Merge pull request #946 in SNORT/snort3 from user_dax to master

Squashed commit of the following:

commit 6dae979e555eeec63b16f1c494cc075479119ace
Author: Russ Combs <rucombs@cisco.com>
Date:   Thu Jul 6 21:20:04 2017 -0400

    review: not sup and size check

commit b23ad2fb260560fcd980a1a456d998c354068535
Author: Russ Combs <rucombs@cisco.com>
Date:   Thu Jul 6 21:13:48 2017 -0400

    decode: fix counts when no layers are decoded

commit 22596bc64fe69d91e0edf18db55f144ed80e784f
Author: Russ Combs <rucombs@cisco.com>
Date:   Wed Jul 5 15:29:14 2017 -0400

    daq_file: update for pci query

commit 3f3fbd6bc99ae44532080f49d995ac2e27f3fe97
Author: Russ Combs <rucombs@cisco.com>
Date:   Wed Jul 5 14:54:11 2017 -0400

    daq_hext: cleanup

commit 6692812227307ff76064fbb7f6f4c76eb9111791
Author: Russ Combs <rucombs@cisco.com>
Date:   Wed Jul 5 14:49:16 2017 -0400

    daq_hext, cd_user: query for pci

diff --git a/daqs/daq_file.c b/daqs/daq_file.c
index da46ae2dd5228a46885c2a0bfd8e4997a8b388d7..0447d88cbaa60de64b62596a8b7e3722bbe76325 100644 (file)
--- a/daqs/daq_file.c
+++ b/daqs/daq_file.c
@@ -24,6 +24,7 @@
 
 #include "daq_user.h"
 
+#include <assert.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <stdlib.h>
@@ -362,6 +363,20 @@ static int file_daq_set_filter (void* handle, const char* filter)
     return DAQ_ERROR_NOTSUP;
 }
 
+static int file_query_flow(void *handle, const DAQ_PktHdr_t *hdr, DAQ_QueryFlow_t *query)
+{
+    FileImpl* impl = (FileImpl*)handle;
+    assert(hdr->priv_ptr == &impl->pci);  // sanity check
+
+    if ( query->type == DAQ_USR_QUERY_PCI )
+    {
+        query->value = &impl->pci;
+        query->length = sizeof(impl->pci);
+        return DAQ_SUCCESS;
+    }
+    return DAQ_ERROR_NOTSUP;
+}
+
 //-------------------------------------------------------------------------
 
 #ifdef BUILDING_SO
@@ -395,6 +410,7 @@ DAQ_Module_t file_daq_module_data =
     .hup_prep = NULL,
     .hup_apply = NULL,
     .hup_post = NULL,
-    .dp_add_dc = NULL
+    .dp_add_dc = NULL,
+    .query_flow = file_query_flow
 };
 

diff --git a/daqs/daq_hext.c b/daqs/daq_hext.c
index e1c9814b0b744ae231d8cdac6ad1ddbefec91c57..ba74139cb6b7ceb8707c63712a124f2f57e437d8 100644 (file)
--- a/daqs/daq_hext.c
+++ b/daqs/daq_hext.c
@@ -24,6 +24,7 @@
 
 #include "daq_user.h"
 
+#include <assert.h>
 #include <ctype.h>
 #include <errno.h>
 #include <stdlib.h>
@@ -67,13 +68,13 @@ typedef struct {
 
     DAQ_State state;
     DAQ_Stats_t stats;
-} FileImpl;
+} HextImpl;
 
 //-------------------------------------------------------------------------
 // utility functions
 //-------------------------------------------------------------------------
 
-static void set_c2s(FileImpl* impl, int c2s)
+static void set_c2s(HextImpl* impl, int c2s)
 {
     if ( c2s )
     {
@@ -109,7 +110,7 @@ static void parse_host(const char* s, uint32_t* addr, uint16_t* port)
     *port = atoi(s);
 }
 
-static void parse_pci(FileImpl* impl, const char* s)
+static void parse_pci(HextImpl* impl, const char* s)
 {
     parse_host(s, &impl->pci.src_addr, &impl->pci.src_port);
 
@@ -127,7 +128,7 @@ static void parse_pci(FileImpl* impl, const char* s)
         impl->pci.flags &= ~DAQ_USR_FLAG_TO_SERVER;
 }
 
-static unsigned flush(FileImpl* impl)
+static unsigned flush(HextImpl* impl)
 {
     unsigned n = impl->idx;
     impl->idx = 0;
@@ -174,7 +175,7 @@ static int unescape(char c, char* u)
 // $packet -> server
 // $client <addr> <port>
 // $server <addr> <port>
-static void parse_command(FileImpl* impl, char* s)
+static void parse_command(HextImpl* impl, char* s)
 {
     if ( !strncmp(s, "packet -> client", 16) )
         set_c2s(impl, 0);
@@ -193,7 +194,7 @@ static void parse_command(FileImpl* impl, char* s)
 }
 
 // load quoted string data into buffer up to snaplen
-static void parse_string(FileImpl* impl, char* s)
+static void parse_string(HextImpl* impl, char* s)
 {
     char t;
 
@@ -205,7 +206,7 @@ static void parse_string(FileImpl* impl, char* s)
 }
 
 // load hex data into buffer up to snaplen
-static void parse_hex(FileImpl* impl, char* s)
+static void parse_hex(HextImpl* impl, char* s)
 {
     char* t = s;
     long x = strtol(t, &s, 16);
@@ -217,7 +218,7 @@ static void parse_hex(FileImpl* impl, char* s)
     }
 }
 
-static int parse(FileImpl* impl)
+static int parse(HextImpl* impl)
 {
     char* s = impl->line;
 
@@ -256,7 +257,7 @@ static int parse(FileImpl* impl)
 // file functions
 //-------------------------------------------------------------------------
 
-static int hext_setup(FileImpl* impl)
+static int hext_setup(HextImpl* impl)
 {
     if ( !strcmp(impl->name, "tty") )
     {
@@ -278,7 +279,7 @@ static int hext_setup(FileImpl* impl)
     return 0;
 }
 
-static void hext_cleanup(FileImpl* impl)
+static void hext_cleanup(HextImpl* impl)
 {
     if ( impl->fyle != stdin )
         fclose(impl->fyle);
@@ -286,7 +287,7 @@ static void hext_cleanup(FileImpl* impl)
     impl->fyle = NULL;
 }
 
-static int hext_read(FileImpl* impl)
+static int hext_read(HextImpl* impl)
 {
     int n = 0;
 
@@ -326,7 +327,7 @@ static int hext_read(FileImpl* impl)
 //-------------------------------------------------------------------------
 
 static int get_vars (
-    FileImpl* impl, const DAQ_Config_t* cfg, char* errBuf, size_t errMax
+    HextImpl* impl, const DAQ_Config_t* cfg, char* errBuf, size_t errMax
 ) {
     const char* s = NULL;
     DAQ_Dict* entry;
@@ -348,7 +349,7 @@ static int get_vars (
     return 1;
 }
 
-static void set_pkt_hdr(FileImpl* impl, DAQ_PktHdr_t* phdr, ssize_t len)
+static void set_pkt_hdr(HextImpl* impl, DAQ_PktHdr_t* phdr, ssize_t len)
 {
     struct timeval t;
     gettimeofday(&t, NULL);
@@ -383,7 +384,7 @@ static void set_pkt_hdr(FileImpl* impl, DAQ_PktHdr_t* phdr, ssize_t len)
 }
 
 static int hext_daq_process(
-    FileImpl* impl, DAQ_Analysis_Func_t cb, void* user)
+    HextImpl* impl, DAQ_Analysis_Func_t cb, void* user)
 {
     DAQ_PktHdr_t hdr;
     int n = hext_read(impl);
@@ -407,7 +408,7 @@ static int hext_daq_process(
 
 static void hext_daq_shutdown (void* handle)
 {
-    FileImpl* impl = (FileImpl*)handle;
+    HextImpl* impl = (HextImpl*)handle;
 
     if ( impl->name )
         free(impl->name);
@@ -423,7 +424,7 @@ static void hext_daq_shutdown (void* handle)
 static int hext_daq_initialize (
     const DAQ_Config_t* cfg, void** handle, char* errBuf, size_t errMax)
 {
-    FileImpl* impl = calloc(1, sizeof(*impl));
+    HextImpl* impl = calloc(1, sizeof(*impl));
 
     if ( !impl )
     {
@@ -467,7 +468,7 @@ static int hext_daq_initialize (
 
 static int hext_daq_start (void* handle)
 {
-    FileImpl* impl = (FileImpl*)handle;
+    HextImpl* impl = (HextImpl*)handle;
 
     if ( hext_setup(impl) )
         return DAQ_ERROR;
@@ -478,7 +479,7 @@ static int hext_daq_start (void* handle)
 
 static int hext_daq_stop (void* handle)
 {
-    FileImpl* impl = (FileImpl*)handle;
+    HextImpl* impl = (HextImpl*)handle;
     hext_cleanup(impl);
     impl->state = DAQ_STATE_STOPPED;
     return DAQ_SUCCESS;
@@ -504,7 +505,7 @@ static int hext_daq_acquire (
 {
     (void)meta;
 
-    FileImpl* impl = (FileImpl*)handle;
+    HextImpl* impl = (HextImpl*)handle;
     int hit = 0, miss = 0;
     impl->stop = 0;
 
@@ -530,33 +531,33 @@ static int hext_daq_acquire (
 
 static int hext_daq_breakloop (void* handle)
 {
-    FileImpl* impl = (FileImpl*)handle;
+    HextImpl* impl = (HextImpl*)handle;
     impl->stop = 1;
     return DAQ_SUCCESS;
 }
 
 static DAQ_State hext_daq_check_status (void* handle)
 {
-    FileImpl* impl = (FileImpl*)handle;
+    HextImpl* impl = (HextImpl*)handle;
     return impl->state;
 }
 
 static int hext_daq_get_stats (void* handle, DAQ_Stats_t* stats)
 {
-    FileImpl* impl = (FileImpl*)handle;
+    HextImpl* impl = (HextImpl*)handle;
     *stats = impl->stats;
     return DAQ_SUCCESS;
 }
 
 static void hext_daq_reset_stats (void* handle)
 {
-    FileImpl* impl = (FileImpl*)handle;
+    HextImpl* impl = (HextImpl*)handle;
     memset(&impl->stats, 0, sizeof(impl->stats));
 }
 
 static int hext_daq_get_snaplen (void* handle)
 {
-    FileImpl* impl = (FileImpl*)handle;
+    HextImpl* impl = (HextImpl*)handle;
     return impl->snaplen;
 }
 
@@ -569,19 +570,19 @@ static uint32_t hext_daq_get_capabilities (void* handle)
 
 static int hext_daq_get_datalink_type(void *handle)
 {
-    FileImpl* impl = (FileImpl*)handle;
+    HextImpl* impl = (HextImpl*)handle;
     return impl->dlt;
 }
 
 static const char* hext_daq_get_errbuf (void* handle)
 {
-    FileImpl* impl = (FileImpl*)handle;
+    HextImpl* impl = (HextImpl*)handle;
     return impl->error;
 }
 
 static void hext_daq_set_errbuf (void* handle, const char* s)
 {
-    FileImpl* impl = (FileImpl*)handle;
+    HextImpl* impl = (HextImpl*)handle;
     DPE(impl->error, "%s", s ? s : "");
 }
 
@@ -599,6 +600,20 @@ static int hext_daq_set_filter (void* handle, const char* filter)
     return DAQ_ERROR_NOTSUP;
 }
 
+static int hext_query_flow(void *handle, const DAQ_PktHdr_t *hdr, DAQ_QueryFlow_t *query)
+{
+    HextImpl* impl = (HextImpl*)handle;
+    assert(hdr->priv_ptr == &impl->pci);  // sanity check
+
+    if ( query->type == DAQ_USR_QUERY_PCI )
+    {
+        query->value = &impl->pci;
+        query->length = sizeof(impl->pci);
+        return DAQ_SUCCESS;
+    }
+    return DAQ_ERROR_NOTSUP;
+}
+
 //-------------------------------------------------------------------------
 
 #ifdef BUILDING_SO
@@ -632,6 +647,7 @@ DAQ_Module_t hext_daq_module_data =
     .hup_prep = NULL,
     .hup_apply = NULL,
     .hup_post = NULL,
-    .dp_add_dc = NULL
+    .dp_add_dc = NULL,
+    .query_flow = hext_query_flow
 };
 

diff --git a/daqs/daq_user.h b/daqs/daq_user.h
index 23363707043a0aa7883e1ecc4eea2ebeee4cdc04..4fdcf955dd95e4f12bb515894e787692eb63b32a 100644 (file)
--- a/daqs/daq_user.h
+++ b/daqs/daq_user.h
@@ -27,11 +27,15 @@
 /* for raw payload only */
 #define DLT_USER 230
 
+/* in: DAQ_QueryFlow_t.type */
+#define DAQ_USR_QUERY_PCI       1000
+
+/* DAQ_UsrHdr_t.flags */
 #define DAQ_USR_FLAG_TO_SERVER  0x01
 #define DAQ_USR_FLAG_START_FLOW 0x02
 #define DAQ_USR_FLAG_END_FLOW   0x04
 
-/* user-related DAQs set priv_ptr to this */
+/* out: DAQ_QueryFlow_t.value */
 typedef struct
 {
     uint32_t src_addr;

diff --git a/src/codecs/misc/cd_user.cc b/src/codecs/misc/cd_user.cc
index 3029b24c6c7dfeb56b75e1efb19ac4a5f5929362..fccdc6e2c6aeacd70c940b2e7d2c58304611a674 100644 (file)
--- a/src/codecs/misc/cd_user.cc
+++ b/src/codecs/misc/cd_user.cc
@@ -25,6 +25,7 @@
 
 #include "daqs/daq_user.h"
 #include "framework/codec.h"
+#include "packet_io/sfdaq.h"
 
 #define CD_NAME "user"
 #define CD_HELP_STR "support for user sessions"
@@ -96,7 +97,18 @@ static void set_flags(
 
 bool UserCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort)
 {
-    const DAQ_UsrHdr_t* pci = (DAQ_UsrHdr_t*)raw.pkth->priv_ptr;
+    DAQ_QueryFlow_t query { DAQ_USR_QUERY_PCI, 0, nullptr };
+
+    if ( SFDAQ::get_local_instance()->query_flow(raw.pkth, &query) != DAQ_SUCCESS or
+        query.length != sizeof(DAQ_UsrHdr_t) )
+    {
+        return false;
+    }
+
+    const DAQ_UsrHdr_t* pci = (DAQ_UsrHdr_t*)query.value;
+
+    if ( !pci )
+        return false;
 
     if ( pci->ip_proto )
     {

diff --git a/src/packet_io/sfdaq.cc b/src/packet_io/sfdaq.cc
index 94102372dc8854910d0049185fb7adddbc0656a6..c725af12463bc07fdb410a71301888a9d1c02502 100644 (file)
--- a/src/packet_io/sfdaq.cc
+++ b/src/packet_io/sfdaq.cc
@@ -547,6 +547,11 @@ const DAQ_Stats_t* SFDAQInstance::get_stats()
     return &daq_stats;
 }
 
+int SFDAQInstance::query_flow(const DAQ_PktHdr_t* hdr, DAQ_QueryFlow_t* query)
+{
+    return daq_query_flow(daq_mod, daq_hand, hdr, query);
+}
+
 int SFDAQInstance::modify_flow_opaque(const DAQ_PktHdr_t* hdr, uint32_t opaque)
 {
     DAQ_ModFlow_t mod;

diff --git a/src/packet_io/sfdaq.h b/src/packet_io/sfdaq.h
index 4b7709ecaf2a9c48a96574e8da151ddec0f6fbd9..69c15c7f0e587d4102cac65fe36d53b877140a85 100644 (file)
--- a/src/packet_io/sfdaq.h
+++ b/src/packet_io/sfdaq.h
@@ -38,28 +38,36 @@ class SFDAQInstance
 public:
     SFDAQInstance(const char* intf);
     ~SFDAQInstance();
+
     bool configure(const SnortConfig*);
+    void set_metacallback(DAQ_Meta_Func_t);
+
+    bool start();
+    bool was_started();
+    bool stop();
+    void reload();
     void abort();
-    const char* get_interface_spec();
+
     int get_base_protocol();
+    const char* get_interface_spec();
+    const DAQ_Stats_t* get_stats();
+
     bool can_inject();
     bool can_inject_raw();
     bool can_replace();
     bool can_start_unprivileged();
     bool can_whitelist();
-    bool start();
-    bool was_started();
-    bool stop();
-    void reload();
-    void set_metacallback(DAQ_Meta_Func_t);
+
     int acquire(int max, DAQ_Analysis_Func_t);
     int inject(const DAQ_PktHdr_t*, int rev, const uint8_t* buf, uint32_t len);
     bool break_loop(int error);
-    const DAQ_Stats_t* get_stats();
+
+    SO_PUBLIC int query_flow(const DAQ_PktHdr_t*, DAQ_QueryFlow_t*);
     int modify_flow_opaque(const DAQ_PktHdr_t*, uint32_t opaque);
     int add_expected(const Packet* ctrlPkt, const SfIp* cliIP, uint16_t cliPort,
             const SfIp* srvIP, uint16_t srvPort, IpProtocol, unsigned timeout_ms,
             unsigned /* flags */);
+
 private:
     bool set_filter(const char*);
     std::string interface_spec;
@@ -75,26 +83,32 @@ class SFDAQ
 public:
     static void load(const SnortConfig*);
     static void unload();
+
     static void print_types(std::ostream&);
     static void init(const SnortConfig*);
     static void term();
-    static bool forwarding_packet(const DAQ_PktHdr_t*);
+
     static const char* get_type();
-    SO_PUBLIC static uint32_t get_snap_len();
-    static bool unprivileged();
     static const char* get_input_spec(const SnortConfig*, unsigned instance_id);
     static const char* default_type();
+    static const DAQ_Stats_t* get_stats();
+
+    static bool unprivileged();
+    static bool can_inject();
+    static bool can_inject_raw();
+    static bool can_replace();
+
     // FIXIT-M X Temporary thread-local instance helpers to be removed when no longer needed
     static void set_local_instance(SFDAQInstance*);
-    static SFDAQInstance* get_local_instance();
+
+    SO_PUBLIC static SFDAQInstance* get_local_instance();
     SO_PUBLIC static const char* get_interface_spec();
     SO_PUBLIC static int get_base_protocol();
-    static bool can_inject();
-    static bool can_inject_raw();
-    static bool can_replace();
+    SO_PUBLIC static uint32_t get_snap_len();
+
     static int inject(const DAQ_PktHdr_t*, int rev, const uint8_t* buf, uint32_t len);
+    static bool forwarding_packet(const DAQ_PktHdr_t*);
     static bool break_loop(int error);
-    static const DAQ_Stats_t* get_stats();
 };
 
 #endif

diff --git a/src/protocols/packet_manager.cc b/src/protocols/packet_manager.cc
index bf126c93bdf7c2ab89693f9a49ae0384cdf76e13..09a5158c728dfb541595a8f36aaa6d32f12a31bf 100644 (file)
--- a/src/protocols/packet_manager.cc
+++ b/src/protocols/packet_manager.cc
@@ -232,10 +232,11 @@ void PacketManager::decode(
         CodecManager::s_protocols[mapped_prot]->get_name(),
         static_cast<uint16_t>(prev_prot_id), pkt, (unsigned long)codec_data.lyr_len);
 
-    s_stats[mapped_prot + stat_offset]++;
+    if ( p->num_layers > 0 )
+        s_stats[mapped_prot + stat_offset]++;
 
     // if the final protocol ID is not the default codec, a Codec failed
-    if (prev_prot_id != ProtocolId::FINISHED_DECODE)
+    if (prev_prot_id != ProtocolId::FINISHED_DECODE or p->num_layers == 0 )
     {
         if (codec_data.codec_flags & CODEC_UNSURE_ENCAP)
         {