Making Snort++ PktType basedy()

diff --git a/src/detection/fpdetect.cc b/src/detection/fpdetect.cc
index c3b66bbb5d19a8bf7c2eba01b658a05ab6c6c13d..d527469273a3b426aabf264bd5a5754f4ec2a56a 100644 (file)
--- a/src/detection/fpdetect.cc
+++ b/src/detection/fpdetect.cc
@@ -1476,7 +1476,6 @@ static inline int fpEvalHeaderIp(Packet *p, int ip_proto, OTNX_MATCH_DATA *omd)
 */
 int fpEvalPacket(Packet *p)
 {
-    int ip_proto = p->ptrs.ip_api.proto();
     OTNX_MATCH_DATA *omd = &t_omd;
 
     /* Run UDP rules against the UDP header of Teredo packets */
@@ -1516,53 +1515,27 @@ int fpEvalPacket(Packet *p)
         do_detect_content = tmp_do_detect_content;
     }
 
-    switch(ip_proto)
+    switch(p->type())
     {
-        case IPPROTO_TCP:
-            DEBUG_WRAP(DebugMessage(DEBUG_DETECT,
-                        "Detecting on TcpList\n"););
-
-            if(p->ptrs.tcph == NULL)
-            {
-                ip_proto = -1;
-                break;
-            }
-
+        case PktType::TCP:
             return fpEvalHeaderTcp(p, omd);
 
-        case IPPROTO_UDP:
-            DEBUG_WRAP(DebugMessage(DEBUG_DETECT,
-                        "Detecting on UdpList\n"););
-
-            if(p->ptrs.udph == NULL)
-            {
-                ip_proto = -1;
-                break;
-            }
-
+        case PktType::UDP:
             return fpEvalHeaderUdp(p, omd);
 
-        case IPPROTO_ICMPV6:
-        case IPPROTO_ICMP:
+        case PktType::ICMP:
             DEBUG_WRAP(DebugMessage(DEBUG_DETECT,
                         "Detecting on IcmpList\n"););
-
-            if(p->ptrs.icmph == NULL)
-            {
-                ip_proto = -1;
-                break;
-            }
-
             return fpEvalHeaderIcmp(p, omd);
 
+        /*
+        **  No Match on TCP/UDP, Do IP
+        */
         default:
+            return fpEvalHeaderIp(p, -1, omd);
             break;
     }
 
-    /*
-    **  No Match on TCP/UDP, Do IP
-    */
-    return fpEvalHeaderIp(p, ip_proto, omd);
 }
 
 void fpEvalIpProtoOnlyRules(Packet *p, uint8_t proto_id)

diff --git a/src/ips_options/ips_ip_proto.cc b/src/ips_options/ips_ip_proto.cc
index c4155461cd7393cfa6f6726ed9d18357e7663168..0258045e824f093f923141eb664f8d216a56c5cc 100644 (file)
--- a/src/ips_options/ips_ip_proto.cc
+++ b/src/ips_options/ips_ip_proto.cc
@@ -132,7 +132,7 @@ int IpProtoOption::eval(Cursor&, Packet *p)
 
     MODULE_PROFILE_START(ipProtoPerfStats);
 
-    const uint8_t ip_proto = p->ip_next_proto();
+    const uint8_t ip_proto = p->ip_proto_next();
 
     switch (ipd->comparison_flag)
     {

diff --git a/src/log/log_text.cc b/src/log/log_text.cc
index a8072320427c0c7a531c84a1315776911831a8e7..fc9e092db40ea704b7169e772d7dc80339fef60a 100644 (file)
--- a/src/log/log_text.cc
+++ b/src/log/log_text.cc
@@ -1002,7 +1002,7 @@ static void LogICMPEmbeddedIP(TextLog* log, Packet *p)
         {
             case PROTO_BIT__TCP_EMBED_ICMP:
             {
-                const tcp::TCPHdr* tcph = layer::get_tcp_embed_icmp(op.ptrs.ip_api);
+                const tcp::TCPHdr* const tcph = layer::get_tcp_embed_icmp(op.ptrs.ip_api);
                 if (tcph)
                 {
                     orig_p->ptrs.sp = tcph->src_port();
@@ -1020,7 +1020,7 @@ static void LogICMPEmbeddedIP(TextLog* log, Packet *p)
 
             case PROTO_BIT__UDP_EMBED_ICMP:
             {
-                const udp::UDPHdr* udph = layer::get_udp_embed_icmp(op.ptrs.ip_api);
+                const udp::UDPHdr* const udph = layer::get_udp_embed_icmp(op.ptrs.ip_api);
                 if (udph)
                 {
                     orig_p->ptrs.sp = udph->src_port();
@@ -1031,8 +1031,9 @@ static void LogICMPEmbeddedIP(TextLog* log, Packet *p)
                     LogIPHeader(log, orig_p);
 
                     TextLog_Print(log, "Len: %d  Csum: %d\n",
-                            ntohs(orig_p->ptrs.udph->uh_len) - udp::UDP_HEADER_LEN,
-                            ntohs(orig_p->ptrs.udph->uh_chk));
+                            udph->len() - udp::UDP_HEADER_LEN,
+                            udph->cksum());
+                }
                 break;
             }
 

diff --git a/src/loggers/alert_fast.cc b/src/loggers/alert_fast.cc
index d2fc4577e8c539c9d4a879132c67ff5e333395d1..3780d1f0e207a747d9747142c8d5f088f4b0fe9d 100644 (file)
--- a/src/loggers/alert_fast.cc
+++ b/src/loggers/alert_fast.cc
@@ -238,10 +238,10 @@ void FastLogger::alert(Packet *p, const char *msg, Event *event)
     }
 
     /* print the packet header to the alert file */
-    if (p->ptrs.ip_api.is_valid())
+    if (p->has_ip())
     {
         LogPriorityData(fast_log, event, 0);
-        TextLog_Print(fast_log, "{%s} ", protocol_names[p->ptrs.ip_api.proto()]);
+        TextLog_Print(fast_log, "{%s} ", protocol_names[p->ip_proto_next()]);
         LogIpAddrs(fast_log, p);
     }
 

diff --git a/src/loggers/alert_sf_socket.cc b/src/loggers/alert_sf_socket.cc
index 06bb0e83748bf9d6609b897b937fdebcdb3f2265..443d37a7b49ab9b9cb3312a7f200f3097abfe24f 100644 (file)
--- a/src/loggers/alert_sf_socket.cc
+++ b/src/loggers/alert_sf_socket.cc
@@ -316,7 +316,7 @@ void load_sar(Packet *packet, Event *event, SnortActionRequest& sar)
     //   and only 1st 8 used for ip4
     sar.src_ip =  ntohl(packet->ptrs.ip_api.get_src()->ip32[0]);
     sar.dest_ip = ntohl(packet->ptrs.ip_api.get_dst()->ip32[0]);
-    sar.protocol = packet->ptrs.ip_api.proto();
+    sar.protocol = packet->ip_proto_next();
 
     if(packet->is_tcp() || packet->is_udp())
     {

diff --git a/src/loggers/alert_syslog.cc b/src/loggers/alert_syslog.cc
index c318f8fbc9d22d458397d1e8d5e19410b2479024..a14d823fa5adefd7bb8240ba1f4bb9301a2da8cb 100644 (file)
--- a/src/loggers/alert_syslog.cc
+++ b/src/loggers/alert_syslog.cc
@@ -241,7 +241,7 @@ static void AlertSyslog(
                     "<%s> ", PRINT_INTERFACE(DAQ_GetInterfaceSpec()));
         }
 
-        uint16_t proto = p->ptrs.ip_api.proto();
+        uint16_t proto = p->ip_proto_next();
         if (protocol_names[proto] != NULL)
         {
             SnortSnprintfAppend(event_string, sizeof(event_string),

diff --git a/src/loggers/unified2.cc b/src/loggers/unified2.cc
index d5bed6efa733faac48e255f3ddd3df8bf47e983e..951631aaae61662af3de0210d59192d4a219d3ad 100644 (file)
--- a/src/loggers/unified2.cc
+++ b/src/loggers/unified2.cc
@@ -271,7 +271,7 @@ static void _AlertIP4_v2(Packet *p, const char*, Unified2Config *config, Event *
             }
             else
             {
-                alertdata.protocol = p->ptrs.ip_api.proto();;
+                alertdata.protocol = p->ip_proto_next();
 
                 if ( p->type() == PktType::ICMP)
                 {
@@ -382,7 +382,7 @@ static void _AlertIP6_v2(Packet *p, const char*, Unified2Config *config, Event *
             }
             else
             {
-                alertdata.protocol = p->ptrs.ip_api.proto();;
+                alertdata.protocol = p->ip_proto_next();
 
                 if ( p->type() == PktType::ICMP)
                 {

diff --git a/src/main/snort.cc b/src/main/snort.cc
index bcf37ed219a010865c26f3dca25d6c32d28bff6e..1ed206ea25f8a1dfdbebf17ba6daca7ec44a2ad9 100644 (file)
--- a/src/main/snort.cc
+++ b/src/main/snort.cc
@@ -328,7 +328,7 @@ static void SnortInit(int argc, char **argv)
         OrderRuleLists(snort_conf, "drop sdrop reject alert pass log");
     }
 
-    // Must be after CodecManagers
+    // Must be after CodecManager::instantiate()
     if ( !InspectorManager::configure(snort_conf) )
         FatalError("can't initialize inspectors\n");
 

diff --git a/src/protocols/packet.h b/src/protocols/packet.h
index 35fe28c5a7bf3dfe39444a0a5cdb3ea8f1a22154..0090ab335e45b1d762c4dad2ab1aa732c43b7dbb 100644 (file)
--- a/src/protocols/packet.h
+++ b/src/protocols/packet.h
@@ -227,7 +227,7 @@ struct SO_PUBLIC Packet
      *          eth::ip6::hop_opts::ipv6_routing::UDP
      * this function return 17 == IPPROTO_UDP == IPPROTO_ID_UDP
      */
-    uint8_t ip_next_proto() const;
+    uint8_t ip_proto_next() const;
 
     inline void reset()
     {

diff --git a/src/stream/ip/ip_defrag.cc b/src/stream/ip/ip_defrag.cc
index 77d11f308368b1f8bdab1d7b9c1eae5967321b5c..f656ef39a1f7b5868294070766fe5f8d2cc4e084 100644 (file)
--- a/src/stream/ip/ip_defrag.cc
+++ b/src/stream/ip/ip_defrag.cc
@@ -1366,7 +1366,7 @@ void Defrag::process(Packet* p, FragTracker* ft)
      *    a rebuilt packet later.  So don't process it further.
      */
     if ((frag_offset != 0) ||
-        ((p->ptrs.ip_api.proto() != IPPROTO_UDP) && (p->ptrs.decode_flags & DECODE_MF)))
+        ((p->ip_proto_next() != IPPROTO_UDP) && (p->ptrs.decode_flags & DECODE_MF)))
     {
         DisableDetect(p);
     }
@@ -1503,7 +1503,7 @@ void Defrag::process(Packet* p, FragTracker* ft)
             FragRebuild(ft, p);
 
             if (frag_offset != 0 ||
-                (p->ptrs.ip_api.proto() != IPPROTO_UDP && ft->frag_flags & FRAG_REBUILT))
+                (p->ip_proto_next() != IPPROTO_UDP && ft->frag_flags & FRAG_REBUILT))
             {
                 /* Need to reset some things here because the
                  * rebuilt packet will have reset the do_detect
@@ -2322,7 +2322,7 @@ int Defrag::new_tracker(Packet *p, FragTracker* ft)
     
     if (p->ptrs.ip_api.is_ip4())
     {
-        ft->protocol = p->ptrs.ip_api.proto();
+        ft->protocol = p->ptrs.ip_api.get_ip4h()->get_proto();
 
         const ip::IP4Hdr *ip4h = reinterpret_cast<const ip::IP4Hdr*>(lyr.start);
         frag_off = ntohs(ip4h->get_off());