORIG_IP_TRUNCATED, "(decode) ICMP Original IP Header Truncated" },
- { DECODE_ICMP_ORIG_IP_VER_MISMATCH, "(decode) ICMP version and Original IP Header versions differ" },
- { DECODE_ICMP_ORIG_DGRAM_LT_ORIG_IP, "(decode) ICMP Original Datagram Length < Original IP Header Length" },
- { DECODE_ICMP_ORIG_PAYLOAD_LT_64, "(decode) ICMP Original IP Payload < 64 bits" },
- { DECODE_ICMP_ORIG_PAYLOAD_GT_576, "(decode) ICMP Origianl IP Payload > 576 bytes" },
- { DECODE_ICMP_ORIG_IP_WITH_FRAGOFFSET, "(decode) ICMP Original IP Fragmented and Offset Not 0" },
-
- { DECODE_IPV6_MIN_TTL, "(snort decoder) IPv6 packet below TTL limit" },
- { DECODE_IPV6_IS_NOT, "(snort decoder) IPv6 header claims to not be IPv6" },
- { DECODE_IPV6_TRUNCATED_EXT, "(snort decoder) IPV6 truncated extension header" },
- { DECODE_IPV6_TRUNCATED, "(snort decoder) IPV6 truncated header" },
- { DECODE_IPV6_DGRAM_LT_IPHDR, "(decode) IP dgm len < IP Hdr len" },
- { DECODE_IPV6_DGRAM_GT_CAPLEN, "(decode) IP dgm len > captured len" },
-
- { DECODE_IPV6_DST_ZERO, "(decode) IPv6 packet with destination address ::0" },
- { DECODE_IPV6_SRC_MULTICAST, "(decode) IPv6 packet with multicast source address" },
- { DECODE_IPV6_DST_RESERVED_MULTICAST, "(decode) IPv6 packet with reserved multicast destination address" },
- { DECODE_IPV6_BAD_OPT_TYPE, "(decode) IPv6 header includes an undefined option type" },
- { DECODE_IPV6_BAD_MULTICAST_SCOPE, "(decode) IPv6 address includes an unassigned multicast scope value" },
- { DECODE_IPV6_BAD_NEXT_HEADER, "(decode) IPv6 header includes an invalid value for the \"next header\" field" },
- { DECODE_IPV6_ROUTE_AND_HOPBYHOP, "(decode) IPv6 header includes a routing extension header followed by a hop-by-hop header" },
- { DECODE_IPV6_TWO_ROUTE_HEADERS, "(decode) IPv6 header includes two routing extension headers" },
- { DECODE_IPV6_DSTOPTS_WITH_ROUTING, "(decode) IPv6 header has destination options followed by a routing header" },
- { DECODE_ICMPV6_TOO_BIG_BAD_MTU, "(decode) ICMPv6 packet of type 2 (message too big) with MTU field < 1280" },
- { DECODE_ICMPV6_UNREACHABLE_NON_RFC_2463_CODE, "(decode) ICMPv6 packet of type 1 (destination unreachable) with non-RFC 2463 code" },
- { DECODE_ICMPV6_SOLICITATION_BAD_CODE, "(decode) ICMPv6 router solicitation packet with a code not equal to 0" },
- { DECODE_ICMPV6_ADVERT_BAD_CODE, "(decode) ICMPv6 router advertisement packet with a code not equal to 0" },
- { DECODE_ICMPV6_SOLICITATION_BAD_RESERVED, "(decode) ICMPv6 router solicitation packet with the reserved field not equal to 0" },
- { DECODE_ICMPV6_ADVERT_BAD_REACHABLE, "(decode) ICMPv6 router advertisement packet with the reachable time field set > 1 hour" },
-
- { DECODE_IPV6_TUNNELED_IPV4_TRUNCATED, "(decode) IPV6 tunneled over IPv4, IPv6 header truncated, possible Linux Kernel attack" },
-
- { DECODE_IP_MULTIPLE_ENCAPSULATION, "(decode) Two or more IP (v4 and/or v6) encapsulation layers present" },
-
- { DECODE_ESP_HEADER_TRUNC, "(decode) truncated Encapsulated Security Payload (ESP) header" },
-
- { DECODE_IPV6_BAD_OPT_LEN, "(decode) IPv6 header includes an option which is too big for the containing header" },
-
- { DECODE_IPV6_UNORDERED_EXTENSIONS, "(decode) IPv6 packet includes out-of-order extension headers" },
- { DECODE_GTP_MULTIPLE_ENCAPSULATION, "(decode) Two or more GTP encapsulation layers present" },
- { DECODE_GTP_BAD_LEN, "(decode) GTP header length is invalid" },
- { DECODE_TCP_XMAS, "(decode) XMAS Attack Detected" },
- { DECODE_TCP_NMAP_XMAS, "(decode) Nmap XMAS Attack Detected" },
-
- { DECODE_DOS_NAPTHA, "(decode) DOS NAPTHA Vulnerability Detected" },
- { DECODE_SYN_TO_MULTICAST, "(decode) Bad Traffic SYN to multicast address" },
- { DECODE_ZERO_TTL, "(decode) IPV4 packet with zero TTL" },
- { DECODE_BAD_FRAGBITS, "(decode) IPV4 packet with bad frag bits (Both MF and DF set)" },
- { DECODE_UDP_IPV6_ZERO_CHECKSUM, "(decode) Invalid IPv6 UDP packet, checksum zero" },
- { DECODE_IP4_LEN_OFFSET, "(decode) IPV4 packet frag offset + length exceed maximum" },
- { DECODE_IP4_SRC_THIS_NET, "(decode) IPV4 packet from 'current net' source address" },
- { DECODE_IP4_DST_THIS_NET, "(decode) IPV4 packet to 'current net' dest address" },
- { DECODE_IP4_SRC_MULTICAST, "(decode) IPV4 packet from multicast source address" },
- { DECODE_IP4_SRC_RESERVED, "(decode) IPV4 packet from reserved source address" },
- { DECODE_IP4_DST_RESERVED, "(decode) IPV4 packet to reserved dest address" },
- { DECODE_IP4_SRC_BROADCAST, "(decode) IPV4 packet from broadcast source address" },
- { DECODE_IP4_DST_BROADCAST, "(decode) IPV4 packet to broadcast dest address" },
- { DECODE_ICMP4_DST_MULTICAST, "(decode) ICMP4 packet to multicast dest address" },
- { DECODE_ICMP4_DST_BROADCAST, "(decode) ICMP4 packet to broadcast dest address" },
- { DECODE_ICMP4_TYPE_OTHER, "(decode) ICMP4 type other" },
- { DECODE_TCP_BAD_URP, "(decode) TCP urgent pointer exceeds payload length or no payload" },
- { DECODE_TCP_SYN_FIN, "(decode) TCP SYN with FIN" },
- { DECODE_TCP_SYN_RST, "(decode) TCP SYN with RST" },
- { DECODE_TCP_MUST_ACK, "(decode) TCP PDU missing ack for established session" },
- { DECODE_TCP_NO_SYN_ACK_RST, "(decode) TCP has no SYN, ACK, or RST" },
- { DECODE_ETH_HDR_TRUNC, "(decode) truncated eth header" },
- { DECODE_IP4_HDR_TRUNC, "(decode) truncated IP4 header" },
- { DECODE_ICMP4_HDR_TRUNC, "(decode) truncated ICMP4 header" },
- { DECODE_ICMP6_HDR_TRUNC, "(decode) truncated ICMP6 header" },
- { DECODE_IP4_MIN_TTL, "(snort decoder) IPV4 packet below TTL limit" },
- { DECODE_IP6_ZERO_HOP_LIMIT, "(snort decoder) IPV6 packet has zero hop limit" },
- { DECODE_IP4_DF_OFFSET, "(decode) IPV4 packet both DF and offset set" },
- { DECODE_ICMP6_TYPE_OTHER, "(decode) ICMP6 type not decoded" },
- { DECODE_ICMP6_DST_MULTICAST, "(decode) ICMP6 packet to multicast address" },
- { DECODE_TCP_SHAFT_SYNFLOOD, "(decode) DDOS shaft synflood" },
- { DECODE_ICMP_PING_NMAP, "(decode) ICMP PING NMAP" },
- { DECODE_ICMP_ICMPENUM, "(decode) ICMP icmpenum v1.1.1" },
- { DECODE_ICMP_REDIRECT_HOST, "(decode) ICMP redirect host" },
- { DECODE_ICMP_REDIRECT_NET, "(decode) ICMP redirect net" },
- { DECODE_ICMP_TRACEROUTE_IPOPTS, "(decode) ICMP traceroute ipopts" },
- { DECODE_ICMP_SOURCE_QUENCH, "(decode) ICMP Source Quench" },
- { DECODE_ICMP_BROADSCAN_SMURF_SCANNER, "(decode) Broadscan Smurf Scanner" },
- { DECODE_ICMP_DST_UNREACH_ADMIN_PROHIBITED, "(decode) ICMP Destination Unreachable Communication Administratively Prohibited" },
- { DECODE_ICMP_DST_UNREACH_DST_HOST_PROHIBITED, "(decode) ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited" },
- { DECODE_ICMP_DST_UNREACH_DST_NET_PROHIBITED, "(decode) ICMP Destination Unreachable Communication with Destination Network is Administratively Prohibited" },
- { DECODE_IP_OPTION_SET, "(decode) MISC IP option set" },
- { DECODE_UDP_LARGE_PACKET, "(decode) MISC Large UDP Packet" },
- { DECODE_TCP_PORT_ZERO, "(decode) BAD-TRAFFIC TCP port 0 traffic" },
- { DECODE_UDP_PORT_ZERO, "(decode) BAD-TRAFFIC UDP port 0 traffic" },
- { DECODE_IP_RESERVED_FRAG_BIT, "(decode) BAD-TRAFFIC IP reserved bit set" },
- { DECODE_IP_UNASSIGNED_PROTO, "(decode) BAD-TRAFFIC Unassigned/Reserved IP protocol" },
- { DECODE_IP_BAD_PROTO, "(decode) BAD-TRAFFIC Bad IP protocol" },
- { DECODE_ICMP_PATH_MTU_DOS, "(decode) ICMP PATH MTU denial of service attempt" },
- { DECODE_ICMP_DOS_ATTEMPT, "(decode) BAD-TRAFFIC linux ICMP header dos attempt" },
- { DECODE_IPV6_ISATAP_SPOOF, "(decode) BAD-TRAFFIC ISATAP-addressed IPv6 traffic spoofing attempt" },
- { DECODE_PGM_NAK_OVERFLOW, "(decode) BAD-TRAFFIC PGM nak list overflow attempt" },
- { DECODE_IGMP_OPTIONS_DOS, "(decode) DOS IGMP IP Options validation attempt" },
- { DECODE_IP6_EXCESS_EXT_HDR, "(decode) too many IP6 extension headers" },
- { DECODE_ICMPV6_UNREACHABLE_NON_RFC_4443_CODE, "(decode) ICMPv6 packet of type 1 (destination unreachable) with non-RFC 4443 code" },
- { DECODE_IPV6_BAD_FRAG_PKT, "(decode) bogus fragmentation packet. Possible BSD attack" },
- { DECODE_ZERO_LENGTH_FRAG, "(decode) fragment with zero length" },
- { DECODE_ICMPV6_NODE_INFO_BAD_CODE, "(decode) ICMPv6 node info query/response packet with a code greater than 2" },
- { DECODE_IPV6_ROUTE_ZERO, "(snort decoder) IPV6 routing type 0 extension header" },
- { DECODE_ERSPAN_HDR_VERSION_MISMATCH, "(decode) ERSpan Header version mismatch" },
- { DECODE_ERSPAN2_DGRAM_LT_HDR, "(decode) captured < ERSpan Type2 Header Length" },
- { DECODE_ERSPAN3_DGRAM_LT_HDR, "(decode) captured < ERSpan Type3 Header Length" },
-
- { DECODE_BAD_MPLS, "(decode) Bad MPLS Frame" },
- { DECODE_BAD_MPLS_LABEL0, "(decode) MPLS Label 0 Appears in Nonbottom Header" },
- { DECODE_BAD_MPLS_LABEL1, "(decode) MPLS Label 1 Appears in Bottom Header" },
- { DECODE_BAD_MPLS_LABEL2, "(decode) MPLS Label 2 Appears in Nonbottom Header" },
- { DECODE_BAD_MPLS_LABEL3, "(decode) MPLS Label 3 Appears in Header" },
- { DECODE_MPLS_RESERVED_LABEL, "(decode) MPLS Label 4, 5,.. or 15 Appears in Header" },
- { DECODE_MPLS_LABEL_STACK, "(decode) Too Many MPLS headers" },
- { DECODE_AUTH_HDR_TRUNC, "(decode) Truncated authentication header"},
- { DECODE_AUTH_HDR_BAD_LEN, "(decode) Bad authentication header length"},
-
- { 0, nullptr }
-};
-
-//-------------------------------------------------------------------------
-// decode module
-//-------------------------------------------------------------------------
-
-DecodeModule::DecodeModule() :
- Module("decode", decode_params, decode_rules) { }
-
-bool DecodeModule::set(const char*, Value& v, SnortConfig* sc)
-{
- if ( v.is("decode_data_link") )
- {
- if ( v.get_bool() )
- ConfigDecodeDataLink(sc, "");
- }
- else if ( v.is("decode_esp") )
- sc->enable_esp = v.get_bool();
-
- else if ( v.is("enable_deep_teredo_inspection") )
- sc->enable_teredo = v.get_long(); // FIXIT move to existing bitfield
-
- else if ( v.is("enable_gtp") )
- {
- if ( v.get_bool() )
- sc->enable_gtp = 1; // FIXIT move to existing bitfield
- }
- else if ( v.is("enable_mpls_multicast") )
- {
- if ( v.get_bool() )
- sc->run_flags |= RUN_FLAG__MPLS_MULTICAST; // FIXIT move to existing bitfield
- }
- else if ( v.is("enable_mpls_overlapping_ip") )
- {
- if ( v.get_bool() )
- sc->run_flags |= RUN_FLAG__MPLS_OVERLAPPING_IP; // FIXIT move to existing bitfield
- }
- else if ( v.is("gtp_ports") )
- ConfigGTPDecoding(sc, v.get_string());
-
- else if ( v.is("max_mpls_label_chain_len") )
- sc->mpls_stack_depth = v.get_long();
-
- else if ( v.is("mpls_payload_type") )
- sc->mpls_payload_type = v.get_long() + 1;
-
- else if ( v.is("snaplen") )
- ConfigPacketSnaplen(sc, v.get_string());
-
- else
- return false;
-
- return true;
-}
-
/*
** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
**
-** This program is free software; you can redistribute it and/or modify
+** This program is free software, you can redistribute it and/or modify
** it under the terms of the GNU General Public License Version 2 as
** published by the Free Software Foundation. You may not use, modify or
** distribute this program under any other version of the GNU General
** Public License.
**
** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** but WITHOUT ANY WARRANTY, without even the implied warranty of
** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
** GNU General Public License for more details.
**
** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
+** along with this program, if not, write to the Free Software
** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
#include "framework/module.h"
-#define GID_DECODE 116
-
-#define DECODE_NOT_IPV4_DGRAM 1
-#define DECODE_IPV4_INVALID_HEADER_LEN 2
-#define DECODE_IPV4_DGRAM_LT_IPHDR 3
-#define DECODE_IPV4OPT_BADLEN 4
-#define DECODE_IPV4OPT_TRUNCATED 5
-#define DECODE_IPV4_DGRAM_GT_CAPLEN 6
-
-#define DECODE_TCP_DGRAM_LT_TCPHDR 45
-#define DECODE_TCP_INVALID_OFFSET 46
-#define DECODE_TCP_LARGE_OFFSET 47
-
-#define DECODE_TCPOPT_BADLEN 54
-#define DECODE_TCPOPT_TRUNCATED 55
-#define DECODE_TCPOPT_TTCP 56
-#define DECODE_TCPOPT_OBSOLETE 57
-#define DECODE_TCPOPT_EXPERIMENTAL 58
-#define DECODE_TCPOPT_WSCALE_INVALID 59
-
-#define DECODE_UDP_DGRAM_LT_UDPHDR 95
-#define DECODE_UDP_DGRAM_INVALID_LENGTH 96
-#define DECODE_UDP_DGRAM_SHORT_PACKET 97
-#define DECODE_UDP_DGRAM_LONG_PACKET 98
-
-#define DECODE_ICMP_DGRAM_LT_ICMPHDR 105
-#define DECODE_ICMP_DGRAM_LT_TIMESTAMPHDR 106
-#define DECODE_ICMP_DGRAM_LT_ADDRHDR 107
-
-#define DECODE_ARP_TRUNCATED 109
-#define DECODE_EAPOL_TRUNCATED 110
-#define DECODE_EAPKEY_TRUNCATED 111
-#define DECODE_EAP_TRUNCATED 112
-
-#define DECODE_BAD_PPPOE 120
-#define DECODE_BAD_VLAN 130
-#define DECODE_BAD_VLAN_ETHLLC 131
-#define DECODE_BAD_VLAN_OTHER 132
-#define DECODE_BAD_80211_ETHLLC 133
-#define DECODE_BAD_80211_OTHER 134
-
-#define DECODE_BAD_TRH 140
-#define DECODE_BAD_TR_ETHLLC 141
-#define DECODE_BAD_TR_MR_LEN 142
-#define DECODE_BAD_TRHMR 143
-
-#define DECODE_BAD_TRAFFIC_LOOPBACK 150
-#define DECODE_BAD_TRAFFIC_SAME_SRCDST 151
-
-#define DECODE_GRE_DGRAM_LT_GREHDR 160
-#define DECODE_GRE_MULTIPLE_ENCAPSULATION 161
-#define DECODE_GRE_INVALID_VERSION 162
-#define DECODE_GRE_INVALID_HEADER 163
-#define DECODE_GRE_V1_INVALID_HEADER 164
-#define DECODE_GRE_TRANS_DGRAM_LT_TRANSHDR 165
-
-#define DECODE_BAD_MPLS 170
-#define DECODE_BAD_MPLS_LABEL0 171
-#define DECODE_BAD_MPLS_LABEL1 172
-#define DECODE_BAD_MPLS_LABEL2 173
-#define DECODE_BAD_MPLS_LABEL3 174
-#define DECODE_MPLS_RESERVED_LABEL 175
-#define DECODE_MPLS_LABEL_STACK 176
-
-#define DECODE_ICMP_ORIG_IP_TRUNCATED 250
-#define DECODE_ICMP_ORIG_IP_VER_MISMATCH 251
-#define DECODE_ICMP_ORIG_DGRAM_LT_ORIG_IP 252
-#define DECODE_ICMP_ORIG_PAYLOAD_LT_64 253
-#define DECODE_ICMP_ORIG_PAYLOAD_GT_576 254
-#define DECODE_ICMP_ORIG_IP_WITH_FRAGOFFSET 255
-
-#define DECODE_IPV6_MIN_TTL 270
-#define DECODE_IPV6_IS_NOT 271
-#define DECODE_IPV6_TRUNCATED_EXT 272
-#define DECODE_IPV6_TRUNCATED 273
-#define DECODE_IPV6_DGRAM_LT_IPHDR 274
-#define DECODE_IPV6_DGRAM_GT_CAPLEN 275
-#define DECODE_IPV6_DST_ZERO 276
-#define DECODE_IPV6_SRC_MULTICAST 277
-#define DECODE_IPV6_DST_RESERVED_MULTICAST 278
-#define DECODE_IPV6_BAD_OPT_TYPE 279
-#define DECODE_IPV6_BAD_MULTICAST_SCOPE 280
-#define DECODE_IPV6_BAD_NEXT_HEADER 281
-#define DECODE_IPV6_ROUTE_AND_HOPBYHOP 282
-#define DECODE_IPV6_TWO_ROUTE_HEADERS 283
-
-#define DECODE_ICMPV6_TOO_BIG_BAD_MTU 285
-#define DECODE_ICMPV6_UNREACHABLE_NON_RFC_2463_CODE 286
-#define DECODE_ICMPV6_SOLICITATION_BAD_CODE 287
-#define DECODE_ICMPV6_ADVERT_BAD_CODE 288
-#define DECODE_ICMPV6_SOLICITATION_BAD_RESERVED 289
-#define DECODE_ICMPV6_ADVERT_BAD_REACHABLE 290
-
-#define DECODE_IPV6_TUNNELED_IPV4_TRUNCATED 291
-#define DECODE_IPV6_DSTOPTS_WITH_ROUTING 292
-#define DECODE_IP_MULTIPLE_ENCAPSULATION 293
-
-#define DECODE_ESP_HEADER_TRUNC 294
-#define DECODE_IPV6_BAD_OPT_LEN 295
-#define DECODE_IPV6_UNORDERED_EXTENSIONS 296
-
-#define DECODE_GTP_MULTIPLE_ENCAPSULATION 297
-#define DECODE_GTP_BAD_LEN 298
+const int GID_DECODE = 116;
//-----------------------------------------------------
// remember to add rules to preproc_rules/decoder.rules
// add the new decoder rules to the following enum.
-#define DECODE_START_INDEX 400
-enum {
- DECODE_TCP_XMAS = DECODE_START_INDEX,
+enum CodecSid {
+
+ DECODE_NOT_IPV4_DGRAM = 1,
+ DECODE_IPV4_INVALID_HEADER_LEN = 2,
+ DECODE_IPV4_DGRAM_LT_IPHDR = 3,
+ DECODE_IPV4OPT_BADLEN = 4,
+ DECODE_IPV4OPT_TRUNCATED = 5,
+ DECODE_IPV4_DGRAM_GT_CAPLEN = 6,
+
+ DECODE_TCP_DGRAM_LT_TCPHDR = 45,
+ DECODE_TCP_INVALID_OFFSET = 46,
+ DECODE_TCP_LARGE_OFFSET = 47,
+
+ DECODE_TCPOPT_BADLEN = 54,
+ DECODE_TCPOPT_TRUNCATED = 55,
+ DECODE_TCPOPT_TTCP = 56,
+ DECODE_TCPOPT_OBSOLETE = 57,
+ DECODE_TCPOPT_EXPERIMENTAL = 58,
+ DECODE_TCPOPT_WSCALE_INVALID = 59,
+
+ DECODE_UDP_DGRAM_LT_UDPHDR = 95,
+ DECODE_UDP_DGRAM_INVALID_LENGTH = 96,
+ DECODE_UDP_DGRAM_SHORT_PACKET = 97,
+ DECODE_UDP_DGRAM_LONG_PACKET = 98,
+
+ DECODE_ICMP_DGRAM_LT_ICMPHDR = 105,
+ DECODE_ICMP_DGRAM_LT_TIMESTAMPHDR = 106,
+ DECODE_ICMP_DGRAM_LT_ADDRHDR = 107,
+
+ DECODE_ARP_TRUNCATED = 109,
+ DECODE_EAPOL_TRUNCATED = 110,
+ DECODE_EAPKEY_TRUNCATED = 111,
+ DECODE_EAP_TRUNCATED = 112,
+
+ DECODE_BAD_PPPOE = 120,
+ DECODE_BAD_VLAN = 130,
+ DECODE_BAD_VLAN_ETHLLC = 131,
+ DECODE_BAD_VLAN_OTHER = 132,
+ DECODE_BAD_80211_ETHLLC = 133,
+ DECODE_BAD_80211_OTHER = 134,
+
+ DECODE_BAD_TRH = 140,
+ DECODE_BAD_TR_ETHLLC = 141,
+ DECODE_BAD_TR_MR_LEN = 142,
+ DECODE_BAD_TRHMR = 143,
+
+ DECODE_BAD_TRAFFIC_LOOPBACK = 150,
+ DECODE_BAD_TRAFFIC_SAME_SRCDST = 151,
+
+ DECODE_GRE_DGRAM_LT_GREHDR = 160,
+ DECODE_GRE_MULTIPLE_ENCAPSULATION = 161,
+ DECODE_GRE_INVALID_VERSION = 162,
+ DECODE_GRE_INVALID_HEADER = 163,
+ DECODE_GRE_V1_INVALID_HEADER = 164,
+ DECODE_GRE_TRANS_DGRAM_LT_TRANSHDR = 165,
+
+ DECODE_BAD_MPLS = 170,
+ DECODE_BAD_MPLS_LABEL0 = 171,
+ DECODE_BAD_MPLS_LABEL1 = 172,
+ DECODE_BAD_MPLS_LABEL2 = 173,
+ DECODE_BAD_MPLS_LABEL3 = 174,
+ DECODE_MPLS_RESERVED_LABEL = 175,
+ DECODE_MPLS_LABEL_STACK = 176,
+
+ DECODE_ICMP_ORIG_IP_TRUNCATED = 250,
+ DECODE_ICMP_ORIG_IP_VER_MISMATCH = 251,
+ DECODE_ICMP_ORIG_DGRAM_LT_ORIG_IP = 252,
+ DECODE_ICMP_ORIG_PAYLOAD_LT_64 = 253,
+ DECODE_ICMP_ORIG_PAYLOAD_GT_576 = 254,
+ DECODE_ICMP_ORIG_IP_WITH_FRAGOFFSET = 255,
+
+ DECODE_IPV6_MIN_TTL = 270,
+ DECODE_IPV6_IS_NOT = 271,
+ DECODE_IPV6_TRUNCATED_EXT = 272,
+ DECODE_IPV6_TRUNCATED = 273,
+ DECODE_IPV6_DGRAM_LT_IPHDR = 274,
+ DECODE_IPV6_DGRAM_GT_CAPLEN = 275,
+ DECODE_IPV6_DST_ZERO = 276,
+ DECODE_IPV6_SRC_MULTICAST = 277,
+ DECODE_IPV6_DST_RESERVED_MULTICAST = 278,
+ DECODE_IPV6_BAD_OPT_TYPE = 279,
+ DECODE_IPV6_BAD_MULTICAST_SCOPE = 280,
+ DECODE_IPV6_BAD_NEXT_HEADER = 281,
+ DECODE_IPV6_ROUTE_AND_HOPBYHOP = 282,
+ DECODE_IPV6_TWO_ROUTE_HEADERS = 283,
+
+ DECODE_ICMPV6_TOO_BIG_BAD_MTU = 285,
+ DECODE_ICMPV6_UNREACHABLE_NON_RFC_2463_CODE = 286,
+ DECODE_ICMPV6_SOLICITATION_BAD_CODE = 287,
+ DECODE_ICMPV6_ADVERT_BAD_CODE = 288,
+ DECODE_ICMPV6_SOLICITATION_BAD_RESERVED = 289,
+ DECODE_ICMPV6_ADVERT_BAD_REACHABLE = 290,
+
+ DECODE_IPV6_TUNNELED_IPV4_TRUNCATED = 291,
+ DECODE_IPV6_DSTOPTS_WITH_ROUTING = 292,
+ DECODE_IP_MULTIPLE_ENCAPSULATION = 293,
+
+ DECODE_ESP_HEADER_TRUNC = 294,
+ DECODE_IPV6_BAD_OPT_LEN = 295,
+ DECODE_IPV6_UNORDERED_EXTENSIONS = 296,
+
+ DECODE_GTP_MULTIPLE_ENCAPSULATION = 297,
+ DECODE_GTP_BAD_LEN = 298,
+
+ DECODE_TCP_XMAS = 400,
DECODE_TCP_NMAP_XMAS,
DECODE_DOS_NAPTHA,
DECODE_SYN_TO_MULTICAST,
class DecodeModule : public Module
{
public:
- DecodeModule();
- bool set(const char*, Value&, SnortConfig*);
+ using Module::Module; // inherit Module's constructors
unsigned get_gid() const
{ return GID_DECODE; };
if( STATIC_DECODERS )
set( PLUGIN_SOURCES
cd_ah.cc
+ cd_ah_module.h
+ cd_ah_module.cc
cd_dstopts.cc
cd_frag.cc
cd_gre.cc
+ cd_gre_module.h
+ cd_gre_module.cc
cd_hopopts.cc
cd_igmp.cc
- cd_ipv6.cc
+ cd_igmp_module.h
+ cd_igmp_module.cc
cd_no_next.cc
cd_pgm.cc
+ cd_pgm_module.h
+ cd_pgm_module.cc
cd_routing.cc
cd_swipe.cc
)
else()
- add_shared_library(cd_ah codecs cd_ah.cc)
+ add_shared_library(cd_ah codecs cd_ah.cc cd_ah_module.h cd_ah_module.cc)
add_shared_library(cd_dstopts codecs cd_dstopts.cc)
add_shared_library(cd_frag codecs cd_frag.cc)
- add_shared_library(cd_gre codecs cd_gre.cc)
+ add_shared_library(cd_gre codecs cd_gre.cc cd_gre_module.h cd_gre_module.cc)
add_shared_library(cd_hopopts codecs cd_hopopts.cc)
- add_shared_library(cd_igmp codecs cd_igmp.cc)
- add_shared_library(cd_ipv6 codecs cd_ipv6.cc)
+ add_shared_library(cd_igmp codecs cd_igmp.cc cd_igmp_module.h cd_igmp_module.cc)
add_shared_library(cd_no_next codecs cd_no_next.cc)
- add_shared_library(cd_pgm codecs cd_pgm.cc)
+ add_shared_library(cd_pgm codecs cd_pgm.cc cd_pgm_module.h cd_pgm_module.cc)
add_shared_library(cd_routing codecs cd_routing.cc)
add_shared_library(cd_swipe codecs cd_swipe.cc)
add_library( ip_codecs STATIC
cd_icmp4.cc
+ cd_icmp4_module.h
+ cd_icmp4_module.cc
cd_icmp6.cc
+ cd_icmp6_module.h
+ cd_icmp6_module.cc
cd_ipv4.cc
+ cd_ipv4_module.h
+ cd_ipv4_module.cc
cd_ipv6.cc
+ cd_ipv6_module.h
+ cd_ipv6_module.cc
cd_tcp.cc
+ cd_tcp_module.h
+ cd_tcp_module.cc
cd_udp.cc
+ cd_udp_module.h
+ cd_udp_module.cc
cd_esp.cc # statically linked due to its dependance on the packet manager.
+ cd_esp_module.h
+ cd_esp_module.cc
${PLUGIN_SOURCES}
)
main
managers
)
-
-
noinst_LIBRARIES = libip_codecs.a
libip_codecs_a_SOURCES = \
-cd_esp.cc \
cd_icmp4.cc \
+cd_icmp4_module.h \
+cd_icmp4_module.cc \
cd_icmp6.cc \
+cd_icmp6_module.h \
+cd_icmp6_module.cc \
cd_ipv4.cc \
+cd_ipv4_module.h \
+cd_ipv4_module.cc \
cd_ipv6.cc \
+cd_ipv6_module.h \
+cd_ipv6_module.cc \
cd_tcp.cc \
-cd_udp.cc
+cd_tcp_module.h \
+cd_tcp_module.cc \
+cd_udp.cc \
+cd_udp_module.h \
+cd_udp_module.cc \
+cd_esp.cc \
+cd_esp_module.h \
+cd_esp_module.cc
plugin_list = \
cd_ah.cc \
+cd_ah_module.h \
+cd_ah_module.cc \
cd_dstopts.cc \
cd_frag.cc \
cd_gre.cc \
+cd_gre_module.h \
+cd_gre_module.cc \
cd_hopopts.cc \
cd_igmp.cc \
-cd_ipv6.cc \
+cd_igmp_module.h \
+cd_igmp_module.cc \
cd_no_next.cc \
cd_pgm.cc \
+cd_pgm_module.h \
+cd_pgm_module.cc \
cd_routing.cc \
cd_swipe.cc
ehlib_LTLIBRARIES = libcd_ah.la
libcd_ah_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
libcd_ah_la_LDFLAGS = -export-dynamic -shared
-libcd_ah_la_SOURCES = cd_ah.cc
+libcd_ah_la_SOURCES = cd_ah.cc cd_ah_module.h cd_ah_module.cc
+
+ehlib_LTLIBRARIES += libcd_gre.la
+libcd_gre_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
+libcd_gre_la_LDFLAGS = -export-dynamic -shared
+libcd_gre_la_SOURCES = cd_gre.cc cd_gre_module.h cd_gre_module.cc
+
+ehlib_LTLIBRARIES += libcd_pgm.la
+libcd_pgm_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
+libcd_pgm_la_LDFLAGS = -export-dynamic -shared
+libcd_pgm_la_SOURCES = cd_gre.cc cd_pgm_module.h cd_pgm_module.cc
# TODO: PUT THESE IN THE LIST
#add_shared_library(cd_dstopts codecs cd_dstopts.cc)
#add_shared_library(cd_frag codecs cd_frag.cc)
-#add_shared_library(cd_gre codecs cd_gre.cc)
#add_shared_library(cd_hopopts codecs cd_hopopts.cc)
#add_shared_library(cd_igmp codecs cd_igmp.cc)
-#add_shared_library(cd_ipv6 codecs cd_ipv6.cc)
#add_shared_library(cd_no_next codecs cd_no_next.cc)
-#add_shared_library(cd_pgm codecs cd_pgm.cc)
#add_shared_library(cd_routing codecs cd_routing.cc)
#add_shared_library(cd_swipe codecs cd_swipe.cc)
#include "framework/codec.h"
#include "codecs/codec_events.h"
+#include "codecs/ip/cd_ah_module.h"
#include "protocols/protocol_ids.h"
#include "protocols/ipv6.h"
class AhCodec : public Codec
{
public:
- AhCodec() : Codec("ah"){};
+ AhCodec() : Codec(CD_AH_NAME){};
~AhCodec(){};
// api
//-------------------------------------------------------------------------
-static Codec* ctor()
+static Module* mod_ctor()
+{
+ return new AhModule;
+}
+
+static void mod_dtor(Module* m)
+{
+ delete m;
+}
+
+static Codec* ctor(Module*)
{
return new AhCodec();
}
delete cd;
}
-static const char* name = "ah";
static const CodecApi ah_api =
{
{
PT_CODEC,
- name,
+ CD_AH_NAME,
CDAPI_PLUGIN_V0,
0,
- nullptr,
- nullptr,
+ mod_ctor,
+ mod_dtor,
},
nullptr, // pinit
nullptr, // pterm
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// cd_ah_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
+
+#include "codecs/ip/cd_ah_module.h"
+
+
+static const Parameter ah_params[] =
+{
+ { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
+};
+
+
+static const RuleMap ah_rules[] =
+{
+ { DECODE_AUTH_HDR_TRUNC, "(" CD_AH_NAME ") Truncated authentication header"},
+ { DECODE_AUTH_HDR_BAD_LEN, "(" CD_AH_NAME ") Bad authentication header length"},
+ { 0, nullptr }
+};
+
+//-------------------------------------------------------------------------
+// rpc module
+//-------------------------------------------------------------------------
+
+AhModule::AhModule() : DecodeModule(CD_AH_NAME, ah_params, ah_rules)
+{ }
+
+bool AhModule::set(const char*, Value&, SnortConfig*)
+{
+ return true;
+}
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// cd_ah_module.h author Josh Rosenbaum <jrosenba@cisco.com>
+
+#ifndef CD_AH_MODULE_H
+#define CD_AH_MODULE_H
+
+#include "codecs/decode_module.h"
+
+
+#define CD_AH_NAME "codec_ah"
+
+class AhModule : public DecodeModule
+{
+public:
+ AhModule();
+
+ bool set(const char*, Value&, SnortConfig*);
+};
+
+#endif
namespace
{
+#define CD_DSTOPTS_NAME "codec_ipv6_dstopts"
+
class Ipv6DSTOptsCodec : public Codec
{
public:
- Ipv6DSTOptsCodec() : Codec("ipv6_dstopts"){};
+ Ipv6DSTOptsCodec() : Codec(CD_DSTOPTS_NAME){};
~Ipv6DSTOptsCodec() {};
// api
//-------------------------------------------------------------------------
-static Codec* ctor()
+static Codec* ctor(Module*)
{
return new Ipv6DSTOptsCodec();
}
delete cd;
}
-static const char* name = "ipv6_dstopts";
-
static const CodecApi ipv6_dstopts_api =
{
{
PT_CODEC,
- name,
+ CD_DSTOPTS_NAME,
CDAPI_PLUGIN_V0,
0,
nullptr,
#include "framework/codec.h"
#include "snort.h"
-#include "codecs/decode_module.h"
+#include "codecs/ip/cd_esp_module.h"
#include "managers/packet_manager.h"
#include "codecs/codec_events.h"
#include "protocols/protocol_ids.h"
class EspCodec : public Codec
{
public:
- EspCodec() : Codec("esp"){};
+ EspCodec() : Codec(CD_ESP_NAME){};
~EspCodec(){};
return true;
}
-static Codec* ctor()
+
+//-------------------------------------------------------------------------
+// api
+//-------------------------------------------------------------------------
+
+static Module* mod_ctor()
+{
+ return new EspModule;
+}
+
+static void mod_dtor(Module* m)
+{
+ delete m;
+}
+
+static Codec* ctor(Module*)
{
return new EspCodec();
}
delete cd;
}
-static const char* name = "esp";
static const CodecApi esp_api =
{
- {
+ {
PT_CODEC,
- name,
+ CD_ESP_NAME,
CDAPI_PLUGIN_V0,
0,
- nullptr,
- nullptr,
+ mod_ctor,
+ mod_dtor,
},
- NULL, // pinit
- NULL, // pterm
- NULL, // tinit
- NULL, // tterm
+ nullptr, // pinit
+ nullptr, // pterm
+ nullptr, // tinit
+ nullptr, // tterm
ctor, // ctor
dtor, // dtor
};
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// cd_esp_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
+
+#include "codecs/ip/cd_esp_module.h"
+#include "main/snort_config.h"
+
+
+static const Parameter esp_params[] =
+{
+ { "decode_esp", Parameter::PT_BOOL, nullptr, "false",
+ "enable for inspection of esp traffic that has authentication but not encryption" },
+
+ { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
+};
+
+
+// rules which will loaded into snort.
+// You can now reference these rules by calling a codec_event
+// in your main codec's functions
+static const RuleMap esp_rules[] =
+{
+ { DECODE_ESP_HEADER_TRUNC, "(" CD_ESP_NAME ") truncated Encapsulated Security Payload (ESP) header" },
+ { 0, nullptr }
+};
+
+//-------------------------------------------------------------------------
+// rpc module
+//-------------------------------------------------------------------------
+
+EspModule::EspModule() : DecodeModule(CD_ESP_NAME, esp_params, esp_rules)
+{ }
+
+bool EspModule::set(const char*, Value& v, SnortConfig* sc)
+{
+ if ( v.is("decode_esp") )
+ sc->enable_esp = v.get_bool();
+ else
+ return false;
+
+ return true;
+}
+
+
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// cd_esp_module.h author Josh Rosenbaum <jrosenba@cisco.com>
+
+#ifndef CD_ESP_MODULE_H
+#define CD_ESP_MODULE_H
+
+#include "codecs/decode_module.h"
+
+
+#define CD_ESP_NAME "codec_esp"
+
+class EspModule : public DecodeModule
+{
+public:
+ EspModule();
+
+ bool set(const char*, Value&, SnortConfig*);
+};
+
+#endif
+
namespace
{
+#define CD_IPV6_FRAG_NAME "codec_ipv6_frag"
+
class Ipv6FragCodec : public Codec
{
public:
- Ipv6FragCodec() : Codec("ipv6_frag"){};
+ Ipv6FragCodec() : Codec(CD_IPV6_FRAG_NAME){};
~Ipv6FragCodec() {};
// api
//-------------------------------------------------------------------------
-static Codec* ctor()
+static Codec* ctor(Module*)
{
return new Ipv6FragCodec();
}
delete cd;
}
-
-static const char* name = "ipv6_frag";
static const CodecApi ipv6_frag_api =
{
- {
- PT_CODEC,
- name,
- CDAPI_PLUGIN_V0,
+ {
+ PT_CODEC,
+ CD_IPV6_FRAG_NAME,
+ CDAPI_PLUGIN_V0,
0,
nullptr,
nullptr,
#include "framework/codec.h"
-#include "codecs/decode_module.h"
+#include "codecs/ip/cd_gre_module.h"
#include "codecs/codec_events.h"
#include "protocols/packet.h"
-
#include "protocols/protocol_ids.h"
namespace
class GreCodec : public Codec
{
public:
- GreCodec() : Codec("gre"){};
+ GreCodec() : Codec(CD_GRE_NAME){};
~GreCodec(){};
sre_addrfamily = ntohs(*((uint16_t *)sre_ptr));
sre_ptr += sizeof(sre_addrfamily);
-// sre_offset = *((uint8_t *)sre_ptr);
sre_ptr += sizeof(sre_offset);
sre_length = *((uint8_t *)sre_ptr);
// api
//-------------------------------------------------------------------------
+static Module* mod_ctor()
+{
+ return new GreModule;
+}
+
+static void mod_dtor(Module* m)
+{
+ delete m;
+}
-static Codec* ctor()
+static Codec* ctor(Module*)
{
return new GreCodec();
}
delete cd;
}
-static const char* name = "gre";
static const CodecApi gre_api =
{
{
PT_CODEC,
- name,
+ CD_GRE_NAME,
CDAPI_PLUGIN_V0,
0,
- nullptr,
- nullptr,
+ mod_ctor,
+ mod_dtor,
},
nullptr, // pinit
nullptr, // pterm
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// cd_gre_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
+
+#include "codecs/ip/cd_gre_module.h"
+
+
+static const Parameter gre_params[] =
+{
+ { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
+};
+
+
+static const RuleMap gre_rules[] =
+{
+ { DECODE_GRE_DGRAM_LT_GREHDR, "(" CD_GRE_NAME ") GRE header length > payload length" },
+ { DECODE_GRE_MULTIPLE_ENCAPSULATION, "(" CD_GRE_NAME ") Multiple encapsulations in packet" },
+ { DECODE_GRE_INVALID_VERSION, "(" CD_GRE_NAME ") Invalid GRE version" },
+ { DECODE_GRE_INVALID_HEADER, "(" CD_GRE_NAME ") Invalid GRE header" },
+ { DECODE_GRE_V1_INVALID_HEADER, "(" CD_GRE_NAME ") Invalid GRE v.1 PPTP header" },
+ { DECODE_GRE_TRANS_DGRAM_LT_TRANSHDR, "(" CD_GRE_NAME ") GRE Trans header length > payload length" },
+ { 0, nullptr }
+};
+
+//-------------------------------------------------------------------------
+// rpc module
+//-------------------------------------------------------------------------
+
+GreModule::GreModule() : DecodeModule(CD_GRE_NAME, gre_params, gre_rules)
+{ }
+
+bool GreModule::set(const char*, Value&, SnortConfig*)
+{
+ return true;
+}
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// cd_gre_module.h author Josh Rosenbaum <jrosenba@cisco.com>
+
+#ifndef CD_GRE_MODULE_H
+#define CD_GRE_MODULE_H
+
+#include "codecs/decode_module.h"
+
+
+#define CD_GRE_NAME "codec_gre"
+
+class GreModule : public DecodeModule
+{
+public:
+ GreModule();
+
+ bool set(const char*, Value&, SnortConfig*);
+};
+
+#endif
namespace
{
+#define CD_HOPOPTS_NAME "codec_ipv6_hopopts"
+
class Ipv6HopOptsCodec : public Codec
{
public:
- Ipv6HopOptsCodec() : Codec("ipv6_hopopts") {};
+ Ipv6HopOptsCodec() : Codec(CD_HOPOPTS_NAME) {};
~Ipv6HopOptsCodec() {};
virtual void get_protocol_ids(std::vector<uint16_t>& v);
} // anonymous namespace
-
-
/*
* Class functions
*/
// api
//-------------------------------------------------------------------------
-
-static Codec* ctor()
+static Codec* ctor(Module*)
{
return new Ipv6HopOptsCodec();
}
delete cd;
}
-static const char* name = "ipv6_hopopts";
-
static const CodecApi ipv6_hopopts_api =
{
- {
- PT_CODEC,
- name,
- CDAPI_PLUGIN_V0,
+ {
+ PT_CODEC,
+ CD_HOPOPTS_NAME,
+ CDAPI_PLUGIN_V0,
0,
nullptr,
nullptr,
#include "framework/codec.h"
#include "snort.h"
-#include "codecs/decode_module.h"
#include "protocols/icmp4.h"
#include "codecs/codec_events.h"
#include "codecs/checksum.h"
#include "protocols/protocol_ids.h"
+#include "codecs/ip/cd_icmp4_module.h"
namespace{
class Icmp4Codec : public Codec{
public:
- Icmp4Codec() : Codec("icmp4"){};
+ Icmp4Codec() : Codec(CD_ICMP4_NAME){};
~Icmp4Codec() {};
virtual void get_protocol_ids(std::vector<uint16_t>&);
p->error_flags |= PKT_ERR_CKSUM_ICMP;
DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Bad ICMP Checksum\n"););
codec_events::exec_icmp_chksm_drop(p);
-// dc.invalid_checksums++;
}
else
{
// api
//-------------------------------------------------------------------------
-static Codec *ctor()
+
+static Module* mod_ctor()
+{
+ return new Icmp4Module;
+}
+
+static void mod_dtor(Module* m)
+{
+ delete m;
+}
+
+static Codec *ctor(Module*)
{
return new Icmp4Codec();
}
delete cd;
}
-static const char* name = "icmp4";
static const CodecApi icmp4_api =
{
- {
+ {
PT_CODEC,
- name,
+ CD_ICMP4_NAME,
CDAPI_PLUGIN_V0,
0,
- nullptr,
- nullptr
+ mod_ctor,
+ mod_dtor
},
- NULL, // pinit
- NULL, // pterm
- NULL, // tinit
- NULL, // tterm
+ nullptr, // pinit
+ nullptr, // pterm
+ nullptr, // tinit
+ nullptr, // tterm
ctor, // ctor
dtor, // dtor
};
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// cd_icmp4_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
+
+#include "codecs/ip/cd_icmp4_module.h"
+
+
+static const Parameter icmp4_params[] =
+{
+ { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
+};
+
+
+// rules which will loaded into snort.
+// You can now reference these rules by calling a codec_event
+// in your main codec's functions
+static const RuleMap icmp4_rules[] =
+{
+ { DECODE_ICMP_DGRAM_LT_ICMPHDR, "(" CD_ICMP4_NAME ") ICMP Header Truncated" },
+ { DECODE_ICMP_DGRAM_LT_TIMESTAMPHDR, "(" CD_ICMP4_NAME ") ICMP Timestamp Header Truncated" },
+ { DECODE_ICMP_DGRAM_LT_ADDRHDR, "(" CD_ICMP4_NAME ") ICMP Address Header Truncated" },
+ { DECODE_ICMP_ORIG_IP_TRUNCATED, "(" CD_ICMP4_NAME ") ICMP Original IP Header Truncated" },
+ { DECODE_ICMP_ORIG_IP_VER_MISMATCH, "(" CD_ICMP4_NAME ") ICMP version and Original IP Header versions differ" },
+ { DECODE_ICMP_ORIG_DGRAM_LT_ORIG_IP, "(" CD_ICMP4_NAME ") ICMP Original Datagram Length < Original IP Header Length" },
+ { DECODE_ICMP_ORIG_PAYLOAD_LT_64, "(" CD_ICMP4_NAME ") ICMP Original IP Payload < 64 bits" },
+ { DECODE_ICMP_ORIG_PAYLOAD_GT_576, "(" CD_ICMP4_NAME ") ICMP Origianl IP Payload > 576 bytes" },
+ { DECODE_ICMP_ORIG_IP_WITH_FRAGOFFSET, "(" CD_ICMP4_NAME ") ICMP Original IP Fragmented and Offset Not 0" },
+ { DECODE_ICMP4_DST_MULTICAST, "(" CD_ICMP4_NAME ") ICMP4 packet to multicast dest address" },
+ { DECODE_ICMP4_DST_BROADCAST, "(" CD_ICMP4_NAME ") ICMP4 packet to broadcast dest address" },
+ { DECODE_ICMP4_TYPE_OTHER, "(" CD_ICMP4_NAME ") ICMP4 type other" },
+ { DECODE_ICMP_PING_NMAP, "(" CD_ICMP4_NAME ") ICMP PING NMAP" },
+ { DECODE_ICMP_ICMPENUM, "(" CD_ICMP4_NAME ") ICMP icmpenum v1.1.1" },
+ { DECODE_ICMP_REDIRECT_HOST, "(" CD_ICMP4_NAME ") ICMP redirect host" },
+ { DECODE_ICMP_REDIRECT_NET, "(" CD_ICMP4_NAME ") ICMP redirect net" },
+ { DECODE_ICMP_TRACEROUTE_IPOPTS, "(" CD_ICMP4_NAME ") ICMP traceroute ipopts" },
+ { DECODE_ICMP_SOURCE_QUENCH, "(" CD_ICMP4_NAME ") ICMP Source Quench" },
+ { DECODE_ICMP_BROADSCAN_SMURF_SCANNER, "(" CD_ICMP4_NAME ") Broadscan Smurf Scanner" },
+ { DECODE_ICMP_DST_UNREACH_ADMIN_PROHIBITED, "(" CD_ICMP4_NAME ") ICMP Destination Unreachable Communication Administratively Prohibited" },
+ { DECODE_ICMP_DST_UNREACH_DST_HOST_PROHIBITED, "(" CD_ICMP4_NAME ") ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited" },
+ { DECODE_ICMP_DST_UNREACH_DST_NET_PROHIBITED, "(" CD_ICMP4_NAME ") ICMP Destination Unreachable Communication with Destination Network is Administratively Prohibited" },
+ { DECODE_ICMP_PATH_MTU_DOS, "(" CD_ICMP4_NAME ") ICMP PATH MTU denial of service attempt" },
+ { DECODE_ICMP_DOS_ATTEMPT, "(" CD_ICMP4_NAME ") BAD-TRAFFIC linux ICMP header dos attempt" },
+ { DECODE_ICMP4_HDR_TRUNC, "(" CD_ICMP4_NAME ") truncated ICMP4 header" },
+ { 0, nullptr }
+};
+
+//-------------------------------------------------------------------------
+// rpc module
+//-------------------------------------------------------------------------
+
+Icmp4Module::Icmp4Module() : DecodeModule(CD_ICMP4_NAME, icmp4_params, icmp4_rules)
+{ }
+
+bool Icmp4Module::set(const char*, Value&, SnortConfig*)
+{
+ return true;
+}
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// cd_icmp4_module.h author Josh Rosenbaum <jrosenba@cisco.com>
+
+#ifndef CD_ICMP4_MODULE_H
+#define CD_ICMP4_MODULE_H
+
+#include "codecs/decode_module.h"
+
+
+#define CD_ICMP4_NAME "codec_icmp4"
+
+class Icmp4Module : public DecodeModule
+{
+public:
+ Icmp4Module();
+
+ bool set(const char*, Value&, SnortConfig*);
+};
+
+#endif
+
#include "protocols/icmp6.h"
#include "protocols/icmp4.h"
+#include "codecs/ip/cd_icmp6_module.h"
namespace
class Icmp6Codec : public Codec
{
public:
- Icmp6Codec() : Codec("icmp6"){};
+ Icmp6Codec() : Codec(CD_ICMP6_NAME){};
~Icmp6Codec(){};
p->error_flags |= PKT_ERR_CKSUM_ICMP;
DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Bad ICMP Checksum\n"););
codec_events::exec_icmp_chksm_drop(p);
-// dc.invalid_checksums++;
}
else
{
p->icmph = NULL;
p->icmp6h = NULL;
-// dc.discards++;
-// dc.icmpdisc++;
return false;
}
break;
case ICMP6_BIG:
-// case icmp6::Icmp6Types::BIG: --> naming conflict with a different macro in byte_exter.h
if (p->dsize >= sizeof(ICMP6TooBig))
{
ICMP6TooBig *too_big = (ICMP6TooBig *)raw_pkt;
p->icmph = NULL;
p->icmp6h = NULL;
-// dc.discards++;
-// dc.icmpdisc++;
return false;
}
break;
p->icmph = NULL;
p->icmp6h = NULL;
-// dc.discards++;
-// dc.icmpdisc++;
return false;
}
break;
p->icmph = NULL;
p->icmp6h = NULL;
-// dc.discards++;
-// dc.icmpdisc++;
return false;
}
break;
p->icmph = NULL;
p->icmp6h = NULL;
-// dc.discards++;
-// dc.icmpdisc++;
return false;
}
break;
p->icmph = NULL;
p->icmp6h = NULL;
-// dc.discards++;
-// dc.icmpdisc++;
return false;
}
break;
/* lay the IP struct over the raw data */
ipv6::IP6RawHdr* hdr = (ipv6::IP6RawHdr*)pkt;
-// dc.embdip++;
DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "DecodeICMPEmbeddedIP6: ip header"
" starts at: %p, length is %lu\n", hdr,
codec_events::decoder_event(p, DECODE_ICMP_ORIG_IP_TRUNCATED);
-// dc.discards++;
return;
}
codec_events::decoder_event(p, DECODE_ICMP_ORIG_IP_VER_MISMATCH);
-// dc.discards++;
return;
}
codec_events::decoder_event(p, DECODE_ICMP_ORIG_DGRAM_LT_ORIG_IP);
-// dc.discards++;
return;
}
sfiph_orig_build(p, pkt, AF_INET6);
// api
//-------------------------------------------------------------------------
+static Module* mod_ctor()
+{
+ return new Icmp6Module;
+}
+
+static void mod_dtor(Module* m)
+{
+ delete m;
+}
-static Codec* ctor()
+static Codec* ctor(Module*)
{
return new Icmp6Codec();
}
delete cd;
}
-static const char* name = "icmp6";
-
static const CodecApi ipv6_api =
{
{
PT_CODEC,
- name,
+ CD_ICMP6_NAME,
CDAPI_PLUGIN_V0,
0,
- nullptr,
- nullptr,
+ mod_ctor,
+ mod_dtor,
},
- NULL, // pinit
- NULL, // pterm
- NULL, // tinit
- NULL, // tterm
+ nullptr, // pinit
+ nullptr, // pterm
+ nullptr, // tinit
+ nullptr, // tterm
ctor, // ctor
dtor, // dtor
};
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// cd_icmp6_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
+
+#include "codecs/ip/cd_icmp6_module.h"
+
+
+static const Parameter icmp6_params[] =
+{
+ { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
+};
+
+
+// rules which will loaded into snort.
+// You can now reference these rules by calling a codec_event
+// in your main codec's functions
+static const RuleMap icmp6_rules[] =
+{
+ { DECODE_ICMP6_HDR_TRUNC, "(" CD_ICMP6_NAME ") truncated ICMP6 header" },
+ { DECODE_ICMP6_TYPE_OTHER, "(" CD_ICMP6_NAME ") ICMP6 type not decoded" },
+ { DECODE_ICMP6_DST_MULTICAST, "(" CD_ICMP6_NAME ") ICMP6 packet to multicast address" },
+ { DECODE_ICMPV6_TOO_BIG_BAD_MTU, "(" CD_ICMP6_NAME ") ICMPv6 packet of type 2 (message too big) with MTU field < 1280" },
+ { DECODE_ICMPV6_UNREACHABLE_NON_RFC_2463_CODE, "(" CD_ICMP6_NAME ") ICMPv6 packet of type 1 (destination unreachable) with non-RFC 2463 code" },
+ { DECODE_ICMPV6_SOLICITATION_BAD_CODE, "(" CD_ICMP6_NAME ") ICMPv6 router solicitation packet with a code not equal to 0" },
+ { DECODE_ICMPV6_ADVERT_BAD_CODE, "(" CD_ICMP6_NAME ") ICMPv6 router advertisement packet with a code not equal to 0" },
+ { DECODE_ICMPV6_SOLICITATION_BAD_RESERVED, "(" CD_ICMP6_NAME ") ICMPv6 router solicitation packet with the reserved field not equal to 0" },
+ { DECODE_ICMPV6_ADVERT_BAD_REACHABLE, "(" CD_ICMP6_NAME ") ICMPv6 router advertisement packet with the reachable time field set > 1 hour" },
+ { DECODE_ICMPV6_UNREACHABLE_NON_RFC_4443_CODE, "(" CD_ICMP6_NAME ") ICMPv6 packet of type 1 (destination unreachable) with non-RFC 4443 code" },
+ { DECODE_ICMPV6_NODE_INFO_BAD_CODE, "(" CD_ICMP6_NAME ") ICMPv6 node info query/response packet with a code greater than 2" },
+ { 0, nullptr }
+};
+
+//-------------------------------------------------------------------------
+// rpc module
+//-------------------------------------------------------------------------
+
+Icmp6Module::Icmp6Module() : DecodeModule(CD_ICMP6_NAME, icmp6_params, icmp6_rules)
+{ }
+
+bool Icmp6Module::set(const char*, Value&, SnortConfig*)
+{
+ return true;
+}
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// cd_icmp6_module.h author Josh Rosenbaum <jrosenba@cisco.com>
+
+#ifndef CD_ICMP6_MODULE_H
+#define CD_ICMP6_MODULE_H
+
+#include "codecs/decode_module.h"
+
+
+#define CD_ICMP6_NAME "codec_icmp6"
+
+class Icmp6Module : public DecodeModule
+{
+public:
+ Icmp6Module();
+
+ bool set(const char*, Value&, SnortConfig*);
+};
+
+#endif
#endif
#include "framework/codec.h"
-#include "codecs/decode_module.h"
+#include "codecs/ip/cd_igmp_module.h"
#include "codecs/codec_events.h"
class IgmpCodec : public Codec
{
public:
- IgmpCodec() : Codec("igmp"){};
+ IgmpCodec() : Codec(CD_IGMP_NAME){};
~IgmpCodec() {};
// api
//-------------------------------------------------------------------------
-static Codec* ctor()
+static Module* mod_ctor()
+{
+ return new IgmpModule;
+}
+
+static void mod_dtor(Module* m)
+{
+ delete m;
+}
+
+static Codec* ctor(Module*)
{
return new IgmpCodec();
}
delete cd;
}
-
-static const char* name = "igmp";
static const CodecApi igmp_api =
{
- {
- PT_CODEC,
- name,
- CDAPI_PLUGIN_V0,
+ {
+ PT_CODEC,
+ CD_IGMP_NAME,
+ CDAPI_PLUGIN_V0,
0,
- nullptr,
- nullptr,
+ mod_ctor,
+ mod_dtor,
},
nullptr, // pinit
nullptr, // pterm
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// cd_igmp_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
+
+#include "codecs/ip/cd_igmp_module.h"
+
+
+static const Parameter igmp_params[] =
+{
+ { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
+};
+
+
+static const RuleMap igmp_rules[] =
+{
+ { DECODE_IGMP_OPTIONS_DOS, "(" CD_IGMP_NAME ") DOS IGMP IP Options validation attempt" },
+ { 0, nullptr }
+};
+
+//-------------------------------------------------------------------------
+// rpc module
+//-------------------------------------------------------------------------
+
+IgmpModule::IgmpModule() : DecodeModule(CD_IGMP_NAME, igmp_params, igmp_rules)
+{ }
+
+bool IgmpModule::set(const char*, Value&, SnortConfig*)
+{
+ return true;
+}
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// cd_igmp_module.h author Josh Rosenbaum <jrosenba@cisco.com>
+
+#ifndef CD_IGMP_MODULE_H
+#define CD_IGMP_MODULE_H
+
+#include "codecs/decode_module.h"
+
+
+#define CD_IGMP_NAME "codec_igmp"
+
+class IgmpModule : public DecodeModule
+{
+public:
+ IgmpModule();
+
+ bool set(const char*, Value&, SnortConfig*);
+};
+
+#endif
#include "codecs/checksum.h"
#include "main/thread.h"
#include "stream/stream_api.h"
+#include "codecs/ip/cd_ipv4_module.h"
namespace{
class Ipv4Codec : public Codec
{
public:
- Ipv4Codec() : Codec("ipv4"){};
+ Ipv4Codec() : Codec(CD_IPV4_NAME){};
~Ipv4Codec(){};
virtual void get_protocol_ids(std::vector<uint16_t>& v);
uint32_t ip_len; /* length from the start of the ip hdr to the pkt end */
uint16_t hlen; /* ip header length */
-// dc.ip++;
-
-// if (p->greh != NULL)
-// dc.gre_ip++;
-
DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Packet!\n"););
/* do a little validation */
p->iph = NULL;
p->family = NO_IP;
-
-// dc.discards++;
-// dc.ipdisc++;
return false;
}
p->iph = NULL;
p->family = NO_IP;
-
-// dc.discards++;
-// dc.ipdisc++;
return false;
}
p->iph = NULL;
p->family = NO_IP;
-
-// dc.discards++;
-// dc.ipdisc++;
return false;
}
p->iph = NULL;
p->family = NO_IP;
-
-// dc.discards++;
-// dc.ipdisc++;
return false;
}
#if 0
p->iph = NULL;
p->family = NO_IP;
-
-// dc.discards++;
-// dc.ipdisc++;
return false;
}
DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Bad IP checksum\n"););
codec_events::exec_ip_chksm_drop(p);
-// dc.invalid_checksums++;
}
#ifdef DEBUG_MSGS
else
p->frag_flag = 1;
p->ip_frag_start = raw_pkt + hlen;
p->ip_frag_len = (uint16_t)ip_len;
-// dc.frags++;
}
}
else
{
- case IPPROTO_IPV6:
-// dc.ip4ip6++;
-// if ( ScTunnelBypassEnabled(TUNNEL_6IN4) )
-// Active_SetTunnelBypass();
- return;
-
case IPPROTO_IP_MOBILITY:
case IPPROTO_SUN_ND:
case IPPROTO_PIM:
sfiph_build(c, c->iph, AF_INET);
}
-/*
- * CHECKSUM
- */
-
-
-/*
-* checksum IP - header=20+ bytes
-*
-* w - short words of data
-* blen - byte length
-*
-*/
-
//-------------------------------------------------------------------------
// api
//-------------------------------------------------------------------------
+static Module* mod_ctor()
+{
+ return new Ipv4Module;
+}
+
+static void mod_dtor(Module* m)
+{
+ delete m;
+}
//-------------------------------------------------------------------------
// ip id considerations:
}
-static Codec *ctor()
+static Codec *ctor(Module*)
{
return new Ipv4Codec;
}
delete cd;
}
-
-static const char* name = "ipv4";
static const CodecApi ipv4_api =
{
{
PT_CODEC,
- name,
+ CD_IPV4_NAME,
CDAPI_PLUGIN_V0,
0,
- nullptr,
- nullptr
+ mod_ctor,
+ mod_dtor
},
ipv4_codec_ginit, // pinit
ipv4_codec_gterm, // pterm
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// cd_ipv4_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
+
+#include "codecs/ip/cd_ipv4_module.h"
+
+
+static const Parameter ipv4_params[] =
+{
+ { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
+};
+
+
+// rules which will loaded into snort.
+// You can now reference these rules by calling a codec_event
+// in your main codec's functions
+static const RuleMap ipv4_rules[] =
+{
+ { DECODE_NOT_IPV4_DGRAM, "(" CD_IPV4_NAME ") Not IPv4 datagram" },
+ { DECODE_IPV4_INVALID_HEADER_LEN, "(" CD_IPV4_NAME ") hlen < IP_HEADER_LEN" },
+ { DECODE_IPV4_DGRAM_LT_IPHDR, "(" CD_IPV4_NAME ") IP dgm len < IP Hdr len" },
+ { DECODE_IPV4OPT_BADLEN, "(" CD_IPV4_NAME ") Ipv4 Options found with bad lengths" },
+ { DECODE_IPV4OPT_TRUNCATED, "(" CD_IPV4_NAME ") Truncated Ipv4 Options" },
+ { DECODE_IPV4_DGRAM_GT_CAPLEN, "(" CD_IPV4_NAME ") IP dgm len > captured len" },
+ { DECODE_ZERO_TTL, "(" CD_IPV4_NAME ") IPV4 packet with zero TTL" },
+ { DECODE_BAD_FRAGBITS, "(" CD_IPV4_NAME ") IPV4 packet with bad frag bits (Both MF and DF set)" },
+ { DECODE_IP4_LEN_OFFSET, "(" CD_IPV4_NAME ") IPV4 packet frag offset + length exceed maximum" },
+ { DECODE_IP4_SRC_THIS_NET, "(" CD_IPV4_NAME ") IPV4 packet from 'current net' source address" },
+ { DECODE_IP4_DST_THIS_NET, "(" CD_IPV4_NAME ") IPV4 packet to 'current net' dest address" },
+ { DECODE_IP4_SRC_MULTICAST, "(" CD_IPV4_NAME ") IPV4 packet from multicast source address" },
+ { DECODE_IP4_SRC_RESERVED, "(" CD_IPV4_NAME ") IPV4 packet from reserved source address" },
+ { DECODE_IP4_DST_RESERVED, "(" CD_IPV4_NAME ") IPV4 packet to reserved dest address" },
+ { DECODE_IP4_SRC_BROADCAST, "(" CD_IPV4_NAME ") IPV4 packet from broadcast source address" },
+ { DECODE_IP4_DST_BROADCAST, "(" CD_IPV4_NAME ") IPV4 packet to broadcast dest address" },
+ { DECODE_IP4_MIN_TTL, "(" CD_IPV4_NAME ") IPV4 packet below TTL limit" },
+ { DECODE_IP4_DF_OFFSET, "(" CD_IPV4_NAME ") IPV4 packet both DF and offset set" },
+ { DECODE_IP_RESERVED_FRAG_BIT, "(decode) BAD-TRAFFIC IP reserved bit set" },
+ { DECODE_IP_UNASSIGNED_PROTO, "(decode) BAD-TRAFFIC Unassigned/Reserved IP protocol" },
+ { DECODE_IP_BAD_PROTO, "(decode) BAD-TRAFFIC Bad IP protocol" },
+ { DECODE_IP_OPTION_SET, "(decode) MISC IP option set" },
+ { DECODE_IP_MULTIPLE_ENCAPSULATION, "(decode) Two or more IP (v4 and/or v6) encapsulation layers present" },
+ { DECODE_ZERO_LENGTH_FRAG, "(decode) fragment with zero length" },
+ { DECODE_IP4_HDR_TRUNC, "(decode) truncated IP4 header" },
+ { DECODE_BAD_TRAFFIC_LOOPBACK, "(snort decoder) Bad Traffic Loopback IP" },
+ { DECODE_BAD_TRAFFIC_SAME_SRCDST, "(snort decoder) Bad Traffic Same Src/Dst IP" },
+ { 0, nullptr }
+};
+
+//-------------------------------------------------------------------------
+// rpc module
+//-------------------------------------------------------------------------
+
+Ipv4Module::Ipv4Module() : DecodeModule(CD_IPV4_NAME, ipv4_params, ipv4_rules)
+{ }
+
+bool Ipv4Module::set(const char*, Value&, SnortConfig*)
+{
+ return true;
+}
+
+
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// cd_ipv4_module.h author Josh Rosenbaum <jrosenba@cisco.com>
+
+#ifndef TEMPLATE_MODULE_H
+#define TEMPLATE_MODULE_H
+
+#include "codecs/decode_module.h"
+
+
+#define CD_IPV4_NAME "codec_ipv4"
+
+class Ipv4Module : public DecodeModule
+{
+public:
+ Ipv4Module();
+
+ bool set(const char*, Value&, SnortConfig*);
+};
+
+#endif
+
#include "stream/stream_api.h"
#include "main/snort.h"
#include "packet_io/active.h"
+#include "codecs/ip/cd_ipv6_module.h"
namespace
{
class Ipv6Codec : public Codec
{
public:
- Ipv6Codec() : Codec("ipv6"){};
+ Ipv6Codec() : Codec(CD_IPV6_NAME){};
~Ipv6Codec(){};
virtual void get_protocol_ids(std::vector<uint16_t>& v);
// api
//-------------------------------------------------------------------------
+static Module* mod_ctor()
+{
+ return new Ipv6Module;
+}
+
+static void mod_dtor(Module* m)
+{
+ delete m;
+}
-static Codec* ctor()
+static Codec* ctor(Module*)
{
return new Ipv6Codec();
}
delete cd;
}
-static const char* name = "ipv6";
static const CodecApi ipv6_api =
{
{
PT_CODEC,
- name,
+ CD_IPV6_NAME,
CDAPI_PLUGIN_V0,
0,
- nullptr,
- nullptr,
+ mod_ctor,
+ mod_dtor,
},
nullptr, // pinit
nullptr, // pterm
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// cd_ipv6_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
+
+#include "codecs/ip/cd_ipv6_module.h"
+
+
+static const Parameter ipv6_params[] =
+{
+ { "parameter1", Parameter::PT_BOOL, nullptr, "false",
+ "This is a boolean parameter" },
+
+ { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
+};
+
+
+// rules which will loaded into snort.
+// You can now reference these rules by calling a codec_event
+// in your main codec's functions
+static const RuleMap ipv6_rules[] =
+{
+ { DECODE_IPV6_MIN_TTL, "(" CD_IPV6_NAME ") IPv6 packet below TTL limit" },
+ { DECODE_IPV6_IS_NOT, "(" CD_IPV6_NAME ") IPv6 header claims to not be IPv6" },
+ { DECODE_IPV6_TRUNCATED_EXT, "(" CD_IPV6_NAME ") IPV6 truncated extension header" },
+ { DECODE_IPV6_TRUNCATED, "(" CD_IPV6_NAME ") IPV6 truncated header" },
+ { DECODE_IPV6_DGRAM_LT_IPHDR, "(" CD_IPV6_NAME ") IP dgm len < IP Hdr len" },
+ { DECODE_IPV6_DGRAM_GT_CAPLEN, "(" CD_IPV6_NAME ") IP dgm len > captured len" },
+ { DECODE_IPV6_DST_ZERO, "(" CD_IPV6_NAME ") IPv6 packet with destination address ::0" },
+ { DECODE_IPV6_SRC_MULTICAST, "(" CD_IPV6_NAME ") IPv6 packet with multicast source address" },
+ { DECODE_IPV6_DST_RESERVED_MULTICAST, "(" CD_IPV6_NAME ") IPv6 packet with reserved multicast destination address" },
+ { DECODE_IPV6_BAD_OPT_TYPE, "(" CD_IPV6_NAME ") IPv6 header includes an undefined option type" },
+ { DECODE_IPV6_BAD_MULTICAST_SCOPE, "(" CD_IPV6_NAME ") IPv6 address includes an unassigned multicast scope value" },
+ { DECODE_IPV6_BAD_NEXT_HEADER, "(" CD_IPV6_NAME ") IPv6 header includes an invalid value for the \"next header\" field" },
+ { DECODE_IPV6_ROUTE_AND_HOPBYHOP, "(" CD_IPV6_NAME ") IPv6 header includes a routing extension header followed by a hop-by-hop header" },
+ { DECODE_IPV6_TWO_ROUTE_HEADERS, "(" CD_IPV6_NAME ") IPv6 header includes two routing extension headers" },
+ { DECODE_IPV6_DSTOPTS_WITH_ROUTING, "(" CD_IPV6_NAME ") IPv6 header has destination options followed by a routing header" },
+ { DECODE_IPV6_TUNNELED_IPV4_TRUNCATED, "(" CD_IPV6_NAME ") IPV6 tunneled over IPv4, IPv6 header truncated, possible Linux Kernel attack" },
+ { DECODE_IPV6_BAD_OPT_LEN, "(" CD_IPV6_NAME ") IPv6 header includes an option which is too big for the containing header" },
+ { DECODE_IPV6_UNORDERED_EXTENSIONS, "(" CD_IPV6_NAME ") IPv6 packet includes out-of-order extension headers" },
+ { DECODE_IP6_ZERO_HOP_LIMIT, "(" CD_IPV6_NAME ") IPV6 packet has zero hop limit" },
+ { DECODE_IPV6_ISATAP_SPOOF, "(" CD_IPV6_NAME ") BAD-TRAFFIC ISATAP-addressed IPv6 traffic spoofing attempt" },
+ { DECODE_IPV6_BAD_FRAG_PKT, "(" CD_IPV6_NAME ") bogus fragmentation packet. Possible BSD attack" },
+ { DECODE_IPV6_ROUTE_ZERO, "(" CD_IPV6_NAME ") IPV6 routing type 0 extension header" },
+ { DECODE_IP6_EXCESS_EXT_HDR, "(decode) too many IP6 extension headers" },
+ { 0, nullptr }
+};
+
+//-------------------------------------------------------------------------
+// rpc module
+//-------------------------------------------------------------------------
+
+Ipv6Module::Ipv6Module() : DecodeModule(CD_IPV6_NAME, ipv6_params, ipv6_rules)
+{ }
+
+bool Ipv6Module::set(const char*, Value&, SnortConfig*)
+{
+ return true;
+}
/*
-** Copyright (C) 2002-2013 Sourcefire, Inc.
-** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
**
** This program is free software; you can redistribute it and/or modify
** it under the terms of the GNU General Public License Version 2 as
** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
+// cd_ipv6_module.h author Josh Rosenbaum <jrosenba@cisco.com>
-#ifndef ROOT_IEEE80211_H
-#define ROOT_IEEE80211_H
+#ifndef CD_IPV6_MODULE_H
+#define CD_IPV6_MODULE_H
+#include "codecs/decode_module.h"
-#ifndef NO_NON_ETHER_DECODER
-#define MINIMAL_IEEE80211_HEADER_LEN 10 /* Ack frames and others */
-#define IEEE802_11_DATA_HDR_LEN 24 /* Header for data packets */
-#endif // NO_NON_ETHER_DECODER
+#define CD_IPV6_NAME "codec_ipv6"
+class Ipv6Module : public DecodeModule
+{
+public:
+ Ipv6Module();
-void DecodeIEEE80211Pkt(Packet *, const DAQ_PktHdr_t*, const uint8_t *);
+ bool set(const char*, Value&, SnortConfig*);
-#endif /* PROT_TRK_H */
+};
+
+#endif
namespace
{
+#define CD_NO_NEXT_NAME "codec_ipv6_no_next"
+
class Ipv6NoNextCodec : public Codec
{
public:
- Ipv6NoNextCodec() : Codec("ipv6_no_next"){};
+ Ipv6NoNextCodec() : Codec(CD_NO_NEXT_NAME){};
~Ipv6NoNextCodec() {};
// api
//-------------------------------------------------------------------------
-static Codec* ctor()
+static Codec* ctor(Module*)
{
return new Ipv6NoNextCodec();
}
delete cd;
}
-
-static const char* name = "ipv6_no_next";
static const CodecApi no_next_api =
{
- {
- PT_CODEC,
- name,
- CDAPI_PLUGIN_V0,
+ {
+ PT_CODEC,
+ CD_NO_NEXT_NAME,
+ CDAPI_PLUGIN_V0,
0,
nullptr,
nullptr,
#endif
#include "framework/codec.h"
-#include "codecs/decode_module.h"
+#include "codecs/ip/cd_pgm_module.h"
#include "codecs/codec_events.h"
#include "protocols/ipv4.h"
#include "codecs/checksum.h"
class PgmCodec : public Codec
{
public:
- PgmCodec() : Codec("pgm"){};
+ PgmCodec() : Codec(CD_PGM_NAME){};
~PgmCodec() {};
// api
//-------------------------------------------------------------------------
-static Codec* ctor()
+static Module* mod_ctor()
+{
+ return new PgmModule;
+}
+
+static void mod_dtor(Module* m)
+{
+ delete m;
+}
+
+static Codec* ctor(Module*)
{
return new PgmCodec();
}
}
-static const char* name = "pgm";
static const CodecApi pgm_api =
{
- {
- PT_CODEC,
- name,
- CDAPI_PLUGIN_V0,
+ {
+ PT_CODEC,
+ CD_PGM_NAME,
+ CDAPI_PLUGIN_V0,
0,
- nullptr,
- nullptr,
+ mod_ctor,
+ mod_dtor,
},
nullptr, // pinit
nullptr, // pterm
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// cd_pgm_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
+
+#include "codecs/ip/cd_pgm_module.h"
+
+
+static const Parameter pgm_params[] =
+{
+ { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
+};
+
+
+static const RuleMap pgm_rules[] =
+{
+ { DECODE_PGM_NAK_OVERFLOW, "(" CD_PGM_NAME ") BAD-TRAFFIC PGM nak list overflow attempt" },
+ { 0, nullptr }
+};
+
+//-------------------------------------------------------------------------
+// rpc module
+//-------------------------------------------------------------------------
+
+PgmModule::PgmModule() : DecodeModule(CD_PGM_NAME, pgm_params, pgm_rules)
+{ }
+
+bool PgmModule::set(const char*, Value&, SnortConfig*)
+{
+ return true;
+}
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// cd_pgm_module.h author Josh Rosenbaum <jrosenba@cisco.com>
+
+#ifndef CD_PGM_MODULE_H
+#define CD_PGM_MODULE_H
+
+#include "codecs/decode_module.h"
+
+
+#define CD_PGM_NAME "codec_pgm"
+
+class PgmModule : public DecodeModule
+{
+public:
+ PgmModule();
+
+ bool set(const char*, Value&, SnortConfig*);
+};
+
+#endif
namespace
{
+#define CD_IPV6_ROUTING_NAME "codec_ipv6_routing"
+
class Ipv6RoutingCodec : public Codec
{
public:
- Ipv6RoutingCodec() : Codec("ipv6_routing"){};
+ Ipv6RoutingCodec() : Codec(CD_IPV6_ROUTING_NAME){};
~Ipv6RoutingCodec() {};
// api
//-------------------------------------------------------------------------
-static Codec* ctor()
+static Codec* ctor(Module*)
{
return new Ipv6RoutingCodec();
}
delete cd;
}
-
-static const char* name = "ipv6_routing";
static const CodecApi ipv6_routing_api =
{
- {
- PT_CODEC,
- name,
- CDAPI_PLUGIN_V0,
+ {
+ PT_CODEC,
+ CD_IPV6_ROUTING_NAME,
+ CDAPI_PLUGIN_V0,
0,
nullptr,
nullptr,
#endif
#include "framework/codec.h"
-#include "codecs/decode_module.h"
#include "codecs/codec_events.h"
namespace{
-class SwipeCodec : public Codec{
+#define CD_SWIPE_NAME "codec_swipe"
+
+class SwipeCodec : public Codec
+{
public:
- SwipeCodec() : Codec("swipe"){};
+ SwipeCodec() : Codec(CD_SWIPE_NAME){};
virtual ~SwipeCodec(){};
virtual void get_protocol_ids(std::vector<uint16_t>& v);
virtual bool decode(const uint8_t* raw_packet, const uint32_t raw_len,
Packet *p, uint16_t &lyr_len, uint16_t &);
};
-
} // namespace
static const uint16_t SWIPE_PROT_ID = 53;
// api
//-------------------------------------------------------------------------
-static Codec *ctor()
+static Codec *ctor(Module*)
{
return new SwipeCodec();
}
delete cd;
}
-static const char* const name = "swipe";
static const CodecApi swipe_api =
{
{
PT_CODEC,
- name,
+ CD_SWIPE_NAME,
CDAPI_PLUGIN_V0,
0,
nullptr,
#include "protocols/tcp.h"
#include "protocols/packet.h"
#include "framework/codec.h"
-
+#include "codecs/ip/cd_tcp_module.h"
namespace
{
class TcpCodec : public Codec
{
public:
- TcpCodec() : Codec("tcp")
+ TcpCodec() : Codec(CD_TCP_NAME)
{
};
codec_events::decoder_event(p, DECODE_TCP_INVALID_OFFSET);
p->tcph = NULL;
-// dc.discards++;
-// dc.tdisc++;
-
return false;
}
codec_events::decoder_event(p, DECODE_TCP_LARGE_OFFSET);
p->tcph = NULL;
-// dc.discards++;
-// dc.tdisc++;
-
return false;
}
ntohs(p->tcph->th_sum)););
codec_events::exec_tcp_chksm_drop(p);
-// dc.invalid_checksums++;
}
else
{
// Allowing this packet for further processing
// (in case there is a valid data inside it).
/*p->tcph = NULL;
- dc.discards++;
- dc.tdisc++;
return;*/
}
// api
//-------------------------------------------------------------------------
+static Module* mod_ctor()
+{
+ return new TcpModule;
+}
+
+static void mod_dtor(Module* m)
+{
+ delete m;
+}
+
/*
* Static api functions. there are NOT part of the TCPCodec class,
* but provide global initializers and/or destructors to the class
}
-
-
static void tcp_codec_gterm()
{
if( SynToMulticastDstIp )
sfvar_free(SynToMulticastDstIp);
}
-
-
-static Codec* ctor()
+static Codec* ctor(Module*)
{
return new TcpCodec();
}
delete cd;
}
-static const char* name = "tcp";
static const CodecApi tcp_api =
{
{
PT_CODEC,
- name,
+ CD_TCP_NAME,
CDAPI_PLUGIN_V0,
0,
- nullptr,
- nullptr,
+ mod_ctor,
+ mod_dtor,
},
tcp_codec_ginit, // pinit
tcp_codec_gterm, // pterm
- NULL, // tinit
- NULL, // tterm
+ nullptr, // tinit
+ nullptr, // tterm
ctor, // ctor
dtor, // dtor
};
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// cd_tcp_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
+
+#include "codecs/ip/cd_tcp_module.h"
+
+
+static const Parameter tcp_params[] =
+{
+ { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
+};
+
+
+// rules which will loaded into snort.
+// You can now reference these rules by calling a codec_event
+// in your main codec's functions
+static const RuleMap tcp_rules[] =
+{
+ { DECODE_TCP_DGRAM_LT_TCPHDR, "(" CD_TCP_NAME ") TCP packet len is smaller than 20 bytes" },
+ { DECODE_TCP_INVALID_OFFSET, "(" CD_TCP_NAME ") TCP Data Offset is less than 5" },
+ { DECODE_TCP_LARGE_OFFSET, "(" CD_TCP_NAME ") TCP Header length exceeds packet length" },
+
+ { DECODE_TCPOPT_BADLEN, "(" CD_TCP_NAME ") Tcp Options found with bad lengths" },
+ { DECODE_TCPOPT_TRUNCATED, "(" CD_TCP_NAME ") Truncated Tcp Options" },
+ { DECODE_TCPOPT_TTCP, "(" CD_TCP_NAME ") T/TCP Detected" },
+ { DECODE_TCPOPT_OBSOLETE, "(" CD_TCP_NAME ") Obsolete TCP Options found" },
+ { DECODE_TCPOPT_EXPERIMENTAL, "(" CD_TCP_NAME ") Experimental Tcp Options found" },
+ { DECODE_TCPOPT_WSCALE_INVALID, "(" CD_TCP_NAME ") Tcp Window Scale Option found with length > 14" },
+ { DECODE_TCP_XMAS, "(" CD_TCP_NAME ") XMAS Attack Detected" },
+ { DECODE_TCP_NMAP_XMAS, "(" CD_TCP_NAME ") Nmap XMAS Attack Detected" },
+ { DECODE_TCP_BAD_URP, "(" CD_TCP_NAME ") TCP urgent pointer exceeds payload length or no payload" },
+ { DECODE_TCP_SYN_FIN, "(" CD_TCP_NAME ") TCP SYN with FIN" },
+ { DECODE_TCP_SYN_RST, "(" CD_TCP_NAME ") TCP SYN with RST" },
+ { DECODE_TCP_MUST_ACK, "(" CD_TCP_NAME ") TCP PDU missing ack for established session" },
+ { DECODE_TCP_NO_SYN_ACK_RST, "(" CD_TCP_NAME ") TCP has no SYN, ACK, or RST" },
+ { DECODE_TCP_SHAFT_SYNFLOOD, "(" CD_TCP_NAME ") DDOS shaft synflood" },
+ { DECODE_TCP_PORT_ZERO, "(" CD_TCP_NAME ") BAD-TRAFFIC TCP port 0 traffic" },
+ { DECODE_DOS_NAPTHA, "(decode) DOS NAPTHA Vulnerability Detected" },
+ { DECODE_SYN_TO_MULTICAST, "(decode) Bad Traffic SYN to multicast address" },
+ { 0, nullptr }
+};
+
+//-------------------------------------------------------------------------
+// rpc module
+//-------------------------------------------------------------------------
+
+TcpModule::TcpModule() : DecodeModule(CD_TCP_NAME, tcp_params, tcp_rules)
+{ }
+
+bool TcpModule::set(const char*, Value&, SnortConfig*)
+{
+ return true;
+}
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// cd_tcp_module.h author Josh Rosenbaum <jrosenba@cisco.com>
+
+#ifndef CD_TCP_MODULE_H
+#define CD_TCP_MODULE_H
+
+#include "codecs/decode_module.h"
+
+
+#define CD_TCP_NAME "codec_tcp"
+
+class TcpModule : public DecodeModule
+{
+public:
+ TcpModule();
+
+ bool set(const char*, Value&, SnortConfig*);
+
+};
+
+#endif
+
#include "framework/codec.h"
#include "packet_io/active.h"
#include "codecs/codec_events.h"
+#include "codecs/ip/cd_udp_module.h"
namespace
{
class UdpCodec : public Codec
{
public:
- UdpCodec() : Codec("udp"){};
+ UdpCodec() : Codec(CD_UDP_NAME){};
~UdpCodec(){};
p->proto_bits |= PROTO_BIT__UDP;
UDPMiscTests(p);
- if (teredo::is_teredo_port(p->sp) ||
+ if (ScGTPDecoding() &&
+ (ScIsGTPPort(p->sp)||ScIsGTPPort(p->dp)))
+ {
+ if ( !p->frag_flag )
+ next_prot_id = PROTOCOL_GTP;
+ }
+ else if (teredo::is_teredo_port(p->sp) ||
teredo::is_teredo_port(p->dp) ||
ScDeepTeredoInspection())
{
next_prot_id = PROTOCOL_TEREDO;
}
- if (ScGTPDecoding() &&
- (ScIsGTPPort(p->sp)||ScIsGTPPort(p->dp)))
- {
- if ( !p->frag_flag )
- next_prot_id = PROTOCOL_GTP;
- }
return true;
}
// api
//-------------------------------------------------------------------------
-static Codec* ctor()
+
+static Module* mod_ctor()
+{
+ return new UdpModule;
+}
+
+static void mod_dtor(Module* m)
+{
+ delete m;
+}
+
+static Codec* ctor(Module*)
{
return new UdpCodec();
}
delete cd;
}
-static const char* name = "udp";
static const CodecApi udp_api =
{
- {
- PT_CODEC,
- name,
- CDAPI_PLUGIN_V0,
- 0,
- nullptr,
- nullptr
+ {
+ PT_CODEC,
+ CD_UDP_NAME,
+ CDAPI_PLUGIN_V0,
+ 0,
+ mod_ctor,
+ mod_dtor
},
nullptr, // pinit
nullptr, // pterm
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// cd_udp_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
+
+#include "cd_udp_module.h"
+#include "snort_config.h"
+#include "parser/config_file.h"
+
+static const Parameter udp_params[] =
+{
+ { "deep_teredo_inspection", Parameter::PT_BOOL, nullptr, "false",
+ "look for Teredo on all UDP ports (default is only 3544)" },
+
+ { "enable_gtp", Parameter::PT_BOOL, nullptr, "false",
+ "decode GTP encapsulations" },
+
+ // FIXIT use PT_BIT_LIST
+ { "gtp_ports", Parameter::PT_STRING, nullptr,
+ "'2152 3386'", "set GTP ports" },
+
+ { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
+};
+
+
+static const RuleMap udp_rules[] =
+{
+
+ { DECODE_UDP_DGRAM_LT_UDPHDR, "(" CD_UDP_NAME ") Truncated UDP Header" },
+ { DECODE_UDP_DGRAM_INVALID_LENGTH, "(" CD_UDP_NAME ") Invalid UDP header, length field < 8" },
+ { DECODE_UDP_DGRAM_SHORT_PACKET, "(" CD_UDP_NAME ") Short UDP packet, length field > payload length" },
+ { DECODE_UDP_DGRAM_LONG_PACKET, "(" CD_UDP_NAME ") Long UDP packet, length field < payload length" },
+ { DECODE_UDP_IPV6_ZERO_CHECKSUM, "(" CD_UDP_NAME ") Invalid IPv6 UDP packet, checksum zero" },
+ { DECODE_UDP_LARGE_PACKET, "(" CD_UDP_NAME ") MISC Large UDP Packet" },
+ { DECODE_UDP_PORT_ZERO, "(" CD_UDP_NAME ") BAD-TRAFFIC UDP port 0 traffic" },
+
+
+ { 0, nullptr }
+};
+
+//-------------------------------------------------------------------------
+// rpc module
+//-------------------------------------------------------------------------
+
+UdpModule::UdpModule() : DecodeModule(CD_UDP_NAME, udp_params, udp_rules)
+{ }
+
+bool UdpModule::set(const char*, Value& v, SnortConfig* sc)
+{
+ if ( v.is("deep_teredo_inspection") )
+ sc->enable_teredo = v.get_long(); // FIXIT move to existing bitfield
+
+ else if ( v.is("enable_gtp") )
+ {
+ if ( v.get_bool() )
+ sc->enable_gtp = 1; // FIXIT move to existing bitfield
+ }
+ else if ( v.is("gtp_ports") )
+ ConfigGTPDecoding(sc, v.get_string());
+
+ else
+ return false;
+
+ return true;
+}
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// cd_udp_module.h author Josh Rosenbaum <jrosenba@cisco.com>
+
+#ifndef CD_UDP_MODULE_H
+#define CD_UDP_MODULE_H
+
+#include "codecs/decode_module.h"
+
+
+#define CD_UDP_NAME "codec_udp"
+
+class UdpModule : public DecodeModule
+{
+public:
+ UdpModule();
+
+ bool set(const char*, Value&, SnortConfig*);
+
+};
+
+#endif
if( STATIC_DECODERS )
set( PLUGIN_SOURCES
cd_erspan2.cc
+ cd_erspan2_module.h
+ cd_erspan2_module.cc
cd_erspan3.cc
+ cd_erspan3_module.h
+ cd_erspan3_module.cc
cd_ethloopback.cc
cd_mpls.cc
+ cd_mpls_module.h
+ cd_mpls_module.cc
cd_pppencap.cc
cd_pppoepkt.cc
+ cd_pppoepkt_module.h
+ cd_pppoepkt_module.cc
cd_transbridge.cc
cd_vlan.cc
+ cd_vlan_module.h
+ cd_vlan_module.cc
)
if(ENABLE_NON_ETHER_DECODER)
set( PLUGIN_SOURCES
${PLUGIN_SOURCES}
cd_eapol.cc
+ cd_eapol_module.h
+ cd_eapol_module.cc
)
endif()
else()
- add_shared_library(cd_erspan2 codecs cd_erspan2.cc)
- add_shared_library(cd_erspan3 codecs cd_erspan3.cc)
+ add_shared_library(cd_erspan2 codecs cd_erspan2.cc cd_erspan2_module.h cd_erspan2_module.cc)
+ add_shared_library(cd_erspan3 codecs cd_erspan3.cc cd_erspan3_module.h cd_erspan3_module.cc)
add_shared_library(cd_ethloopback codecs cd_ethloopback.cc)
- add_shared_library(cd_mpls codecs cd_mpls.cc)
+ add_shared_library(cd_mpls codecs cd_mpls.cc cd_mpls_module.h cd_mpls_module.cc)
add_shared_library(cd_pppencap codecs cd_pppencap.cc)
- add_shared_library(cd_pppoepkt codecs cd_pppoepkt.cc)
+ add_shared_library(cd_pppoepkt codecs cd_pppoepkt.cc cd_pppoepkt_module.h cd_pppoepkt_module.cc)
add_shared_library(cd_transbridge codecs cd_transbridge.cc)
- add_shared_library(cd_vlan codecs cd_vlan.cc)
+ add_shared_library(cd_vlan codecs cd_vlan.cc cd_vlan_module.h cd_vlan_module.cc)
if(ENABLE_NON_ETHER_DECODER)
add_shared_library(cd_eapol codecs cd_eapol.cc)
add_library( link_codecs STATIC
cd_arp.cc
+ cd_arp_module.h
+ cd_arp_module.cc
${PLUGIN_SOURCES}
)
noinst_LIBRARIES = liblink_codecs.a
liblink_codecs_a_SOURCES = \
-cd_arp.cc
+cd_arp.cc \
+cd_arp_module.h \
+cd_arp_module.cc
plugin_list = \
cd_erspan2.cc \
+cd_erspan2_module.h \
+cd_erspan2_module.cc \
cd_erspan3.cc \
+cd_erspan3_module.h \
+cd_erspan3_module.cc \
cd_ethloopback.cc \
cd_mpls.cc \
+cd_mpls_module.h \
+cd_mpls_module.cc \
cd_pppencap.cc \
cd_pppoepkt.cc \
+cd_pppoepkt_module.h \
+cd_pppoepkt_module.cc \
cd_transbridge.cc \
-cd_vlan.cc
+cd_vlan.cc \
+cd_vlan_module.h \
+cd_vlan_module.cc
if ENABLE_NON_ETHER_DECODER
-plugin_list += cd_eapol.cc
+plugin_list += cd_eapol.cc cd_eapol_module.h cd_eapol_module.cc
endif
if STATIC_DECODERS
ehlib_LTLIBRARIES = libcd_erspan2.la
libcd_erspan2_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
libcd_erspan2_la_LDFLAGS = -export-dynamic -shared
-libcd_erspan2_la_SOURCES = cd_erspan2.cc
+libcd_erspan2_la_SOURCES = cd_erspan2.cc cd_erspan2_module.h cd_erspan2_module.cc
-# TODO: PUT THESE IN T LIST
-# add_shared_library(cd_eapol codecs cd_eapol.cc)
-# add_shared_library(cd_erspan3 codecs cd_erspan3.cc)
+ehlib_LTLIBRARIES += libcd_erspan3.la
+libcd_erspan3_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
+libcd_erspan3_la_LDFLAGS = -export-dynamic -shared
+libcd_erspan3_la_SOURCES = cd_erspan3.cc cd_erspan3_module.h cd_erspan3_module.cc
+
+ehlib_LTLIBRARIES += libcd_mpls.la
+libcd_mpls_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
+libcd_mpls_la_LDFLAGS = -export-dynamic -shared
+libcd_mpls_la_SOURCES = cd_mpls.cc cd_mpls_module.h cd_mpls_module.cc
+
+ehlib_LTLIBRARIES += libcd_vlan.la
+libcd_vlan_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
+libcd_vlan_la_LDFLAGS = -export-dynamic -shared
+libcd_vlan_la_SOURCES = cd_vlan.cc cd_vlan_module.h cd_vlan_module.cc
+
+# TODO: CREATE PLUGING LIBRARIES FOR THESE LIBRARIES
# add_shared_library(cd_ethloopback codecs cd_ethloopback.cc)
# add_shared_library(cd_mpls codecs cd_mpls.cc)
# add_shared_library(cd_pppencap codecs cd_pppencap.cc)
# add_shared_library(cd_pppoepkt codecs cd_pppoepkt.cc)
# add_shared_library(cd_transbridge codecs cd_transbridge.cc)
-# add_shared_library(cd_vlan codecs cd_vlan.cc)
+
+if ENABLE_NON_ETHER_DECODER
+
+ehlib_LTLIBRARIES += libcd_eapol.la
+libcd_eapol_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
+libcd_eapol_la_LDFLAGS = -export-dynamic -shared
+libcd_eapol_la_SOURCES = cd_eapol.cc cd_eapol_module.h cd_eapol_module.cc
+endif
# if(ENABLE_NON_ETHER_DECODER)
# add_shared_library(cd_eapol codecs cd_eapol.cc)
#include "framework/codec.h"
-#include "codecs/decode_module.h"
+#include "codecs/link/cd_arp_module.h"
#include "codecs/codec_events.h"
namespace
class ArpCodec : public Codec
{
public:
- ArpCodec() : Codec("arp"){};
+ ArpCodec() : Codec(CD_ARP_NAME){};
~ArpCodec(){};
bool ArpCodec::decode(const uint8_t *raw_pkt, const uint32_t len,
Packet *p, uint16_t &lyr_len, uint16_t& /* next_prot_id */)
{
-// if (p->greh != NULL)
-// dc.gre_arp++;
-
p->ah = (EtherARP *) raw_pkt;
if(len < sizeof(EtherARP))
// api
//-------------------------------------------------------------------------
+static Module* mod_ctor()
+{
+ return new ArpModule;
+}
+
+static void mod_dtor(Module* m)
+{
+ delete m;
+}
-static Codec* ctor()
+static Codec* ctor(Module*)
{
return new ArpCodec();
}
delete cd;
}
-static const char* name = "arp";
static const CodecApi arp_api =
{
{
PT_CODEC,
- name,
+ CD_ARP_NAME,
CDAPI_PLUGIN_V0,
0,
- nullptr,
- nullptr,
+ mod_ctor,
+ mod_dtor,
},
nullptr, // pinit
nullptr, // pterm
dtor, // dtor
};
-#ifdef BUILDING_SO
-SO_PUBLIC const BaseApi* snort_plugins[] =
-{
- &arp_api.base,
- nullptr
-};
-#else
const BaseApi* cd_arp = &arp_api.base;
-#endif
-
-
-
-
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// cd_arp_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
+
+#include "codecs/link/cd_arp_module.h"
+
+
+static const Parameter arp_params[] =
+{
+ { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
+};
+
+
+static const RuleMap arp_rules[] =
+{
+ { DECODE_ARP_TRUNCATED, "(" CD_ARP_NAME ") Truncated ARP" },
+ { 0, nullptr }
+};
+
+//-------------------------------------------------------------------------
+// rpc module
+//-------------------------------------------------------------------------
+
+ArpModule::ArpModule() : DecodeModule(CD_ARP_NAME, arp_params, arp_rules)
+{ }
+
+bool ArpModule::set(const char*, Value&, SnortConfig*)
+{
+ return true;
+}
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// cd_arp_module.h author Josh Rosenbaum <jrosenba@cisco.com>
+
+#ifndef CD_ARP_MODULE_H
+#define CD_ARP_MODULE_H
+
+#include "codecs/decode_module.h"
+
+
+#define CD_ARP_NAME "codec_arp"
+
+class ArpModule : public DecodeModule
+{
+public:
+ ArpModule();
+
+ bool set(const char*, Value&, SnortConfig*);
+};
+
+#endif
#endif
#include "framework/codec.h"
-#include "codecs/decode_module.h"
+#include "codecs/link/cd_eapol_module.h"
#include "codecs/codec_events.h"
class EapolCodec : public Codec
{
public:
- EapolCodec() : Codec("eapol"){};
+ EapolCodec() : Codec(CD_EAPOL_NAME){};
~EapolCodec() {};
+struct EtherEapol
+{
+ uint8_t version; /* EAPOL proto version */
+ uint8_t eaptype; /* EAPOL Packet type */
+ uint16_t len; /* Packet body length */
+};
+
+struct EAPHdr
+{
+ uint8_t code;
+ uint8_t id;
+ uint16_t len;
+};
+
+struct EapolKey
+{
+ uint8_t type;
+ uint8_t length[2];
+ uint8_t counter[8];
+ uint8_t iv[16];
+ uint8_t index;
+ uint8_t sig[16];
+};
+
+
} // namespace
/*************************************************
*/
void DecodeEAP(const uint8_t * pkt, const uint32_t len, Packet * p)
{
+ const EAPHdr *eaph = reinterpret_cast<const EAPHdr* pkt>(pkt);
p->eaph = (EAPHdr *) pkt;
if(len < sizeof(EAPHdr))
{
codec_events::decoder_event(p, DECODE_EAP_TRUNCATED);
return;
}
- if (p->eaph->code == EAP_CODE_REQUEST ||
- p->eaph->code == EAP_CODE_RESPONSE) {
+ if (eaph->code == EAP_CODE_REQUEST ||
+ eaph->code == EAP_CODE_RESPONSE) {
p->eaptype = pkt + sizeof(EAPHdr);
}
return;
// api
//-------------------------------------------------------------------------
-static Codec* ctor()
+static Module* mod_ctor()
+{
+ return new EapolModule;
+}
+
+static void mod_dtor(Module* m)
+{
+ delete m;
+}
+
+static Codec* ctor(Module*)
{
return new EapolCodec();
}
}
-static const char* name = "eapol";
static const CodecApi eapol_api =
{
{
PT_CODEC,
- name,
+ CD_NAME_EAPOL,
CDAPI_PLUGIN_V0,
0,
- nullptr,
- nullptr,
+ mod_ctor,
+ mod_dtor,
},
nullptr, // pinit
nullptr, // pterm
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// cd_eapol_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
+
+#include "codecs/link/cd_eapol_module.h"
+
+
+static const Parameter eapol_params[] =
+{
+ { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
+};
+
+
+static const RuleMap eapol_rules[] =
+{
+ { DECODE_EAPOL_TRUNCATED, "(" CD_EAPOL_NAME ") Truncated EAP Header" },
+ { DECODE_EAPKEY_TRUNCATED, "(" CD_EAPOL_NAME ") EAP Key Truncated" },
+ { DECODE_EAP_TRUNCATED, "(" CD_EAPOL_NAME ") EAP Header Truncated" },
+ { 0, nullptr }
+};
+
+//-------------------------------------------------------------------------
+// rpc module
+//-------------------------------------------------------------------------
+
+EapolModule::EapolModule() : DecodeModule(CD_EAPOL_NAME, eapol_params, eapol_rules)
+{ }
+
+bool EapolModule::set(const char*, Value&, SnortConfig*)
+{
+ return true;
+}
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// cd_eapol_module.h author Josh Rosenbaum <jrosenba@cisco.com>
+
+#ifndef CD_EAPOL_MODULE_H
+#define CD_EAPOL_MODULE_H
+
+#include "codecs/decode_module.h"
+
+
+#define CD_EAPOL_NAME "codec_eapol"
+
+class EapolModule : public DecodeModule
+{
+public:
+ EapolModule();
+
+ bool set(const char*, Value&, SnortConfig*);
+};
+
+#endif
#include "framework/codec.h"
-#include "codecs/decode_module.h"
+#include "codecs/link/cd_erspan2_module.h"
#include "codecs/codec_events.h"
#include "protocols/protocol_ids.h"
class Erspan2Codec : public Codec
{
public:
- Erspan2Codec() : Codec("erspan2"){};
+ Erspan2Codec() : Codec(CD_ERSPAN2_NAME){};
~Erspan2Codec(){};
virtual void get_protocol_ids(std::vector<uint16_t>& v);
// api
//-------------------------------------------------------------------------
+static Module* mod_ctor()
+{
+ return new Erspan2Module;
+}
+
+static void mod_dtor(Module* m)
+{
+ delete m;
+}
-static Codec* ctor()
+static Codec* ctor(Module*)
{
return new Erspan2Codec();
}
}
-static const char* name = "erspan2";
static const CodecApi erspan2_api =
{
{
PT_CODEC,
- name,
+ CD_ERSPAN2_NAME,
CDAPI_PLUGIN_V0,
0,
- nullptr,
- nullptr,
+ mod_ctor,
+ mod_dtor,
},
nullptr, // pinit
nullptr, // pterm
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// cd_erspan2_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
+
+#include "codecs/link/cd_erspan2_module.h"
+
+
+static const Parameter erspan2_params[] =
+{
+ { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
+};
+
+
+static const RuleMap erspan2_rules[] =
+{
+ { DECODE_ERSPAN_HDR_VERSION_MISMATCH, "(codec_erspan) ERSpan Header version mismatch" },
+ { DECODE_ERSPAN2_DGRAM_LT_HDR, "(" CD_ERSPAN2_NAME ") captured < ERSpan Type2 Header Length" },
+ { 0, nullptr }
+};
+
+//-------------------------------------------------------------------------
+// rpc module
+//-------------------------------------------------------------------------
+
+Erspan2Module::Erspan2Module() : DecodeModule(CD_ERSPAN2_NAME, erspan2_params, erspan2_rules)
+{ }
+
+bool Erspan2Module::set(const char*, Value&, SnortConfig*)
+{
+ return true;
+}
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// cd_erspan2_module.h author Josh Rosenbaum <jrosenba@cisco.com>
+
+#ifndef CD_ERSPAN2_MODULE_H
+#define CD_ERSPAN2_MODULE_H
+
+#include "codecs/decode_module.h"
+
+
+#define CD_ERSPAN2_NAME "codec_erspan2"
+
+class Erspan2Module : public DecodeModule
+{
+public:
+ Erspan2Module();
+
+ bool set(const char*, Value&, SnortConfig*);
+};
+
+#endif
#include "framework/codec.h"
-#include "codecs/decode_module.h"
+#include "codecs/link/cd_erspan3_module.h"
#include "codecs/codec_events.h"
#include "protocols/protocol_ids.h"
class Erspan3Codec : public Codec
{
public:
- Erspan3Codec() : Codec("erspan3"){};
+ Erspan3Codec() : Codec(CD_ERSPAN3_NAME){};
~Erspan3Codec(){};
// api
//-------------------------------------------------------------------------
-static Codec* ctor()
+static Module* mod_ctor()
+{
+ return new Erspan3Module;
+}
+
+static void mod_dtor(Module* m)
+{
+ delete m;
+}
+
+static Codec* ctor(Module*)
{
return new Erspan3Codec();
}
}
-static const char* name = "erspan3";
static const CodecApi erspan3_api =
{
{
PT_CODEC,
- name,
+ CD_ERSPAN3_NAME,
CDAPI_PLUGIN_V0,
0,
- nullptr,
- nullptr,
+ mod_ctor,
+ mod_dtor,
},
nullptr, // pinit
nullptr, // pterm
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// cd_erspan3_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
+
+#include "codecs/link/cd_erspan3_module.h"
+
+
+static const Parameter erspan3_params[] =
+{
+ { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
+};
+
+
+static const RuleMap erspan3_rules[] =
+{
+ { DECODE_ERSPAN3_DGRAM_LT_HDR, "(" CD_ERSPAN3_NAME ") captured < ERSpan Type3 Header Length" },
+ { 0, nullptr }
+};
+
+//-------------------------------------------------------------------------
+// rpc module
+//-------------------------------------------------------------------------
+
+Erspan3Module::Erspan3Module() : DecodeModule(CD_ERSPAN3_NAME, erspan3_params, erspan3_rules)
+{ }
+
+bool Erspan3Module::set(const char*, Value&, SnortConfig*)
+{
+ return true;
+}
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// cd_erspan3_module.h author Josh Rosenbaum <jrosenba@cisco.com>
+
+#ifndef CD_ERSPAN3_MODULE_H
+#define CD_ERSPAN3_MODULE_H
+
+#include "codecs/decode_module.h"
+
+
+#define CD_ERSPAN3_NAME "codec_erspan3"
+
+class Erspan3Module : public DecodeModule
+{
+public:
+ Erspan3Module();
+
+ bool set(const char*, Value&, SnortConfig*);
+};
+
+#endif
namespace
{
+#define CD_ETHLOOPBACK_NAME "codec_ethloopback"
+
+
class EthLoopbackCodec : public Codec
{
public:
- EthLoopbackCodec() : Codec("ethloopback"){};
+ EthLoopbackCodec() : Codec(CD_ETHLOOPBACK_NAME){};
~EthLoopbackCodec(){};
{
DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "EthLoopback is not supported.\n"););
-
-// loopbackstats.total_packets++;
-
-// if (p->greh != NULL)
-// dc.gre_loopback++;
-
return true;
}
// api stuff
//-------------------------------------------------------------------------
-
-
-static Codec* ctor()
+static Codec* ctor(Module*)
{
return new EthLoopbackCodec();
}
delete cd;
}
-static const char* name = "ethloopback";
static const CodecApi ethloopback_api =
{
{
PT_CODEC,
- name,
+ CD_ETHLOOPBACK_NAME,
CDAPI_PLUGIN_V0,
0,
nullptr,
#include "packet_io/active.h"
#include "protocols/protocol_ids.h"
#include "protocols/mpls.h"
+#include "codecs/link/cd_mpls_module.h"
namespace
{
class MplsCodec : public Codec
{
public:
- MplsCodec() : Codec("mpls"){};
+ MplsCodec() : Codec(CD_MPLS_NAME){};
~MplsCodec(){};
virtual void get_protocol_ids(std::vector<uint16_t>& v);
};
-const uint16_t ETHERNET_TYPE_MPLS_UNICAST = 0x8847;
-const uint16_t ETHERNET_TYPE_MPLS_MULTICAST = 0x8848;
-
+const static uint16_t ETHERNET_TYPE_MPLS_UNICAST = 0x8847;
+const static uint16_t ETHERNET_TYPE_MPLS_MULTICAST = 0x8848;
const static uint32_t MPLS_HEADER_LEN = 4;
const static uint32_t NUM_RESERVED_LABELS = 16;
int iRet = 0;
-// dc.mpls++;
UpdateMPLSStats(&sfBase, len, Active_PacketWasDropped());
tmpMplsHdr = (uint32_t *) raw_pkt;
p->mpls = NULL;
{
codec_events::decoder_event(p, DECODE_BAD_MPLS);
-// dc.discards++;
p->iph = NULL;
p->family = NO_IP;
return false;
{
codec_events::decoder_event(p, DECODE_MPLS_LABEL_STACK);
-// dc.discards++;
p->iph = NULL;
p->family = NO_IP;
return false;
else
codec_events::decoder_event(p, DECODE_BAD_MPLS_LABEL2);
- dc.discards++;
p->iph = NULL;
p->family = NO_IP;
return(-1);
codec_events::decoder_event(p, DECODE_BAD_MPLS_LABEL1);
-// dc.discards++;
p->iph = NULL;
p->family = NO_IP;
iRet = MPLS_PAYLOADTYPE_ERROR;
case 3:
codec_events::decoder_event(p, DECODE_BAD_MPLS_LABEL3);
-// dc.discards++;
p->iph = NULL;
p->family = NO_IP;
iRet = MPLS_PAYLOADTYPE_ERROR;
// api
//-------------------------------------------------------------------------
-static Codec* ctor()
+static Module* mod_ctor()
+{
+ return new MplsModule;
+}
+
+static void mod_dtor(Module* m)
+{
+ delete m;
+}
+
+static Codec* ctor(Module*)
{
return new MplsCodec();
}
delete cd;
}
-static const char* name = "mpls";
static const CodecApi mpls_api =
{
- {
- PT_CODEC,
- name,
- CDAPI_PLUGIN_V0,
+ {
+ PT_CODEC,
+ CD_MPLS_NAME,
+ CDAPI_PLUGIN_V0,
0,
- nullptr,
- nullptr,
+ mod_ctor,
+ mod_dtor,
},
nullptr, // pinit
nullptr, // pterm
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// cd_mpls_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
+
+#include "codecs/link/cd_mpls_module.h"
+#include "main/snort_config.h"
+#include "main/snort.h"
+
+static const Parameter mpls_params[] =
+{
+ { "enable_mpls_multicast", Parameter::PT_BOOL, nullptr, "false",
+ "enables support for MPLS multicast" },
+
+ { "enable_mpls_overlapping_ip", Parameter::PT_BOOL, nullptr, "false",
+ "enable if private network addresses overlap and must be differentiated by MPLS label(s)" },
+
+ { "max_mpls_label_chain_len", Parameter::PT_INT, "-1:", "-1",
+ "set MPLS stack depth" },
+
+ { "mpls_payload_type", Parameter::PT_ENUM, "eth | ip4 | ip6", "ip4",
+ "set encapsulated payload type" },
+
+ { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
+};
+
+
+// rules which will loaded into snort.
+// You can now reference these rules by calling a codec_event
+// in your main codec's functions
+static const RuleMap mpls_rules[] =
+{
+ { DECODE_BAD_MPLS, "(" CD_MPLS_NAME ") Bad MPLS Frame" },
+ { DECODE_BAD_MPLS_LABEL0, "(" CD_MPLS_NAME ") MPLS Label 0 Appears in Nonbottom Header" },
+ { DECODE_BAD_MPLS_LABEL1, "(" CD_MPLS_NAME ") MPLS Label 1 Appears in Bottom Header" },
+ { DECODE_BAD_MPLS_LABEL2, "(" CD_MPLS_NAME ") MPLS Label 2 Appears in Nonbottom Header" },
+ { DECODE_BAD_MPLS_LABEL3, "(" CD_MPLS_NAME ") MPLS Label 3 Appears in Header" },
+ { DECODE_MPLS_RESERVED_LABEL, "(" CD_MPLS_NAME ") MPLS Label 4, 5,.. or 15 Appears in Header" },
+ { DECODE_MPLS_LABEL_STACK, "(" CD_MPLS_NAME ") Too Many MPLS headers" },
+ { 0, nullptr }
+};
+
+//-------------------------------------------------------------------------
+// rpc module
+//-------------------------------------------------------------------------
+
+MplsModule::MplsModule() : DecodeModule(CD_MPLS_NAME, mpls_params, mpls_rules)
+{ }
+
+bool MplsModule::set(const char*, Value& v, SnortConfig* sc)
+{
+ if ( v.is("enable_mpls_multicast") )
+ {
+ if ( v.get_bool() )
+ sc->run_flags |= RUN_FLAG__MPLS_MULTICAST; // FIXIT move to existing bitfield
+ }
+ else if ( v.is("enable_mpls_overlapping_ip") )
+ {
+ if ( v.get_bool() )
+ sc->run_flags |= RUN_FLAG__MPLS_OVERLAPPING_IP; // FIXIT move to existing bitfield
+ }
+ else if ( v.is("max_mpls_label_chain_len") )
+ sc->mpls_stack_depth = v.get_long();
+
+ else if ( v.is("mpls_payload_type") )
+ sc->mpls_payload_type = v.get_long() + 1;
+
+ else
+ return false;
+
+ return true;
+}
+
+
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// cd_mpls_module.h author Josh Rosenbaum <jrosenba@cisco.com>
+
+#ifndef CD_MPLS_MODULE_H
+#define CD_MPLS_MODULE_H
+
+#include "codecs/decode_module.h"
+
+
+#define CD_MPLS_NAME "codec_mpls"
+
+class MplsModule : public DecodeModule
+{
+public:
+ MplsModule();
+
+ bool set(const char*, Value&, SnortConfig*);
+
+};
+
+#endif
+
#include "config.h"
#endif
-
#include "framework/codec.h"
-#include "codecs/decode_module.h"
-#include "codecs/codec_events.h"
#include "protocols/protocol_ids.h"
#include "snort.h"
-#include "main/snort_types.h"
namespace
{
+#define CD_PPPENCAP_NAME "codec_ppp_encap"
+
class PppEncap : public Codec
{
public:
- PppEncap() : Codec("ppp_encap"){};
+ PppEncap() : Codec(CD_PPPENCAP_NAME){};
~PppEncap(){};
-
virtual void get_protocol_ids(std::vector<uint16_t>& v);
virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
#endif /* WORDS_MUSTALIGN */
-// if (p->greh != NULL)
-// dc.gre_ppp++;
/* do a little validation:
*
// api
//-------------------------------------------------------------------------
-static Codec* ctor()
+static Codec* ctor(Module*)
{
return new PppEncap();
}
delete cd;
}
-static const char* name = "ppp_encap";
static const CodecApi pppencap_api =
{
{
PT_CODEC,
- name,
+ CD_PPPENCAP_NAME,
CDAPI_PLUGIN_V0,
0,
nullptr,
#include "framework/codec.h"
-#include "codecs/decode_module.h"
+#include "codecs/link/cd_pppoepkt_module.h"
#include "codecs/codec_events.h"
#include "protocols/packet.h"
class PPPoEPktCodec : public Codec
{
public:
- PPPoEPktCodec() : Codec("ppp_over_eth"){};
+ PPPoEPktCodec() : Codec(CD_PPPOEPKT_NAME){};
~PPPoEPktCodec(){};
// api
//-------------------------------------------------------------------------
-static Codec* ctor()
+static Module* mod_ctor()
+{
+ return new PPPoEPktModule;
+}
+
+static void mod_dtor(Module* m)
+{
+ delete m;
+}
+
+static Codec* ctor(Module *)
{
return new PPPoEPktCodec();
}
delete cd;
}
-static const char* name = "ppp_over_eth";
static const CodecApi pppoe_api =
{
{
- PT_CODEC,
- name,
- CDAPI_PLUGIN_V0,
+ PT_CODEC,
+ CD_PPPOEPKT_NAME,
+ CDAPI_PLUGIN_V0,
0,
- nullptr,
- nullptr,
+ mod_ctor,
+ mod_dtor,
},
nullptr, // pinit
nullptr, // pterm
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// cd_pppoepkt_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
+
+#include "codecs/link/cd_pppoepkt_module.h"
+
+
+static const Parameter pppoepkt_params[] =
+{
+ { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
+};
+
+
+static const RuleMap pppoepkt_rules[] =
+{
+ { DECODE_BAD_PPPOE, "(" CD_PPPOEPKT_NAME ") Bad PPPOE frame detected" },
+ { 0, nullptr }
+};
+
+//-------------------------------------------------------------------------
+// rpc module
+//-------------------------------------------------------------------------
+
+PPPoEPktModule::PPPoEPktModule() : DecodeModule(CD_PPPOEPKT_NAME, pppoepkt_params, pppoepkt_rules)
+{ }
+
+bool PPPoEPktModule::set(const char*, Value&, SnortConfig*)
+{
+ return true;
+}
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// cd_pppoepkt_module.h author Josh Rosenbaum <jrosenba@cisco.com>
+
+#ifndef CD_PPPOEPKT_MODULE_H
+#define CD_PPPOEPKT_MODULE_H
+
+#include "codecs/decode_module.h"
+
+
+#define CD_PPPOEPKT_NAME "codec_pppoepkt"
+
+class PPPoEPktModule : public DecodeModule
+{
+public:
+ PPPoEPktModule();
+
+ bool set(const char*, Value&, SnortConfig*);
+};
+
+#endif
namespace
{
+#define CD_TRANSBRIDGE_NAME "codec_transbridge"
+
class TransbridgeCodec : public Codec
{
public:
- TransbridgeCodec() : Codec("transbridge"){};
+ TransbridgeCodec() : Codec(CD_TRANSBRIDGE_NAME){};
~TransbridgeCodec(){};
bool TransbridgeCodec::decode(const uint8_t *raw_pkt, const uint32_t len,
Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
{
-// dc.gre_eth++;
-
if(len < eth::hdr_len())
{
codec_events::decoder_alert_encapsulated(p, DECODE_GRE_TRANS_DGRAM_LT_TRANSHDR,
// api
//-------------------------------------------------------------------------
-
-static Codec* ctor()
+static Codec* ctor(Module*)
{
return new TransbridgeCodec();
}
delete cd;
}
-static const char* name = "transbridge";
static const CodecApi transbridge_api =
{
{
PT_CODEC,
- name,
+ CD_TRANSBRIDGE_NAME,
CDAPI_PLUGIN_V0,
0,
nullptr,
#include "protocols/packet.h"
#include "framework/codec.h"
-#include "codecs/decode_module.h"
+#include "codecs/link/cd_vlan_module.h"
#include "codecs/codec_events.h"
-#include "codecs/decode.h"
namespace
{
class VlanCodec : public Codec
{
public:
- VlanCodec() : Codec("vlan"){};
+ VlanCodec() : Codec(CD_VLAN_NAME){};
~VlanCodec(){};
virtual void get_protocol_ids(std::vector<uint16_t>& v);
virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
+ virtual void format(EncodeFlags, const Packet* p, Packet* c, Layer*);
// DELETE from here and below
} // namespace
static const uint16_t ETHERNET_TYPE_8021Q = 0x8100;
+static const unsigned int ETHERNET_MAX_LEN_ENCAP = 1518; /* 802.3 (+LLC) or ether II ? */
static inline uint32_t len_vlan_llc_other()
bool VlanCodec::decode(const uint8_t *raw_pkt, const uint32_t len,
Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
{
-// dc.vlan++;
-
-// if (p->greh != NULL)
-// dc.gre_vlan++;
-
if(len < sizeof(VlanTagHdr))
{
codec_events::decoder_event(p, DECODE_BAD_VLAN);
// TBD add decoder drop event for VLAN hdr len issue
-// dc.discards++;
p->iph = NULL;
p->family = NO_IP;
return false;
{
codec_events::decoder_event(p, DECODE_BAD_VLAN_ETHLLC);
-// dc.discards++;
p->iph = NULL;
p->family = NO_IP;
return false;
{
codec_events::decoder_event(p, DECODE_BAD_VLAN_OTHER);
-// dc.discards++;
p->iph = NULL;
p->family = NO_IP;
ntohs(p->ehllcother->proto_id));
);
-// PushLayer(PROTO_VLAN, p, pkt, sizeof(*p->vh));
-
lyr_len = len_vlan_llc_other();
next_prot_id = ntohs(p->ehllcother->proto_id);
}
return true;
}
-#if 0
/*
* ENCODER
*/
-void VLAN_Format (EncodeFlags, const Packet*, Packet* c, Layer* lyr)
+void VlanCodec::format(EncodeFlags, const Packet* /*p*/, Packet* c, Layer*lyr)
{
c->vh = (VlanTagHdr*)lyr->start;
}
-#endif
+
//-------------------------------------------------------------------------
// api
//-------------------------------------------------------------------------
-static Codec* ctor()
+static Module* mod_ctor()
+{
+ return new VlanModule;
+}
+
+static void mod_dtor(Module* m)
+{
+ delete m;
+}
+
+static Codec* ctor(Module*)
{
return new VlanCodec();
}
delete cd;
}
-static const char* name = "vlan";
+
static const CodecApi vlan_api =
{
{
PT_CODEC,
- name,
+ CD_VLAN_NAME,
CDAPI_PLUGIN_V0,
0,
- nullptr,
- nullptr,
+ mod_ctor,
+ mod_dtor,
},
nullptr, // pinit
nullptr, // pterm
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// cd_vlan_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
+
+#include "codecs/link/cd_vlan_module.h"
+
+
+static const Parameter vlan_params[] =
+{
+ { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
+};
+
+
+static const RuleMap vlan_rules[] =
+{
+ { DECODE_BAD_VLAN, "(" CD_VLAN_NAME ") Bad VLAN Frame" },
+ { DECODE_BAD_VLAN_ETHLLC, "(" CD_VLAN_NAME ") Bad LLC header" },
+ { DECODE_BAD_VLAN_OTHER, "(" CD_VLAN_NAME ") Bad Extra LLC Info" },
+ { 0, nullptr }
+};
+
+//-------------------------------------------------------------------------
+// rpc module
+//-------------------------------------------------------------------------
+
+VlanModule::VlanModule() : DecodeModule(CD_VLAN_NAME, vlan_params, vlan_rules)
+{ }
+
+bool VlanModule::set(const char*, Value&, SnortConfig*)
+{
+ return true;
+}
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// cd_vlan_module.h author Josh Rosenbaum <jrosenba@cisco.com>
+
+#ifndef CD_VLAN_MODULE_H
+#define CD_VLAN_MODULE_H
+
+#include "codecs/decode_module.h"
+
+
+#define CD_VLAN_NAME "codec_vlan"
+
+class VlanModule : public DecodeModule
+{
+public:
+ VlanModule();
+
+ bool set(const char*, Value&, SnortConfig*);
+};
+
+#endif
if(STATIC_DECODERS)
set(PLUGIN_LIST
cd_gtp.cc
+ cd_gtp_module.h
+ cd_gtp_module.cc
cd_teredo.cc
)
else()
- add_shared_library(cd_gtp codecs cd_gtp.cc)
+ add_shared_library(cd_gtp codecs cd_gtp.cc cd_gtp_module.h cd_gtp_module.cc)
add_shared_library(cd_teredo codecs cd_teredo.cc)
endif()
add_library( misc_codecs STATIC
- cd_null.cc
+ cd_default.cc
${PLUGIN_LIST}
)
noinst_LIBRARIES = libmisc_codecs.a
libmisc_codecs_a_SOURCES = \
-cd_null.cc
+cd_default.cc
plugin_list = \
cd_gtp.cc \
+cd_gtp_module.h \
+cd_gtp_module.cc \
cd_teredo.cc
if STATIC_DECODERS
ehlib_LTLIBRARIES = libcd_gtp.la
libcd_gtp_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
libcd_gtp_la_LDFLAGS = -export-dynamic -shared
-libcd_gtp_la_SOURCES = cd_gtp.cc
+libcd_gtp_la_SOURCES = cd_gtp.cc cd_gtp_module.h cd_gtp_module.cc
ehlib_LTLIBRARIES += libcd_teredo.la
libcd_teredo_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
namespace
{
-class NullCodec : public Codec
+#define CD_DEFAULT_NAME "codec_default"
+
+class DefaultCodec : public Codec
{
public:
- NullCodec() : Codec("null"){};
- ~NullCodec(){};
+ DefaultCodec() : Codec(CD_DEFAULT_NAME){};
+ ~DefaultCodec(){};
virtual void get_protocol_ids(std::vector<uint16_t>& v);
virtual bool decode(const uint8_t*, const uint32_t,
Packet*, uint16_t&, uint16_t&) { return false; };
- virtual bool is_default_codec() { return true; };
};
} // namespace
+void DefaultCodec::get_protocol_ids(std::vector<uint16_t>& v)
+{
+ v.push_back(FINISHED_DECODE);
+}
+
//-------------------------------------------------------------------------
//-------------------------------------------------------------------------
-
-void NullCodec::get_protocol_ids(std::vector<uint16_t>& v)
-{
- v.push_back(FINISHED_DECODE);
- // placeholder to avoid error
-}
-
-static Codec* ctor()
+static Codec* ctor(Module*)
{
- return new NullCodec();
+ return new DefaultCodec();
}
static void dtor(Codec *cd)
}
-static const char* name = "null";
-static const CodecApi null_api =
+static const CodecApi default_api =
{
{
PT_CODEC,
- name,
+ CD_DEFAULT_NAME,
CDAPI_PLUGIN_V0,
0,
nullptr,
nullptr,
},
- NULL, // pinit
- NULL, // pterm
- NULL, // tinit
- NULL, // tterm
+ nullptr, // pinit
+ nullptr, // pterm
+ nullptr, // tinit
+ nullptr, // tterm
ctor, // ctor
dtor, // dtor
};
-const BaseApi* cd_null = &null_api.base;
+const CodecApi* default_codec = &default_api;
#include "packet.h"
#include "snort_debug.h"
#include "framework/codec.h"
-#include "codecs/decode_module.h"
+#include "codecs/misc/cd_gtp_module.h"
#include "codecs/codec_events.h"
#include "snort.h"
#include "protocols/ipv4.h"
class GtpCodec : public Codec
{
public:
- GtpCodec() : Codec("gtp"){};
+ GtpCodec() : Codec(CD_GTP_NAME){};
~GtpCodec(){};
virtual void get_protocol_ids(std::vector<uint16_t>& v);
// api
//-------------------------------------------------------------------------
-static Codec* ctor()
+static Module* mod_ctor()
+{
+ return new GtpModule;
+}
+
+static void mod_dtor(Module* m)
+{
+ delete m;
+}
+
+static Codec* ctor(Module*)
{
return new GtpCodec();
}
delete cd;
}
-static const char* name = "gtp";
static const CodecApi gtp_api =
{
{
PT_CODEC,
- name,
+ CD_GTP_NAME,
CDAPI_PLUGIN_V0,
0,
- nullptr,
- nullptr
+ mod_ctor,
+ mod_dtor
},
- NULL, // pinit
- NULL, // pterm
- NULL, // tinit
- NULL, // tterm
+ nullptr, // pinit
+ nullptr, // pterm
+ nullptr, // tinit
+ nullptr, // tterm
ctor, // ctor
dtor, // dtor
};
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// cd_gtp_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
+
+#include "codecs/misc/cd_gtp_module.h"
+
+
+static const Parameter gtp_params[] =
+{
+ { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
+};
+
+
+static const RuleMap gtp_rules[] =
+{
+
+ { DECODE_GTP_MULTIPLE_ENCAPSULATION, "(" CD_GTP_NAME ") Two or more GTP encapsulation layers present" },
+ { DECODE_GTP_BAD_LEN, "(" CD_GTP_NAME ") GTP header length is invalid" },
+ { 0, nullptr }
+};
+
+//-------------------------------------------------------------------------
+// rpc module
+//-------------------------------------------------------------------------
+
+GtpModule::GtpModule() : DecodeModule(CD_GTP_NAME, gtp_params, gtp_rules)
+{ }
+
+bool GtpModule::set(const char*, Value&, SnortConfig*)
+{
+ return true;
+}
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// cd_gtp_module.h author Josh Rosenbaum <jrosenba@cisco.com>
+
+#ifndef CD_GTP_MODULE_H
+#define CD_GTP_MODULE_H
+
+#include "codecs/decode_module.h"
+
+
+#define CD_GTP_NAME "codec_gtp"
+
+class GtpModule : public DecodeModule
+{
+public:
+ GtpModule();
+
+ bool set(const char*, Value&, SnortConfig*);
+};
+
+#endif
namespace
{
+#define CD_TEREDO_NAME "codec_teredo"
+
class TeredoCodec : public Codec
{
public:
- TeredoCodec() : Codec("teredo"){};
+ TeredoCodec() : Codec(CD_TEREDO_NAME){};
~TeredoCodec(){};
virtual void get_protocol_ids(std::vector<uint16_t>& v);
if ( ScTunnelBypassEnabled(TUNNEL_TEREDO) )
Active_SetTunnelBypass();
- if (ScDeepTeredoInspection() && (!teredo::is_teredo_port(p->sp)) && (!teredo::is_teredo_port(p->dp)))
+ if ((!teredo::is_teredo_port(p->sp)) && (!teredo::is_teredo_port(p->dp)))
p->packet_flags |= PKT_UNSURE_ENCAP;
next_prot_id = IPPROTO_IPV6;
return false;
}
-
-
//-------------------------------------------------------------------------
// api
//-------------------------------------------------------------------------
-static Codec* ctor()
+static Codec* ctor(Module*)
{
return new TeredoCodec();
}
delete cd;
}
-static const char* name = "teredo";
static const CodecApi teredo_api =
{
{
PT_CODEC,
- name,
+ CD_TEREDO_NAME,
CDAPI_PLUGIN_V0,
0,
nullptr,
if (ENABLE_NON_ETHER_DECODERS)
set(NON_ETHER_DECODERS
- root_trk.cc
+ cd_trk.cc
+ cd_trk_module.h
+ cd_trk_module.cc
root_fddi.cc
root_linuxsll.cc
- root_ieee80211.cc
+ cd_ieee80211.cc
+ cd_ieee80211_module.h
+ cd_ieee80211_module.cc
root_slip.cc
root_i4lrawip.cc
root_oldpflog.cc
add_library(root_codecs STATIC
cd_eth.cc
+ cd_eth_module.h
+ cd_eth_module.cc
cd_raw4.cc
cd_raw6.cc
cd_null_root.cc
noinst_LIBRARIES = libroot_codecs.a
libroot_codecs_a_SOURCES = \
cd_eth.cc \
+cd_eth_module.h \
+cd_eth_module.cc \
cd_raw4.cc \
cd_raw6.cc \
cd_null_root.cc
if ENABLE_NON_ETHER_DECODER
if STATIC_DECODERS
libroot_codecs_a_SOURCES += \
-root_trk.cc \
+cd_trk.cc \
+cd_trk_module.h \
+cd_trk_module.cc \
root_fddi.cc \
root_linuxsll.cc \
-root_ieee80211.cc \
+cd_ieee80211.cc \
+cd_ieee80211_module.h \
+cd_ieee80211_module.cc \
root_slip.cc \
root_i4lrawip.cc \
root_oldpflog.cc \
ehlib_LTLIBRARIES = libcd_trk.la
libcd_trk_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
libcd_trk_la_LDFLAGS = -export-dynamic -shared
-libcd_trk_la_SOURCES = root_trk.cc
+libcd_trk_la_SOURCES = cd_trk.cc cd_trk_module.h cd_trk_module.cc
endif
endif
#endif
#include <pcap.h>
-#include "codecs/decode_module.h"
+#include "codecs/root/cd_eth_module.h"
#include "framework/codec.h"
#include "time/profiler.h"
#include "protocols/packet.h"
class EthCodec : public Codec
{
public:
- EthCodec() : Codec("eth"){};
+ EthCodec() : Codec(CD_ETH_NAME){};
~EthCodec(){};
codec_events::decoder_event(p, DECODE_ETH_HDR_TRUNC);
-// dc.discards++;
-// dc.ethdisc++;
return false;
}
return true;
}
-// add this alert type
-// if(len > MAX_LENGTH) {
-// CodecEvents::decoder_event(p, DECODE_ETH_INVALID_FRAME);
-
return false;
}
// api
//-------------------------------------------------------------------------
-static Codec* ctor()
+static Module* mod_ctor()
+{
+ return new EthModule;
+}
+
+static void mod_dtor(Module* m)
+{
+ delete m;
+}
+
+static Codec* ctor(Module*)
{
return new EthCodec();
}
delete cd;
}
-static const char* name = "eth";
static const CodecApi eth_api =
{
{
PT_CODEC,
- name,
+ CD_ETH_NAME,
CDAPI_PLUGIN_V0,
0,
- nullptr,
- nullptr,
+ mod_ctor,
+ mod_dtor,
},
nullptr, // pinit
nullptr, // pterm
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// cd_eth_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
+
+#include "codecs/root/cd_eth_module.h"
+
+
+static const Parameter eth_params[] =
+{
+ { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
+};
+
+
+static const RuleMap eth_rules[] =
+{
+ { DECODE_ETH_HDR_TRUNC, "(" CD_ETH_NAME ") truncated eth header" },
+ { 0, nullptr }
+};
+
+//-------------------------------------------------------------------------
+// rpc module
+//-------------------------------------------------------------------------
+
+EthModule::EthModule() : DecodeModule(CD_ETH_NAME, eth_params, eth_rules)
+{ }
+
+bool EthModule::set(const char*, Value&, SnortConfig*)
+{
+ return true;
+}
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// cd_eth_module.h author Josh Rosenbaum <jrosenba@cisco.com>
+
+#ifndef CD_ETH_MODULE_H
+#define CD_ETH_MODULE_H
+
+#include "codecs/decode_module.h"
+
+
+#define CD_ETH_NAME "codec_eth"
+
+class EthModule : public DecodeModule
+{
+public:
+ EthModule();
+
+ bool set(const char*, Value&, SnortConfig*);
+};
+
+#endif
#include "../decoder_includes.h"
+
+#define MINIMAL_IEEE80211_HEADER_LEN 10 /* Ack frames and others */
+#define IEEE802_11_DATA_HDR_LEN 24 /* Header for data packets */
+
/*
* Function: DecodeIEEE80211Pkt(Packet *, char *, DAQ_PktHdr_t*,
* uint8_t*)
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// cd_ieee8021_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
+
+#include "codecs/root/cd_ieee8021_module.h"
+
+
+static const Parameter ieee80211_params[] =
+{
+ { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
+};
+
+
+static const RuleMap iee80211_rules[] =
+{
+ { DECODE_BAD_80211_ETHLLC, "(" CD_IEEE80211_NAME ") Bad 802.11 LLC header" },
+ { DECODE_BAD_80211_OTHER, "(" CD_IEEE80211_NAME ") Bad 802.11 Extra LLC Info" },
+ { 0, nullptr }
+};
+
+//-------------------------------------------------------------------------
+// rpc module
+//-------------------------------------------------------------------------
+
+Ieee80211Module::Ieee80211Module() : DecodeModule(CD_IEEE80211_NAME, ieee80211_params, iee80211_rules)
+{ }
+
+bool Ieee80211Module::set(const char*, Value&, SnortConfig*)
+{
+ return true;
+}
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// cd_ieee8021_module.h author Josh Rosenbaum <jrosenba@cisco.com>
+
+#ifndef CD_IEEE80211_MODULE_H
+#define CD_IEEE80211_MODULE_H
+
+#include "codecs/decode_module.h"
+
+
+#define CD_IEEE80211_NAME "codec_ieee80211"
+
+class Ieee80211Module : public DecodeModule
+{
+public:
+ Ieee80211Module();
+
+ bool set(const char*, Value&, SnortConfig*);
+};
+
+#endif
#endif
#include "framework/codec.h"
-#include "codecs/decode_module.h"
-#include "codecs/codec_events.h"
#include "protocols/protocol_ids.h"
#include "main/snort.h"
#include <pcap.h>
namespace
{
+#define CD_NULL_NAME "codec_null"
+
class NullRootCodec : public Codec
{
public:
- NullRootCodec() : Codec("null_root"){};
+ NullRootCodec() : Codec(CD_NULL_NAME){};
~NullRootCodec() {};
v.push_back(DLT_NULL);
}
-
-
//-------------------------------------------------------------------------
// api
//-------------------------------------------------------------------------
-static Codec* ctor()
+static Codec* ctor(Module*)
{
return new NullRootCodec();
}
delete cd;
}
-
-static const char* name = "null_root";
static const CodecApi null_root_api =
{
- {
- PT_CODEC,
- name,
- CDAPI_PLUGIN_V0,
+ {
+ PT_CODEC,
+ CD_NULL_NAME,
+ CDAPI_PLUGIN_V0,
0,
nullptr,
nullptr,
// cd_raw4.cc author Josh Rosenbaum <jorosenba@cisco.com>
-
#ifdef HAVE_CONFIG_H
#include "config.h"
#endif
#include "framework/codec.h"
-#include "codecs/decode_module.h"
-#include "codecs/codec_events.h"
#include "protocols/protocol_ids.h"
#include <pcap.h>
namespace
{
+#define CD_RAW4_NAME "codec_raw4"
+
class Raw4Codec : public Codec
{
public:
- Raw4Codec() : Codec("raw4"){};
+ Raw4Codec() : Codec(CD_RAW4_NAME){};
~Raw4Codec() {};
// api
//-------------------------------------------------------------------------
-static Codec* ctor()
+static Codec* ctor(Module*)
{
return new Raw4Codec();
}
delete cd;
}
-
-static const char* name = "raw4";
static const CodecApi raw4_api =
{
{
PT_CODEC,
- name,
+ CD_RAW4_NAME,
CDAPI_PLUGIN_V0,
0,
nullptr,
#endif
#include "framework/codec.h"
-#include "codecs/decode_module.h"
-#include "codecs/codec_events.h"
#include "protocols/protocol_ids.h"
#include <pcap.h>
namespace
{
+#define CD_RAW6_NAME "codec_raw6"
+
class Raw6Codec : public Codec
{
public:
- Raw6Codec() : Codec("raw6"){};
+ Raw6Codec() : Codec(CD_RAW6_NAME){};
~Raw6Codec() {};
-
virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
virtual void get_data_link_type(std::vector<int>&);
// api
//-------------------------------------------------------------------------
-static Codec* ctor()
+static Codec* ctor(Module*)
{
return new Raw6Codec();
}
delete cd;
}
-
-static const char* name = "raw6";
static const CodecApi raw6_api =
{
{
PT_CODEC,
- name,
+ CD_RAW6_NAME,
CDAPI_PLUGIN_V0,
0,
nullptr,
#include "config.h"
#endif
-#include "generators.h"
-#include "decode.h"
-#include "static_include.h"
+#include "decode.h"
-#include "../decoder_includes.h"
+
+
+
+// THESE ARE NEVER USED!!
+#define MINIMAL_TOKENRING_HEADER_LEN 22
+#define TR_HLEN MINIMAL_TOKENRING_HEADER_LEN
+#define TOKENRING_LLC_LEN 8
+// DELETE FIN
+
+#define TR_ALEN 6 /* octets in an Ethernet header */
+#define IPARP_SAP 0xaa
+
+#define AC 0x10
+#define LLC_FRAME 0x40
+
+#define TRMTU 2000 /* 2000 bytes */
+#define TR_RII 0x80
+#define TR_RCF_DIR_BIT 0x80
+#define TR_RCF_LEN_MASK 0x1f00
+#define TR_RCF_BROADCAST 0x8000 /* all-routes broadcast */
+#define TR_RCF_LIMITED_BROADCAST 0xC000 /* single-route broadcast */
+#define TR_RCF_FRAME2K 0x20
+#define TR_RCF_BROADCAST_MASK 0xC000
/*
* Function: DecodeTRPkt(Packet *, char *, DAQ_PktHdr_t*, uint8_t*)
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// cd_arp_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
+
+#include "codecs/root/cd_trk_module.h"
+
+
+static const Parameter trk_params[] =
+{
+ { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
+};
+
+
+static const RuleMap trk_rules[] =
+{
+ { DECODE_BAD_TRH, "(" CD_TRK_NAME ") Bad Token Ring Header" },
+ { DECODE_BAD_TR_ETHLLC, "(" CD_TRK_NAME ") Bad Token Ring ETHLLC Header" },
+ { DECODE_BAD_TR_MR_LEN, "(" CD_TRK_NAME ") Bad Token Ring MRLENHeader" },
+ { DECODE_BAD_TRHMR, "(" CD_TRK_NAME ") Bad Token Ring MR Header" },
+ { 0, nullptr }
+};
+
+//-------------------------------------------------------------------------
+// token ring module
+//-------------------------------------------------------------------------
+
+TrkModule::TrkModule() : DecodeModule(CD_TRK_NAME, trk_params, trk_rules)
+{ }
+
+bool TrkModule::set(const char*, Value&, SnortConfig*)
+{
+ return true;
+}
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// cd_trk_module.h author Josh Rosenbaum <jrosenba@cisco.com>
+
+#ifndef CD_TRK_MODULE_H
+#define CD_TRK_MODULE_H
+
+#include "codecs/decode_module.h"
+
+
+#define CD_TRK_NAME "codec_trk"
+
+class TrkModule : public DecodeModule
+{
+public:
+ TrkModule();
+
+ bool set(const char*, Value&, SnortConfig*);
+};
+
+#endif
#include "../decoder_includes.h"
+
+/* enc interface */
+struct enc_header {
+ uint32_t af;
+ uint32_t spi;
+ uint32_t flags;
+};
+#define ENC_HEADER_LEN 12
+
+
#ifdef DLT_ENC
/* see http://sourceforge.net/mailarchive/message.php?msg_id=1000380 */
/*
+++ /dev/null
-/*
-** Copyright (C) 2002-2013 Sourcefire, Inc.
-** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-
-#ifndef ROOT_TRK_H
-#define ROOT_TRK_H
-
-// THESE ARE NEVER USED!!
-#define MINIMAL_TOKENRING_HEADER_LEN 22
-#define TR_HLEN MINIMAL_TOKENRING_HEADER_LEN
-#define TOKENRING_LLC_LEN 8
-// DELETE FIN
-
-#define TR_ALEN 6 /* octets in an Ethernet header */
-#define IPARP_SAP 0xaa
-
-#define AC 0x10
-#define LLC_FRAME 0x40
-
-#define TRMTU 2000 /* 2000 bytes */
-#define TR_RII 0x80
-#define TR_RCF_DIR_BIT 0x80
-#define TR_RCF_LEN_MASK 0x1f00
-#define TR_RCF_BROADCAST 0x8000 /* all-routes broadcast */
-#define TR_RCF_LIMITED_BROADCAST 0xC000 /* single-route broadcast */
-#define TR_RCF_FRAME2K 0x20
-#define TR_RCF_BROADCAST_MASK 0xC000
-
-
-void DecodeTRPkt(Packet *, const DAQ_PktHdr_t*, const uint8_t *);
-
-#endif /* PROT_TRK_H */
-
#include "config.h"
#endif
+#include <string.h> // memcpy
#include "framework/codec.h"
-#include "codecs/decode_module.h"
-#include "codecs/codec_events.h"
+#include "codecs/template_module.h"
namespace
{
+// yes, macros are necessary. The API and class constructor require different strings.
+//
+// this macros is defined in the module to ensure identical names. However,
+// if you don't want a module, define the name here.
+#ifndef CODEC_NAME
+#define CODEC_NAME "name"
+#endif
+
class NameCodec : public Codec
{
public:
- NameCodec() : Codec("name"){};
+ NameCodec() : Codec(CODEC_NAME){};
~NameCodec() {};
// api
//-------------------------------------------------------------------------
+/*
+ * Modules create custom configuration options which can be used in snort.lua.
+ * If you don't want any configuration options, remove the mod_ctor
+ * and mod_dtor functions from the api below. See documentation for additional
+ * details regarding Modules
+ */
+static Module* mod_ctor()
+{
+ return new NameModule;
+}
+
+static void mod_dtor(Module* m)
+{
+ delete m;
+}
+
static void ginit()
{
// initialize global variables
// cleanup any thread_local variables
}
-static Codec* ctor()
+static Codec* ctor(Module*)
{
return new NameCodec();
}
}
-static const char* const name = "name";
static const CodecApi name_api =
{
{
PT_CODEC,
- name,
+ CODEC_NAME,
CDAPI_PLUGIN_V0,
0,
- nullptr,
- nullptr,
+ mod_ctor, // module constructor ( see function for details )
+ mod_dtor // module destructor ( see function for details )
},
- ginit, // pinit
- gterm, // pterm
- tinit, // tinit
- tterm, // tterm
- ctor, // ctor
- dtor, // dtor
+ ginit, // global initializer
+ gterm, // global terminate
+ tinit, // thread local initializer
+ tterm, // thread local terminate
+ ctor, // constructor --> REQUIRED. return a newly create Codec
+ dtor, // desctructor --> REQUIRED. destory the Codec.
};
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// template_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
+
+#include "codecs/template_module.h"
+
+
+static const Parameter codec_params[] =
+{
+ { "parameter1", Parameter::PT_BOOL, nullptr, "false",
+ "This is a boolean parameter" },
+
+ { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
+};
+
+
+// rules which will loaded into snort.
+// You can now reference these rules by calling a codec_event
+// in your main codec's functions
+static const RuleMap codec_rules[] =
+{
+ { SID, "(" CODEC_NAME ") alert message" },
+ { 0, nullptr }
+};
+
+//-------------------------------------------------------------------------
+// rpc module
+//-------------------------------------------------------------------------
+
+NameCodec::NameCodec() : DecodeModule(CODEC_NAME, codec_params, codec_rules)
+{ }
+
+bool NameCodec::set(const char*, Value& v, SnortConfig* sc)
+{
+ if ( v.is("parameter1") )
+ option1 = v.get_bool();
+
+ else
+ return false;
+
+ return true;
+}
+
+bool NameCodec::begin(const char*, int, SnortConfig*)
+{
+ option1 = false;
+ return true;
+}
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// template_module.h author Josh Rosenbaum <jrosenba@cisco.com>
+
+#ifndef TEMPLATE_MODULE_H
+#define TEMPLATE_MODULE_H
+
+#include "codecs/decode_module.h"
+
+
+#define CODEC_NAME "name"
+
+// inherit from DecodeModule rather than Module so the GID for
+// all codecs are identical. Additionally, all of the SIDS are
+// defined in DecodeModule. So, when creating new events, you
+// only need to look for codec SID collisions in one locations
+class NameModule : public DecodeModule
+{
+public:
+ NameModule();
+
+ bool set(const char*, Value&, SnortConfig*);
+ bool begin(const char*, int, SnortConfig*);
+
+private:
+ // any structs or options which will be used when constructing
+ // the Codec
+ bool option1;
+
+};
+
+#endif
// Get the codec's name
inline const char* get_name(){return name; };
- // used by packet manager to determine the default/null codec
- virtual bool is_default_codec() { return false; };
// Registers this Codec's data link type (as defined by libpcap)
virtual void get_data_link_type(std::vector<int>&) {};
// Register the code's protocol ID's and Ethertypes
// to be useful, these must be explicit (*_V0, *_V1, ...)
#define CDAPI_PLUGIN_V0 0
-typedef Codec* (*cd_new_f)();
+typedef Codec* (*cd_new_f)(Module*);
typedef void (*cd_del_f)(Codec *);
typedef void (*cd_aux_f)();
typedef void (*cd_dlt_f)(std::vector<int>&v);
{ "var", Parameter::PT_STRING, nullptr, nullptr,
"list of name=value DAQ-specific parameters" },
+ { "snaplen", Parameter::PT_INT, "0:65535", "deflt",
+ "set snap length (same as -P)" },
+
+ { "decode_data_link", Parameter::PT_BOOL, nullptr, "false",
+ "display the second layer header info" },
+
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
else if ( v.is("var") )
ConfigDaqVar(sc, v.get_string());
+ else if ( v.is("decode_data_link") )
+ {
+ if ( v.get_bool() )
+ ConfigDecodeDataLink(sc, "");
+ }
+ else if ( v.is("snaplen") )
+ ConfigPacketSnaplen(sc, v.get_string());
+
else
return false;
// these modules could be in traffic policy
ModuleManager::add_module(new ActiveModule);
- ModuleManager::add_module(new DecodeModule);
ModuleManager::add_module(new FileIdModule);
#ifdef PPM_MGR
install (FILES ${LUA_INCLUDES}
DESTINATION "${INCLUDE_INSTALL_PATH}/lua"
)
-
*/
// packet_manager.cc author Josh Rosenbaum <jorosenba@cisco.com>
-#include <list>
#include <vector>
#include <cstring>
#include <mutex>
+#include <algorithm>
+
#include "packet_manager.h"
#include "framework/codec.h"
#include "snort.h"
THREAD_LOCAL PreprocStats decodePerfStats;
#endif
-static const uint16_t max_protocol_id = 65535;
-static std::list<const CodecApi*> s_codecs;
+extern const CodecApi* default_codec;
+
+static const uint16_t max_protocol_id = 65535;
+static std::vector<const CodecApi*> s_codecs;
// when initialization arrays, although the zero is not required
// the compiler complains about a missing-field-initiliezers
static THREAD_LOCAL std::array<uint16_t, IP_ID_COUNT> s_id_pool{{0}};
static THREAD_LOCAL std::array<uint8_t, Codec::PKT_MAX> s_pkt{{0}};
+
+
//-------------------------------------------------------------------------
// Private helper functions
//-------------------------------------------------------------------------
stats_mutex.unlock();
}
+static bool api_instantiated(const CodecApi* cd_api)
+{
+ static std::vector<bool> instantiated_api; // all elements initialized to false
+
+ if (instantiated_api.size() != s_codecs.size())
+ instantiated_api.resize(s_codecs.size());
+
+ std::vector<const CodecApi*>::iterator p = std::find(s_codecs.begin(), s_codecs.end(), cd_api);
+
+ if (p == s_codecs.end())
+ FatalError("PacketManager:: should never reach this code!!" \
+ "Cannot find Codec %s's api", cd_api->base.name);
+
+ int pos = p - s_codecs.begin();
+
+ if(instantiated_api[pos])
+ return true;
+
+ instantiated_api[pos] = true;
+ return false;
+}
//-------------------------------------------------------------------------
// Initialization and setup
//-------------------------------------------------------------------------
if (!api->ctor)
FatalError("Codec %s: ctor() must be implemented. Look at the example code for an example.\n",
api->base.name);
-
if (!api->dtor)
FatalError("Codec %s: dtor() must be implemented. Look at the example code for an example.\n",
api->base.name);
s_protocols[0] = nullptr;
}
-void PacketManager::instantiate(const CodecApi* /*cd_api */, Module* /*m*/, SnortConfig* /*sc*/)
+void PacketManager::instantiate(const CodecApi* cd_api , Module* m, SnortConfig* /*sc*/)
{
-#if 0
- static uint16_t codec_id = 1;
+ static int codec_id = 1;
std::vector<uint16_t> ids;
- const CodecApi *p = GetApi(cd_api->base.name);
- if(!p)
- ParseError("Unknown codec: '%s'.", cd_api->base.name);
+ if (api_instantiated(cd_api)) // automatically marks as instantiated
+ return;
+
+ if (codec_id >= UINT8_MAX)
+ FatalError("A maximum of 256 codecs can be registered\n");
// global init here to ensure the global policy has already been configured
- if (p->ginit)
- p->ginit();
+ if (cd_api->ginit)
+ cd_api->ginit();
- Codec *cd = p->ctor();
+ Codec *cd = cd_api->ctor(m);
cd->get_protocol_ids(ids);
for (auto id : ids)
{
s_proto_map[id] = codec_id;
}
- if(cd->is_default_codec())
- {
- if(s_protocols[0])
- FatalError("Only one Codec may be the registered as default, "
- "but both the %s and %s return 'true' when "
- " the function default_codec().\n",
- s_protocols[0]->get_name(), cd->get_name());
- else
- s_protocols[0] = cd;
- }
-
s_protocols[codec_id++] = cd;
-#endif
}
void PacketManager::instantiate()
{
- static uint16_t codec_id = 1;
-
- if (codec_id >= UINT8_MAX)
- FatalError("A maximum of 256 codecs can be registered\n");
+ // hard code the default codec into the zero index
+ add_plugin(default_codec);
+ instantiate(default_codec, nullptr, nullptr);
+ s_protocols[0] = s_protocols[get_codec(default_codec->base.name)];
+ // and instantiate every codec which does not have a module
for (auto p : s_codecs)
- {
- std::vector<uint16_t> ids;
-
- // global init here to ensure the global policy has already been configured
- if (p->ginit)
- p->ginit();
-
- Codec *cd = p->ctor();
- cd->get_protocol_ids(ids);
- for (auto id : ids)
- {
- if(s_proto_map[id] != 0)
- WarningMessage("The Codecs %s and %s have both been registered "
- "for protocol_id %d. Codec %s will be used\n",
- s_protocols[s_proto_map[id]]->get_name(), cd->get_name(),
- id, cd->get_name());
-
- s_proto_map[id] = codec_id;
- }
-
- if(cd->is_default_codec())
- {
- if(s_protocols[0])
- FatalError("Only one Codec may be the registered as default, "
- "but both the %s and %s return 'true' for "
- " the function is_default_codec().\n",
- s_protocols[0]->get_name(), cd->get_name());
- else
- s_protocols[0] = cd;
- }
-
- s_protocols[codec_id++] = cd;
- }
+ instantiate(p, nullptr, nullptr);
}
void PacketManager::thread_init(void)
}
if(!grinder)
- FatalError("Unable to find a Codec with data link type %d!!\n", daq_dlt);
+ FatalError("PacketManager: Unable to find a Codec with data link type %d!!\n", daq_dlt);
// ENCODER initialization
mapped_prot = s_proto_map[prot_id];
prev_prot_id = prot_id;
- // reset for next call
+ // set for next call
prot_id = FINISHED_DECODE;
len -= lyr_len;
pkt += lyr_len;
//-------------------------------------------------------------------------
// encoders operate layer by layer:
-
-
-
-//-------------------------------------------------------------------------
-// basic setup stuff
//-------------------------------------------------------------------------
#define ETHERNET_HEADER_LEN 14
#define ETHERNET_MTU 1500
+#define ETH_DSAP_SNA 0x08 /* SNA */
+#define ETH_SSAP_SNA 0x00 /* SNA */
+#define ETH_DSAP_STP 0x42 /* Spanning Tree Protocol */
+#define ETH_SSAP_STP 0x42 /* Spanning Tree Protocol */
+#define ETH_DSAP_IP 0xaa /* IP */
+#define ETH_SSAP_IP 0xaa /* IP */
+
+#define ETH_ORG_CODE_ETHR 0x000000 /* Encapsulated Ethernet */
+#define ETH_ORG_CODE_CDP 0x00000c /* Cisco Discovery Proto */
+
namespace eth
{
sum_stats((PegCount*)&gpc, (PegCount*)&pc, array_size(pc_names));
memset(&pc, 0, sizeof(pc));
-
- //decoder_sum(); FIXIT must be moved
}
//-------------------------------------------------------------------------
projects / thirdparty / snort3.git / commitdiff
