'make check' command"
)
-find_library(CHECK_LIBRARY
- NAMES check
-)
-find_path (CHECK_INCLUDE_DIRS
+find_path (CHECK_INCLUDE_DIR
NAMES check.h
)
+find_library(CHECK_LIBRARIES
+ NAMES check
+)
include(FindPackageHandleStandardArgs)
find_package_handle_standard_args(CHECK
- REQUIRED_VARS CHECK_INCLUDE_DIRS CHECK_INCLUDE_DIRS
+ REQUIRED_VARS CHECK_INCLUDE_DIR CHECK_LIBRARIES
FAIL_MESSAGE "${ERROR_MESSAGE}"
)
mark_as_advanced(
- CHECK_INCLUDE_DIRS
- CHECK_LIBRARIES
+ CHECK_INCLUDE_DIR
+ CHECK_LIBRARIES
)
endif()
+if (BUILD_UNIT_TESTS)
+ enable_testing()
+endif()
+
# sanity checks to re-check and set all necesssary variables
if (NOT ASCIIDOC_FOUND)
#
-# This list of built sources MUST be kept up to date with
-# the actual build targets located at the bottom of src/CMakelists.txt
+# Assuming a file the source file is 'file_name.txt' the BUILT_SOURCES
+# files will be created with the following command
+#
+# snort --help-file_name > file_name.txt
#
set(BUILT_SOURCES
builtin.txt
config.txt
options.txt
gids.txt
+# version.txt Required special formatting. manually add below.
+ CACHE INTERNAL "sources to be built" FORCE
)
set (UNBUILT_SOURCES
differences.txt
style.txt
tips.txt
- images/snort.png
+ plugins.txt
+# images/snort.png # images directory is manually included as an a2x option
)
-
if (MAKE_HTML_DOC)
set(HTML_DOCS
snort_manual.html
set(PDF_DOCS snort_manual.pdf)
endif()
-
# Docuements to be built
set (EXTRA_DIST ${HTML_DOCS} ${PDF_DOCS})
-###############################################################################
-###############################################################################
-
-
-
-
-
###############################################################################
###############################################################################
###############################################################################
# #
-# Since we'd lke to keep the source tree unpolluted, only build targets #
-# in the build directory. The rest of this file creates custom commands to #
-# copy all of the documents into the doc/ directory. #
+# Since we'd lke to keep the source tree unpolluted, create all targets in #
+# the build directory. This section adds custom commands to copy all of the #
+# BUILT_SOURCES into this directory and create all of the UNBUILT_SOURCES in #
+# this directory. #
+# #
+# NOTE: BUILT_SOURCES recipes are actually defined in src/CMakeLists.txt to #
+# ensure a file dependency on Snort. This section copies those built sources #
+# into this directory. #
# #
###############################################################################
-
-# Due to the depency on the snort executable, the files are created in a
-# different directory and copied into the top level of the build directory
-# This next loop copies all of the appropriate files into the doc direcotry
-
+# copy built files into this directory
set (TARGET_DIR ${CMAKE_BINARY_DIR})
-foreach (file ${BUILT_SOURCES})
+foreach (file ${BUILT_SOURCES};version.txt)
set(input ${CMAKE_BINARY_DIR}/${file})
set (output ${CMAKE_CURRENT_BINARY_DIR}/${file})
+ # create this custom file name so it can be used below. Doesn't actually
+ # build the file itself.
add_custom_command(
OUTPUT ${input}
COMMAND ${CMAKE_COMMAND}
-E touch_nocreate ${input}
)
+ # complementary section to the foreach loop at the bottom of src/CMakeLists.txt
add_custom_command(
OUTPUT ${output}
COMMAND ${CMAKE_COMMAND}
endforeach(file)
-#copying the images directory!
-add_custom_target(copy_images DEPENDS images)
-add_custom_command(
- OUTPUT images
- COMMAND ${CMAKE_COMMAND}
- -E copy_directory ${CMAKE_CURRENT_SOURCE_DIR}/images ${CMAKE_CURRENT_BINARY_DIR}/images
- COMMENT "Copying doc/images. If the doc/images directory changes, rerun the cmake command!!"
-)
-set_source_files_properties(images SYMBOLIC "YES")
-
-
# Copy all distributed files into the binary tree (necessary for asciidocs).
# Then create a dependency between the new and old files.
foreach (file ${UNBUILT_SOURCES})
OUTPUT ${CMAKE_CURRENT_BINARY_DIR}/${file}
COMMAND ${CMAKE_COMMAND}
-E copy ${CMAKE_CURRENT_SOURCE_DIR}/${file} ${CMAKE_CURRENT_BINARY_DIR}/${file}
- MAIN_DEPENDENCY ${CMAKE_CURRENT_SOURCE_DIR}/${file}
- DEPENDS copy_images
+ MAIN_DEPENDENCY ${file}
COMMENT "Copying ${file} into binary directory"
)
list(APPEND UNBUILT_SOURCES_BINARY_PATH "${CMAKE_CURRENT_BINARY_DIR}/${file}")
-# set(UNBUILT_SOURCES_BINARY_PATH "${UNBUILT_SOURCES_BINARY_PATH} ${CMAKE_CURRENT_BINARY_DIR}/${file}")
endforeach(file)
foreach (file ${EXTRA_DIST})
###############################################################################
###############################################################################
-# This part contains all of the custom commmands for creating the actual
-# documentation.
+# create the recipes for building the files
-set (PDF_ARGUMENTS --icons --icons-dir=./images/icons -a imagesdir=./images)
+set (PDF_ARGUMENTS --icons --icons-dir=./images/icons --resource=${CMAKE_CURRENT_SOURCE_DIR}/images )
set (HTML_ARGUMENTS --copy --attribute linkcss --attribute stylesdir --attribute disable-javascript --attribute quirks! ${PDF_ARGUMENTS})
add_custom_command(OUTPUT snort_manual.html
COMMAND ${ASCIIDOC_A2X_EXE}
-f xhtml
${HTML_ARGUMENTS}
- --resource=${CMAKE_CURRENT_BINARY_DIR}
- --destination-dir=${CMAKE_CURRENT_BINARY_DIR}
+ --resource=${CMAKE_CURRENT_BINARY_DIR}
+ --destination-dir=${CMAKE_CURRENT_BINARY_DIR}
${CMAKE_CURRENT_BINARY_DIR}/snort_manual.txt
DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/snort_manual.txt ${ALL_SOURCES}
COMMENT "Documents: building snort_manual.html"
zcf snort_manual.tgz
${CMAKE_CURRENT_BINARY_DIR}/snort_manual.chunked
MAIN_DEPENDENCY ${CMAKE_CURRENT_SOURCE_DIR}/snort_manual.txt
- DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/images ${ALL_SOURCES}
+ DEPENDS ${ALL_SOURCES}
COMMENT "Documents: building snort_manual.tgz"
)
zcf images.tgz
--exclude callouts
--exclude README
- -C ${CMAKE_CURRENT_BINARY_DIR}/images
+ -C ${CMAKE_CURRENT_SOURCE_DIR}/images
.
- DEPENDS ${CMAKE_CURRENT_BINARY_DIR}/images ${ALL_SOURCES}
+ DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/images ${ALL_SOURCES}
COMMENT "Documents: building images.tgz"
)
###############################################################################
###############################################################################
-# Finally, the commands to create the manuals, and the command to install the
-# manuals
+# Finally, the commands to set the manual dependencies and install the
+# built documents
add_custom_target(snort_manuals ALL
DEPENDS ${EXTRA_DIST}
)
-add_dependencies(snort_manuals snort)
+add_dependencies(snort_manuals snort ${ALL_SOURCES})
include_directories(time)
include_directories(utils)
-add_executable(snort
+add_executable( snort
main.h
main.cc
)
endif(STATIC_INSPECTORS)
if (BUILD_UNIT_TESTS)
- set( UNIT_TESTS_LIBRARIES test)
+ set( UNIT_TESTS_LIBRARIES unit_tests)
add_subdirectory(test)
endif( BUILD_UNIT_TESTS)
-set_default_visibility_compile_flag(snort)
-target_link_libraries(snort
+target_link_libraries( snort
main
target_based
log
)
##############################################################################
-#
-# This is the documents seciton of the cmake file. Yes, I hate that I am
-# putting this stuff in the src directory instead of the doc directory,
-# but these files are dependent on the Snort executable. Since complete
-# platform independence is the goal, these command need a file level
-# dependcy on snort, which means they need to be here
-#
-# When creating new files, follow these directions
-# 1) Copy an entire segment (include the set, add_custom_command,
-# and add_custom_target pieces)
-# 2) Change the ARGS to create the file you want
-# 3) Add the file name to list of BUILT_SOURCES at the top of
-# doc/CMakeLists.txt
-#
+# #
+# This is the documents section of the file. It needs to be in same #
+# directory or subdirectory as snort to create a valid file dependency on #
+# snort. To build another .txt file with a dependcy on snort, add the file #
+# to the BUILT_SOURCES variable located at the top of doc/CMakeLists.txt. #
+# If the new file's name is new_file.txt, cmake will automatcially run the #
+# command #
+# #
+# >> snort --help-file_name > file_name.txt #
+# #
+# to creat the new file. Notice that the extension is missing in the help #
+# command. If the command does not exist, the behavior is undefined but #
+# will likely lead to error. #
+# #
##############################################################################
-
if (MAKE_PDF_DOC OR MAKE_HTML_DOC)
+ foreach(file ${BUILT_SOURCES})
+ set(TARGET_DIR ${CMAKE_BINARY_DIR})
+ set(output ${TARGET_DIR}/${file})
+ get_filename_component(file_name "${file}" NAME_WE)
- set(TARGET_DIR ${CMAKE_BINARY_DIR})
-
-
- set(file builtin.txt)
-
- set(output ${TARGET_DIR}/${file})
- add_custom_command(
- OUTPUT ${output}
- COMMAND snort --markup --help-builtin > ${output}
- MAIN_DEPENDENCY snort
- COMMENT "Documents: building ${output}"
- )
- get_filename_component(file_name "${file}" NAME_WE)
- add_custom_target(doc_${file_name} ALL DEPENDS ${output} )
-
-
- set(file commands.txt)
-
- set(output ${TARGET_DIR}/${file})
- add_custom_command(
- OUTPUT ${output}
- COMMAND snort --markup --help-commands > ${output}
- MAIN_DEPENDENCY snort
- COMMENT "Documents: building ${output}"
- )
- get_filename_component(file_name "${file}" NAME_WE)
- add_custom_target(doc_${file_name} ALL DEPENDS ${output} )
-
-
-
- set(file config.txt)
+ add_custom_command(
+ OUTPUT ${output}
+ COMMAND snort --markup --help-${file_name} | sort > ${output}
+ DEPENDS snort
+ COMMENT "Documents: building ${output}"
+ )
+ add_custom_target(doc_${file_name} ALL DEPENDS ${output} )
- set(output ${TARGET_DIR}/${file})
- add_custom_command(
- OUTPUT ${output}
- COMMAND snort --markup --help-config > ${output}
- MAIN_DEPENDENCY snort
- COMMENT "Documents: building ${output}"
- )
- get_filename_component(file_name "${file}" NAME_WE)
- add_custom_target(doc_${file_name} ALL DEPENDS ${output})
-
-
- set(file options.txt)
-
- set(output ${TARGET_DIR}/${file})
- add_custom_command(
- OUTPUT ${output}
- COMMAND snort --markup --help > ${output}
- MAIN_DEPENDENCY snort
- COMMENT "Documents: building ${output}"
- )
- get_filename_component(file_name "${file}" NAME_WE)
- add_custom_target(doc_${file_name} ALL DEPENDS ${output})
-
-
- set(file gids.txt)
+ endforeach()
- set(output ${TARGET_DIR}/${file})
- add_custom_command(
- OUTPUT ${output}
- COMMAND snort --markup --help-gids > ${output}
- MAIN_DEPENDENCY snort
- COMMENT "Documents: building ${output}"
- )
- get_filename_component(file_name "${file}" NAME_WE)
- add_custom_target(doc_${file_name} ALL DEPENDS ${output})
+ # version is different since it outputs to standard out.
set(file version.txt)
set(output ${TARGET_DIR}/${file})
add_custom_command(
OUTPUT ${output}
COMMAND snort -V 2>&1 | grep -v Using > ${output}
- MAIN_DEPENDENCY snort
+ DEPENDS snort
COMMENT "Documents: building ${output}"
)
- get_filename_component(file_name "${file}" NAME_WE)
- add_custom_target(doc_${file_name} ALL DEPENDS ${output})
+ add_custom_target(doc_version ALL DEPENDS ${output})
endif()
helpers/libhelpers.a \
sfip/libsfip.a \
sfrt/libsfrt.a \
+protocols/libprotocols.a \
utils/libutils.a
SUBDIRS = \
add_library( codecs STATIC
- decode.h
decode_module.h
codec_api.h
codec_api.cc
codec_events.h
checksum.h
checksum.cc
+ template.cc # for development purposes. Keep the template up to date
)
libcodecs_a_SOURCES = \
codec_api.cc \
codec_api.h \
-decode.h \
decode_module.h \
-layer.h \
sf_protocols.h
libcodec_utils_a_SOURCES = \
if (len > 1 )
{
- sn = ((len / 2) & 0xF); // len divided by two mod 16 == len/2 % 16
+ sn = ((len / 2) & 0xF); // == len/2 % 16
n = (((len / 2) + 15) / 16) ; // ceiling of (len / 2) / 16
switch (sn) {
#include "config.h"
#endif
-#ifndef WIN32
-#include <sys/socket.h>
-#include <netinet/in.h>
-#include <net/if.h>
-#else /* !WIN32 */
-#include <netinet/in_systm.h>
-#ifndef IFNAMSIZ
-#define IFNAMESIZ MAX_ADAPTER_NAME
-#endif /* !IFNAMSIZ */
-#endif /* !WIN32 */
-
+#include <stdint.h>
+#include <stdlib.h>
namespace checksum
#include "framework/codec.h"
-// root decoders
+// root codecs
extern const BaseApi* cd_eth;
extern const BaseApi* cd_raw4;
extern const BaseApi* cd_raw6;
-extern const BaseApi* cd_null_root;
+extern const BaseApi* cd_null;
-#ifndef NO_NON_ETHER_DECODER
-
-#endif
-
-// decoders
+// other codecs
extern const BaseApi* cd_ipv4;
extern const BaseApi* cd_ipv6;
extern const BaseApi* cd_icmp4;
extern const BaseApi* cd_gtp;
extern const BaseApi* cd_hopopts;
extern const BaseApi* cd_igmp;
+extern const BaseApi* cd_mobility;
extern const BaseApi* cd_mpls;
extern const BaseApi* cd_no_next;
+extern const BaseApi* cd_pim;
extern const BaseApi* cd_pgm;
extern const BaseApi* cd_pppencap;
-extern const BaseApi* cd_pppoe;
+extern const BaseApi* cd_pppoepkt_disc;
+extern const BaseApi* cd_pppoepkt_sess;
extern const BaseApi* cd_routing;
+extern const BaseApi* cd_sun_nd;
extern const BaseApi* cd_swipe;
extern const BaseApi* cd_teredo;
extern const BaseApi* cd_transbridge;
#ifndef NO_NON_ETHER_DECODER
extern const BaseApi* cd_eapol;
+extern const BaseApi* cd_linux_sll;
+extern const BaseApi* cd_tr;
+extern const BaseApi* cd_wlan;
#endif
cd_eth,
cd_raw4,
cd_raw6,
- cd_null_root,
+ cd_null,
-#ifndef NO_NON_ETHER_DECODER
-
-#endif
// non root codeccs
cd_ipv4,
cd_gtp,
cd_hopopts,
cd_igmp,
+ cd_mobility,
cd_mpls,
cd_no_next,
+ cd_pim,
cd_pgm,
cd_pppencap,
- cd_pppoe,
+ cd_pppoepkt_disc,
+ cd_pppoepkt_sess,
cd_routing,
+ cd_sun_nd,
cd_swipe,
cd_teredo,
cd_transbridge,
#ifndef NO_NON_ETHER_DECODER
cd_eapol,
+ cd_linux_sll,
+ cd_tr,
+ cd_wlan,
#endif
#endif
p->data = pkt;
p->dsize = (uint16_t)len;
-
- p->greh = NULL;
}
+++ /dev/null
-/*
-** Copyright (C) 2002-2013 Sourcefire, Inc.
-** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-#ifndef DECODE_H
-#define DECODE_H
-
-/* I N C L U D E S **********************************************************/
-
-#ifdef HAVE_CONFIG_H
-#include "config.h"
-#endif
-
-#include <stddef.h>
-#include <sys/types.h>
-#include <string.h>
-
-#ifndef WIN32
-#include <sys/socket.h>
-#include <netinet/in.h>
-#include <net/if.h>
-#else /* !WIN32 */
-#include <netinet/in_systm.h>
-#ifndef IFNAMSIZ
-#define IFNAMESIZ MAX_ADAPTER_NAME
-#endif /* !IFNAMSIZ */
-#endif /* !WIN32 */
-
-extern "C" {
-#include <daq.h>
-#include <sfbpf_dlt.h>
-}
-
-#include "snort_types.h"
-#include "protocols/packet.h"
-#include "profiler.h"
-#include "protocols/mpls.h"
-
-
-
-
-
-/* D E F I N E S ************************************************************/
-
-#if 0
-#define ETH_DSAP_SNA 0x08 /* SNA */
-#define ETH_SSAP_SNA 0x00 /* SNA */
-#define ETH_DSAP_STP 0x42 /* Spanning Tree Protocol */
-#define ETH_SSAP_STP 0x42 /* Spanning Tree Protocol */
-#define ETH_DSAP_IP 0xaa /* IP */
-#define ETH_SSAP_IP 0xaa /* IP */
-
-#define ETH_ORG_CODE_ETHR 0x000000 /* Encapsulated Ethernet */
-#define ETH_ORG_CODE_CDP 0x00000c /* Cisco Discovery Proto */
-#endif
-
-
-#define DEFAULT_MPLS_PAYLOADTYPE MPLS_PAYLOADTYPE_IPV4
-#define DEFAULT_LABELCHAIN_LENGTH -1
-
-
-#define MAX_PORTS 65536
-
-#if 0
-/* ppp header structure
- *
- * Actually, this is the header for RFC1332 Section 3
- * IPCP Configuration Options for sending IP datagrams over a PPP link
- *
- */
-struct ppp_header {
- unsigned char address;
- unsigned char control;
- unsigned short protocol;
-};
-
-#ifndef PPP_HDRLEN
- #define PPP_HDRLEN sizeof(struct ppp_header)
-#endif
-
-/* otherwise defined in /usr/include/ppp_defs.h */
-#ifndef PPP_MTU
- #define PPP_MTU 1500
-#endif
-
-#endif
-
-
-#define IP_OPTMAX 40
-#define IP6_EXTMAX 8
-#define TCP_OPTLENMAX 40 /* (((2^4) - 1) * 4 - TCP_HEADER_LEN) */
-
-
-
-
-
-static inline uint16_t EXTRACT_16BITS(const uint8_t* p)
-{
- return ntohs(*(uint16_t*)(p));
-}
-
-#ifdef WORDS_MUSTALIGN
-
-#if defined(__GNUC__)
-/* force word-aligned ntohl parameter */
- static inline uint32_t EXTRACT_32BITS(const uint8_t* p)
- {
- uint32_t tmp;
- memmove(&tmp, p, sizeof(uint32_t));
- return ntohl(tmp);
- }
-#endif /* __GNUC__ */
-
-#else
-
-/* allows unaligned ntohl parameter - dies w/SIGBUS on SPARCs */
- static inline uint32_t EXTRACT_32BITS(const uint8_t* p)
- {
- return ntohl(*(uint32_t *)p);
- }
-#endif /* WORDS_MUSTALIGN */
-
-
-
-const unsigned int ALERTMSG_LENGTH = 256;
-const int16_t SFTARGET_UNKNOWN_PROTOCOL = -1;
-
-
-
-#endif
-
cd_igmp_module.h
cd_igmp_module.cc
cd_no_next.cc
+ cd_mobility.cc
+ cd_pim.cc
cd_pgm.cc
cd_pgm_module.h
cd_pgm_module.cc
cd_routing.cc
+ cd_sun_nd.cc
cd_swipe.cc
)
add_shared_library(cd_gre codecs cd_gre.cc cd_gre_module.h cd_gre_module.cc)
add_shared_library(cd_hopopts codecs cd_hopopts.cc)
add_shared_library(cd_igmp codecs cd_igmp.cc cd_igmp_module.h cd_igmp_module.cc)
+ add_shared_library(cd_mobility codecs cd_mobility.cc)
add_shared_library(cd_no_next codecs cd_no_next.cc)
+ add_shared_library(cd_pim codecs cd_pim.cc)
add_shared_library(cd_pgm codecs cd_pgm.cc cd_pgm_module.h cd_pgm_module.cc)
add_shared_library(cd_routing codecs cd_routing.cc)
+ add_shared_library(cd_sun_nd codecs cd_sun_nd.cc)
add_shared_library(cd_swipe codecs cd_swipe.cc)
endif()
cd_igmp.cc \
cd_igmp_module.h \
cd_igmp_module.cc \
+cd_mobility.cc \
cd_no_next.cc \
+cd_pim.cc \
cd_pgm.cc \
cd_pgm_module.h \
cd_pgm_module.cc \
cd_routing.cc \
+cd_sun_nd.cc \
cd_swipe.cc
libcd_gre_la_LDFLAGS = -export-dynamic -shared
libcd_gre_la_SOURCES = cd_gre.cc cd_gre_module.h cd_gre_module.cc
+ehlib_LTLIBRARIES += libcd_mobility.la
+libcd_mobility_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
+libcd_mobility_la_LDFLAGS = -export-dynamic -shared
+libcd_mobility_la_SOURCES = cd_mobility.cc
+
ehlib_LTLIBRARIES += libcd_pgm.la
libcd_pgm_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
libcd_pgm_la_LDFLAGS = -export-dynamic -shared
libcd_pgm_la_SOURCES = cd_gre.cc cd_pgm_module.h cd_pgm_module.cc
+ehlib_LTLIBRARIES += libcd_pim.la
+libcd_pim_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
+libcd_pim_la_LDFLAGS = -export-dynamic -shared
+libcd_pim_la_SOURCES = cd_pim.cc
+
+ehlib_LTLIBRARIES += libcd_sun_nd.la
+libcd_sun_nd_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
+libcd_sun_nd_la_LDFLAGS = -export-dynamic -shared
+libcd_sun_nd_la_SOURCES = cd_sun_nd.cc
+
# TODO: PUT THESE IN THE LIST
#add_shared_library(cd_dstopts codecs cd_dstopts.cc)
#add_shared_library(cd_frag codecs cd_frag.cc)
#include "codecs/ip/cd_ah_module.h"
#include "protocols/protocol_ids.h"
#include "protocols/ipv6.h"
+#include "codecs/sf_protocols.h"
namespace
{
~AhCodec(){};
+ virtual PROTO_ID get_proto_id() { return PROTO_AH; };
virtual void get_protocol_ids(std::vector<uint16_t>& v);
virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
-
-
- // DELETE from here and below
- #include "codecs/sf_protocols.h"
- virtual inline PROTO_ID get_proto_id() { return PROTO_AH; };
-
};
#include "codecs/decode_module.h"
-#define CD_AH_NAME "codec_ah"
+#define CD_AH_NAME "cd_ah"
class AhModule : public DecodeModule
{
namespace
{
-#define CD_DSTOPTS_NAME "codec_ipv6_dstopts"
+#define CD_DSTOPTS_NAME "cd_ipv6_dstopts"
class Ipv6DSTOptsCodec : public Codec
{
#include "codecs/decode_module.h"
-#define CD_ESP_NAME "codec_esp"
+#define CD_ESP_NAME "cd_esp"
class EspModule : public DecodeModule
{
namespace
{
-#define CD_IPV6_FRAG_NAME "codec_ipv6_frag"
+#define CD_IPV6_FRAG_NAME "cd_ipv6_frag"
class Ipv6FragCodec : public Codec
{
// cd_gre.cc author Josh Rosenbaum <jorosenba@cisco.com>
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
#include "framework/codec.h"
#include "codecs/ip/cd_gre_module.h"
#include "codecs/codec_events.h"
#include "protocols/packet.h"
#include "protocols/protocol_ids.h"
+#include "codecs/sf_protocols.h"
+#include "protocols/gre.h"
namespace
{
GreCodec() : Codec(CD_GRE_NAME){};
~GreCodec(){};
-
+ virtual PROTO_ID get_proto_id() { return PROTO_GRE; };
virtual void get_protocol_ids(std::vector<uint16_t>& v);
virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
- virtual void format(EncodeFlags, const Packet* p, Packet* c, Layer*);
- // DELETE from here and below
- #include "codecs/sf_protocols.h"
- virtual inline PROTO_ID get_proto_id() { return PROTO_GRE; };
};
-static const uint16_t GRE_PROT_ID = 47;
static const uint32_t GRE_HEADER_LEN = 4;
static const uint32_t GRE_CHKSUM_LEN = 2;
static const uint32_t GRE_OFFSET_LEN = 2;
void GreCodec::get_protocol_ids(std::vector<uint16_t>& v)
{
- v.push_back(GRE_PROT_ID);
+ v.push_back(IPPROTO_ID_GRE);
}
* figure out the length
*/
- p->greh = (GREHdr *)raw_pkt;
+ const gre::GREHdr *greh = reinterpret_cast<const gre::GREHdr *>(raw_pkt);
lyr_len = GRE_HEADER_LEN;
- switch (GRE_VERSION(p->greh))
+ switch (GRE_VERSION(greh))
{
case 0x00:
/* these must not be set */
- if (GRE_RECUR(p->greh) || GRE_FLAGS(p->greh))
+ if (GRE_RECUR(greh) || GRE_FLAGS(greh))
{
codec_events::decoder_alert_encapsulated(p, DECODE_GRE_INVALID_HEADER,
raw_pkt, len);
return false;
}
- if (GRE_CHKSUM(p->greh) || GRE_ROUTE(p->greh))
+ if (GRE_CHKSUM(greh) || GRE_ROUTE(greh))
lyr_len += GRE_CHKSUM_LEN + GRE_OFFSET_LEN;
- if (GRE_KEY(p->greh))
+ if (GRE_KEY(greh))
lyr_len += GRE_KEY_LEN;
- if (GRE_SEQ(p->greh))
+ if (GRE_SEQ(greh))
lyr_len += GRE_SEQ_LEN;
/* if this flag is set, we need to walk through all of the
* Source Route Entries */
- if (GRE_ROUTE(p->greh))
+ if (GRE_ROUTE(greh))
{
uint16_t sre_addrfamily;
uint8_t sre_offset;
/* PPTP */
case 0x01:
/* these flags should never be present */
- if (GRE_CHKSUM(p->greh) || GRE_ROUTE(p->greh) || GRE_SSR(p->greh) ||
- GRE_RECUR(p->greh) || GRE_V1_FLAGS(p->greh))
+ if (GRE_CHKSUM(greh) || GRE_ROUTE(greh) || GRE_SSR(greh) ||
+ GRE_RECUR(greh) || GRE_V1_FLAGS(greh))
{
codec_events::decoder_alert_encapsulated(p, DECODE_GRE_V1_INVALID_HEADER,
raw_pkt, len);
}
/* protocol must be 0x880B - PPP */
- if (GRE_PROTO(p->greh) != ETHERTYPE_PPP)
+ if (GRE_PROTO(greh) != ETHERTYPE_PPP)
{
codec_events::decoder_alert_encapsulated(p, DECODE_GRE_V1_INVALID_HEADER,
raw_pkt, len);
}
/* this flag should always be present */
- if (!(GRE_KEY(p->greh)))
+ if (!(GRE_KEY(greh)))
{
codec_events::decoder_alert_encapsulated(p, DECODE_GRE_V1_INVALID_HEADER,
raw_pkt, len);
lyr_len += GRE_KEY_LEN;
- if (GRE_SEQ(p->greh))
+ if (GRE_SEQ(greh))
lyr_len += GRE_SEQ_LEN;
- if (GRE_V1_ACK(p->greh))
+ if (GRE_V1_ACK(greh))
lyr_len += GRE_V1_ACK_LEN;
break;
return false;
}
- next_prot_id = GRE_PROTO(p->greh);
+ next_prot_id = GRE_PROTO(greh);
return true;
}
-/******************************************************************
- ******************** E N C O D E R ******************************
- ******************************************************************/
-
-void GreCodec::format (EncodeFlags, const Packet*, Packet* c, Layer* lyr)
-{
- c->greh = (GREHdr*)lyr->start;
-}
//-------------------------------------------------------------------------
#include "codecs/decode_module.h"
-#define CD_GRE_NAME "codec_gre"
+#define CD_GRE_NAME "cd_gre"
class GreModule : public DecodeModule
{
namespace
{
-#define CD_HOPOPTS_NAME "codec_ipv6_hopopts"
+#define CD_HOPOPTS_NAME "cd_ipv6_hopopts"
class Ipv6HopOptsCodec : public Codec
{
#include "codecs/checksum.h"
#include "protocols/protocol_ids.h"
#include "codecs/ip/cd_icmp4_module.h"
+#include "codecs/sf_protocols.h"
namespace{
Icmp4Codec() : Codec(CD_ICMP4_NAME){};
~Icmp4Codec() {};
+ virtual PROTO_ID get_proto_id() { return PROTO_ICMP4; };
virtual void get_protocol_ids(std::vector<uint16_t>&);
virtual bool decode(const uint8_t* raw_packet, const uint32_t raw_len,
Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id);
virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in);
virtual bool update(Packet*, Layer*, uint32_t* len);
virtual void format(EncodeFlags, const Packet* p, Packet* c, Layer*);
-
- // DELETE from here and below
- #include "codecs/sf_protocols.h"
- virtual inline PROTO_ID get_proto_id() { return PROTO_ICMP4; };
-
private:
void DecodeICMPEmbeddedIP(const uint8_t *pkt, const uint32_t len, Packet *p);
#include "codecs/decode_module.h"
-#define CD_ICMP4_NAME "codec_icmp4"
+#define CD_ICMP4_NAME "cd_icmp4"
class Icmp4Module : public DecodeModule
{
#include "protocols/icmp6.h"
#include "protocols/icmp4.h"
#include "codecs/ip/cd_icmp6_module.h"
+#include "codecs/sf_protocols.h"
namespace
~Icmp6Codec(){};
+ virtual PROTO_ID get_proto_id() { return PROTO_ICMP6; };
virtual void get_protocol_ids(std::vector<uint16_t>& v);
virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in);
virtual bool update(Packet*, Layer*, uint32_t* len);
virtual void format(EncodeFlags, const Packet* p, Packet* c, Layer*);
-
-
- // DELETE from here and below
- #include "codecs/sf_protocols.h"
- virtual inline PROTO_ID get_proto_id() { return PROTO_ICMP6; };
};
} // anonymous namespace
+static void DecodeICMPEmbeddedIP6(const uint8_t *pkt, const uint32_t len, Packet *p);
+
+
void Icmp6Codec::get_protocol_ids(std::vector<uint16_t>& v)
{
v.push_back(IPPROTO_ICMPV6);
}
-
-
-static void DecodeICMPEmbeddedIP6(const uint8_t *pkt, const uint32_t len, Packet *p);
-
-#if 0
-static unsigned short in_chksum_icmp6(pseudoheader6 *, unsigned short *, int);
-#endif
-
-
//--------------------------------------------------------------------
// decode.c::ICMP6
//--------------------------------------------------------------------
}
break;
- case ICMP6_BIG:
+ case icmp6::Icmp6Types::BIG:
if (p->dsize >= sizeof(ICMP6TooBig))
{
ICMP6TooBig *too_big = (ICMP6TooBig *)raw_pkt;
p->data += 4;
p->dsize -= 4;
- if (p->icmp6h->type == ICMP6_UNREACH)
+ if (p->icmp6h->type == icmp6::Icmp6Types::UNREACH)
{
if (p->icmp6h->code == 2)
{
c->icmp6h = (ICMP6Hdr*)lyr->start;
}
-#if 0
-
-/*
- * CHECKSUM
- */
-
-
-/*
-* checksum icmp6
-*/
-
-static unsigned short in_chksum_icmp6(pseudoheader6 *ph,
- unsigned short *w, int blen )
-{
- uint16_t *h = (uint16_t *)ph;
- unsigned short answer=0;
- unsigned int cksum = 0;
-
- /* PseudoHeader must have 36 bytes */
- cksum = h[0];
- cksum += h[1];
- cksum += h[2];
- cksum += h[3];
- cksum += h[4];
- cksum += h[5];
- cksum += h[6];
- cksum += h[7];
- cksum += h[8];
- cksum += h[9];
- cksum += h[10];
- cksum += h[11];
- cksum += h[12];
- cksum += h[13];
- cksum += h[14];
- cksum += h[15];
- cksum += h[16];
- cksum += h[17];
-
- while(blen >=32)
- {
- cksum += w[0];
- cksum += w[1];
- cksum += w[2];
- cksum += w[3];
- cksum += w[4];
- cksum += w[5];
- cksum += w[6];
- cksum += w[7];
- cksum += w[8];
- cksum += w[9];
- cksum += w[10];
- cksum += w[11];
- cksum += w[12];
- cksum += w[13];
- cksum += w[14];
- cksum += w[15];
- w += 16;
- blen -= 32;
- }
-
- while(blen >=8)
- {
- cksum += w[0];
- cksum += w[1];
- cksum += w[2];
- cksum += w[3];
- w += 4;
- blen -= 8;
- }
-
- while(blen > 1)
- {
- cksum += *w++;
- blen -= 2;
- }
-
- if( blen == 1 )
- {
- *(unsigned char*)(&answer) = (*(unsigned char*)w);
- cksum += answer;
- }
-
- cksum = (cksum >> 16) + (cksum & 0x0000ffff);
- cksum += (cksum >> 16);
-
-
- return (unsigned short)(~cksum);
-}
-#endif
-
-
//-------------------------------------------------------------------------
// api
//-------------------------------------------------------------------------
#include "codecs/decode_module.h"
-#define CD_ICMP6_NAME "codec_icmp6"
+#define CD_ICMP6_NAME "cd_icmp6"
class Icmp6Module : public DecodeModule
{
#include "codecs/decode_module.h"
-#define CD_IGMP_NAME "codec_igmp"
+#define CD_IGMP_NAME "cd_igmp"
class IgmpModule : public DecodeModule
{
#include "main/thread.h"
#include "stream/stream_api.h"
#include "codecs/ip/cd_ipv4_module.h"
+#include "codecs/sf_protocols.h"
namespace{
Ipv4Codec() : Codec(CD_IPV4_NAME){};
~Ipv4Codec(){};
+ virtual PROTO_ID get_proto_id() { return PROTO_IP4; };
virtual void get_protocol_ids(std::vector<uint16_t>& v);
virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
virtual bool update(Packet*, Layer*, uint32_t* len);
virtual void format(EncodeFlags, const Packet* p, Packet* c, Layer*);
- // used in random classes throughout Snort++
-
- // DELETE from here and below
- #include "codecs/sf_protocols.h"
- virtual inline PROTO_ID get_proto_id() { return PROTO_IP4; };
private:
-
-
+ static uint8_t RevTTL (const EncState* enc, uint8_t ttl);
+ static uint8_t FwdTTL (const EncState* enc, uint8_t ttl);
+ static uint8_t GetTTL (const EncState* enc);
};
************ PRIVATE FUNCTIONS ***********
*******************************************/
-static inline uint8_t GetTTL (const EncState* enc)
+uint8_t Ipv4Codec::GetTTL (const EncState* enc)
{
char dir;
uint8_t ttl;
return ttl;
}
-static inline uint8_t FwdTTL (const EncState* enc, uint8_t ttl)
+uint8_t Ipv4Codec::FwdTTL (const EncState* enc, uint8_t ttl)
{
uint8_t new_ttl = GetTTL(enc);
if ( !new_ttl )
return new_ttl;
}
-static inline uint8_t RevTTL (const EncState* enc, uint8_t ttl)
+uint8_t Ipv4Codec::RevTTL (const EncState* enc, uint8_t ttl)
{
uint8_t new_ttl = GetTTL(enc);
if ( !new_ttl )
p->ip_dsize = (u_short) ip_len;
/* See if there are any ip_proto only rules that match */
- fpEvalIpProtoOnlyRules(snort_conf->ip_proto_only_lists, p);
+ fpEvalIpProtoOnlyRules(snort_conf->ip_proto_only_lists, p, p->iph->ip_proto);
p->proto_bits |= PROTO_BIT__IP;
if (GET_IPH_PROTO(p) >= MIN_UNASSIGNED_IP_PROTO)
codec_events::decoder_event(p, DECODE_IP_UNASSIGNED_PROTO);
-
- next_prot_id = p->iph->ip_proto;
+ else
+ next_prot_id = p->iph->ip_proto;
}
else
{
return true;
}
-
-/* Function: DecodeIPv4Proto
- *
- * Gernalized IPv4 next protocol decoder dispatching.
- *
- * Arguments: proto => IPPROTO value of the next protocol
- * pkt => ptr to the packet data
- * len => length from here to the end of the packet
- * p => pointer to the packet decode struct
- *
- */
-inline void DecodeIPv4Proto(const uint8_t proto,
- const uint8_t *pkt, const uint32_t len, Packet *p)
-{
- switch(proto)
- {
-
-
- case IPPROTO_IP_MOBILITY:
- case IPPROTO_SUN_ND:
- case IPPROTO_PIM:
- codec_events::decoder_event(p, DECODE_IP_BAD_PROTO);
- p->data = pkt;
- p->dsize = (uint16_t)len;
- return;
-
-
- default:
- if (GET_IPH_PROTO(p) >= MIN_UNASSIGNED_IP_PROTO)
- codec_events::decoder_event(p, DECODE_IP_UNASSIGNED_PROTO);
-
- p->data = pkt;
- p->dsize = (uint16_t)len;
- return;
- }
-}
-
-
//------------------------------------------------------------------
// decode.c::IP4 misc
//--------------------------------------------------------------------
sfiph_build(c, c->iph, AF_INET);
}
-
//-------------------------------------------------------------------------
// api
//-------------------------------------------------------------------------
#include "codecs/decode_module.h"
-#define CD_IPV4_NAME "codec_ipv4"
+#define CD_IPV4_NAME "cd_ipv4"
class Ipv4Module : public DecodeModule
{
#include "main/snort.h"
#include "packet_io/active.h"
#include "codecs/ip/cd_ipv6_module.h"
+#include "codecs/sf_protocols.h"
namespace
{
Ipv6Codec() : Codec(CD_IPV6_NAME){};
~Ipv6Codec(){};
+ virtual PROTO_ID get_proto_id() { return PROTO_IP6; };
virtual void get_protocol_ids(std::vector<uint16_t>& v);
virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
virtual bool update(Packet*, Layer*, uint32_t* len);
virtual void format(EncodeFlags, const Packet* p, Packet* c, Layer*);
+private:
- // DELETE from here and below
- #include "codecs/sf_protocols.h"
- virtual inline PROTO_ID get_proto_id() { return PROTO_IP6; };
+ static uint8_t RevTTL (const EncState* enc, uint8_t ttl);
+ static uint8_t FwdTTL (const EncState* enc, uint8_t ttl);
+ static uint8_t GetTTL (const EncState* enc);
};
************************* PRIVATE FUNCTIONS **********************
********************************************************************/
-static inline uint8_t GetTTL (const EncState* enc)
+uint8_t Ipv6Codec::GetTTL (const EncState* enc)
{
char dir;
uint8_t ttl;
return ttl;
}
-static inline uint8_t FwdTTL (const EncState* enc, uint8_t ttl)
+uint8_t Ipv6Codec::FwdTTL (const EncState* enc, uint8_t ttl)
{
uint8_t new_ttl = GetTTL(enc);
if ( !new_ttl )
return new_ttl;
}
-static inline uint8_t RevTTL (const EncState* enc, uint8_t ttl)
+uint8_t Ipv6Codec::RevTTL (const EncState* enc, uint8_t ttl)
{
uint8_t new_ttl = GetTTL(enc);
if ( !new_ttl )
next_prot_id = GET_IPH_PROTO(p);
lyr_len = ipv6::hdr_len();
-
-// DecodeIPV6Extensions(GET_IPH_PROTO(p), raw_pkt + ipv6::hdr_len(), ntohs(p->ip6h->len), p);
return true;
#include "codecs/decode_module.h"
-#define CD_IPV6_NAME "codec_ipv6"
+#define CD_IPV6_NAME "cd_ipv6"
class Ipv6Module : public DecodeModule
{
--- /dev/null
+/*
+** Copyright (C) 2002-2013 Sourcefire, Inc.
+** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include "framework/codec.h"
+#include "codecs/codec_events.h"
+
+
+namespace
+{
+
+// yes, macros are necessary. The API and class constructor require different strings.
+#define CD_MOBILE_NAME "cd_mobility"
+
+class MobilityCodec : public Codec
+{
+public:
+ MobilityCodec() : Codec(CD_MOBILE_NAME){};
+ ~MobilityCodec() {};
+
+
+ virtual void get_protocol_ids(std::vector<uint16_t>&);
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t raw_len,
+ Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
+
+};
+
+const uint16_t IPPROTO_ID_MOBILITY = 55;
+
+} // namespace
+
+
+void MobilityCodec::get_protocol_ids(std::vector<uint16_t>& v)
+{
+ v.push_back(IPPROTO_ID_MOBILITY);
+}
+
+bool MobilityCodec::decode(const uint8_t* raw_pkt, const uint32_t raw_len,
+ Packet* p, uint16_t& /*lyr_len*/, uint16_t& /*next_prot_id*/)
+{
+ codec_events::decoder_event(p, DECODE_IP_BAD_PROTO);
+ p->data = raw_pkt;
+ p->dsize = (uint16_t)raw_len;
+ return true;
+}
+
+
+//-------------------------------------------------------------------------
+// api
+//-------------------------------------------------------------------------
+
+static Codec* ctor(Module*)
+{
+ return new MobilityCodec();
+}
+
+static void dtor(Codec *cd)
+{
+ delete cd;
+}
+
+
+static const CodecApi mobility_api =
+{
+ {
+ PT_CODEC,
+ CD_MOBILE_NAME,
+ CDAPI_PLUGIN_V0,
+ 0,
+ nullptr,
+ nullptr
+ },
+ nullptr,
+ nullptr,
+ nullptr,
+ nullptr,
+ ctor,
+ dtor,
+};
+
+
+#ifdef BUILDING_SO
+SO_PUBLIC const BaseApi* snort_plugins[] =
+{
+ &mobility_api.base,
+ nullptr
+};
+#else
+const BaseApi* cd_mobility = &mobility_api.base;
+#endif
namespace
{
-#define CD_NO_NEXT_NAME "codec_ipv6_no_next"
+#define CD_NO_NEXT_NAME "cd_ipv6_no_next"
class Ipv6NoNextCodec : public Codec
{
#include "codecs/decode_module.h"
-#define CD_PGM_NAME "codec_pgm"
+#define CD_PGM_NAME "cd_pgm"
class PgmModule : public DecodeModule
{
--- /dev/null
+/*
+** Copyright (C) 2002-2013 Sourcefire, Inc.
+** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include "framework/codec.h"
+#include "codecs/codec_events.h"
+
+
+namespace
+{
+
+// yes, macros are necessary. The API and class constructor require different strings.
+#define CD_PIM_NAME "cd_pim"
+
+class PimCodec : public Codec
+{
+public:
+ PimCodec() : Codec(CD_PIM_NAME){};
+ ~PimCodec() {};
+
+
+ virtual void get_protocol_ids(std::vector<uint16_t>&);
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t raw_len,
+ Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
+
+};
+
+const uint16_t IPPROTO_ID_PIM = 103;
+
+} // namespace
+
+
+void PimCodec::get_protocol_ids(std::vector<uint16_t>& v)
+{
+ v.push_back(IPPROTO_ID_PIM);
+}
+
+bool PimCodec::decode(const uint8_t* raw_pkt, const uint32_t raw_len,
+ Packet* p, uint16_t& /*lyr_len*/, uint16_t& /*next_prot_id*/)
+{
+ codec_events::decoder_event(p, DECODE_IP_BAD_PROTO);
+ p->data = raw_pkt;
+ p->dsize = (uint16_t)raw_len;
+ return true;
+}
+
+
+//-------------------------------------------------------------------------
+// api
+//-------------------------------------------------------------------------
+
+static Codec* ctor(Module*)
+{
+ return new PimCodec();
+}
+
+static void dtor(Codec *cd)
+{
+ delete cd;
+}
+
+
+static const CodecApi pim_api =
+{
+ {
+ PT_CODEC,
+ CD_PIM_NAME,
+ CDAPI_PLUGIN_V0,
+ 0,
+ nullptr,
+ nullptr
+ },
+ nullptr,
+ nullptr,
+ nullptr,
+ nullptr,
+ ctor,
+ dtor,
+};
+
+
+#ifdef BUILDING_SO
+SO_PUBLIC const BaseApi* snort_plugins[] =
+{
+ &pim_api.base,
+ nullptr
+};
+#else
+const BaseApi* cd_pim = &pim_api.base;
+#endif
namespace
{
-#define CD_IPV6_ROUTING_NAME "codec_ipv6_routing"
+#define CD_IPV6_ROUTING_NAME "cd_ipv6_routing"
class Ipv6RoutingCodec : public Codec
{
--- /dev/null
+/*
+** Copyright (C) 2002-2013 Sourcefire, Inc.
+** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include "framework/codec.h"
+#include "codecs/codec_events.h"
+
+
+namespace
+{
+
+// yes, macros are necessary. The API and class constructor require different strings.
+#define CD_SUN_ND_NAME "cd_sun_nd"
+
+class SunNdCodec : public Codec
+{
+public:
+ SunNdCodec() : Codec(CD_SUN_ND_NAME){};
+ ~SunNdCodec() {};
+
+
+ virtual void get_protocol_ids(std::vector<uint16_t>&);
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t raw_len,
+ Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
+
+};
+
+const uint16_t IPPROTO_ID_SUN_ND = 77;
+
+} // namespace
+
+
+void SunNdCodec::get_protocol_ids(std::vector<uint16_t>& v)
+{
+ v.push_back(IPPROTO_ID_SUN_ND);
+}
+
+bool SunNdCodec::decode(const uint8_t* raw_pkt, const uint32_t raw_len,
+ Packet* p, uint16_t& /*lyr_len*/, uint16_t& /*next_prot_id*/)
+{
+ codec_events::decoder_event(p, DECODE_IP_BAD_PROTO);
+ p->data = raw_pkt;
+ p->dsize = (uint16_t)raw_len;
+ return true;
+}
+
+
+//-------------------------------------------------------------------------
+// api
+//-------------------------------------------------------------------------
+
+static Codec* ctor(Module*)
+{
+ return new SunNdCodec();
+}
+
+static void dtor(Codec *cd)
+{
+ delete cd;
+}
+
+
+static const CodecApi sun_nd_api =
+{
+ {
+ PT_CODEC,
+ CD_SUN_ND_NAME,
+ CDAPI_PLUGIN_V0,
+ 0,
+ nullptr,
+ nullptr
+ },
+ nullptr,
+ nullptr,
+ nullptr,
+ nullptr,
+ ctor,
+ dtor,
+};
+
+
+#ifdef BUILDING_SO
+SO_PUBLIC const BaseApi* snort_plugins[] =
+{
+ &sun_nd_api.base,
+ nullptr
+};
+#else
+const BaseApi* cd_sun_nd = &sun_nd_api.base;
+#endif
namespace{
-#define CD_SWIPE_NAME "codec_swipe"
+#define CD_SWIPE_NAME "cd_swipe"
class SwipeCodec : public Codec
#include "protocols/packet.h"
#include "framework/codec.h"
#include "codecs/ip/cd_tcp_module.h"
+#include "codecs/sf_protocols.h"
namespace
{
virtual ~TcpCodec(){};
+ virtual PROTO_ID get_proto_id() { return PROTO_TCP; };
virtual void get_protocol_ids(std::vector<uint16_t>& v);
virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
Packet *, uint16_t &lyr_len, uint16_t &);
virtual bool encode(EncState*, Buffer* out, const uint8_t *raw_in);
virtual bool update(Packet*, Layer*, uint32_t* len);
virtual void format(EncodeFlags, const Packet* p, Packet* c, Layer*);
-
-
- // DELETE
- #include "codecs/sf_protocols.h"
- virtual inline PROTO_ID get_proto_id() { return PROTO_TCP; };
};
static sfip_var_t *SynToMulticastDstIp = NULL;
/* calculate the checksum */
csum = checksum::tcp_cksum((uint16_t *)(p->tcph), len, &ph);
-#if 0
- csum = in_chksum_tcp(&ph, (uint16_t *)(p->tcph), len);
- uint16_t csum2 = PacketClass::tcp_cksum((uint16_t *)(p->tcph), len, &ph);
-
- if(csum != csum2)
- {
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "TCP_CHECKSUM_ERROR!!! -> the two checksum are not equal %hu != %hu\n",
- csum, csum2););
- uint16_t csum3 = PacketClass::tcp_cksum((uint16_t *)(p->tcph), len, &ph);
- }
-#endif
-
}
/* IPv6 traffic */
else
csum = checksum::tcp_cksum((uint16_t *)(p->tcph), len, &ph6);
- // TODO::DELETE
- #if 0
- csum = in_chksum_tcp6(&ph6, (uint16_t *)(p->tcph), len);
- uint16_t csum2 = PacketClass::tcp_cksum((uint16_t *)(p->tcph), len, &ph6);
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "HELLO!! -> the two checksum are not equal %hu != %hu\n",
- csum, csum2););
-
- if(csum != csum2)
- {
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "TCP_CHECKSUM_ERROR!!! -> the two checksum are not equal %hu != %hu\n",
- csum, csum2););
- uint16_t csum3 = PacketClass::tcp_cksum((uint16_t *)(p->tcph), len, &ph6);
- }
- #endif
}
if(csum)
#include "codecs/decode_module.h"
-#define CD_TCP_NAME "codec_tcp"
+#define CD_TCP_NAME "cd_tcp"
class TcpModule : public DecodeModule
{
#include "packet_io/active.h"
#include "codecs/codec_events.h"
#include "codecs/ip/cd_udp_module.h"
+#include "codecs/sf_protocols.h"
namespace
{
~UdpCodec(){};
+ virtual PROTO_ID get_proto_id() { return PROTO_UDP; };
virtual void get_protocol_ids(std::vector<uint16_t>& v);
virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
virtual bool encode(EncState*, Buffer* out, const uint8_t *raw_in);
virtual bool update(Packet*, Layer*, uint32_t* len);
virtual void format(EncodeFlags, const Packet* p, Packet* c, Layer*);
-
- // DELETE
- #include "codecs/sf_protocols.h"
- virtual inline PROTO_ID get_proto_id() { return PROTO_UDP; };
-
};
}
/* set the ptr to the start of the UDP header */
- p->inner_udph = p->udph = reinterpret_cast<const udp::UDPHdr*>(raw_pkt);
+ p->udph = reinterpret_cast<const udp::UDPHdr*>(raw_pkt);
if (!p->frag_flag)
{
#include "codecs/decode_module.h"
-#define CD_UDP_NAME "codec_udp"
+#define CD_UDP_NAME "cd_udp"
class UdpModule : public DecodeModule
{
cd_vlan_module.cc
)
- if(ENABLE_NON_ETHER_DECODER)
+ if(ENABLE_NON_ETHER_DECODERS)
set( PLUGIN_SOURCES
${PLUGIN_SOURCES}
cd_eapol.cc
#include "framework/codec.h"
#include "codecs/link/cd_arp_module.h"
#include "codecs/codec_events.h"
+#include "protocols/protocol_ids.h"
+#include "codecs/sf_protocols.h"
+#include "protocols/arp.h"
namespace
{
~ArpCodec(){};
+ virtual PROTO_ID get_proto_id() { return PROTO_ARP; };
virtual void get_protocol_ids(std::vector<uint16_t>& v);
virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
Packet *, uint16_t &lyr_len, uint16_t &);
-
- // DELETE from here and below
- #include "codecs/sf_protocols.h"
- virtual inline PROTO_ID get_proto_id() { return PROTO_ARP; };
};
-static const uint16_t ETHERNET_TYPE_REVARP = 0x8035;
-static const uint16_t ETHERNET_TYPE_ARP = 0x0806;
} // anonymous namespace
void ArpCodec::get_protocol_ids(std::vector<uint16_t>& v)
{
- v.push_back(ETHERNET_TYPE_ARP);
- v.push_back(ETHERNET_TYPE_REVARP);
+ v.push_back(ETHERTYPE_ARP);
+ v.push_back(ETHERTYPE_REVARP);
}
*
* Returns: void function
*/
-bool ArpCodec::decode(const uint8_t *raw_pkt, const uint32_t len,
+bool ArpCodec::decode(const uint8_t* /*raw_pkt*/, const uint32_t len,
Packet *p, uint16_t &lyr_len, uint16_t& /* next_prot_id */)
{
- p->ah = (EtherARP *) raw_pkt;
-
if(len < sizeof(EtherARP))
{
codec_events::decoder_event(p, DECODE_ARP_TRUNCATED);
}
p->proto_bits |= PROTO_BIT__ARP;
- lyr_len = sizeof(*p->ah);
+ lyr_len = sizeof(EtherARP);
return true;
}
#include "codecs/decode_module.h"
-#define CD_ARP_NAME "codec_arp"
+#define CD_ARP_NAME "cd_arp"
class ArpModule : public DecodeModule
{
#include "framework/codec.h"
#include "codecs/link/cd_eapol_module.h"
#include "codecs/codec_events.h"
+#include "protocols/protocol_ids.h"
+#include "protocols/eapol.h"
namespace
};
-static const uint16_t ETHERTYPE_EAPOL = 0x888e;
-
-
-#ifndef NO_NON_ETHER_DECODER
-
-/* IEEE 802.1x eapol types */
-#define EAPOL_TYPE_EAP 0x00 /* EAP packet */
-#define EAPOL_TYPE_START 0x01 /* EAPOL start */
-#define EAPOL_TYPE_LOGOFF 0x02 /* EAPOL Logoff */
-#define EAPOL_TYPE_KEY 0x03 /* EAPOL Key */
-#define EAPOL_TYPE_ASF 0x04 /* EAPOL Encapsulated ASF-Alert */
-
-
-#endif // NO_NON_ETHER_DECODER
-
-
-/* Extensible Authentication Protocol Codes RFC 2284*/
-#define EAP_CODE_REQUEST 0x01
-#define EAP_CODE_RESPONSE 0x02
-#define EAP_CODE_SUCCESS 0x03
-#define EAP_CODE_FAILURE 0x04
-/* EAP Types */
-#define EAP_TYPE_IDENTITY 0x01
-#define EAP_TYPE_NOTIFY 0x02
-#define EAP_TYPE_NAK 0x03
-#define EAP_TYPE_MD5 0x04
-#define EAP_TYPE_OTP 0x05
-#define EAP_TYPE_GTC 0x06
-#define EAP_TYPE_TLS 0x0d
-
-
-
-/* Extensible Authentication Protocol Codes RFC 2284*/
-#define EAP_CODE_REQUEST 0x01
-#define EAP_CODE_RESPONSE 0x02
-#define EAP_CODE_SUCCESS 0x03
-#define EAP_CODE_FAILURE 0x04
-/* EAP Types */
-#define EAP_TYPE_IDENTITY 0x01
-#define EAP_TYPE_NOTIFY 0x02
-#define EAP_TYPE_NAK 0x03
-#define EAP_TYPE_MD5 0x04
-#define EAP_TYPE_OTP 0x05
-#define EAP_TYPE_GTC 0x06
-#define EAP_TYPE_TLS 0x0d
-
-
-
-struct EtherEapol
-{
- uint8_t version; /* EAPOL proto version */
- uint8_t eaptype; /* EAPOL Packet type */
- uint16_t len; /* Packet body length */
-};
-
-struct EAPHdr
-{
- uint8_t code;
- uint8_t id;
- uint16_t len;
-};
-
-struct EapolKey
-{
- uint8_t type;
- uint8_t length[2];
- uint8_t counter[8];
- uint8_t iv[16];
- uint8_t index;
- uint8_t sig[16];
-};
-
-
} // namespace
/*************************************************
*/
void DecodeEAP(const uint8_t * pkt, const uint32_t len, Packet * p)
{
- const EAPHdr *eaph = reinterpret_cast<const EAPHdr* pkt>(pkt);
- p->eaph = (EAPHdr *) pkt;
- if(len < sizeof(EAPHdr))
+ const eapol::EAPHdr *eaph = reinterpret_cast<const eapol::EAPHdr*>(pkt);
+
+ if(len < sizeof(eapol::EAPHdr))
{
codec_events::decoder_event(p, DECODE_EAP_TRUNCATED);
return;
}
if (eaph->code == EAP_CODE_REQUEST ||
eaph->code == EAP_CODE_RESPONSE) {
- p->eaptype = pkt + sizeof(EAPHdr);
}
return;
}
*
* Returns: void function
*/
-void DecodeEapolKey(const uint8_t * pkt, uint32_t len, Packet * p)
+void DecodeEapolKey(const uint8_t* /*pkt*/, uint32_t len, Packet * p)
{
- p->eapolk = (EapolKey *) pkt;
- if(len < sizeof(EapolKey))
+ if(len < sizeof(eapol::EapolKey))
{
codec_events::decoder_event(p, DECODE_EAPKEY_TRUNCATED);
}
bool EapolCodec::decode(const uint8_t *raw_pkt, const uint32_t len,
Packet *p, uint16_t & /*lyr_len*/, uint16_t &/*next_prot_id */)
{
- p->eplh = (EtherEapol *) raw_pkt;
+ const eapol::EtherEapol* eplh = reinterpret_cast<const eapol::EtherEapol*>(raw_pkt);
- if(len < sizeof(EtherEapol))
+ if(len < sizeof(eapol::EtherEapol))
{
codec_events::decoder_event(p, DECODE_EAPOL_TRUNCATED);
return false;
}
- if (p->eplh->eaptype == EAPOL_TYPE_EAP) {
- DecodeEAP(raw_pkt + sizeof(EtherEapol), len - sizeof(EtherEapol), p);
+ if (eplh->eaptype == EAPOL_TYPE_EAP) {
+ DecodeEAP(raw_pkt + sizeof(eapol::EtherEapol), len - sizeof(eapol::EtherEapol), p);
}
- else if(p->eplh->eaptype == EAPOL_TYPE_KEY) {
- DecodeEapolKey(raw_pkt + sizeof(EtherEapol), len - sizeof(EtherEapol), p);
+ else if(eplh->eaptype == EAPOL_TYPE_KEY) {
+ DecodeEapolKey(raw_pkt + sizeof(eapol::EtherEapol), len - sizeof(eapol::EtherEapol), p);
}
return true;
{
{
PT_CODEC,
- CD_NAME_EAPOL,
+ CD_EAPOL_NAME,
CDAPI_PLUGIN_V0,
0,
mod_ctor,
#include "codecs/decode_module.h"
-#define CD_EAPOL_NAME "codec_eapol"
+#define CD_EAPOL_NAME "cd_eapol"
class EapolModule : public DecodeModule
{
#include "codecs/link/cd_erspan2_module.h"
#include "codecs/codec_events.h"
#include "protocols/protocol_ids.h"
+#include "codecs/sf_protocols.h"
namespace
{
Erspan2Codec() : Codec(CD_ERSPAN2_NAME){};
~Erspan2Codec(){};
+ virtual PROTO_ID get_proto_id() { return PROTO_ERSPAN; };
virtual void get_protocol_ids(std::vector<uint16_t>& v);
virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
- // DELETE from here and below
- #include "codecs/sf_protocols.h"
- virtual inline PROTO_ID get_proto_id() { return PROTO_ERSPAN; };
};
const uint16_t ETHERTYPE_ERSPAN_TYPE2 = 0x88be;
} // namespace
+
+static inline uint16_t erspan_version(ERSpanType2Hdr *hdr)
+{
+ return (ntohs(hdr->ver_vlan) & 0xf000) >> 12;
+}
+
void Erspan2Codec::get_protocol_ids(std::vector<uint16_t>& v)
{
v.push_back(ETHERTYPE_ERSPAN_TYPE2);
/* Check that this is in fact ERSpan Type 2.
*/
- if (ERSPAN_VERSION(erSpan2Hdr) != 0x01) /* Type 2 == version 0x01 */
+ if (erspan_version(erSpan2Hdr) != 0x01) /* Type 2 == version 0x01 */
{
codec_events::decoder_alert_encapsulated(p, DECODE_ERSPAN_HDR_VERSION_MISMATCH,
raw_pkt, len);
#include "codecs/decode_module.h"
-#define CD_ERSPAN2_NAME "codec_erspan2"
+#define CD_ERSPAN2_NAME "cd_erspan2"
class Erspan2Module : public DecodeModule
{
#include "codecs/link/cd_erspan3_module.h"
#include "codecs/codec_events.h"
#include "protocols/protocol_ids.h"
-
+#include "codecs/sf_protocols.h"
namespace
{
virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
- // DELETE from here and below
- #include "codecs/sf_protocols.h"
- virtual inline PROTO_ID get_proto_id() { return PROTO_ERSPAN; };
+ virtual PROTO_ID get_proto_id() { return PROTO_ERSPAN; };
};
const uint16_t ETHERTYPE_ERSPAN_TYPE3 = 0x22eb;
} // anonymous namespace
+static inline uint16_t erspan_version(ERSpanType3Hdr *hdr)
+{
+ return (ntohs(hdr->ver_vlan) & 0xf000) >> 12;
+}
+
+#if 0
+// keeping these functions around for use in further development
+
+static inline uint16_t erspan_vlan(ERSpanType3Hdr *hdr)
+{
+ return ntohs(hdr->ver_vlan) & 0x0fff;
+}
+
+static inline uint16_t erspan_span_id(ERSpanType3Hdr *hdr)
+{
+ return ntohs(hdr->flags_spanId) & 0x03ff;
+}
+
+static inline uint32_t erspan3_timestamp(ERSpanType3Hdr *hdr)
+{
+ return hdr->timestamp;
+}
+#endif
void Erspan3Codec::get_protocol_ids(std::vector<uint16_t>& v)
{
/* Check that this is in fact ERSpan Type 3.
*/
- if (ERSPAN_VERSION(erSpan3Hdr) != 0x02) /* Type 3 == version 0x02 */
+ if (erspan_version(erSpan3Hdr) != 0x02) /* Type 3 == version 0x02 */
{
codec_events::decoder_alert_encapsulated(p, DECODE_ERSPAN_HDR_VERSION_MISMATCH,
raw_pkt, len);
#include "codecs/decode_module.h"
-#define CD_ERSPAN3_NAME "codec_erspan3"
+#define CD_ERSPAN3_NAME "cd_erspan3"
class Erspan3Module : public DecodeModule
{
namespace
{
-#define CD_ETHLOOPBACK_NAME "codec_ethloopback"
+#define CD_ETHLOOPBACK_NAME "cd_ethloopback"
class EthLoopbackCodec : public Codec
#include "protocols/protocol_ids.h"
#include "protocols/mpls.h"
#include "codecs/link/cd_mpls_module.h"
+#include "codecs/sf_protocols.h"
namespace
{
MplsCodec() : Codec(CD_MPLS_NAME){};
~MplsCodec(){};
+ virtual PROTO_ID get_proto_id() { return PROTO_MPLS; };
virtual void get_protocol_ids(std::vector<uint16_t>& v);
virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
- // DELETE from here and below
- #include "codecs/sf_protocols.h"
- virtual inline PROTO_ID get_proto_id() { return PROTO_MPLS; };
};
bool MplsCodec::decode(const uint8_t *raw_pkt, const uint32_t len,
Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
{
- uint32_t* tmpMplsHdr;
+ const uint32_t* tmpMplsHdr;
uint32_t mpls_h;
uint32_t label;
lyr_len= 0;
int iRet = 0;
UpdateMPLSStats(&sfBase, len, Active_PacketWasDropped());
- tmpMplsHdr = (uint32_t *) raw_pkt;
- p->mpls = NULL;
+ tmpMplsHdr = (const uint32_t *) raw_pkt;
while (!bos)
{
/**
p->mpls = &(p->mplsHdr);
**/
- p->mpls = tmpMplsHdr;
+ p->proto_bits |= PROTO_BIT__MPLS;
if(!iRet)
{
iRet = ScMplsPayloadType();
{
codec_events::decoder_event(p, DECODE_MPLS_LABEL_STACK);
+ p->proto_bits &= ~PROTO_BIT__MPLS;
p->iph = NULL;
p->family = NO_IP;
return false;
};
//-------------------------------------------------------------------------
-// rpc module
+// mpls module
//-------------------------------------------------------------------------
MplsModule::MplsModule() : DecodeModule(CD_MPLS_NAME, mpls_params, mpls_rules)
return true;
}
-
#include "codecs/decode_module.h"
-#define CD_MPLS_NAME "codec_mpls"
+#define CD_MPLS_NAME "cd_mpls"
class MplsModule : public DecodeModule
{
#include "framework/codec.h"
#include "protocols/protocol_ids.h"
#include "snort.h"
+#include "codecs/sf_protocols.h"
namespace
{
-#define CD_PPPENCAP_NAME "codec_ppp_encap"
+#define CD_PPPENCAP_NAME "cd_pppencap"
class PppEncap : public Codec
{
PppEncap() : Codec(CD_PPPENCAP_NAME){};
~PppEncap(){};
+ virtual PROTO_ID get_proto_id() { return PROTO_PPP_ENCAP; };
virtual void get_protocol_ids(std::vector<uint16_t>& v);
virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
-
- // DELETE from here and below
- #include "codecs/sf_protocols.h"
- virtual inline PROTO_ID get_proto_id() { return PROTO_PPP_ENCAP; };
};
#include "codecs/link/cd_pppoepkt_module.h"
#include "codecs/codec_events.h"
#include "protocols/packet.h"
+#include "codecs/sf_protocols.h"
+#include "protocols/layer.h"
namespace
{
-class PPPoEPktCodec : public Codec
+enum class PppoepktType
{
-public:
- PPPoEPktCodec() : Codec(CD_PPPOEPKT_NAME){};
- ~PPPoEPktCodec(){};
-
+ DISCOVERY,
+ SESSION,
+};
- virtual void get_protocol_ids(std::vector<uint16_t>& v);
- virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
- virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in);
-
- // DELETE from here and below
- #include "codecs/sf_protocols.h"
- virtual inline PROTO_ID get_proto_id() { return PROTO_PPPOE; };
+/* PPPoEHdr Header; eth::EtherHdr plus the PPPoE Header */
+struct PPPoEHdr
+{
+ unsigned char ver_type; /* pppoe version/type */
+ unsigned char code; /* pppoe code CODE_* */
+ unsigned short session; /* session id */
+ unsigned short length; /* payload length */
+ /* payload follows */
};
+} // namespace
-const uint16_t PPPOE_HEADER_LEN = 6;
-const uint16_t ETHERNET_TYPE_PPPoE_DISC = 0x8863; /* discovery stage */
-const uint16_t ETHERNET_TYPE_PPPoE_SESS = 0x8864; /* session stage */
+const uint16_t PPPOE_HEADER_LEN = 6;
/* PPPoE types */
const uint16_t PPPoE_CODE_SESS = 0x00; /* PPPoE session */
#if 0
/* PPPoE tag types - currently not used*/
-
const uint16_t PPPoE_TAG_END_OF_LIST = 0x0000;
const uint16_t PPPoE_TAG_SERVICE_NAME = 0x0101;
const uint16_t PPPoE_TAG_AC_NAME = 0x0102;
const uint16_t PPPoE_TAG_GENERIC_ERROR = 0x0203;
#endif
-} // namespace
-
-void PPPoEPktCodec::get_protocol_ids(std::vector<uint16_t>& v)
-{
- v.push_back(ETHERNET_TYPE_PPPoE_DISC);
- v.push_back(ETHERNET_TYPE_PPPoE_SESS);
-}
-
-
-//--------------------------------------------------------------------
-// decode.c::PPP related
-//--------------------------------------------------------------------
-
-/*
- * Function: DecodePPPoEPkt(Packet *, char *, DAQ_PktHdr_t*, uint8_t*)
- *
- * Purpose: Decode those fun loving ethernet packets, one at a time!
- *
- * Arguments: p => pointer to the decoded packet struct
- * user => Utility pointer (unused)
- * pkthdr => ptr to the packet header
- * pkt => pointer to the real live packet data
- *
- * Returns: void function
- *
- * see http://www.faqs.org/rfcs/rfc2516.html
- *
- */
-bool PPPoEPktCodec::decode(const uint8_t *raw_pkt, const uint32_t len,
- Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
+static inline bool pppoepkt_decode(const uint8_t *raw_pkt,
+ const uint32_t len,
+ Packet *p,
+ PppoepktType ppp_type,
+ uint16_t &lyr_len,
+ uint16_t &next_prot_id)
{
//PPPoE_Tag *ppppoe_tag=0;
//PPPoE_Tag tag; /* needed to avoid alignment problems */
return false;
}
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "%X %X\n",
- *p->eh->ether_src, *p->eh->ether_dst););
/* lay the PPP over ethernet structure over the packet data */
- p->pppoeh = (PPPoEHdr *)raw_pkt;
+ const PPPoEHdr *pppoeh = reinterpret_cast<const PPPoEHdr*>(raw_pkt);
/* grab out the network type */
- switch(ntohs(p->eh->ether_type))
+ switch(ppp_type)
{
- case ETHERNET_TYPE_PPPoE_DISC:
+ case PppoepktType::DISCOVERY:
DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "(PPPOE Discovery) "););
break;
- case ETHERNET_TYPE_PPPoE_SESS:
+ case PppoepktType::SESSION:
DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "(PPPOE Session) "););
break;
-
- default:
- return false;
}
#ifdef DEBUG_MSGS
- switch(p->pppoeh->code)
+ switch(pppoeh->code)
{
case PPPoE_CODE_PADI:
/* The Host sends the PADI packet with the DESTINATION_ADDR set
DebugMessage(DEBUG_DECODE, "(Unknown)\n");
break;
}
+#else
+ UNUSED(pppoeh);
+ UNUSED(PPPoE_CODE_SESS);
+ UNUSED(PPPoE_CODE_PADI);
+ UNUSED(PPPoE_CODE_PADO);
+ UNUSED(PPPoE_CODE_PADR);
+ UNUSED(PPPoE_CODE_PADS);
+ UNUSED(PPPoE_CODE_PADT);
#endif
- if (ntohs(p->eh->ether_type) != ETHERNET_TYPE_PPPoE_DISC)
+ if (ppp_type != PppoepktType::DISCOVERY)
{
-// PushLayer(PROTO_PPPOE, p, pkt, PPPOE_HEADER_LEN);
-// DecodePppPktEncapsulated(pkt + PPPOE_HEADER_LEN, len - PPPOE_HEADER_LEN, p);
-
- // TODO: Why is this specifically PppPktEncapsulated?
lyr_len = PPPOE_HEADER_LEN;
- next_prot_id = ntohs(p->eh->ether_type);
+ next_prot_id = ETHERTYPE_PPP;
return true;
}
- return false;
+ DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Returning early on PPPOE discovery packet\n"););
+ return true;
}
******************** E N C O D E R ******************************
******************************************************************/
-bool PPPoEPktCodec::encode(EncState* enc, Buffer* out, const uint8_t* raw_in)
+static inline bool pppoepkt_encode(EncState* enc, Buffer* out, const uint8_t* raw_in)
{
int lyr_len = enc->p->layers[enc->layer-1].length;
}
+/*******************************************************************
+ *******************************************************************
+ ************* CODECS ****************
+ *******************************************************************
+ *******************************************************************/
+
+
+
+
+namespace
+{
+
+const uint16_t ETHERNET_TYPE_PPPoE_DISC = 0x8863; /* discovery stage */
+
+#define CD_PPPOEPKT_DISC_NAME "cd_pppoepkt (disc)"
+
+class PPPoEPktDiscCodec : public Codec
+{
+public:
+ PPPoEPktDiscCodec() : Codec(CD_PPPOEPKT_DISC_NAME){};
+ ~PPPoEPktDiscCodec() {};
+
+
+ virtual PROTO_ID get_proto_id() { return PROTO_PPPOE; };
+ virtual void get_protocol_ids(std::vector<uint16_t>& v);
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
+ Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
+ virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in);
+};
+
+
+} // namespace
+
+void PPPoEPktDiscCodec::get_protocol_ids(std::vector<uint16_t>& v)
+{
+ v.push_back(ETHERNET_TYPE_PPPoE_DISC);
+}
+
+
+bool PPPoEPktDiscCodec::decode(const uint8_t *raw_pkt, const uint32_t raw_len,
+ Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
+{
+ return pppoepkt_decode(raw_pkt, raw_len, p, PppoepktType::DISCOVERY,
+ lyr_len, next_prot_id);
+}
+
+bool PPPoEPktDiscCodec::encode(EncState *enc, Buffer* out, const uint8_t* raw_in)
+{
+ return pppoepkt_encode(enc, out, raw_in);
+}
//-------------------------------------------------------------------------
// api
//-------------------------------------------------------------------------
+
+// *** NOTE: THE CODEC HAS A DIFFERENT NAME!
+// However, since the module is creating a rule stub and is NOT
+// used for configurtion, it doesn't matter. If you want to use the module
+// for configuration, ensure the names are identical before continuing!
static Module* mod_ctor()
{
return new PPPoEPktModule;
delete m;
}
-static Codec* ctor(Module *)
+static Codec* disc_ctor(Module*)
{
- return new PPPoEPktCodec();
+ return new PPPoEPktDiscCodec();
}
-static void dtor(Codec *cd)
+static void disc_dtor(Codec *cd)
{
delete cd;
}
-static const CodecApi pppoe_api =
+
+static const CodecApi pppoepkt_disc_api =
{
{
PT_CODEC,
- CD_PPPOEPKT_NAME,
+ CD_PPPOEPKT_DISC_NAME,
CDAPI_PLUGIN_V0,
0,
mod_ctor,
mod_dtor,
},
- nullptr, // pinit
- nullptr, // pterm
- nullptr, // tinit
- nullptr, // tterm
- ctor, // ctor
- dtor, // dtor
+ nullptr,
+ nullptr,
+ nullptr,
+ nullptr,
+ disc_ctor,
+ disc_dtor,
};
#ifdef BUILDING_SO
SO_PUBLIC const BaseApi* snort_plugins[] =
{
- &pppoe_api.base,
+ &pppoepkt_disc_api.base,
nullptr
};
#else
-const BaseApi* cd_pppoe = &pppoe_api.base;
+const BaseApi* cd_pppoepkt_disc = &pppoepkt_disc_api.base;
#endif
+/*******************************************************************
+ *******************************************************************
+ *******************************************************************
+ *******************************************************************/
+
+
+
+
+namespace
+{
+
+
+#define CD_PPPOEPKT_SESS_NAME "cd_pppoepkt (sess)"
+const uint16_t ETHERNET_TYPE_PPPoE_SESS = 0x8864; /* session stage */
+
+class PPPoEPktSessCodec : public Codec
+{
+public:
+ PPPoEPktSessCodec() : Codec(CD_PPPOEPKT_SESS_NAME){};
+ ~PPPoEPktSessCodec() {};
+
+
+ virtual PROTO_ID get_proto_id() { return PROTO_PPPOE; };
+ virtual void get_protocol_ids(std::vector<uint16_t>& v);
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
+ Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
+ virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in);
+};
+
+
+} // namespace
+
+void PPPoEPktSessCodec::get_protocol_ids(std::vector<uint16_t>& v)
+{
+ v.push_back(ETHERNET_TYPE_PPPoE_SESS);
+}
+
+
+bool PPPoEPktSessCodec::decode(const uint8_t *raw_pkt, const uint32_t raw_len,
+ Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
+{
+ return pppoepkt_decode(raw_pkt, raw_len, p, PppoepktType::SESSION,
+ lyr_len, next_prot_id);
+}
+
+
+
+bool PPPoEPktSessCodec::encode(EncState *enc, Buffer* out, const uint8_t* raw_in)
+{
+ return pppoepkt_encode(enc, out, raw_in);
+}
+
+
+//-------------------------------------------------------------------------
+// api
+//-------------------------------------------------------------------------
+
+
+static Codec* sess_ctor(Module*)
+{
+ return new PPPoEPktSessCodec();
+}
+
+static void sess_dtor(Codec *cd)
+{
+ delete cd;
+}
+
+
+static const CodecApi pppoepkt_sess_api =
+{
+ {
+ PT_CODEC,
+ CD_PPPOEPKT_SESS_NAME,
+ CDAPI_PLUGIN_V0,
+ 0,
+ nullptr,
+ nullptr,
+ },
+ nullptr,
+ nullptr,
+ nullptr,
+ nullptr,
+ sess_ctor,
+ sess_dtor,
+};
+
+
+#ifdef BUILDING_SO
+SO_PUBLIC const BaseApi* snort_plugins[] =
+{
+ &pppoepkt_sess_api.base,
+ nullptr
+};
+#else
+const BaseApi* cd_pppoepkt_sess = &pppoepkt_sess_api.base;
+#endif
};
//-------------------------------------------------------------------------
-// rpc module
+// General PPPoEpkt module.
+//
+// ***** NOTE: THE CODEC HAS A DIFFERENT NAME!
+// * Additionally, this module is used for generator a rule stub ONLY!
+// * If you want to create a module for configuration, you must change the
+// * names of the correct PPPoEpkt codec
//-------------------------------------------------------------------------
+/// ^^^ READ THE COMMENT!
PPPoEPktModule::PPPoEPktModule() : DecodeModule(CD_PPPOEPKT_NAME, pppoepkt_params, pppoepkt_rules)
{ }
#include "codecs/decode_module.h"
-#define CD_PPPOEPKT_NAME "codec_pppoepkt"
+/*
+ * NOTE: This name reflect the file...NOT the Codec!
+ *
+ * Additionally, this module is used for generator a rule stub ONLY!
+ * If you want to create a module for configuration, you must change the
+ * names of the correct PPPoEpkt codec
+ */
+
+#define CD_PPPOEPKT_NAME "cd_pppoepkt"
class PPPoEPktModule : public DecodeModule
{
namespace
{
-#define CD_TRANSBRIDGE_NAME "codec_transbridge"
+#define CD_TRANSBRIDGE_NAME "cd_transbridge"
class TransbridgeCodec : public Codec
{
* convention needed to be changed and the stuff at the beginning
* wasn't needed since we are already deep into the packet
*/
-bool TransbridgeCodec::decode(const uint8_t *raw_pkt, const uint32_t len,
+bool TransbridgeCodec::decode(const uint8_t *raw_pkt, const uint32_t raw_len,
Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
{
- if(len < eth::hdr_len())
+ if(raw_len < eth::hdr_len())
{
codec_events::decoder_alert_encapsulated(p, DECODE_GRE_TRANS_DGRAM_LT_TRANSHDR,
- raw_pkt, len);
+ raw_pkt, raw_len);
return false;
}
/* The Packet struct's ethernet header will now point to the inner ethernet
* header of the packet
*/
- p->eh = (eth::EtherHdr *)raw_pkt;
+ const eth::EtherHdr *eh = reinterpret_cast<const eth::EtherHdr*>(raw_pkt);
+ p->proto_bits |= PROTO_BIT__ETH;
lyr_len = eth::hdr_len();
- next_prot_id = ntohs(p->eh->ether_type);
+ next_prot_id = ntohs(eh->ether_type);
return true;
}
#include "framework/codec.h"
#include "codecs/link/cd_vlan_module.h"
#include "codecs/codec_events.h"
+#include "protocols/vlan.h"
+#include "protocols/protocol_ids.h"
+#include "codecs/sf_protocols.h"
namespace
{
VlanCodec() : Codec(CD_VLAN_NAME){};
~VlanCodec(){};
+ virtual PROTO_ID get_proto_id() { return PROTO_VLAN; };
virtual void get_protocol_ids(std::vector<uint16_t>& v);
virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
- virtual void format(EncodeFlags, const Packet* p, Packet* c, Layer*);
+};
+
+struct EthLlc
+{
+ uint8_t dsap;
+ uint8_t ssap;
+} ;
-
- // DELETE from here and below
- #include "codecs/sf_protocols.h"
- virtual inline PROTO_ID get_proto_id() { return PROTO_VLAN; };
+
+struct EthLlcOther
+{
+ uint8_t ctrl;
+ uint8_t org_code[3];
+ uint16_t proto_id;
};
} // namespace
-static const uint16_t ETHERNET_TYPE_8021Q = 0x8100;
static const unsigned int ETHERNET_MAX_LEN_ENCAP = 1518; /* 802.3 (+LLC) or ether II ? */
static inline uint32_t len_vlan_llc_other()
{
- return (sizeof(VlanTagHdr) + sizeof(EthLlc) + sizeof(EthLlcOther));
+ return (sizeof(vlan::VlanTagHdr) + sizeof(EthLlc) + sizeof(EthLlcOther));
}
void VlanCodec::get_protocol_ids(std::vector<uint16_t>& v)
{
- v.push_back(ETHERNET_TYPE_8021Q);
+ v.push_back(ETHERTYPE_8021Q);
}
bool VlanCodec::decode(const uint8_t *raw_pkt, const uint32_t len,
Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
{
- if(len < sizeof(VlanTagHdr))
+ if(len < sizeof(vlan::VlanTagHdr))
{
codec_events::decoder_event(p, DECODE_BAD_VLAN);
return false;
}
- p->vh = (VlanTagHdr *) raw_pkt;
+ const vlan::VlanTagHdr *vh = reinterpret_cast<const vlan::VlanTagHdr *>(raw_pkt);
DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Vlan traffic:\n");
DebugMessage(DEBUG_DECODE, " Priority: %d(0x%X)\n",
- VTH_PRIORITY(p->vh), VTH_PRIORITY(p->vh));
- DebugMessage(DEBUG_DECODE, " CFI: %d\n", VTH_CFI(p->vh));
+ vlan::vth_priority(vh), vlan::vth_priority(vh));
+ DebugMessage(DEBUG_DECODE, " CFI: %d\n", vlan::vth_cfi(vh));
DebugMessage(DEBUG_DECODE, " Vlan ID: %d(0x%04X)\n",
- VTH_VLAN(p->vh), VTH_VLAN(p->vh));
+ vlan::vth_vlan(vh), vlan::vth_vlan(vh));
DebugMessage(DEBUG_DECODE, " Vlan Proto: 0x%04X\n",
- ntohs(p->vh->vth_proto));
+ ntohs(vh->vth_proto));
);
/* check to see if we've got an encapsulated LLC layer
* http://www.geocities.com/billalexander/ethernet.html
*/
- if(ntohs(p->vh->vth_proto) <= ETHERNET_MAX_LEN_ENCAP)
+ if(ntohs(vh->vth_proto) <= ETHERNET_MAX_LEN_ENCAP)
{
- if(len < sizeof(VlanTagHdr) + sizeof(EthLlc))
+ if(len < sizeof(vlan::VlanTagHdr) + sizeof(EthLlc))
{
codec_events::decoder_event(p, DECODE_BAD_VLAN_ETHLLC);
return false;
}
- p->ehllc = (EthLlc *) (raw_pkt + sizeof(VlanTagHdr));
+ const EthLlc *ehllc = reinterpret_cast<const EthLlc *>(raw_pkt + sizeof(vlan::VlanTagHdr));
DEBUG_WRAP(
DebugMessage(DEBUG_DECODE, "LLC Header:\n");
- DebugMessage(DEBUG_DECODE, " DSAP: 0x%X\n", p->ehllc->dsap);
- DebugMessage(DEBUG_DECODE, " SSAP: 0x%X\n", p->ehllc->ssap);
+ DebugMessage(DEBUG_DECODE, " DSAP: 0x%X\n", ehllc->dsap);
+ DebugMessage(DEBUG_DECODE, " SSAP: 0x%X\n", ehllc->ssap);
);
- if(p->ehllc->dsap == ETH_DSAP_IP && p->ehllc->ssap == ETH_SSAP_IP)
+ if(ehllc->dsap == ETH_DSAP_IP && ehllc->ssap == ETH_SSAP_IP)
{
if ( len < len_vlan_llc_other() )
{
return false;
}
- p->ehllcother = (EthLlcOther *) (raw_pkt + sizeof(VlanTagHdr) + sizeof(EthLlc));
+ const EthLlcOther *ehllcother = reinterpret_cast<const EthLlcOther *>(raw_pkt + sizeof(vlan::VlanTagHdr) + sizeof(EthLlc));
DEBUG_WRAP(
DebugMessage(DEBUG_DECODE, "LLC Other Header:\n");
DebugMessage(DEBUG_DECODE, " CTRL: 0x%X\n",
- p->ehllcother->ctrl);
+ ehllcother->ctrl);
DebugMessage(DEBUG_DECODE, " ORG: 0x%02X%02X%02X\n",
- p->ehllcother->org_code[0], p->ehllcother->org_code[1],
- p->ehllcother->org_code[2]);
+ ehllcother->org_code[0], ehllcother->org_code[1],
+ ehllcother->org_code[2]);
DebugMessage(DEBUG_DECODE, " PROTO: 0x%04X\n",
- ntohs(p->ehllcother->proto_id));
+ ntohs(ehllcother->proto_id));
);
lyr_len = len_vlan_llc_other();
- next_prot_id = ntohs(p->ehllcother->proto_id);
+ next_prot_id = ntohs(ehllcother->proto_id);
}
}
else
{
- lyr_len = sizeof(VlanTagHdr);
- next_prot_id = ntohs(p->vh->vth_proto);
+ lyr_len = sizeof(vlan::VlanTagHdr);
+ next_prot_id = ntohs(vh->vth_proto);
}
+ p->proto_bits |= PROTO_BIT__VLAN;
return true;
}
-/*
- * ENCODER
- */
-void VlanCodec::format(EncodeFlags, const Packet* /*p*/, Packet* c, Layer*lyr)
-{
- c->vh = (VlanTagHdr*)lyr->start;
-}
-
-
//-------------------------------------------------------------------------
// api
//-------------------------------------------------------------------------
delete cd;
}
-
static const CodecApi vlan_api =
{
{
#include "codecs/decode_module.h"
-#define CD_VLAN_NAME "codec_vlan"
+#define CD_VLAN_NAME "cd_vlan"
class VlanModule : public DecodeModule
{
#include "config.h"
#endif
-#include "packet.h"
#include "snort_debug.h"
+#include "main/snort.h"
#include "framework/codec.h"
-#include "codecs/misc/cd_gtp_module.h"
+#include "protocols/packet.h"
#include "codecs/codec_events.h"
-#include "snort.h"
+#include "codecs/misc/cd_gtp_module.h"
#include "protocols/ipv4.h"
#include "protocols/ipv6.h"
#include "packet_io/active.h"
-
+#include "codecs/sf_protocols.h"
#include "protocols/protocol_ids.h"
namespace
GtpCodec() : Codec(CD_GTP_NAME){};
~GtpCodec(){};
+ virtual PROTO_ID get_proto_id() { return PROTO_GTP; };
virtual void get_protocol_ids(std::vector<uint16_t>& v);
virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in);
virtual bool update(Packet*, Layer*, uint32_t* len);
-
-
- // DELETE from here and below
- #include "codecs/sf_protocols.h"
- virtual inline PROTO_ID get_proto_id() { return PROTO_GTP; };
};
-
/* GTP basic Header */
struct GTPHdr
{
#include "codecs/decode_module.h"
-#define CD_GTP_NAME "codec_gtp"
+#define CD_GTP_NAME "cd_gtp"
class GtpModule : public DecodeModule
{
namespace
{
-#define CD_TEREDO_NAME "codec_teredo"
+#define CD_TEREDO_NAME "cd_teredo"
class TeredoCodec : public Codec
{
include_directories(${PCAP_INCLUDE_DIR})
-if (ENABLE_NON_ETHER_DECODERS)
- set( NON_ETHER_DECODERS
- prot_eap.h
- prot_eapol.h
- prot_eapol.cc
- prot_eapolkey.h
- prot_eapolkey.cc
- )
-endif(ENABLE_NON_ETHER_DECODERS)
-
if (ENABLE_NON_ETHER_DECODERS)
set(NON_ETHER_DECODERS
- cd_trk.cc
- cd_trk_module.h
- cd_trk_module.cc
- root_fddi.cc
- root_linuxsll.cc
- cd_ieee80211.cc
- cd_ieee80211_module.h
- cd_ieee80211_module.cc
- root_slip.cc
- root_i4lrawip.cc
- root_oldpflog.cc
- root_enc.cc
- root_ppp.cc
- root_pflog.cc
- root_pppserial.cc
- root_chdlc.cc
- root_i4lciscoip.cc
- prot_ipx.cc
- prot_eap.cc
+ cd_linux_sll.cc
+ cd_tr.cc
+ cd_tr_module.h
+ cd_tr_module.cc
+ cd_wlan.cc
+ cd_wlan_module.h
+ cd_wlan_module.cc
+# root_fddi.cc
+# root_slip.cc
+# root_i4lrawip.cc
+# root_oldpflog.cc
+# root_enc.cc
+# root_ppp.cc
+# root_pflog.cc
+# root_pppserial.cc
+# root_chdlc.cc
+# root_i4lciscoip.cc
+# prot_ipx.cc
+# prot_eap.cc
)
endif (ENABLE_NON_ETHER_DECODERS)
cd_eth_module.cc
cd_raw4.cc
cd_raw6.cc
- cd_null_root.cc
+ cd_null.cc
${NON_ETHER_DECODERS}
${PCAP_INCLUDE_DIR}/pcap.h # rebuild if a new libpcap is installed
)
cd_eth_module.cc \
cd_raw4.cc \
cd_raw6.cc \
-cd_null_root.cc
+cd_null.cc
if ENABLE_NON_ETHER_DECODER
if STATIC_DECODERS
libroot_codecs_a_SOURCES += \
-cd_trk.cc \
-cd_trk_module.h \
-cd_trk_module.cc \
-root_fddi.cc \
-root_linuxsll.cc \
-cd_ieee80211.cc \
-cd_ieee80211_module.h \
-cd_ieee80211_module.cc \
-root_slip.cc \
-root_i4lrawip.cc \
-root_oldpflog.cc \
-root_enc.cc \
-root_ppp.cc \
-root_pflog.cc \
-root_pppserial.cc \
-root_chdlc.cc \
-root_i4lciscoip.cc
+cd_linux_sll.cc \
+cd_tr.cc \
+cd_tr_module.h \
+cd_tr_module.cc \
+cd_wlan.cc \
+cd_wlan_module.h \
+cd_wlan_module.cc
+#root_fddi.cc \
+#root_slip.cc \
+#root_i4lrawip.cc \
+#root_oldpflog.cc \
+#root_enc.cc \
+#root_ppp.cc \
+#root_pflog.cc \
+#root_pppserial.cc \
+#root_chdlc.cc \
+#root_i4lciscoip.cc
else
ehlibdir = $(pkglibdir)/codecs
-ehlib_LTLIBRARIES = libcd_trk.la
-libcd_trk_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
-libcd_trk_la_LDFLAGS = -export-dynamic -shared
-libcd_trk_la_SOURCES = cd_trk.cc cd_trk_module.h cd_trk_module.cc
+ehlib_LTLIBRARIES = libcd_tr.la
+libcd_tr_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
+libcd_tr_la_LDFLAGS = -export-dynamic -shared
+libcd_tr_la_SOURCES = cd_tr.cc cd_tr_module.h cd_tr_module.cc
+
+ehlib_LTLIBRARIES += libcd_wlan.la
+libcd_wlan_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
+libcd_wlan_la_LDFLAGS = -export-dynamic -shared
+libcd_wlan_la_SOURCES = cd_wlan.cc cd_wlan_module.h cd_wlan_module.cc
+
+ehlib_LTLIBRARIES += libcd_linux_sll.la
+libcd_linux_sll_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
+libcd_linux_sll_la_LDFLAGS = -export-dynamic -shared
+libcd_linux_sll_la_SOURCES = cd_linux_sll.cc
endif
endif
-
/*
** Copyright (C) 2002-2013 Sourcefire, Inc.
** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
*/
-
#ifdef HAVE_CONFIG_H
#include "config.h"
#endif
#include "protocols/eth.h"
#include "codecs/codec_events.h"
#include "managers/packet_manager.h"
+#include "codecs/sf_protocols.h"
namespace
{
~EthCodec(){};
+ virtual PROTO_ID get_proto_id() { return PROTO_ETH; };
virtual void get_protocol_ids(std::vector<uint16_t>&) {};
virtual void get_data_link_type(std::vector<int>&);
virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in);
virtual bool update(Packet*, Layer*, uint32_t* len);
virtual void format(EncodeFlags, const Packet* p, Packet* c, Layer*);
-
- // DELETE
- #include "codecs/sf_protocols.h"
- virtual inline PROTO_ID get_proto_id() { return PROTO_ETH; };
-
};
-} // anonymous
+} // namespace
void EthCodec::get_data_link_type(std::vector<int>&v)
}
/* lay the ethernet structure over the packet data */
- p->eh = reinterpret_cast<const eth::EtherHdr *>(raw_pkt);
+ const eth::EtherHdr *eh = reinterpret_cast<const eth::EtherHdr *>(raw_pkt);
DEBUG_WRAP(
DebugMessage(DEBUG_DECODE, "%X:%X:%X:%X:%X:%X -> %X:%X:%X:%X:%X:%X\n",
- p->eh->ether_src[0],
- p->eh->ether_src[1], p->eh->ether_src[2], p->eh->ether_src[3],
- p->eh->ether_src[4], p->eh->ether_src[5], p->eh->ether_dst[0],
- p->eh->ether_dst[1], p->eh->ether_dst[2], p->eh->ether_dst[3],
- p->eh->ether_dst[4], p->eh->ether_dst[5]);
+ eh->ether_src[0],
+ eh->ether_src[1], eh->ether_src[2], eh->ether_src[3],
+ eh->ether_src[4], eh->ether_src[5], eh->ether_dst[0],
+ eh->ether_dst[1], eh->ether_dst[2], eh->ether_dst[3],
+ eh->ether_dst[4], eh->ether_dst[5]);
);
DEBUG_WRAP(
DebugMessage(DEBUG_DECODE, "type:0x%X len:0x%X\n",
- ntohs(p->eh->ether_type), p->pkth->pktlen)
+ ntohs(eh->ether_type), p->pkth->pktlen)
);
- next_prot_id = ntohs(p->eh->ether_type);
+ next_prot_id = ntohs(eh->ether_type);
if (next_prot_id > eth::min_ethertype() )
{
+ p->proto_bits |= PROTO_BIT__ETH;
lyr_len = eth::hdr_len();
return true;
}
void EthCodec::format(EncodeFlags f, const Packet* p, Packet* c, Layer* lyr)
{
eth::EtherHdr* ch = (eth::EtherHdr*)lyr->start;
- c->eh = ch;
if ( reverse(f) )
{
#include "codecs/decode_module.h"
-#define CD_ETH_NAME "codec_eth"
+#define CD_ETH_NAME "cd_eth"
class EthModule : public DecodeModule
{
+++ /dev/null
-/* $Id: decode.c,v 1.285 2013-06-29 03:03:00 rcombs Exp $ */
-
-/*
-** Copyright (C) 2002-2013 Sourcefire, Inc.
-** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-
-
-#ifdef HAVE_CONFIG_H
-#include "config.h"
-#endif
-
-#include "generators.h"
-#include "decode.h"
-#include "static_include.h"
-#include "log/log.h"
-
-#include "../decoder_includes.h"
-
-
-
-#define MINIMAL_IEEE80211_HEADER_LEN 10 /* Ack frames and others */
-#define IEEE802_11_DATA_HDR_LEN 24 /* Header for data packets */
-
-/*
- * Function: DecodeIEEE80211Pkt(Packet *, char *, DAQ_PktHdr_t*,
- * uint8_t*)
- *
- * Purpose: Decode those fun loving wireless LAN packets, one at a time!
- *
- * Arguments: p => pointer to the decoded packet struct
- * user => Utility pointer (unused)
- * pkthdr => ptr to the packet header
- * pkt => pointer to the real live packet data
- *
- * Returns: void function
- */
-void DecodeIEEE80211Pkt(Packet * p, const DAQ_PktHdr_t * pkthdr,
- const uint8_t * pkt)
-{
- uint32_t cap_len = pkthdr->caplen;
- PROFILE_VARS;
-
- PREPROC_PROFILE_START(decodePerfStats);
-
- dc.total_processed++;
-
- memset(p, 0, PKT_ZERO_LEN);
-
- p->pkth = pkthdr;
- p->pkt = pkt;
-
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Packet!\n"););
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "caplen: %lu pktlen: %lu\n",
- (unsigned long)cap_len, (unsigned long)pkthdr->pktlen););
-
- /* do a little validation */
- if(cap_len < MINIMAL_IEEE80211_HEADER_LEN)
- {
- if (ScLogVerbose())
- {
- ErrorMessage("Captured data length < IEEE 802.11 header length! "
- "(%d bytes)\n", cap_len);
- }
-
- PREPROC_PROFILE_END(decodePerfStats);
- return;
- }
- /* lay the wireless structure over the packet data */
- p->wifih = (WifiHdr *) pkt;
-
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "%X %X\n", *p->wifih->addr1,
- *p->wifih->addr2););
-
- /* determine frame type */
- switch(p->wifih->frame_control & 0x00ff)
- {
- /* management frames */
- case WLAN_TYPE_MGMT_ASREQ:
- case WLAN_TYPE_MGMT_ASRES:
- case WLAN_TYPE_MGMT_REREQ:
- case WLAN_TYPE_MGMT_RERES:
- case WLAN_TYPE_MGMT_PRREQ:
- case WLAN_TYPE_MGMT_PRRES:
- case WLAN_TYPE_MGMT_BEACON:
- case WLAN_TYPE_MGMT_ATIM:
- case WLAN_TYPE_MGMT_DIS:
- case WLAN_TYPE_MGMT_AUTH:
- case WLAN_TYPE_MGMT_DEAUTH:
- dc.wifi_mgmt++;
- break;
-
- /* Control frames */
- case WLAN_TYPE_CONT_PS:
- case WLAN_TYPE_CONT_RTS:
- case WLAN_TYPE_CONT_CTS:
- case WLAN_TYPE_CONT_ACK:
- case WLAN_TYPE_CONT_CFE:
- case WLAN_TYPE_CONT_CFACK:
- dc.wifi_control++;
- break;
- /* Data packets without data */
- case WLAN_TYPE_DATA_NULL:
- case WLAN_TYPE_DATA_CFACK:
- case WLAN_TYPE_DATA_CFPL:
- case WLAN_TYPE_DATA_ACKPL:
-
- dc.wifi_data++;
- break;
- case WLAN_TYPE_DATA_DTCFACK:
- case WLAN_TYPE_DATA_DTCFPL:
- case WLAN_TYPE_DATA_DTACKPL:
- case WLAN_TYPE_DATA_DATA:
- dc.wifi_data++;
-
- if(cap_len < IEEE802_11_DATA_HDR_LEN + sizeof(EthLlc))
- {
- codec_events::decoder_event(p, DECODE_BAD_80211_ETHLLC,
- DECODE_BAD_80211_ETHLLC_STR);
-
- PREPROC_PROFILE_END(decodePerfStats);
- return;
- }
-
- p->ehllc = (EthLlc *) (pkt + IEEE802_11_DATA_HDR_LEN);
-
-#ifdef DEBUG_MSGS
- LogNetData((uint8_t*) p->ehllc, sizeof(EthLlc), NULL);
-
- printf("LLC Header:\n");
- printf(" DSAP: 0x%X\n", p->ehllc->dsap);
- printf(" SSAP: 0x%X\n", p->ehllc->ssap);
-#endif
-
- if(p->ehllc->dsap == ETH_DSAP_IP && p->ehllc->ssap == ETH_SSAP_IP)
- {
- if(cap_len < IEEE802_11_DATA_HDR_LEN +
- sizeof(EthLlc) + sizeof(EthLlcOther))
- {
- codec_events::decoder_event(p, DECODE_BAD_80211_OTHER,
- DECODE_BAD_80211_OTHER_STR);
-
- PREPROC_PROFILE_END(decodePerfStats);
- return;
- }
-
- p->ehllcother = (EthLlcOther *) (pkt + IEEE802_11_DATA_HDR_LEN + sizeof(EthLlc));
-#ifdef DEBUG_MSGS
- LogNetData((uint8_t*)p->ehllcother, sizeof(EthLlcOther), NULL);
-
- printf("LLC Other Header:\n");
- printf(" CTRL: 0x%X\n", p->ehllcother->ctrl);
- printf(" ORG: 0x%02X%02X%02X\n", p->ehllcother->org_code[0],
- p->ehllcother->org_code[1], p->ehllcother->org_code[2]);
- printf(" PROTO: 0x%04X\n", ntohs(p->ehllcother->proto_id));
-#endif
-
- switch(ntohs(p->ehllcother->proto_id))
- {
- case ETHERNET_TYPE_IP:
- DecodeIP(p->pkt + IEEE802_11_DATA_HDR_LEN + sizeof(EthLlc) +
- sizeof(EthLlcOther),
- cap_len - IEEE802_11_DATA_HDR_LEN - sizeof(EthLlc) -
- sizeof(EthLlcOther), p);
- PREPROC_PROFILE_END(decodePerfStats);
- return;
-
- case ETHERNET_TYPE_ARP:
- case ETHERNET_TYPE_REVARP:
- DecodeARP(p->pkt + IEEE802_11_DATA_HDR_LEN + sizeof(EthLlc) +
- sizeof(EthLlcOther),
- cap_len - IEEE802_11_DATA_HDR_LEN - sizeof(EthLlc) -
- sizeof(EthLlcOther), p);
- PREPROC_PROFILE_END(decodePerfStats);
- return;
- case ETHERNET_TYPE_EAPOL:
- DecodeEapol(p->pkt + IEEE802_11_DATA_HDR_LEN + sizeof(EthLlc) +
- sizeof(EthLlcOther),
- cap_len - IEEE802_11_DATA_HDR_LEN - sizeof(EthLlc) -
- sizeof(EthLlcOther), p);
- PREPROC_PROFILE_END(decodePerfStats);
- return;
- case ETHERNET_TYPE_8021Q:
- DecodeVlan(p->pkt + IEEE802_11_DATA_HDR_LEN ,
- cap_len - IEEE802_11_DATA_HDR_LEN , p);
- PREPROC_PROFILE_END(decodePerfStats);
- return;
-
- case ETHERNET_TYPE_IPV6:
- DecodeIPV6(p->pkt + IEEE802_11_DATA_HDR_LEN,
- cap_len - IEEE802_11_DATA_HDR_LEN, p);
- PREPROC_PROFILE_END(decodePerfStats);
- return;
-
- default:
- // TBD add decoder drop event for unknown wifi/eth type
- dc.other++;
- PREPROC_PROFILE_END(decodePerfStats);
- return;
- }
- }
- break;
- default:
- // TBD add decoder drop event for unknown wlan frame type
- dc.other++;
- break;
- }
-
- PREPROC_PROFILE_END(decodePerfStats);
- return;
-}
-
-
--- /dev/null
+/*
+** Copyright (C) 2002-2013 Sourcefire, Inc.
+** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <pcap.h>
+#include "framework/codec.h"
+#include "protocols/linux_sll.h"
+#include "main/snort.h"
+
+
+namespace
+{
+
+#define CD_LINUX_SSL_NAME "cd_linux_sll"
+
+class LinuxSllCodec : public Codec
+{
+public:
+ LinuxSllCodec() : Codec(CD_LINUX_SSL_NAME){};
+ ~LinuxSllCodec() {};
+
+
+ virtual void get_data_link_type(std::vector<int>&);
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t raw_len,
+ Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
+};
+
+// Create your own Hdr Struct for this layer!
+struct NameHdr
+{
+ uint8_t ver;
+ uint8_t next_protocol;
+ uint16_t len;
+ // additional or different data
+};
+
+} // namespace
+
+
+void LinuxSllCodec::get_data_link_type(std::vector<int>&v)
+{
+#ifdef DLT_LINUX_SLL
+ v.push_back(DLT_LINUX_SLL);
+#endif
+}
+
+bool LinuxSllCodec::decode(const uint8_t *raw_pkt, const uint32_t raw_len,
+ Packet* /*p*/, uint16_t &lyr_len, uint16_t &next_prot_id)
+{
+ /* do a little validation */
+ if(raw_len < SLL_HDR_LEN)
+ {
+ if (ScLogVerbose())
+ {
+ ErrorMessage("Captured data length < SLL header length (your "
+ "libpcap is broken?)! (%d bytes)\n", raw_len);
+ }
+ return false;
+ }
+ /* lay the ethernet structure over the packet data */
+ const linux_sll::SLLHdr* sllh = reinterpret_cast<const linux_sll::SLLHdr*>(raw_pkt);
+
+ /* grab out the network type */
+ next_prot_id = ntohs(sllh->sll_protocol);
+ lyr_len = SLL_HDR_LEN;
+ return true;
+}
+
+
+
+//-------------------------------------------------------------------------
+// api
+//-------------------------------------------------------------------------
+
+static Codec* ctor(Module*)
+{
+ return new LinuxSllCodec();
+}
+
+static void dtor(Codec *cd)
+{
+ delete cd;
+}
+
+
+static const CodecApi linux_ssl_api =
+{
+ {
+ PT_CODEC,
+ CD_LINUX_SSL_NAME,
+ CDAPI_PLUGIN_V0,
+ 0,
+ nullptr,
+ nullptr,
+ },
+ nullptr,
+ nullptr,
+ nullptr,
+ nullptr,
+ ctor,
+ dtor,
+};
+
+
+#ifdef BUILDING_SO
+SO_PUBLIC const BaseApi* snort_plugins[] =
+{
+ &linux_ssl_api.base,
+ nullptr
+};
+#else
+const BaseApi* cd_linux_sll = &linux_ssl_api.base;
+#endif
+
namespace
{
-#define CD_NULL_NAME "codec_null"
+#define CD_NULL_NAME "cd_null"
-class NullRootCodec : public Codec
+class NullCodec : public Codec
{
public:
- NullRootCodec() : Codec(CD_NULL_NAME){};
- ~NullRootCodec() {};
+ NullCodec() : Codec(CD_NULL_NAME){};
+ ~NullCodec() {};
virtual bool decode(const uint8_t *raw_pkt, const uint32_t len,
*
* Returns: void function
*/
-bool NullRootCodec::decode(const uint8_t* /*raw_pkt*/, const uint32_t raw_len,
+bool NullCodec::decode(const uint8_t* /*raw_pkt*/, const uint32_t raw_len,
Packet* /*p*/, uint16_t &lyr_len, uint16_t &next_prot_id)
{
DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "NULL Packet!\n"); );
return true;
}
-void NullRootCodec::get_data_link_type(std::vector<int>&v)
+void NullCodec::get_data_link_type(std::vector<int>&v)
{
v.push_back(DLT_NULL);
}
static Codec* ctor(Module*)
{
- return new NullRootCodec();
+ return new NullCodec();
}
static void dtor(Codec *cd)
delete cd;
}
-static const CodecApi null_root_api =
+static const CodecApi null_api =
{
{
PT_CODEC,
#ifdef BUILDING_SO
SO_PUBLIC const BaseApi* snort_plugins[] =
{
- &null_root_api.base,
+ &null_api.base,
nullptr
};
#else
-const BaseApi* cd_null_root = &null_root_api.base;
+const BaseApi* cd_null = &null_api.base;
#endif
namespace
{
-#define CD_RAW4_NAME "codec_raw4"
+#define CD_RAW4_NAME "cd_raw4"
class Raw4Codec : public Codec
{
namespace
{
-#define CD_RAW6_NAME "codec_raw6"
+#define CD_RAW6_NAME "cd_raw6"
class Raw6Codec : public Codec
{
-/* $Id: decode.c,v 1.285 2013-06-29 03:03:00 rcombs Exp $ */
-
/*
** Copyright (C) 2002-2013 Sourcefire, Inc.
** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
#include "config.h"
#endif
-#include "decode.h"
+#include <pcap.h>
+#include "protocols/packet.h"
+#include "protocols/token_ring.h"
+#include "framework/codec.h"
+#include "codecs/codec_events.h"
+#include "codecs/root/cd_tr_module.h"
+namespace
+{
+class TrCodec : public Codec
+{
+public:
+ TrCodec() : Codec(CD_TR_NAME){};
+ ~TrCodec() {};
+ virtual void get_data_link_type(std::vector<int>&);
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t raw_len,
+ Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
+};
+
// THESE ARE NEVER USED!!
#define MINIMAL_TOKENRING_HEADER_LEN 22
// DELETE FIN
#define TR_ALEN 6 /* octets in an Ethernet header */
-#define IPARP_SAP 0xaa
#define AC 0x10
#define LLC_FRAME 0x40
#define TR_RCF_FRAME2K 0x20
#define TR_RCF_BROADCAST_MASK 0xC000
-/*
- * Function: DecodeTRPkt(Packet *, char *, DAQ_PktHdr_t*, uint8_t*)
- *
- * Purpose: Decode Token Ring packets!
- *
- * Arguments: p=> pointer to decoded packet struct
- * user => Utility pointer, unused
- * pkthdr => ptr to the packet header
- * pkt => pointer to the real live packet data
- *
- * Returns: void function
- */
-void DecodeTRPkt(Packet * p, const DAQ_PktHdr_t * pkthdr, const uint8_t * pkt)
+} // namespace
+
+
+void TrCodec::get_data_link_type(std::vector<int>&v)
{
- uint32_t cap_len = pkthdr->caplen;
- uint32_t dataoff; /* data offset is variable here */
- PROFILE_VARS;
+#ifdef DLT_IEEE802
+ v.push_back(DLT_IEEE802);
+#endif
+}
- PREPROC_PROFILE_START(decodePerfStats);
- dc.total_processed++;
+//void DecodeTRPkt(Packet * p, const DAQ_PktHdr_t * pkthdr, const uint8_t * pkt)
+bool TrCodec::decode(const uint8_t *raw_pkt, const uint32_t raw_len,
+ Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
+{
- memset(p, 0, PKT_ZERO_LEN);
+ uint32_t cap_len = raw_len;
+ uint32_t dataoff; /* data offset is variable here */
- p->pkth = pkthdr;
- p->pkt = pkt;
DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Packet!\n");
DebugMessage(DEBUG_DECODE, "caplen: %lu pktlen: %lu\n",
- (unsigned long)cap_len,(unsigned long) pkthdr->pktlen);
+ (unsigned long)cap_len,(unsigned long) raw_len);
);
- if(cap_len < sizeof(Trh_hdr))
+ if(cap_len < sizeof(token_ring::Trh_hdr))
{
DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
"Captured data length < Token Ring header length! "
"(%d < %d bytes)\n", cap_len, TR_HLEN););
- codec_events::decoder_event(p, DECODE_BAD_TRH, DECODE_BAD_TRH_STR);
-
- PREPROC_PROFILE_END(decodePerfStats);
- return;
+ codec_events::decoder_event(p, DECODE_BAD_TRH);
+ return false;
}
/* lay the tokenring header structure over the packet data */
- p->trh = (Trh_hdr *) pkt;
+ //const token_ring::Trh_hdr *trh = reinterpret_cast<const token_ring::Trh_hdr *>(raw_pkt);
/*
* according to rfc 1042:
* first I assume that we have single-ring network with no RIF
* information presented in frame
*/
- if(cap_len < (sizeof(Trh_hdr) + sizeof(Trh_llc)))
+ if(cap_len < (sizeof(token_ring::Trh_hdr) + sizeof(token_ring::Trh_llc)))
{
DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
"Captured data length < Token Ring header length! "
"(%d < %d bytes)\n", cap_len,
- (sizeof(Trh_hdr) + sizeof(Trh_llc))););
+ (sizeof(token_ring::Trh_hdr) + sizeof(token_ring::Trh_llc))););
- codec_events::decoder_event(p, DECODE_BAD_TR_ETHLLC, DECODE_BAD_TR_ETHLLC_STR);
-
- PREPROC_PROFILE_END(decodePerfStats);
- return;
+ codec_events::decoder_event(p, DECODE_BAD_TR_ETHLLC);
+ return false;
}
+ const token_ring::Trh_llc *trhllc =
+ reinterpret_cast<const token_ring::Trh_llc *>(raw_pkt + sizeof(token_ring::Trh_hdr));
- p->trhllc = (Trh_llc *) (pkt + sizeof(Trh_hdr));
-
- if(p->trhllc->dsap != IPARP_SAP && p->trhllc->ssap != IPARP_SAP)
+ if(trhllc->dsap != IPARP_SAP && trhllc->ssap != IPARP_SAP)
{
/*
* DSAP != SSAP != 0xAA .. either we are having frame which doesn't
* lattest ...
*/
- if(cap_len < (sizeof(Trh_hdr) + sizeof(Trh_llc) + sizeof(Trh_mr)))
+ if(cap_len < (sizeof(token_ring::Trh_hdr) + sizeof(token_ring::Trh_llc) + sizeof(token_ring::Trh_mr)))
{
DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
"Captured data length < Token Ring header length! "
"(%d < %d bytes)\n", cap_len,
- (sizeof(Trh_hdr) + sizeof(Trh_llc) + sizeof(Trh_mr))););
+ (sizeof(token_ring::Trh_hdr) + sizeof(token_ring::Trh_llc) + sizeof(token_ring::Trh_mr))););
- codec_events::decoder_event(p, DECODE_BAD_TRHMR, DECODE_BAD_TRHMR_STR);
-
- PREPROC_PROFILE_END(decodePerfStats);
- return;
+ codec_events::decoder_event(p, DECODE_BAD_TRHMR);
+ return false;
}
- p->trhmr = (Trh_mr *) (pkt + sizeof(Trh_hdr));
+ const token_ring::Trh_mr* trhmr =
+ reinterpret_cast<const token_ring::Trh_mr *>(raw_pkt + sizeof(token_ring::Trh_hdr));
- if(cap_len < (sizeof(Trh_hdr) + sizeof(Trh_llc) +
- sizeof(Trh_mr) + TRH_MR_LEN(p->trhmr)))
+ if(cap_len < (sizeof(token_ring::Trh_hdr) + sizeof(token_ring::Trh_llc) +
+ sizeof(token_ring::Trh_mr) + TRH_MR_LEN(trhmr)))
{
DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
"Captured data length < Token Ring header length! "
"(%d < %d bytes)\n", cap_len,
- (sizeof(Trh_hdr) + sizeof(Trh_llc) + sizeof(Trh_mr))););
-
- codec_events::decoder_event(p, DECODE_BAD_TR_MR_LEN, DECODE_BAD_TR_MR_LEN_STR);
+ (sizeof(token_ring::Trh_hdr) + sizeof(token_ring::Trh_llc) + sizeof(token_ring::Trh_mr))););
- PREPROC_PROFILE_END(decodePerfStats);
- return;
+ codec_events::decoder_event(p, DECODE_BAD_TR_MR_LEN);
+ return false;
}
- p->trhllc = (Trh_llc *) (pkt + sizeof(Trh_hdr) + TRH_MR_LEN(p->trhmr));
- dataoff = sizeof(Trh_hdr) + TRH_MR_LEN(p->trhmr) + sizeof(Trh_llc);
+ dataoff = sizeof(token_ring::Trh_hdr) + TRH_MR_LEN(trhmr) + sizeof(token_ring::Trh_llc);
}
else
{
- p->trhllc = (Trh_llc *) (pkt + sizeof(Trh_hdr));
- dataoff = sizeof(Trh_hdr) + sizeof(Trh_llc);
+ dataoff = sizeof(token_ring::Trh_hdr) + sizeof(token_ring::Trh_llc);
}
/*
* Assigned Numbers [7] (IP = 2048, ARP = 2054). .. but we would check
* SSAP and DSAP and assume this would be enough to trust.
*/
- if(p->trhllc->dsap != IPARP_SAP && p->trhllc->ssap != IPARP_SAP)
+ if(trhllc->dsap != IPARP_SAP && trhllc->ssap != IPARP_SAP)
{
DEBUG_WRAP(
DebugMessage(DEBUG_DECODE, "DSAP and SSAP arent set to SNAP\n");
);
- p->trhllc = NULL;
- PREPROC_PROFILE_END(decodePerfStats);
- return;
+ return false;
}
- switch(htons(p->trhllc->ethertype))
- {
- case ETHERNET_TYPE_IP:
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Decoding IP\n"););
- DecodeIP(p->pkt + dataoff, cap_len - dataoff, p);
- PREPROC_PROFILE_END(decodePerfStats);
- return;
-
- case ETHERNET_TYPE_ARP:
- case ETHERNET_TYPE_REVARP:
- DEBUG_WRAP(
- DebugMessage(DEBUG_DECODE, "Decoding ARP\n");
- );
- dc.arp++;
-
- PREPROC_PROFILE_END(decodePerfStats);
- return;
-
- case ETHERNET_TYPE_8021Q:
- DecodeVlan(p->pkt + dataoff, cap_len - dataoff, p);
- PREPROC_PROFILE_END(decodePerfStats);
- return;
-
- default:
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Unknown network protocol: %d\n",
- htons(p->trhllc->ethertype)));
- // TBD add decoder drop event for unknown tr/eth type
- dc.other++;
- PREPROC_PROFILE_END(decodePerfStats);
- return;
- }
+ lyr_len = dataoff;
+ next_prot_id = htons(trhllc->ethertype);
+ return true;
+}
- PREPROC_PROFILE_END(decodePerfStats);
- return;
+
+
+//-------------------------------------------------------------------------
+// api
+//-------------------------------------------------------------------------
+
+
+static Module* mod_ctor()
+{
+ return new TrCodecModule;
}
+static void mod_dtor(Module* m)
+{
+ delete m;
+}
+
+static Codec* ctor(Module*)
+{
+ return new TrCodec();
+}
+
+static void dtor(Codec *cd)
+{
+ delete cd;
+}
+
+
+static const CodecApi tr_api =
+{
+ {
+ PT_CODEC,
+ CD_TR_NAME,
+ CDAPI_PLUGIN_V0,
+ 0,
+ mod_ctor,
+ mod_dtor
+ },
+ nullptr,
+ nullptr,
+ nullptr,
+ nullptr,
+ ctor,
+ dtor,
+};
+
+
+#ifdef BUILDING_SO
+SO_PUBLIC const BaseApi* snort_plugins[] =
+{
+ &tr_api.base,
+ nullptr
+};
+#else
+const BaseApi* cd_tr = &tr_api.base;
+#endif
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// cd_arp_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
+
+#include "codecs/root/cd_tr_module.h"
+
+
+static const Parameter trk_params[] =
+{
+ { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
+};
+
+
+static const RuleMap trk_rules[] =
+{
+ { DECODE_BAD_TRH, "(" CD_TR_NAME ") Bad Token Ring Header" },
+ { DECODE_BAD_TR_ETHLLC, "(" CD_TR_NAME ") Bad Token Ring ETHLLC Header" },
+ { DECODE_BAD_TR_MR_LEN, "(" CD_TR_NAME ") Bad Token Ring MRLENHeader" },
+ { DECODE_BAD_TRHMR, "(" CD_TR_NAME ") Bad Token Ring MR Header" },
+ { 0, nullptr }
+};
+
+//-------------------------------------------------------------------------
+// token ring module
+//-------------------------------------------------------------------------
+
+TrCodecModule::TrCodecModule() : DecodeModule(CD_TR_NAME, trk_params, trk_rules)
+{ }
+
+bool TrCodecModule::set(const char*, Value&, SnortConfig*)
+{
+ return true;
+}
/*
-** Copyright (C) 2002-2013 Sourcefire, Inc.
-** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
**
** This program is free software; you can redistribute it and/or modify
** it under the terms of the GNU General Public License Version 2 as
** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
-#ifndef LAYER_H
-#define LAYER_H
+// cd_trk_module.h author Josh Rosenbaum <jrosenba@cisco.com>
-#include "codecs/sf_protocols.h"
+#ifndef CD_TRK_MODULE_H
+#define CD_TRK_MODULE_H
+#include "codecs/decode_module.h"
-struct Layer {
- uint16_t prot_id;
- PROTO_ID proto;
- uint16_t length;
- uint8_t* start;
-};
+#define CD_TR_NAME "cd_tr"
+
+class TrCodecModule : public DecodeModule
+{
+public:
+ TrCodecModule();
+
+ bool set(const char*, Value&, SnortConfig*);
+};
#endif
--- /dev/null
+/*
+** Copyright (C) 2002-2013 Sourcefire, Inc.
+** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <pcap.h>
+#include "framework/codec.h"
+#include "codecs/root/cd_wlan_module.h"
+#include "codecs/codec_events.h"
+#include "protocols/wlan.h"
+#include "protocols/protocol_ids.h"
+#include "main/snort.h"
+
+namespace
+{
+
+
+class WlanCodec : public Codec
+{
+public:
+ WlanCodec() : Codec(CD_WLAN_NAME){};
+ ~WlanCodec() {};
+
+
+ virtual bool decode(const uint8_t *raw_pkt, const uint32_t raw_len,
+ Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
+
+ virtual void get_data_link_type(std::vector<int>&);
+
+};
+
+struct EthLlc
+{
+ uint8_t dsap;
+ uint8_t ssap;
+} ;
+
+struct EthLlcOther
+{
+ uint8_t ctrl;
+ uint8_t org_code[3];
+ uint16_t proto_id;
+};
+
+#define MINIMAL_IEEE80211_HEADER_LEN 10 /* Ack frames and others */
+#define IEEE802_11_DATA_HDR_LEN 24 /* Header for data packets */
+
+} // namespace
+
+
+void WlanCodec::get_data_link_type(std::vector<int>&v)
+{
+#ifdef DLT_IEEE802_11
+ v.push_back(DLT_IEEE802_11);
+#endif
+}
+
+bool WlanCodec::decode(const uint8_t *raw_pkt, const uint32_t raw_len,
+ Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
+{
+ uint32_t cap_len = raw_len;
+ // reinterpret the raw data into this codec's data format
+
+
+ DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Packet!\n"););
+ DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "caplen: %lu pktlen: %lu\n",
+ (unsigned long)cap_len, (unsigned long)raw_len););
+
+ /* do a little validation */
+ if(cap_len < MINIMAL_IEEE80211_HEADER_LEN)
+ {
+ if (ScLogVerbose())
+ {
+ ErrorMessage("Captured data length < IEEE 802.11 header length! "
+ "(%d bytes)\n", cap_len);
+ }
+
+ return false;
+ }
+
+ /* lay the wireless structure over the packet data */
+ const wlan::WifiHdr *wifih = reinterpret_cast<const wlan::WifiHdr *>(raw_pkt);
+
+ DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "%X %X\n", *wifih->addr1,
+ *wifih->addr2););
+
+ /* determine frame type */
+ switch(wifih->frame_control & 0x00ff)
+ {
+ /* management frames */
+ case WLAN_TYPE_MGMT_ASREQ:
+ case WLAN_TYPE_MGMT_ASRES:
+ case WLAN_TYPE_MGMT_REREQ:
+ case WLAN_TYPE_MGMT_RERES:
+ case WLAN_TYPE_MGMT_PRREQ:
+ case WLAN_TYPE_MGMT_PRRES:
+ case WLAN_TYPE_MGMT_BEACON:
+ case WLAN_TYPE_MGMT_ATIM:
+ case WLAN_TYPE_MGMT_DIS:
+ case WLAN_TYPE_MGMT_AUTH:
+ case WLAN_TYPE_MGMT_DEAUTH:
+ break;
+
+ /* Control frames */
+ case WLAN_TYPE_CONT_PS:
+ case WLAN_TYPE_CONT_RTS:
+ case WLAN_TYPE_CONT_CTS:
+ case WLAN_TYPE_CONT_ACK:
+ case WLAN_TYPE_CONT_CFE:
+ case WLAN_TYPE_CONT_CFACK:
+ break;
+ /* Data packets without data */
+ case WLAN_TYPE_DATA_NULL:
+ case WLAN_TYPE_DATA_CFACK:
+ case WLAN_TYPE_DATA_CFPL:
+ case WLAN_TYPE_DATA_ACKPL:
+
+ break;
+ case WLAN_TYPE_DATA_DTCFACK:
+ case WLAN_TYPE_DATA_DTCFPL:
+ case WLAN_TYPE_DATA_DTACKPL:
+ case WLAN_TYPE_DATA_DATA:
+ {
+
+ if(cap_len < IEEE802_11_DATA_HDR_LEN + sizeof(EthLlc))
+ {
+ codec_events::decoder_event(p, DECODE_BAD_80211_ETHLLC);
+ return false;
+ }
+
+ const EthLlc *ehllc = reinterpret_cast<const EthLlc*>(raw_pkt + IEEE802_11_DATA_HDR_LEN);
+
+#ifdef DEBUG_MSGS
+ LogNetData((uint8_t*) ehllc, sizeof(EthLlc), NULL);
+
+ printf("LLC Header:\n");
+ printf(" DSAP: 0x%X\n", ehllc->dsap);
+ printf(" SSAP: 0x%X\n", ehllc->ssap);
+#endif
+
+ if(ehllc->dsap == ETH_DSAP_IP && ehllc->ssap == ETH_SSAP_IP)
+ {
+ if(cap_len < IEEE802_11_DATA_HDR_LEN +
+ sizeof(EthLlc) + sizeof(EthLlcOther))
+ {
+ codec_events::decoder_event(p, DECODE_BAD_80211_OTHER);
+ return false;
+ }
+
+ const EthLlcOther *ehllcother = reinterpret_cast<const EthLlcOther *>(raw_pkt + IEEE802_11_DATA_HDR_LEN + sizeof(EthLlc));
+#ifdef DEBUG_MSGS
+ LogNetData((uint8_t*)ehllcother, sizeof(EthLlcOther), NULL);
+
+ printf("LLC Other Header:\n");
+ printf(" CTRL: 0x%X\n", ehllcother->ctrl);
+ printf(" ORG: 0x%02X%02X%02X\n", ehllcother->org_code[0],
+ ehllcother->org_code[1], ehllcother->org_code[2]);
+ printf(" PROTO: 0x%04X\n", ntohs(ehllcother->proto_id));
+#endif
+ next_prot_id = ntohs(ehllcother->proto_id);
+
+ switch(ntohs(ehllcother->proto_id))
+ {
+ case ETHERTYPE_IPV4:
+ case ETHERTYPE_ARP:
+ case ETHERTYPE_REVARP:
+ case ETHERTYPE_EAPOL:
+ lyr_len = IEEE802_11_DATA_HDR_LEN + sizeof(EthLlc) + sizeof(EthLlcOther);
+
+
+ case ETHERTYPE_8021Q:
+ case ETHERTYPE_IPV6:
+ lyr_len = IEEE802_11_DATA_HDR_LEN;
+ default:
+ return false;
+ }
+ }
+ break;
+ }
+ default:
+ break;
+ }
+
+ return true;
+}
+
+
+
+//-------------------------------------------------------------------------
+// api
+//-------------------------------------------------------------------------
+
+static Module* mod_ctor()
+{
+ return new WlanCodecModule;
+}
+
+static void mod_dtor(Module* m)
+{
+ delete m;
+}
+
+static Codec* ctor(Module*)
+{
+ return new WlanCodec();
+}
+
+static void dtor(Codec *cd)
+{
+ delete cd;
+}
+
+
+static const CodecApi wlan_api =
+{
+ {
+ PT_CODEC,
+ CD_WLAN_NAME,
+ CDAPI_PLUGIN_V0,
+ 0,
+ mod_ctor,
+ mod_dtor
+ },
+ nullptr,
+ nullptr,
+ nullptr,
+ nullptr,
+ ctor,
+ dtor,
+};
+
+
+#ifdef BUILDING_SO
+SO_PUBLIC const BaseApi* snort_plugins[] =
+{
+ &wlan_api.base,
+ nullptr
+};
+#else
+const BaseApi* cd_wlan = &wlan_api.base;
+#endif
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// cd_ieee8021_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
+
+#include "codecs/root/cd_wlan_module.h"
+
+
+static const Parameter wifi_params[] =
+{
+ { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
+};
+
+
+static const RuleMap wifi_rules[] =
+{
+ { DECODE_BAD_80211_ETHLLC, "(" CD_WLAN_NAME ") Bad 802.11 LLC header" },
+ { DECODE_BAD_80211_OTHER, "(" CD_WLAN_NAME ") Bad 802.11 Extra LLC Info" },
+ { 0, nullptr }
+};
+
+//-------------------------------------------------------------------------
+// wifi module
+//-------------------------------------------------------------------------
+
+WlanCodecModule::WlanCodecModule() : DecodeModule(CD_WLAN_NAME, wifi_params, wifi_rules)
+{ }
+
+bool WlanCodecModule::set(const char*, Value&, SnortConfig*)
+{
+ return true;
+}
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// cd_wlan_module.h author Josh Rosenbaum <jrosenba@cisco.com>
+
+#ifndef CD_WLAN_MODULE_H
+#define CD_WLAN_MODULE_H
+
+#include "codecs/decode_module.h"
+
+
+#define CD_WLAN_NAME "cd_wlan"
+
+class WlanCodecModule : public DecodeModule
+{
+public:
+ WlanCodecModule();
+
+ bool set(const char*, Value&, SnortConfig*);
+};
+
+#endif
-/* $Id: decode.c,v 1.285 2013-06-29 03:03:00 rcombs Exp $ */
-
/*
** Copyright (C) 2002-2013 Sourcefire, Inc.
** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
#endif
#include "generators.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "static_include.h"
#include "decoder_includes.h"
void DecodeIPX(const uint8_t*, uint32_t, Packet *p)
{
DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "IPX is not supported.\n"););
-
dc.ipx++;
-
- if (p->greh != NULL)
- dc.gre_ipx++;
}
static const char* name = "ipx_decode";
static const CodecApi ipx_api =
{
- { PT_CODEC, name, CDAPI_PLUGIN_V0, 0 },
+ {
+ PT_CODEC,
+ name,
+ CDAPI_PLUGIN_V0,
+ 0,
+ nullptr,
+ nullptr,
+ },
{ETHERNET_TYPE_IPX},
- NULL, // pinit
- NULL, // pterm
- NULL, // tinit
- NULL, // tterm
- NULL, // ctor
- NULL, // dtor
- Ipx::Decode,
+ nullptr, // pinit
+ nullptr, // pterm
+ nullptr, // tinit
+ nullptr, // tterm
+ ctor, // ctor
+ dtor, // dtor
};
#endif
#include "generators.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "static_include.h"
#include "root_chdlc.h"
#endif
#include "generators.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "static_include.h"
#include "root_enc.h"
#endif
#include "generators.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "static_include.h"
#include "../decoder_includes.h"
+anonymous
+{
+
+/* FDDI header is always this: -worm5er */
+struct Fddi_hdr
+{
+ uint8_t fc; /* frame control field */
+ uint8_t daddr[FDDI_ALEN]; /* src address */
+ uint8_t saddr[FDDI_ALEN]; /* dst address */
+} Fddi_hdr;
+
+/* splitting the llc up because of variable lengths of the LLC -worm5er */
+struct Fddi_llc_saps
+{
+ uint8_t dsap;
+ uint8_t ssap;
+} Fddi_llc_saps;
+
+/* I've found sna frames have two addition bytes after the llc saps -worm5er */
+struct Fddi_llc_sna
+{
+ uint8_t ctrl_fld[2];
+} Fddi_llc_sna;
+
+/* I've also found other frames that seem to have only one byte... We're only
+really intersted in the IP data so, until we want other, I'm going to say
+the data is one byte beyond this frame... -worm5er */
+struct Fddi_llc_other
+{
+ uint8_t ctrl_fld[1];
+} Fddi_llc_other;
+
+/* Just like TR the ip/arp data is setup as such: -worm5er */
+struct Fddi_llc_iparp
+{
+ uint8_t ctrl_fld;
+ uint8_t protid[3];
+ uint16_t ethertype;
+} Fddi_llc_iparp;
+
+} // anonymous
+
/*
* Function: DecodeFDDIPkt(Packet *, char *, DAQ_PktHdr_t*, uint8_t*)
*
{
uint32_t cap_len = pkthdr->caplen;
uint32_t dataoff = sizeof(Fddi_hdr) + sizeof(Fddi_llc_saps);
- PROFILE_VARS;
-
- PREPROC_PROFILE_START(decodePerfStats);
-
- dc.total_processed++;
- memset(p, 0, PKT_ZERO_LEN);
- p->pkth = pkthdr;
- p->pkt = pkt;
DEBUG_WRAP(DebugMessage(DEBUG_DECODE,"Packet!\n");
DebugMessage(DEBUG_DECODE, "caplen: %lu pktlen: %lu\n",
#endif
#include "generators.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "static_include.h"
#include "root_i4lciscoip.h"
#endif
#include "generators.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "static_include.h"
#include "root_i4lrawip.h"
+++ /dev/null
-/* $Id: decode.c,v 1.285 2013-06-29 03:03:00 rcombs Exp $ */
-
-/*
-** Copyright (C) 2002-2013 Sourcefire, Inc.
-** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-
-
-#ifdef HAVE_CONFIG_H
-#include "config.h"
-#endif
-
-#include "generators.h"
-#include "decode.h"
-#include "static_include.h"
-
-
-#include "../decoder_includes.h"
-
-
-#ifdef DLT_LINUX_SLL // WHERE IS THIS DEFINED!!
-
-
-/*
- * Function: DecodeLinuxSLLPkt(Packet *, char *, DAQ_PktHdr_t*, uint8_t*)
- *
- * Purpose: Decode those fun loving LinuxSLL (linux cooked sockets)
- * packets, one at a time!
- *
- * Arguments: p => pointer to the decoded packet struct
- * user => Utility pointer (unused)
- * pkthdr => ptr to the packet header
- * pkt => pointer to the real live packet data
- *
- * Returns: void function
- */
-
-void DecodeLinuxSLLPkt(Packet * p, const DAQ_PktHdr_t * pkthdr, const uint8_t * pkt)
-{
- uint32_t cap_len = pkthdr->caplen;
- PROFILE_VARS;
-
- PREPROC_PROFILE_START(decodePerfStats);
-
- dc.total_processed++;
-
- memset(p, 0, PKT_ZERO_LEN);
-
- p->pkth = pkthdr;
- p->pkt = pkt;
-
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE,"Packet!\n");
- DebugMessage(DEBUG_DECODE, "caplen: %lu pktlen: %lu\n",
- (unsigned long)cap_len, (unsigned long)pkthdr->pktlen););
-
- /* do a little validation */
- if(cap_len < SLL_HDR_LEN)
- {
- if (ScLogVerbose())
- {
- ErrorMessage("Captured data length < SLL header length (your "
- "libpcap is broken?)! (%d bytes)\n", cap_len);
- }
- PREPROC_PROFILE_END(decodePerfStats);
- return;
- }
- /* lay the ethernet structure over the packet data */
- p->sllh = (SLLHdr *) pkt;
-
- /* grab out the network type */
- switch(ntohs(p->sllh->sll_protocol))
- {
- case ETHERNET_TYPE_IP:
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
- "IP datagram size calculated to be %lu bytes\n",
- (unsigned long)(cap_len - SLL_HDR_LEN)););
-
- DecodeIP(p->pkt + SLL_HDR_LEN, cap_len - SLL_HDR_LEN, p);
- PREPROC_PROFILE_END(decodePerfStats);
- return;
-
- case ETHERNET_TYPE_ARP:
- case ETHERNET_TYPE_REVARP:
- DecodeARP(p->pkt + SLL_HDR_LEN, cap_len - SLL_HDR_LEN, p);
- PREPROC_PROFILE_END(decodePerfStats);
- return;
-
- case ETHERNET_TYPE_IPV6:
- DecodeIPV6(p->pkt + SLL_HDR_LEN, (cap_len - SLL_HDR_LEN), p);
- PREPROC_PROFILE_END(decodePerfStats);
- return;
-
- case ETHERNET_TYPE_IPX:
- DecodeIPX(p->pkt + SLL_HDR_LEN, (cap_len - SLL_HDR_LEN), p);
- PREPROC_PROFILE_END(decodePerfStats);
- return;
-
- case LINUX_SLL_P_802_3:
- DEBUG_WRAP(DebugMessage(DEBUG_DATALINK,
- "Linux SLL P 802.3 is not supported.\n"););
- // TBD add decoder drop event for unsupported linux sll p 802.3
- dc.other++;
- PREPROC_PROFILE_END(decodePerfStats);
- return;
-
- case LINUX_SLL_P_802_2:
- DEBUG_WRAP(DebugMessage(DEBUG_DATALINK,
- "Linux SLL P 802.2 is not supported.\n"););
- // TBD add decoder drop event for unsupported linux sll p 802.2
- dc.other++;
- PREPROC_PROFILE_END(decodePerfStats);
- return;
-
- case ETHERNET_TYPE_8021Q:
- DecodeVlan(p->pkt + SLL_HDR_LEN, cap_len - SLL_HDR_LEN, p);
- PREPROC_PROFILE_END(decodePerfStats);
- return;
-
- default:
- /* shouldn't go here unless pcap library changes again */
- /* should be a DECODE generated alert */
- DEBUG_WRAP(DebugMessage(DEBUG_DATALINK,"(Unknown) %X is not supported. "
- "(need tcpdump snapshots to test. Please contact us)\n",
- p->sllh->sll_protocol););
- // TBD add decoder drop event for unknown sll encapsulation
- dc.other++;
- PREPROC_PROFILE_END(decodePerfStats);
- return;
- }
-
- PREPROC_PROFILE_END(decodePerfStats);
- return;
-}
-#endif /* DLT_LINUX_SLL */
-
#endif
#include "generators.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "static_include.h"
#include "root_oldpflog.h"
#endif
#include "generators.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "static_include.h"
#include "root_pflog.h"
#include "../decoder_includes.h"
+namespace
+{
+
+
+/*
+ * Snort supports 3 versions of the OpenBSD pflog header:
+ *
+ * Pflog1_Hdr: CVS = 1.3, DLT_OLD_PFLOG = 17, Length = 28
+ * Pflog2_Hdr: CVS = 1.8, DLT_PFLOG = 117, Length = 48
+ * Pflog3_Hdr: CVS = 1.12, DLT_PFLOG = 117, Length = 64
+ * Pflog3_Hdr: CVS = 1.172, DLT_PFLOG = 117, Length = 100
+ *
+ * Since they have the same DLT, Pflog{2,3}Hdr are distinguished
+ * by their actual length. The minimum required length excludes
+ * padding.
+ */
+/* Old OpenBSD pf firewall pflog0 header
+ * (information from pf source in kernel)
+ * the rule, reason, and action codes tell why the firewall dropped it -fleck
+ */
+
+struct Pflog1Hdr
+{
+ uint32_t af;
+ char intf[IFNAMSIZ];
+ int16_t rule;
+ uint16_t reason;
+ uint16_t action;
+ uint16_t dir;
+};
+
+#define PFLOG1_HDRLEN (sizeof(struct _Pflog1_hdr))
+
+/*
+ * Note that on OpenBSD, af type is sa_family_t. On linux, that's an unsigned
+ * short, but on OpenBSD, that's a uint8_t, so we should explicitly use uint8_t
+ * here. - ronaldo
+ */
+
+#define PFLOG_RULELEN 16
+#define PFLOG_PADLEN 3
+
+struct Pflog2Hdr
+{
+ int8_t length;
+ uint8_t af;
+ uint8_t action;
+ uint8_t reason;
+ char ifname[IFNAMSIZ];
+ char ruleset[PFLOG_RULELEN];
+ uint32_t rulenr;
+ uint32_t subrulenr;
+ uint8_t dir;
+ uint8_t pad[PFLOG_PADLEN];
+} ;
+
+#define PFLOG2_HDRLEN (sizeof(struct _Pflog2_hdr))
+#define PFLOG2_HDRMIN (PFLOG2_HDRLEN - PFLOG_PADLEN)
+
+struct Pflog3Hdr
+{
+ int8_t length;
+ uint8_t af;
+ uint8_t action;
+ uint8_t reason;
+ char ifname[IFNAMSIZ];
+ char ruleset[PFLOG_RULELEN];
+ uint32_t rulenr;
+ uint32_t subrulenr;
+ uint32_t uid;
+ uint32_t pid;
+ uint32_t rule_uid;
+ uint32_t rule_pid;
+ uint8_t dir;
+ uint8_t pad[PFLOG_PADLEN];
+};
+
+#define PFLOG3_HDRLEN (sizeof(struct _Pflog3_hdr))
+#define PFLOG3_HDRMIN (PFLOG3_HDRLEN - PFLOG_PADLEN)
+
+
+struct Pflog4Hdr
+{
+ uint8_t length;
+ uint8_t af;
+ uint8_t action;
+ uint8_t reason;
+ char ifname[IFNAMSIZ];
+ char ruleset[PFLOG_RULELEN];
+ uint32_t rulenr;
+ uint32_t subrulenr;
+ uint32_t uid;
+ uint32_t pid;
+ uint32_t rule_uid;
+ uint32_t rule_pid;
+ uint8_t dir;
+ uint8_t rewritten;
+ uint8_t pad[2];
+ uint8_t saddr[16];
+ uint8_t daddr[16];
+ uint16_t sport;
+ uint16_t dport;
+};
+
+#define PFLOG4_HDRLEN sizeof(struct _Pflog4_hdr)
+#define PFLOG4_HDRMIN sizeof(struct _Pflog4_hdr)
+
+} // namespace
/*
* Function: DecodePflog(Packet *, DAQ_PktHdr_t *, uint8_t *)
#endif
#include "generators.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "static_include.h"
#include "root_ppp.h"
#endif
#include "generators.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "static_include.h"
#include "root_pppserial.h"
#endif
#include "generators.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "static_include.h"
#include "root_slip.h"
// v.push_back(PROTO_TYPE);
}
-bool NameCodec::decode(const uint8_t *raw_pkt, const uint32_t raw_len,
+bool NameCodec::decode(const uint8_t *raw_pkt, const uint32_t raw_len,
Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
{
// reinterpret the raw data into this codec's data format
#endif
#include "snort_debug.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "rules.h"
#include "treenodes.h"
#include "parser.h"
#endif
#include "snort_types.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "detect.h"
#include "snort.h"
#include "snort_debug.h"
return fpEvalHeaderIp(p, ip_proto, omd);
}
-void fpEvalIpProtoOnlyRules(SF_LIST **ip_proto_only_lists, Packet *p)
-{
- if ((p != NULL) && IPH_IS_VALID(p))
- {
- SF_LIST *l = ip_proto_only_lists[GET_IPH_PROTO(p)];
- OptTreeNode *otn;
-
- /* If list is NULL, sflist_first returns NULL */
- for (otn = (OptTreeNode *)sflist_first(l);
- otn != NULL;
- otn = (OptTreeNode *)sflist_next(l))
- {
- if (fpEvalRTN(getRuntimeRtnFromOtn(otn), p, 0))
- {
- if ( SnortEventqAdd(otn) )
- pc.queue_limit++;
-
- if ( pass_action(getRuntimeRtnFromOtn(otn)->type) )
- p->packet_flags |= PKT_PASS_RULE;
- }
- }
- }
-}
-
void fpEvalIpProtoOnlyRules(SF_LIST **ip_proto_only_lists, Packet *p, uint8_t proto_id)
{
if ((p != NULL) && IPH_IS_VALID(p))
#include "fpcreate.h"
#include "snort_debug.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "sflsq.h"
#include "time/profiler.h"
void otnx_match_data_term();
int fpAddMatch( OTNX_MATCH_DATA *omd_local, int pLen, OptTreeNode *otn);
-void fpEvalIpProtoOnlyRules(SF_LIST **, Packet *);
void fpEvalIpProtoOnlyRules(SF_LIST **, Packet *, uint8_t proto_id);
OptTreeNode * GetOTN(uint32_t gid, uint32_t sid);
#ifndef PCRM_H
#define PCRM_H
-#include "decode.h"
#include "bitop.h"
+#include "protocols/packet.h"
typedef void * RULE_PTR;
#include <string.h>
#include <ctype.h>
-#include "decode.h"
+#include "protocols/packet.h"
#include "rules.h"
#include "treenodes.h"
#include "snort_debug.h"
#include "rules.h"
#include "treenodes.h"
#include "event.h"
-#include "decode.h"
+#include "protocols/packet.h"
#define TAG_SESSION 1
#include "snort_bounds.h"
#include "util.h"
#include "search_engines/str_search.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "detection_util.h"
MimePcre mime_boundary_pcre;
#include "ipv6_port.h"
#include "sfxhash.h"
#include "util.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "packet_io/active.h"
#include "libs/file_sha256.h"
#ifndef FILE_RESUME_BLOCK_H
#define FILE_RESUME_BLOCK_H
-#include "decode.h"
+#include "protocols/packet.h"
#include "file_api.h"
void file_resume_block_init(void);
/* @ingroup rate_filter
* @{
*/
-#include "decode.h"
+#include "protocols/packet.h"
#include "rules.h"
#include "treenodes.h"
#include "filters/sfrf.h"
session.h
)
-set_target_properties(flow
- PROPERTIES
- COMPILE_FLAGS "-fvisibility=default"
+set_default_visibility_compile_flag(flow)
+
+target_link_libraries(flow
+ protocols
)
install(FILES ${FLOW_INCLUDES}
#ifndef EXPECT_CACHE_H
#define EXPECT_CACHE_H
-#include "decode.h"
+#include "protocols/packet.h"
#include "ipv6_port.h"
class FlowData;
#include "ips_options/ips_flowbits.h"
#include "utils/bitop_funcs.h"
#include "utils/util.h"
-#include "protocols/decode.h"
+#include "protocols/packet.h"
unsigned FlowData:: flow_id = 0;
#include "packet_io/sfdaq.h"
#include "main/binder.h"
#include "utils/stats.h"
+#include "protocols/layer.h"
+#include "protocols/vlan.h"
FlowControl::FlowControl()
{
uint16_t vlanId;
uint16_t addressSpaceId;
- if ( p->vh )
- vlanId = (uint16_t)VTH_VLAN(p->vh);
+ if ( p->proto_bits & PROTO_BIT__VLAN )
+ vlanId = vlan::vth_vlan(layer::get_vlan_layer(p));
else
vlanId = 0;
- if ( p->mpls )
+ if ( p->proto_bits & PROTO_BIT__MPLS )
mplsId = p->mplsHdr.label;
else
mplsId = 0;
#include "config.h"
#endif
-#include "protocols/decode.h"
+#include "protocols/packet.h"
#include "snort.h"
#include "utils/util.h"
}
else if ( proto == IPPROTO_ICMPV6 )
{
- if (srcPort == ICMP6_REPLY)
+ if (srcPort == icmp6::Icmp6Types::REPLY)
{
- dstPort = ICMP6_ECHO; /* Treat ICMPv6 echo reply the same as request */
+ dstPort = icmp6::Icmp6Types::ECHO; /* Treat ICMPv6 echo reply the same as request */
srcPort = 0;
}
else /* otherwise, every ICMP type gets different key */
#define CODEC_H
#include <vector>
+#include <cstdint>
#include "snort_types.h"
#include "framework/base_api.h"
+#include "codecs/sf_protocols.h"
+#include "protocols/icmp4.h"
#include "packet.h"
-
-// REMOVE WHEN POSSIBLE!!!
-
-
+struct Packet;
struct Layer;
-typedef enum {
- ENC_TCP_FIN, ENC_TCP_RST,
- ENC_UNR_NET, ENC_UNR_HOST,
- ENC_UNR_PORT, ENC_UNR_FW,
+enum EncodeType{
+ ENC_TCP_FIN,
+ ENC_TCP_RST,
+ ENC_UNR_NET,
+ ENC_UNR_HOST,
+ ENC_UNR_PORT,
+ ENC_UNR_FW,
ENC_TCP_PUSH,
ENC_MAX
-} EncodeType;
-
-#define ENC_FLAG_FWD 0x80000000 // send in forward direction
-#define ENC_FLAG_SEQ 0x40000000 // VAL bits contain seq adj
-#define ENC_FLAG_ID 0x20000000 // use randomized IP ID
-#define ENC_FLAG_NET 0x10000000 // stop after innermost network (ip4/6) layer
-#define ENC_FLAG_DEF 0x08000000 // stop before innermost ip4 opts or ip6 frag header
-#define ENC_FLAG_RAW 0x04000000 // don't encode outer eth header (this is raw ip)
-#define ENC_FLAG_RES 0x03000000 // bits reserved for future use
-#define ENC_FLAG_VAL 0x00FFFFFF // bits for adjusting seq and/or ack
-const uint8_t MIN_TTL = 64;
-const uint8_t MAX_TTL = 255;
+};
+
typedef uint32_t EncodeFlags;
+const uint32_t ENC_FLAG_FWD = 0x80000000; // send in forward direction
+const uint32_t ENC_FLAG_SEQ = 0x40000000; // VAL bits contain seq adj
+const uint32_t ENC_FLAG_ID = 0x20000000; // use randomized IP ID
+const uint32_t ENC_FLAG_NET = 0x10000000; // stop after innermost network (ip4/6) layer
+const uint32_t ENC_FLAG_DEF = 0x08000000; // stop before innermost ip4 opts or ip6 frag header
+const uint32_t ENC_FLAG_RAW = 0x04000000; // don't encode outer eth header (this is raw ip)
+const uint32_t ENC_FLAG_RES = 0x03000000; // bits reserved for future use
+const uint32_t ENC_FLAG_VAL = 0x00FFFFFF; // bits for adjusting seq and/or ack
+
-typedef struct {
+struct EncState{
EncodeType type;
EncodeFlags flags;
const uint8_t* payLoad;
uint32_t payLen;
uint8_t proto;
-
-} EncState;
+};
// Copied from dnet/blob.h
};
-static inline bool forward(const EncState *e)
-{
- return e->flags & ENC_FLAG_FWD;
-}
-
-static inline bool reverse(const EncodeFlags f)
-{
- return !(f & ENC_FLAG_FWD);
-}
-
-static inline uint16_t get_decoded_length(EncState *enc)
-{
- return enc->p->layers[enc->layer-1].length;
-}
-
-// Update's the buffer to contain an additional
+// Update's the buffer to contain an additional
static inline bool update_buffer(Buffer* buf, size_t n)
{
if ( buf->end + n > (unsigned int)buf->size )
}
-
-
class Codec
{
public:
virtual bool update(Packet*, Layer*, uint32_t* /*len*/) { return true; };
// formatter
virtual void format(EncodeFlags, const Packet* /*orig*/, Packet* /*clone*/, Layer*) {};
-
- // DELETE
- virtual inline PROTO_ID get_proto_id() { return PROTO_AH; };
+ // used for backwards compatability.
+ virtual PROTO_ID get_proto_id() { return PROTO_AH; };
protected:
};
- inline uint8_t buff_diff(Buffer *buf, uint8_t* ho)
+ static inline bool forward(const EncState *e)
+ {
+ return e->flags & ENC_FLAG_FWD;
+ }
+
+ static inline bool reverse(const EncodeFlags f)
+ {
+ return !(f & ENC_FLAG_FWD);
+ }
+
+ static inline uint16_t get_decoded_length(EncState *enc)
+ {
+ return enc->p->layers[enc->layer-1].length;
+ }
+
+
+ static inline uint8_t buff_diff(Buffer *buf, uint8_t* ho)
{
return ((uint8_t*)(buf->base+buf->end)-(uint8_t*)ho);
}
- inline icmp4::IcmpCode get_icmp_code (EncodeType et) {
+ static inline icmp4::IcmpCode get_icmp_code (EncodeType et)
+ {
switch ( et ) {
case EncodeType::ENC_UNR_NET: return icmp4::IcmpCode::NET_UNREACH;
case EncodeType::ENC_UNR_HOST: return icmp4::IcmpCode::HOST_UNREACH;
}
+
private:
const char* name;
};
const uint8_t *start, const uint8_t *end,
uint32_t *value)
{
- if(endianess != LITTLE && endianess != BIG)
+ if(endianess != ENDIAN_LITTLE && endianess != ENDIAN_BIG)
{
/* we only support 2 byte formats */
return -2;
*value = (*ptr) & 0xFF;
break;
case 2:
- if(endianess == LITTLE)
+ if(endianess == ENDIAN_LITTLE)
{
*value = (*ptr) & 0xFF;
*value |= (*(ptr + 1) & 0xFF) << 8;
}
break;
case 3:
- if (endianess == LITTLE)
+ if (endianess == ENDIAN_LITTLE)
{
*value = (*ptr) & 0xFF;
*value |= ((*(ptr + 1)) & 0xFF) << 8;
}
break;
case 4:
- if(endianess == LITTLE)
+ if(endianess == ENDIAN_LITTLE)
{
*value = (*ptr) & 0xFF;
*value |= ((*(ptr + 1)) & 0xFF) << 8;
value3[2] = 0x00;
value3[3] = 0x00;
- if(byte_extract(BIG, 2, value1, value1, value1 + 2, &ret))
+ if(byte_extract(ENDIAN_BIG, 2, value1, value1, value1 + 2, &ret))
{
printf("test 1 failed\n");
}
printf("test 1: value: %x %u\n", ret, ret);
}
- if(byte_extract(LITTLE, 2, value1, value1, value1 + 2, &ret))
+ if(byte_extract(ENDIAN_LITTLE, 2, value1, value1, value1 + 2, &ret))
{
printf("test 2 failed\n");
}
}
- if(byte_extract(LITTLE, 2, value1 + 2, value1, value1 + 2, &ret))
+ if(byte_extract(ENDIAN_LITTLE, 2, value1 + 2, value1, value1 + 2, &ret))
{
printf("test 3 failed correctly\n");
}
}
- if(byte_extract(BIG, 2, value2, value2, value2 + 2, &ret))
+ if(byte_extract(ENDIAN_BIG, 2, value2, value2, value2 + 2, &ret))
{
printf("test 1 failed\n");
}
printf("test 1: value: %x %u\n", ret, ret);
}
- if(byte_extract(LITTLE, 2, value2, value2, value2 + 2, &ret))
+ if(byte_extract(ENDIAN_LITTLE, 2, value2, value2, value2 + 2, &ret))
{
printf("test 2 failed\n");
}
}
- if(byte_extract(LITTLE, 2, value2 + 2, value2, value2 + 2, &ret))
+ if(byte_extract(ENDIAN_LITTLE, 2, value2 + 2, value2, value2 + 2, &ret))
{
printf("test 3 failed correctly\n");
}
}
- if(byte_extract(BIG, 4, value3, value3, value3 + 4, &ret))
+ if(byte_extract(ENDIAN_BIG, 4, value3, value3, value3 + 4, &ret))
{
printf("test 1 failed\n");
}
printf("test 1: value: %x %u\n", ret, ret);
}
- if(byte_extract(LITTLE, 4, value3, value3, value3 + 4, &ret))
+ if(byte_extract(ENDIAN_LITTLE, 4, value3, value3, value3 + 4, &ret))
{
printf("test 2 failed\n");
}
}
- if(byte_extract(LITTLE, 4, value3 + 2, value3, value3 + 4, &ret))
+ if(byte_extract(ENDIAN_LITTLE, 4, value3 + 2, value3, value3 + 4, &ret))
{
printf("test 3 failed correctly\n");
}
for(i=0;i<10;i++)
{
- if(byte_extract(LITTLE, 4, value3 + i, value3, value3 + 4, &ret))
+ if(byte_extract(ENDIAN_LITTLE, 4, value3 + i, value3, value3 + 4, &ret))
{
printf("[loop] %d failed correctly\n", i);
}
#define EXTRACT_H
#define ENDIAN_NONE -1
-#define BIG 0
-#define LITTLE 1
+#define ENDIAN_BIG 0
+#define ENDIAN_LITTLE 1
#define ENDIAN_FUNC 2
#define PARSELEN 10
#include "snort_types.h"
#include "detection/treenodes.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "parser.h"
#include "snort_debug.h"
#include "util.h"
#include "snort_bounds.h"
#include "snort_debug.h"
#include "detection/treenodes.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "parser.h"
#include "util.h"
#include "asn1.h"
#include "snort_types.h"
#include "snort_bounds.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "parser.h"
#include "snort_debug.h"
#include "util.h"
#include "snort_types.h"
#include "snort_bounds.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "parser.h"
#include "snort_debug.h"
#include "util.h"
else if (strcmp(token, "little") == 0)
{
if (data->endianess == ENDIAN_NONE)
- data->endianess = LITTLE;
+ data->endianess = ENDIAN_LITTLE;
else
ParseError("byte_extract rule option specifies the "
"byte order twice. Use only one of 'big', 'little', "
else if (strcmp(token, "big") == 0)
{
if (data->endianess == ENDIAN_NONE)
- data->endianess = BIG;
+ data->endianess = ENDIAN_BIG;
else
ParseError("byte_extract rule option specifies the "
"byte order twice. Use only one of 'big', 'little', "
/* Replace sentinels with defaults */
if (data->endianess == ENDIAN_NONE)
- data->endianess = BIG;
+ data->endianess = ENDIAN_BIG;
if (data->data_string_convert_flag && (data->base == 0))
data->base = 10;
#include "snort_types.h"
#include "snort_bounds.h"
#include "detection/treenodes.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "parser.h"
#include "snort_debug.h"
#include "util.h"
}
else if(!strcasecmp(cptr, "little"))
{
- idx->endianess = LITTLE;
+ idx->endianess = ENDIAN_LITTLE;
}
else if(!strcasecmp(cptr, "big"))
{
/* this is the default */
- idx->endianess = BIG;
+ idx->endianess = ENDIAN_BIG;
}
else if(!strcasecmp(cptr, "hex"))
{
#include "snort_bounds.h"
#include "extract.h"
#include "detection/treenodes.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "parser.h"
#include "snort_debug.h"
#include "util.h"
#include "snort_types.h"
#include "detection/treenodes.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "parser.h"
#include "snort_debug.h"
#include "util.h"
#include "snort_types.h"
#include "detection/treenodes.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "snort_debug.h"
#include "parser.h"
#include "util.h"
#include "snort_types.h"
#include "snort_bounds.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "parser.h"
#include "snort_debug.h"
#include "util.h"
#include "snort_types.h"
#include "detection/treenodes.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "parser.h"
#include "snort_debug.h"
#include "util.h"
#include "snort_types.h"
#include "detection/treenodes.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "parser.h"
#include "snort_debug.h"
#include "util.h"
#include "snort_types.h"
#include "detection/treenodes.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "parser.h"
#include "snort_debug.h"
#include "util.h"
#include "snort_types.h"
#include "detection/treenodes.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "parser.h"
#include "snort_debug.h"
#include "util.h"
#include "snort_types.h"
#include "detection/treenodes.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "parser.h"
#include "snort_debug.h"
#include "util.h"
#include "snort_types.h"
#include "snort_bounds.h"
#include "detection/treenodes.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "parser.h"
#include "snort_debug.h"
#include "util.h"
#include "snort_types.h"
#include "detection/treenodes.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "parser.h"
#include "snort_debug.h"
#include "util.h"
PREPROC_PROFILE_START(icmpIdPerfStats);
if( (p->icmph->type == ICMP_ECHO || p->icmph->type == ICMP_ECHOREPLY)
- || ((uint16_t)p->icmph->type == ICMP6_ECHO || (uint16_t)p->icmph->type == ICMP6_REPLY)
+ || ((uint16_t)p->icmph->type == icmp6::Icmp6Types::ECHO || (uint16_t)p->icmph->type == icmp6::Icmp6Types::REPLY)
)
{
/* test the rule ID value against the ICMP extension ID field */
#include "snort_types.h"
#include "detection/treenodes.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "parser.h"
#include "snort_debug.h"
#include "util.h"
PREPROC_PROFILE_START(icmpSeqPerfStats);
if( (p->icmph->type == ICMP_ECHO || p->icmph->type == ICMP_ECHOREPLY)
- || ((uint16_t)p->icmph->type == ICMP6_ECHO || (uint16_t)p->icmph->type == ICMP6_REPLY)
+ || ((uint16_t)p->icmph->type == icmp6::Icmp6Types::ECHO || (uint16_t)p->icmph->type == icmp6::Icmp6Types::REPLY)
)
{
/* test the rule ID value against the ICMP extension ID field */
#include "snort_types.h"
#include "treenodes.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "parser.h"
#include "util.h"
#include "snort_debug.h"
#include "snort_types.h"
#include "treenodes.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "parser.h"
#include "snort_debug.h"
#include "util.h"
#include <netdb.h>
#include "treenodes.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "parser.h"
#include "snort_debug.h"
#include "util.h"
#include "snort_types.h"
#include "treenodes.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "parser.h"
#include "snort_debug.h"
#include "util.h"
#include "snort_types.h"
#include "snort_bounds.h"
#include "treenodes.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "parser.h"
#include "snort_debug.h"
#include "util.h"
#include "snort_types.h"
#include "treenodes.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "parser.h"
#include "snort_debug.h"
#include "util.h"
#include "snort_bounds.h"
#include "treenodes.h"
#include "snort_debug.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "parser.h"
#include "util.h"
#include "mstring.h"
#include "snort_types.h"
#include "snort_bounds.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "parser.h"
#include "snort_debug.h"
#include "util.h"
#include "snort_types.h"
#include "snort_debug.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "managers/packet_manager.h"
#include "detection/detection_defines.h"
#include "parser.h"
#include "snort_types.h"
#include "snort_bounds.h"
#include "snort_debug.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "managers/packet_manager.h"
#include "detection/detection_defines.h"
#include "mstring.h"
#include <rpc/rpc.h>
#include "treenodes.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "parser.h"
#include "snort_debug.h"
#include "util.h"
#include "snort_types.h"
#include "treenodes.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "parser.h"
#include "snort_debug.h"
#include "util.h"
#include "snort_types.h"
#include "treenodes.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "parser.h"
#include "util.h"
#include "snort_debug.h"
#include <string>
#include "treenodes.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "parser.h"
#include "snort_debug.h"
#include "util.h"
#include <ctype.h>
#include <string.h>
-#include "decode.h"
+#include "protocols/packet.h"
#include "parser.h"
#include "snort_debug.h"
#include "util.h"
#include "snort_types.h"
#include "treenodes.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "snort_debug.h"
#include "parser.h"
#include "util.h"
#include "snort_types.h"
#include "treenodes.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "snort_debug.h"
#include "parser.h"
#include "util.h"
#include "snort_types.h"
#include "treenodes.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "parser.h"
#include "util.h"
#include "snort_debug.h"
#include "snort_types.h"
#include "snort_bounds.h"
#include "snort_debug.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "parser.h"
#include "ips_content.h"
#include "snort.h"
target_link_libraries(log
utils
+ protocols
)
LogIPPkt(text_log, GET_IPH_PROTO((p)), p);
}
#ifndef NO_NON_ETHER_DECODER
- else if (p->ah != NULL)
+ else if (p->proto_bits & PROTO_BIT__ARP)
{
log_mutex.lock();
LogArpHeader(text_log, p);
#ifndef LOG_H
#define LOG_H
-#include "decode.h"
+#include "protocols/packet.h"
void CreateTCPFlagString(Packet *, char *);
#include "snort_debug.h"
#include "signature.h"
#include "util_net.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "snort.h"
#include "sf_textlog.h"
#include "snort_bounds.h"
#include "obfuscation.h"
#include "detection_util.h"
#include "packet_io/sfdaq.h"
+#include "protocols/layer.h"
#include "sfip/sf_ip.h"
#include "protocols/ipv6.h"
#include "protocols/icmp6.h"
#include "protocols/icmp4.h"
+#include "protocols/gre.h"
+#include "protocols/token_ring.h"
#include "protocols/wlan.h"
+#include "protocols/linux_sll.h"
+#include "protocols/eapol.h"
#ifdef HAVE_DUMBNET_H
#include <dumbnet.h>
void LogTrHeader(TextLog* log, Packet* p)
{
+ const token_ring::Trh_hdr* trh =
+ reinterpret_cast<const token_ring::Trh_hdr*>(layer::get_root_layer(p));
- TextLog_Print(log, "%X:%X:%X:%X:%X:%X -> ", p->trh->saddr[0],
- p->trh->saddr[1], p->trh->saddr[2], p->trh->saddr[3],
- p->trh->saddr[4], p->trh->saddr[5]);
- TextLog_Print(log, "%X:%X:%X:%X:%X:%X\n", p->trh->daddr[0],
- p->trh->daddr[1], p->trh->daddr[2], p->trh->daddr[3],
- p->trh->daddr[4], p->trh->daddr[5]);
+ TextLog_Print(log, "%X:%X:%X:%X:%X:%X -> ", trh->saddr[0],
+ trh->saddr[1], trh->saddr[2], trh->saddr[3],
+ trh->saddr[4], trh->saddr[5]);
+ TextLog_Print(log, "%X:%X:%X:%X:%X:%X\n", trh->daddr[0],
+ trh->daddr[1], trh->daddr[2], trh->daddr[3],
+ trh->daddr[4], trh->daddr[5]);
+
+ const token_ring::Trh_llc* trhllc =
+ reinterpret_cast<const token_ring::Trh_llc*>(trh + sizeof(*trh));
+
+ TextLog_Print(log, "access control:0x%X frame control:0x%X\n", trh->ac,
+ trh->fc);
- TextLog_Print(log, "access control:0x%X frame control:0x%X\n", p->trh->ac,
- p->trh->fc);
- if(!p->trhllc)
- return;
TextLog_Print(log, "DSAP: 0x%X SSAP 0x%X protoID: %X%X%X Ethertype: %X\n",
- p->trhllc->dsap, p->trhllc->ssap, p->trhllc->protid[0],
- p->trhllc->protid[1], p->trhllc->protid[2], p->trhllc->ethertype);
- if(p->trhmr)
+ trhllc->dsap, trhllc->ssap, trhllc->protid[0],
+ trhllc->protid[1], trhllc->protid[2], trhllc->ethertype);
+
+
+ const token_ring::Trh_mr* trhmr = token_ring::get_trhmr(trhllc);
+
+ if(trhmr)
{
TextLog_Print(log, "RIF structure is present:\n");
TextLog_Print(log, "bcast: 0x%X length: 0x%X direction: 0x%X largest"
"fr. size: 0x%X res: 0x%X\n",
- TRH_MR_BCAST(p->trhmr), TRH_MR_LEN(p->trhmr),
- TRH_MR_DIR(p->trhmr), TRH_MR_LF(p->trhmr),
- TRH_MR_RES(p->trhmr));
+ TRH_MR_BCAST(trhmr), TRH_MR_LEN(trhmr),
+ TRH_MR_DIR(trhmr), TRH_MR_LF(trhmr),
+ TRH_MR_RES(trhmr));
TextLog_Print(log, "rseg -> %X:%X:%X:%X:%X:%X:%X:%X\n",
- p->trhmr->rseg[0], p->trhmr->rseg[1], p->trhmr->rseg[2],
- p->trhmr->rseg[3], p->trhmr->rseg[4], p->trhmr->rseg[5],
- p->trhmr->rseg[6], p->trhmr->rseg[7]);
+ trhmr->rseg[0], trhmr->rseg[1], trhmr->rseg[2],
+ trhmr->rseg[3], trhmr->rseg[4], trhmr->rseg[5],
+ trhmr->rseg[6], trhmr->rseg[7]);
}
}
#endif // NO_NON_ETHER_DECODER
*/
static void LogEthHeader(TextLog* log, Packet* p)
{
+ const eth::EtherHdr *eh = layer::get_eth_layer(p);
+
/* src addr */
- TextLog_Print(log, "%02X:%02X:%02X:%02X:%02X:%02X -> ", p->eh->ether_src[0],
- p->eh->ether_src[1], p->eh->ether_src[2], p->eh->ether_src[3],
- p->eh->ether_src[4], p->eh->ether_src[5]);
+ TextLog_Print(log, "%02X:%02X:%02X:%02X:%02X:%02X -> ", eh->ether_src[0],
+ eh->ether_src[1], eh->ether_src[2], eh->ether_src[3],
+ eh->ether_src[4], eh->ether_src[5]);
/* dest addr */
- TextLog_Print(log, "%02X:%02X:%02X:%02X:%02X:%02X ", p->eh->ether_dst[0],
- p->eh->ether_dst[1], p->eh->ether_dst[2], p->eh->ether_dst[3],
- p->eh->ether_dst[4], p->eh->ether_dst[5]);
+ TextLog_Print(log, "%02X:%02X:%02X:%02X:%02X:%02X ", eh->ether_dst[0],
+ eh->ether_dst[1], eh->ether_dst[2], eh->ether_dst[3],
+ eh->ether_dst[4], eh->ether_dst[5]);
/* protocol and pkt size */
- TextLog_Print(log, "type:0x%X len:0x%X\n", ntohs(p->eh->ether_type),
+ TextLog_Print(log, "type:0x%X len:0x%X\n", ntohs(eh->ether_type),
p->pkth->pktlen);
}
static void LogGREHeader(TextLog *log, Packet *p)
{
- if (p->greh == NULL)
+ const gre::GREHdr *greh = layer::get_gre_layer(p);
+
+ if (greh == NULL)
return;
TextLog_Print(log, "GRE version:%u flags:0x%02X ether-type:0x%04X\n",
- GRE_VERSION(p->greh), p->greh->flags, GRE_PROTO(p->greh));
+ GRE_VERSION(greh), greh->flags, GRE_PROTO(greh));
}
#ifndef NO_NON_ETHER_DECODER
#ifdef DLT_LINUX_SLL
static void LogSLLHeader(TextLog* log, Packet* p)
{
- switch (ntohs(p->sllh->sll_pkttype)) {
+ const linux_sll::SLLHdr* sllh =
+ reinterpret_cast<const linux_sll::SLLHdr*>(layer::get_root_layer(p));
+
+ switch (ntohs(sllh->sll_pkttype)) {
case LINUX_SLL_HOST:
TextLog_Puts(log, "< ");
break;
/* mac addr */
TextLog_Print(log, "l/l len: %i l/l type: 0x%X %02X:%02X:%02X:%02X:%02X:%02X\n",
- htons(p->sllh->sll_halen), ntohs(p->sllh->sll_hatype),
- p->sllh->sll_addr[0], p->sllh->sll_addr[1], p->sllh->sll_addr[2],
- p->sllh->sll_addr[3], p->sllh->sll_addr[4], p->sllh->sll_addr[5]);
+ htons(sllh->sll_halen), ntohs(sllh->sll_hatype),
+ sllh->sll_addr[0], sllh->sll_addr[1], sllh->sll_addr[2],
+ sllh->sll_addr[3], sllh->sll_addr[4], sllh->sll_addr[5]);
/* protocol and pkt size */
TextLog_Print(log, "pkt type:0x%X proto: 0x%X len:0x%X\n",
- ntohs(p->sllh->sll_pkttype),
- ntohs(p->sllh->sll_protocol), p->pkth->pktlen);
+ ntohs(sllh->sll_pkttype),
+ ntohs(sllh->sll_protocol), p->pkth->pktlen);
}
#endif
*/
static void LogWifiHeader(TextLog* log, Packet * p)
{
+ const wlan::WifiHdr *wifih =
+ reinterpret_cast< const wlan::WifiHdr *>(layer::get_root_layer(p));
+
/* This assumes we are printing a data packet, could be changed
to print other types as well */
const uint8_t *da = NULL, *sa = NULL, *bssid = NULL, *ra = NULL,
*ta = NULL;
/* per table 4, IEEE802.11 section 7.2.2 */
- if ((p->wifih->frame_control & WLAN_FLAG_TODS) &&
- (p->wifih->frame_control & WLAN_FLAG_FROMDS)) {
- ra = p->wifih->addr1;
- ta = p->wifih->addr2;
- da = p->wifih->addr3;
- sa = p->wifih->addr4;
+ if ((wifih->frame_control & WLAN_FLAG_TODS) &&
+ (wifih->frame_control & WLAN_FLAG_FROMDS)) {
+ ra = wifih->addr1;
+ ta = wifih->addr2;
+ da = wifih->addr3;
+ sa = wifih->addr4;
}
- else if (p->wifih->frame_control & WLAN_FLAG_TODS) {
- bssid = p->wifih->addr1;
- sa = p->wifih->addr2;
- da = p->wifih->addr3;
+ else if (wifih->frame_control & WLAN_FLAG_TODS) {
+ bssid = wifih->addr1;
+ sa = wifih->addr2;
+ da = wifih->addr3;
}
- else if (p->wifih->frame_control & WLAN_FLAG_FROMDS) {
- da = p->wifih->addr1;
- bssid = p->wifih->addr2;
- sa = p->wifih->addr3;
+ else if (wifih->frame_control & WLAN_FLAG_FROMDS) {
+ da = wifih->addr1;
+ bssid = wifih->addr2;
+ sa = wifih->addr3;
}
else {
- da = p->wifih->addr1;
- sa = p->wifih->addr2;
- bssid = p->wifih->addr3;
+ da = wifih->addr1;
+ sa = wifih->addr2;
+ bssid = wifih->addr3;
}
/* DO this switch to provide additional info on the type */
- switch(p->wifih->frame_control & 0x00ff)
+ switch(wifih->frame_control & 0x00ff)
{
case WLAN_TYPE_MGMT_BEACON:
TextLog_Puts(log, "Beacon ");
ra[1], ra[2], ra[3], ra[4], ra[5]);
}
TextLog_Puts(log, " Flags:");
- if (p->wifih->frame_control & WLAN_FLAG_TODS) TextLog_Puts(log," ToDs");
- if (p->wifih->frame_control & WLAN_FLAG_TODS) TextLog_Puts(log," FrDs");
- if (p->wifih->frame_control & WLAN_FLAG_FRAG) TextLog_Puts(log," Frag");
- if (p->wifih->frame_control & WLAN_FLAG_RETRY) TextLog_Puts(log," Re");
- if (p->wifih->frame_control & WLAN_FLAG_PWRMGMT) TextLog_Puts(log," Pwr");
- if (p->wifih->frame_control & WLAN_FLAG_MOREDAT) TextLog_Puts(log," MD");
- if (p->wifih->frame_control & WLAN_FLAG_WEP) TextLog_Puts(log," Wep");
- if (p->wifih->frame_control & WLAN_FLAG_ORDER) TextLog_Puts(log," Ord");
+ if (wifih->frame_control & WLAN_FLAG_TODS) TextLog_Puts(log," ToDs");
+ if (wifih->frame_control & WLAN_FLAG_TODS) TextLog_Puts(log," FrDs");
+ if (wifih->frame_control & WLAN_FLAG_FRAG) TextLog_Puts(log," Frag");
+ if (wifih->frame_control & WLAN_FLAG_RETRY) TextLog_Puts(log," Re");
+ if (wifih->frame_control & WLAN_FLAG_PWRMGMT) TextLog_Puts(log," Pwr");
+ if (wifih->frame_control & WLAN_FLAG_MOREDAT) TextLog_Puts(log," MD");
+ if (wifih->frame_control & WLAN_FLAG_WEP) TextLog_Puts(log," Wep");
+ if (wifih->frame_control & WLAN_FLAG_ORDER) TextLog_Puts(log," Ord");
TextLog_NewLine(log);
}
#endif // NO_NON_ETHER_DECODER
switch(DAQ_GetBaseProtocol())
{
case DLT_EN10MB: /* Ethernet */
- if(p && p->eh)
+ if(p && (p->next_layer > 0))
LogEthHeader(log, p);
break;
#ifndef NO_NON_ETHER_DECODER
#ifdef DLT_IEEE802_11
case DLT_IEEE802_11:
- if(p && p->wifih)
+ if(p && (p->next_layer > 0))
LogWifiHeader(log, p);
break;
#endif
case DLT_IEEE802: /* Token Ring */
- if(p && p->trh)
+ if(p && (p->next_layer > 0))
LogTrHeader(log, p);
break;
#ifdef DLT_LINUX_SLL
case DLT_LINUX_SLL:
- if (p && p->sllh)
+ if (p && (p->next_layer > 0))
LogSLLHeader(log, p); /* Linux cooked sockets */
break;
#endif
int next_layer, ip_start, ip_ob_start, ip_ob_end, byte_pos, char_pos;
int i;
- next_layer = ip_start = byte_pos = char_pos = 0;
+ ip_start = byte_pos = char_pos = 0;
ip_ob_start = ip_ob_end = -1;
/* loop thru the whole buffer */
while ( pb < end )
{
- i = 0;
-
if (ScVerboseByteDump())
{
TextLog_Print(log, "0x%04X: ", offset);
{
Log2ndHeader(log, p);
- if ( p->mpls )
+ if ( p->proto_bits & PROTO_BIT__MPLS )
{
LogMPLSHeader(log, p);
}
if ( p->outer_iph )
{
LogOuterIPHeader(log, p);
- if ( p->greh )
- LogGREHeader(log, p);
+ LogGREHeader(log, p); // checks for valid gre layer before logging
}
}
* Returns: void function
*
***************************************************************************/
-static void PrintEapolKey(FILE * fp, Packet * p)
+static void PrintEapolKey(FILE * fp, const eapol::EapolKey* eapolk)
{
+
uint16_t length;
- if(p->eapolk == NULL)
+ if(eapolk == NULL)
{
fprintf(fp, "Eapol Key truncated\n");
return;
}
fprintf(fp, "KEY type: ");
- if (p->eapolk->type == 1) {
+ if (eapolk->type == 1) {
fprintf(fp, "RC4");
}
- memcpy(&length, &p->eapolk->length, 2);
+ memcpy(&length, &eapolk->length, 2);
length = ntohs(length);
fprintf(fp, " len: %d", length);
- fprintf(fp, " index: %d ", p->eapolk->index & 0x7F);
- fprintf(fp, p->eapolk->index & 0x80 ? " unicast\n" : " broadcast\n");
+ fprintf(fp, " index: %d ", eapolk->index & 0x7F);
+ fprintf(fp, eapolk->index & 0x80 ? " unicast\n" : " broadcast\n");
}
/****************************************************************************
* Returns: void function
*
***************************************************************************/
-static void PrintEapolHeader(FILE * fp, Packet * p)
+static void PrintEapolHeader(FILE * fp, const eapol::EtherEapol* eplh)
{
fprintf(fp, "EAPOL type: ");
- switch(p->eplh->eaptype) {
+ switch(eplh->eaptype) {
case EAPOL_TYPE_EAP:
- fprintf(fp, "EAP");
- break;
+ fprintf(fp, "EAP");
+ break;
case EAPOL_TYPE_START:
- fprintf(fp, "Start");
- break;
+ fprintf(fp, "Start");
+ break;
case EAPOL_TYPE_LOGOFF:
- fprintf(fp, "Logoff");
- break;
+ fprintf(fp, "Logoff");
+ break;
case EAPOL_TYPE_KEY:
- fprintf(fp, "Key");
- break;
+ fprintf(fp, "Key");
+ break;
case EAPOL_TYPE_ASF:
- fprintf(fp, "ASF Alert");
- break;
+ fprintf(fp, "ASF Alert");
+ break;
default:
- fprintf(fp, "Unknown");
+ fprintf(fp, "Unknown");
}
- fprintf(fp, " Len: %d\n", ntohs(p->eplh->len));
+ fprintf(fp, " Len: %d\n", ntohs(eplh->len));
}
/****************************************************************************
* Returns: void function
*
***************************************************************************/
-static void PrintEAPHeader(FILE * fp, Packet * p)
+static void PrintEAPHeader(FILE * fp, const eapol::EAPHdr* eaph)
{
+ uint8_t* eaptype = 0;
- if(p->eaph == NULL)
+ if(eaph == NULL)
{
fprintf(fp, "EAP header truncated\n");
return;
}
fprintf(fp, "code: ");
- switch(p->eaph->code) {
+ switch(eaph->code) {
case EAP_CODE_REQUEST:
- fprintf(fp, "Req ");
- break;
+ fprintf(fp, "Req ");
+ eaptype = (uint8_t*) (eaph + sizeof(*eaph));
+ break;
case EAP_CODE_RESPONSE:
- fprintf(fp, "Resp");
- break;
+ fprintf(fp, "Resp");
+ eaptype = (uint8_t*) (eaph + sizeof(*eaph));
+ break;
case EAP_CODE_SUCCESS:
- fprintf(fp, "Succ");
- break;
+ fprintf(fp, "Succ");
+ break;
case EAP_CODE_FAILURE:
- fprintf(fp, "Fail");
- break;
+ fprintf(fp, "Fail");
+ break;
}
- fprintf(fp, " id: 0x%x len: %d", p->eaph->id, ntohs(p->eaph->len));
- if (p->eaptype != NULL) {
- fprintf(fp, " type: ");
- switch(*(p->eaptype)) {
- case EAP_TYPE_IDENTITY:
- fprintf(fp, "id");
- break;
- case EAP_TYPE_NOTIFY:
- fprintf(fp, "notify");
- break;
- case EAP_TYPE_NAK:
- fprintf(fp, "nak");
- break;
- case EAP_TYPE_MD5:
- fprintf(fp, "md5");
- break;
- case EAP_TYPE_OTP:
- fprintf(fp, "otp");
- break;
- case EAP_TYPE_GTC:
- fprintf(fp, "token");
- break;
- case EAP_TYPE_TLS:
- fprintf(fp, "tls");
- break;
- default:
- fprintf(fp, "undef");
- break;
- }
+ fprintf(fp, " id: 0x%x len: %d", eaph->id, ntohs(eaph->len));
+ if (eaptype != NULL)
+ {
+ fprintf(fp, " type: ");
+ switch(*(eaptype))
+ {
+ case EAP_TYPE_IDENTITY:
+ fprintf(fp, "id");
+ break;
+ case EAP_TYPE_NOTIFY:
+ fprintf(fp, "notify");
+ break;
+ case EAP_TYPE_NAK:
+ fprintf(fp, "nak");
+ break;
+ case EAP_TYPE_MD5:
+ fprintf(fp, "md5");
+ break;
+ case EAP_TYPE_OTP:
+ fprintf(fp, "otp");
+ break;
+ case EAP_TYPE_GTC:
+ fprintf(fp, "token");
+ break;
+ case EAP_TYPE_TLS:
+ fprintf(fp, "tls");
+ break;
+ default:
+ fprintf(fp, "undef");
+ break;
+ }
}
fprintf(fp, "\n");
}
{
Print2ndHeader(fp, p);
}
- PrintEapolHeader(fp, p);
- if (p->eplh->eaptype == EAPOL_TYPE_EAP) {
- PrintEAPHeader(fp, p);
+
+ const eapol::EtherEapol* eplh = layer::get_eapol_layer(p);
+
+ if (eplh)
+ {
+ PrintEapolHeader(fp, eplh);
+ if (eplh->eaptype == EAPOL_TYPE_EAP) {
+ PrintEAPHeader(fp, (const eapol::EAPHdr*) eplh + sizeof(*eplh));
+ }
+ else if (eplh->eaptype == EAPOL_TYPE_KEY) {
+ PrintEapolKey(fp, (const eapol::EapolKey*) eplh + sizeof(*eplh));
+ }
}
- else if (p->eplh->eaptype == EAPOL_TYPE_KEY) {
- PrintEapolKey(fp, p);
+ else
+ {
+ fprintf(fp, "EAP header truncated\n");
}
/* dump the application layer data */
#include "snort_types.h"
#include "snort_debug.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "stream/stream_api.h"
#include "snort_bounds.h"
#include "main/thread.h"
alert_csv.cc
alert_fast.cc
alert_full.cc
- alert_sf_socket.cc
alert_syslog.cc
alert_test.cc
alert_unixsock.cc
unified2_common.h
)
+if( LINUX )
+ set ( PLUGIN_LIST
+ ${PLUGIN_LIST}
+ alert_sf_socket.cc
+ )
+endif()
+
+
if (STATIC_LOGGERS)
add_library ( loggers STATIC
${LOGGER_SOURCES}
#include "framework/logger.h"
#include "framework/module.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "parser.h"
#include "snort_debug.h"
#include "mstring.h"
int num;
char *type;
char tcpFlags[9];
+ const eth::EtherHdr *eh = nullptr;
assert(p);
+ if (p->proto_bits & PROTO_BIT__ETH)
+ eh = layer::get_eth_layer(p);
+
// TBD an enum would be an improvement here
for (num = 0; num < numargs; num++)
{
}
else if (!strcasecmp("eth_src", type))
{
- if (p->eh != NULL)
+ if (eh)
{
- TextLog_Print(csv_log, "%02X:%02X:%02X:%02X:%02X:%02X", p->eh->ether_src[0],
- p->eh->ether_src[1], p->eh->ether_src[2], p->eh->ether_src[3],
- p->eh->ether_src[4], p->eh->ether_src[5]);
+ TextLog_Print(csv_log, "%02X:%02X:%02X:%02X:%02X:%02X", eh->ether_src[0],
+ eh->ether_src[1], eh->ether_src[2], eh->ether_src[3],
+ eh->ether_src[4], eh->ether_src[5]);
}
}
else if (!strcasecmp("eth_dst", type))
{
- if (p->eh != NULL)
+ if (eh)
{
- TextLog_Print(csv_log, "%02X:%02X:%02X:%02X:%02X:%02X", p->eh->ether_dst[0],
- p->eh->ether_dst[1], p->eh->ether_dst[2], p->eh->ether_dst[3],
- p->eh->ether_dst[4], p->eh->ether_dst[5]);
+ TextLog_Print(csv_log, "%02X:%02X:%02X:%02X:%02X:%02X", eh->ether_dst[0],
+ eh->ether_dst[1], eh->ether_dst[2], eh->ether_dst[3],
+ eh->ether_dst[4], eh->ether_dst[5]);
}
}
else if (!strcasecmp("eth_type", type))
{
- if (p->eh != NULL)
- TextLog_Print(csv_log, "0x%X", ntohs(p->eh->ether_type));
+ if (eh != NULL)
+ TextLog_Print(csv_log, "0x%X", ntohs(eh->ether_type));
}
else if (!strcasecmp("eth_len", type))
{
- if (p->eh != NULL)
+ if (eh != NULL)
TextLog_Print(csv_log, "0x%X", p->pkth->pktlen);
}
else if (!strcasecmp("udp_len", type))
#include "framework/logger.h"
#include "framework/module.h"
#include "event.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "snort_debug.h"
#include "parser.h"
#include "util.h"
if(IPH_IS_VALID(p))
LogIPPkt(fast_log, GET_IPH_PROTO(p), p);
#ifndef NO_NON_ETHER_DECODER
- else if(p->ah)
+ else if(p->proto_bits & PROTO_BIT__ARP)
LogArpHeader(fast_log, p);
#endif
}
#include "framework/logger.h"
#include "framework/module.h"
#include "event.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "snort_debug.h"
#include "parser.h"
#include "util.h"
#include "framework/logger.h"
#include "framework/module.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "detect.h"
#include "event.h"
#include "rules.h"
#include "framework/logger.h"
#include "framework/module.h"
#include "event.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "snort_debug.h"
#include "parser.h"
#include "util.h"
#include "framework/module.h"
#include "snort_types.h"
#include "event.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "parser.h"
#include "snort_debug.h"
#include "util.h"
/* this struct is for the alert socket code.... */
// FIXTHIS alert unix sock supports l2-l3-l4 encapsulations
+
+const unsigned int ALERTMSG_LENGTH = 256;
struct Alertpkt
{
uint8_t alertmsg[ALERTMSG_LENGTH]; /* variable.. */
{
if(p)
{
- if (p->eh)
+ if (p->proto_bits & PROTO_BIT__ETH)
{
- us.alert.dlthdr=(char *)p->eh-(char *)p->pkt;
+
+ const eth::EtherHdr *eh = layer::get_eth_layer(p);
+ us.alert.dlthdr=(char *)eh-(char *)p->pkt;
}
/* we don't log any headers besides eth yet */
#include "framework/logger.h"
#include "framework/module.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "event.h"
#include "mstring.h"
#include "parser.h"
#include "framework/logger.h"
#include "framework/module.h"
-#include "decode.h" /* for struct in6_addr -- maybe move to snort_types.h? */
+#include "protocols/packet.h" /* for struct in6_addr -- maybe move to snort_types.h? */
#include "snort_types.h"
#include "main/analyzer.h"
-#include "decode.h"
#include "rules.h"
#include "treenodes.h"
#include "util.h"
#include "detect.h"
#include "snort.h"
#include "stream/stream_api.h"
+#include "protocols/layer.h"
+#include "protocols/vlan.h"
using namespace std;
alertdata.dport_icode = htons(p->dp);
}
- if((p->mpls) && (config->mpls_event_types))
+ if((p->proto_bits & PROTO_BIT__MPLS) && (config->mpls_event_types))
{
alertdata.mpls_label = htonl(p->mplsHdr.label);
}
if(config->vlan_event_types)
{
- if(p->vh)
+ if(p->proto_bits & PROTO_BIT__VLAN)
{
- alertdata.vlanId = htons(VTH_VLAN(p->vh));
+ alertdata.vlanId = htons(vlan::vth_vlan(layer::get_vlan_layer(p)));
}
alertdata.pad2 = htons(p->user_policy_id);
alertdata.dport_icode = htons(p->dp);
}
- if((p->mpls) && (config->mpls_event_types))
+ if((p->proto_bits & PROTO_BIT__MPLS) && (config->mpls_event_types))
{
alertdata.mpls_label = htonl(p->mplsHdr.label);
}
if(config->vlan_event_types)
{
- if(p->vh)
+ if(p->proto_bits & PROTO_BIT__VLAN)
{
- alertdata.vlanId = htons(VTH_VLAN(p->vh));
+ alertdata.vlanId = htons(vlan::vth_vlan(layer::get_vlan_layer(p)));
}
alertdata.pad2 = htons(p->user_policy_id);
#define ANALYZER_H
#include "snort_types.h"
-#include "decode.h"
+#include "protocols/packet.h"
enum AnalyzerCommand
{
#include <thread>
#include "helpers/process.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "managers/packet_manager.h"
#include "packet_io/sfdaq.h"
#include "packet_io/active.h"
{
// for now need to just get stream_* inspectors and call appropriately
#if 0
- int vlanId = (p->vh) ? VTH_VLAN(p->vh) : -1;
+ int vlanId = (p->vh) ? vlan::vth_vlan(p->vh) : -1;
snort_ip_p srcIp = (p->iph) ? GET_SRC_IP((p)) : (snort_ip_p)0;
snort_ip_p dstIp = (p->iph) ? GET_DST_IP((p)) : (snort_ip_p)0;
#include <stdio.h>
#include "snort_types.h"
-#include "protocols/decode.h"
#include "sfip/sf_ipvar.h"
#include "main/snort_config.h"
#include "snort_types.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "log/log.h"
SnortConfig* reload_config();
namespace
{
-struct CdGenPegs{
- PegCount total_processed = 0;
- PegCount other_codecs = 0;
- PegCount discards = 0;
-};
-std::vector<const char*> gen_peg_names =
-{
- "total",
- "other",
- "discards"
-};
} // anonymous
THREAD_LOCAL PreprocStats decodePerfStats;
#endif
-
extern const CodecApi* default_codec;
-
static const uint16_t max_protocol_id = 65535;
-static std::vector<const CodecApi*> s_codecs;
+static const uint16_t IP_ID_COUNT = 8192;
-// when initialization arrays, although the zero is not required
-// the compiler complains about a missing-field-initiliezers
+// the zero initialization is not required but quiets the compiler
+static std::vector<const CodecApi*> s_codecs;
static std::array<uint8_t, max_protocol_id> s_proto_map{{0}};
static std::array<Codec*, UINT8_MAX> s_protocols{{0}};
static THREAD_LOCAL uint8_t grinder = 0;
// Decoding statistics
-static const uint8_t gen_peg_size = 3; // reflects size of CdGenPegs
-static const uint8_t stat_offset = gen_peg_size; // different name to simplify code
-static THREAD_LOCAL std::array<PegCount, 256 + gen_peg_size> s_stats{{0}};
-static std::array<PegCount, 256 + gen_peg_size> g_stats{{0}};
-static THREAD_LOCAL CdGenPegs pkt_cnt;
+// this vector reflects the printed names for the statistics
+// before the stat_offset
+static const std::vector<const char*> stat_names =
+{
+ "total",
+ "other",
+ "discards"
+};
+static const uint8_t total_processed = 0;
+static const uint8_t other_codecs = 1;
+static const uint8_t discards = 2;
+static const uint8_t stat_offset = 3;
+static THREAD_LOCAL std::array<PegCount, stat_offset + s_protocols.size()> s_stats{{0}};
+static std::array<PegCount, s_stats.size()> g_stats{{0}};
// Encoder Foo
-static Packet *encode_pkt;
-//static THREAD_LOCAL PegCount g_total_rebuilt_pkts = 0;
+static THREAD_LOCAL rand_t* s_rand = NULL;
+static THREAD_LOCAL Packet *encode_pkt;
static THREAD_LOCAL PegCount total_rebuilt_pkts = 0;
static THREAD_LOCAL uint8_t* dst_mac = NULL;
-
-static const uint16_t IP_ID_COUNT = 8192;
-static THREAD_LOCAL rand_t* s_rand = NULL;
static THREAD_LOCAL std::array<uint16_t, IP_ID_COUNT> s_id_pool{{0}};
static THREAD_LOCAL std::array<uint8_t, Codec::PKT_MAX> s_pkt{{0}};
//-------------------------------------------------------------------------
-static inline void push_layer(Packet *p,
- uint16_t prot_id,
- const uint8_t *hdr_start,
- uint32_t len)
-{
- if ( p->next_layer < LAYER_MAX )
- {
- Layer& lyr = p->layers[p->next_layer++];
- lyr.prot_id = prot_id;
- lyr.start = (uint8_t*)hdr_start;
- lyr.length = (uint16_t)len;
- }
- else
- {
- LogMessage("(snort_decoder) WARNING: decoder got too many layers;"
- " next proto is something.\n");
- }
-}
-
-
static inline void push_layer(Packet *p,
uint16_t prot_id,
const uint8_t *hdr_start,
}
else
{
- LogMessage("(snort_decoder) WARNING: decoder got too many layers;"
+ LogMessage("(packet_manager) WARNING: decoder has too many layers;"
" next proto is something.\n");
}
}
return nullptr;
}
-
static inline int get_inner_ip_lyr(const Packet *p)
{
const Layer *layers = p->layers;
return 0;
}
-
static const uint8_t* encode_packet(
EncState* enc, const Packet* p, uint32_t* len)
{
return obuf.base + obuf.off;
}
-static void accumulate()
+static inline void accumulate()
{
static std::mutex stats_mutex;
- stats_mutex.lock();
-
- s_stats[0] = pkt_cnt.total_processed;
- s_stats[1] = pkt_cnt.other_codecs;
- s_stats[2] = pkt_cnt.discards;
-
- // zeroing out the null/default codecs
- s_stats[3] = 0;
- s_stats[s_proto_map[FINISHED_DECODE] + stat_offset] = 0;
+ stats_mutex.lock();
sum_stats(&g_stats[0], &s_stats[0], s_stats.size());
-
stats_mutex.unlock();
}
static bool api_instantiated(const CodecApi* cd_api)
{
- static std::vector<bool> instantiated_api; // all elements initialized to false
-
- if (instantiated_api.size() != s_codecs.size())
- instantiated_api.resize(s_codecs.size());
+ // all elements initialize to false
+ static std::vector<bool> instantiated_api(s_codecs.size());
- std::vector<const CodecApi*>::iterator p = std::find(s_codecs.begin(), s_codecs.end(), cd_api);
+ std::vector<const CodecApi*>::iterator p =
+ std::find(s_codecs.begin(), s_codecs.end(), cd_api);
if (p == s_codecs.end())
FatalError("PacketManager:: should never reach this code!!" \
"Cannot find Codec %s's api", cd_api->base.name);
int pos = p - s_codecs.begin();
-
if(instantiated_api[pos])
return true;
if(!grinder)
FatalError("PacketManager: Unable to find a Codec with data link type %d!!\n", daq_dlt);
+ if ( !ScReadMode() || ScPcapShow() )
+ LogMessage("Decoding with %s\n", s_protocols[grinder]->get_name());
+
// ENCODER initialization
#ifndef VALGRIND_TESTING
{
PROFILE_VARS;
uint16_t prot_id;
- uint8_t mapped_prot;
+ uint8_t mapped_prot = grinder;
uint16_t prev_prot_id = FINISHED_DECODE;
uint16_t len, lyr_len;
p->pkth = pkthdr;
p->pkt = pkt;
len = pkthdr->caplen;
- mapped_prot = grinder;
- pkt_cnt.total_processed++;
+
+ s_stats[total_processed]++;
// loop until the protocol id is no longer valid
while(s_protocols[mapped_prot]->decode(pkt, len, p, lyr_len, prot_id))
}
}
- // if the final protocol ID is not the null codec
+ // if the final protocol ID is not the default codec, a Codec failed
if (prev_prot_id != FINISHED_DECODE)
{
+ // if the codec exists, it failed
if(s_proto_map[prev_prot_id])
- pkt_cnt.discards++;
+ s_stats[discards]++;
else
- pkt_cnt.other_codecs++;
+ s_stats[other_codecs]++;
}
s_stats[mapped_prot + stat_offset]++;
}
-
-
-
-
-
-
//-------------------------------------------------------------------------
// encoders operate layer by layer:
//-------------------------------------------------------------------------
{
std::vector<const char*> pkt_names;
- for(unsigned int i = 0; i < gen_peg_names.size(); i++)
- pkt_names.push_back(gen_peg_names[i]);
+ // zero out the default codecs
+ g_stats[3] = 0;
+ g_stats[s_proto_map[FINISHED_DECODE] + stat_offset] = 0;
+ for(unsigned int i = 0; i < stat_names.size(); i++)
+ pkt_names.push_back(stat_names[i]);
for(int i = 0; s_protocols[i] != 0; i++)
- if(s_protocols[i])
- pkt_names.push_back(s_protocols[i]->get_name());
+ pkt_names.push_back(s_protocols[i]->get_name());
show_percent_stats((PegCount*) &g_stats, &pkt_names[0], (unsigned int) pkt_names.size(),
"codecs");
/*
-** Copyright (C) 2013-2013 Sourcefire, Inc.
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
**
** This program is free software; you can redistribute it and/or modify
** it under the terms of the GNU General Public License Version 2 as
#ifndef PACKET_MANAGER_H
#define PACKET_MANAGER_H
-#include "snort_types.h"
+#include <array>
+#include <list>
#include "framework/codec.h"
#include "time/profiler.h"
#include "utils/stats.h"
#include "snort_config.h"
-#include <array>
-#include <list>
-
struct Packet;
//-------------------------------------------------------------------------
-/*
- * E N C O D E R F O O
- */
-
-// for encodeders
-#include "protocols/packet.h"
-#include "codecs/sf_protocols.h"
-#include "framework/codec.h"
-
-
-
-
-// TODO --> delete this!!
#ifdef PERF_PROFILING
extern THREAD_LOCAL PreprocStats decodePerfStats;
#endif
/*
* PacketManager class
*/
-
-
class PacketManager
{
public:
#include "snort_types.h"
#include "snort_debug.h"
#include "detect.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "event.h"
#include "parser.h"
#include "mstring.h"
#include "arp_module.h"
#include "framework/inspector.h"
+#include "protocols/layer.h"
+#include "protocols/arp.h"
static const uint8_t bcast[6] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
{
IPMacEntry *ipme;
PROFILE_VARS;
+ const arp::EtherARP *ah;
+ const eth::EtherHdr *eh;
// preconditions - what we registered for
- assert(p->eh && p->ah);
+ assert((p->proto_bits & PROTO_BIT__ETH) && (p->proto_bits & PROTO_BIT__ARP));
+
+ ah = layer::get_arp_layer(p);
+ eh = layer::get_eth_layer(p);
/* is the ARP protocol type IP and the ARP hardware type Ethernet? */
- if ((ntohs(p->ah->ea_hdr.ar_hrd) != 0x0001) ||
- (ntohs(p->ah->ea_hdr.ar_pro) != ETHERNET_TYPE_IP))
+ if ((ntohs(ah->ea_hdr.ar_hrd) != 0x0001) ||
+ (ntohs(ah->ea_hdr.ar_pro) != ETHERNET_TYPE_IP))
return;
PREPROC_PROFILE_START(arpPerfStats);
++asstats.total_packets;
- switch(ntohs(p->ah->ea_hdr.ar_op))
+ switch(ntohs(ah->ea_hdr.ar_op))
{
case ARPOP_REQUEST:
if (config->check_unicast_arp)
{
- if (memcmp((u_char *)p->eh->ether_dst, (u_char *)bcast, 6) != 0)
+ if (memcmp((u_char *)eh->ether_dst, (u_char *)bcast, 6) != 0)
{
SnortEventqAdd(GID_ARP_SPOOF,
ARPSPOOF_UNICAST_ARP_REQUEST);
"MODNAME: Unicast request\n"););
}
}
- else if (memcmp((u_char *)p->eh->ether_src,
- (u_char *)p->ah->arp_sha, 6) != 0)
+ else if (memcmp((u_char *)eh->ether_src,
+ (u_char *)ah->arp_sha, 6) != 0)
{
SnortEventqAdd(GID_ARP_SPOOF,
ARPSPOOF_ETHERFRAME_ARP_MISMATCH_SRC);
}
break;
case ARPOP_REPLY:
- if (memcmp((u_char *)p->eh->ether_src,
- (u_char *)p->ah->arp_sha, 6) != 0)
+ if (memcmp((u_char *)eh->ether_src,
+ (u_char *)ah->arp_sha, 6) != 0)
{
SnortEventqAdd(GID_ARP_SPOOF,
ARPSPOOF_ETHERFRAME_ARP_MISMATCH_SRC);
DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,
"MODNAME: Ethernet/ARP mismatch reply src\n"););
}
- else if (memcmp((u_char *)p->eh->ether_dst,
- (u_char *)p->ah->arp_tha, 6) != 0)
+ else if (memcmp((u_char *)eh->ether_dst,
+ (u_char *)ah->arp_tha, 6) != 0)
{
SnortEventqAdd(GID_ARP_SPOOF,
ARPSPOOF_ETHERFRAME_ARP_MISMATCH_DST);
return;
if ((ipme = LookupIPMacEntryByIP(config->ipmel,
- *(uint32_t *)&p->ah->arp_spa)) == NULL)
+ *(uint32_t *)&ah->arp_spa)) == NULL)
{
DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,
"MODNAME: LookupIPMacEntryByIp returned NULL\n"););
/* If the Ethernet source address or the ARP source hardware address
* in p doesn't match the MAC address in ipme, then generate an alert
*/
- if ((memcmp((uint8_t *)p->eh->ether_src,
+ if ((memcmp((uint8_t *)eh->ether_src,
(uint8_t *)ipme->mac_addr, 6)) ||
- (memcmp((uint8_t *)p->ah->arp_sha,
+ (memcmp((uint8_t *)ah->arp_sha,
(uint8_t *)ipme->mac_addr, 6)))
{
SnortEventqAdd(GID_ARP_SPOOF,
{
ICMPHdr* h = (ICMPHdr*)(p->layers[layer].start);
- if ( ((uint16_t)h->type == ICMP6_ECHO || (uint16_t)h->type == ICMP6_REPLY) &&
+ if ( ((uint16_t)h->type == icmp6::Icmp6Types::ECHO ||
+ (uint16_t)h->type == icmp6::Icmp6Types::REPLY) &&
(h->code != 0) )
{
h->code = static_cast<icmp4::IcmpCode>(0);
#ifndef NORM_H
#define NORM_H
-#include "decode.h"
+#include "protocols/packet.h"
#include "snort.h"
#include "normalize.h"
#include "main/analyzer.h"
#include "util.h"
#include "snort_types.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "snort.h"
THREAD_LOCAL SFBASE sfBase;
#include "perf_event.h"
#include "snort_types.h"
#include "snort_debug.h"
-#include "decode.h"
+#include "protocols/packet.h"
+#include "main/thread.h"
// Perf Flags
#define SFPERF_BASE 0x00000001
#include "sfprocpidstats.h"
#include "snort_types.h"
#include "snort_debug.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include <time.h>
#include <stdio.h>
#include "snort_types.h"
#include "sfxhash.h"
#include "ipv6_port.h"
-#include "decode.h"
+#include "protocols/packet.h"
#define SF_MAX_PKT_LEN 9000
#define SF_MAX_PORT UINT16_MAX
#include "ps_module.h"
#include "main/analyzer.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "managers/packet_manager.h"
#include "event.h"
#include "event_wrapper.h"
#include <sys/types.h>
#include "snort.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "packet_time.h"
#include "sfxhash.h"
#include "ipobj.h"
#ifndef ACTIVE_H
#define ACTIVE_H
-#include "decode.h"
+#include "protocols/packet.h"
#include "snort.h"
#include "managers/packet_manager.h"
#include "util.h"
#include "mstring.h"
#include "detect.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "fpcreate.h"
#include "tag.h"
#include "signature.h"
#include "util.h"
#include "mstring.h"
#include "detect.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "fpcreate.h"
#include "generators.h"
#include "tag.h"
#include "util.h"
#include "mstring.h"
#include "detect.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "fpcreate.h"
#include "tag.h"
#include "signature.h"
#include "snort.h"
#include "rules.h"
#include "treenodes.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "main/policy.h"
#include "sflsq.h"
#include "util.h"
#include "util.h"
#include "mstring.h"
#include "detect.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "fpcreate.h"
#include "tag.h"
#include "signature.h"
set (PROTOCOL_HEADERS
- ipv4.h
- tcp.h
- packet.h
- ipv6.h
- udp.h
+ arp.h
+ eapol.h
eth.h
icmp4.h
icmp6.h
+ ipv4.h
+ ipv6.h
gre.h
- arp.h
- wlan.h
- teredo.h
+ layer.h
+ linux_sll.h
mpls.h
+ packet.h
protocol_ids.h
+ tcp.h
+ teredo.h
+ token_ring.h
+ udp.h
+ wlan.h
+ vlan.h
)
add_library (protocols STATIC
${PROTOCOL_HEADERS}
- ../codecs/template.cc # CMake complains if we don't compile any files. so use dummy file. Linux will remove all of the symbols anyways.
+ layer.cc
)
install (FILES ${PROTOCOL_HEADERS}
x_includedir = $(pkgincludedir)/protocols
-x_include_HEADERS = \
-packet.h
+noinst_LIBRARIES = libprotocols.a
-EXTRA_DIST = \
+x_include_HEADERS = \
arp.h \
-decode.h \
-encode.h \
+eapol.h \
eth.h \
-gre.h \
icmp4.h \
icmp6.h \
ipv4.h \
ipv6.h \
+gre.h \
+layer.h \
+layer.cc \
mpls.h \
protocol_ids.h \
tcp.h \
teredo.h \
+token_ring.h \
udp.h \
-wlan.h
+vlan.h \
+wlan.h \
+packet.h
-AM_CXXFLAGS = @AM_CXXFLAGS@
+libprotocols_a_SOURCES = \
+layer.cc
+
+AM_CXXFLAGS = @AM_CXXFLAGS@
#ifndef ARP_H
#define ARP_H
-namespace arp{
-
-namespace detail{
-
-} // namespace detail
+namespace arp
+{
+++ /dev/null
-#include "codecs/decode.h"
--- /dev/null
+/*
+** Copyright (C) 2002-2013 Sourcefire, Inc.
+** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+
+#ifndef EAPOL_H
+#define EAPOL_H
+
+#ifndef NO_NON_ETHER_DECODER
+
+namespace eapol
+{
+
+struct EtherEapol
+{
+ uint8_t version; /* EAPOL proto version */
+ uint8_t eaptype; /* EAPOL Packet type */
+ uint16_t len; /* Packet body length */
+};
+
+struct EAPHdr
+{
+ uint8_t code;
+ uint8_t id;
+ uint16_t len;
+};
+
+struct EapolKey
+{
+ uint8_t type;
+ uint8_t length[2];
+ uint8_t counter[8];
+ uint8_t iv[16];
+ uint8_t index;
+ uint8_t sig[16];
+};
+
+
+/* IEEE 802.1x eapol types */
+#define EAPOL_TYPE_EAP 0x00 /* EAP packet */
+#define EAPOL_TYPE_START 0x01 /* EAPOL start */
+#define EAPOL_TYPE_LOGOFF 0x02 /* EAPOL Logoff */
+#define EAPOL_TYPE_KEY 0x03 /* EAPOL Key */
+#define EAPOL_TYPE_ASF 0x04 /* EAPOL Encapsulated ASF-Alert */
+
+
+
+/* Extensible Authentication Protocol Codes RFC 2284*/
+#define EAP_CODE_REQUEST 0x01
+#define EAP_CODE_RESPONSE 0x02
+#define EAP_CODE_SUCCESS 0x03
+#define EAP_CODE_FAILURE 0x04
+/* EAP Types */
+#define EAP_TYPE_IDENTITY 0x01
+#define EAP_TYPE_NOTIFY 0x02
+#define EAP_TYPE_NAK 0x03
+#define EAP_TYPE_MD5 0x04
+#define EAP_TYPE_OTP 0x05
+#define EAP_TYPE_GTC 0x06
+#define EAP_TYPE_TLS 0x0d
+
+
+
+/* Extensible Authentication Protocol Codes RFC 2284*/
+#define EAP_CODE_REQUEST 0x01
+#define EAP_CODE_RESPONSE 0x02
+#define EAP_CODE_SUCCESS 0x03
+#define EAP_CODE_FAILURE 0x04
+/* EAP Types */
+#define EAP_TYPE_IDENTITY 0x01
+#define EAP_TYPE_NOTIFY 0x02
+#define EAP_TYPE_NAK 0x03
+#define EAP_TYPE_MD5 0x04
+#define EAP_TYPE_OTP 0x05
+#define EAP_TYPE_GTC 0x06
+#define EAP_TYPE_TLS 0x0d
+
+}
+
+#endif /* NO_NON_ETHER_DECODER */
+#endif /* EAPOL_H */
namespace gre{
-namespace detail{
-
-} // namespace detail
-
/* GRE related stuff */
struct GREHdr
{
} // namespace gre
-typedef gre::GREHdr GREHdr;
-
-
-
-
#define GRE_VERSION(x) (x->version & 0x07)
#define GRE_PROTO(x) ntohs(x->ether_type)
//enum class Icmp6Types : std::uint8_t {
enum Icmp6Types : std::uint8_t {
UNREACH = 1,
- ICMP6_TYPE_BIG = 2,
+ BIG = 2,
TIME = 3,
PARAMS = 4,
ECHO = 128,
// Things that should be deleted immediately....which I bet will manage to make it into production
-#define ICMP6_UNREACH 1
-#define ICMP6_BIG 2
-#define ICMP6_TIME 3
-#define ICMP6_PARAMS 4
-#define ICMP6_ECHO 128
-#define ICMP6_REPLY 129
-#define ICMP6_SOLICITATION 133
-#define ICMP6_ADVERTISEMENT 134
-#define ICMP6_NODE_INFO_QUERY 139
-#define ICMP6_NODE_INFO_RESPONSE 140
+#if 1
+#define ICMP6_ECHO icmp6::Icmp6Types::ECHO
+#define ICMP6_REPLY icmp6::Icmp6Types::REPLY
+#endif
typedef icmp6::ICMP6Hdr ICMP6Hdr;
typedef icmp6::ICMP6TooBig ICMP6TooBig;
#define IPV4_H
#include <cstdint>
+
+
+#ifndef WIN32
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <net/if.h>
+#else /* !WIN32 */
+#include <netinet/in_systm.h>
+#ifndef IFNAMSIZ
+#define IFNAMESIZ MAX_ADAPTER_NAME
+#endif /* !IFNAMSIZ */
+#endif /* !WIN32 */
+
#include "sfip/sfip_t.h"
#include "protocols/protocol_ids.h" // include ipv4 protocol numbers
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+** Copyright (C) 2007-2013 Sourcefire, Inc.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+// layer.cc author Josh Rosenbaum <jorosenba@cisco.com>
+
+
+#include "protocols/packet.h"
+
+namespace layer
+{
+
+static inline const uint8_t *find_layer(const Layer *lyr,
+ uint8_t num_layers,
+ uint16_t prot_id)
+{
+ for(int i = num_layers - 1; i >= 0 ; i--)
+ {
+ if (lyr->prot_id == prot_id)
+ return lyr->start;
+ lyr++;
+ }
+ return nullptr;
+}
+
+static inline const uint8_t *find_layer(const Layer *lyr,
+ uint8_t num_layers,
+ uint16_t prot_id1,
+ uint16_t prot_id2)
+{
+ for(int i = num_layers - 1; i >= 0; i--)
+ {
+ if (lyr->prot_id == prot_id1 ||
+ lyr->prot_id == prot_id2)
+ return lyr->start;
+ lyr++;
+ }
+ return nullptr;
+}
+
+const arp::EtherARP* get_arp_layer(const Packet* p)
+{
+ uint8_t num_layers = p->next_layer;
+ const Layer *lyr = p->layers;
+
+ return reinterpret_cast<const arp::EtherARP*>(
+ find_layer(lyr, num_layers, ETHERTYPE_ARP, ETHERTYPE_REVARP));
+}
+
+const gre::GREHdr* get_gre_layer(const Packet* p)
+{
+ uint8_t num_layers = p->next_layer;
+ const Layer *lyr = p->layers;
+
+ return reinterpret_cast<const gre::GREHdr*>(
+ find_layer(lyr, num_layers, IPPROTO_ID_GRE));
+}
+
+const eapol::EtherEapol* get_eapol_layer(const Packet* p)
+{
+ uint8_t num_layers = p->next_layer;
+ const Layer *lyr = p->layers;
+
+ return reinterpret_cast<const eapol::EtherEapol*>(
+ find_layer(lyr, num_layers, ETHERTYPE_EAPOL));
+}
+
+const vlan::VlanTagHdr* get_vlan_layer(const Packet* p)
+{
+ uint8_t num_layers = p->next_layer;
+ const Layer *lyr = p->layers;
+
+ return reinterpret_cast<const vlan::VlanTagHdr*>(
+ find_layer(lyr, num_layers, ETHERTYPE_8021Q));
+}
+
+const eth::EtherHdr* get_eth_layer(const Packet* p)
+{
+ uint8_t num_layers = p->next_layer;
+ const Layer *lyr = p->layers;
+
+ // First, search for the inner eth layer (transbridging)
+ const eth::EtherHdr* eh = reinterpret_cast<const eth::EtherHdr*>(
+ find_layer(lyr, num_layers, ETHERTYPE_TRANS_ETHER_BRIDGING));
+
+ // if no inner eth layer, assume root layer is eth (callers job to confirm)
+ return eh ? eh : reinterpret_cast<const eth::EtherHdr*>(get_root_layer(p));
+}
+
+const uint8_t* get_root_layer(const Packet* p)
+{
+ // since token ring is the grinder, its the begining of the packet.
+ if (p->next_layer > 0)
+ return p->layers[0].start;
+ return nullptr;
+}
+
+} // namespace layer
--- /dev/null
+/*
+** Copyright (C) 2002-2013 Sourcefire, Inc.
+** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+#ifndef LAYER_H
+#define LAYER_H
+
+#include <cstdint>
+#include "protocols/protocol_ids.h"
+#include "codecs/sf_protocols.h"
+
+
+
+struct Layer {
+ uint16_t prot_id;
+ PROTO_ID proto;
+ uint16_t length;
+ uint8_t* start;
+};
+
+
+// forward declaring relevent structs. Since we're only return a pointer,
+// there is no need for the actual header files
+
+namespace vlan
+{
+struct VlanTagHdr;
+}
+
+namespace arp
+{
+struct EtherARP;
+}
+
+namespace gre
+{
+struct GREHdr;
+}
+
+namespace eapol
+{
+struct EtherEapol;
+}
+
+namespace eth
+{
+struct EtherHdr;
+}
+
+
+// code maintained in header to ensure files to not depend on this library
+namespace layer
+{
+
+
+// signatures. No need to go searching for the correct function
+const arp::EtherARP* get_arp_layer(const Packet*);
+const vlan::VlanTagHdr* get_vlan_layer(const Packet*);
+const gre::GREHdr* get_gre_layer(const Packet*);
+const eapol::EtherEapol* get_eapol_layer(const Packet*);
+const eth::EtherHdr* get_eth_layer(const Packet*);
+const uint8_t* get_root_layer(const Packet*);
+
+
+} // namespace layer
+
+#endif
--- /dev/null
+/*
+** Copyright (C) 2002-2013 Sourcefire, Inc.
+** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+
+#ifndef LINUX_SLL_H
+#define LINUX_SLL_H
+
+#ifndef NO_NON_ETHER_DECODER
+
+namespace linux_sll
+{
+
+
+/* 'Linux cooked captures' data
+ * (taken from tcpdump source).
+ */
+
+#define SLL_HDR_LEN 16 /* total header length */
+#define SLL_ADDRLEN 8 /* length of address field */
+typedef struct _SLLHdr {
+ uint16_t sll_pkttype; /* packet type */
+ uint16_t sll_hatype; /* link-layer address type */
+ uint16_t sll_halen; /* link-layer address length */
+ uint8_t sll_addr[SLL_ADDRLEN]; /* link-layer address */
+ uint16_t sll_protocol; /* protocol */
+} SLLHdr;
+
+/*
+ * ssl_pkttype values.
+ */
+
+#define LINUX_SLL_HOST 0
+#define LINUX_SLL_BROADCAST 1
+#define LINUX_SLL_MULTICAST 2
+#define LINUX_SLL_OTHERHOST 3
+#define LINUX_SLL_OUTGOING 4
+
+/* ssl protocol values */
+
+#define LINUX_SLL_P_802_3 0x0001 /* Novell 802.3 frames without 802.2 LLC header */
+#define LINUX_SLL_P_802_2 0x0004 /* 802.2 frames (not D/I/X Ethernet) */
+
+
+} // namespace ssl
+
+#endif /* NO_NON_ETHER_DECODER */
+#endif /* LINUX_SLL_H */
#include "sfip/ipv6_port.h"
#include "sfip/sf_ip.h"
#include "sfip/sf_iph.h"
+#include "codecs/sf_protocols.h"
-#include "codecs/layer.h"
+
+#include "protocols/layer.h"
#include "protocols/ipv4.h"
#include "protocols/ipv6.h"
#include "protocols/tcp.h"
#include "protocols/eth.h"
#include "protocols/icmp4.h"
#include "protocols/icmp6.h"
-#include "protocols/arp.h"
-#include "protocols/gre.h"
#include "protocols/mpls.h"
/* D E F I N E S ************************************************************/
#define REASSEMBLED_PACKET_FLAGS (PKT_REBUILT_STREAM|PKT_REASSEMBLED_OLD)
-typedef enum {
+enum PseudoPacketType{
PSEUDO_PKT_IP,
PSEUDO_PKT_TCP,
PSEUDO_PKT_DCE_RPKT,
PSEUDO_PKT_PS,
PSEUDO_PKT_SDF,
PSEUDO_PKT_MAX
-} PseudoPacketType;
+} ;
/* error flags */
#define PKT_ERR_CKSUM_IP 0x01
#define PKT_ERR_CKSUM_ANY 0x0F
#define PKT_ERR_BAD_TTL 0x10
-/* D A T A S T R U C T U R E S *********************************************/
-class Flow;
-
-#ifndef NO_NON_ETHER_DECODER
-/* Start Token Ring Data Structures */
-
-#ifdef _MSC_VER
- /* Visual C++ pragma to disable warning messages about nonstandard bit field type */
- #pragma warning( disable : 4214 )
-#endif
-
-/* LLC structure */
-typedef struct _Trh_llc
-{
- uint8_t dsap;
- uint8_t ssap;
- uint8_t protid[3];
- uint16_t ethertype;
-} Trh_llc;
-
-/* RIF structure
- * Linux/tcpdump patch defines tokenring header in dump way, since not
- * every tokenring header with have RIF data... we define it separately, and
- * a bit more split up
- */
-
-#ifdef _MSC_VER
- /* Visual C++ pragma to disable warning messages about nonstandard bit field type */
- #pragma warning( disable : 4214 )
-#endif
-
-
-/* These are macros to use the bitlevel accesses in the Trh_Mr header
-
- they haven't been tested and they aren't used much so here is a
- listing of what used to be there
-
- #if defined(WORDS_BIGENDIAN)
- uint16_t bcast:3, len:5, dir:1, lf:3, res:4;
- #else
- uint16_t len:5, length of RIF field, including RC itself
- bcast:3, broadcast indicator
- res:4, reserved
- lf:3, largest frame size
- dir:1; direction
-*/
-
-#define TRH_MR_BCAST(trhmr) ((ntohs((trhmr)->bcast_len_dir_lf_res) & 0xe000) >> 13)
-#define TRH_MR_LEN(trhmr) ((ntohs((trhmr)->bcast_len_dir_lf_res) & 0x1F00) >> 8)
-#define TRH_MR_DIR(trhmr) ((ntohs((trhmr)->bcast_len_dir_lf_res) & 0x0080) >> 7)
-#define TRH_MR_LF(trhmr) ((ntohs((trhmr)->bcast_len_dir_lf_res) & 0x0070) >> 4)
-#define TRH_MR_RES(trhmr) ((ntohs((trhmr)->bcast_len_dir_lf_res) & 0x000F))
-
-typedef struct _Trh_mr
-{
- uint16_t bcast_len_dir_lf_res; /* broadcast/res/framesize/direction */
- uint16_t rseg[8];
-} Trh_mr;
-#ifdef _MSC_VER
- /* Visual C++ pragma to enable warning messages about nonstandard bit field type */
- #pragma warning( default : 4214 )
-#endif
-
-#define TR_ALEN 6 /* octets in an Ethernet header */
-#define FDDI_ALEN 6
-
-typedef struct _Trh_hdr
-{
- uint8_t ac; /* access control field */
- uint8_t fc; /* frame control field */
- uint8_t daddr[TR_ALEN]; /* src address */
- uint8_t saddr[TR_ALEN]; /* dst address */
-} Trh_hdr;
-
-#ifdef WIN32
- /* Visual C++ pragma to enable warning messages about nonstandard bit field type */
- #pragma warning( default : 4214 )
-#endif
-/* End Token Ring Data Structures */
-
-
-/* Start FDDI Data Structures */
-
-/* FDDI header is always this: -worm5er */
-typedef struct _Fddi_hdr
-{
- uint8_t fc; /* frame control field */
- uint8_t daddr[FDDI_ALEN]; /* src address */
- uint8_t saddr[FDDI_ALEN]; /* dst address */
-} Fddi_hdr;
-
-/* splitting the llc up because of variable lengths of the LLC -worm5er */
-typedef struct _Fddi_llc_saps
-{
- uint8_t dsap;
- uint8_t ssap;
-} Fddi_llc_saps;
-
-/* I've found sna frames have two addition bytes after the llc saps -worm5er */
-typedef struct _Fddi_llc_sna
-{
- uint8_t ctrl_fld[2];
-} Fddi_llc_sna;
-
-/* I've also found other frames that seem to have only one byte... We're only
-really intersted in the IP data so, until we want other, I'm going to say
-the data is one byte beyond this frame... -worm5er */
-typedef struct _Fddi_llc_other
-{
- uint8_t ctrl_fld[1];
-} Fddi_llc_other;
-
-/* Just like TR the ip/arp data is setup as such: -worm5er */
-typedef struct _Fddi_llc_iparp
-{
- uint8_t ctrl_fld;
- uint8_t protid[3];
- uint16_t ethertype;
-} Fddi_llc_iparp;
-
-/* End FDDI Data Structures */
-
-
-/* 'Linux cooked captures' data
- * (taken from tcpdump source).
- */
-
-#define SLL_HDR_LEN 16 /* total header length */
-#define SLL_ADDRLEN 8 /* length of address field */
-typedef struct _SLLHdr {
- uint16_t sll_pkttype; /* packet type */
- uint16_t sll_hatype; /* link-layer address type */
- uint16_t sll_halen; /* link-layer address length */
- uint8_t sll_addr[SLL_ADDRLEN]; /* link-layer address */
- uint16_t sll_protocol; /* protocol */
-} SLLHdr;
-
-
-/*
- * Snort supports 3 versions of the OpenBSD pflog header:
- *
- * Pflog1_Hdr: CVS = 1.3, DLT_OLD_PFLOG = 17, Length = 28
- * Pflog2_Hdr: CVS = 1.8, DLT_PFLOG = 117, Length = 48
- * Pflog3_Hdr: CVS = 1.12, DLT_PFLOG = 117, Length = 64
- * Pflog3_Hdr: CVS = 1.172, DLT_PFLOG = 117, Length = 100
- *
- * Since they have the same DLT, Pflog{2,3}Hdr are distinguished
- * by their actual length. The minimum required length excludes
- * padding.
- */
-/* Old OpenBSD pf firewall pflog0 header
- * (information from pf source in kernel)
- * the rule, reason, and action codes tell why the firewall dropped it -fleck
- */
-
-typedef struct _Pflog1_hdr
-{
- uint32_t af;
- char intf[IFNAMSIZ];
- int16_t rule;
- uint16_t reason;
- uint16_t action;
- uint16_t dir;
-} Pflog1Hdr;
-
-#define PFLOG1_HDRLEN (sizeof(struct _Pflog1_hdr))
-
-/*
- * Note that on OpenBSD, af type is sa_family_t. On linux, that's an unsigned
- * short, but on OpenBSD, that's a uint8_t, so we should explicitly use uint8_t
- * here. - ronaldo
- */
-
-#define PFLOG_RULELEN 16
-#define PFLOG_PADLEN 3
-
-typedef struct _Pflog2_hdr
-{
- int8_t length;
- uint8_t af;
- uint8_t action;
- uint8_t reason;
- char ifname[IFNAMSIZ];
- char ruleset[PFLOG_RULELEN];
- uint32_t rulenr;
- uint32_t subrulenr;
- uint8_t dir;
- uint8_t pad[PFLOG_PADLEN];
-} Pflog2Hdr;
-
-#define PFLOG2_HDRLEN (sizeof(struct _Pflog2_hdr))
-#define PFLOG2_HDRMIN (PFLOG2_HDRLEN - PFLOG_PADLEN)
-
-typedef struct _Pflog3_hdr
-{
- int8_t length;
- uint8_t af;
- uint8_t action;
- uint8_t reason;
- char ifname[IFNAMSIZ];
- char ruleset[PFLOG_RULELEN];
- uint32_t rulenr;
- uint32_t subrulenr;
- uint32_t uid;
- uint32_t pid;
- uint32_t rule_uid;
- uint32_t rule_pid;
- uint8_t dir;
- uint8_t pad[PFLOG_PADLEN];
-} Pflog3Hdr;
-
-#define PFLOG3_HDRLEN (sizeof(struct _Pflog3_hdr))
-#define PFLOG3_HDRMIN (PFLOG3_HDRLEN - PFLOG_PADLEN)
-
-
-typedef struct _Pflog4_hdr
-{
- uint8_t length;
- uint8_t af;
- uint8_t action;
- uint8_t reason;
- char ifname[IFNAMSIZ];
- char ruleset[PFLOG_RULELEN];
- uint32_t rulenr;
- uint32_t subrulenr;
- uint32_t uid;
- uint32_t pid;
- uint32_t rule_uid;
- uint32_t rule_pid;
- uint8_t dir;
- uint8_t rewritten;
- uint8_t pad[2];
- uint8_t saddr[16];
- uint8_t daddr[16];
- uint16_t sport;
- uint16_t dport;
-} Pflog4Hdr;
-
-#define PFLOG4_HDRLEN sizeof(struct _Pflog4_hdr)
-#define PFLOG4_HDRMIN sizeof(struct _Pflog4_hdr)
-
-/*
- * ssl_pkttype values.
- */
-
-#define LINUX_SLL_HOST 0
-#define LINUX_SLL_BROADCAST 1
-#define LINUX_SLL_MULTICAST 2
-#define LINUX_SLL_OTHERHOST 3
-#define LINUX_SLL_OUTGOING 4
-
-/* ssl protocol values */
-
-#define LINUX_SLL_P_802_3 0x0001 /* Novell 802.3 frames without 802.2 LLC header */
-#define LINUX_SLL_P_802_2 0x0004 /* 802.2 frames (not D/I/X Ethernet) */
-#endif // NO_NON_ETHER_DECODER
-
-
-#ifdef _MSC_VER
- /* Visual C++ pragma to disable warning messages
- * about nonstandard bit field type
- */
- #pragma warning( disable : 4214 )
-#endif
-
-#define VTH_PRIORITY(vh) ((ntohs((vh)->vth_pri_cfi_vlan) & 0xe000) >> 13)
-#define VTH_CFI(vh) ((ntohs((vh)->vth_pri_cfi_vlan) & 0x1000) >> 12)
-#define VTH_VLAN(vh) ((uint16_t)(ntohs((vh)->vth_pri_cfi_vlan) & 0x0FFF))
-
-typedef struct _VlanTagHdr
-{
- uint16_t vth_pri_cfi_vlan;
- uint16_t vth_proto; /* protocol field... */
-} VlanTagHdr;
-#ifdef _MSC_VER
- /* Visual C++ pragma to enable warning messages about nonstandard bit field type */
- #pragma warning( default : 4214 )
-#endif
-
-
-typedef struct _EthLlc
-{
- uint8_t dsap;
- uint8_t ssap;
-} EthLlc;
-
-typedef struct _EthLlcOther
-{
- uint8_t ctrl;
- uint8_t org_code[3];
- uint16_t proto_id;
-} EthLlcOther;
/* We must twiddle to align the offset the ethernet header and align
* the IP header on solaris -- maybe this will work on HPUX too.
#endif
-#ifndef NO_NON_ETHER_DECODER
-/*
- * Wireless Header (IEEE 802.11)
- */
-typedef struct _WifiHdr
-{
- uint16_t frame_control;
- uint16_t duration_id;
- uint8_t addr1[6];
- uint8_t addr2[6];
- uint8_t addr3[6];
- uint16_t seq_control;
- uint8_t addr4[6];
-} WifiHdr;
-
-
-struct EtherEapol
-{
- uint8_t version; /* EAPOL proto version */
- uint8_t eaptype; /* EAPOL Packet type */
- uint16_t len; /* Packet body length */
-};
-
-struct EAPHdr
-{
- uint8_t code;
- uint8_t id;
- uint16_t len;
-};
-
-struct EapolKey
-{
- uint8_t type;
- uint8_t length[2];
- uint8_t counter[8];
- uint8_t iv[16];
- uint8_t index;
- uint8_t sig[16];
-};
-
-
-#endif // NO_NON_ETHER_DECODER
-
-
-/* Can't add any fields not in the real header here
- because of how the decoder uses structure overlaying */
-#ifdef _MSC_VER
- /* Visual C++ pragma to disable warning messages
- * about nonstandard bit field type
- */
- #pragma warning( disable : 4214 )
-#endif
-
-
-#define NUM_IP_PROTOS 256
-
-
-#ifndef IPPROTO_IP_MOBILITY
-#define IPPROTO_IP_MOBILITY 55
-#endif
-#ifndef IPPROTO_SUN_ND
-#define IPPROTO_SUN_ND 77
-#endif
-#ifndef IPPROTO_PIM
-#define IPPROTO_PIM 103
-#endif
-
-#define IP_OPTMAX 40
-#define TCP_OPTLENMAX 40 /* (((2^4) - 1) * 4 - TCP_HEADER_LEN) */
-const uint32_t IP6_EXTMAX = 8;
-
-
-
-#ifdef _MSC_VER
- /* Visual C++ pragma to enable warning messages about nonstandard bit field type */
- #pragma warning( default : 4214 )
-#endif
-
-
-/* Can't add any fields not in the real header here
- because of how the decoder uses structure overlaying */
-#ifdef _MSC_VER
- /* Visual C++ pragma to disable warning
- * messages about nonstandard bit field type
- */
- #pragma warning( disable : 4214 )
-#endif
-
-
+/* default mpls flags */
+#define DEFAULT_MPLS_PAYLOADTYPE MPLS_PAYLOADTYPE_IPV4
+#define DEFAULT_LABELCHAIN_LENGTH -1
-#define ERSPAN_VERSION(x) ((ntohs(x->ver_vlan) & 0xf000) >> 12)
-#define ERSPAN_VLAN(x) (ntohs(x->ver_vlan) & 0x0fff)
-#define ERSPAN_SPAN_ID(x) (ntohs(x->flags_spanId) & 0x03ff)
-#define ERSPAN3_TIMESTAMP(x) (x->timestamp)
+const int32_t MAX_PORTS = 65536;
+const uint16_t NUM_IP_PROTOS = 256;
+const int16_t SFTARGET_UNKNOWN_PROTOCOL = -1;
+const uint8_t IP_OPTMAX = 40;
+const uint8_t TCP_OPTLENMAX = 40; /* (((2^4) - 1) * 4 - TCP_HEADER_LEN) */
+const uint8_t IP6_EXTMAX = 8;
+const uint8_t MIN_TTL = 64;
+const uint8_t MAX_TTL = 255;
-#ifdef _MSC_VER
- /* Visual C++ pragma to enable warning messages
- * about nonstandard bit field type
- */
- #pragma warning( default : 4214 )
-#endif
-
+/* D A T A S T R U C T U R E S *********************************************/
+class Flow;
-typedef struct _Options
+struct Options
{
uint8_t code;
uint8_t len; /* length of the data section */
const uint8_t *data;
-} Options;
-
-
-
-
-/* PPPoEHdr Header; eth::EtherHdr plus the PPPoE Header */
-typedef struct _PPPoEHdr
-{
- unsigned char ver_type; /* pppoe version/type */
- unsigned char code; /* pppoe code CODE_* */
- unsigned short session; /* session id */
- unsigned short length; /* payload length */
- /* payload follows */
-} PPPoEHdr;
-
-/* PPPoE tag; the payload is a sequence of these */
-typedef struct _PPPoE_Tag
-{
- unsigned short type; /* tag type TAG_* */
- unsigned short length; /* tag length */
- /* payload follows */
-} PPPoE_Tag;
+} ;
-#define LAYER_MAX 32
+const uint8_t LAYER_MAX = 32;
struct Packet
{
//^^^------------------------------------------------
//vvv-----------------------------
- EtherARP *ah;
- const eth::EtherHdr *eh; /* standard TCP/IP/Ethernet/ARP headers */
- const VlanTagHdr *vh;
- EthLlc *ehllc;
- EthLlcOther *ehllcother;
- const PPPoEHdr *pppoeh; /* Encapsulated PPP of Ether header */
- const GREHdr *greh;
- uint32_t *mpls;
const IPHdr *iph, *orig_iph;/* and orig. headers for ICMP_*_UNREACH family */
const IPHdr *inner_iph; /* if IP-in-IP, this will be the inner IP header */
const IPHdr *outer_iph; /* if IP-in-IP, this will be the outer IP header */
const TCPHdr *tcph, *orig_tcph;
const udp::UDPHdr *udph, *orig_udph;
- const udp::UDPHdr *inner_udph; /* if Teredo + UDP, this will be the inner UDP header */
const udp::UDPHdr *outer_udph; /* if Teredo + UDP, this will be the outer UDP header */
const ICMPHdr *icmph, *orig_icmph;
uint8_t GTPencapsulated;
uint8_t next_layer; /* index into layers for next encap */
-#ifndef NO_NON_ETHER_DECODER
- const Fddi_hdr *fddihdr; /* FDDI support headers */
- Fddi_llc_saps *fddisaps;
- Fddi_llc_sna *fddisna;
- Fddi_llc_iparp *fddiiparp;
- Fddi_llc_other *fddiother;
-
- const Trh_hdr *trh; /* Token Ring support headers */
- Trh_llc *trhllc;
- Trh_mr *trhmr;
-
- Pflog1Hdr *pf1h; /* OpenBSD pflog interface header - version 1 */
- Pflog2Hdr *pf2h; /* OpenBSD pflog interface header - version 2 */
- Pflog3Hdr *pf3h; /* OpenBSD pflog interface header - version 3 */
- Pflog4Hdr *pf4h; /* OpenBSD pflog interface header - version 4 */
-
-#ifdef DLT_LINUX_SLL
- const SLLHdr *sllh; /* Linux cooked sockets header */
-#endif
-#ifdef DLT_IEEE802_11
- const WifiHdr *wifih; /* wireless LAN header */
-#endif
- const EtherEapol *eplh; /* 802.1x EAPOL header */
- const EAPHdr *eaph;
- const uint8_t *eaptype;
- EapolKey *eapolk;
-#endif
-
// nothing after this point is zeroed ...
ipv4::IpOptions ip_options[IP_OPTMAX]; /* ip options decode structure */
Options tcp_options[TCP_OPTLENMAX]; /* tcp options decode struct */
#define PROTO_BIT__ICMP 0x0010
#define PROTO_BIT__TEREDO 0x0020
#define PROTO_BIT__GTP 0x0040
+#define PROTO_BIT__MPLS 0x0080
+#define PROTO_BIT__VLAN 0x0100
+#define PROTO_BIT__ETH 0x0200
#define PROTO_BIT__OTHER 0x8000
#define PROTO_BIT__ALL 0xffff
return p->family == AF_INET6;
}
+static inline uint16_t EXTRACT_16BITS(const uint8_t* p)
+{
+ return ntohs(*(uint16_t*)(p));
+}
+
+#ifdef WORDS_MUSTALIGN
+
+#if defined(__GNUC__)
+/* force word-aligned ntohl parameter */
+ static inline uint32_t EXTRACT_32BITS(const uint8_t* p)
+ {
+ uint32_t tmp;
+ memmove(&tmp, p, sizeof(uint32_t));
+ return ntohl(tmp);
+ }
+#endif /* __GNUC__ */
+
+#else
+
+/* allows unaligned ntohl parameter - dies w/SIGBUS on SPARCs */
+ static inline uint32_t EXTRACT_32BITS(const uint8_t* p)
+ {
+ return ntohl(*(uint32_t *)p);
+ }
+#endif /* WORDS_MUSTALIGN */
+
#endif
const uint16_t IPPROTO_ID_IPV6 = 41;
const uint16_t IPPROTO_ID_ROUTING = 43;
const uint16_t IPPROTO_ID_FRAGMENT = 44;
+const uint16_t IPPROTO_ID_GRE = 47;
const uint16_t IPPROTO_ID_ESP = 50;
const uint16_t IPPROTO_ID_AH = 51; // RFC 4302
const uint16_t IPPROTO_ID_ICMPV6 = 58;
const uint16_t ETHERTYPE_TRANS_ETHER_BRIDGING = 0x6558;
const uint16_t ETHERTYPE_IPV4 = 0x0800;
+const uint16_t ETHERTYPE_REVARP = 0x8035;
+const uint16_t ETHERTYPE_ARP = 0x0806;
+const uint16_t ETHERTYPE_8021Q = 0x8100;
+const uint16_t ETHERTYPE_IPX = 0x8137;
const uint16_t ETHERTYPE_IPV6 = 0x86dd;
const uint16_t ETHERTYPE_PPP = 0x880B;
-const uint16_t ETHERTYPE_IPX = 0x8137;
+const uint16_t ETHERTYPE_EAPOL = 0x888e;
#endif
--- /dev/null
+/*
+** Copyright (C) 2002-2013 Sourcefire, Inc.
+** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+
+#ifndef TOKEN_RING_H
+#define TOKEN_RING_H
+
+namespace token_ring{
+
+/* LLC structure */
+struct Trh_llc
+{
+ uint8_t dsap;
+ uint8_t ssap;
+ uint8_t protid[3];
+ uint16_t ethertype;
+} ;
+
+/* RIF structure
+ * Linux/tcpdump patch defines tokenring header in dump way, since not
+ * every tokenring header with have RIF data... we define it separately, and
+ * a bit more split up
+ */
+
+
+/* These are macros to use the bitlevel accesses in the Trh_Mr header
+
+ they haven't been tested and they aren't used much so here is a
+ listing of what used to be there
+
+ #if defined(WORDS_BIGENDIAN)
+ uint16_t bcast:3, len:5, dir:1, lf:3, res:4;
+ #else
+ uint16_t len:5, length of RIF field, including RC itself
+ bcast:3, broadcast indicator
+ res:4, reserved
+ lf:3, largest frame size
+ dir:1; direction
+*/
+
+#define TRH_MR_BCAST(trhmr) ((ntohs((trhmr)->bcast_len_dir_lf_res) & 0xe000) >> 13)
+#define TRH_MR_LEN(trhmr) ((ntohs((trhmr)->bcast_len_dir_lf_res) & 0x1F00) >> 8)
+#define TRH_MR_DIR(trhmr) ((ntohs((trhmr)->bcast_len_dir_lf_res) & 0x0080) >> 7)
+#define TRH_MR_LF(trhmr) ((ntohs((trhmr)->bcast_len_dir_lf_res) & 0x0070) >> 4)
+#define TRH_MR_RES(trhmr) ((ntohs((trhmr)->bcast_len_dir_lf_res) & 0x000F))
+
+struct Trh_mr
+{
+ uint16_t bcast_len_dir_lf_res; /* broadcast/res/framesize/direction */
+ uint16_t rseg[8];
+};
+
+#define TR_ALEN 6 /* octets in an Ethernet header */
+#define FDDI_ALEN 6
+#define IPARP_SAP 0xaa
+
+struct Trh_hdr
+{
+ uint8_t ac; /* access control field */
+ uint8_t fc; /* frame control field */
+ uint8_t daddr[TR_ALEN]; /* src address */
+ uint8_t saddr[TR_ALEN]; /* dst address */
+};
+/* End Token Ring Data Structures */
+
+static inline const Trh_mr* get_trhmr(const Trh_llc* llc)
+{
+
+ if(llc->dsap != IPARP_SAP && llc->ssap != IPARP_SAP)
+ return reinterpret_cast<const Trh_mr *>(llc);
+
+ return nullptr;
+}
+
+} // namespace token_ring
+
+#endif
--- /dev/null
+/*
+** Copyright (C) 2002-2013 Sourcefire, Inc.
+** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+
+#ifndef VLAN_H
+#define VLAN_H
+
+namespace vlan
+{
+
+struct VlanTagHdr
+{
+ uint16_t vth_pri_cfi_vlan;
+ uint16_t vth_proto; /* protocol field... */
+};
+
+
+static inline uint16_t vth_priority(const VlanTagHdr* vh)
+{
+ return (ntohs((vh)->vth_pri_cfi_vlan) & 0xe000) >> 13;
+}
+
+static inline uint16_t vth_cfi(const VlanTagHdr* vh)
+{
+ return (ntohs((vh)->vth_pri_cfi_vlan) & 0x1000) >> 12;
+}
+
+static inline uint16_t vth_vlan(const VlanTagHdr* vh)
+{
+ return ntohs((vh)->vth_pri_cfi_vlan) & 0x0FFF;
+}
+
+} // namespace vlan
+
+#endif
+
#ifndef WLAN_H
#define WLAN_H
-#include <cstdint>
+#ifndef NO_NON_ETHER_DECODER
+
+namespace wlan
+{
+
+/*
+ * Wireless Header (IEEE 802.11)
+ */
+struct WifiHdr
+{
+ uint16_t frame_control;
+ uint16_t duration_id;
+ uint8_t addr1[6];
+ uint8_t addr2[6];
+ uint8_t addr3[6];
+ uint16_t seq_control;
+ uint8_t addr4[6];
+} ;
/* Frame type/subype combinations with version = 0 */
#define WLAN_FLAG_WEP 0x4000 /* Wep Enabled 00000010 */
#define WLAN_FLAG_ORDER 0x8000 /* Strict Order 00000001 */
+} // namespace wlan
+
+#endif
#endif
#include "snort_types.h"
#include "detect.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "event.h"
#include "parser.h"
#include "snort_debug.h"
#define FT_MAIN_H
#include "ftpp_ui_config.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "framework/bits.h"
+#include "time/profiler.h"
#define BUF_SIZE 1024
#define FTP_PARSE_H
#include "ftpp_ui_config.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "framework/bits.h"
/*
#include "snort_types.h"
#include "sf_ip.h"
#include "snort_debug.h"
-#include "decode.h"
+#include "protocols/packet.h"
#define GENERATOR_SPP_FTPP_FTP 125
#define GENERATOR_SPP_FTPP_TELNET 126
#include "ftpp_ui_config.h"
#include "ftp_client.h"
#include "ftp_server.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "file_api/file_api.h"
#include "stream/stream_api.h"
#include "flow/flow.h"
#include <sys/types.h>
-//#include "decode.h"
+//#include "protocols/packet.h"
#include "ftpp_ui_config.h"
#include "ftpp_si.h"
/* RFC 1184 defines Abort, Suspend, and End of File telnet optinos */
#define RFC1184
-//#include "decode.h"
+//#include "protocols/packet.h"
#include "ftpp_ui_config.h"
#include "ftpp_si.h"
#include "snort.h"
#include "detect.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "event.h"
#include "generators.h"
#include "snort_debug.h"
#include "config.h"
#endif
-#include "decode.h"
+#include "protocols/packet.h"
#include "stream/stream_api.h"
#include "hi_ui_config.h"
#include "util_utf.h"
#include "generators.h"
#include "hi_events.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "snort.h"
#include "stream/stream_api.h"
#include "snort_debug.h"
#include "hi_ad.h"
#include "ipv6_port.h"
-#include "decode.h"
+#include "protocols/packet.h"
/*
** These are the defines for the different types of
#include <string.h>
#include <sys/types.h>
-#include "decode.h"
+#include "protocols/packet.h"
#include "snort_debug.h"
#include "util.h"
#include "parser.h"
#include <string>
#include "rpc_module.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "parser.h"
#include "snort_debug.h"
#include "util.h"
#include "config.h"
#endif
#include <string.h>
-#include "decode.h"
+#include "protocols/packet.h"
#define FAILURE -1
#define SUCCESS 0
stream_icmp
stream_tcp
stream_udp
+ protocols
)
install (FILES ${STREAM_INCLUDES}
stream_icmp.h
)
+target_link_libraries( stream_icmp
+ protocols
+)
#include "icmp_session.h"
#include "snort_types.h"
#include "snort_debug.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "mstring.h"
#include "sfxhash.h"
#include "util.h"
#include "flow/session.h"
#include "perf_monitor/perf.h"
#include "profiler.h"
+#include "protocols/layer.h"
+#include "protocols/vlan.h"
static SessionStats gicmpStats;
static THREAD_LOCAL SessionStats icmpStats;
skey.port_h = sport;
}
- if (p->vh)
- skey.vlan_tag = (uint16_t)VTH_VLAN(p->vh);
+ if (p->proto_bits & PROTO_BIT__VLAN)
+ skey.vlan_tag = vlan::vth_vlan(layer::get_vlan_layer(p));
else
skey.vlan_tag = 0;
#include "snort_bounds.h"
#include "log_text.h"
#include "detect.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "managers/packet_manager.h"
#include "event.h"
#include "util.h"
#include "icmp/stream_icmp.h"
#include "ip/stream_ip.h"
#include "mstring.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "detect.h"
#include "generators.h"
#include "perf_monitor/perf.h"
#include "ipv6_port.h"
#include "ips_options/ips_flowbits.h"
#include "snort_debug.h"
+#include "protocols/layer.h"
+#include "protocols/vlan.h"
#include "target_based/sftarget_protocol_reference.h"
#include "target_based/sftarget_hostentry.h"
GET_SRC_IP(p), p->sp,
GET_DST_IP(p), p->dp,
GET_IPH_PROTO(p),
- p->vh ? VTH_VLAN(p->vh) : 0,
- p->mpls ? p->mplsHdr.label : 0,
+ // if the vlan protocol bit is defined, vlan layer gauranteed to exist
+ (p->proto_bits & PROTO_BIT__VLAN) ? vlan::vth_vlan(layer::get_vlan_layer(p)) : 0,
+ (p->proto_bits & PROTO_BIT__MPLS) ? p->mplsHdr.label : 0,
addressSpaceId);
}
#include "flow/flow.h"
#include "stream/stream_api.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "target_based/sftarget_protocol_reference.h"
#include "framework/bits.h"
#include "generators.h"
#include "snort.h"
#include "time/packet_time.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "managers/packet_manager.h"
#include "log_text.h"
#include "packet_io/active.h"
{
int i, j, ret = 0;
- if (p->eh == NULL)
+ if (!(p->proto_bits & PROTO_BIT__ETH))
return 0;
+ // if flag is set, gauranteed to have an eth layer
+ const eth::EtherHdr *eh = layer::get_eth_layer(p);
+
for ( i = 0; i < 6; ++i )
{
- if ((talker->mac_addr[i] != p->eh->ether_src[i]))
+ if ((talker->mac_addr[i] != eh->ether_src[i]))
break;
}
for ( j = 0; j < 6; ++j )
{
- if (listener->mac_addr[j] != p->eh->ether_dst[j])
+ if (listener->mac_addr[j] != eh->ether_dst[j])
break;
}
int i;
/* Not ethernet based, nothing to do */
- if (p->eh == NULL)
+ if (!(p->proto_bits & PROTO_BIT__ETH))
return;
+ // if flag is set, gauranteed to have an eth layer
+ const eth::EtherHdr *eh = layer::get_eth_layer(p);
+
if (dir == FROM_CLIENT)
{
/* Client is SRC */
for (i=0;i<6;i++)
{
- tcpssn->client.mac_addr[i] = p->eh->ether_src[i];
- tcpssn->server.mac_addr[i] = p->eh->ether_dst[i];
+ tcpssn->client.mac_addr[i] = eh->ether_src[i];
+ tcpssn->server.mac_addr[i] = eh->ether_dst[i];
}
}
else
/* Server is SRC */
for (i=0;i<6;i++)
{
- tcpssn->server.mac_addr[i] = p->eh->ether_src[i];
- tcpssn->client.mac_addr[i] = p->eh->ether_dst[i];
+ tcpssn->server.mac_addr[i] = eh->ether_src[i];
+ tcpssn->client.mac_addr[i] = eh->ether_dst[i];
}
}
}
#include "mstring.h"
#include "sfxhash.h"
#include "util.h"
-#include "decode.h"
+#include "protocols/packet.h"
#include "flow/flow_control.h"
#include "flow/session.h"
#include "rules.h"
#ifndef SFTARGET_PROTOCOL_REFERENCE_H
#define SFTARGET_PROTOCOL_REFERENCE_H
-#include "decode.h"
+#include "protocols/packet.h"
#include "util.h"
#include "sftarget_data.h"
-if ( TESTING_ENABLED )
+if ( BUILD_UNIT_TESTS )
-#find_package(GCOV)
+find_package(CHECK REQUIRED)
+include_directories(${CHECK_INCLUDE_DIR})
+include_directories(${CMAKE_CURRENT_BINARY_DIR}) # for generated files
-message ("cmake path = ..${CMAKE_MODULE_PATH}..")
-#SET (CHECK_DIR "${CMAKE_MODULE_PATH}")
-find_package(CHECK)
-find_package(GCOV)
-
-
-# build sf_ip_test
-
-
-
-# BUILDING SF_IP_TEST:
-
-
-add_executable (sf_ip_test sf_ip_test.cc)
-add_compile_flags (sf_ip_test "--std=gnu++11 -O0 -Wall -fprofile-arcs -ftest-coverage -DSF_IP_TEST -C ${CMAKE_CURRENT_BINARY_DIR}")
-add_link_flags (sf_ip_test "-g -O0 -Wall -fprofile-arcs -ftest-coverage -DSF_IP_TEST")
-target_link_libraries ( sf_ip_test
- policy
- sfrt
- sfip
- utils
- ${CHECK_LIBRARY}
- ${MATH_LIBRARY}
+# Generating build_decl.h Will rebuild every time 'make' is run
+add_custom_target(build_suit_decl ALL
+ COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/build_list.sh ${CMAKE_SOURCE_DIR}/src ${CMAKE_CURRENT_BINARY_DIR}
+ COMMENT "building suite_decl.h"
)
-
-
-# BUILDING SFTHD_TEST
-
-#add_executable ( sfthd_test
-# sfthd_test.cc
-# unit_hacks.cc
-# unit_hacks.h
-# ${CMAKE_SOURCE_DIR}/src/filters/sfthd.cc
-#)
-
-#add_compile_flags (sfthd_test "-DSFTHD_TEST")
-#target_link_libraries ( sfthd_test
-# policy
-# sfrt
-# sfip
-# utils
-# ${CHECK_LIBRARY}
-# ${MATH_LIBRARY}
-#)
-
-# BUILDDING SFRF_TEST
-
-#add_executable (sfrf_test
-# sfrf_test.cc
-# unit_hacks.cc
-# unit_hacks.h
-# ${CMAKE_SOURCE_DIR}/src/filters/sfrf.cc
-#)
-#add_compile_flags (sfrf_test "-DSFRF_TEST")
-#target_link_libraries ( sfrf_test
-# policy
-# sfrt
-# sfip
-# utils
-# ${CHECK_LIBRARY}
-# ${MATH_LIBRARY}
-#)
-
-
-# BUILDING SFRF_TEST
-#add_executable ( sfrt_test sfrt_test.cc )
-#target_link_libraries (sfrf_test
-# policy
-# sfrt
-# sfip
-# utils
-# ${CHECK_LIBRARY}
-# ${MATH_LIBRARY}
-#)
-
-
-ADD_CUSTOM_TARGET( check
- COMMAND "${CMAKE_CURRENT_BINARY_DIR}/sf_ip_test"
-# COMMAND "${CMAKE_CURRENT_BINARY_DIR}/sfthd_test"
-# COMMAND "${CMAKE_CURRENT_BINARY_DIR}/sfrf_test"
-# COMMAND "${CMAKE_CURRENT_BINARY_DIR}/sfrt_test"
- DEPENDS sf_ip_test
-# sfthd_test
-# sfrf_test
-# sfrt_test
+add_custom_command( OUTPUT ${CMAKE_CURRENT_BINARY_DIR}/suite_decl.h
+ COMMAND ${CMAKE_COMMAND} -E touch_nocreate ${CMAKE_CURRENT_BINARY_DIR}/suite_decl.h
+ DEPENDS build_suit_decl
)
-
-# BUILDING AND RUNNING GCOV PROJECTS
-
-message ("CHECK_LIBRARY = ${CHECK_LIBRARY}")
-message ("MATH_LIBRARY = ${MATH_LIBRARY}")
-
-
-add_executable ( sf_ip_gcov_prog
- ../sfip/sf_ip.cc
- sf_ip_test.cc
+# Generating suite_list.h Will rebuild every time 'make' is run
+add_custom_target(build_suite_list ALL
+ COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/build_decl.sh ${CMAKE_SOURCE_DIR}/src ${CMAKE_CURRENT_BINARY_DIR}
+ COMMENT "building suite_list.h"
)
-include_directories("${CMAKE_CURRENT_SOURCE_DIR}/..")
-add_compile_flags (sf_ip_gcov_prog "--std=gnu++11 -O0 -Wall -fprofile-arcs -ftest-coverage -DSF_IP_TEST -C ${CMAKE_CURRENT_BINARY_DIR}")
-add_link_flags (sf_ip_gcov_prog "-g -O0 -Wall -fprofile-arcs -ftest-coverage -DSF_IP_TEST")
-#CFLAGS="-g -O0 -Wall -W -fprofile-arcs -ftest-coverage"
-#LDFLAGS="-fprofile-arcs -ftest-coverage"
-target_link_libraries ( sf_ip_gcov_prog
- ${CHECK_LIBRARY}
- ${MATH_LIBRARY}
+add_custom_command( OUTPUT ${CMAKE_CURRENT_BINARY_DIR}/suite_list.h
+ COMMAND ${CMAKE_COMMAND} -E touch_nocreate ${CMAKE_CURRENT_BINARY_DIR}/suite_list.h
+ DEPENDS build_suite_list
)
-message ("current binary directory is ${CMAKE_CURRENT_BINARY_DIR}")
-
-ADD_CUSTOM_TARGET ( sf_ip_gcov
- COMMAND "${CMAKE_CURRENT_BINARY_DIR}/sf_ip_gcov_prog"
- COMMAND ${GCOV_EXECUTABLE}
- -o ${CMAKE_CURRENT_BINARY_DIR}
- ${CMAKE_SOURCE_DIR}/src/sfip/sf_ip.cc
- COMMAND ${GCOV_EXECUTABLE}
- -o ${CMAKE_CURRENT_BINARY_DIR}
- ${CMAKE_CURRENT_SOURCE_DIR}/sf_ip_test.cc
- DEPENDS sf_ip_gcov_prog
+add_library(unit_tests STATIC
+ ${CMAKE_CURRENT_BINARY_DIR}/suite_decl.h
+ ${CMAKE_CURRENT_BINARY_DIR}/suite_list.h
+ sfip_test.cc
+ sfrf_test.cc
+ sfrt_test.cc
+ sfthd_test.cc
+ unit_test.cc
+ unit_test.h
)
+target_link_libraries(unit_tests
+ ${CHECK_LIBRARIES}
+)
-#ADD_CUSTOM_TARGET ( gcov_tests
-# DEPENDS sf_ip_gcov
-# sfthc_gcov
-# sfrf_gcov
-# sfrt_gcov
-#)
-
-
-#sf_ip_gcov:
-# g++ -g -O0 -Wall -fprofile-arcs -ftest-coverage -o sf_ip_test -DSF_IP_TEST -lm -lcheck -I.. ../sf_ip.cc sf_ip_test.cc
-# ./sf_ip_test
-# gcov ../sf_ip.cc
-# gcov sf_ip_test.cc
-
-#sfthd_gcov:
-# g++ -g -O0 -Wall -fprofile-arcs -ftest-coverage -o sfthd_test -lm -lcheck -I.. -I../.. sfthd_test.cc ../sfthd.cc $(top_builddir)/src/utils/libutils.a
-# ./sfthd_test
-# gcov ../sfthd.cc
-# gcov sfthd_test.cc
-
-#sfrf_gcov:
-# g++ -g -O0 -Wall -fprofile-arcs -ftest-coverage -o sfrf_test -lm -lcheck -I.. -I../.. sfrf_test.cc ../sfrf.cc $(top_builddir)/src/utils/libutils.a
-# ./sfrf_test
-# gcov ../sfrf.cc
-# gcov sfrf_test.cc
-
-#sfrt_gcov:
-# g++ -g -O0 -Wall -fprofile-arcs -ftest-coverage -o sfrt_test -lm -lcheck -I.. -I../.. sfrt_test.cc ../sfrt.cc
-# ./sfrt_test
-# gcov ../sfrt.cc
-# gcov sfrt_test.cc
+set_source_files_properties( unit_test.cc PROPERTIES
+ OBJECT_DEPENDS ${CMAKE_CURRENT_BINARY_DIR}/suite_decl.h
+ OBJECT_DEPENDS ${CMAKE_CURRENT_BINARY_DIR}/suite_list.h
+)
-endif( TESTING_ENABLED)
+endif()
--- /dev/null
+#/bin/bash
+
+SOURCE_DIR=$1
+FILE=$2/suite_decl.h
+
+rm -f $FILE ;
+for f in `grep -whoR --include \*.cc 'TEST_SUITE[^(]*' $SOURCE_DIR` ; do
+ echo "extern Suite* $f();" >> $FILE ;
+done ;
+touch unit_test.cc
--- /dev/null
+#!/bin/bash
+
+SOURCE_DIR=$1
+FILE=$2/suite_list.h
+
+rm -f $FILE ;
+for f in `grep -whoR --include \*.cc 'TEST_SUITE[^(]*' $SOURCE_DIR` ; do
+ echo "$f," >> $FILE ;
+done ;
+touch unit_test.cc
#include "rules.h"
#include "treenodes.h"
#include "treenodes.h"
-#include "decode.h"
#include "parser.h"
#include "util.h"
#include "rules.h"
#include "detection/detect.h"
#include "detection/fpdetect.h"
#include "actions/actions.h"
+#include "protocols/packet.h"
#ifdef PPM_MGR
projects / thirdparty / snort3.git / commitdiff
