+119
+-- updated binder
+-- fixed packet direction
+
118
-- fixed bind action
-- tweaked main loop
git checkout master
git merge brname
+* check the commit history for a <file>:
+
+ git log <file>
+
+* diff specific committed versions of a <file> (using the unambiguous
+ commit prefixes):
+
+git diff f072c3... ff38ce... lua/snort.lua
+
=== Building
* you need luajit from luajit.org; build from source.
{
if (proto == IPPROTO_TCP)
{
- if (p->tcph->th_sport == client_port)
+ if (p->sp == client_port)
{
p->packet_flags |= PKT_FROM_CLIENT;
}
}
else if (proto == IPPROTO_UDP && p->udph )
{
- if (p->udph->uh_sport == client_port)
+ if (p->sp == client_port)
{
p->packet_flags |= PKT_FROM_CLIENT;
}
{
if (proto == IPPROTO_TCP)
{
- if (p->tcph->th_dport == client_port)
+ if (p->dp == client_port)
{
p->packet_flags |= PKT_FROM_SERVER;
}
}
else if (proto == IPPROTO_UDP && p->udph )
{
- if (p->udph->uh_dport == client_port)
+ if (p->dp == client_port)
{
p->packet_flags |= PKT_FROM_SERVER;
}
else
{
p->packet_flags |= PKT_FROM_SERVER;
- }
- }
+ } }
}
else /* IS_IP6(p) */
{
{
if (proto == IPPROTO_TCP)
{
- if (p->tcph->th_sport == client_port)
+ if (p->sp == client_port)
{
p->packet_flags |= PKT_FROM_CLIENT;
}
}
else if (proto == IPPROTO_UDP && p->udph )
{
- if (p->udph->uh_sport == client_port)
+ if (p->sp == client_port)
{
p->packet_flags |= PKT_FROM_CLIENT;
}
{
if (proto == IPPROTO_TCP)
{
- if (p->tcph->th_dport == client_port)
+ if (p->dp == client_port)
{
p->packet_flags |= PKT_FROM_SERVER;
}
}
else if (proto == IPPROTO_UDP && p->udph )
{
- if (p->udph->uh_dport == client_port)
+ if (p->dp == client_port)
{
p->packet_flags |= PKT_FROM_SERVER;
}
/****************************************************************************
*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+ * Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
* Copyright (C) 2013-2013 Sourcefire, Inc.
*
* This program is free software; you can redistribute it and/or modify
Inspector* gadget;
const char* service;
+ unsigned policy_id;
+
int flow_state; // FIXIT-H wow - this is poorly encapsulated! did i do that? :(
FlowState s5_state; // FIXIT-L rename this (s5 not appropriate)
+ // FIXIT-L can client and server ip and port be removed from flow?
sfip_t client_ip; // FIXIT-L family and bits should be changed to uint16_t
sfip_t server_ip; // or uint8_t to reduce sizeof from 24 to 20
#endif
#include <assert.h>
+#include <arpa/inet.h>
#include "flow/flow_cache.h"
#include "flow/expect_cache.h"
cache->reset_prunes();
}
+//-------------------------------------------------------------------------
+// packet foo
+//-------------------------------------------------------------------------
+
void FlowControl::set_key(FlowKey* key, Packet* p)
{
ip::IpApi* ip_api = &p->ip_api;
}
}
-static bool is_bidirectional(Flow* flow)
+static bool is_bidirectional(const Flow* flow)
{
constexpr unsigned bidir = SSNFLAG_SEEN_CLIENT | SSNFLAG_SEEN_SERVER;
return (flow->s5_state.session_flags & bidir) == bidir;
}
+// FIXIT-L init_roles* should take const Packet*
+static void init_roles_tcp(Packet* p, Flow* flow)
+{
+ if (TCP_ISFLAGSET(p->tcph, TH_SYN) &&
+ !TCP_ISFLAGSET(p->tcph, TH_ACK))
+ {
+ flow->s5_state.direction = FROM_CLIENT;
+ sfip_copy(flow->client_ip, p->ip_api.get_src());
+ flow->client_port = ntohs(p->tcph->th_sport);
+ sfip_copy(flow->server_ip, p->ip_api.get_dst());
+ flow->server_port = ntohs(p->tcph->th_dport);
+ }
+ else if (TCP_ISFLAGSET(p->tcph, (TH_SYN|TH_ACK)))
+ {
+ flow->s5_state.direction = FROM_SERVER;
+ sfip_copy(flow->client_ip, p->ip_api.get_dst());
+ flow->client_port = ntohs(p->tcph->th_dport);
+ sfip_copy(flow->server_ip, p->ip_api.get_src());
+ flow->server_port = ntohs(p->tcph->th_sport);
+ }
+ else if (p->sp > p->dp)
+ {
+ flow->s5_state.direction = FROM_CLIENT;
+ sfip_copy(flow->client_ip, p->ip_api.get_src());
+ flow->client_port = ntohs(p->tcph->th_sport);
+ sfip_copy(flow->server_ip, p->ip_api.get_dst());
+ flow->server_port = ntohs(p->tcph->th_dport);
+ }
+ else
+ {
+ flow->s5_state.direction = FROM_SERVER;
+ sfip_copy(flow->client_ip, p->ip_api.get_dst());
+ flow->client_port = ntohs(p->tcph->th_dport);
+ sfip_copy(flow->server_ip, p->ip_api.get_src());
+ flow->server_port = ntohs(p->tcph->th_sport);
+ }
+}
+
+static void init_roles_udp(Packet* p, Flow* flow)
+{
+ flow->s5_state.direction = FROM_SENDER;
+ sfip_copy(flow->client_ip, p->ip_api.get_src());
+ flow->client_port = ntohs(p->udph->uh_sport);
+ sfip_copy(flow->server_ip, p->ip_api.get_dst());
+ flow->server_port = ntohs(p->udph->uh_dport);
+}
+
+static void init_roles(Packet* p, Flow* flow)
+{
+ if ( flow->protocol == IPPROTO_TCP )
+ init_roles_tcp(p, flow);
+
+ else if ( flow->protocol == IPPROTO_UDP )
+ init_roles_udp(p, flow);
+}
+
unsigned FlowControl::process(FlowCache* cache, Packet* p)
{
unsigned news = 0;
p->flow = flow;
if ( !flow->flow_state )
+ {
+ init_roles(p, flow);
binder->eval(p);
+ ++news;
+ }
switch ( flow->flow_state )
{
*/
// module.h author Russ Combs <rucombs@cisco.com>
-// FIXIT-H add brief help string to modules
// FIXIT-H add optional default config to modules
// FIXIT-M add trace param(s)
// FIXIT-M add memcap related
AUTOMAKE_OPTIONS=foreign no-dependencies
file_list = \
-binder.cc binder.h \
-bind_module.cc bind_module.h
+binder.cc \
+binding.h \
+bind_module.cc \
+bind_module.h
#if STATIC_INSPECTORS
noinst_LIBRARIES = libbinder.a
#include <string>
using namespace std;
-#include "binder.h"
+#include "binding.h"
#include "protocols/packet.h"
+#include "parser/parse_ip.h"
THREAD_LOCAL BindStats bstats;
static const Parameter binder_when_params[] =
{
- { "policy_id", Parameter::PT_STRING, nullptr, nullptr,
+ // FIXIT when.policy_id should be an arbitrary string auto converted
+ // into index for binder matching and lookups
+ { "policy_id", Parameter::PT_INT, "0:", nullptr,
"unique ID for selection of this config by external logic" },
{ "vlans", Parameter::PT_BIT_LIST, "4095", nullptr,
{ "file", Parameter::PT_STRING, nullptr, nullptr,
"use configuration in given file" },
- { "policy_id", Parameter::PT_STRING, nullptr, nullptr,
- "use configuration in given policy" },
-
{ "service", Parameter::PT_STRING, nullptr, nullptr,
"override automatic service identification" },
bool BinderModule::set(const char* fqn, Value& v, SnortConfig*)
{
// both
- if ( !strcmp(fqn, "binder.when.policy_id") )
- work->when_id = v.get_string();
-
- else if ( !strcmp(fqn, "binder.use.policy_id") )
- work->use_id = v.get_string();
-
- else if ( !strcmp(fqn, "binder.when.service") )
- work->when_svc = v.get_string();
+ if ( !strcmp(fqn, "binder.when.service") )
+ work->when.svc = v.get_string();
else if ( !strcmp(fqn, "binder.use.service") )
- work->use_svc = v.get_string();
+ work->use.svc = v.get_string();
// when
+ else if ( v.is("policy_id") )
+ work->when.id = v.get_long();
+
else if ( v.is("nets") )
- work->nets = v.get_string();
+ work->when.nets = sfip_var_from_string(v.get_string());
else if ( v.is("proto") )
{
{
PROTO_BIT__ALL, PROTO_BIT__IP, PROTO_BIT__ICMP, PROTO_BIT__TCP, PROTO_BIT__UDP
};
- work->protos = mask[v.get_long()];
+ work->when.protos = mask[v.get_long()];
}
else if ( v.is("ports") )
- v.get_bits(work->ports);
+ v.get_bits(work->when.ports);
else if ( v.is("role") )
- work->role = (BindRole)v.get_long();
+ work->when.role = (BindRole)v.get_long();
else if ( v.is("vlans") )
- v.get_bits(work->vlans);
+ v.get_bits(work->when.vlans);
// use
else if ( v.is("action") )
- work->action = (BindAction)(v.get_long() + 1);
+ work->use.action = (BindAction)(v.get_long() + 1);
else if ( v.is("file") )
- work->file = v.get_string();
+ work->use.file = v.get_string();
else if ( v.is("name") )
- work->name = v.get_string();
+ work->use.name = v.get_string();
else if ( v.is("type") )
- work->type = v.get_string();
+ work->use.type = v.get_string();
else
return false;
*/
// binder.cc author Russ Combs <rucombs@cisco.com>
-#include "binder.h"
-
#include <vector>
using namespace std;
+#include "binding.h"
#include "bind_module.h"
#include "flow/flow.h"
#include "framework/inspector.h"
THREAD_LOCAL ProfileStats bindPerfStats;
//-------------------------------------------------------------------------
-// helpers
+// binding
//-------------------------------------------------------------------------
Binding::Binding()
{
- role = BR_EITHER;
- protos = PROTO_BIT__ALL;
- action = BA_INSPECT;
- ports.set();
+ when.nets = nullptr;
+ when.protos = PROTO_BIT__ALL;
+
+ when.vlans.set();
+ when.ports.set();
+
+ when.role = BR_EITHER;
+ use.action = BA_INSPECT;
+}
+
+Binding::~Binding()
+{
+ if ( when.nets )
+ sfvar_free(when.nets);
+}
+
+bool Binding::check_policy(const Flow* flow) const
+{
+ if ( !when.id )
+ return true;
+
+ if ( when.id == flow->policy_id )
+ return true;
+
+ return false;
+}
+
+bool Binding::check_addr(const Flow* flow) const
+{
+ if ( !when.nets )
+ return true;
+
+ if ( sfvar_ip_in(when.nets, &flow->client_ip) )
+ return true;
+
+ if ( sfvar_ip_in(when.nets, &flow->server_ip) )
+ return true;
+
+ return false;
}
+bool Binding::check_proto(const Flow* flow) const
+{
+ unsigned mask = when.protos;
+ unsigned bit = 0;
+
+ switch ( flow->protocol )
+ {
+ case IPPROTO_IP: bit = PROTO_BIT__IP; break;
+ case IPPROTO_ICMP: bit = PROTO_BIT__ICMP; break;
+ case IPPROTO_TCP: bit = PROTO_BIT__TCP; break;
+ case IPPROTO_UDP: bit = PROTO_BIT__UDP; break;
+ }
+ return ( mask & bit ) != 0;
+}
+
+bool Binding::check_vlan(const Flow* flow) const
+{
+ unsigned v = flow->key->vlan_tag;
+ return when.vlans.test(v);
+}
+
+bool Binding::check_port(const Flow* flow) const
+{
+ return when.ports.test(flow->server_port);
+}
+
+bool Binding::check_service(const Flow* flow) const
+{
+ if ( !flow->service )
+ return when.svc.empty();
+
+ if ( when.svc == flow->service )
+ return true;
+
+ return false;
+}
+
+//-------------------------------------------------------------------------
+// helpers
+//-------------------------------------------------------------------------
+
// FIXIT-H bind this is a temporary hack. note that both ends must be set
// independently and that we must ref count inspectors.
static void set_session(Flow* flow, const char* key)
flow->clouseau = nullptr;
}
-static bool check_proto(const Flow* flow, unsigned mask)
-{
- unsigned bit = 0;
-
- switch ( flow->protocol )
- {
- case IPPROTO_IP: bit = PROTO_BIT__IP; break;
- case IPPROTO_ICMP: bit = PROTO_BIT__ICMP; break;
- case IPPROTO_TCP: bit = PROTO_BIT__TCP; break;
- case IPPROTO_UDP: bit = PROTO_BIT__UDP; break;
- }
- return ( mask & bit ) != 0;
-}
-
//-------------------------------------------------------------------------
// class stuff
//-------------------------------------------------------------------------
-class Binder : public Inspector {
+class Binder : public Inspector
+{
public:
Binder(vector<Binding*>);
~Binder();
void eval(Packet*);
int exec(int, void*);
- Inspector* find_inspector(const char*);
-
void add(Binding* b)
{ bindings.push_back(b); };
private:
- Binding* get_binding(Flow*, Packet*);
- BindAction apply(Flow*, Binding*);
void init_flow(Flow*);
+ Binding* get_binding(const Flow*);
+ BindAction apply(Flow*, Binding*);
+ Inspector* find_inspector(const Flow*);
private:
vector<Binding*> bindings;
{
Flow* flow = p->flow;
- Binding* pb = get_binding(flow, p);
+ Binding* pb = get_binding(flow);
flow->flow_state = apply(flow, pb);
++bstats.verdicts[flow->flow_state - 1];
}
// FIXIT-H implement inspector lookup from policy / bindings
-Inspector* Binder::find_inspector(const char* s)
+Inspector* Binder::find_inspector(const Flow* flow)
{
- Binding* pb;
- unsigned i, sz = bindings.size();
+ Binding* pb = get_binding(flow);
- for ( i = 0; i < sz; i++ )
- {
- pb = bindings[i];
-
- if ( pb->when_svc == s )
- break;
- }
-
- if ( i == sz )
+ if ( !pb )
return nullptr;
- Inspector* ins = InspectorManager::get_inspector(pb->type.c_str());
+ Inspector* ins = InspectorManager::get_inspector(pb->use.type.c_str());
return ins;
}
int Binder::exec(int, void* pv)
{
Flow* flow = (Flow*)pv;
- Inspector* ins = find_inspector(flow->service);
+ Inspector* ins = find_inspector(flow);
if ( ins )
flow->set_gadget(ins);
return 0;
}
-// FIXIT-H bind services - this is a temporary hack that just looks at ports,
-// need to examine all key fields for matching. ultimately need a routing
-// table, scapegoat tree, etc.
-Binding* Binder::get_binding(Flow* flow, Packet* p)
+// FIXIT-L this is a simple linear search until functionality is nailed
+// down. performance could be improved by breaking bindings up into
+// multiple lists by proto and service or by using a more sophisticated
+// approach like routing tables, avl or scapegoat tree, etc.
+Binding* Binder::get_binding(const Flow* flow)
{
Binding* pb;
unsigned i, sz = bindings.size();
- // FIXIT-H called before stream runs - these flags aren't set
- // (below is structured to work by accident on initial syn until fixed)
- Port port = (p->packet_flags & PKT_FROM_SERVER) ? p->sp : p->dp;
-
for ( i = 0; i < sz; i++ )
{
pb = bindings[i];
- if ( !check_proto(flow, pb->protos) )
+ // FIXIT-H file must be implemented and should not be in runtime
+ // list of bindings
+ if ( pb->use.file.size() )
+ continue;
+
+ if ( !pb->check_policy(flow) )
+ continue;
+
+ if ( !pb->check_vlan(flow) )
continue;
- if ( pb->ports.test(port) )
- break;
+ // FIXIT-H need to check role and addr/ports relative to it
+ if ( !pb->check_addr(flow) )
+ continue;
+
+ if ( !pb->check_proto(flow) )
+ continue;
+
+ if ( !pb->check_port(flow) )
+ continue;
+
+ if ( !pb->check_service(flow) )
+ continue;
+
+ return pb;
}
// absent a specific rule, we must choose a course of action
// so we act as if binder wasn't configured at all
- if ( i == sz )
- return nullptr;
-
- return pb;
+ return nullptr;
}
BindAction Binder::apply(Flow* flow, Binding* pb)
if ( !pb )
return BA_ALLOW;
- if ( pb->action != BA_INSPECT )
+ if ( pb->use.action != BA_INSPECT )
{
- if ( pb->action == BA_BLOCK )
+ if ( pb->use.action == BA_BLOCK )
stream.drop_traffic(flow, SSN_DIR_BOTH);
- return pb->action;
+ return pb->use.action;
}
init_flow(flow);
Inspector* ins;
- if ( !pb->type.size() || pb->type == "wizard" )
+ if ( !pb->use.type.size() || pb->use.type == "wizard" )
{
ins = InspectorManager::get_wizard();
flow->set_clouseau(ins);
}
else
{
- ins = InspectorManager::get_inspector(pb->type.c_str());
+ ins = InspectorManager::get_inspector(pb->use.type.c_str());
flow->set_gadget(ins);
}
return BA_INSPECT;
#include <string>
#include "framework/bits.h"
+#include "sfip/sf_ipvar.h"
+
+class Flow;
enum BindRole
{
BA_INSPECT
};
-struct Binding
+struct BindWhen
{
- // when
- std::string when_id;
- std::string when_svc;
+ unsigned id;
+ std::string svc;
VlanList vlans;
- std::string nets;
+ sfip_var_t* nets;
unsigned protos;
PortList ports;
BindRole role;
+};
- // use
+struct BindUse
+{
BindAction action;
- std::string use_id;
- std::string use_svc;
+ std::string svc;
std::string type;
std::string name;
std::string file;
+};
+
+struct Binding
+{
+ BindWhen when;
+ BindUse use;
Binding();
+ ~Binding();
+
+ bool check_port(const Flow*) const;
+ bool check_vlan(const Flow*) const;
+ bool check_addr(const Flow*) const;
+ bool check_proto(const Flow*) const;
+ bool check_policy(const Flow*) const;
+ bool check_service(const Flow*) const;
};
#endif
static inline bool s5_paf_eval (
StreamSplitter* ss, PAF_State* ps, Flow* ssn,
- uint16_t, uint32_t flags,
- const uint8_t* data, uint32_t len, FlushType* ft)
+ uint32_t flags, const uint8_t* data, uint32_t len, FlushType* ft)
{
DEBUG_WRAP(DebugMessage(DEBUG_STREAM_PAF,
"%s: paf=%d, idx=%u, len=%u, fpt=%u\n",
uint32_t s5_paf_check (
StreamSplitter* ss, PAF_State* ps, Flow* ssn,
const uint8_t* data, uint32_t len, uint32_t total,
- uint32_t seq, uint16_t port, uint32_t* flags)
+ uint32_t seq, uint32_t* flags)
{
DEBUG_WRAP(DebugMessage(DEBUG_STREAM_PAF,
"%s: len=%u, amt=%u, seq=%u, cur=%u, pos=%u, fpt=%u, tot=%u, paf=%d\n",
uint32_t idx = s5_idx;
uint32_t shift, fp;
- bool cont = s5_paf_eval(ss, ps, ssn, port, *flags, data, len, &ft);
+ bool cont = s5_paf_eval(ss, ps, ssn, *flags, data, len, &ft);
if ( ft != FT_NOP )
{
uint32_t s5_paf_check(
StreamSplitter* paf_config, PAF_State*, Flow* ssn,
const uint8_t* data, uint32_t len, uint32_t total,
- uint32_t seq, uint16_t port, uint32_t* flags);
+ uint32_t seq, uint32_t* flags);
#endif
#define STREAM5_DEBUG_WRAP(x)
#endif
-/* client/server ip/port dereference */
-#define tcp_client_ip flow->client_ip
-#define tcp_client_port flow->client_port
-#define tcp_server_ip flow->server_ip
-#define tcp_server_port flow->server_port
-
#define SL_BUF_FLUSHED 1
struct TcpDataBlock
char buf[64];
LogMessage("TcpSession:\n");
- sfip_ntop(&ts->tcp_server_ip, buf, sizeof(buf));
+ sfip_ntop(&ts->flow->server_ip, buf, sizeof(buf));
LogMessage(" server IP: %s\n", buf);
- sfip_ntop(&ts->tcp_client_ip, buf, sizeof(buf));
+ sfip_ntop(&ts->flow->client_ip, buf, sizeof(buf));
LogMessage(" client IP: %s\n", buf);
- LogMessage(" server port: %d\n", ts->tcp_server_port);
- LogMessage(" client port: %d\n", ts->tcp_client_port);
+ LogMessage(" server port: %d\n", ts->flow->server_port);
+ LogMessage(" client port: %d\n", ts->flow->client_port);
LogMessage(" flags: 0x%X\n", ts->flow->s5_state.session_flags);
{
fprintf(stdout, " LWS: ST=0x%x SF=0x%x CP=%u SP=%u\n",
(unsigned)lws->session_state, lws->s5_state.session_flags,
- (unsigned)ntohs(lws->client_port), (unsigned)ntohs(lws->server_port)
+ lws->client_port, lws->server_port
);
}
"session direction.\n"););
/* SYN packet from client */
lwssn->s5_state.direction = FROM_CLIENT;
- sfip_copy(lwssn->client_ip, p->ip_api.get_src());
- lwssn->client_port = p->tcph->th_sport;
- sfip_copy(lwssn->server_ip, p->ip_api.get_dst());
- lwssn->server_port = p->tcph->th_dport;
lwssn->session_state |= STREAM5_STATE_SYN;
if (require3Way || (Stream5PacketHasWscale(p) & TF_WSCALE) ||
"Stream5 SYN|ACK PACKET, establishing lightweight"
"session direction.\n"););
lwssn->s5_state.direction = FROM_SERVER;
- sfip_copy(lwssn->client_ip, p->ip_api.get_dst());
- lwssn->client_port = p->tcph->th_dport;
- sfip_copy(lwssn->server_ip, p->ip_api.get_src());
- lwssn->server_port = p->tcph->th_sport;
}
lwssn->session_state |= STREAM5_STATE_SYN_ACK;
/* create session on data, need to figure out direction, etc */
/* Assume from client, can update later */
if (p->sp > p->dp)
- {
lwssn->s5_state.direction = FROM_CLIENT;
- sfip_copy(lwssn->client_ip, p->ip_api.get_src());
- lwssn->client_port = p->tcph->th_sport;
- sfip_copy(lwssn->server_ip, p->ip_api.get_dst());
- lwssn->server_port = p->tcph->th_dport;
- }
else
- {
lwssn->s5_state.direction = FROM_SERVER;
- sfip_copy(lwssn->client_ip, p->ip_api.get_dst());
- lwssn->client_port = p->tcph->th_dport;
- sfip_copy(lwssn->server_ip, p->ip_api.get_src());
- lwssn->server_port = p->tcph->th_sport;
- }
+
lwssn->session_state |= STREAM5_STATE_MIDSTREAM;
lwssn->s5_state.session_flags |= SSNFLAG_MIDSTREAM;
!TCP_ISFLAGSET(p->tcph, TH_ACK))
{
lwssn->s5_state.direction = FROM_CLIENT;
- sfip_copy(lwssn->client_ip, p->ip_api.get_src());
- lwssn->client_port = p->tcph->th_sport;
- sfip_copy(lwssn->server_ip, p->ip_api.get_dst());
- lwssn->server_port = p->tcph->th_dport;
lwssn->session_state = STREAM5_STATE_SYN;
lwssn->set_ttl(p, true);
NewTcpSession(p, lwssn, tdb, config);
else if (TCP_ISFLAGSET(p->tcph, (TH_SYN|TH_ACK)))
{
lwssn->s5_state.direction = FROM_SERVER;
- sfip_copy(lwssn->client_ip, p->ip_api.get_dst());
- lwssn->client_port = p->tcph->th_dport;
- sfip_copy(lwssn->server_ip, p->ip_api.get_src());
- lwssn->server_port = p->tcph->th_sport;
lwssn->session_state = STREAM5_STATE_SYN_ACK;
lwssn->set_ttl(p, false);
NewTcpSession(p, lwssn, tdb, config);
TcpSession* ssn, StreamTracker* trk, Packet* pkt, uint32_t* flags)
{
bool to_srv = ( *flags == PKT_FROM_CLIENT );
- uint16_t srv_port = ( to_srv ? pkt->dp : pkt->sp );
uint32_t total = 0, avail;
StreamSegment* seg;
PROFILE_VARS;
flush_pt = s5_paf_check(
trk->splitter, &trk->paf_state, ssn->flow,
- seg->payload, size, total, seg->seq, srv_port, flags);
+ seg->payload, size, total, seg->seq, flags);
if ( flush_pt > 0 )
{
TcpSession* ssn, StreamTracker* trk, Packet* pkt, uint32_t* flags)
{
bool to_srv = ( *flags == PKT_FROM_CLIENT );
- uint16_t srv_port = ( to_srv ? pkt->sp : pkt->dp );
uint32_t total = 0;
StreamSegment* seg;
PROFILE_VARS;
flush_pt = s5_paf_check(
trk->splitter, &trk->paf_state, ssn->flow,
- seg->payload, size, total, seg->seq, srv_port, flags);
+ seg->payload, size, total, seg->seq, flags);
if ( flush_pt > 0 )
{
/* StreamTracker is the opposite of the ip of the reassembled
* packet --> it came out the queue for the other side */
- if (sfip_equals(p->ip_api.get_src(), &tcpssn->tcp_client_ip))
+ if (sfip_equals(p->ip_api.get_src(), &tcpssn->flow->client_ip))
{
st = &tcpssn->server;
}
/* StreamTracker is the opposite of the ip of the reassembled
* packet --> it came out the queue for the other side */
- if (sfip_equals(p->ip_api.get_src(), &tcpssn->tcp_client_ip))
+ if (sfip_equals(p->ip_api.get_src(), &tcpssn->flow->client_ip))
st = &tcpssn->server;
else
st = &tcpssn->client;
Stream5AlertInfo* ai;
TcpSession *tcpssn = (TcpSession*)lwssn->session;
- if (sfip_equals(p->ip_api.get_src(),&tcpssn->tcp_client_ip))
+ if (sfip_equals(p->ip_api.get_src(),&tcpssn->flow->client_ip))
{
st = &tcpssn->server;
}
return 0;
}
- if (sfip_equals(p->ip_api.get_src(), &tcpssn->tcp_client_ip))
+ if (sfip_equals(p->ip_api.get_src(), &tcpssn->flow->client_ip))
{
st = &tcpssn->server;
}
uint32_t seq_num;
TcpSession *tcpssn = (TcpSession*)lwssn->session;
- if (sfip_equals(p->ip_api.get_src(), &tcpssn->tcp_client_ip))
+ if (sfip_equals(p->ip_api.get_src(), &tcpssn->flow->client_ip))
{
st = &tcpssn->server;
}
StreamTracker *st;
TcpSession *tcpssn = (TcpSession*)lwssn->session;
- if (sfip_equals(p->ip_api.get_src(),&tcpssn->tcp_client_ip))
+ if (sfip_equals(p->ip_api.get_src(),&tcpssn->flow->client_ip))
st = &tcpssn->server;
else
st = &tcpssn->client;
StreamTracker *st;
TcpSession *tcpssn = (TcpSession*)lwssn->session;
- if (sfip_equals(p->ip_api.get_src(),&tcpssn->tcp_client_ip))
+ if (sfip_equals(p->ip_api.get_src(),&tcpssn->flow->client_ip))
st = &tcpssn->server;
else
st = &tcpssn->client;
uint16_t tmpPort;
StreamTracker tmpTracker;
- if (sfip_equals(&tcp_client_ip, ip) && (tcp_client_port == port))
+ if (sfip_equals(&flow->client_ip, ip) && (flow->client_port == port))
{
if ((dir == SSN_DIR_CLIENT) && (flow->s5_state.direction == SSN_DIR_CLIENT))
{
return;
}
}
- else if (sfip_equals(&tcp_server_ip, ip) && (tcp_server_port == port))
+ else if (sfip_equals(&flow->server_ip, ip) && (flow->server_port == port))
{
if ((dir == SSN_DIR_SERVER) && (flow->s5_state.direction == SSN_DIR_SERVER))
{
/* Swap them -- leave flow->s5_state.direction the same */
/* XXX: Gotta be a more efficient way to do this without the memcpy */
- tmpIp = tcp_client_ip;
- tmpPort = tcp_client_port;
- tcp_client_ip = tcp_server_ip;
- tcp_client_port = tcp_server_port;
- tcp_server_ip = tmpIp;
- tcp_server_port = tmpPort;
+ tmpIp = flow->client_ip;
+ tmpPort = flow->client_port;
+ flow->client_ip = flow->server_ip;
+ flow->client_port = flow->server_port;
+ flow->server_ip = tmpIp;
+ flow->server_port = tmpPort;
#ifdef HAVE_DAQ_ADDRESS_SPACE_ID
SwapPacketHeaderFoo(this);
#include "perf_monitor/perf.h"
#include "profiler.h"
-/* sender/responder ip/port dereference */
-#define udp_sender_ip flow->client_ip
-#define udp_sender_port flow->client_port
-#define udp_responder_ip flow->server_ip
-#define udp_responder_port flow->server_port
+// NOTE: sender is assumed to be client
+// responder is assumed to be server
THREAD_LOCAL SessionStats udpStats;
THREAD_LOCAL ProfileStats udp_perf_stats;
&flow->server_ip, SFS_STATE_UDP_CREATED);
flow->s5_state.direction = FROM_SENDER;
- sfip_copy(flow->client_ip, p->ip_api.get_src());
- flow->client_port = p->udph->uh_sport;
- sfip_copy(flow->server_ip, p->ip_api.get_dst());
- flow->server_port = p->udph->uh_dport;
if ( flow_con->expected_flow(flow, p) )
return false;
sfip_t tmpIp;
uint16_t tmpPort;
- if (sfip_equals(&udp_sender_ip, ip) && (udp_sender_port == port))
+ if (sfip_equals(&flow->client_ip, ip) && (flow->client_port == port))
{
if ((dir == SSN_DIR_SENDER) && (flow->s5_state.direction == SSN_DIR_SENDER))
{
return;
}
}
- else if (sfip_equals(&udp_responder_ip, ip) && (udp_responder_port == port))
+ else if (sfip_equals(&flow->server_ip, ip) && (flow->server_port == port))
{
if ((dir == SSN_DIR_RESPONDER) && (flow->s5_state.direction == SSN_DIR_RESPONDER))
{
}
/* Swap them -- leave flow->s5_state.direction the same */
- tmpIp = udp_sender_ip;
- tmpPort = udp_sender_port;
- udp_sender_ip = udp_responder_ip;
- udp_sender_port = udp_responder_port;
- udp_responder_ip = tmpIp;
- udp_responder_port = tmpPort;
+ tmpIp = flow->client_ip;
+ tmpPort = flow->client_port;
+ flow->client_ip = flow->server_ip;
+ flow->client_port = flow->server_port;
+ flow->server_ip = tmpIp;
+ flow->server_port = tmpPort;
}
int UdpSession::process(Packet *p)
projects / thirdparty / snort3.git / commitdiff
