Refactor packet manager

diff --git a/src/codecs/basic/cd_icmp4.cc b/src/codecs/basic/cd_icmp4.cc
index e8cbe1016693d94ed5a8e8903aae161f34699a01..54689bcbb820d03f459d9bb4fd63c2466dfa2db9 100644 (file)
--- a/src/codecs/basic/cd_icmp4.cc
+++ b/src/codecs/basic/cd_icmp4.cc
@@ -39,9 +39,6 @@
 
 namespace{
 
-const uint32_t ICMP_HEADER_LEN = 4;
-const uint32_t ICMP_NORMAL_LEN = 8;
-
 
 class Icmp4Codec : public Codec{
 
@@ -95,7 +92,7 @@ void Icmp4Codec::get_protocol_ids(std::vector<uint16_t> &v)
 bool Icmp4Codec::decode(const uint8_t* raw_pkt, const uint32_t raw_len, 
         Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
 {
-    if(raw_len < ICMP_HEADER_LEN)
+    if(raw_len < icmp4::hdr_len())
     {
         DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
             "WARNING: Truncated ICMP4 header (%d bytes).\n", raw_len););
@@ -200,10 +197,7 @@ bool Icmp4Codec::decode(const uint8_t* raw_pkt, const uint32_t raw_len,
         }
     }
 
-    lyr_len = ICMP_HEADER_LEN;
-
-    p->dsize = (u_short)(raw_len - ICMP_HEADER_LEN);
-    p->data = raw_pkt + ICMP_HEADER_LEN;
+    lyr_len =  icmp4::hdr_len();
 
     DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "ICMP type: %d   code: %d\n",
                 p->icmph->type, p->icmph->code););
@@ -245,14 +239,11 @@ bool Icmp4Codec::decode(const uint8_t* raw_pkt, const uint32_t raw_len,
 
 
     /* Run a bunch of ICMP decoder rules */
-    p->dsize = (u_short)(raw_len - lyr_len);
-    p->data = raw_pkt + lyr_len;
+    p->dsize = (u_short)(raw_len - lyr_len); // setting for use in ICMP4MiscTests
     ICMP4MiscTests(p);
 
     p->proto_bits |= PROTO_BIT__ICMP;
     p->proto_bits &= ~(PROTO_BIT__UDP | PROTO_BIT__TCP);
-
-    next_prot_id = -1;
     return true;
 }
 

diff --git a/src/codecs/basic/cd_icmp6.cc b/src/codecs/basic/cd_icmp6.cc
index 6568fb8514c2c6d7d15db5bfa143d2e97b016a37..33f8d63e5de8088aab3a253b71c3d81a35591672 100644 (file)
--- a/src/codecs/basic/cd_icmp6.cc
+++ b/src/codecs/basic/cd_icmp6.cc
@@ -321,6 +321,8 @@ bool Icmp6Codec::decode(const uint8_t* raw_pkt, const uint32_t len,
             break;
 
         default:
+                DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
+                    "WARNING: ICMP6_TYPE (type %d).\n", p->icmp6h->type););
             codec_events::decoder_event(p, DECODE_ICMP6_TYPE_OTHER);
 
             lyr_len = icmp6::hdr_min_len();
@@ -516,7 +518,6 @@ void ICMP6_Format (EncodeFlags, const Packet*, Packet* c, Layer* lyr)
     c->icmp6h = (ICMP6Hdr*)lyr->start;
 }
 
-#endif
 
 /*
  * CHECKSUM
@@ -605,6 +606,7 @@ static unsigned short in_chksum_icmp6(pseudoheader6 *ph,
   return (unsigned short)(~cksum);
 }
 
+#endif
 
 static Codec* ctor()
 {

diff --git a/src/codecs/basic/cd_ipv4.cc b/src/codecs/basic/cd_ipv4.cc
index a1606c74be00318b5cbad69e54ae0dcac254ca64..76d632f23ab3edb5bc6a0bed73a3c82def1e5f74 100644 (file)
--- a/src/codecs/basic/cd_ipv4.cc
+++ b/src/codecs/basic/cd_ipv4.cc
@@ -117,6 +117,7 @@ bool Ipv4Codec::decode(const uint8_t *raw_packet, const uint32_t len,
         Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
 {
     uint32_t ip_len; /* length from the start of the ip hdr to the pkt end */
+    uint16_t hlen;  /* ip header length */
 
 //    dc.ip++;
 
@@ -187,13 +188,13 @@ bool Ipv4Codec::decode(const uint8_t *raw_packet, const uint32_t len,
     ip_len = ntohs(p->iph->ip_len);
 
     /* get the IP header length */
-    lyr_len = ipv4::get_pkt_hdr_len(p->iph) << 2;
+    hlen = ipv4::get_pkt_hdr_len(p->iph) << 2;
 
     /* header length sanity check */
-    if(lyr_len < ipv4::hdr_len())
+    if(hlen < ipv4::hdr_len())
     {
         DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
-            "Bogus IP header length of %i bytes\n", lyr_len););
+            "Bogus IP header length of %i bytes\n", hlen););
 
         codec_events::decoder_event(p, DECODE_IPV4_INVALID_HEADER_LEN);
 
@@ -236,11 +237,11 @@ bool Ipv4Codec::decode(const uint8_t *raw_packet, const uint32_t len,
     }
 #endif
 
-    if(ip_len < lyr_len)
+    if(ip_len < hlen)
     {
         DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
             "IP dgm len (%d bytes) < IP hdr "
-            "len (%d bytes), packet discarded\n", ip_len, lyr_len););
+            "len (%d bytes), packet discarded\n", ip_len, hlen););
 
         codec_events::decoder_event(p, DECODE_IPV4_DGRAM_LT_IPHDR);
 
@@ -263,7 +264,7 @@ bool Ipv4Codec::decode(const uint8_t *raw_packet, const uint32_t len,
          * need to check them (should make this a command line/config
          * option
          */
-        int16_t csum = in_chksum_ip((u_short *)p->iph, lyr_len);
+        int16_t csum = in_chksum_ip((u_short *)p->iph, hlen);
 
         if(csum)
         {
@@ -282,7 +283,7 @@ bool Ipv4Codec::decode(const uint8_t *raw_packet, const uint32_t len,
     }
 
     /* test for IP options */
-    p->ip_options_len = (uint16_t)(lyr_len - ipv4::hdr_len());
+    p->ip_options_len = (uint16_t)(hlen - ipv4::hdr_len());
 
     if(p->ip_options_len > 0)
     {
@@ -309,7 +310,7 @@ bool Ipv4Codec::decode(const uint8_t *raw_packet, const uint32_t len,
     p->actual_ip_len = (uint16_t) ip_len;
 
     /* set the remaining packet length */
-    ip_len -= lyr_len;
+    ip_len -= hlen;
 
     /* check for fragmented packets */
     p->frag_offset = ntohs(p->iph->ip_off);
@@ -342,7 +343,7 @@ bool Ipv4Codec::decode(const uint8_t *raw_packet, const uint32_t len,
         {
             /* set the packet fragment flag */
             p->frag_flag = 1;
-            p->ip_frag_start = raw_packet + lyr_len;
+            p->ip_frag_start = raw_packet + hlen;
             p->ip_frag_len = (uint16_t)ip_len;
 //            dc.frags++;
         }
@@ -358,7 +359,7 @@ bool Ipv4Codec::decode(const uint8_t *raw_packet, const uint32_t len,
     }
 
     /* Set some convienience pointers */
-    p->ip_data = raw_packet + lyr_len;
+    p->ip_data = raw_packet + hlen;
     p->ip_dsize = (u_short) ip_len;
 
     /* See if there are any ip_proto only rules that match */
@@ -367,6 +368,7 @@ bool Ipv4Codec::decode(const uint8_t *raw_packet, const uint32_t len,
     p->proto_bits |= PROTO_BIT__IP;
 
     IPMiscTests(p);
+    lyr_len = hlen;
 
     /* if this packet isn't a fragment
      * or if it is, its a UDP packet and offset is 0 */
@@ -375,15 +377,14 @@ bool Ipv4Codec::decode(const uint8_t *raw_packet, const uint32_t len,
             (p->iph->ip_proto == IPPROTO_UDP)))
     {
         DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "IP header length: %lu\n",
-                    (unsigned long)lyr_len););
+                    (unsigned long)hlen););
 
         next_prot_id = p->iph->ip_proto;
-        return true;
     }
     else
     {
         /* set the payload pointer and payload size */
-        p->data = raw_packet + lyr_len;
+        p->data = raw_packet + hlen;
         p->dsize = (u_short) ip_len;
     }
 
@@ -416,39 +417,32 @@ inline void DecodeIPv4Proto(const uint8_t proto,
 
 #if 0
 
+#endif
         case IPPROTO_IP_MOBILITY:
         case IPPROTO_SUN_ND:
         case IPPROTO_PIM:
-            if ( Event_Enabled(DECODE_IP_BAD_PROTO) )
-                codec_events::decoder_event(p, DECODE_IP_BAD_PROTO));
-//            dc.other++;
+            codec_events::decoder_event(p, DECODE_IP_BAD_PROTO);
             p->data = pkt;
             p->dsize = (uint16_t)len;
             return;
 
         case IPPROTO_PGM:
-//            dc.other++;
             p->data = pkt;
             p->dsize = (uint16_t)len;
 
-            if ( Event_Enabled(DECODE_PGM_NAK_OVERFLOW) )
                 CheckPGMVuln(p);
             return;
 
         case IPPROTO_IGMP:
-//            dc.other++;
             p->data = pkt;
             p->dsize = (uint16_t)len;
-
-            if ( Event_Enabled(DECODE_IGMP_OPTIONS_DOS) )
-                CheckIGMPVuln(p);
+            CheckIGMPVuln(p);
             return;
-#endif
+
         default:
             if (GET_IPH_PROTO(p) >= MIN_UNASSIGNED_IP_PROTO)
                 codec_events::decoder_event(p, DECODE_IP_UNASSIGNED_PROTO);
 
-//            dc.other++;
             p->data = pkt;
             p->dsize = (uint16_t)len;
             return;

diff --git a/src/codecs/encode.cc b/src/codecs/encode.cc
index 335ef35afbdf3e100a6a7858e91434655e17dbc7..b84059436c6615fb2f86027bc0207036bad4358d 100644 (file)
--- a/src/codecs/encode.cc
+++ b/src/codecs/encode.cc
@@ -66,12 +66,6 @@ static THREAD_LOCAL uint8_t* dst_mac = NULL;
 Packet* encode_pkt = NULL;
 uint64_t total_rebuilt_pkts = 0;
 
-static inline int IsIcmp (int type)
-{
-    static constexpr int s_icmp[ENC_MAX] = { 0, 0, 1, 1, 1 };
-    return ( s_icmp[type] );
-}
-
 //-------------------------------------------------------------------------
 // encoders operate layer by layer:
 // * base+off is start of packet

diff --git a/src/codecs/plugins/cd_erspan2.cc b/src/codecs/plugins/cd_erspan2.cc
index 8cd5870a1dd75f86b31e76eafbc3ce06c9cb9beb..ddb3e1eefe0203bce9b256312a35a00b684ab5fa 100644 (file)
--- a/src/codecs/plugins/cd_erspan2.cc
+++ b/src/codecs/plugins/cd_erspan2.cc
@@ -77,7 +77,6 @@ bool Erspan2Codec::decode(const uint8_t *raw_pkt, const uint32_t len,
         Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
 {
     lyr_len = sizeof(ERSpanType2Hdr);
-    uint32_t payload_len;
     ERSpanType2Hdr *erSpan2Hdr = (ERSpanType2Hdr *)raw_pkt;
 
     if (len < sizeof(ERSpanType2Hdr))

diff --git a/src/codecs/plugins/cd_erspan3.cc b/src/codecs/plugins/cd_erspan3.cc
index 980220808e735b0b5d058837f1cb851aa7dde3bf..5ccf2893a9dadfc0af988f16699c9255654fca1f 100644 (file)
--- a/src/codecs/plugins/cd_erspan3.cc
+++ b/src/codecs/plugins/cd_erspan3.cc
@@ -84,8 +84,7 @@ void Erspan3Codec::get_protocol_ids(std::vector<uint16_t>& v)
 bool Erspan3Codec::decode(const uint8_t *raw_pkt, const uint32_t len, 
         Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
 {
-    lyr_len= sizeof(ERSpanType3Hdr);
-    uint32_t payload_len;
+    lyr_len = sizeof(ERSpanType3Hdr);
     ERSpanType3Hdr *erSpan3Hdr = (ERSpanType3Hdr *)raw_pkt;
 
     if (len < sizeof(ERSpanType3Hdr))

diff --git a/src/codecs/plugins/cd_gre.cc b/src/codecs/plugins/cd_gre.cc
index c9dd04b365680a7b8d97f4fe468f328a5d33b5fd..1a95d1a2eec92b4bdeb6a63bc7e76f9820efaa19 100644 (file)
--- a/src/codecs/plugins/cd_gre.cc
+++ b/src/codecs/plugins/cd_gre.cc
@@ -56,7 +56,7 @@ static const uint32_t GRE_SEQ_LEN = 4;
 static const uint32_t GRE_SRE_HEADER_LEN = 4;
 
 /* GRE version 1 used with PPTP */
-static const uint32_t GRE_V1_HEADER_LEN =8;
+/* static const uint32_t GRE_V1_HEADER_LEN == GRE_HEADER_LEN + GRE_KEY_LEN; */
 static const uint32_t GRE_V1_ACK_LEN = 4;
 
 #define GRE_V1_FLAGS(x)   (x->version & 0x78)

diff --git a/src/codecs/plugins/cd_gtp.cc b/src/codecs/plugins/cd_gtp.cc
index ee249b8541825cde0bd42bbb7ab4731a582fd0ca..592f625c8c685139401e46e5aa21d1cf711f2d95 100644 (file)
--- a/src/codecs/plugins/cd_gtp.cc
+++ b/src/codecs/plugins/cd_gtp.cc
@@ -75,7 +75,6 @@ void GtpCodec::get_protocol_ids(std::vector<uint16_t>& v)
 bool GtpCodec::decode(const uint8_t *raw_pkt, const uint32_t len, 
     Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
 {
-    uint32_t header_len;
     uint8_t  next_hdr_type;
     uint8_t  version;
     uint8_t  ip_ver;
@@ -214,6 +213,8 @@ bool GtpCodec::decode(const uint8_t *raw_pkt, const uint32_t len,
         else if (ip_ver == 0x60)
             next_prot_id = ipv6::prot_id();
     }
+    
+    return true;
 }
 
 

diff --git a/src/codecs/plugins/cd_pppoepkt.cc b/src/codecs/plugins/cd_pppoepkt.cc
index 8b2b962e001e0c41ef0d51bb1d0d2edc34193f4b..99f721c361744c5818f707c39c2f7bbbcafad423 100644 (file)
--- a/src/codecs/plugins/cd_pppoepkt.cc
+++ b/src/codecs/plugins/cd_pppoepkt.cc
@@ -58,7 +58,9 @@ const uint16_t PPPoE_CODE_PADR = 0x19; /* PPPoE Active Discovery Request */
 const uint16_t PPPoE_CODE_PADS = 0x65; /* PPPoE Active Discovery Session-confirmation */
 const uint16_t PPPoE_CODE_PADT = 0xa7; /* PPPoE Active Discovery Terminate */
 
-/* PPPoE tag types */
+#if 0
+/* PPPoE tag types  -  currently not used*/
+
 const uint16_t PPPoE_TAG_END_OF_LIST = 0x0000;
 const uint16_t PPPoE_TAG_SERVICE_NAME = 0x0101;
 const uint16_t PPPoE_TAG_AC_NAME = 0x0102;
@@ -69,7 +71,7 @@ const uint16_t PPPoE_TAG_RELAY_SESSION_ID = 0x0110;
 const uint16_t PPPoE_TAG_SERVICE_NAME_ERROR = 0x0201;
 const uint16_t PPPoE_TAG_AC_SYSTEM_ERROR = 0x0202;
 const uint16_t PPPoE_TAG_GENERIC_ERROR = 0x0203;
-
+#endif
 
 } // namespace
 

diff --git a/src/codecs/plugins/cd_swipe.cc b/src/codecs/plugins/cd_swipe.cc
index 4dda224fc8322d8485672b483b25dafe659a63ac..c1c6eb900ccce293c19a71ad4f8ad0a56df3c706 100644 (file)
--- a/src/codecs/plugins/cd_swipe.cc
+++ b/src/codecs/plugins/cd_swipe.cc
@@ -1,6 +1,3 @@
-
-/* $Id: decode.c,v 1.285 2013-06-29 03:03:00 rcombs Exp $ */
-
 /*
 ** Copyright (C) 2002-2013 Sourcefire, Inc.
 ** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
@@ -20,6 +17,7 @@
 ** along with this program; if not, write to the Free Software
 ** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 */
+// cd_swipe.cc author Josh Rosenbaum <jorosenba@cisco.com>
 
 
 
@@ -32,8 +30,6 @@
 
 namespace{
 
-const uint32_t ICMP_HEADER_LEN = 4;
-const uint32_t ICMP_NORMAL_LEN = 8;
 const uint16_t SWIPE_PROT_ID = 53;
 
 class SwipeCodec : public Codec{
@@ -59,14 +55,8 @@ void SwipeCodec::get_protocol_ids(std::vector<uint16_t> &proto_ids)
 bool SwipeCodec::decode(const uint8_t* raw_packet, const uint32_t raw_len, 
         Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
 {
-
+    // currently unsupported
     codec_events::decoder_event(p, DECODE_IP_BAD_PROTO);
-//            dc.other++;
-    p->data = raw_packet;
-    p->dsize = (uint16_t)raw_len;
-
-    lyr_len = 0;
-    next_prot_id = -1;
     return true;
 }
 

diff --git a/src/ips_options/ips_icmp_id.cc b/src/ips_options/ips_icmp_id.cc
index 49c03b37cbdc00987a386cbcce4f965d0608aae3..63ff5fd68b9fcf891438efeef2c6a94d41cc632f 100644 (file)
--- a/src/ips_options/ips_icmp_id.cc
+++ b/src/ips_options/ips_icmp_id.cc
@@ -146,7 +146,7 @@ int IcmpIdOption::eval(Packet *p)
     PREPROC_PROFILE_START(icmpIdPerfStats);
 
     if( (p->icmph->type == ICMP_ECHO || p->icmph->type == ICMP_ECHOREPLY)
-        || (p->icmph->type == ICMP6_ECHO || p->icmph->type == ICMP6_REPLY)
+        || (p->icmph->type == (uint16_t)ICMP6_ECHO || p->icmph->type == (uint16_t)ICMP6_REPLY)
       )
     {
         /* test the rule ID value against the ICMP extension ID field */

diff --git a/src/ips_options/ips_icmp_seq.cc b/src/ips_options/ips_icmp_seq.cc
index 0da9653111f25c0286288e23648b0b2fbcb0195b..445f7ed27ae391e13f9ce0256d37b61a39ae2718 100644 (file)
--- a/src/ips_options/ips_icmp_seq.cc
+++ b/src/ips_options/ips_icmp_seq.cc
@@ -145,7 +145,7 @@ int IcmpSeqOption::eval(Packet *p)
     PREPROC_PROFILE_START(icmpSeqPerfStats);
 
     if( (p->icmph->type == ICMP_ECHO || p->icmph->type == ICMP_ECHOREPLY)
-        || (p->icmph->type == ICMP6_ECHO || p->icmph->type == ICMP6_REPLY)
+        || (p->icmph->type == (uint16_t)ICMP6_ECHO || p->icmph->type == (uint16_t)ICMP6_REPLY)
       )
     {
         /* test the rule ID value against the ICMP extension ID field */

diff --git a/src/managers/packet_manager.cc b/src/managers/packet_manager.cc
index 39d40f542f9624c923f74009b0d3d96e6be3e3d4..389893f415ccc8c84a5790a1b676ab33faa1f298 100644 (file)
--- a/src/managers/packet_manager.cc
+++ b/src/managers/packet_manager.cc
@@ -78,10 +78,8 @@ static THREAD_LOCAL CdGenPegs pkt_cnt;
 // helper functions
 //-------------------------------------------------------------------------
 
-// note that we now have multiple preproc configs saved by parser
-// (s5-global, s5-tcp, ..., etc.) but just one ppapi.  that means
-// we must call the config func multiple times but add only the 1st
-// instance to the policy list.
+#if 0
+// not need until instatiate && codec modules implemented
 static inline const CodecApi* GetApi(const char* keyword)
 {
     for ( auto* p : s_codecs )
@@ -89,6 +87,7 @@ static inline const CodecApi* GetApi(const char* keyword)
             return p;
     return NULL;
 }
+#endif
 
 
 //-------------------------------------------------------------------------
@@ -345,9 +344,9 @@ void PacketManager::decode(
     if (prev_prot_id != FINISHED_DECODE)
     {
         if(s_proto_map[prev_prot_id])
-            pkt_cnt.other_codecs++;
-        else
             pkt_cnt.discards++;
+        else
+            pkt_cnt.other_codecs++;
     }
 
     s_stats[mapped_prot + stat_offset]++;

diff --git a/src/network_inspectors/normalize/norm.cc b/src/network_inspectors/normalize/norm.cc
index bca8eb72c28f7d6b56bdf21f6ca502adf97c89ad..80cc26a73149cf821b93d28f4551c6cc830cd548 100644 (file)
--- a/src/network_inspectors/normalize/norm.cc
+++ b/src/network_inspectors/normalize/norm.cc
@@ -283,7 +283,7 @@ static int Norm_ICMP6 (
 {
     ICMPHdr* h = (ICMPHdr*)(p->layers[layer].start);
 
-    if ( (h->type == ICMP6_ECHO || h->type == ICMP6_REPLY) &&
+    if ( (h->type == (uint16_t)ICMP6_ECHO || h->type == (uint16_t)ICMP6_REPLY) &&
          (h->code != 0) )
     {
         h->code = static_cast<icmp4::IcmpCode>(0);

diff --git a/src/protocols/icmp4.h b/src/protocols/icmp4.h
index 74b92b1b95b1ec9f3dde173bab92985ef3477aaf..aa33b6010198235abdf60580e1849b4ab9fdcb88 100644 (file)
--- a/src/protocols/icmp4.h
+++ b/src/protocols/icmp4.h
@@ -28,14 +28,12 @@
 namespace icmp4
 {
 
-    // class to hold any data which should be hidden
-    namespace detail
-    {
-
-
+namespace detail
+{
 
+const uint32_t ICMP_HEADER_LEN = 4;
 
-    }
+} // namespace
 
 
 // do NOT add 'ICMP_' to the begining of these const because they 
@@ -217,7 +215,10 @@ inline bool is_echo(uint32_t type)
     return (type == (uint32_t) IcmpType::ECHO);
 }
 
-
+inline uint32_t hdr_len()
+{
+  return detail::ICMP_HEADER_LEN;
+}
 
 /*
  * CHECKSUM