From: Josh Date: Fri, 15 Aug 2014 20:17:02 +0000 (-0400) Subject: Cleaning codecs. Moving modules into codec file. Removing NON_ETHER... macro. All... X-Git-Tag: 3.0.0-233~1422^2^2~3 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=1a59c5b790d0ec7907e9fa4bc89240cc99265e5c;p=thirdparty%2Fsnort3.git Cleaning codecs. Moving modules into codec file. Removing NON_ETHER... macro. All Codecs now plugins. --- diff --git a/cmake/configure_options.cmake b/cmake/configure_options.cmake index e83e2b653..023410843 100644 --- a/cmake/configure_options.cmake +++ b/cmake/configure_options.cmake @@ -21,7 +21,6 @@ set_project_compiler_defines_if_true (ENABLE_DEBUG_MSGS "DEBUG_MSGS") set_project_compiler_defines_if_true (ENABLE_DEBUG "DEBUG") set_project_compiler_defines_if_true (ENABLE_SOURCEFIRE "PERF_PROFILING") set_project_compiler_defines_if_true (BUILD_HA "ENABLE_HA") -set_project_compiler_defines_if_false (ENABLE_NON_ETHER_DECODERS "NO_NON_ETHER_DECODER") set_project_compiler_defines_if_true (ENABLE_LARGE_PCAP "_LARGEFILE_SOURCE") set_project_compiler_defines_if_true (ENABLE_LARGE_PCAP "_LARGEFILE64_SOURCE") set_project_compiler_defines_if_true (ENABLE_LARGE_PCAP "_FILE_OFFSET_BITS=64") @@ -50,7 +49,6 @@ set_if_true (ENABLE_SOURCEFIRE SOURCEFIRE) set_if_true (ENABLE_SOURCEFIRE PPM_MGR) set_if_true (ENABLE_SOURCEFIRE PERF_PROFILING) set_if_false (ENABLE_COREFILES NOCOREFILE) -set_if_false (ENABLE_NON_ETHER_DECODERS NO_NON_ETHER_DECODER) set_if_true (HAVE_INTEL_SOFT_CPM INTEL_SOFT_CPM) set_if_true (BUILD_UNIT_TESTS UNIT_TEST) set_if_true (ENABLE_PROFILE PROFILE) diff --git a/cmake/create_options.cmake b/cmake/create_options.cmake index 2632304ec..7e972f06e 100644 --- a/cmake/create_options.cmake +++ b/cmake/create_options.cmake @@ -28,7 +28,6 @@ option (ENABLE_PROFILE "Enable profiling options (developers only)" OFF) option (ENABLE_SOURCEFIRE "Enable Sourcefire specific build options, encompasing ENABLE_PERFPROFILING and ENABLE_PPM" ON) option (ENABLE_COREFILES "Prevent Snort from generating core files" ON) option (BUILD_HA "Enable high-availability state sharing" OFF) -option (ENABLE_NON_ETHER_DECODERS "Enable non Ethernet decoders" OFF) option (HAVE_INTEL_SOFT_CPM "Enable Intel Soft CPM support" OFF) option (ENABLE_LARGE_PCAP "Enable support for pcaps larger than 2 GB" OFF) option (BUILD_SIDE_CHANNEL "Build the side channel library" OFF) diff --git a/config.cmake.h.in b/config.cmake.h.in index ca6eb811b..8e14bf8b2 100644 --- a/config.cmake.h.in +++ b/config.cmake.h.in @@ -85,9 +85,6 @@ /* enable ha capable build */ #cmakedefine ENABLE_HA 1 -/* do not build non-ethernet decoders */ -#cmakedefine NO_NON_ETHER_DECODER 1 - /* enable intel cpm support in build */ #cmakedefine INTEL_SOFT_CPM 1 diff --git a/configure.ac b/configure.ac index 1780cc17d..ee0c0152b 100644 --- a/configure.ac +++ b/configure.ac @@ -388,17 +388,6 @@ if test "x$enable_corefiles" = "xno"; then AC_DEFINE(NOCOREFILE, [1], [do not generate a core file on segfault etc.]) fi -AC_ARG_ENABLE(non-ether-decoders, -[ --enable-non-ether-decoders Enable non Ethernet decoders.], - enable_non_ether_decoders="$enableval", enable_non_ether_decoders="no") - -if test "x$enable_non_ether_decoders" = "xno"; then - CPPFLAGS="$CPPFLAGS -DNO_NON_ETHER_DECODER" - AC_DEFINE(NO_NON_ETHER_DECODER, [1], [do not build non-ethernet decoders]) -fi - -AM_CONDITIONAL(ENABLE_NON_ETHER_DECODER, test "x$enable_non_ether_decoders" = "xyes") - AC_ARG_ENABLE(intel_soft_cpm, [ --enable-intel-soft-cpm Enable Intel Soft CPM support], enable_intel_soft_cpm="$enableval", enable_intel_soft_cpm="no") diff --git a/configure_cmake.sh b/configure_cmake.sh index fb21a5c93..a93f6c9e5 100755 --- a/configure_cmake.sh +++ b/configure_cmake.sh @@ -290,12 +290,6 @@ while [ $# -ne 0 ]; do --enable-ha) append_cache_entry BUILD_HA BOOL true ;; - --disable-non-ether-decoders) - append_cache_entry ENABLE_NON_ETHER_DECODERS BOOL false - ;; - --enable-non-ether-decoders) - append_cache_entry ENABLE_NON_ETHER_DECODERS BOOL true - ;; --disable-large-pcap) append_cache_entry ENABLE_LARGE_PCAP BOOL false ;; diff --git a/extra/src/codecs/pim.cc b/extra/src/codecs/pim.cc index 349f3e92e..6a599badc 100644 --- a/extra/src/codecs/pim.cc +++ b/extra/src/codecs/pim.cc @@ -33,7 +33,7 @@ namespace { // yes, macros are necessary. The API and class constructor require different strings. -#define CD_PIM_NAME "cd_pim" +#define CD_PIM_NAME "pim" class PimCodec : public Codec { diff --git a/extra/src/codecs/token_ring.cc b/extra/src/codecs/token_ring.cc index 759bd991d..ce010dba3 100644 --- a/extra/src/codecs/token_ring.cc +++ b/extra/src/codecs/token_ring.cc @@ -40,7 +40,7 @@ namespace class TrCodec : public Codec { public: - TrCodec() : Codec(CD_TR_NAME){}; + TrCodec() : Codec(TR_NAME){}; ~TrCodec() {}; @@ -209,7 +209,7 @@ static const CodecApi tr_api = { { PT_CODEC, - CD_TR_NAME, + TR_NAME, CDAPI_PLUGIN_V0, 0, mod_ctor, diff --git a/extra/src/codecs/token_ring_module.cc b/extra/src/codecs/token_ring_module.cc index 6c38efb2a..8644ee6eb 100644 --- a/extra/src/codecs/token_ring_module.cc +++ b/extra/src/codecs/token_ring_module.cc @@ -30,10 +30,10 @@ static const Parameter tkr_params[] = static const RuleMap tkr_rules[] = { - { DECODE_BAD_TRH, "(" CD_TR_NAME ") Bad Token Ring Header" }, - { DECODE_BAD_TR_ETHLLC, "(" CD_TR_NAME ") Bad Token Ring ETHLLC Header" }, - { DECODE_BAD_TR_MR_LEN, "(" CD_TR_NAME ") Bad Token Ring MRLENHeader" }, - { DECODE_BAD_TRHMR, "(" CD_TR_NAME ") Bad Token Ring MR Header" }, + { DECODE_BAD_TRH, "(" TR_NAME ") Bad Token Ring Header" }, + { DECODE_BAD_TR_ETHLLC, "(" TR_NAME ") Bad Token Ring ETHLLC Header" }, + { DECODE_BAD_TR_MR_LEN, "(" TR_NAME ") Bad Token Ring MRLENHeader" }, + { DECODE_BAD_TRHMR, "(" TR_NAME ") Bad Token Ring MR Header" }, { 0, nullptr } }; @@ -41,7 +41,7 @@ static const RuleMap tkr_rules[] = // token ring module //------------------------------------------------------------------------- -TrCodecModule::TrCodecModule() : DecodeModule(CD_TR_NAME, tkr_params) +TrCodecModule::TrCodecModule() : DecodeModule(TR_NAME, tkr_params) { } const RuleMap* TrCodecModule::get_rules() const diff --git a/extra/src/codecs/token_ring_module.h b/extra/src/codecs/token_ring_module.h index fb4d5bc8e..74e146371 100644 --- a/extra/src/codecs/token_ring_module.h +++ b/extra/src/codecs/token_ring_module.h @@ -19,13 +19,13 @@ // token_ring_module.h author Josh Rosenbaum -#ifndef CD_TRK_MODULE_H -#define CD_TRK_MODULE_H +#ifndef CODECS_TOKEN_RING_MODULE_H +#define CODECS_TOKEN_RING_MODULE_H #include "codecs/decode_module.h" -#define CD_TR_NAME "cd_tr" +#define TR_NAME "token_ring" class TrCodecModule : public DecodeModule { diff --git a/lua/snort.lua b/lua/snort.lua index 265d7ad1d..6e9a99b16 100644 --- a/lua/snort.lua +++ b/lua/snort.lua @@ -553,12 +553,12 @@ default_rules = #alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"BLACKLIST User-Agent known malicious user agent - SAH Agent"; flow:to_server,established; content:"User-Agent|3A| SAH Agent"; metadata: policy balanced-ips drop, policy connectivity-ips drop, policy security-ips drop, service http; classtype:misc-activity; sid:5808; rev:9;) -#alert tcp any any -> any 80 ( msg:"Sample rule for Snort++"; http_uri; content:"attack"; sid:1; ) +alert tcp any any -> any 80 ( msg:"Sample rule for Snort++"; http_uri; content:"attack"; sid:1; ) #alert tcp any 80 -> any any ( msg:"Sample rule for Snort++"; http_header:Transfer-Encoding; content:"chunk"; sid:2; ) #alert tcp any 80 -> any any ( msg:"Sample rule for Snort++"; http_header; content:"chunk"; sid:3; ) #alert tcp any any -> any any ( msg:"Sample rule for Snort++"; content:"trigger"; sid:2; ) -alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"FILE-IDENTIFY Microsoft Windows Visual Basic script file download request"; metadata:service http; reference:url,en.wikipedia.org/wiki/Vbs; classtype:misc-activity; sid:18758; rev:8; soid:3|18758;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"FILE-IDENTIFY Microsoft Windows Visual Basic script file download request"; metadata:service http; reference:url,en.wikipedia.org/wiki/Vbs; classtype:misc-activity; sid:18758; rev:8; soid:3|18758;) ]] network = diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt index bd3a44182..96f465d41 100644 --- a/src/CMakeLists.txt +++ b/src/CMakeLists.txt @@ -57,6 +57,12 @@ if (STATIC_INSPECTORS) ) endif() +if (STATIC_CODECS) + set (STATIC_CODEC_LIBRARIES + link_codecs + ) +endif() + if (BUILD_UNIT_TESTS) set( UNIT_TESTS_LIBRARIES unit_tests) add_subdirectory(test) @@ -110,9 +116,9 @@ target_link_libraries( snort managers codecs root_codecs - link_codecs ip_codecs misc_codecs + ${STATIC_CODEC_LIBRARIES} ${STATIC_INSPECTOR_LIBRARIES} ${UNIT_TESTS_LIBRARIES} ${EXTERNAL_LIBRARIES} diff --git a/src/Makefile.am b/src/Makefile.am index 2efc556f1..3c06e181b 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -23,7 +23,6 @@ snort_LDADD = \ target_based/libtarget_based.a \ managers/libmanagers.a \ main/libmain.a \ -parser/libparser.a \ loggers/libloggers.a \ codecs/libcodecs.a \ codecs/ip/libip_codecs.a \ @@ -47,6 +46,7 @@ stream/libstream.a \ file_api/libfile_api.a \ file_api/libs/libfile.a \ ips_options/libips_options.a \ +parser/libparser.a \ search_engines/libsearch_engines.a \ flow/libflow.a \ control/libcontrol.a \ diff --git a/src/codecs/CMakeLists.txt b/src/codecs/CMakeLists.txt index 6e93e8bdc..c5690651a 100644 --- a/src/codecs/CMakeLists.txt +++ b/src/codecs/CMakeLists.txt @@ -16,15 +16,19 @@ add_library( codecs STATIC codec_api.h codec_api.cc codec_events.cc - checksum.h - checksum.cc template.cc # for development purposes. Keep the template up to date ) +if (STATIC_CODECS) + set (CODEC_PLUGIN_LIBRARIES + link_codecs + ) +endif(STATIC_CODECS) + target_link_libraries( codecs + ${CODEC_PLUGIN_LIBRARIES} root_codecs - link_codecs ip_codecs misc_codecs protocols diff --git a/src/codecs/Makefile.am b/src/codecs/Makefile.am index f65560a77..c6a705bd7 100644 --- a/src/codecs/Makefile.am +++ b/src/codecs/Makefile.am @@ -16,9 +16,7 @@ codec_api.h \ sf_protocols.h libcodec_utils_a_SOURCES = \ -codec_events.cc \ -checksum.h \ -checksum.cc +codec_events.cc SUBDIRS = \ ip \ diff --git a/src/codecs/checksum.h b/src/codecs/checksum.h deleted file mode 100644 index aabc3bc43..000000000 --- a/src/codecs/checksum.h +++ /dev/null @@ -1,66 +0,0 @@ -/* -** Copyright (C) 2002-2013 Sourcefire, Inc. -** Copyright (C) 1998-2002 Martin Roesch -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ -// checksum.h author Josh Rosenbaum - -#ifndef CHECKSUM_H -#define CHECKSUM_H - -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif - -#include -#include -#include - - -namespace checksum -{ - -struct Pseudoheader6 -{ - uint32_t sip[4], dip[4]; - uint8_t zero; - uint8_t protocol; - uint16_t len; -}; - - -struct Pseudoheader -{ - uint32_t sip, dip; - uint8_t zero; - uint8_t protocol; - uint16_t len; -}; - - -uint16_t cksum_add(const uint16_t *buf, std::size_t len); -uint16_t tcp_cksum(const uint16_t *buf, std::size_t len, Pseudoheader*); -uint16_t tcp_cksum(const uint16_t *buf, std::size_t len, Pseudoheader6 *ph ); -uint16_t udp_cksum(const uint16_t *buf, std::size_t len, Pseudoheader*); -uint16_t udp_cksum(const uint16_t *buf, std::size_t len, Pseudoheader6*); -uint16_t icmp_cksum(const uint16_t *buf, std::size_t len, Pseudoheader6*); -uint16_t icmp_cksum(const uint16_t *buf, std::size_t len); -uint16_t ip_cksum(const uint16_t *buf, std::size_t len); - -} // namespace checksum - -#endif \ No newline at end of file diff --git a/src/codecs/codec_api.cc b/src/codecs/codec_api.cc index 892b30595..b31621744 100644 --- a/src/codecs/codec_api.cc +++ b/src/codecs/codec_api.cc @@ -31,30 +31,26 @@ // ip codecs -extern const BaseApi* cd_ipv4; -extern const BaseApi* cd_ipv6; -extern const BaseApi* cd_icmp4; -extern const BaseApi* cd_icmp6; -extern const BaseApi* cd_tcp; -extern const BaseApi* cd_udp; extern const BaseApi* cd_esp; +extern const BaseApi* cd_ipv4; // static due to dependence on fpdetect // link codecs -extern const BaseApi* cd_arp; #ifdef STATIC_CODECS extern const BaseApi* cd_ah; +extern const BaseApi* cd_arp; extern const BaseApi* cd_dstopts; extern const BaseApi* cd_erspan2; extern const BaseApi* cd_erspan3; -extern const BaseApi* cd_ethloopback; extern const BaseApi* cd_frag; extern const BaseApi* cd_gre; extern const BaseApi* cd_gtp; extern const BaseApi* cd_hopopts; -extern const BaseApi* cd_ip4_embedded_in_icmp; -extern const BaseApi* cd_ip6_embedded_in_icmp; -extern const BaseApi* cd_prot_embedded_in_icmp; +extern const BaseApi* cd_icmp4; +extern const BaseApi* cd_icmp4_ip; +extern const BaseApi* cd_icmp6; +extern const BaseApi* cd_icmp6_ip; +extern const BaseApi* cd_ipv6; extern const BaseApi* cd_igmp; extern const BaseApi* cd_mobility; extern const BaseApi* cd_mpls; @@ -66,8 +62,10 @@ extern const BaseApi* cd_pppoepkt_sess; extern const BaseApi* cd_routing; extern const BaseApi* cd_sun_nd; extern const BaseApi* cd_swipe; +extern const BaseApi* cd_tcp; extern const BaseApi* cd_teredo; extern const BaseApi* cd_transbridge; +extern const BaseApi* cd_udp; extern const BaseApi* cd_vlan; // Root codecs @@ -75,8 +73,6 @@ extern const BaseApi* cd_eth; extern const BaseApi* cd_raw4; extern const BaseApi* cd_raw6; extern const BaseApi* cd_null; - -#ifndef NO_NON_ETHER_DECODER extern const BaseApi* cd_eapol; extern const BaseApi* cd_linux_sll; extern const BaseApi* cd_ppp; @@ -84,34 +80,28 @@ extern const BaseApi* cd_wlan; #endif -#endif - const BaseApi* codecs[] = { - // non root codeccs - cd_ipv4, - cd_ipv6, - cd_icmp4, - cd_icmp6, - cd_tcp, - cd_udp, + // non root codecs cd_esp, - cd_arp, + cd_ipv4, #ifdef STATIC_CODECS cd_ah, + cd_arp, cd_dstopts, cd_erspan2, cd_erspan3, - cd_ethloopback, cd_frag, cd_gre, cd_gtp, cd_hopopts, - cd_ip4_embedded_in_icmp, - cd_ip6_embedded_in_icmp, - cd_prot_embedded_in_icmp, + cd_icmp4, + cd_icmp4_ip, + cd_icmp6, + cd_icmp6_ip, + cd_ipv6, cd_igmp, cd_mobility, cd_mpls, @@ -123,8 +113,10 @@ const BaseApi* codecs[] = cd_routing, cd_sun_nd, cd_swipe, + cd_tcp, cd_teredo, cd_transbridge, + cd_udp, cd_vlan, /* root codecs */ @@ -132,14 +124,10 @@ const BaseApi* codecs[] = cd_raw4, cd_raw6, cd_null, - -#ifndef NO_NON_ETHER_DECODER cd_eapol, cd_linux_sll, cd_ppp, cd_wlan, -#endif - #endif nullptr diff --git a/src/codecs/ip/CMakeLists.txt b/src/codecs/ip/CMakeLists.txt index 30ae00849..af2c540c2 100644 --- a/src/codecs/ip/CMakeLists.txt +++ b/src/codecs/ip/CMakeLists.txt @@ -4,74 +4,53 @@ if( STATIC_CODECS ) set( PLUGIN_SOURCES cd_auth.cc - cd_auth_module.h - cd_auth_module.cc - cd_dstopts.cc + cd_dst_opts.cc cd_frag.cc cd_gre.cc - cd_gre_module.h - cd_gre_module.cc - cd_hopopts.cc + cd_hop_opts.cc cd_icmp4.cc - cd_icmp4_module.h - cd_icmp4_module.cc cd_icmp6.cc - cd_icmp6_module.h - cd_icmp6_module.cc cd_igmp.cc - cd_igmp_module.h - cd_igmp_module.cc - cd_ipv4.cc - cd_ipv4_module.h - cd_ipv4_module.cc cd_ipv6.cc - cd_ipv6_module.h - cd_ipv6_module.cc cd_no_next.cc cd_mobility.cc cd_pgm.cc - cd_pgm_module.h - cd_pgm_module.cc cd_routing.cc cd_sun_nd.cc cd_swipe.cc cd_tcp.cc - cd_tcp_module.h - cd_tcp_module.cc cd_udp.cc - cd_udp_module.h - cd_udp_module.cc - ipv6_util.h - ipv6_util.cc ) else() - add_shared_library(cd_auth codecs cd_auth.cc cd_auth_module.h cd_auth_module.cc) - add_shared_library(cd_dstopts codecs cd_dstopts.cc ipv6_util.h ipv6_util.cc) + add_shared_library(cd_auth codecs cd_auth.cc) + add_shared_library(cd_dst_opts codecs cd_dst_opts.cc ipv6_util.h ipv6_util.cc) add_shared_library(cd_frag codecs cd_frag.cc ipv6_util.h ipv6_util.cc) - add_shared_library(cd_gre codecs cd_gre.cc cd_gre_module.h cd_gre_module.cc) - add_shared_library(cd_hopopts codecs cd_hopopts.cc ipv6_util.h ipv6_util.cc) - add_shared_library(cd_icmp4 codecs cd_icmp4.cc cd_icmp4_module.h cd_icmp4_module.cc) - add_shared_library(cd_icmp6 codecs cd_icmp6.cc cd_icmp6_module.h cd_icmp6_module.cc) - add_shared_library(cd_igmp codecs cd_igmp.cc cd_igmp_module.h cd_igmp_module.cc) - add_shared_library(cd_ipv4 codecs cd_ipv4.cc cd_ipv4_module.h cd_ipv4_module.cc) - add_shared_library(cd_ipv6 codecs cd_ipv6.cc cd_ipv6_module.h cd_ipv6_module.cc ipv6_util.h ipv6_util.cc) + add_shared_library(cd_gre codecs cd_gre.cc) + add_shared_library(cd_hop_opts codecs cd_hop_opts.cc ipv6_util.h ipv6_util.cc) + add_shared_library(cd_icmp4 codecs cd_icmp4.cc checksum.h) + add_shared_library(cd_icmp6 codecs cd_icmp6.cc checksum.h) + add_shared_library(cd_igmp codecs cd_igmp.cc) +# add_shared_library(cd_ipv4 codecs cd_ipv4.cc checksum.h) + add_shared_library(cd_ipv6 codecs cd_ipv6.cc checksum.h ipv6_util.h ipv6_util.cc) add_shared_library(cd_mobility codecs cd_mobility.cc) add_shared_library(cd_no_next codecs cd_no_next.cc ipv6_util.h ipv6_util.cc) - add_shared_library(cd_pgm codecs cd_pgm.cc cd_pgm_module.h cd_pgm_module.cc) + add_shared_library(cd_pgm codecs cd_pgm.cc checksum.h) add_shared_library(cd_routing codecs cd_routing.cc ipv6_util.h ipv6_util.cc) add_shared_library(cd_sun_nd codecs cd_sun_nd.cc) add_shared_library(cd_swipe codecs cd_swipe.cc) - add_shared_library(cd_tcp codecs cd_tcp.cc cd_tcp_module.h cd_tcp_module.cc) - add_shared_library(cd_udp codecs cd_udp.cc cd_udp_module.h cd_udp_module.cc) + add_shared_library(cd_tcp codecs cd_tcp.cc checksum.h) + add_shared_library(cd_udp codecs cd_udp.cc checksum.h) endif() add_library( ip_codecs STATIC cd_esp.cc # statically linked due to its dependance on the packet manager. - cd_esp_module.h - cd_esp_module.cc + cd_ipv4.cc # Static due to its dependence on fpdetect + checksum.h + ipv6_util.h + ipv6_util.cc # PacketManager ${PLUGIN_SOURCES} ) diff --git a/src/codecs/ip/Makefile.am b/src/codecs/ip/Makefile.am index 24af9a590..eb7693607 100644 --- a/src/codecs/ip/Makefile.am +++ b/src/codecs/ip/Makefile.am @@ -3,52 +3,31 @@ AUTOMAKE_OPTIONS=foreign no-dependencies noinst_LIBRARIES = libip_codecs.a libip_codecs_a_SOURCES = \ -cd_icmp4.cc \ -cd_icmp4_module.h \ -cd_icmp4_module.cc \ -cd_icmp6.cc \ -cd_icmp6_module.h \ -cd_icmp6_module.cc \ cd_ipv4.cc \ -cd_ipv4_module.h \ -cd_ipv4_module.cc \ -cd_ipv6.cc \ -cd_ipv6_module.h \ -cd_ipv6_module.cc \ -cd_tcp.cc \ -cd_tcp_module.h \ -cd_tcp_module.cc \ -cd_udp.cc \ -cd_udp_module.h \ -cd_udp_module.cc \ cd_esp.cc \ -cd_esp_module.h \ -cd_esp_module.cc \ ipv6_util.h \ ipv6_util.cc plugin_list = \ cd_auth.cc \ -cd_auth_module.h \ -cd_auth_module.cc \ -cd_dstopts.cc \ +cd_dst_opts.cc \ cd_frag.cc \ cd_gre.cc \ -cd_gre_module.h \ -cd_gre_module.cc \ -cd_hopopts.cc \ +cd_hop_opts.cc \ +cd_icmp4.cc \ +cd_icmp6.cc \ cd_igmp.cc \ -cd_igmp_module.h \ -cd_igmp_module.cc \ +cd_ipv6.cc \ cd_mobility.cc \ cd_no_next.cc \ cd_pgm.cc \ -cd_pgm_module.h \ -cd_pgm_module.cc \ cd_routing.cc \ cd_sun_nd.cc \ -cd_swipe.cc +cd_swipe.cc \ +cd_tcp.cc \ +cd_udp.cc \ +checksum.h if STATIC_CODECS @@ -61,17 +40,32 @@ ehlibdir = $(pkglibdir)/codecs ehlib_LTLIBRARIES = libcd_auth.la libcd_auth_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO libcd_auth_la_LDFLAGS = -export-dynamic -shared -libcd_auth_la_SOURCES = cd_auth.cc cd_auth_module.h cd_auth_module.cc +libcd_auth_la_SOURCES = cd_auth.cc ehlib_LTLIBRARIES += libcd_gre.la libcd_gre_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO libcd_gre_la_LDFLAGS = -export-dynamic -shared -libcd_gre_la_SOURCES = cd_gre.cc cd_gre_module.h cd_gre_module.cc +libcd_gre_la_SOURCES = cd_gre.cc + +ehlib_LTLIBRARIES += libcd_icmp4.la +libcd_icmp4_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO +libcd_icmp4_la_LDFLAGS = -export-dynamic -shared +libcd_icmp4_la_SOURCES = cd_icmp4.cc checksum.h + +ehlib_LTLIBRARIES += libcd_icmp6.la +libcd_icmp6_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO +libcd_icmp6_la_LDFLAGS = -export-dynamic -shared +libcd_icmp6_la_SOURCES = cd_icmp6.cc checksum.h ehlib_LTLIBRARIES += libcd_igmp.la libcd_igmp_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO libcd_igmp_la_LDFLAGS = -export-dynamic -shared -libcd_igmp_la_SOURCES = cd_igmp.cc cd_igmp_module.h cd_igmp_module.cc +libcd_igmp_la_SOURCES = cd_igmp.cc + +ehlib_LTLIBRARIES += libcd_ipv6.la +libcd_ipv6_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO +libcd_ipv6_la_LDFLAGS = -export-dynamic -shared +libcd_ipv6_la_SOURCES = cd_ipv6.cc checksum.h ehlib_LTLIBRARIES += libcd_mobility.la libcd_mobility_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO @@ -81,27 +75,27 @@ libcd_mobility_la_SOURCES = cd_mobility.cc ehlib_LTLIBRARIES += libcd_pgm.la libcd_pgm_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO libcd_pgm_la_LDFLAGS = -export-dynamic -shared -libcd_pgm_la_SOURCES = cd_pgm.cc cd_pgm_module.h cd_pgm_module.cc +libcd_pgm_la_SOURCES = cd_pgm.cc checksum.h ehlib_LTLIBRARIES += libcd_sun_nd.la libcd_sun_nd_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO libcd_sun_nd_la_LDFLAGS = -export-dynamic -shared libcd_sun_nd_la_SOURCES = cd_sun_nd.cc -ehlib_LTLIBRARIES += libcd_dstopts.la -libcd_dstopts_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO -libcd_dstopts_la_LDFLAGS = -export-dynamic -shared -libcd_dstopts_la_SOURCES = cd_dstopts.cc ipv6_util.h ipv6_util.cc +ehlib_LTLIBRARIES += libcd_dst_opts.la +libcd_dst_opts_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO +libcd_dst_opts_la_LDFLAGS = -export-dynamic -shared +libcd_dst_opts_la_SOURCES = cd_dst_opts.cc ipv6_util.h ipv6_util.cc ehlib_LTLIBRARIES += libcd_frag.la libcd_frag_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO libcd_frag_la_LDFLAGS = -export-dynamic -shared libcd_frag_la_SOURCES = cd_frag.cc ipv6_util.h ipv6_util.cc -ehlib_LTLIBRARIES += libcd_hopopts.la -libcd_hopopts_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO -libcd_hopopts_la_LDFLAGS = -export-dynamic -shared -libcd_hopopts_la_SOURCES = cd_hopopts.cc ipv6_util.h ipv6_util.cc +ehlib_LTLIBRARIES += libcd_hop_opts.la +libcd_hop_opts_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO +libcd_hop_opts_la_LDFLAGS = -export-dynamic -shared +libcd_hop_opts_la_SOURCES = cd_hop_opts.cc ipv6_util.h ipv6_util.cc ehlib_LTLIBRARIES += libcd_no_next.la libcd_no_next_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO @@ -118,6 +112,16 @@ libcd_swipe_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO libcd_swipe_la_LDFLAGS = -export-dynamic -shared libcd_swipe_la_SOURCES = cd_swipe.cc +ehlib_LTLIBRARIES += libcd_tcp.la +libcd_tcp_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO +libcd_tcp_la_LDFLAGS = -export-dynamic -shared +libcd_tcp_la_SOURCES = cd_tcp.cc checksum.h + +ehlib_LTLIBRARIES += libcd_udp.la +libcd_udp_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO +libcd_udp_la_LDFLAGS = -export-dynamic -shared +libcd_udp_la_SOURCES = cd_udp.cc checksum.h + endif diff --git a/src/codecs/ip/cd_auth.cc b/src/codecs/ip/cd_auth.cc index b6f0322da..c0da4cfe6 100644 --- a/src/codecs/ip/cd_auth.cc +++ b/src/codecs/ip/cd_auth.cc @@ -17,7 +17,7 @@ ** along with this program; if not, write to the Free Software ** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */ -// cd_ah.cc author Josh Rosenbaum +// cd_auth.cc author Josh Rosenbaum @@ -28,18 +28,41 @@ #include "framework/codec.h" #include "codecs/codec_events.h" -#include "codecs/ip/cd_auth_module.h" #include "protocols/protocol_ids.h" #include "codecs/sf_protocols.h" namespace { -class AhCodec : public Codec +#define CD_AUTH_NAME "auth" + +static const RuleMap auth_rules[] = +{ + { DECODE_AUTH_HDR_TRUNC, "(" CD_AUTH_NAME ") Truncated authentication header"}, + { DECODE_AUTH_HDR_BAD_LEN, "(" CD_AUTH_NAME ") Bad authentication header length"}, + { 0, nullptr } +}; + +class AuthModule : public DecodeModule +{ +public: + AuthModule() : DecodeModule(CD_AUTH_NAME) {} + + const RuleMap* get_rules() const + { return auth_rules; } +}; + + +//------------------------------------------------------------------------- +// auth module +//------------------------------------------------------------------------- + + +class AuthCodec : public Codec { public: - AhCodec() : Codec(CD_AUTH_NAME){}; - ~AhCodec(){}; + AuthCodec() : Codec(CD_AUTH_NAME){}; + ~AuthCodec(){}; virtual PROTO_ID get_proto_id() { return PROTO_AH; }; @@ -52,12 +75,12 @@ public: } // anonymous namespace -void AhCodec::get_protocol_ids(std::vector& v) +void AuthCodec::get_protocol_ids(std::vector& v) { v.push_back(IPPROTO_ID_AH); } -bool AhCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len, +bool AuthCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) { @@ -89,7 +112,7 @@ bool AhCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len, static Module* mod_ctor() { - return new AhModule; + return new AuthModule; } static void mod_dtor(Module* m) @@ -99,7 +122,7 @@ static void mod_dtor(Module* m) static Codec* ctor(Module*) { - return new AhCodec(); + return new AuthCodec(); } static void dtor(Codec *cd) diff --git a/src/codecs/ip/cd_auth_module.cc b/src/codecs/ip/cd_auth_module.cc deleted file mode 100644 index bdfc2f817..000000000 --- a/src/codecs/ip/cd_auth_module.cc +++ /dev/null @@ -1,40 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -// cd_ah_module.cc author Josh Rosenbaum - -#include "codecs/ip/cd_auth_module.h" - -static const RuleMap ah_rules[] = -{ - { DECODE_AUTH_HDR_TRUNC, "(" CD_AUTH_NAME ") Truncated authentication header"}, - { DECODE_AUTH_HDR_BAD_LEN, "(" CD_AUTH_NAME ") Bad authentication header length"}, - { 0, nullptr } -}; - -//------------------------------------------------------------------------- -// auth module -//------------------------------------------------------------------------- - -AhModule::AhModule() : DecodeModule(CD_AUTH_NAME) -{ } - -const RuleMap* AhModule::get_rules() const -{ return ah_rules; } - diff --git a/src/codecs/ip/cd_auth_module.h b/src/codecs/ip/cd_auth_module.h deleted file mode 100644 index d12aa1891..000000000 --- a/src/codecs/ip/cd_auth_module.h +++ /dev/null @@ -1,38 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -// cd_ah_module.h author Josh Rosenbaum - -#ifndef CD_AH_MODULE_H -#define CD_AH_MODULE_H - -#include "codecs/decode_module.h" - - -#define CD_AUTH_NAME "auth" - -class AhModule : public DecodeModule -{ -public: - AhModule(); - - const RuleMap* get_rules() const; -}; - -#endif diff --git a/src/codecs/ip/cd_dstopts.cc b/src/codecs/ip/cd_dst_opts.cc similarity index 99% rename from src/codecs/ip/cd_dstopts.cc rename to src/codecs/ip/cd_dst_opts.cc index 9053e5d2d..93d700a7f 100644 --- a/src/codecs/ip/cd_dstopts.cc +++ b/src/codecs/ip/cd_dst_opts.cc @@ -37,7 +37,7 @@ namespace { -#define CD_DSTOPTS_NAME "ipv6_dstopts" +#define CD_DSTOPTS_NAME "ipv6_dst_opts" class Ipv6DSTOptsCodec : public Codec { diff --git a/src/codecs/ip/cd_esp.cc b/src/codecs/ip/cd_esp.cc index 11e8d04bc..f758e4c7e 100644 --- a/src/codecs/ip/cd_esp.cc +++ b/src/codecs/ip/cd_esp.cc @@ -27,7 +27,6 @@ #include "framework/codec.h" #include "snort.h" -#include "codecs/ip/cd_esp_module.h" #include "managers/packet_manager.h" #include "codecs/codec_events.h" #include "protocols/protocol_ids.h" @@ -35,6 +34,46 @@ namespace { + +#define CD_ESP_NAME "esp" + +static const RuleMap esp_rules[] = +{ + { DECODE_ESP_HEADER_TRUNC, "(" CD_ESP_NAME ") truncated Encapsulated Security Payload (ESP) header" }, + { 0, nullptr } +}; + + +static const Parameter esp_params[] = +{ + { "decode_esp", Parameter::PT_BOOL, nullptr, "false", + "enable for inspection of esp traffic that has authentication but not encryption" }, + + { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } +}; + + +class EspModule : public DecodeModule +{ +public: + EspModule() : DecodeModule(CD_ESP_NAME, esp_params) {} + + const RuleMap* get_rules() const + { return esp_rules; } + + + bool set(const char*, Value& v, SnortConfig* sc) + { + if ( v.is("decode_esp") ) + sc->enable_esp = v.get_bool(); + else + return false; + + return true; + } +}; + + class EspCodec : public Codec { public: diff --git a/src/codecs/ip/cd_esp_module.cc b/src/codecs/ip/cd_esp_module.cc deleted file mode 100644 index 144ad5d6d..000000000 --- a/src/codecs/ip/cd_esp_module.cc +++ /dev/null @@ -1,62 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -// cd_esp_module.cc author Josh Rosenbaum - -#include "codecs/ip/cd_esp_module.h" -#include "main/snort_config.h" - -static const Parameter esp_params[] = -{ - { "decode_esp", Parameter::PT_BOOL, nullptr, "false", - "enable for inspection of esp traffic that has authentication but not encryption" }, - - { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } -}; - - -// rules which will loaded into snort. -// You can now reference these rules by calling a codec_event -// in your main codec's functions -static const RuleMap esp_rules[] = -{ - { DECODE_ESP_HEADER_TRUNC, "(" CD_ESP_NAME ") truncated Encapsulated Security Payload (ESP) header" }, - { 0, nullptr } -}; - -//------------------------------------------------------------------------- -// rpc module -//------------------------------------------------------------------------- - -EspModule::EspModule() : DecodeModule(CD_ESP_NAME, esp_params) -{ } - -const RuleMap* EspModule::get_rules() const -{ return esp_rules; } - -bool EspModule::set(const char*, Value& v, SnortConfig* sc) -{ - if ( v.is("decode_esp") ) - sc->enable_esp = v.get_bool(); - else - return false; - - return true; -} - diff --git a/src/codecs/ip/cd_esp_module.h b/src/codecs/ip/cd_esp_module.h deleted file mode 100644 index 71e97de41..000000000 --- a/src/codecs/ip/cd_esp_module.h +++ /dev/null @@ -1,40 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -// cd_esp_module.h author Josh Rosenbaum - -#ifndef CD_ESP_MODULE_H -#define CD_ESP_MODULE_H - -#include "codecs/decode_module.h" - - -#define CD_ESP_NAME "esp" - -class EspModule : public DecodeModule -{ -public: - EspModule(); - - const RuleMap* get_rules() const; - bool set(const char*, Value&, SnortConfig*); -}; - -#endif - diff --git a/src/codecs/ip/cd_gre.cc b/src/codecs/ip/cd_gre.cc index 799010480..6f18d610b 100644 --- a/src/codecs/ip/cd_gre.cc +++ b/src/codecs/ip/cd_gre.cc @@ -25,7 +25,6 @@ #endif #include "framework/codec.h" -#include "codecs/ip/cd_gre_module.h" #include "codecs/codec_events.h" #include "protocols/packet.h" #include "protocols/protocol_ids.h" @@ -35,6 +34,33 @@ namespace { +#define CD_GRE_NAME "gre" + +static const RuleMap gre_rules[] = +{ + { DECODE_GRE_DGRAM_LT_GREHDR, "(" CD_GRE_NAME ") GRE header length > payload length" }, + { DECODE_GRE_MULTIPLE_ENCAPSULATION, "(" CD_GRE_NAME ") Multiple encapsulations in packet" }, + { DECODE_GRE_INVALID_VERSION, "(" CD_GRE_NAME ") Invalid GRE version" }, + { DECODE_GRE_INVALID_HEADER, "(" CD_GRE_NAME ") Invalid GRE header" }, + { DECODE_GRE_V1_INVALID_HEADER, "(" CD_GRE_NAME ") Invalid GRE v.1 PPTP header" }, + { DECODE_GRE_TRANS_DGRAM_LT_TRANSHDR, "(" CD_GRE_NAME ") GRE Trans header length > payload length" }, + { 0, nullptr } +}; + + +class GreModule : public DecodeModule +{ +public: + GreModule() : DecodeModule(CD_GRE_NAME) {} + + const RuleMap* get_rules() const + { return gre_rules; } +}; + + + + + class GreCodec : public Codec { public: diff --git a/src/codecs/ip/cd_gre_module.cc b/src/codecs/ip/cd_gre_module.cc deleted file mode 100644 index 611f65842..000000000 --- a/src/codecs/ip/cd_gre_module.cc +++ /dev/null @@ -1,44 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -// cd_gre_module.cc author Josh Rosenbaum - -#include "codecs/ip/cd_gre_module.h" - -static const RuleMap gre_rules[] = -{ - { DECODE_GRE_DGRAM_LT_GREHDR, "(" CD_GRE_NAME ") GRE header length > payload length" }, - { DECODE_GRE_MULTIPLE_ENCAPSULATION, "(" CD_GRE_NAME ") Multiple encapsulations in packet" }, - { DECODE_GRE_INVALID_VERSION, "(" CD_GRE_NAME ") Invalid GRE version" }, - { DECODE_GRE_INVALID_HEADER, "(" CD_GRE_NAME ") Invalid GRE header" }, - { DECODE_GRE_V1_INVALID_HEADER, "(" CD_GRE_NAME ") Invalid GRE v.1 PPTP header" }, - { DECODE_GRE_TRANS_DGRAM_LT_TRANSHDR, "(" CD_GRE_NAME ") GRE Trans header length > payload length" }, - { 0, nullptr } -}; - -//------------------------------------------------------------------------- -// rpc module -//------------------------------------------------------------------------- - -GreModule::GreModule() : DecodeModule(CD_GRE_NAME) -{ } - -const RuleMap* GreModule::get_rules() const -{ return gre_rules; } - diff --git a/src/codecs/ip/cd_gre_module.h b/src/codecs/ip/cd_gre_module.h deleted file mode 100644 index 6157238d8..000000000 --- a/src/codecs/ip/cd_gre_module.h +++ /dev/null @@ -1,38 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -// cd_gre_module.h author Josh Rosenbaum - -#ifndef CD_GRE_MODULE_H -#define CD_GRE_MODULE_H - -#include "codecs/decode_module.h" - - -#define CD_GRE_NAME "gre" - -class GreModule : public DecodeModule -{ -public: - GreModule(); - - const RuleMap* get_rules() const; -}; - -#endif diff --git a/src/codecs/ip/cd_hopopts.cc b/src/codecs/ip/cd_hop_opts.cc similarity index 99% rename from src/codecs/ip/cd_hopopts.cc rename to src/codecs/ip/cd_hop_opts.cc index d2f5d877d..7010ef7e3 100644 --- a/src/codecs/ip/cd_hopopts.cc +++ b/src/codecs/ip/cd_hop_opts.cc @@ -36,7 +36,7 @@ namespace { -#define CD_HOPOPTS_NAME "ipv6_hopopts" +#define CD_HOPOPTS_NAME "ipv6_hop_opts" class Ipv6HopOptsCodec : public Codec { diff --git a/src/codecs/ip/cd_icmp4.cc b/src/codecs/ip/cd_icmp4.cc index c16e1009b..e9c948a9a 100644 --- a/src/codecs/ip/cd_icmp4.cc +++ b/src/codecs/ip/cd_icmp4.cc @@ -29,14 +29,56 @@ #include "snort.h" #include "protocols/icmp4.h" #include "codecs/codec_events.h" -#include "codecs/checksum.h" +#include "codecs/ip/checksum.h" #include "protocols/protocol_ids.h" -#include "codecs/ip/cd_icmp4_module.h" +#include "codecs/decode_module.h" #include "codecs/sf_protocols.h" namespace{ +#define CD_ICMP4_NAME "icmp4" + +static const RuleMap icmp4_rules[] = +{ + { DECODE_ICMP_DGRAM_LT_ICMPHDR, "(" CD_ICMP4_NAME ") ICMP Header Truncated" }, + { DECODE_ICMP_DGRAM_LT_TIMESTAMPHDR, "(" CD_ICMP4_NAME ") ICMP Timestamp Header Truncated" }, + { DECODE_ICMP_DGRAM_LT_ADDRHDR, "(" CD_ICMP4_NAME ") ICMP Address Header Truncated" }, + { DECODE_ICMP_ORIG_IP_TRUNCATED, "(" CD_ICMP4_NAME ") ICMP Original IP Header Truncated" }, + { DECODE_ICMP_ORIG_IP_VER_MISMATCH, "(" CD_ICMP4_NAME ") ICMP version and Original IP Header versions differ" }, + { DECODE_ICMP_ORIG_DGRAM_LT_ORIG_IP, "(" CD_ICMP4_NAME ") ICMP Original Datagram Length < Original IP Header Length" }, + { DECODE_ICMP_ORIG_PAYLOAD_LT_64, "(" CD_ICMP4_NAME ") ICMP Original IP Payload < 64 bits" }, + { DECODE_ICMP_ORIG_PAYLOAD_GT_576, "(" CD_ICMP4_NAME ") ICMP Origianl IP Payload > 576 bytes" }, + { DECODE_ICMP_ORIG_IP_WITH_FRAGOFFSET, "(" CD_ICMP4_NAME ") ICMP Original IP Fragmented and Offset Not 0" }, + { DECODE_ICMP4_DST_MULTICAST, "(" CD_ICMP4_NAME ") ICMP4 packet to multicast dest address" }, + { DECODE_ICMP4_DST_BROADCAST, "(" CD_ICMP4_NAME ") ICMP4 packet to broadcast dest address" }, + { DECODE_ICMP4_TYPE_OTHER, "(" CD_ICMP4_NAME ") ICMP4 type other" }, + { DECODE_ICMP_PING_NMAP, "(" CD_ICMP4_NAME ") ICMP PING NMAP" }, + { DECODE_ICMP_ICMPENUM, "(" CD_ICMP4_NAME ") ICMP icmpenum v1.1.1" }, + { DECODE_ICMP_REDIRECT_HOST, "(" CD_ICMP4_NAME ") ICMP redirect host" }, + { DECODE_ICMP_REDIRECT_NET, "(" CD_ICMP4_NAME ") ICMP redirect net" }, + { DECODE_ICMP_TRACEROUTE_IPOPTS, "(" CD_ICMP4_NAME ") ICMP traceroute ipopts" }, + { DECODE_ICMP_SOURCE_QUENCH, "(" CD_ICMP4_NAME ") ICMP Source Quench" }, + { DECODE_ICMP_BROADSCAN_SMURF_SCANNER, "(" CD_ICMP4_NAME ") Broadscan Smurf Scanner" }, + { DECODE_ICMP_DST_UNREACH_ADMIN_PROHIBITED, "(" CD_ICMP4_NAME ") ICMP Destination Unreachable Communication Administratively Prohibited" }, + { DECODE_ICMP_DST_UNREACH_DST_HOST_PROHIBITED, "(" CD_ICMP4_NAME ") ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited" }, + { DECODE_ICMP_DST_UNREACH_DST_NET_PROHIBITED, "(" CD_ICMP4_NAME ") ICMP Destination Unreachable Communication with Destination Network is Administratively Prohibited" }, + { DECODE_ICMP_PATH_MTU_DOS, "(" CD_ICMP4_NAME ") ICMP PATH MTU denial of service attempt" }, + { DECODE_ICMP_DOS_ATTEMPT, "(" CD_ICMP4_NAME ") BAD-TRAFFIC linux ICMP header dos attempt" }, + { DECODE_ICMP4_HDR_TRUNC, "(" CD_ICMP4_NAME ") truncated ICMP4 header" }, + { 0, nullptr } +}; + +class Icmp4Module : public DecodeModule +{ +public: + Icmp4Module() : DecodeModule(CD_ICMP4_NAME) {} + + const RuleMap* get_rules() const + { return icmp4_rules; } +}; + + class Icmp4Codec : public Codec{ @@ -61,9 +103,7 @@ private: } // namespace void Icmp4Codec::get_protocol_ids(std::vector &v) -{ - v.push_back(IPPROTO_ID_ICMPV4); -} +{ v.push_back(IPPROTO_ID_ICMPV4); } @@ -226,144 +266,6 @@ bool Icmp4Codec::decode(const uint8_t* raw_pkt, const uint32_t& raw_len, return true; } -// TODO: delete -#if 0 -/* - * Function: DecodeICMPEmbeddedIP(uint8_t *, const uint32_t, Packet *) - * - * Purpose: Decode the ICMP embedded IP header + 64 bits payload - * - * Arguments: pkt => ptr to the packet data - * len => length from here to the end of the packet - * p => pointer to dummy packet decode struct - * - * Returns: void function - */ -void Icmp4Codec::DecodeICMPEmbeddedIP(const uint8_t *pkt, const uint32_t len, Packet *p) -{ - uint32_t ip_len; /* length from the start of the ip hdr to the - * pkt end */ - uint32_t hlen; /* ip header length */ - uint16_t orig_frag_offset; - - /* do a little validation */ - if(len < ip::hdr_len()) - { - DEBUG_WRAP(DebugMessage(DEBUG_DECODE, - "ICMP: IP short header (%d bytes)\n", len);); - - codec_events::decoder_event(p, DECODE_ICMP_ORIG_IP_TRUNCATED); - - p->orig_family = NO_IP; - p->orig_iph = NULL; - return; - } - - /* lay the IP struct over the raw data */ - sfiph_orig_build(p, pkt, AF_INET); - p->orig_iph = (IPHdr *) pkt; - - DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "DecodeICMPEmbeddedIP: ip header" - " starts at: %p, length is %lu\n", p->orig_iph, - (unsigned long) len);); - /* - * with datalink DLT_RAW it's impossible to differ ARP datagrams from IP. - * So we are just ignoring non IP datagrams - */ - if((GET_ORIG_IPH_VER(p) != 4) && !IS_IP6(p)) - { - DEBUG_WRAP(DebugMessage(DEBUG_DECODE, - "ICMP: not IPv4 datagram ([ver: 0x%x][len: 0x%x])\n", - GET_ORIG_IPH_VER(p), GET_ORIG_IPH_LEN(p));); - - codec_events::decoder_event(p, DECODE_ICMP_ORIG_IP_VER_MISMATCH); - - p->orig_family = NO_IP; - p->orig_iph = NULL; - return; - } - - /* set the IP datagram length */ - ip_len = ntohs(GET_ORIG_IPH_LEN(p)); - - /* set the IP header length */ - hlen = (p->orig_iph->ip_verhl & 0x0f) << 2; - - if(len < hlen) - { - DEBUG_WRAP(DebugMessage(DEBUG_DECODE, - "ICMP: IP len (%d bytes) < IP hdr len (%d bytes), packet discarded\n", - ip_len, hlen);); - - codec_events::decoder_event(p, DECODE_ICMP_ORIG_DGRAM_LT_ORIG_IP); - - p->orig_family = NO_IP; - p->orig_iph = NULL; - return; - } - - /* set the remaining packet length */ - ip_len = len - hlen; - - orig_frag_offset = ntohs(GET_ORIG_IPH_OFF(p)); - orig_frag_offset &= 0x1FFF; - - if (orig_frag_offset == 0) - { - /* Original IP payload should be 64 bits */ - if (ip_len < 8) - { - codec_events::decoder_event(p, DECODE_ICMP_ORIG_PAYLOAD_LT_64); - - return; - } - /* ICMP error packets could contain as much of original payload - * as possible, but not exceed 576 bytes - */ - else if (ntohs(GET_IPH_LEN(p)) > 576) - { - codec_events::decoder_event(p, DECODE_ICMP_ORIG_PAYLOAD_GT_576); - } - } - else - { - /* RFC states that only first frag will get an ICMP response */ - codec_events::decoder_event(p, DECODE_ICMP_ORIG_IP_WITH_FRAGOFFSET); - return; - } - - DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "ICMP Unreachable IP header length: " - "%lu\n", (unsigned long)hlen);); - - switch(GET_ORIG_IPH_PROTO(p)) - { - case IPPROTO_TCP: /* decode the interesting part of the header */ - p->orig_tcph = (TCPHdr *)(pkt + hlen); - - /* stuff more data into the printout data struct */ - p->orig_sp = ntohs(p->orig_tcph->th_sport); - p->orig_dp = ntohs(p->orig_tcph->th_dport); - - break; - - case IPPROTO_UDP: - p->orig_udph = (udp::UDPHdr *)(pkt + hlen); - - /* fill in the printout data structs */ - p->orig_sp = ntohs(p->orig_udph->uh_sport); - p->orig_dp = ntohs(p->orig_udph->uh_dport); - - break; - - case IPPROTO_ICMP: - p->orig_icmph = (ICMPHdr *)(pkt + hlen); - break; - } - - return; -} -#endif - void Icmp4Codec::ICMP4AddrTests(Packet* p) { uint8_t msb_dst; @@ -560,5 +462,12 @@ static const CodecApi icmp4_api = }; +#ifdef BUILDING_SO +SO_PUBLIC const BaseApi* snort_plugins[] = +{ + &icmp4_api.base, + nullptr +}; +#else const BaseApi* cd_icmp4 = &icmp4_api.base; - +#endif diff --git a/src/codecs/ip/cd_icmp4_module.cc b/src/codecs/ip/cd_icmp4_module.cc deleted file mode 100644 index 25340d5ad..000000000 --- a/src/codecs/ip/cd_icmp4_module.cc +++ /dev/null @@ -1,66 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -// cd_icmp4_module.cc author Josh Rosenbaum - -#include "codecs/ip/cd_icmp4_module.h" - -// rules which will loaded into snort. -// You can now reference these rules by calling a codec_event -// in your main codec's functions -static const RuleMap icmp4_rules[] = -{ - { DECODE_ICMP_DGRAM_LT_ICMPHDR, "(" CD_ICMP4_NAME ") ICMP Header Truncated" }, - { DECODE_ICMP_DGRAM_LT_TIMESTAMPHDR, "(" CD_ICMP4_NAME ") ICMP Timestamp Header Truncated" }, - { DECODE_ICMP_DGRAM_LT_ADDRHDR, "(" CD_ICMP4_NAME ") ICMP Address Header Truncated" }, - { DECODE_ICMP_ORIG_IP_TRUNCATED, "(" CD_ICMP4_NAME ") ICMP Original IP Header Truncated" }, - { DECODE_ICMP_ORIG_IP_VER_MISMATCH, "(" CD_ICMP4_NAME ") ICMP version and Original IP Header versions differ" }, - { DECODE_ICMP_ORIG_DGRAM_LT_ORIG_IP, "(" CD_ICMP4_NAME ") ICMP Original Datagram Length < Original IP Header Length" }, - { DECODE_ICMP_ORIG_PAYLOAD_LT_64, "(" CD_ICMP4_NAME ") ICMP Original IP Payload < 64 bits" }, - { DECODE_ICMP_ORIG_PAYLOAD_GT_576, "(" CD_ICMP4_NAME ") ICMP Origianl IP Payload > 576 bytes" }, - { DECODE_ICMP_ORIG_IP_WITH_FRAGOFFSET, "(" CD_ICMP4_NAME ") ICMP Original IP Fragmented and Offset Not 0" }, - { DECODE_ICMP4_DST_MULTICAST, "(" CD_ICMP4_NAME ") ICMP4 packet to multicast dest address" }, - { DECODE_ICMP4_DST_BROADCAST, "(" CD_ICMP4_NAME ") ICMP4 packet to broadcast dest address" }, - { DECODE_ICMP4_TYPE_OTHER, "(" CD_ICMP4_NAME ") ICMP4 type other" }, - { DECODE_ICMP_PING_NMAP, "(" CD_ICMP4_NAME ") ICMP PING NMAP" }, - { DECODE_ICMP_ICMPENUM, "(" CD_ICMP4_NAME ") ICMP icmpenum v1.1.1" }, - { DECODE_ICMP_REDIRECT_HOST, "(" CD_ICMP4_NAME ") ICMP redirect host" }, - { DECODE_ICMP_REDIRECT_NET, "(" CD_ICMP4_NAME ") ICMP redirect net" }, - { DECODE_ICMP_TRACEROUTE_IPOPTS, "(" CD_ICMP4_NAME ") ICMP traceroute ipopts" }, - { DECODE_ICMP_SOURCE_QUENCH, "(" CD_ICMP4_NAME ") ICMP Source Quench" }, - { DECODE_ICMP_BROADSCAN_SMURF_SCANNER, "(" CD_ICMP4_NAME ") Broadscan Smurf Scanner" }, - { DECODE_ICMP_DST_UNREACH_ADMIN_PROHIBITED, "(" CD_ICMP4_NAME ") ICMP Destination Unreachable Communication Administratively Prohibited" }, - { DECODE_ICMP_DST_UNREACH_DST_HOST_PROHIBITED, "(" CD_ICMP4_NAME ") ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited" }, - { DECODE_ICMP_DST_UNREACH_DST_NET_PROHIBITED, "(" CD_ICMP4_NAME ") ICMP Destination Unreachable Communication with Destination Network is Administratively Prohibited" }, - { DECODE_ICMP_PATH_MTU_DOS, "(" CD_ICMP4_NAME ") ICMP PATH MTU denial of service attempt" }, - { DECODE_ICMP_DOS_ATTEMPT, "(" CD_ICMP4_NAME ") BAD-TRAFFIC linux ICMP header dos attempt" }, - { DECODE_ICMP4_HDR_TRUNC, "(" CD_ICMP4_NAME ") truncated ICMP4 header" }, - { 0, nullptr } -}; - -//------------------------------------------------------------------------- -// rpc module -//------------------------------------------------------------------------- - -Icmp4Module::Icmp4Module() : DecodeModule(CD_ICMP4_NAME) -{ } - -const RuleMap* Icmp4Module::get_rules() const -{ return icmp4_rules; } - diff --git a/src/codecs/ip/cd_icmp4_module.h b/src/codecs/ip/cd_icmp4_module.h deleted file mode 100644 index 41a299b40..000000000 --- a/src/codecs/ip/cd_icmp4_module.h +++ /dev/null @@ -1,39 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -// cd_icmp4_module.h author Josh Rosenbaum - -#ifndef CD_ICMP4_MODULE_H -#define CD_ICMP4_MODULE_H - -#include "codecs/decode_module.h" - - -#define CD_ICMP4_NAME "icmp4" - -class Icmp4Module : public DecodeModule -{ -public: - Icmp4Module(); - - const RuleMap* get_rules() const; -}; - -#endif - diff --git a/src/codecs/ip/cd_icmp6.cc b/src/codecs/ip/cd_icmp6.cc index e7d443d02..c129bb9d2 100644 --- a/src/codecs/ip/cd_icmp6.cc +++ b/src/codecs/ip/cd_icmp6.cc @@ -17,6 +17,7 @@ ** along with this program; if not, write to the Free Software ** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */ +// cd_icmp6.cc author Josh Rosenbaum @@ -29,17 +30,44 @@ #include "framework/codec.h" #include "codecs/decode_module.h" #include "codecs/codec_events.h" -#include "codecs/checksum.h" +#include "codecs/ip/checksum.h" #include "protocols/icmp6.h" #include "protocols/icmp4.h" -#include "codecs/ip/cd_icmp6_module.h" +#include "codecs/decode_module.h" #include "codecs/sf_protocols.h" namespace { +#define CD_ICMP6_NAME "icmp6" +static const RuleMap icmp6_rules[] = +{ + { DECODE_ICMP6_HDR_TRUNC, "(" CD_ICMP6_NAME ") truncated ICMP6 header" }, + { DECODE_ICMP6_TYPE_OTHER, "(" CD_ICMP6_NAME ") ICMP6 type not decoded" }, + { DECODE_ICMP6_DST_MULTICAST, "(" CD_ICMP6_NAME ") ICMP6 packet to multicast address" }, + { DECODE_ICMPV6_TOO_BIG_BAD_MTU, "(" CD_ICMP6_NAME ") ICMPv6 packet of type 2 (message too big) with MTU field < 1280" }, + { DECODE_ICMPV6_UNREACHABLE_NON_RFC_2463_CODE, "(" CD_ICMP6_NAME ") ICMPv6 packet of type 1 (destination unreachable) with non-RFC 2463 code" }, + { DECODE_ICMPV6_SOLICITATION_BAD_CODE, "(" CD_ICMP6_NAME ") ICMPv6 router solicitation packet with a code not equal to 0" }, + { DECODE_ICMPV6_ADVERT_BAD_CODE, "(" CD_ICMP6_NAME ") ICMPv6 router advertisement packet with a code not equal to 0" }, + { DECODE_ICMPV6_SOLICITATION_BAD_RESERVED, "(" CD_ICMP6_NAME ") ICMPv6 router solicitation packet with the reserved field not equal to 0" }, + { DECODE_ICMPV6_ADVERT_BAD_REACHABLE, "(" CD_ICMP6_NAME ") ICMPv6 router advertisement packet with the reachable time field set > 1 hour" }, + { DECODE_ICMPV6_UNREACHABLE_NON_RFC_4443_CODE, "(" CD_ICMP6_NAME ") ICMPv6 packet of type 1 (destination unreachable) with non-RFC 4443 code" }, + { DECODE_ICMPV6_NODE_INFO_BAD_CODE, "(" CD_ICMP6_NAME ") ICMPv6 node info query/response packet with a code greater than 2" }, + { 0, nullptr } +}; + +class Icmp6Module : public DecodeModule +{ +public: + Icmp6Module() : DecodeModule(CD_ICMP6_NAME) {} + + const RuleMap* get_rules() const + { return icmp6_rules; } +}; + + class Icmp6Codec : public Codec { public: @@ -307,109 +335,6 @@ bool Icmp6Codec::decode(const uint8_t* raw_pkt, const uint32_t& raw_len, } -// TODO: delete (along with any mention of this function) - -#if 0 - -/* - * Function: DecodeICMPEmbeddedIP6(uint8_t *, const uint32_t, Packet *) - * - * Purpose: Decode the ICMP embedded IP6 header + payload - * - * Arguments: pkt => ptr to the packet data - * len => length from here to the end of the packet - * p => pointer to dummy packet decode struct - * - * Returns: void function - */ -static void DecodeICMPEmbeddedIP6(const uint8_t *pkt, const uint32_t len, Packet *p) -{ -// uint16_t orig_frag_offset; - - /* lay the IP struct over the raw data */ - const ip::IP6RawHdr* hdr = reinterpret_cast(pkt); - - DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "DecodeICMPEmbeddedIP6: ip header" - " starts at: %p, length is %lu\n", hdr, - (unsigned long) len);); - - /* do a little validation */ - if ( len < ip::hdr_len() ) - { - DEBUG_WRAP(DebugMessage(DEBUG_DECODE, - "ICMP6: IP short header (%d bytes)\n", len);); - - codec_events::decoder_event(p, DECODE_ICMP_ORIG_IP_TRUNCATED); - - return; - } - - /* - * with datalink DLT_RAW it's impossible to differ ARP datagrams from IP. - * So we are just ignoring non IP datagrams - */ - if(hdr->get_ver() != 6) - { - DEBUG_WRAP(DebugMessage(DEBUG_DECODE, - "ICMP: not IPv6 datagram ([ver: 0x%x][len: 0x%x])\n", - hdr->get_ver(), len);); - - codec_events::decoder_event(p, DECODE_ICMP_ORIG_IP_VER_MISMATCH); - - return; - } - - if ( len < ip::hdr_len() ) - { - DEBUG_WRAP(DebugMessage(DEBUG_DECODE, - "ICMP6: IP6 len (%d bytes) < IP6 hdr len (%d bytes), packet discarded\n", - len, ip::hdr_len());); - - codec_events::decoder_event(p, DECODE_ICMP_ORIG_DGRAM_LT_ORIG_IP); - - return; - } - sfiph_orig_build(p, pkt, AF_INET6); - -// orig_frag_offset = ntohs(GET_ORIG_IPH_OFF(p)); -// orig_frag_offset &= 0x1FFF; - - // XXX NOT YET IMPLEMENTED - fragments inside ICMP payload - - DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "ICMP6 Unreachable IP6 header length: " - "%lu\n", (unsigned long)ip::hdr_len());); - - switch(GET_ORIG_IPH_PROTO(p)) - { - case IPPROTO_TCP: /* decode the interesting part of the header */ - p->orig_tcph = (TCPHdr *)(pkt + ip::hdr_len()); - - /* stuff more data into the printout data struct */ - p->orig_sp = ntohs(p->orig_tcph->th_sport); - p->orig_dp = ntohs(p->orig_tcph->th_dport); - - break; - - case IPPROTO_UDP: - p->orig_udph = (udp::UDPHdr *)(pkt + ip::hdr_len()); - - /* fill in the printout data structs */ - p->orig_sp = ntohs(p->orig_udph->uh_sport); - p->orig_dp = ntohs(p->orig_udph->uh_dport); - - break; - - case IPPROTO_ICMP: - p->orig_icmph = (ICMPHdr *)(pkt + ip::hdr_len()); - break; - } - - return; -} - -#endif - - /****************************************************************** ******************** E N C O D E R ****************************** ******************************************************************/ @@ -452,7 +377,7 @@ bool Icmp6Codec::encode(EncState* enc, Buffer* out, const uint8_t *raw_in) // Now performed in cd_ip6_embedded_in_icmp.cc // TBD should be able to elminate enc->ip_hdr by using layer-2 memcpy(out->base, enc->ip_hdr, enc->ip_len); - ((ip::IP6RawHdr*)out->base)->ip6_next = IPPROTO_UDP; + ((ip::IP6Hdr*)out->base)->ip6_next = IPPROTO_UDP; #endif @@ -469,7 +394,7 @@ bool Icmp6Codec::encode(EncState* enc, Buffer* out, const uint8_t *raw_in) enc->proto = IPPROTO_ICMPV6; int len = buff_diff(out, (uint8_t *)ho); - const ip::IP6RawHdr* const ip6h = enc->p->ip_api.get_ip6h(); + const ip::IP6Hdr* const ip6h = enc->p->ip_api.get_ip6h(); memcpy(ps6.sip, ip6h->ip6_src.u6_addr8, sizeof(ps6.sip)); memcpy(ps6.dip, ip6h->ip6_dst.u6_addr8, sizeof(ps6.dip)); @@ -546,4 +471,12 @@ static const CodecApi ipv6_api = }; +#ifdef BUILDING_SO +SO_PUBLIC const BaseApi* snort_plugins[] = +{ + &ipv6_api.base, + nullptr +}; +#else const BaseApi* cd_icmp6 = &ipv6_api.base; +#endif diff --git a/src/codecs/ip/cd_icmp6_module.cc b/src/codecs/ip/cd_icmp6_module.cc deleted file mode 100644 index 691c08bbf..000000000 --- a/src/codecs/ip/cd_icmp6_module.cc +++ /dev/null @@ -1,52 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -// cd_icmp6_module.cc author Josh Rosenbaum - -#include "codecs/ip/cd_icmp6_module.h" - -// rules which will loaded into snort. -// You can now reference these rules by calling a codec_event -// in your main codec's functions -static const RuleMap icmp6_rules[] = -{ - { DECODE_ICMP6_HDR_TRUNC, "(" CD_ICMP6_NAME ") truncated ICMP6 header" }, - { DECODE_ICMP6_TYPE_OTHER, "(" CD_ICMP6_NAME ") ICMP6 type not decoded" }, - { DECODE_ICMP6_DST_MULTICAST, "(" CD_ICMP6_NAME ") ICMP6 packet to multicast address" }, - { DECODE_ICMPV6_TOO_BIG_BAD_MTU, "(" CD_ICMP6_NAME ") ICMPv6 packet of type 2 (message too big) with MTU field < 1280" }, - { DECODE_ICMPV6_UNREACHABLE_NON_RFC_2463_CODE, "(" CD_ICMP6_NAME ") ICMPv6 packet of type 1 (destination unreachable) with non-RFC 2463 code" }, - { DECODE_ICMPV6_SOLICITATION_BAD_CODE, "(" CD_ICMP6_NAME ") ICMPv6 router solicitation packet with a code not equal to 0" }, - { DECODE_ICMPV6_ADVERT_BAD_CODE, "(" CD_ICMP6_NAME ") ICMPv6 router advertisement packet with a code not equal to 0" }, - { DECODE_ICMPV6_SOLICITATION_BAD_RESERVED, "(" CD_ICMP6_NAME ") ICMPv6 router solicitation packet with the reserved field not equal to 0" }, - { DECODE_ICMPV6_ADVERT_BAD_REACHABLE, "(" CD_ICMP6_NAME ") ICMPv6 router advertisement packet with the reachable time field set > 1 hour" }, - { DECODE_ICMPV6_UNREACHABLE_NON_RFC_4443_CODE, "(" CD_ICMP6_NAME ") ICMPv6 packet of type 1 (destination unreachable) with non-RFC 4443 code" }, - { DECODE_ICMPV6_NODE_INFO_BAD_CODE, "(" CD_ICMP6_NAME ") ICMPv6 node info query/response packet with a code greater than 2" }, - { 0, nullptr } -}; - -//------------------------------------------------------------------------- -// rpc module -//------------------------------------------------------------------------- - -Icmp6Module::Icmp6Module() : DecodeModule(CD_ICMP6_NAME) -{ } - -const RuleMap* Icmp6Module::get_rules() const -{ return icmp6_rules; } - diff --git a/src/codecs/ip/cd_icmp6_module.h b/src/codecs/ip/cd_icmp6_module.h deleted file mode 100644 index 393f4ef4f..000000000 --- a/src/codecs/ip/cd_icmp6_module.h +++ /dev/null @@ -1,38 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -// cd_icmp6_module.h author Josh Rosenbaum - -#ifndef CD_ICMP6_MODULE_H -#define CD_ICMP6_MODULE_H - -#include "codecs/decode_module.h" - - -#define CD_ICMP6_NAME "icmp6" - -class Icmp6Module : public DecodeModule -{ -public: - Icmp6Module(); - - const RuleMap* get_rules() const; -}; - -#endif diff --git a/src/codecs/ip/cd_igmp.cc b/src/codecs/ip/cd_igmp.cc index 6d2eb558b..c1a112119 100644 --- a/src/codecs/ip/cd_igmp.cc +++ b/src/codecs/ip/cd_igmp.cc @@ -17,6 +17,7 @@ ** along with this program; if not, write to the Free Software ** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */ +// cd_igmp.cc author Josh Rosenbaum @@ -25,13 +26,34 @@ #endif #include "framework/codec.h" -#include "codecs/ip/cd_igmp_module.h" +#include "codecs/decode_module.h" #include "codecs/codec_events.h" namespace { + +#define CD_IGMP_NAME "igmp" + +static const RuleMap igmp_rules[] = +{ + { DECODE_IGMP_OPTIONS_DOS, "(" CD_IGMP_NAME ") DOS IGMP IP Options validation attempt" }, + { 0, nullptr } +}; + + +class IgmpModule : public DecodeModule +{ +public: + IgmpModule() : DecodeModule(CD_IGMP_NAME) {} + + const RuleMap* get_rules() const + { return igmp_rules; } +}; + + + class IgmpCodec : public Codec { public: diff --git a/src/codecs/ip/cd_igmp_module.cc b/src/codecs/ip/cd_igmp_module.cc deleted file mode 100644 index 0720a709f..000000000 --- a/src/codecs/ip/cd_igmp_module.cc +++ /dev/null @@ -1,39 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -// cd_igmp_module.cc author Josh Rosenbaum - -#include "codecs/ip/cd_igmp_module.h" - -static const RuleMap igmp_rules[] = -{ - { DECODE_IGMP_OPTIONS_DOS, "(" CD_IGMP_NAME ") DOS IGMP IP Options validation attempt" }, - { 0, nullptr } -}; - -//------------------------------------------------------------------------- -// rpc module -//------------------------------------------------------------------------- - -IgmpModule::IgmpModule() : DecodeModule(CD_IGMP_NAME) -{ } - -const RuleMap* IgmpModule::get_rules() const -{ return igmp_rules; } - diff --git a/src/codecs/ip/cd_igmp_module.h b/src/codecs/ip/cd_igmp_module.h deleted file mode 100644 index ded8acad8..000000000 --- a/src/codecs/ip/cd_igmp_module.h +++ /dev/null @@ -1,38 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -// cd_igmp_module.h author Josh Rosenbaum - -#ifndef CD_IGMP_MODULE_H -#define CD_IGMP_MODULE_H - -#include "codecs/decode_module.h" - - -#define CD_IGMP_NAME "igmp" - -class IgmpModule : public DecodeModule -{ -public: - IgmpModule(); - - const RuleMap* get_rules() const; -}; - -#endif diff --git a/src/codecs/ip/cd_ipv4.cc b/src/codecs/ip/cd_ipv4.cc index 182d110ef..a1f19b59d 100644 --- a/src/codecs/ip/cd_ipv4.cc +++ b/src/codecs/ip/cd_ipv4.cc @@ -41,17 +41,60 @@ #include "utils/stats.h" #include "packet_io/active.h" -#include "codecs/decode_module.h" #include "codecs/codec_events.h" -#include "codecs/checksum.h" +#include "codecs/ip/checksum.h" #include "main/thread.h" #include "stream/stream_api.h" -#include "codecs/ip/cd_ipv4_module.h" +#include "codecs/decode_module.h" #include "codecs/sf_protocols.h" #include "protocols/ip.h" namespace{ +#define CD_IPV4_NAME "ipv4" +static const RuleMap ipv4_rules[] = +{ + { DECODE_NOT_IPV4_DGRAM, "(" CD_IPV4_NAME ") Not IPv4 datagram" }, + { DECODE_IPV4_INVALID_HEADER_LEN, "(" CD_IPV4_NAME ") hlen < IP_HEADER_LEN" }, + { DECODE_IPV4_DGRAM_LT_IPHDR, "(" CD_IPV4_NAME ") IP dgm len < IP Hdr len" }, + { DECODE_IPV4OPT_BADLEN, "(" CD_IPV4_NAME ") Ipv4 Options found with bad lengths" }, + { DECODE_IPV4OPT_TRUNCATED, "(" CD_IPV4_NAME ") Truncated Ipv4 Options" }, + { DECODE_IPV4_DGRAM_GT_CAPLEN, "(" CD_IPV4_NAME ") IP dgm len > captured len" }, + { DECODE_ZERO_TTL, "(" CD_IPV4_NAME ") IPV4 packet with zero TTL" }, + { DECODE_BAD_FRAGBITS, "(" CD_IPV4_NAME ") IPV4 packet with bad frag bits (Both MF and DF set)" }, + { DECODE_IP4_LEN_OFFSET, "(" CD_IPV4_NAME ") IPV4 packet frag offset + length exceed maximum" }, + { DECODE_IP4_SRC_THIS_NET, "(" CD_IPV4_NAME ") IPV4 packet from 'current net' source address" }, + { DECODE_IP4_DST_THIS_NET, "(" CD_IPV4_NAME ") IPV4 packet to 'current net' dest address" }, + { DECODE_IP4_SRC_MULTICAST, "(" CD_IPV4_NAME ") IPV4 packet from multicast source address" }, + { DECODE_IP4_SRC_RESERVED, "(" CD_IPV4_NAME ") IPV4 packet from reserved source address" }, + { DECODE_IP4_DST_RESERVED, "(" CD_IPV4_NAME ") IPV4 packet to reserved dest address" }, + { DECODE_IP4_SRC_BROADCAST, "(" CD_IPV4_NAME ") IPV4 packet from broadcast source address" }, + { DECODE_IP4_DST_BROADCAST, "(" CD_IPV4_NAME ") IPV4 packet to broadcast dest address" }, + { DECODE_IP4_MIN_TTL, "(" CD_IPV4_NAME ") IPV4 packet below TTL limit" }, + { DECODE_IP4_DF_OFFSET, "(" CD_IPV4_NAME ") IPV4 packet both DF and offset set" }, + { DECODE_IP_RESERVED_FRAG_BIT, "(" CD_IPV4_NAME ") BAD-TRAFFIC IP reserved bit set" }, + { DECODE_IP_UNASSIGNED_PROTO, "(" CD_IPV4_NAME ") BAD-TRAFFIC Unassigned/Reserved IP protocol" }, + { DECODE_IP_BAD_PROTO, "(" CD_IPV4_NAME ") BAD-TRAFFIC Bad IP protocol" }, + { DECODE_IP_OPTION_SET, "(" CD_IPV4_NAME ") MISC IP option set" }, + { DECODE_IP_MULTIPLE_ENCAPSULATION, "(" CD_IPV4_NAME ") Two or more IP (v4 and/or v6) encapsulation layers present" }, + { DECODE_ZERO_LENGTH_FRAG, "(" CD_IPV4_NAME ") fragment with zero length" }, + { DECODE_IP4_HDR_TRUNC, "(" CD_IPV4_NAME ") truncated IP4 header" }, + { DECODE_BAD_TRAFFIC_LOOPBACK, "(" CD_IPV4_NAME ") Bad Traffic Loopback IP" }, + { DECODE_BAD_TRAFFIC_SAME_SRCDST, "(" CD_IPV4_NAME ") Bad Traffic Same Src/Dst IP" }, + { 0, nullptr } +}; + +class Ipv4Module : public DecodeModule +{ +public: + Ipv4Module() : DecodeModule(CD_IPV4_NAME) {} + + const RuleMap* get_rules() const + { return ipv4_rules; } +}; + + + class Ipv4Codec : public Codec { public: @@ -86,10 +129,16 @@ static THREAD_LOCAL std::array s_id_pool{{0}}; } // namespace -static inline void IP4AddrTests (const IPHdr*, const Packet* p); +static inline void IP4AddrTests (const IP4Hdr*, const Packet* p); static inline void IPMiscTests(Packet *); static void DecodeIPOptions(const uint8_t *start, uint32_t o_len, Packet *p); +static int OptLenValidate(const uint8_t *option_ptr, + const uint8_t *end, + const uint8_t *len_ptr, + int expected_len, + Options *tcpopt, + uint8_t *byte_skip); /******************************************* ************ PRIVATE FUNCTIONS *********** @@ -188,7 +237,7 @@ bool Ipv4Codec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len, p->encapsulations++; /* lay the IP struct over the raw data */ - IPHdr* iph = reinterpret_cast(const_cast(raw_pkt)); + IP4Hdr* iph = reinterpret_cast(const_cast(raw_pkt)); /* * with datalink DLT_RAW it's impossible to differ ARP datagrams from IP. @@ -381,7 +430,7 @@ bool Ipv4Codec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len, //-------------------------------------------------------------------- -static inline void IP4AddrTests(const IPHdr* iph, const Packet* p) +static inline void IP4AddrTests(const IP4Hdr* iph, const Packet* p) { uint8_t msb_src, msb_dst; @@ -583,6 +632,57 @@ static void DecodeIPOptions(const uint8_t *start, uint32_t o_len, Packet *p) return; } + +static int OptLenValidate(const uint8_t *option_ptr, + const uint8_t *end, + const uint8_t *len_ptr, + int expected_len, + Options *tcpopt, + uint8_t *byte_skip) +{ + *byte_skip = 0; + + if(len_ptr == NULL) + return tcp::OPT_TRUNC; + + + if(*len_ptr == 0 || expected_len == 0 || expected_len == 1) + { + return tcp::OPT_BADLEN; + } + else if(expected_len > 1) + { + /* not enough data to read in a perfect world */ + if((option_ptr + expected_len) > end) + return tcp::OPT_TRUNC; + + if(*len_ptr != expected_len) + return tcp::OPT_BADLEN; + } + else /* expected_len < 0 (i.e. variable length) */ + { + /* RFC sez that we MUST have atleast this much data */ + if(*len_ptr < 2) + return tcp::OPT_BADLEN; + + /* not enough data to read in a perfect world */ + if((option_ptr + *len_ptr) > end) + return tcp::OPT_TRUNC; + } + + tcpopt->len = *len_ptr - 2; + + if(*len_ptr == 2) + tcpopt->data = NULL; + else + tcpopt->data = option_ptr + 2; + + *byte_skip = *len_ptr; + + return 0; +} + + /****************************************************************** ******************** E N C O D E R ****************************** *******************************************************************/ @@ -609,14 +709,14 @@ static inline uint16_t IpId_Next () bool Ipv4Codec::encode(EncState* enc, Buffer* out, const uint8_t* raw_in) { - IPHdr *ho; + IP4Hdr *ho; if (!update_buffer(out, sizeof(*ho))) return false; - const IPHdr *hi = reinterpret_cast(raw_in); - ho = reinterpret_cast(out->base); + const IP4Hdr *hi = reinterpret_cast(raw_in); + ho = reinterpret_cast(out->base); /* IPv4 encoded header is hardcoded 20 bytes */ ho->ip_verhl = 0x45; @@ -655,7 +755,7 @@ bool Ipv4Codec::encode(EncState* enc, Buffer* out, const uint8_t* raw_in) bool Ipv4Codec::update(Packet* p, Layer* lyr, uint32_t* len) { - IPHdr* h = (IPHdr*)(lyr->start); + IP4Hdr* h = (IP4Hdr*)(lyr->start); int i = lyr - p->layers; uint16_t hlen = h->get_hlen() << 2; @@ -680,12 +780,12 @@ bool Ipv4Codec::update(Packet* p, Layer* lyr, uint32_t* len) void Ipv4Codec::format(EncodeFlags f, const Packet* p, Packet* c, Layer* lyr) { // TBD handle nested ip layers - IPHdr* ch = (IPHdr*)lyr->start; + IP4Hdr* ch = (IP4Hdr*)lyr->start; if ( reverse(f) ) { int i = lyr - c->layers; - IPHdr* ph = (IPHdr*)p->layers[i].start; + IP4Hdr* ph = (IP4Hdr*)p->layers[i].start; ch->ip_src = ph->ip_dst; ch->ip_dst = ph->ip_src; @@ -778,5 +878,18 @@ static const CodecApi ipv4_api = dtor, // dtor }; +#if 0 +#ifdef BUILDING_SO +SO_PUBLIC const BaseApi* snort_plugins[] = +{ + &ipv4_api.base, + nullptr +}; +#else +const BaseApi* cd_ipv4 = &ipv4_api.base; +#endif +#endif + +// Currently needs to be static const BaseApi* cd_ipv4 = &ipv4_api.base; diff --git a/src/codecs/ip/cd_ipv4_module.cc b/src/codecs/ip/cd_ipv4_module.cc deleted file mode 100644 index da0c0c926..000000000 --- a/src/codecs/ip/cd_ipv4_module.cc +++ /dev/null @@ -1,68 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -// cd_ipv4_module.cc author Josh Rosenbaum - -#include "codecs/ip/cd_ipv4_module.h" - -// rules which will loaded into snort. -// You can now reference these rules by calling a codec_event -// in your main codec's functions -static const RuleMap ipv4_rules[] = -{ - { DECODE_NOT_IPV4_DGRAM, "(" CD_IPV4_NAME ") Not IPv4 datagram" }, - { DECODE_IPV4_INVALID_HEADER_LEN, "(" CD_IPV4_NAME ") hlen < IP_HEADER_LEN" }, - { DECODE_IPV4_DGRAM_LT_IPHDR, "(" CD_IPV4_NAME ") IP dgm len < IP Hdr len" }, - { DECODE_IPV4OPT_BADLEN, "(" CD_IPV4_NAME ") Ipv4 Options found with bad lengths" }, - { DECODE_IPV4OPT_TRUNCATED, "(" CD_IPV4_NAME ") Truncated Ipv4 Options" }, - { DECODE_IPV4_DGRAM_GT_CAPLEN, "(" CD_IPV4_NAME ") IP dgm len > captured len" }, - { DECODE_ZERO_TTL, "(" CD_IPV4_NAME ") IPV4 packet with zero TTL" }, - { DECODE_BAD_FRAGBITS, "(" CD_IPV4_NAME ") IPV4 packet with bad frag bits (Both MF and DF set)" }, - { DECODE_IP4_LEN_OFFSET, "(" CD_IPV4_NAME ") IPV4 packet frag offset + length exceed maximum" }, - { DECODE_IP4_SRC_THIS_NET, "(" CD_IPV4_NAME ") IPV4 packet from 'current net' source address" }, - { DECODE_IP4_DST_THIS_NET, "(" CD_IPV4_NAME ") IPV4 packet to 'current net' dest address" }, - { DECODE_IP4_SRC_MULTICAST, "(" CD_IPV4_NAME ") IPV4 packet from multicast source address" }, - { DECODE_IP4_SRC_RESERVED, "(" CD_IPV4_NAME ") IPV4 packet from reserved source address" }, - { DECODE_IP4_DST_RESERVED, "(" CD_IPV4_NAME ") IPV4 packet to reserved dest address" }, - { DECODE_IP4_SRC_BROADCAST, "(" CD_IPV4_NAME ") IPV4 packet from broadcast source address" }, - { DECODE_IP4_DST_BROADCAST, "(" CD_IPV4_NAME ") IPV4 packet to broadcast dest address" }, - { DECODE_IP4_MIN_TTL, "(" CD_IPV4_NAME ") IPV4 packet below TTL limit" }, - { DECODE_IP4_DF_OFFSET, "(" CD_IPV4_NAME ") IPV4 packet both DF and offset set" }, - { DECODE_IP_RESERVED_FRAG_BIT, "(decode) BAD-TRAFFIC IP reserved bit set" }, - { DECODE_IP_UNASSIGNED_PROTO, "(decode) BAD-TRAFFIC Unassigned/Reserved IP protocol" }, - { DECODE_IP_BAD_PROTO, "(decode) BAD-TRAFFIC Bad IP protocol" }, - { DECODE_IP_OPTION_SET, "(decode) MISC IP option set" }, - { DECODE_IP_MULTIPLE_ENCAPSULATION, "(decode) Two or more IP (v4 and/or v6) encapsulation layers present" }, - { DECODE_ZERO_LENGTH_FRAG, "(decode) fragment with zero length" }, - { DECODE_IP4_HDR_TRUNC, "(decode) truncated IP4 header" }, - { DECODE_BAD_TRAFFIC_LOOPBACK, "(snort decoder) Bad Traffic Loopback IP" }, - { DECODE_BAD_TRAFFIC_SAME_SRCDST, "(snort decoder) Bad Traffic Same Src/Dst IP" }, - { 0, nullptr } -}; - -//------------------------------------------------------------------------- -// rpc module -//------------------------------------------------------------------------- - -Ipv4Module::Ipv4Module() : DecodeModule(CD_IPV4_NAME) -{ } - -const RuleMap* Ipv4Module::get_rules() const -{ return ipv4_rules; } - diff --git a/src/codecs/ip/cd_ipv4_module.h b/src/codecs/ip/cd_ipv4_module.h deleted file mode 100644 index 8e38816aa..000000000 --- a/src/codecs/ip/cd_ipv4_module.h +++ /dev/null @@ -1,39 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -// cd_ipv4_module.h author Josh Rosenbaum - -#ifndef TEMPLATE_MODULE_H -#define TEMPLATE_MODULE_H - -#include "codecs/decode_module.h" - - -#define CD_IPV4_NAME "ipv4" - -class Ipv4Module : public DecodeModule -{ -public: - Ipv4Module(); - - const RuleMap* get_rules() const; -}; - -#endif - diff --git a/src/codecs/ip/cd_ipv6.cc b/src/codecs/ip/cd_ipv6.cc index ea9f887bc..cb41c6718 100644 --- a/src/codecs/ip/cd_ipv6.cc +++ b/src/codecs/ip/cd_ipv6.cc @@ -34,13 +34,53 @@ #include "stream/stream_api.h" #include "main/snort.h" #include "packet_io/active.h" -#include "codecs/ip/cd_ipv6_module.h" +#include "codecs/decode_module.h" #include "codecs/sf_protocols.h" #include "protocols/protocol_ids.h" namespace { +#define CD_IPV6_NAME "ipv6" +static const RuleMap ipv6_rules[] = +{ + { DECODE_IPV6_MIN_TTL, "(" CD_IPV6_NAME ") IPv6 packet below TTL limit" }, + { DECODE_IPV6_IS_NOT, "(" CD_IPV6_NAME ") IPv6 header claims to not be IPv6" }, + { DECODE_IPV6_TRUNCATED_EXT, "(" CD_IPV6_NAME ") IPV6 truncated extension header" }, + { DECODE_IPV6_TRUNCATED, "(" CD_IPV6_NAME ") IPV6 truncated header" }, + { DECODE_IPV6_DGRAM_LT_IPHDR, "(" CD_IPV6_NAME ") IP dgm len < IP Hdr len" }, + { DECODE_IPV6_DGRAM_GT_CAPLEN, "(" CD_IPV6_NAME ") IP dgm len > captured len" }, + { DECODE_IPV6_DST_ZERO, "(" CD_IPV6_NAME ") IPv6 packet with destination address ::0" }, + { DECODE_IPV6_SRC_MULTICAST, "(" CD_IPV6_NAME ") IPv6 packet with multicast source address" }, + { DECODE_IPV6_DST_RESERVED_MULTICAST, "(" CD_IPV6_NAME ") IPv6 packet with reserved multicast destination address" }, + { DECODE_IPV6_BAD_OPT_TYPE, "(" CD_IPV6_NAME ") IPv6 header includes an undefined option type" }, + { DECODE_IPV6_BAD_MULTICAST_SCOPE, "(" CD_IPV6_NAME ") IPv6 address includes an unassigned multicast scope value" }, + { DECODE_IPV6_BAD_NEXT_HEADER, "(" CD_IPV6_NAME ") IPv6 header includes an invalid value for the 'next header' field" }, + { DECODE_IPV6_ROUTE_AND_HOPBYHOP, "(" CD_IPV6_NAME ") IPv6 header includes a routing extension header followed by a hop-by-hop header" }, + { DECODE_IPV6_TWO_ROUTE_HEADERS, "(" CD_IPV6_NAME ") IPv6 header includes two routing extension headers" }, + { DECODE_IPV6_DSTOPTS_WITH_ROUTING, "(" CD_IPV6_NAME ") IPv6 header has destination options followed by a routing header" }, + { DECODE_IPV6_TUNNELED_IPV4_TRUNCATED, "(" CD_IPV6_NAME ") IPV6 tunneled over IPv4, IPv6 header truncated, possible Linux Kernel attack" }, + { DECODE_IPV6_BAD_OPT_LEN, "(" CD_IPV6_NAME ") IPv6 header includes an option which is too big for the containing header" }, + { DECODE_IPV6_UNORDERED_EXTENSIONS, "(" CD_IPV6_NAME ") IPv6 packet includes out-of-order extension headers" }, + { DECODE_IP6_ZERO_HOP_LIMIT, "(" CD_IPV6_NAME ") IPV6 packet has zero hop limit" }, + { DECODE_IPV6_ISATAP_SPOOF, "(" CD_IPV6_NAME ") BAD-TRAFFIC ISATAP-addressed IPv6 traffic spoofing attempt" }, + { DECODE_IPV6_BAD_FRAG_PKT, "(" CD_IPV6_NAME ") bogus fragmentation packet. Possible BSD attack" }, + { DECODE_IPV6_ROUTE_ZERO, "(" CD_IPV6_NAME ") IPV6 routing type 0 extension header" }, + { DECODE_IP6_EXCESS_EXT_HDR, "(" CD_IPV6_NAME ") too many IP6 extension headers" }, + { 0, nullptr } +}; + + +class Ipv6Module : public DecodeModule +{ +public: + Ipv6Module() : DecodeModule(CD_IPV6_NAME) {} + + const RuleMap* get_rules() const + { return ipv6_rules; } +}; + + class Ipv6Codec : public Codec { public: @@ -67,10 +107,10 @@ private: } // namespace -static inline void IPV6CheckIsatap(const ip::IP6RawHdr* const, Packet* p); +static inline void IPV6CheckIsatap(const ip::IP6Hdr* const, Packet* p); static inline void IPV6MiscTests(Packet* p); -static void CheckIPV6Multicast(const ip::IP6RawHdr*, const Packet* const p); -static inline int CheckTeredoPrefix(const ip::IP6RawHdr* const hdr); +static void CheckIPV6Multicast(const ip::IP6Hdr*, const Packet* const p); +static inline int CheckTeredoPrefix(const ip::IP6Hdr* const hdr); /******************************************************************** ************************* PRIVATE FUNCTIONS ********************** @@ -139,8 +179,8 @@ bool Ipv6Codec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len, uint32_t payload_len; /* lay the IP struct over the raw data */ - const ip::IP6RawHdr* const ip6h = - reinterpret_cast(const_cast(raw_pkt)); + const ip::IP6Hdr* const ip6h = + reinterpret_cast(const_cast(raw_pkt)); if(raw_len < ip::IP6_HEADER_LEN) { @@ -235,7 +275,7 @@ decodeipv6_fail: return false; } -static inline void IPV6CheckIsatap(const ip::IP6RawHdr* const ip6h, Packet* p) +static inline void IPV6CheckIsatap(const ip::IP6Hdr* const ip6h, Packet* p) { /* Only check for IPv6 over IPv4 */ if (p->ip_api.is_ip4() && p->ip_api.proto() == IPPROTO_IPV6) @@ -295,7 +335,7 @@ static inline void IPV6MiscTests(Packet* p) /* Check for multiple IPv6 Multicast-related alerts */ -static void CheckIPV6Multicast(const ip::IP6RawHdr* ip6h, +static void CheckIPV6Multicast(const ip::IP6Hdr* ip6h, const Packet* const p) { ip::MulticastScope multicast_scope; @@ -510,7 +550,7 @@ static void CheckIPV6Multicast(const ip::IP6RawHdr* ip6h, /* Teredo packets need to have one of their IPs use either the Teredo prefix, or a link-local prefix (in the case of Router Solicitation messages) */ -static inline int CheckTeredoPrefix(const ip::IP6RawHdr* const hdr) +static inline int CheckTeredoPrefix(const ip::IP6Hdr* const hdr) { /* Check if src address matches 2001::/32 */ if ((hdr->ip6_src.u6_addr8[0] == 0x20) && @@ -558,11 +598,11 @@ static inline int CheckTeredoPrefix(const ip::IP6RawHdr* const hdr) bool Ipv6Codec::encode(EncState* enc, Buffer* out, const uint8_t* raw_in) { - if (!update_buffer(out, sizeof(ip::IP6RawHdr))) + if (!update_buffer(out, sizeof(ip::IP6Hdr))) return false; - const ip::IP6RawHdr* hi = reinterpret_cast(raw_in); - ip::IP6RawHdr* ho = (ip::IP6RawHdr*)(out->base); + const ip::IP6Hdr* hi = reinterpret_cast(raw_in); + ip::IP6Hdr* ho = (ip::IP6Hdr*)(out->base); ho->ip6_vtf = htonl(ntohl(hi->ip6_vtf) & 0xFFF00000); @@ -600,7 +640,7 @@ bool Ipv6Codec::encode(EncState* enc, Buffer* out, const uint8_t* raw_in) bool Ipv6Codec::update(Packet* p, Layer* lyr, uint32_t* len) { - ip::IP6RawHdr* h = (ip::IP6RawHdr*)(lyr->start); + ip::IP6Hdr* h = (ip::IP6Hdr*)(lyr->start); int i = lyr - p->layers; // if we didn't trim payload or format this packet, @@ -634,13 +674,13 @@ bool Ipv6Codec::update(Packet* p, Layer* lyr, uint32_t* len) void Ipv6Codec::format(EncodeFlags f, const Packet* p, Packet* c, Layer* lyr) { - ip::IP6RawHdr* ch = reinterpret_cast( + ip::IP6Hdr* ch = reinterpret_cast( const_cast(lyr->start)); if ( reverse(f) ) { int i = lyr - c->layers; - ip::IP6RawHdr* ph = (ip::IP6RawHdr*)p->layers[i].start; + ip::IP6Hdr* ph = (ip::IP6Hdr*)p->layers[i].start; memcpy(ch->ip6_src.u6_addr8, ph->ip6_dst.u6_addr8, sizeof(ch->ip6_src.u6_addr8)); memcpy(ch->ip6_dst.u6_addr8, ph->ip6_src.u6_addr8, sizeof(ch->ip6_dst.u6_addr8)); @@ -702,6 +742,12 @@ static const CodecApi ipv6_api = }; +#ifdef BUILDING_SO +SO_PUBLIC const BaseApi* snort_plugins[] = +{ + &ipv6_api.base, + nullptr +}; +#else const BaseApi* cd_ipv6 = &ipv6_api.base; - - +#endif diff --git a/src/codecs/ip/cd_ipv6_module.cc b/src/codecs/ip/cd_ipv6_module.cc deleted file mode 100644 index ed3ea374b..000000000 --- a/src/codecs/ip/cd_ipv6_module.cc +++ /dev/null @@ -1,74 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -// cd_ipv6_module.cc author Josh Rosenbaum - -#include "codecs/ip/cd_ipv6_module.h" - - -static const Parameter ipv6_params[] = -{ - { "parameter1", Parameter::PT_BOOL, nullptr, "false", - "This is a boolean parameter" }, - - { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } -}; - - -// rules which will loaded into snort. -// You can now reference these rules by calling a codec_event -// in your main codec's functions -static const RuleMap ipv6_rules[] = -{ - { DECODE_IPV6_MIN_TTL, "(" CD_IPV6_NAME ") IPv6 packet below TTL limit" }, - { DECODE_IPV6_IS_NOT, "(" CD_IPV6_NAME ") IPv6 header claims to not be IPv6" }, - { DECODE_IPV6_TRUNCATED_EXT, "(" CD_IPV6_NAME ") IPV6 truncated extension header" }, - { DECODE_IPV6_TRUNCATED, "(" CD_IPV6_NAME ") IPV6 truncated header" }, - { DECODE_IPV6_DGRAM_LT_IPHDR, "(" CD_IPV6_NAME ") IP dgm len < IP Hdr len" }, - { DECODE_IPV6_DGRAM_GT_CAPLEN, "(" CD_IPV6_NAME ") IP dgm len > captured len" }, - { DECODE_IPV6_DST_ZERO, "(" CD_IPV6_NAME ") IPv6 packet with destination address ::0" }, - { DECODE_IPV6_SRC_MULTICAST, "(" CD_IPV6_NAME ") IPv6 packet with multicast source address" }, - { DECODE_IPV6_DST_RESERVED_MULTICAST, "(" CD_IPV6_NAME ") IPv6 packet with reserved multicast destination address" }, - { DECODE_IPV6_BAD_OPT_TYPE, "(" CD_IPV6_NAME ") IPv6 header includes an undefined option type" }, - { DECODE_IPV6_BAD_MULTICAST_SCOPE, "(" CD_IPV6_NAME ") IPv6 address includes an unassigned multicast scope value" }, - { DECODE_IPV6_BAD_NEXT_HEADER, "(" CD_IPV6_NAME ") IPv6 header includes an invalid value for the 'next header' field" }, - { DECODE_IPV6_ROUTE_AND_HOPBYHOP, "(" CD_IPV6_NAME ") IPv6 header includes a routing extension header followed by a hop-by-hop header" }, - { DECODE_IPV6_TWO_ROUTE_HEADERS, "(" CD_IPV6_NAME ") IPv6 header includes two routing extension headers" }, - { DECODE_IPV6_DSTOPTS_WITH_ROUTING, "(" CD_IPV6_NAME ") IPv6 header has destination options followed by a routing header" }, - { DECODE_IPV6_TUNNELED_IPV4_TRUNCATED, "(" CD_IPV6_NAME ") IPV6 tunneled over IPv4, IPv6 header truncated, possible Linux Kernel attack" }, - { DECODE_IPV6_BAD_OPT_LEN, "(" CD_IPV6_NAME ") IPv6 header includes an option which is too big for the containing header" }, - { DECODE_IPV6_UNORDERED_EXTENSIONS, "(" CD_IPV6_NAME ") IPv6 packet includes out-of-order extension headers" }, - { DECODE_IP6_ZERO_HOP_LIMIT, "(" CD_IPV6_NAME ") IPV6 packet has zero hop limit" }, - { DECODE_IPV6_ISATAP_SPOOF, "(" CD_IPV6_NAME ") BAD-TRAFFIC ISATAP-addressed IPv6 traffic spoofing attempt" }, - { DECODE_IPV6_BAD_FRAG_PKT, "(" CD_IPV6_NAME ") bogus fragmentation packet. Possible BSD attack" }, - { DECODE_IPV6_ROUTE_ZERO, "(" CD_IPV6_NAME ") IPV6 routing type 0 extension header" }, - { DECODE_IP6_EXCESS_EXT_HDR, "(" CD_IPV6_NAME ") too many IP6 extension headers" }, - { 0, nullptr } -}; - -//------------------------------------------------------------------------- -// rpc module -//------------------------------------------------------------------------- - -Ipv6Module::Ipv6Module() : DecodeModule(CD_IPV6_NAME, ipv6_params) -{ } - -const RuleMap* Ipv6Module::get_rules() const -{ return ipv6_rules; } - diff --git a/src/codecs/ip/cd_ipv6_module.h b/src/codecs/ip/cd_ipv6_module.h deleted file mode 100644 index 12f29ba91..000000000 --- a/src/codecs/ip/cd_ipv6_module.h +++ /dev/null @@ -1,39 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -// cd_ipv6_module.h author Josh Rosenbaum - -#ifndef CD_IPV6_MODULE_H -#define CD_IPV6_MODULE_H - -#include "codecs/decode_module.h" - - -#define CD_IPV6_NAME "ipv6" - -class Ipv6Module : public DecodeModule -{ -public: - Ipv6Module(); - - const RuleMap* get_rules() const; -}; - -#endif - diff --git a/src/codecs/ip/cd_pgm.cc b/src/codecs/ip/cd_pgm.cc index ea3d9d372..8ecc2905c 100644 --- a/src/codecs/ip/cd_pgm.cc +++ b/src/codecs/ip/cd_pgm.cc @@ -17,6 +17,7 @@ ** along with this program; if not, write to the Free Software ** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */ +// cd_pgm.cc author Josh Rosenbaum @@ -25,14 +26,33 @@ #endif #include "framework/codec.h" -#include "codecs/ip/cd_pgm_module.h" +#include "codecs/decode_module.h" #include "codecs/codec_events.h" #include "protocols/ipv4.h" -#include "codecs/checksum.h" +#include "codecs/ip/checksum.h" namespace { +#define CD_PGM_NAME "pgm" + +static const RuleMap pgm_rules[] = +{ + { DECODE_PGM_NAK_OVERFLOW, "(" CD_PGM_NAME ") BAD-TRAFFIC PGM nak list overflow attempt" }, + { 0, nullptr } +}; + + +class PgmModule : public DecodeModule +{ +public: + PgmModule() : DecodeModule(CD_PGM_NAME) {} + + const RuleMap* get_rules() const + { return pgm_rules; } +}; + + class PgmCodec : public Codec { public: @@ -125,7 +145,7 @@ static inline int pgm_nak_detect (uint8_t *data, uint16_t length) { /* checksum is expensive... do that only if the length is bad */ if (header->checksum != 0) { - checksum = checksum::cksum_add((unsigned short*)data, (int)length); + checksum = checksum::cksum_add((uint16_t*)data, (int)length); if (checksum != 0) return PGM_NAK_ERR; } diff --git a/src/codecs/ip/cd_pgm_module.cc b/src/codecs/ip/cd_pgm_module.cc deleted file mode 100644 index dd37c564b..000000000 --- a/src/codecs/ip/cd_pgm_module.cc +++ /dev/null @@ -1,39 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -// cd_pgm_module.cc author Josh Rosenbaum - -#include "codecs/ip/cd_pgm_module.h" - -static const RuleMap pgm_rules[] = -{ - { DECODE_PGM_NAK_OVERFLOW, "(" CD_PGM_NAME ") BAD-TRAFFIC PGM nak list overflow attempt" }, - { 0, nullptr } -}; - -//------------------------------------------------------------------------- -// rpc module -//------------------------------------------------------------------------- - -PgmModule::PgmModule() : DecodeModule(CD_PGM_NAME) -{ } - -const RuleMap* PgmModule::get_rules() const -{ return pgm_rules; } - diff --git a/src/codecs/ip/cd_pgm_module.h b/src/codecs/ip/cd_pgm_module.h deleted file mode 100644 index 2f01db66b..000000000 --- a/src/codecs/ip/cd_pgm_module.h +++ /dev/null @@ -1,38 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -// cd_pgm_module.h author Josh Rosenbaum - -#ifndef CD_PGM_MODULE_H -#define CD_PGM_MODULE_H - -#include "codecs/decode_module.h" - - -#define CD_PGM_NAME "pgm" - -class PgmModule : public DecodeModule -{ -public: - PgmModule(); - - const RuleMap* get_rules() const; -}; - -#endif diff --git a/src/codecs/ip/cd_tcp.cc b/src/codecs/ip/cd_tcp.cc index 7cc39dfb1..6c4f046a4 100644 --- a/src/codecs/ip/cd_tcp.cc +++ b/src/codecs/ip/cd_tcp.cc @@ -17,6 +17,7 @@ ** along with this program; if not, write to the Free Software ** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */ +// cd_tcp.cc author Josh Rosenbaum @@ -36,7 +37,7 @@ #include "packet_io/sfdaq.h" #include "parser/parse_ip.h" #include "codecs/codec_events.h" -#include "codecs/checksum.h" +#include "codecs/ip/checksum.h" #include "snort.h" #include "packet_io/active.h" @@ -44,12 +45,54 @@ #include "protocols/tcp.h" #include "protocols/packet.h" #include "framework/codec.h" -#include "codecs/ip/cd_tcp_module.h" +#include "codecs/decode_module.h" #include "codecs/sf_protocols.h" + namespace { + +#define CD_TCP_NAME "tcp" + +static const RuleMap tcp_rules[] = +{ + { DECODE_TCP_DGRAM_LT_TCPHDR, "(" CD_TCP_NAME ") TCP packet len is smaller than 20 bytes" }, + { DECODE_TCP_INVALID_OFFSET, "(" CD_TCP_NAME ") TCP Data Offset is less than 5" }, + { DECODE_TCP_LARGE_OFFSET, "(" CD_TCP_NAME ") TCP Header length exceeds packet length" }, + + { DECODE_TCPOPT_BADLEN, "(" CD_TCP_NAME ") Tcp Options found with bad lengths" }, + { DECODE_TCPOPT_TRUNCATED, "(" CD_TCP_NAME ") Truncated Tcp Options" }, + { DECODE_TCPOPT_TTCP, "(" CD_TCP_NAME ") T/TCP Detected" }, + { DECODE_TCPOPT_OBSOLETE, "(" CD_TCP_NAME ") Obsolete TCP Options found" }, + { DECODE_TCPOPT_EXPERIMENTAL, "(" CD_TCP_NAME ") Experimental Tcp Options found" }, + { DECODE_TCPOPT_WSCALE_INVALID, "(" CD_TCP_NAME ") Tcp Window Scale Option found with length > 14" }, + { DECODE_TCP_XMAS, "(" CD_TCP_NAME ") XMAS Attack Detected" }, + { DECODE_TCP_NMAP_XMAS, "(" CD_TCP_NAME ") Nmap XMAS Attack Detected" }, + { DECODE_TCP_BAD_URP, "(" CD_TCP_NAME ") TCP urgent pointer exceeds payload length or no payload" }, + { DECODE_TCP_SYN_FIN, "(" CD_TCP_NAME ") TCP SYN with FIN" }, + { DECODE_TCP_SYN_RST, "(" CD_TCP_NAME ") TCP SYN with RST" }, + { DECODE_TCP_MUST_ACK, "(" CD_TCP_NAME ") TCP PDU missing ack for established session" }, + { DECODE_TCP_NO_SYN_ACK_RST, "(" CD_TCP_NAME ") TCP has no SYN, ACK, or RST" }, + { DECODE_TCP_SHAFT_SYNFLOOD, "(" CD_TCP_NAME ") DDOS shaft synflood" }, + { DECODE_TCP_PORT_ZERO, "(" CD_TCP_NAME ") BAD-TRAFFIC TCP port 0 traffic" }, + { DECODE_DOS_NAPTHA, "(decode) DOS NAPTHA Vulnerability Detected" }, + { DECODE_SYN_TO_MULTICAST, "(decode) Bad Traffic SYN to multicast address" }, + { 0, nullptr } +}; + + +class TcpModule : public DecodeModule +{ +public: + TcpModule() : DecodeModule(CD_TCP_NAME) {} + + const RuleMap* get_rules() const + { return tcp_rules; } +}; + + + class TcpCodec : public Codec { public: @@ -75,7 +118,7 @@ static sfip_var_t *SynToMulticastDstIp = NULL; -int OptLenValidate(const uint8_t *option_ptr, +static int OptLenValidate(const uint8_t *option_ptr, const uint8_t *end, const uint8_t *len_ptr, int expected_len, @@ -86,11 +129,6 @@ int OptLenValidate(const uint8_t *option_ptr, static void DecodeTCPOptions(const uint8_t *, uint32_t, Packet *); static inline void TCPMiscTests(Packet *p); -#if 0 -static inline unsigned short in_chksum_tcp(pseudoheader *, unsigned short *, int); -static inline unsigned short in_chksum_tcp6(pseudoheader6 *, unsigned short *, int); -#endif - void TcpCodec::get_protocol_ids(std::vector& v) { v.push_back(IPPROTO_TCP); @@ -278,7 +316,6 @@ bool TcpCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len, DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "%lu bytes of tcp options....\n", (unsigned long)(tcp_opt_len));); - p->tcp_options_data = raw_pkt + tcp::TCP_HEADER_LEN; DecodeTCPOptions((uint8_t *) (raw_pkt + tcp::TCP_HEADER_LEN), tcp_opt_len, p); } else @@ -664,7 +701,7 @@ bool TcpCodec::encode (EncState* enc, Buffer* out, const uint8_t* raw_in) checksum::Pseudoheader ps; int len = buff_diff(out, (uint8_t*)ho); - const IPHdr* const ip4h = ip_api->get_ip4h(); + const IP4Hdr* const ip4h = ip_api->get_ip4h(); ps.sip = ip4h->get_src(); ps.dip = ip4h->get_dst(); ps.zero = 0; @@ -677,7 +714,7 @@ bool TcpCodec::encode (EncState* enc, Buffer* out, const uint8_t* raw_in) checksum::Pseudoheader6 ps6; int len = buff_diff(out, (uint8_t*) ho); - const ip::IP6RawHdr* const ip6h = ip_api->get_ip6h(); + const ip::IP6Hdr* const ip6h = ip_api->get_ip6h(); memcpy(ps6.sip, ip6h->get_src()->u6_addr8, sizeof(ps6.sip)); memcpy(ps6.dip, ip6h->get_dst()->u6_addr8, sizeof(ps6.dip)); ps6.zero = 0; @@ -702,7 +739,7 @@ bool TcpCodec::update(Packet* p, Layer* lyr, uint32_t* len) if (p->ip_api.is_ip4()) { checksum::Pseudoheader ps; - const ip::IPHdr* ip4h = p->ip_api.get_ip4h(); + const ip::IP4Hdr* ip4h = p->ip_api.get_ip4h(); ps.sip = ip4h->get_src(); ps.dip = ip4h->get_dst();; ps.zero = 0; @@ -713,7 +750,7 @@ bool TcpCodec::update(Packet* p, Layer* lyr, uint32_t* len) else { checksum::Pseudoheader6 ps6; - const ip::IP6RawHdr* ip6h = p->ip_api.get_ip6h(); + const ip::IP6Hdr* ip6h = p->ip_api.get_ip6h(); memcpy(ps6.sip, ip6h->get_src()->u6_addr32, sizeof(ps6.sip)); memcpy(ps6.dip, ip6h->get_dst()->u6_addr32, sizeof(ps6.dip)); ps6.zero = 0; @@ -744,7 +781,7 @@ void TcpCodec::format(EncodeFlags f, const Packet* p, Packet* c, Layer* lyr) } -int OptLenValidate(const uint8_t *option_ptr, +static int OptLenValidate(const uint8_t *option_ptr, const uint8_t *end, const uint8_t *len_ptr, int expected_len, @@ -1062,5 +1099,12 @@ static const CodecApi tcp_api = dtor, // dtor }; +#ifdef BUILDING_SO +SO_PUBLIC const BaseApi* snort_plugins[] = +{ + &tcp_api.base, + nullptr +}; +#else const BaseApi* cd_tcp = &tcp_api.base; - +#endif diff --git a/src/codecs/ip/cd_tcp_module.cc b/src/codecs/ip/cd_tcp_module.cc deleted file mode 100644 index a811d6308..000000000 --- a/src/codecs/ip/cd_tcp_module.cc +++ /dev/null @@ -1,62 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -// cd_tcp_module.cc author Josh Rosenbaum - -#include "codecs/ip/cd_tcp_module.h" - -// rules which will loaded into snort. -// You can now reference these rules by calling a codec_event -// in your main codec's functions -static const RuleMap tcp_rules[] = -{ - { DECODE_TCP_DGRAM_LT_TCPHDR, "(" CD_TCP_NAME ") TCP packet len is smaller than 20 bytes" }, - { DECODE_TCP_INVALID_OFFSET, "(" CD_TCP_NAME ") TCP Data Offset is less than 5" }, - { DECODE_TCP_LARGE_OFFSET, "(" CD_TCP_NAME ") TCP Header length exceeds packet length" }, - - { DECODE_TCPOPT_BADLEN, "(" CD_TCP_NAME ") Tcp Options found with bad lengths" }, - { DECODE_TCPOPT_TRUNCATED, "(" CD_TCP_NAME ") Truncated Tcp Options" }, - { DECODE_TCPOPT_TTCP, "(" CD_TCP_NAME ") T/TCP Detected" }, - { DECODE_TCPOPT_OBSOLETE, "(" CD_TCP_NAME ") Obsolete TCP Options found" }, - { DECODE_TCPOPT_EXPERIMENTAL, "(" CD_TCP_NAME ") Experimental Tcp Options found" }, - { DECODE_TCPOPT_WSCALE_INVALID, "(" CD_TCP_NAME ") Tcp Window Scale Option found with length > 14" }, - { DECODE_TCP_XMAS, "(" CD_TCP_NAME ") XMAS Attack Detected" }, - { DECODE_TCP_NMAP_XMAS, "(" CD_TCP_NAME ") Nmap XMAS Attack Detected" }, - { DECODE_TCP_BAD_URP, "(" CD_TCP_NAME ") TCP urgent pointer exceeds payload length or no payload" }, - { DECODE_TCP_SYN_FIN, "(" CD_TCP_NAME ") TCP SYN with FIN" }, - { DECODE_TCP_SYN_RST, "(" CD_TCP_NAME ") TCP SYN with RST" }, - { DECODE_TCP_MUST_ACK, "(" CD_TCP_NAME ") TCP PDU missing ack for established session" }, - { DECODE_TCP_NO_SYN_ACK_RST, "(" CD_TCP_NAME ") TCP has no SYN, ACK, or RST" }, - { DECODE_TCP_SHAFT_SYNFLOOD, "(" CD_TCP_NAME ") DDOS shaft synflood" }, - { DECODE_TCP_PORT_ZERO, "(" CD_TCP_NAME ") BAD-TRAFFIC TCP port 0 traffic" }, - { DECODE_DOS_NAPTHA, "(decode) DOS NAPTHA Vulnerability Detected" }, - { DECODE_SYN_TO_MULTICAST, "(decode) Bad Traffic SYN to multicast address" }, - { 0, nullptr } -}; - -//------------------------------------------------------------------------- -// rpc module -//------------------------------------------------------------------------- - -TcpModule::TcpModule() : DecodeModule(CD_TCP_NAME) -{ } - -const RuleMap* TcpModule::get_rules() const -{ return tcp_rules; } - diff --git a/src/codecs/ip/cd_tcp_module.h b/src/codecs/ip/cd_tcp_module.h deleted file mode 100644 index a5374a8dc..000000000 --- a/src/codecs/ip/cd_tcp_module.h +++ /dev/null @@ -1,39 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -// cd_tcp_module.h author Josh Rosenbaum - -#ifndef CD_TCP_MODULE_H -#define CD_TCP_MODULE_H - -#include "codecs/decode_module.h" - - -#define CD_TCP_NAME "tcp" - -class TcpModule : public DecodeModule -{ -public: - TcpModule(); - - const RuleMap* get_rules() const; -}; - -#endif - diff --git a/src/codecs/ip/cd_udp.cc b/src/codecs/ip/cd_udp.cc index 8fad30787..9167e3198 100644 --- a/src/codecs/ip/cd_udp.cc +++ b/src/codecs/ip/cd_udp.cc @@ -38,17 +38,82 @@ #include "protocols/icmp4.h" #include "protocols/ipv4.h" #include "protocols/protocol_ids.h" -#include "codecs/checksum.h" +#include "codecs/ip/checksum.h" #include "framework/codec.h" #include "packet_io/active.h" #include "codecs/codec_events.h" -#include "codecs/ip/cd_udp_module.h" #include "codecs/sf_protocols.h" +#include "snort_config.h" +#include "parser/config_file.h" namespace { + +#define CD_UDP_NAME "udp" +static const Parameter udp_params[] = +{ + { "deep_teredo_inspection", Parameter::PT_BOOL, nullptr, "false", + "look for Teredo on all UDP ports (default is only 3544)" }, + + { "enable_gtp", Parameter::PT_BOOL, nullptr, "false", + "decode GTP encapsulations" }, + + // FIXIT use PT_BIT_LIST + { "gtp_ports", Parameter::PT_STRING, nullptr, + "'2152 3386'", "set GTP ports" }, + + { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } +}; + + +static const RuleMap udp_rules[] = +{ + + { DECODE_UDP_DGRAM_LT_UDPHDR, "(" CD_UDP_NAME ") Truncated UDP Header" }, + { DECODE_UDP_DGRAM_INVALID_LENGTH, "(" CD_UDP_NAME ") Invalid UDP header, length field < 8" }, + { DECODE_UDP_DGRAM_SHORT_PACKET, "(" CD_UDP_NAME ") Short UDP packet, length field > payload length" }, + { DECODE_UDP_DGRAM_LONG_PACKET, "(" CD_UDP_NAME ") Long UDP packet, length field < payload length" }, + { DECODE_UDP_IPV6_ZERO_CHECKSUM, "(" CD_UDP_NAME ") Invalid IPv6 UDP packet, checksum zero" }, + { DECODE_UDP_LARGE_PACKET, "(" CD_UDP_NAME ") MISC Large UDP Packet" }, + { DECODE_UDP_PORT_ZERO, "(" CD_UDP_NAME ") BAD-TRAFFIC UDP port 0 traffic" }, + { 0, nullptr } +}; + +class UdpModule : public DecodeModule +{ +public: + UdpModule() : DecodeModule(CD_UDP_NAME) {} + + const RuleMap* get_rules() const + { return udp_rules; } + + bool set(const char*, Value& v, SnortConfig* sc) + { + if ( v.is("deep_teredo_inspection") ) + { + sc->enable_teredo = v.get_long(); // FIXIT move to existing bitfield + } + else if ( v.is("gtp_ports") ) + { + ConfigGTPDecoding(sc, v.get_string()); + } + else if ( v.is("enable_gtp") ) + { + if ( v.get_bool() ) + sc->enable_gtp = 1; // FIXIT move to existing bitfield + } + else + { + return false; + } + + return true; + } +}; + + class UdpCodec : public Codec { public: @@ -163,7 +228,7 @@ bool UdpCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len, if( !fragmented_udp_flag && udph->uh_chk ) { checksum::Pseudoheader ph; - const ip::IPHdr* ip4h = p->ip_api.get_ip4h(); + const ip::IP4Hdr* ip4h = p->ip_api.get_ip4h(); ph.sip = ip4h->get_src(); ph.dip = ip4h->get_dst(); ph.zero = 0; @@ -192,7 +257,7 @@ bool UdpCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len, else if( !fragmented_udp_flag ) { checksum::Pseudoheader6 ph6; - const ip::IP6RawHdr* ip6h = p->ip_api.get_ip6h(); + const ip::IP6Hdr* ip6h = p->ip_api.get_ip6h(); COPY4(ph6.sip, ip6h->ip6_src.u6_addr32); COPY4(ph6.dip, ip6h->ip6_dst.u6_addr32); ph6.zero = 0; @@ -334,7 +399,7 @@ bool UdpCodec::encode (EncState* enc, Buffer* out, const uint8_t* raw_in) if (ip_api->is_ip4()) { checksum::Pseudoheader ps; - const IPHdr* const ip4h = ip_api->get_ip4h(); + const IP4Hdr* const ip4h = ip_api->get_ip4h(); ps.sip = ip4h->get_src(); ps.dip = ip4h->get_dst(); ps.zero = 0; @@ -345,7 +410,7 @@ bool UdpCodec::encode (EncState* enc, Buffer* out, const uint8_t* raw_in) else { checksum::Pseudoheader6 ps6; - const ip::IP6RawHdr* const ip6h = ip_api->get_ip6h(); + const ip::IP6Hdr* const ip6h = ip_api->get_ip6h(); memcpy(ps6.sip, ip6h->get_src()->u6_addr8, sizeof(ps6.sip)); memcpy(ps6.dip, ip6h->get_dst()->u6_addr8, sizeof(ps6.dip)); ps6.zero = 0; @@ -407,7 +472,7 @@ bool UdpCodec::encode (EncState* enc, Buffer* out, const uint8_t* raw_in) return false; memcpy(out->base, ip_api->get_ip6h(), ip::IP6_HEADER_LEN); - ((ip::IP6RawHdr*)out->base)->ip6_next = IPPROTO_UDP; + ((ip::IP6Hdr*)out->base)->ip6_next = IPPROTO_UDP; if (!update_buffer(out, sizeof(*ho))) @@ -449,7 +514,7 @@ bool UdpCodec::update(Packet* p, Layer* lyr, uint32_t* len) if (p->ip_api.is_ip4()) { checksum::Pseudoheader ps; - const ip::IPHdr* ip4h = p->ip_api.get_ip4h(); + const ip::IP4Hdr* ip4h = p->ip_api.get_ip4h(); ps.sip = ip4h->get_src(); ps.dip = ip4h->get_dst(); ps.zero = 0; @@ -460,7 +525,7 @@ bool UdpCodec::update(Packet* p, Layer* lyr, uint32_t* len) else { checksum::Pseudoheader6 ps6; - const ip::IP6RawHdr* ip6h = p->ip_api.get_ip6h(); + const ip::IP6Hdr* ip6h = p->ip_api.get_ip6h(); memcpy(ps6.sip, &ip6h->ip6_src.u6_addr32, sizeof(ps6.sip)); memcpy(ps6.dip, &ip6h->ip6_dst.u6_addr32, sizeof(ps6.dip)); ps6.zero = 0; @@ -490,183 +555,6 @@ void UdpCodec::format (EncodeFlags f, const Packet* p, Packet* c, Layer* lyr) c->dp = ntohs(ch->uh_dport); } -#if 0 - -/* - * CHECKSUMS -- TODO:: delete - */ - -/* -* checksum udp -* -* h - pseudo header - 12 bytes -* d - udp hdr + payload -* dlen - length of payload in bytes -* -*/ -static inline unsigned short in_chksum_udp6(pseudoheader6 *ph, - unsigned short * d, int dlen ) -{ - uint16_t *h = (uint16_t *)ph; - unsigned int cksum; - unsigned short answer=0; - - /* PseudoHeader must have 12 bytes */ - cksum = h[0]; - cksum += h[1]; - cksum += h[2]; - cksum += h[3]; - cksum += h[4]; - cksum += h[5]; - cksum += h[6]; - cksum += h[7]; - cksum += h[8]; - cksum += h[9]; - cksum += h[10]; - cksum += h[11]; - cksum += h[12]; - cksum += h[13]; - cksum += h[14]; - cksum += h[15]; - cksum += h[16]; - cksum += h[17]; - - /* UDP must have 8 hdr bytes */ - cksum += d[0]; - cksum += d[1]; - cksum += d[2]; - cksum += d[3]; - - dlen -= 8; /* bytes */ - d += 4; /* short's */ - - while(dlen >=32) - { - cksum += d[0]; - cksum += d[1]; - cksum += d[2]; - cksum += d[3]; - cksum += d[4]; - cksum += d[5]; - cksum += d[6]; - cksum += d[7]; - cksum += d[8]; - cksum += d[9]; - cksum += d[10]; - cksum += d[11]; - cksum += d[12]; - cksum += d[13]; - cksum += d[14]; - cksum += d[15]; - d += 16; - dlen -= 32; - } - - while(dlen >=8) - { - cksum += d[0]; - cksum += d[1]; - cksum += d[2]; - cksum += d[3]; - d += 4; - dlen -= 8; - } - - while(dlen > 1) - { - cksum += *d++; - dlen -= 2; - } - - if( dlen == 1 ) - { - *(unsigned char*)(&answer) = (*(unsigned char*)d); - cksum += answer; - } - - cksum = (cksum >> 16) + (cksum & 0x0000ffff); - cksum += (cksum >> 16); - - return (unsigned short)(~cksum); -} - - - -static inline unsigned short in_chksum_udp(pseudoheader *ph, - unsigned short * d, int dlen ) -{ - uint16_t *h = (uint16_t *)ph; - unsigned int cksum; - unsigned short answer=0; - - /* PseudoHeader must have 36 bytes */ - cksum = h[0]; - cksum += h[1]; - cksum += h[2]; - cksum += h[3]; - cksum += h[4]; - cksum += h[5]; - - /* UDP must have 8 hdr bytes */ - cksum += d[0]; - cksum += d[1]; - cksum += d[2]; - cksum += d[3]; - - dlen -= 8; /* bytes */ - d += 4; /* short's */ - - while(dlen >=32) - { - cksum += d[0]; - cksum += d[1]; - cksum += d[2]; - cksum += d[3]; - cksum += d[4]; - cksum += d[5]; - cksum += d[6]; - cksum += d[7]; - cksum += d[8]; - cksum += d[9]; - cksum += d[10]; - cksum += d[11]; - cksum += d[12]; - cksum += d[13]; - cksum += d[14]; - cksum += d[15]; - d += 16; - dlen -= 32; - } - - while(dlen >=8) - { - cksum += d[0]; - cksum += d[1]; - cksum += d[2]; - cksum += d[3]; - d += 4; - dlen -= 8; - } - - while(dlen > 1) - { - cksum += *d++; - dlen -= 2; - } - - if( dlen == 1 ) - { - *(unsigned char*)(&answer) = (*(unsigned char*)d); - cksum += answer; - } - - cksum = (cksum >> 16) + (cksum & 0x0000ffff); - cksum += (cksum >> 16); - - return (unsigned short)(~cksum); -} -#endif - //------------------------------------------------------------------------- // api //------------------------------------------------------------------------- @@ -712,5 +600,12 @@ static const CodecApi udp_api = }; +#ifdef BUILDING_SO +SO_PUBLIC const BaseApi* snort_plugins[] = +{ + &udp_api.base, + nullptr +}; +#else const BaseApi* cd_udp = &udp_api.base; - +#endif diff --git a/src/codecs/ip/cd_udp_module.cc b/src/codecs/ip/cd_udp_module.cc deleted file mode 100644 index c392cd174..000000000 --- a/src/codecs/ip/cd_udp_module.cc +++ /dev/null @@ -1,84 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -// cd_udp_module.cc author Josh Rosenbaum - -#include "cd_udp_module.h" -#include "snort_config.h" -#include "parser/config_file.h" - -static const Parameter udp_params[] = -{ - { "deep_teredo_inspection", Parameter::PT_BOOL, nullptr, "false", - "look for Teredo on all UDP ports (default is only 3544)" }, - - { "enable_gtp", Parameter::PT_BOOL, nullptr, "false", - "decode GTP encapsulations" }, - - // FIXIT use PT_BIT_LIST - { "gtp_ports", Parameter::PT_STRING, nullptr, - "'2152 3386'", "set GTP ports" }, - - { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } -}; - - -static const RuleMap udp_rules[] = -{ - - { DECODE_UDP_DGRAM_LT_UDPHDR, "(" CD_UDP_NAME ") Truncated UDP Header" }, - { DECODE_UDP_DGRAM_INVALID_LENGTH, "(" CD_UDP_NAME ") Invalid UDP header, length field < 8" }, - { DECODE_UDP_DGRAM_SHORT_PACKET, "(" CD_UDP_NAME ") Short UDP packet, length field > payload length" }, - { DECODE_UDP_DGRAM_LONG_PACKET, "(" CD_UDP_NAME ") Long UDP packet, length field < payload length" }, - { DECODE_UDP_IPV6_ZERO_CHECKSUM, "(" CD_UDP_NAME ") Invalid IPv6 UDP packet, checksum zero" }, - { DECODE_UDP_LARGE_PACKET, "(" CD_UDP_NAME ") MISC Large UDP Packet" }, - { DECODE_UDP_PORT_ZERO, "(" CD_UDP_NAME ") BAD-TRAFFIC UDP port 0 traffic" }, - - - { 0, nullptr } -}; - -//------------------------------------------------------------------------- -// rpc module -//------------------------------------------------------------------------- - -UdpModule::UdpModule() : DecodeModule(CD_UDP_NAME, udp_params) -{ } - -const RuleMap* UdpModule::get_rules() const -{ return udp_rules; } - -bool UdpModule::set(const char*, Value& v, SnortConfig* sc) -{ - if ( v.is("deep_teredo_inspection") ) - sc->enable_teredo = v.get_long(); // FIXIT move to existing bitfield - - else if ( v.is("enable_gtp") ) - { - if ( v.get_bool() ) - sc->enable_gtp = 1; // FIXIT move to existing bitfield - } - else if ( v.is("gtp_ports") ) - ConfigGTPDecoding(sc, v.get_string()); - - else - return false; - - return true; -} diff --git a/src/codecs/ip/cd_udp_module.h b/src/codecs/ip/cd_udp_module.h deleted file mode 100644 index 503c67f36..000000000 --- a/src/codecs/ip/cd_udp_module.h +++ /dev/null @@ -1,39 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -// cd_udp_module.h author Josh Rosenbaum - -#ifndef CD_UDP_MODULE_H -#define CD_UDP_MODULE_H - -#include "codecs/decode_module.h" - - -#define CD_UDP_NAME "udp" - -class UdpModule : public DecodeModule -{ -public: - UdpModule(); - - const RuleMap* get_rules() const; - bool set(const char*, Value&, SnortConfig*); -}; - -#endif diff --git a/src/codecs/checksum.cc b/src/codecs/ip/checksum.h similarity index 57% rename from src/codecs/checksum.cc rename to src/codecs/ip/checksum.h index ce26385f9..c8f386436 100644 --- a/src/codecs/checksum.cc +++ b/src/codecs/ip/checksum.h @@ -19,20 +19,68 @@ */ // checksum.h author Josh Rosenbaum +#ifndef CODECS_CHECKSUM_H +#define CODECS_CHECKSUM_H +#ifdef HAVE_CONFIG_H +#include "config.h" +#endif -#include "codecs/checksum.h" +#include +#include +#include -/************************************************************ - *********** Checksum information ************************* - ************************************************************/ namespace checksum { -uint16_t cksum_add(const uint16_t *buf, std::size_t len, uint32_t cksum) +struct Pseudoheader6 { - uint16_t *sp = (uint16_t *)buf; + uint32_t sip[4], dip[4]; + uint8_t zero; + uint8_t protocol; + uint16_t len; +}; + + +struct Pseudoheader +{ + uint32_t sip, dip; + uint8_t zero; + uint8_t protocol; + uint16_t len; +}; + +// calculate the checksum for this general case. +static uint16_t cksum_add(const uint16_t *buf, std::size_t buf_len); +inline uint16_t tcp_cksum(const uint16_t *buf, std::size_t len, const Pseudoheader* const); +inline uint16_t tcp_cksum(const uint16_t *buf, std::size_t len, const Pseudoheader6* const); +inline uint16_t udp_cksum(const uint16_t *buf, std::size_t len, const Pseudoheader* const); +inline uint16_t udp_cksum(const uint16_t *buf, std::size_t len, const Pseudoheader6* const); +inline uint16_t icmp_cksum(const uint16_t *buf, std::size_t len, const Pseudoheader6* const); +inline uint16_t icmp_cksum(const uint16_t *buf, std::size_t len); +inline uint16_t ip_cksum(const uint16_t *buf, std::size_t len); + + +/* + * NOTE: Since multiple dynamic libraries use checksums, the choice + * is to either include all of the checksum details in a header, + * or ensure I include these symbols for every linker which + * can be used. Obviously, setting correct linker flags is + * signifigantly more difficult, so these functions will all + * stay in a header file + */ + +/* + * IT IS HIGHLY RECOMMENDED to use the above API. Rathern than calling + * any of of the following recomendations directly + */ +namespace detail +{ + +static inline uint16_t cksum_add(const uint16_t *buf, std::size_t len, uint32_t cksum) +{ + const uint16_t *sp = buf; std::size_t n, sn; if (len > 1 ) @@ -110,7 +158,7 @@ uint16_t cksum_add(const uint16_t *buf, std::size_t len, uint32_t cksum) } -static inline void add_ipv4_pseudoheader(const uint16_t *h, +static inline void add_ipv4_pseudoheader(const uint16_t* const h, uint32_t &cksum) { /* ipv4 pseudo header must have 12 bytes */ @@ -123,7 +171,7 @@ static inline void add_ipv4_pseudoheader(const uint16_t *h, } -static inline void add_ipv6_pseudoheader(const uint16_t *h, +static inline void add_ipv6_pseudoheader(const uint16_t* const h, uint32_t &cksum) { /* PseudoHeader must have 36 bytes */ @@ -199,81 +247,83 @@ static inline void add_ip_header(const uint16_t* &d, len -= 20; } - -uint16_t icmp_cksum(const uint16_t *buf, +} // namespace detail + + +inline uint16_t icmp_cksum(const uint16_t *buf, std::size_t len, - Pseudoheader6* ph) + const Pseudoheader6* const ph) { uint32_t cksum = 0; - add_ipv6_pseudoheader((uint16_t *)ph, cksum); - return cksum_add(buf, len, cksum); + detail::add_ipv6_pseudoheader((const uint16_t* const)ph, cksum); + return detail::cksum_add(buf, len, cksum); } -uint16_t icmp_cksum(const uint16_t *buf, size_t len) +inline uint16_t icmp_cksum(const uint16_t *buf, size_t len) { - return cksum_add(buf, len, 0); + return detail::cksum_add(buf, len, 0); } -uint16_t tcp_cksum(const uint16_t *h, +inline uint16_t tcp_cksum(const uint16_t *h, std::size_t len, - Pseudoheader *ph ) + const Pseudoheader* const ph ) { uint32_t cksum = 0; - add_ipv4_pseudoheader((uint16_t *)ph, cksum); - add_tcp_header(h, len, cksum); - return cksum_add(h, len, cksum); + detail::add_ipv4_pseudoheader((const uint16_t* const)ph, cksum); + detail::add_tcp_header(h, len, cksum); + return detail::cksum_add(h, len, cksum); } -uint16_t tcp_cksum(const uint16_t *buf, +inline uint16_t tcp_cksum(const uint16_t *buf, std::size_t len, - Pseudoheader6 *ph ) + const Pseudoheader6* const ph ) { uint32_t cksum = 0; - add_ipv6_pseudoheader((uint16_t *)ph, cksum); - add_tcp_header(buf, len, cksum); - return cksum_add(buf, len, cksum); + detail::add_ipv6_pseudoheader((const uint16_t* const)ph, cksum); + detail::add_tcp_header(buf, len, cksum); + return detail::cksum_add(buf, len, cksum); } -uint16_t udp_cksum(const uint16_t *buf, +inline uint16_t udp_cksum(const uint16_t *buf, std::size_t len, - Pseudoheader *ph ) + const Pseudoheader* const ph ) { uint32_t cksum = 0; - add_ipv4_pseudoheader((uint16_t *)ph, cksum); - add_udp_header(buf, len, cksum); - return cksum_add(buf, len, cksum); + detail::add_ipv4_pseudoheader((const uint16_t* const)ph, cksum); + detail::add_udp_header(buf, len, cksum); + return detail::cksum_add(buf, len, cksum); } -uint16_t udp_cksum(const uint16_t *buf, +inline uint16_t udp_cksum(const uint16_t *buf, std::size_t len, - Pseudoheader6 *ph ) + const Pseudoheader6* const ph ) { uint32_t cksum = 0; - add_ipv6_pseudoheader((uint16_t *)ph, cksum); - add_udp_header(buf, len, cksum); - return cksum_add(buf, len, cksum); + detail::add_ipv6_pseudoheader((const uint16_t* const)ph, cksum); + detail::add_udp_header(buf, len, cksum); + return detail::cksum_add(buf, len, cksum); } -uint16_t ip_cksum(const uint16_t *buf, std::size_t len) +inline uint16_t ip_cksum(const uint16_t *buf, std::size_t len) { uint32_t cksum = 0; - add_ip_header(buf, len, cksum); - return cksum_add(buf, len, cksum); + detail::add_ip_header(buf, len, cksum); + return detail::cksum_add(buf, len, cksum); } -uint16_t cksum_add(const uint16_t *buf, std::size_t len) -{ - return cksum_add(buf, len, 0); -} +static inline uint16_t cksum_add(const uint16_t *buf, std::size_t len) +{ return detail::cksum_add(buf, len, 0); } } // namespace checksum + +#endif /* CODECS_CHECKSUM_H */ diff --git a/src/codecs/link/CMakeLists.txt b/src/codecs/link/CMakeLists.txt index bac484f4d..38e44dcd7 100644 --- a/src/codecs/link/CMakeLists.txt +++ b/src/codecs/link/CMakeLists.txt @@ -1,63 +1,49 @@ -if( STATIC_CODECS ) +if(STATIC_CODECS) set( PLUGIN_SOURCES + cd_arp.cc + cd_eapol.cc cd_erspan2.cc - cd_erspan2_module.h - cd_erspan2_module.cc cd_erspan3.cc - cd_erspan3_module.h - cd_erspan3_module.cc - cd_eth_loopback.cc cd_mpls.cc - cd_mpls_module.h - cd_mpls_module.cc - cd_pppencap.cc + cd_ppp_encap.cc cd_pppoe.cc - cd_pppoe_module.h - cd_pppoe_module.cc - cd_transbridge.cc + cd_trans_bridge.cc cd_vlan.cc - cd_vlan_module.h - cd_vlan_module.cc ) - if(ENABLE_NON_ETHER_DECODERS) - set( PLUGIN_SOURCES - ${PLUGIN_SOURCES} - cd_eapol.cc - cd_eapol_module.h - cd_eapol_module.cc - ) - endif(ENABLE_NON_ETHER_DECODERS) else(STATIC_CODECS) - add_shared_library(cd_erspan2 codecs cd_erspan2.cc cd_erspan2_module.h cd_erspan2_module.cc) - add_shared_library(cd_erspan3 codecs cd_erspan3.cc cd_erspan3_module.h cd_erspan3_module.cc) - add_shared_library(cd_eth_loopback codecs cd_eth_loopback.cc) - add_shared_library(cd_mpls codecs cd_mpls.cc cd_mpls_module.h cd_mpls_module.cc) - add_shared_library(cd_pppencap codecs cd_pppencap.cc) - add_shared_library(cd_pppoe codecs cd_pppoe.cc cd_pppoe_module.h cd_pppoe_module.cc) - add_shared_library(cd_transbridge codecs cd_transbridge.cc) - add_shared_library(cd_vlan codecs cd_vlan.cc cd_vlan_module.h cd_vlan_module.cc) - - if(ENABLE_NON_ETHER_DECODERS) - add_shared_library(cd_eapol codecs cd_eapol.cc cd_eapol_module.h cd_eapol_module.cc) - endif(ENABLE_NON_ETHER_DECODERS) + add_shared_library(cd_arp codecs cd_arp.cc) + add_shared_library(cd_erspan2 codecs cd_erspan2.cc) + add_shared_library(cd_erspan3 codecs cd_erspan3.cc) + add_shared_library(cd_mpls codecs cd_mpls.cc) + add_shared_library(cd_ppp_encap codecs cd_ppp_encap.cc) + add_shared_library(cd_pppoe codecs cd_pppoe.cc) + add_shared_library(cd_trans_bridge codecs cd_trans_bridge.cc) + add_shared_library(cd_vlan codecs cd_vlan.cc) + add_shared_library(cd_eapol codecs cd_eapol.cc) endif(STATIC_CODECS) -add_library( link_codecs STATIC - cd_arp.cc - cd_arp_module.h - cd_arp_module.cc - ${PLUGIN_SOURCES} -) -target_link_libraries( link_codecs - events - managers -) +# NOTE: if any static libraries need to built, this extra if() +# MUST be removed. It is here because cmake sends out +# a warning if no files exist in the link codecs library + +if(STATIC_CODECS) + add_library( link_codecs STATIC + ${PLUGIN_SOURCES} + ) + + + target_link_libraries( link_codecs + events + managers + ) + +endif(STATIC_CODECS) diff --git a/src/codecs/link/Makefile.am b/src/codecs/link/Makefile.am index 72ca80ca9..f746cf83a 100644 --- a/src/codecs/link/Makefile.am +++ b/src/codecs/link/Makefile.am @@ -2,92 +2,71 @@ AUTOMAKE_OPTIONS=foreign no-dependencies noinst_LIBRARIES = liblink_codecs.a -liblink_codecs_a_SOURCES = \ -cd_arp.cc \ -cd_arp_module.h \ -cd_arp_module.cc - plugin_list = \ +cd_arp.cc \ +cd_eapol.cc \ cd_erspan2.cc \ -cd_erspan2_module.h \ -cd_erspan2_module.cc \ cd_erspan3.cc \ -cd_erspan3_module.h \ -cd_erspan3_module.cc \ -cd_eth_loopback.cc \ cd_mpls.cc \ -cd_mpls_module.h \ -cd_mpls_module.cc \ -cd_pppencap.cc \ +cd_ppp_encap.cc \ cd_pppoe.cc \ -cd_pppoe_module.h \ -cd_pppoe_module.cc \ -cd_transbridge.cc \ -cd_vlan.cc \ -cd_vlan_module.h \ -cd_vlan_module.cc +cd_trans_bridge.cc \ +cd_vlan.cc -if ENABLE_NON_ETHER_DECODER -plugin_list += cd_eapol.cc cd_eapol_module.h cd_eapol_module.cc -endif - if STATIC_CODECS -liblink_codecs_a_SOURCES += $(plugin_list) +liblink_codecs_a_SOURCES = $(plugin_list) else ehlibdir = $(pkglibdir)/codecs -ehlib_LTLIBRARIES = libcd_erspan2.la +ehlib_LTLIBRARIES = libcd_arp.la +libcd_arp_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO +libcd_arp_la_LDFLAGS = -export-dynamic -shared +libcd_arp_la_SOURCES = cd_arp.cc + +ehlib_LTLIBRARIES += libcd_erspan2.la libcd_erspan2_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO libcd_erspan2_la_LDFLAGS = -export-dynamic -shared -libcd_erspan2_la_SOURCES = cd_erspan2.cc cd_erspan2_module.h cd_erspan2_module.cc +libcd_erspan2_la_SOURCES = cd_erspan2.cc ehlib_LTLIBRARIES += libcd_erspan3.la libcd_erspan3_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO libcd_erspan3_la_LDFLAGS = -export-dynamic -shared -libcd_erspan3_la_SOURCES = cd_erspan3.cc cd_erspan3_module.h cd_erspan3_module.cc +libcd_erspan3_la_SOURCES = cd_erspan3.cc ehlib_LTLIBRARIES += libcd_mpls.la libcd_mpls_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO libcd_mpls_la_LDFLAGS = -export-dynamic -shared -libcd_mpls_la_SOURCES = cd_mpls.cc cd_mpls_module.h cd_mpls_module.cc +libcd_mpls_la_SOURCES = cd_mpls.cc ehlib_LTLIBRARIES += libcd_vlan.la libcd_vlan_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO libcd_vlan_la_LDFLAGS = -export-dynamic -shared -libcd_vlan_la_SOURCES = cd_vlan.cc cd_vlan_module.h cd_vlan_module.cc - -ehlib_LTLIBRARIES += libcd_eth_loopback.la -libcd_eth_loopback_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO -libcd_eth_loopback_la_LDFLAGS = -export-dynamic -shared -libcd_eth_loopback_la_SOURCES = cd_eth_loopback.cc +libcd_vlan_la_SOURCES = cd_vlan.cc -ehlib_LTLIBRARIES += libcd_pppencap.la -libcd_pppencap_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO -libcd_pppencap_la_LDFLAGS = -export-dynamic -shared -libcd_pppencap_la_SOURCES = cd_pppencap.cc +ehlib_LTLIBRARIES += libcd_ppp_encap.la +libcd_ppp_encap_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO +libcd_ppp_encap_la_LDFLAGS = -export-dynamic -shared +libcd_ppp_encap_la_SOURCES = cd_ppp_encap.cc -ehlib_LTLIBRARIES += libcd_transbridge.la -libcd_transbridge_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO -libcd_transbridge_la_LDFLAGS = -export-dynamic -shared -libcd_transbridge_la_SOURCES = cd_transbridge.cc +ehlib_LTLIBRARIES += libcd_trans_bridge.la +libcd_trans_bridge_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO +libcd_trans_bridge_la_LDFLAGS = -export-dynamic -shared +libcd_trans_bridge_la_SOURCES = cd_trans_bridge.cc ehlib_LTLIBRARIES += libcd_pppoe.la libcd_pppoe_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO libcd_pppoe_la_LDFLAGS = -export-dynamic -shared -libcd_pppoe_la_SOURCES = cd_pppoe.cc cd_pppoe_module.h cd_pppoe_module.cc +libcd_pppoe_la_SOURCES = cd_pppoe.cc -if ENABLE_NON_ETHER_DECODER - ehlib_LTLIBRARIES += libcd_eapol.la libcd_eapol_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO libcd_eapol_la_LDFLAGS = -export-dynamic -shared -libcd_eapol_la_SOURCES = cd_eapol.cc cd_eapol_module.h cd_eapol_module.cc -endif +libcd_eapol_la_SOURCES = cd_eapol.cc endif diff --git a/src/codecs/link/cd_arp.cc b/src/codecs/link/cd_arp.cc index a080fbed0..87e400773 100644 --- a/src/codecs/link/cd_arp.cc +++ b/src/codecs/link/cd_arp.cc @@ -25,7 +25,7 @@ #include "framework/codec.h" -#include "codecs/link/cd_arp_module.h" +#include "codecs/decode_module.h" #include "codecs/codec_events.h" #include "protocols/protocol_ids.h" #include "codecs/sf_protocols.h" @@ -34,6 +34,25 @@ namespace { +#define CD_ARP_NAME "arp" + +static const RuleMap arp_rules[] = +{ + { DECODE_ARP_TRUNCATED, "(" CD_ARP_NAME ") Truncated ARP" }, + { 0, nullptr } +}; + + +class ArpModule : public DecodeModule +{ +public: + ArpModule() : DecodeModule(CD_ARP_NAME) {} + + const RuleMap* get_rules() const + { return arp_rules; } +}; + + class ArpCodec : public Codec { public: @@ -134,4 +153,12 @@ static const CodecApi arp_api = dtor, // dtor }; +#ifdef BUILDING_SO +SO_PUBLIC const BaseApi* snort_plugins[] = +{ + &arp_api.base, + nullptr +}; +#else const BaseApi* cd_arp = &arp_api.base; +#endif diff --git a/src/codecs/link/cd_arp_module.cc b/src/codecs/link/cd_arp_module.cc deleted file mode 100644 index 2505084c1..000000000 --- a/src/codecs/link/cd_arp_module.cc +++ /dev/null @@ -1,39 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -// cd_arp_module.cc author Josh Rosenbaum - -#include "codecs/link/cd_arp_module.h" - -static const RuleMap arp_rules[] = -{ - { DECODE_ARP_TRUNCATED, "(" CD_ARP_NAME ") Truncated ARP" }, - { 0, nullptr } -}; - -//------------------------------------------------------------------------- -// rpc module -//------------------------------------------------------------------------- - -ArpModule::ArpModule() : DecodeModule(CD_ARP_NAME) -{ } - -const RuleMap* ArpModule::get_rules() const -{ return arp_rules; } - diff --git a/src/codecs/link/cd_arp_module.h b/src/codecs/link/cd_arp_module.h deleted file mode 100644 index 07f4579b9..000000000 --- a/src/codecs/link/cd_arp_module.h +++ /dev/null @@ -1,38 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -// cd_arp_module.h author Josh Rosenbaum - -#ifndef CD_ARP_MODULE_H -#define CD_ARP_MODULE_H - -#include "codecs/decode_module.h" - - -#define CD_ARP_NAME "arp" - -class ArpModule : public DecodeModule -{ -public: - ArpModule(); - - const RuleMap* get_rules() const; -}; - -#endif diff --git a/src/codecs/link/cd_eapol.cc b/src/codecs/link/cd_eapol.cc index d117ecb91..eda308871 100644 --- a/src/codecs/link/cd_eapol.cc +++ b/src/codecs/link/cd_eapol.cc @@ -17,6 +17,7 @@ ** along with this program; if not, write to the Free Software ** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */ +// cd_eapol.cc author Josh Rosenbaum @@ -25,7 +26,7 @@ #endif #include "framework/codec.h" -#include "codecs/link/cd_eapol_module.h" +#include "codecs/decode_module.h" #include "codecs/codec_events.h" #include "protocols/protocol_ids.h" #include "protocols/eapol.h" @@ -34,6 +35,24 @@ namespace { +#define CD_EAPOL_NAME "eapol" +static const RuleMap eapol_rules[] = +{ + { DECODE_EAPOL_TRUNCATED, "(" CD_EAPOL_NAME ") Truncated EAP Header" }, + { DECODE_EAPKEY_TRUNCATED, "(" CD_EAPOL_NAME ") EAP Key Truncated" }, + { DECODE_EAP_TRUNCATED, "(" CD_EAPOL_NAME ") EAP Header Truncated" }, + { 0, nullptr } +}; + +class EapolModule : public DecodeModule +{ +public: + EapolModule() : DecodeModule(CD_EAPOL_NAME) {} + + const RuleMap* get_rules() const + { return eapol_rules; } +}; + class EapolCodec : public Codec { public: diff --git a/src/codecs/link/cd_eapol_module.cc b/src/codecs/link/cd_eapol_module.cc deleted file mode 100644 index c6dbd946b..000000000 --- a/src/codecs/link/cd_eapol_module.cc +++ /dev/null @@ -1,43 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -// cd_eapol_module.cc author Josh Rosenbaum - -#include "codecs/link/cd_eapol_module.h" - -static const RuleMap eapol_rules[] = -{ - { DECODE_EAPOL_TRUNCATED, "(" CD_EAPOL_NAME ") Truncated EAP Header" }, - { DECODE_EAPKEY_TRUNCATED, "(" CD_EAPOL_NAME ") EAP Key Truncated" }, - { DECODE_EAP_TRUNCATED, "(" CD_EAPOL_NAME ") EAP Header Truncated" }, - { 0, nullptr } -}; - -//------------------------------------------------------------------------- -// rpc module -//------------------------------------------------------------------------- - -EapolModule::EapolModule() : DecodeModule(CD_EAPOL_NAME) -{ } - -const RuleMap* EapolModule::get_rules() const -{ return eapol_rules; } - -bool EapolModule::set(const char* /*fqn*/, Value& /*v*/, SnortConfig* /*sc*/) -{ return true; } diff --git a/src/codecs/link/cd_eapol_module.h b/src/codecs/link/cd_eapol_module.h deleted file mode 100644 index 2a85a89e6..000000000 --- a/src/codecs/link/cd_eapol_module.h +++ /dev/null @@ -1,39 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -// cd_eapol_module.h author Josh Rosenbaum - -#ifndef CD_EAPOL_MODULE_H -#define CD_EAPOL_MODULE_H - -#include "codecs/decode_module.h" - - -#define CD_EAPOL_NAME "eapol" - -class EapolModule : public DecodeModule -{ -public: - EapolModule(); - - const RuleMap* get_rules() const; - bool set(const char*, Value&, SnortConfig*); -}; - -#endif diff --git a/src/codecs/link/cd_erspan2.cc b/src/codecs/link/cd_erspan2.cc index cdd00e7f1..3966f4213 100644 --- a/src/codecs/link/cd_erspan2.cc +++ b/src/codecs/link/cd_erspan2.cc @@ -21,7 +21,7 @@ #include "framework/codec.h" -#include "codecs/link/cd_erspan2_module.h" +#include "codecs/decode_module.h" #include "codecs/codec_events.h" #include "protocols/protocol_ids.h" #include "codecs/sf_protocols.h" @@ -29,6 +29,25 @@ namespace { +#define CD_ERSPAN2_NAME "erspan2" + +static const RuleMap erspan2_rules[] = +{ + { DECODE_ERSPAN_HDR_VERSION_MISMATCH, "(codec_erspan) ERSpan Header version mismatch" }, + { DECODE_ERSPAN2_DGRAM_LT_HDR, "(" CD_ERSPAN2_NAME ") captured < ERSpan Type2 Header Length" }, + { 0, nullptr } +}; + +class Erspan2Module : public DecodeModule +{ +public: + Erspan2Module() : DecodeModule(CD_ERSPAN2_NAME) {} + + const RuleMap* get_rules() const + { return erspan2_rules; } +}; + + class Erspan2Codec : public Codec { public: diff --git a/src/codecs/link/cd_erspan2_module.cc b/src/codecs/link/cd_erspan2_module.cc deleted file mode 100644 index dd23c1c6d..000000000 --- a/src/codecs/link/cd_erspan2_module.cc +++ /dev/null @@ -1,40 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -// cd_erspan2_module.cc author Josh Rosenbaum - -#include "codecs/link/cd_erspan2_module.h" - -static const RuleMap erspan2_rules[] = -{ - { DECODE_ERSPAN_HDR_VERSION_MISMATCH, "(codec_erspan) ERSpan Header version mismatch" }, - { DECODE_ERSPAN2_DGRAM_LT_HDR, "(" CD_ERSPAN2_NAME ") captured < ERSpan Type2 Header Length" }, - { 0, nullptr } -}; - -//------------------------------------------------------------------------- -// rpc module -//------------------------------------------------------------------------- - -Erspan2Module::Erspan2Module() : DecodeModule(CD_ERSPAN2_NAME) -{ } - -const RuleMap* Erspan2Module::get_rules() const -{ return erspan2_rules; } - diff --git a/src/codecs/link/cd_erspan2_module.h b/src/codecs/link/cd_erspan2_module.h deleted file mode 100644 index 7dd039121..000000000 --- a/src/codecs/link/cd_erspan2_module.h +++ /dev/null @@ -1,38 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -// cd_erspan2_module.h author Josh Rosenbaum - -#ifndef CD_ERSPAN2_MODULE_H -#define CD_ERSPAN2_MODULE_H - -#include "codecs/decode_module.h" - - -#define CD_ERSPAN2_NAME "erspan2" - -class Erspan2Module : public DecodeModule -{ -public: - Erspan2Module(); - - const RuleMap* get_rules() const; -}; - -#endif diff --git a/src/codecs/link/cd_erspan3.cc b/src/codecs/link/cd_erspan3.cc index 0466d48d9..2cb4bf213 100644 --- a/src/codecs/link/cd_erspan3.cc +++ b/src/codecs/link/cd_erspan3.cc @@ -22,7 +22,7 @@ #include "framework/codec.h" -#include "codecs/link/cd_erspan3_module.h" +#include "codecs/decode_module.h" #include "codecs/codec_events.h" #include "protocols/protocol_ids.h" #include "codecs/sf_protocols.h" @@ -30,6 +30,23 @@ namespace { +#define CD_ERSPAN3_NAME "erspan3" +static const RuleMap erspan3_rules[] = +{ + { DECODE_ERSPAN3_DGRAM_LT_HDR, "(" CD_ERSPAN3_NAME ") captured < ERSpan Type3 Header Length" }, + { 0, nullptr } +}; + +class Erspan3Module : public DecodeModule +{ +public: + Erspan3Module() : DecodeModule(CD_ERSPAN3_NAME) {} + + const RuleMap* get_rules() const + { return erspan3_rules; } +}; + + class Erspan3Codec : public Codec { public: diff --git a/src/codecs/link/cd_erspan3_module.cc b/src/codecs/link/cd_erspan3_module.cc deleted file mode 100644 index bf48f22e1..000000000 --- a/src/codecs/link/cd_erspan3_module.cc +++ /dev/null @@ -1,39 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -// cd_erspan3_module.cc author Josh Rosenbaum - -#include "codecs/link/cd_erspan3_module.h" - -static const RuleMap erspan3_rules[] = -{ - { DECODE_ERSPAN3_DGRAM_LT_HDR, "(" CD_ERSPAN3_NAME ") captured < ERSpan Type3 Header Length" }, - { 0, nullptr } -}; - -//------------------------------------------------------------------------- -// rpc module -//------------------------------------------------------------------------- - -Erspan3Module::Erspan3Module() : DecodeModule(CD_ERSPAN3_NAME) -{ } - -const RuleMap* Erspan3Module::get_rules() const -{ return erspan3_rules; } - diff --git a/src/codecs/link/cd_erspan3_module.h b/src/codecs/link/cd_erspan3_module.h deleted file mode 100644 index 8d912d20a..000000000 --- a/src/codecs/link/cd_erspan3_module.h +++ /dev/null @@ -1,38 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -// cd_erspan3_module.h author Josh Rosenbaum - -#ifndef CD_ERSPAN3_MODULE_H -#define CD_ERSPAN3_MODULE_H - -#include "codecs/decode_module.h" - - -#define CD_ERSPAN3_NAME "erspan3" - -class Erspan3Module : public DecodeModule -{ -public: - Erspan3Module(); - - const RuleMap* get_rules() const; -}; - -#endif diff --git a/src/codecs/link/cd_eth_loopback.cc b/src/codecs/link/cd_eth_loopback.cc deleted file mode 100644 index f79f929ed..000000000 --- a/src/codecs/link/cd_eth_loopback.cc +++ /dev/null @@ -1,110 +0,0 @@ -/* -** Copyright (C) 2002-2013 Sourcefire, Inc. -** Copyright (C) 1998-2002 Martin Roesch -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ -// cd_ethloopback.cc author Josh Rosenbaum - - -#include "framework/codec.h" -#include "codecs/decode_module.h" -#include "codecs/codec_events.h" - -namespace -{ - -#define CD_ETHLOOPBACK_NAME "ethloopback" - - -class EthLoopbackCodec : public Codec -{ -public: - EthLoopbackCodec() : Codec(CD_ETHLOOPBACK_NAME){}; - ~EthLoopbackCodec(){}; - - - virtual void get_protocol_ids(std::vector& v); - virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len, - Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); - - -}; - -const uint16_t ETHERNET_TYPE_LOOP = 0x9000; - - -} // anonymous namespace - - -void EthLoopbackCodec::get_protocol_ids(std::vector& v) -{ - v.push_back(ETHERNET_TYPE_LOOP); -} - -bool EthLoopbackCodec::decode(const uint8_t* /*raw_pkt*/, const uint32_t& /*raw_len*/, - Packet* /*p*/, uint16_t& /*lyr_len*/, uint16_t& /*next_prot_id*/) -{ - - DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "EthLoopback is not supported.\n");); - return true; -} - - -//------------------------------------------------------------------------- -// api stuff -//------------------------------------------------------------------------- - -static Codec* ctor(Module*) -{ - return new EthLoopbackCodec(); -} - -static void dtor(Codec *cd) -{ - delete cd; -} - -static const CodecApi ethloopback_api = -{ - { - PT_CODEC, - CD_ETHLOOPBACK_NAME, - CDAPI_PLUGIN_V0, - 0, - nullptr, - nullptr, - }, - nullptr, // pinit - nullptr, // pterm - nullptr, // tinit - nullptr, // tterm - ctor, // ctor - dtor, // dtor -}; - - -#ifdef BUILDING_SO -SO_PUBLIC const BaseApi* snort_plugins[] = -{ - ðloopback_api.base, - nullptr -}; -#else -const BaseApi* cd_ethloopback = ðloopback_api.base; -#endif - - diff --git a/src/codecs/link/cd_mpls.cc b/src/codecs/link/cd_mpls.cc index c0dd872dd..51fd39393 100644 --- a/src/codecs/link/cd_mpls.cc +++ b/src/codecs/link/cd_mpls.cc @@ -30,11 +30,81 @@ #include "packet_io/active.h" #include "protocols/protocol_ids.h" #include "protocols/mpls.h" -#include "codecs/link/cd_mpls_module.h" #include "codecs/sf_protocols.h" +#include "main/snort_config.h" +#include "main/snort.h" namespace { +#define CD_MPLS_NAME "mpls" + +static const Parameter mpls_params[] = +{ + { "enable_mpls_multicast", Parameter::PT_BOOL, nullptr, "false", + "enables support for MPLS multicast" }, + + { "enable_mpls_overlapping_ip", Parameter::PT_BOOL, nullptr, "false", + "enable if private network addresses overlap and must be differentiated by MPLS label(s)" }, + + { "max_mpls_stack_depth", Parameter::PT_INT, "-1:", "-1", + "set MPLS stack depth" }, + + { "mpls_payload_type", Parameter::PT_ENUM, "eth | ip4 | ip6", "ip4", + "set encapsulated payload type" }, + + { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } +}; + + +// rules which will loaded into snort. +// You can now reference these rules by calling a codec_event +// in your main codec's functions +static const RuleMap mpls_rules[] = +{ + { DECODE_BAD_MPLS, "(" CD_MPLS_NAME ") Bad MPLS Frame" }, + { DECODE_BAD_MPLS_LABEL0, "(" CD_MPLS_NAME ") MPLS Label 0 Appears in Nonbottom Header" }, + { DECODE_BAD_MPLS_LABEL1, "(" CD_MPLS_NAME ") MPLS Label 1 Appears in Bottom Header" }, + { DECODE_BAD_MPLS_LABEL2, "(" CD_MPLS_NAME ") MPLS Label 2 Appears in Nonbottom Header" }, + { DECODE_BAD_MPLS_LABEL3, "(" CD_MPLS_NAME ") MPLS Label 3 Appears in Header" }, + { DECODE_MPLS_RESERVED_LABEL, "(" CD_MPLS_NAME ") MPLS Label 4, 5,.. or 15 Appears in Header" }, + { DECODE_MPLS_LABEL_STACK, "(" CD_MPLS_NAME ") Too Many MPLS headers" }, + { 0, nullptr } +}; + +class MplsModule : public DecodeModule +{ +public: + MplsModule() : DecodeModule(CD_MPLS_NAME) {}; + + const RuleMap* get_rules() const + { return mpls_rules; } + + bool set(const char*, Value& v, SnortConfig* sc) + { + if ( v.is("enable_mpls_multicast") ) + { + if ( v.get_bool() ) + sc->run_flags |= RUN_FLAG__MPLS_MULTICAST; // FIXIT move to existing bitfield + } + else if ( v.is("enable_mpls_overlapping_ip") ) + { + if ( v.get_bool() ) + sc->run_flags |= RUN_FLAG__MPLS_OVERLAPPING_IP; // FIXIT move to existing bitfield + } + else if ( v.is("max_mpls_stack_depth") ) + { + sc->mpls_stack_depth = v.get_long(); + } + else if ( v.is("mpls_payload_type") ) + { + sc->mpls_payload_type = v.get_long() + 1; + } + else + return false; + + return true; + } +}; class MplsCodec : public Codec { diff --git a/src/codecs/link/cd_mpls_module.cc b/src/codecs/link/cd_mpls_module.cc deleted file mode 100644 index b2e47e6d6..000000000 --- a/src/codecs/link/cd_mpls_module.cc +++ /dev/null @@ -1,92 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -// cd_mpls_module.cc author Josh Rosenbaum - -#include "codecs/link/cd_mpls_module.h" -#include "main/snort_config.h" -#include "main/snort.h" - -static const Parameter mpls_params[] = -{ - { "enable_mpls_multicast", Parameter::PT_BOOL, nullptr, "false", - "enables support for MPLS multicast" }, - - { "enable_mpls_overlapping_ip", Parameter::PT_BOOL, nullptr, "false", - "enable if private network addresses overlap and must be differentiated by MPLS label(s)" }, - - { "max_mpls_stack_depth", Parameter::PT_INT, "-1:", "-1", - "set MPLS stack depth" }, - - { "mpls_payload_type", Parameter::PT_ENUM, "eth | ip4 | ip6", "ip4", - "set encapsulated payload type" }, - - { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } -}; - - -// rules which will loaded into snort. -// You can now reference these rules by calling a codec_event -// in your main codec's functions -static const RuleMap mpls_rules[] = -{ - { DECODE_BAD_MPLS, "(" CD_MPLS_NAME ") Bad MPLS Frame" }, - { DECODE_BAD_MPLS_LABEL0, "(" CD_MPLS_NAME ") MPLS Label 0 Appears in Nonbottom Header" }, - { DECODE_BAD_MPLS_LABEL1, "(" CD_MPLS_NAME ") MPLS Label 1 Appears in Bottom Header" }, - { DECODE_BAD_MPLS_LABEL2, "(" CD_MPLS_NAME ") MPLS Label 2 Appears in Nonbottom Header" }, - { DECODE_BAD_MPLS_LABEL3, "(" CD_MPLS_NAME ") MPLS Label 3 Appears in Header" }, - { DECODE_MPLS_RESERVED_LABEL, "(" CD_MPLS_NAME ") MPLS Label 4, 5,.. or 15 Appears in Header" }, - { DECODE_MPLS_LABEL_STACK, "(" CD_MPLS_NAME ") Too Many MPLS headers" }, - { 0, nullptr } -}; - -//------------------------------------------------------------------------- -// mpls module -//------------------------------------------------------------------------- - -MplsModule::MplsModule() : DecodeModule(CD_MPLS_NAME, mpls_params) -{ } - -const RuleMap* MplsModule::get_rules() const -{ return mpls_rules; } - -bool MplsModule::set(const char*, Value& v, SnortConfig* sc) -{ - if ( v.is("enable_mpls_multicast") ) - { - if ( v.get_bool() ) - sc->run_flags |= RUN_FLAG__MPLS_MULTICAST; // FIXIT move to existing bitfield - } - else if ( v.is("enable_mpls_overlapping_ip") ) - { - if ( v.get_bool() ) - sc->run_flags |= RUN_FLAG__MPLS_OVERLAPPING_IP; // FIXIT move to existing bitfield - } - else if ( v.is("max_mpls_stack_depth") ) - sc->mpls_stack_depth = v.get_long(); - - else if ( v.is("mpls_payload_type") ) - sc->mpls_payload_type = v.get_long() + 1; - - else - return false; - - return true; -} - diff --git a/src/codecs/link/cd_mpls_module.h b/src/codecs/link/cd_mpls_module.h deleted file mode 100644 index 91ba73cf6..000000000 --- a/src/codecs/link/cd_mpls_module.h +++ /dev/null @@ -1,40 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -// cd_mpls_module.h author Josh Rosenbaum - -#ifndef CD_MPLS_MODULE_H -#define CD_MPLS_MODULE_H - -#include "codecs/decode_module.h" - - -#define CD_MPLS_NAME "mpls" - -class MplsModule : public DecodeModule -{ -public: - MplsModule(); - - const RuleMap* get_rules() const; - bool set(const char*, Value&, SnortConfig*); -}; - -#endif - diff --git a/src/codecs/link/cd_pppencap.cc b/src/codecs/link/cd_ppp_encap.cc similarity index 98% rename from src/codecs/link/cd_pppencap.cc rename to src/codecs/link/cd_ppp_encap.cc index 9870c32d2..0e9495095 100644 --- a/src/codecs/link/cd_pppencap.cc +++ b/src/codecs/link/cd_ppp_encap.cc @@ -32,7 +32,7 @@ namespace { -#define CD_PPPENCAP_NAME "pppencap" +#define CD_PPPENCAP_NAME "ppp_encap" class PppEncap : public Codec { @@ -148,7 +148,7 @@ bool PppEncap::decode(const uint8_t *raw_pkt, const uint32_t& raw_len, return false; } - ((IPHdr *)(raw_pkt + lyr_len))->ip_proto = IPPROTO_TCP; + ((IP4Hdr *)(raw_pkt + lyr_len))->ip_proto = IPPROTO_TCP; /* fall through */ case PPP_IP: diff --git a/src/codecs/link/cd_pppoe.cc b/src/codecs/link/cd_pppoe.cc index da351029a..8e59c6e24 100644 --- a/src/codecs/link/cd_pppoe.cc +++ b/src/codecs/link/cd_pppoe.cc @@ -22,7 +22,7 @@ #include "framework/codec.h" -#include "codecs/link/cd_pppoe_module.h" +#include "codecs/decode_module.h" #include "codecs/codec_events.h" #include "protocols/packet.h" #include "codecs/sf_protocols.h" @@ -47,6 +47,32 @@ struct PPPoEHdr /* payload follows */ }; + + +//------------------------------------------------------------------------- +// General PPPoEpkt module. +// +// ***** NOTE: THE CODEC HAS A DIFFERENT NAME! +// * Additionally, this module is used for generator a rule stub ONLY! +// * If you want to create a module for configuration, you must change the +// * names of the correct PPPoEpkt codec +//------------------------------------------------------------------------- +#define CD_PPPOE_NAME "pppoe" +static const RuleMap pppoe_rules[] = +{ + { DECODE_BAD_PPPOE, "(" CD_PPPOE_NAME ") Bad PPPOE frame detected" }, + { 0, nullptr } +}; + +class PPPoEModule : public DecodeModule +{ +public: + PPPoEModule() : DecodeModule(CD_PPPOE_NAME) {} + + const RuleMap* get_rules() const + { return pppoe_rules; } +}; + } // namespace diff --git a/src/codecs/link/cd_pppoe_module.cc b/src/codecs/link/cd_pppoe_module.cc deleted file mode 100644 index fbf6420b2..000000000 --- a/src/codecs/link/cd_pppoe_module.cc +++ /dev/null @@ -1,45 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -// cd_pppoe_module.cc author Josh Rosenbaum - -#include "codecs/link/cd_pppoe_module.h" - -static const RuleMap pppoe_rules[] = -{ - { DECODE_BAD_PPPOE, "(" CD_PPPOE_NAME ") Bad PPPOE frame detected" }, - { 0, nullptr } -}; - -//------------------------------------------------------------------------- -// General PPPoEpkt module. -// -// ***** NOTE: THE CODEC HAS A DIFFERENT NAME! -// * Additionally, this module is used for generator a rule stub ONLY! -// * If you want to create a module for configuration, you must change the -// * names of the correct PPPoEpkt codec -//------------------------------------------------------------------------- - -/// ^^^ READ THE COMMENT! -PPPoEModule::PPPoEModule() : DecodeModule(CD_PPPOE_NAME) -{ } - -const RuleMap* PPPoEModule::get_rules() const -{ return pppoe_rules; } - diff --git a/src/codecs/link/cd_pppoe_module.h b/src/codecs/link/cd_pppoe_module.h deleted file mode 100644 index a215543df..000000000 --- a/src/codecs/link/cd_pppoe_module.h +++ /dev/null @@ -1,47 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -// cd_pppoepkt_module.h author Josh Rosenbaum - -#ifndef CD_PPPOEPKT_MODULE_H -#define CD_PPPOEPKT_MODULE_H - -#include "codecs/decode_module.h" - - -/* - * NOTE: This name reflect the file...NOT the Codec! - * - * Additionally, this module is used for generator a rule stub ONLY! - * If you want to create a module for configuration, you must change the - * names of the correct PPPoEpkt codec - */ - - -#define CD_PPPOE_NAME "pppoe" - -class PPPoEModule : public DecodeModule -{ -public: - PPPoEModule(); - - const RuleMap* get_rules() const; -}; - -#endif diff --git a/src/codecs/link/cd_transbridge.cc b/src/codecs/link/cd_trans_bridge.cc similarity index 98% rename from src/codecs/link/cd_transbridge.cc rename to src/codecs/link/cd_trans_bridge.cc index ba00ffe37..cbdd5447d 100644 --- a/src/codecs/link/cd_transbridge.cc +++ b/src/codecs/link/cd_trans_bridge.cc @@ -36,7 +36,7 @@ namespace { -#define CD_TRANSBRIDGE_NAME "transbridge" +#define CD_TRANSBRIDGE_NAME "trans_ether_bridging" class TransbridgeCodec : public Codec { diff --git a/src/codecs/link/cd_vlan.cc b/src/codecs/link/cd_vlan.cc index ab3e5c2f1..d90ff1324 100644 --- a/src/codecs/link/cd_vlan.cc +++ b/src/codecs/link/cd_vlan.cc @@ -27,7 +27,7 @@ #include "protocols/packet.h" #include "framework/codec.h" -#include "codecs/link/cd_vlan_module.h" +#include "codecs/decode_module.h" #include "codecs/codec_events.h" #include "protocols/vlan.h" #include "protocols/protocol_ids.h" @@ -36,6 +36,25 @@ namespace { +#define CD_VLAN_NAME "vlan" +static const RuleMap vlan_rules[] = +{ + { DECODE_BAD_VLAN, "(" CD_VLAN_NAME ") Bad VLAN Frame" }, + { DECODE_BAD_VLAN_ETHLLC, "(" CD_VLAN_NAME ") Bad LLC header" }, + { DECODE_BAD_VLAN_OTHER, "(" CD_VLAN_NAME ") Bad Extra LLC Info" }, + { 0, nullptr } +}; + +class VlanModule : public DecodeModule +{ +public: + VlanModule() : DecodeModule(CD_VLAN_NAME) {} + + const RuleMap* get_rules() const + { return vlan_rules; } +}; + + class VlanCodec : public Codec { public: diff --git a/src/codecs/link/cd_vlan_module.cc b/src/codecs/link/cd_vlan_module.cc deleted file mode 100644 index 05202f47a..000000000 --- a/src/codecs/link/cd_vlan_module.cc +++ /dev/null @@ -1,41 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -// cd_vlan_module.cc author Josh Rosenbaum - -#include "codecs/link/cd_vlan_module.h" - -static const RuleMap vlan_rules[] = -{ - { DECODE_BAD_VLAN, "(" CD_VLAN_NAME ") Bad VLAN Frame" }, - { DECODE_BAD_VLAN_ETHLLC, "(" CD_VLAN_NAME ") Bad LLC header" }, - { DECODE_BAD_VLAN_OTHER, "(" CD_VLAN_NAME ") Bad Extra LLC Info" }, - { 0, nullptr } -}; - -//------------------------------------------------------------------------- -// rpc module -//------------------------------------------------------------------------- - -VlanModule::VlanModule() : DecodeModule(CD_VLAN_NAME) -{ } - -const RuleMap* VlanModule::get_rules() const -{ return vlan_rules; } - diff --git a/src/codecs/link/cd_vlan_module.h b/src/codecs/link/cd_vlan_module.h deleted file mode 100644 index 8b4c9c5a4..000000000 --- a/src/codecs/link/cd_vlan_module.h +++ /dev/null @@ -1,38 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -// cd_vlan_module.h author Josh Rosenbaum - -#ifndef CD_VLAN_MODULE_H -#define CD_VLAN_MODULE_H - -#include "codecs/decode_module.h" - - -#define CD_VLAN_NAME "vlan" - -class VlanModule : public DecodeModule -{ -public: - VlanModule(); - - const RuleMap* get_rules() const; -}; - -#endif diff --git a/src/codecs/misc/CMakeLists.txt b/src/codecs/misc/CMakeLists.txt index ac437522d..231931e39 100644 --- a/src/codecs/misc/CMakeLists.txt +++ b/src/codecs/misc/CMakeLists.txt @@ -2,24 +2,17 @@ if(STATIC_CODECS) set(PLUGIN_LIST - cd_ip4_embedded_in_icmp.cc - cd_ip6_embedded_in_icmp.cc - cd_prot_embedded_in_icmp.cc + cd_icmp4_ip.cc + cd_icmp6_ip.cc cd_gtp.cc - cd_gtp_module.h - cd_gtp_module.cc cd_teredo.cc ) else(STATIC_CODECS) - add_shared_library(cd_gtp codecs cd_gtp.cc cd_gtp_module.h cd_gtp_module.cc) + add_shared_library(cd_gtp codecs cd_gtp.cc) add_shared_library(cd_teredo codecs cd_teredo.cc) - add_shared_library(cd_ip4_embedded_in_icmp codecs cd_ip4_embedded_in_icmp.cc) - add_shared_library(cd_ip6_embedded_in_icmp codecs cd_ip6_embedded_in_icmp.cc) - add_shared_library(cd_prot_embedded_in_icmp codecs cd_prot_embedded_in_icmp.cc) - - # When static codecs NOT enabled, the icmp files will be included in the - # ICMP libraries in the other file. + add_shared_library(cd_icmp4_ip codecs cd_icmp4_ip.cc) + add_shared_library(cd_icmp6_ip codecs cd_icmp6_ip.cc) endif(STATIC_CODECS) diff --git a/src/codecs/misc/Makefile.am b/src/codecs/misc/Makefile.am index 99dd3442c..afb9cba93 100644 --- a/src/codecs/misc/Makefile.am +++ b/src/codecs/misc/Makefile.am @@ -6,12 +6,9 @@ cd_default.cc plugin_list = \ cd_gtp.cc \ -cd_gtp_module.h \ -cd_gtp_module.cc \ cd_teredo.cc \ -cd_ip4_embedded_in_icmp.cc \ -cd_ip6_embedded_in_icmp.cc \ -cd_prot_embedded_in_icmp.cc +cd_icmp4_ip.cc \ +cd_icmp6_ip.cc if STATIC_CODECS libmisc_codecs_a_SOURCES += $(plugin_list) @@ -23,27 +20,23 @@ ehlibdir = $(pkglibdir)/codecs ehlib_LTLIBRARIES = libcd_gtp.la libcd_gtp_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO libcd_gtp_la_LDFLAGS = -export-dynamic -shared -libcd_gtp_la_SOURCES = cd_gtp.cc cd_gtp_module.h cd_gtp_module.cc +libcd_gtp_la_SOURCES = cd_gtp.cc ehlib_LTLIBRARIES += libcd_teredo.la libcd_teredo_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO libcd_teredo_la_LDFLAGS = -export-dynamic -shared libcd_teredo_la_SOURCES = cd_teredo.cc -ehlib_LTLIBRARIES += libcd_ip4_embedded_in_icmp.la -libcd_ip4_embedded_in_icmp_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO -libcd_ip4_embedded_in_icmp_la_LDFLAGS = -export-dynamic -shared -libcd_ip4_embedded_in_icmp_la_SOURCES = cd_ip4_embedded_in_icmp.cc +ehlib_LTLIBRARIES += libcd_icmp4_ip.la +libcd_icmp4_ip_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO +libcd_icmp4_ip_la_LDFLAGS = -export-dynamic -shared +libcd_icmp4_ip_la_SOURCES = cd_icmp4_ip.cc -ehlib_LTLIBRARIES += libcd_ip6_embedded_in_icmp.la -libcd_ip6_embedded_in_icmp_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO -libcd_ip6_embedded_in_icmp_la_LDFLAGS = -export-dynamic -shared -libcd_ip6_embedded_in_icmp_la_SOURCES = cd_ip6_embedded_in_icmp.cc +ehlib_LTLIBRARIES += libcd_icmp6_ip.la +libcd_icmp6_ip_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO +libcd_icmp6_ip_la_LDFLAGS = -export-dynamic -shared +libcd_icmp6_ip_la_SOURCES = cd_icmp6_ip.cc -ehlib_LTLIBRARIES += libcd_prot_embedded_in_icmp.la -libcd_prot_embedded_in_icmp_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO -libcd_prot_embedded_in_icmp_la_LDFLAGS = -export-dynamic -shared -libcd_prot_embedded_in_icmp_la_SOURCES = cd_prot_embedded_in_icmp.cc endif AM_CXXFLAGS = @AM_CXXFLAGS@ diff --git a/src/codecs/misc/cd_gtp.cc b/src/codecs/misc/cd_gtp.cc index d33a8fd0e..5626ae5d8 100644 --- a/src/codecs/misc/cd_gtp.cc +++ b/src/codecs/misc/cd_gtp.cc @@ -30,14 +30,39 @@ #include "framework/codec.h" #include "protocols/packet.h" #include "codecs/codec_events.h" -#include "codecs/misc/cd_gtp_module.h" #include "packet_io/active.h" #include "codecs/sf_protocols.h" #include "protocols/protocol_ids.h" +#include "codecs/decode_module.h" namespace { +#define CD_GTP_NAME "gtp" + +static const RuleMap gtp_rules[] = +{ + { DECODE_GTP_MULTIPLE_ENCAPSULATION, "(" CD_GTP_NAME ") Two or more GTP encapsulation layers present" }, + { DECODE_GTP_BAD_LEN, "(" CD_GTP_NAME ") GTP header length is invalid" }, + { 0, nullptr } +}; + +class GtpModule : public DecodeModule +{ +public: + GtpModule() : DecodeModule(CD_GTP_NAME) {}; + + const RuleMap* get_rules() const + { return gtp_rules; } +}; + + +//------------------------------------------------------------------------- +// gtp module +//------------------------------------------------------------------------- + + + class GtpCodec : public Codec { public: diff --git a/src/codecs/misc/cd_gtp_module.cc b/src/codecs/misc/cd_gtp_module.cc deleted file mode 100644 index a4d475bf1..000000000 --- a/src/codecs/misc/cd_gtp_module.cc +++ /dev/null @@ -1,41 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -// cd_gtp_module.cc author Josh Rosenbaum - -#include "codecs/misc/cd_gtp_module.h" - -static const RuleMap gtp_rules[] = -{ - - { DECODE_GTP_MULTIPLE_ENCAPSULATION, "(" CD_GTP_NAME ") Two or more GTP encapsulation layers present" }, - { DECODE_GTP_BAD_LEN, "(" CD_GTP_NAME ") GTP header length is invalid" }, - { 0, nullptr } -}; - -//------------------------------------------------------------------------- -// rpc module -//------------------------------------------------------------------------- - -GtpModule::GtpModule() : DecodeModule(CD_GTP_NAME) -{ } - -const RuleMap* GtpModule::get_rules() const -{ return gtp_rules; } - diff --git a/src/codecs/misc/cd_gtp_module.h b/src/codecs/misc/cd_gtp_module.h deleted file mode 100644 index 131fa7722..000000000 --- a/src/codecs/misc/cd_gtp_module.h +++ /dev/null @@ -1,38 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -// cd_gtp_module.h author Josh Rosenbaum - -#ifndef CD_GTP_MODULE_H -#define CD_GTP_MODULE_H - -#include "codecs/decode_module.h" - - -#define CD_GTP_NAME "gtp" - -class GtpModule : public DecodeModule -{ -public: - GtpModule(); - - const RuleMap* get_rules() const; -}; - -#endif diff --git a/src/codecs/misc/cd_ip4_embedded_in_icmp.cc b/src/codecs/misc/cd_icmp4_ip.cc similarity index 85% rename from src/codecs/misc/cd_ip4_embedded_in_icmp.cc rename to src/codecs/misc/cd_icmp4_ip.cc index 88cb0bdfd..5565afe87 100644 --- a/src/codecs/misc/cd_ip4_embedded_in_icmp.cc +++ b/src/codecs/misc/cd_icmp4_ip.cc @@ -37,15 +37,15 @@ namespace // // this macros is defined in the module to ensure identical names. However, // if you don't want a module, define the name here. -#ifndef IP4_EMBEDDED_IN_ICMP -#define IP4_EMBEDDED_IN_ICMP "ip4_embedded_in_icmp" +#ifndef ICMP4_IP_NAME +#define ICMP4_IP_NAME "icmp4_ip" #endif -class Ip4EmbeddedInIcmpCodec : public Codec +class Icmp4IpCodec : public Codec { public: - Ip4EmbeddedInIcmpCodec() : Codec(IP4_EMBEDDED_IN_ICMP){}; - ~Ip4EmbeddedInIcmpCodec() {}; + Icmp4IpCodec() : Codec(ICMP4_IP_NAME){}; + ~Icmp4IpCodec() {}; virtual void get_protocol_ids(std::vector&); @@ -59,13 +59,13 @@ public: } // namespace -void Ip4EmbeddedInIcmpCodec::get_protocol_ids(std::vector& v) +void Icmp4IpCodec::get_protocol_ids(std::vector& v) { v.push_back(IP_EMBEDDED_IN_ICMP4); } -bool Ip4EmbeddedInIcmpCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len, - Packet* p, uint16_t& lyr_len, uint16_t& next_prot_id) +bool Icmp4IpCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len, + Packet* p, uint16_t& lyr_len, uint16_t& /*next_prot_id*/) { uint32_t ip_len; /* length from the start of the ip hdr to the * pkt end */ @@ -83,7 +83,7 @@ bool Ip4EmbeddedInIcmpCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_ } /* lay the IP struct over the raw data */ - const IPHdr *ip4h = reinterpret_cast(raw_pkt); + const IP4Hdr *ip4h = reinterpret_cast(raw_pkt); /* * with datalink DLT_RAW it's impossible to differ ARP datagrams from IP. @@ -156,17 +156,14 @@ bool Ip4EmbeddedInIcmpCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_ { case IPPROTO_TCP: /* decode the interesting part of the header */ p->proto_bits |= PROTO_BIT__TCP_EMBED_ICMP; - next_prot_id = PROT_EMBEDDED_IN_ICMP; break; case IPPROTO_UDP: p->proto_bits |= PROTO_BIT__UDP_EMBED_ICMP; - next_prot_id = PROT_EMBEDDED_IN_ICMP; break; case IPPROTO_ICMP: p->proto_bits |= PROTO_BIT__ICMP_EMBED_ICMP; - next_prot_id = PROT_EMBEDDED_IN_ICMP; break; } @@ -177,7 +174,7 @@ bool Ip4EmbeddedInIcmpCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_ } -bool Ip4EmbeddedInIcmpCodec::encode(EncState* enc, Buffer* out, const uint8_t* raw_in) +bool Icmp4IpCodec::encode(EncState* /*enc*/, Buffer* out, const uint8_t* raw_in) { // allocate space for this protocols encoded data if (!update_buffer(out, ip::IP4_HEADER_LEN)) @@ -194,7 +191,7 @@ bool Ip4EmbeddedInIcmpCodec::encode(EncState* enc, Buffer* out, const uint8_t* r static Codec* ctor(Module*) { - return new Ip4EmbeddedInIcmpCodec(); + return new Icmp4IpCodec(); } static void dtor(Codec *cd) @@ -203,11 +200,11 @@ static void dtor(Codec *cd) } -static const CodecApi ip4_embedded_in_icmp_api = +static const CodecApi icmp4_ip_api = { { PT_CODEC, - IP4_EMBEDDED_IN_ICMP, + ICMP4_IP_NAME, CDAPI_PLUGIN_V0, 0, nullptr, // module constructor @@ -225,9 +222,9 @@ static const CodecApi ip4_embedded_in_icmp_api = #ifdef BUILDING_SO SO_PUBLIC const BaseApi* snort_plugins[] = { - &ip4_embedded_in_icmp_api.base, + &icmp4_ip_api.base, nullptr }; #else -const BaseApi* cd_ip4_embedded_in_icmp = &ip4_embedded_in_icmp_api.base; +const BaseApi* cd_icmp4_ip = &icmp4_ip_api.base; #endif diff --git a/src/codecs/misc/cd_ip6_embedded_in_icmp.cc b/src/codecs/misc/cd_icmp6_ip.cc similarity index 83% rename from src/codecs/misc/cd_ip6_embedded_in_icmp.cc rename to src/codecs/misc/cd_icmp6_ip.cc index 9eb2cd68e..be7af0c8b 100644 --- a/src/codecs/misc/cd_ip6_embedded_in_icmp.cc +++ b/src/codecs/misc/cd_icmp6_ip.cc @@ -39,15 +39,15 @@ namespace // // this macros is defined in the module to ensure identical names. However, // if you don't want a module, define the name here. -#ifndef IP6_EMBEDDED_IN_ICMP -#define IP6_EMBEDDED_IN_ICMP "ip6_embedded_in_icmp" +#ifndef ICMP6_IP_NAME +#define ICMP6_IP_NAME "icmp6_ip" #endif -class Ip6EmbeddedInIcmpCodec : public Codec +class Icmp6IpCodec : public Codec { public: - Ip6EmbeddedInIcmpCodec() : Codec(IP6_EMBEDDED_IN_ICMP){}; - ~Ip6EmbeddedInIcmpCodec() {}; + Icmp6IpCodec() : Codec(ICMP6_IP_NAME){}; + ~Icmp6IpCodec() {}; virtual void get_protocol_ids(std::vector&); @@ -58,18 +58,18 @@ public: } // namespace -void Ip6EmbeddedInIcmpCodec::get_protocol_ids(std::vector& v) +void Icmp6IpCodec::get_protocol_ids(std::vector& v) { v.push_back(IP_EMBEDDED_IN_ICMP6); } -bool Ip6EmbeddedInIcmpCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len, - Packet* p, uint16_t& lyr_len, uint16_t& next_prot_id) +bool Icmp6IpCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len, + Packet* p, uint16_t& lyr_len, uint16_t& /*next_prot_id*/) { // uint16_t orig_frag_offset; /* lay the IP struct over the raw data */ - const ip::IP6RawHdr* ip6h = reinterpret_cast(raw_pkt); + const ip::IP6Hdr* ip6h = reinterpret_cast(raw_pkt); DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "DecodeICMPEmbeddedIP6: ip header" " starts at: %p, length is %lu\n", ip6h, @@ -130,17 +130,14 @@ bool Ip6EmbeddedInIcmpCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_ { case IPPROTO_TCP: /* decode the interesting part of the header */ p->proto_bits |= PROTO_BIT__TCP_EMBED_ICMP; - next_prot_id = PROT_EMBEDDED_IN_ICMP; break; case IPPROTO_UDP: p->proto_bits |= PROTO_BIT__UDP_EMBED_ICMP; - next_prot_id = PROT_EMBEDDED_IN_ICMP; break; case IPPROTO_ICMP: p->proto_bits |= PROTO_BIT__ICMP_EMBED_ICMP; - next_prot_id = PROT_EMBEDDED_IN_ICMP; break; } @@ -151,14 +148,14 @@ bool Ip6EmbeddedInIcmpCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_ } -bool Ip6EmbeddedInIcmpCodec::encode(EncState *enc, Buffer* out, const uint8_t* raw_in) +bool Icmp6IpCodec::encode(EncState* /*enc*/, Buffer* out, const uint8_t* raw_in) { if (!update_buffer(out, ip::IP6_HEADER_LEN)) return false; memcpy(out->base, raw_in, ip::IP6_HEADER_LEN); - ((ip::IP6RawHdr*)out->base)->ip6_next = IPPROTO_UDP; + ((ip::IP6Hdr*)out->base)->ip6_next = IPPROTO_UDP; return true; } @@ -169,7 +166,7 @@ bool Ip6EmbeddedInIcmpCodec::encode(EncState *enc, Buffer* out, const uint8_t* r static Codec* ctor(Module*) { - return new Ip6EmbeddedInIcmpCodec(); + return new Icmp6IpCodec(); } static void dtor(Codec *cd) @@ -178,11 +175,11 @@ static void dtor(Codec *cd) } -static const CodecApi ip6_embedded_in_icmp_api = +static const CodecApi icmp6_ip_api = { { PT_CODEC, - IP6_EMBEDDED_IN_ICMP, + ICMP6_IP_NAME, CDAPI_PLUGIN_V0, 0, nullptr, // module constructor @@ -200,9 +197,9 @@ static const CodecApi ip6_embedded_in_icmp_api = #ifdef BUILDING_SO SO_PUBLIC const BaseApi* snort_plugins[] = { - &ip6_embedded_in_icmp_api.base, + &icmp6_ip_api.base, nullptr }; #else -const BaseApi* cd_ip6_embedded_in_icmp = &ip6_embedded_in_icmp_api.base; +const BaseApi* cd_icmp6_ip = &icmp6_ip_api.base; #endif diff --git a/src/codecs/misc/cd_prot_embedded_in_icmp.cc b/src/codecs/misc/cd_prot_embedded_in_icmp.cc deleted file mode 100644 index b941a1306..000000000 --- a/src/codecs/misc/cd_prot_embedded_in_icmp.cc +++ /dev/null @@ -1,137 +0,0 @@ -/* -** Copyright (C) 2002-2013 Sourcefire, Inc. -** Copyright (C) 1998-2002 Martin Roesch -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ -// cd_prot_embedded_in_icmp.cc author Josh Rosenbaum - - - -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif - -#include "framework/codec.h" - - -namespace -{ - -// yes, macros are necessary. The API and class constructor require different strings. -// -// this macros is defined in the module to ensure identical names. However, -// if you don't want a module, define the name here. -#ifndef ProtEmbeddedInIcmp_NAME -#define ProtEmbeddedInIcmp_NAME "prot_embedded_in_icmp" -#endif - -class ProtEmbeddedInIcmp : public Codec -{ -public: - ProtEmbeddedInIcmp() : Codec(ProtEmbeddedInIcmp_NAME){}; - ~ProtEmbeddedInIcmp() {}; - - - virtual void get_protocol_ids(std::vector&); - virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in); - virtual bool decode(const uint8_t *raw_pkt, const uint32_t &raw_len, - Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); -}; - -} // namespace - - -void ProtEmbeddedInIcmp::get_protocol_ids(std::vector& v) -{ - v.push_back(PROT_EMBEDDED_IN_ICMP); -} - -bool ProtEmbeddedInIcmp::decode(const uint8_t* /*raw_pkt*/, const uint32_t& raw_len, - Packet* /*p*/, uint16_t& lyr_len, uint16_t& /*next_prot_id*/) -{ - - // Since the previous layer already set the correct p->proto_bits, - // there is really nothing to do here. This layer is actually - // a placeholder so I can easily find this layer's data at some - // other point in Snort++. - - lyr_len = raw_len; // so I can access len when encoding - return true; -} - - -bool ProtEmbeddedInIcmp::encode(EncState* enc, Buffer* out, const uint8_t* raw_in) -{ - uint16_t lyr_len = enc->p->layers[enc->layer-1].length; - - - if (icmp::ICMP_UNREACH_DATA_LEN < lyr_len) - lyr_len = icmp::ICMP_UNREACH_DATA_LEN; - - if (!update_buffer(out, lyr_len)) - return false; - - - memcpy(out->base, raw_in, lyr_len); - return true; -} - - -//------------------------------------------------------------------------- -// api -//------------------------------------------------------------------------- - - -static Codec* ctor(Module*) -{ - return new ProtEmbeddedInIcmp(); -} - -static void dtor(Codec *cd) -{ - delete cd; -} - - -static const CodecApi prot_embedded_in_icmp_api = -{ - { - PT_CODEC, - ProtEmbeddedInIcmp_NAME, - CDAPI_PLUGIN_V0, - 0, - nullptr, - nullptr - }, - nullptr, // ginit - nullptr, // gterm - nullptr, // tinit - nullptr, // tterm - ctor, - dtor, -}; - - -#ifdef BUILDING_SO -SO_PUBLIC const BaseApi* snort_plugins[] = -{ - &prot_embedded_in_icmp_api.base, - nullptr -}; -#else -const BaseApi* cd_prot_embedded_in_icmp = &prot_embedded_in_icmp_api.base; -#endif diff --git a/src/codecs/root/CMakeLists.txt b/src/codecs/root/CMakeLists.txt index 260ffe42d..546763500 100644 --- a/src/codecs/root/CMakeLists.txt +++ b/src/codecs/root/CMakeLists.txt @@ -4,44 +4,37 @@ include_directories(${PCAP_INCLUDE_DIR}) if (STATIC_CODECS) - if (ENABLE_NON_ETHER_DECODERS) - set( PLUGIN_LIST - cd_eth.cc - cd_eth_module.h - cd_eth_module.cc - cd_raw4.cc - cd_raw6.cc - cd_null.cc - cd_linux_sll.cc - cd_ppp.cc - cd_wlan.cc - cd_wlan_module.h - cd_wlan_module.cc - # root_fddi.cc - # root_slip.cc - # root_i4lrawip.cc - # root_oldpflog.cc - # root_enc.cc - # root_pflog.cc - # root_pppserial.cc - # root_chdlc.cc - # root_i4lciscoip.cc - # prot_ipx.cc - # prot_eap.cc - ) - endif (ENABLE_NON_ETHER_DECODERS) + set( PLUGIN_LIST + cd_eth.cc + cd_raw4.cc + cd_raw6.cc + cd_null.cc + cd_linux_sll.cc + cd_ppp.cc + cd_wlan.cc +# root_fddi.cc +# root_slip.cc +# root_i4lrawip.cc +# root_oldpflog.cc +# root_enc.cc +# root_pflog.cc +# root_pppserial.cc +# root_chdlc.cc +# root_i4lciscoip.cc +# prot_ipx.cc +# prot_eap.cc + ) + else(STATIC_CODECS) + add_shared_library(cd_eth codecs cd_eth.cc) + add_shared_library(cd_linux_sll codecs cd_linux_sll.cc) + add_shared_library(cd_ppp codecs cd_ppp.cc) + add_shared_library(cd_raw4 codecs cd_raw4.cc) + add_shared_library(cd_raw6 codecs cd_raw6.cc) + add_shared_library(cd_null codecs cd_null.cc) + add_shared_library(cd_wlan codecs cd_wlan.cc) - if (ENABLE_NON_ETHER_DECODERS) - add_shared_library(cd_eth codecs cd_eth.cc cd_eth_module.h cd_eth_module.cc) - add_shared_library(cd_linux_sll codecs cd_linux_sll.cc) - add_shared_library(cd_ppp codecs cd_ppp.cc) - add_shared_library(cd_raw4 codecs cd_raw4.cc) - add_shared_library(cd_raw6 codecs cd_raw6.cc) - add_shared_library(cd_null codecs cd_null.cc) - add_shared_library(cd_wlan codecs cd_wlan.cc cd_wlan_module.h cd_wlan_module.cc) - endif(ENABLE_NON_ETHER_DECODERS) endif(STATIC_CODECS) diff --git a/src/codecs/root/Makefile.am b/src/codecs/root/Makefile.am index 3b396979a..04477adfb 100644 --- a/src/codecs/root/Makefile.am +++ b/src/codecs/root/Makefile.am @@ -1,24 +1,19 @@ AUTOMAKE_OPTIONS=foreign no-dependencies noinst_LIBRARIES = libroot_codecs.a -libroot_codecs_a_SOURCES = \ -cd_eth.cc \ -cd_eth_module.h \ -cd_eth_module.cc \ -cd_raw4.cc \ -cd_raw6.cc \ -cd_null.cc -if ENABLE_NON_ETHER_DECODER if STATIC_CODECS -libroot_codecs_a_SOURCES += \ + +libroot_codecs_a_SOURCES = \ +cd_eth.cc \ cd_linux_sll.cc \ +cd_null.cc \ cd_ppp.cc \ -cd_wlan.cc \ -cd_wlan_module.h \ -cd_wlan_module.cc +cd_raw4.cc \ +cd_raw6.cc \ +cd_wlan.cc #root_fddi.cc \ #root_slip.cc \ #root_i4lrawip.cc \ @@ -35,22 +30,41 @@ cd_wlan_module.cc else ehlibdir = $(pkglibdir)/codecs -ehlib_LTLIBRARIES = libcd_linux_sll.la +ehlib_LTLIBRARIES = libcd_eth.la +libcd_eth_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO +libcd_eth_la_LDFLAGS = -export-dynamic -shared +libcd_eth_la_SOURCES = cd_eth.cc + +ehlib_LTLIBRARIES += libcd_linux_sll.la libcd_linux_sll_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO libcd_linux_sll_la_LDFLAGS = -export-dynamic -shared libcd_linux_sll_la_SOURCES = cd_linux_sll.cc +ehlib_LTLIBRARIES += libcd_null.la +libcd_null_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO +libcd_null_la_LDFLAGS = -export-dynamic -shared +libcd_null_la_SOURCES = cd_null.cc + ehlib_LTLIBRARIES += libcd_ppp.la libcd_ppp_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO libcd_ppp_la_LDFLAGS = -export-dynamic -shared -libcd_ppp_la_SOURCES = cd_ppp.cc cd_ppp.h +libcd_ppp_la_SOURCES = cd_ppp.cc + +ehlib_LTLIBRARIES += libcd_raw4.la +libcd_raw4_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO +libcd_raw4_la_LDFLAGS = -export-dynamic -shared +libcd_raw4_la_SOURCES = cd_raw4.cc + +ehlib_LTLIBRARIES += libcd_raw6.la +libcd_raw6_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO +libcd_raw6_la_LDFLAGS = -export-dynamic -shared +libcd_raw6_la_SOURCES = cd_raw6.cc ehlib_LTLIBRARIES += libcd_wlan.la libcd_wlan_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO libcd_wlan_la_LDFLAGS = -export-dynamic -shared -libcd_wlan_la_SOURCES = cd_wlan.cc cd_wlan_module.h cd_wlan_module.cc +libcd_wlan_la_SOURCES = cd_wlan.cc -endif endif AM_CXXFLAGS = @AM_CXXFLAGS@ diff --git a/src/codecs/root/cd_eth.cc b/src/codecs/root/cd_eth.cc index f42d57041..62917e1a9 100644 --- a/src/codecs/root/cd_eth.cc +++ b/src/codecs/root/cd_eth.cc @@ -24,7 +24,7 @@ #endif #include -#include "codecs/root/cd_eth_module.h" +#include "codecs/decode_module.h" #include "framework/codec.h" #include "protocols/packet.h" #include "protocols/eth.h" @@ -35,6 +35,23 @@ namespace { +#define CD_ETH_NAME "eth" +static const RuleMap eth_rules[] = +{ + { DECODE_ETH_HDR_TRUNC, "(" CD_ETH_NAME ") truncated eth header" }, + { 0, nullptr } +}; + +class EthModule : public DecodeModule +{ +public: + EthModule() : DecodeModule(CD_ETH_NAME) {} + + const RuleMap* get_rules() const + { return eth_rules; } +}; + + class EthCodec : public Codec { public: diff --git a/src/codecs/root/cd_eth_module.cc b/src/codecs/root/cd_eth_module.cc deleted file mode 100644 index 8351529c1..000000000 --- a/src/codecs/root/cd_eth_module.cc +++ /dev/null @@ -1,39 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -// cd_eth_module.cc author Josh Rosenbaum - -#include "codecs/root/cd_eth_module.h" - -static const RuleMap eth_rules[] = -{ - { DECODE_ETH_HDR_TRUNC, "(" CD_ETH_NAME ") truncated eth header" }, - { 0, nullptr } -}; - -//------------------------------------------------------------------------- -// rpc module -//------------------------------------------------------------------------- - -EthModule::EthModule() : DecodeModule(CD_ETH_NAME) -{ } - -const RuleMap* EthModule::get_rules() const -{ return eth_rules; } - diff --git a/src/codecs/root/cd_eth_module.h b/src/codecs/root/cd_eth_module.h deleted file mode 100644 index 3dea09857..000000000 --- a/src/codecs/root/cd_eth_module.h +++ /dev/null @@ -1,38 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -// cd_eth_module.h author Josh Rosenbaum - -#ifndef CD_ETH_MODULE_H -#define CD_ETH_MODULE_H - -#include "codecs/decode_module.h" - - -#define CD_ETH_NAME "eth" - -class EthModule : public DecodeModule -{ -public: - EthModule(); - - const RuleMap* get_rules() const; -}; - -#endif diff --git a/src/codecs/root/cd_ppp.cc b/src/codecs/root/cd_ppp.cc index 400a40dab..ac8f836b2 100644 --- a/src/codecs/root/cd_ppp.cc +++ b/src/codecs/root/cd_ppp.cc @@ -38,7 +38,7 @@ namespace // this macros is defined in the module to ensure identical names. However, // if you don't want a module, define the name here. #ifndef PPP_NAME -#define PPP_NAME "point_to_point" +#define PPP_NAME "ppp" #endif class PPPCodec : public Codec diff --git a/src/codecs/root/cd_wlan.cc b/src/codecs/root/cd_wlan.cc index b21138c24..3957caebb 100644 --- a/src/codecs/root/cd_wlan.cc +++ b/src/codecs/root/cd_wlan.cc @@ -25,16 +25,33 @@ #endif #include +#include "protocols/wlan.h" #include "framework/codec.h" -#include "codecs/root/cd_wlan_module.h" +#include "codecs/decode_module.h" #include "codecs/codec_events.h" -#include "protocols/wlan.h" #include "protocols/protocol_ids.h" #include "main/snort.h" namespace { +#define CD_WLAN_NAME "wlan" +static const RuleMap wlan_rules[] = +{ + { DECODE_BAD_80211_ETHLLC, "(" CD_WLAN_NAME ") Bad 802.11 LLC header" }, + { DECODE_BAD_80211_OTHER, "(" CD_WLAN_NAME ") Bad 802.11 Extra LLC Info" }, + { 0, nullptr } +}; + +class WlanCodecModule : public DecodeModule +{ +public: + WlanCodecModule() : DecodeModule(CD_WLAN_NAME) {} + + const RuleMap* get_rules() const + { return wlan_rules; } +}; + class WlanCodec : public Codec { diff --git a/src/codecs/root/cd_wlan_module.cc b/src/codecs/root/cd_wlan_module.cc deleted file mode 100644 index 2dfbeb38e..000000000 --- a/src/codecs/root/cd_wlan_module.cc +++ /dev/null @@ -1,42 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -// cd_ieee8021_module.cc author Josh Rosenbaum - -#include "codecs/root/cd_wlan_module.h" - -static const RuleMap wifi_rules[] = -{ - { DECODE_BAD_80211_ETHLLC, "(" CD_WLAN_NAME ") Bad 802.11 LLC header" }, - { DECODE_BAD_80211_OTHER, "(" CD_WLAN_NAME ") Bad 802.11 Extra LLC Info" }, - { 0, nullptr } -}; - -//------------------------------------------------------------------------- -// wifi module -//------------------------------------------------------------------------- - -WlanCodecModule::WlanCodecModule() : DecodeModule(CD_WLAN_NAME) -{ } - -const RuleMap* WlanCodecModule::get_rules() const -{ return wifi_rules; } - -bool WlanCodecModule::set(const char* /*fqn*/, Value& /*v*/, SnortConfig* /*sc*/) -{ return true; } diff --git a/src/codecs/root/cd_wlan_module.h b/src/codecs/root/cd_wlan_module.h deleted file mode 100644 index 19af07599..000000000 --- a/src/codecs/root/cd_wlan_module.h +++ /dev/null @@ -1,39 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -// cd_wlan_module.h author Josh Rosenbaum - -#ifndef CD_WLAN_MODULE_H -#define CD_WLAN_MODULE_H - -#include "codecs/decode_module.h" - - -#define CD_WLAN_NAME "wlan" - -class WlanCodecModule : public DecodeModule -{ -public: - WlanCodecModule(); - - const RuleMap* get_rules() const; - bool set(const char*, Value&, SnortConfig*); -}; - -#endif diff --git a/src/codecs/root/prot_ipx.cc b/src/codecs/root/prot_ipx.cc deleted file mode 100644 index fd2a040f3..000000000 --- a/src/codecs/root/prot_ipx.cc +++ /dev/null @@ -1,74 +0,0 @@ -/* -** Copyright (C) 2002-2013 Sourcefire, Inc. -** Copyright (C) 1998-2002 Martin Roesch -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - - - -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif - -#include "generators.h" -#include "protocols/packet.h" -#include "static_include.h" -#include "decoder_includes.h" - - - -static const uint16_t ETHERNET_TYPE_IPX = 0x8137; - -/* - * Function: DecodeIPX(uint8_t *, uint32_t) - * - * Purpose: Well, it doesn't do much of anything right now... - * - * Arguments: pkt => ptr to the packet data - * len => length from here to the end of the packet - * - * Returns: void function - * - */ -void DecodeIPX(const uint8_t*, uint32_t, Packet *p) -{ - DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "IPX is not supported.\n");); - dc.ipx++; -} - -static const char* name = "ipx_decode"; - -static const CodecApi ipx_api = -{ - { - PT_CODEC, - name, - CDAPI_PLUGIN_V0, - 0, - nullptr, - nullptr, - }, - {ETHERNET_TYPE_IPX}, - nullptr, // pinit - nullptr, // pterm - nullptr, // tinit - nullptr, // tterm - ctor, // ctor - dtor, // dtor -}; - - diff --git a/src/codecs/sf_protocols.h b/src/codecs/sf_protocols.h index ad5b6c8cc..12ed527aa 100644 --- a/src/codecs/sf_protocols.h +++ b/src/codecs/sf_protocols.h @@ -53,7 +53,6 @@ typedef enum { PROTO_GTP, // DecodeGTP PROTO_AH, // DecodeAH - Authentication Header (IPSec stuff) -#ifndef NO_NON_ETHER_DECODER PROTO_TR, // DecodeTRPkt PROTO_FDDI, // DecodeFDDIPkt PROTO_LSLL, // DecodeLinuxSLLPkt sockaddr_ll for "any" device and @@ -84,7 +83,6 @@ typedef enum { PROTO_EAP, // DecodeEAP PROTO_EAPOL, // DecodeEapol - leaf decoder PROTO_EAPOL_KEY, // DecodeEapolKey - leaf decoder -#endif // NO_NON_ETHER_DECODER PROTO_MAX } PROTO_ID; diff --git a/src/ips_options/ips_replace.cc b/src/ips_options/ips_replace.cc index de4a57ad1..dbc4c8103 100644 --- a/src/ips_options/ips_replace.cc +++ b/src/ips_options/ips_replace.cc @@ -34,7 +34,7 @@ using namespace std; #include "snort_debug.h" #include "protocols/packet.h" #include "parser.h" -#include "parse_byte_code.h" +#include "parser/parse_byte_code.h" #include "ips_content.h" #include "snort.h" #include "packet_io/sfdaq.h" diff --git a/src/log/log.cc b/src/log/log.cc index 5024d985b..969cb4011 100644 --- a/src/log/log.cc +++ b/src/log/log.cc @@ -160,7 +160,6 @@ void snort_print(Packet* p) { LogIPPkt(text_log, p->ip_api.proto(), p); } -#ifndef NO_NON_ETHER_DECODER else if (p->proto_bits & PROTO_BIT__ARP) { log_mutex.lock(); @@ -178,7 +177,6 @@ void snort_print(Packet* p) LogWifiPkt(text_log, p); } #endif -#endif } void LogNetData(const uint8_t* data, const int len, Packet* p) diff --git a/src/log/log_text.cc b/src/log/log_text.cc index e53a73db0..f213a036e 100644 --- a/src/log/log_text.cc +++ b/src/log/log_text.cc @@ -116,7 +116,6 @@ void LogPriorityData(TextLog* log, const Event* e, bool doNewLine) * Layer 2 header stuff cloned from log.c *-------------------------------------------------------------------- */ -#ifndef NO_NON_ETHER_DECODER /*-------------------------------------------------------------------- * Function: LogTrHeader(TextLog*, Packet*) * @@ -167,7 +166,6 @@ void LogTrHeader(TextLog* log, Packet* p) trhmr->rseg[6], trhmr->rseg[7]); } } -#endif // NO_NON_ETHER_DECODER /*-------------------------------------------------------------------- * Function: LogEthHeader() @@ -216,7 +214,6 @@ static void LogGREHeader(TextLog *log, Packet *p) greh->get_version(), greh->flags, greh->get_proto()); } -#ifndef NO_NON_ETHER_DECODER /*-------------------------------------------------------------------- * Function: LogSLLHeader(TextLog* ) * @@ -393,7 +390,6 @@ static void LogWifiHeader(TextLog* log, Packet * p) if (wifih->frame_control & WLAN_FLAG_ORDER) TextLog_Puts(log," Ord"); TextLog_NewLine(log); } -#endif // NO_NON_ETHER_DECODER /*-------------------------------------------------------------------- * Function: Log2ndHeader(TextLog* , Packet p) @@ -414,7 +410,6 @@ void Log2ndHeader(TextLog* log, Packet* p) if(p && (p->num_layers > 0)) LogEthHeader(log, p); break; -#ifndef NO_NON_ETHER_DECODER #ifdef DLT_IEEE802_11 case DLT_IEEE802_11: if(p && (p->num_layers > 0)) @@ -431,7 +426,6 @@ void Log2ndHeader(TextLog* log, Packet* p) LogSLLHeader(log, p); /* Linux cooked sockets */ break; #endif -#endif // NO_NON_ETHER_DECODER default: if (ScLogVerbose()) { @@ -1001,7 +995,7 @@ static void LogICMPEmbeddedIP(TextLog* log, Packet *p) { case IPPROTO_TCP: { - const tcp::TCPHdr* tcph = layer::get_tcp_embed_icmp(p); + const tcp::TCPHdr* tcph = layer::get_tcp_embed_icmp(op.ip_api); if (tcph) { orig_p->sp = ntohs(tcph->th_sport); @@ -1022,7 +1016,7 @@ static void LogICMPEmbeddedIP(TextLog* log, Packet *p) case IPPROTO_UDP: { - const udp::UDPHdr* udph = layer::get_udp_embed_icmp(p); + const udp::UDPHdr* udph = layer::get_udp_embed_icmp(op.ip_api); if (udph) { orig_p->sp = ntohs(p->udph->uh_sport); @@ -1045,7 +1039,7 @@ static void LogICMPEmbeddedIP(TextLog* log, Packet *p) TextLog_Print(log, "\n** ORIGINAL DATAGRAM DUMP:\n"); LogIPHeader(log, orig_p); - const icmp::ICMPHdr* icmph = layer::get_icmp_embed_icmp(p); + const icmp::ICMPHdr* icmph = layer::get_icmp_embed_icmp(op.ip_api); if(icmph != NULL) LogEmbeddedICMPHeader(log, icmph); break; @@ -1808,7 +1802,6 @@ void LogIPPkt(TextLog* log, int type, Packet * p) } } -#ifndef NO_NON_ETHER_DECODER /*-------------------------------------------------------------------- * ARP stuff cloned from log.c *-------------------------------------------------------------------- @@ -1817,13 +1810,11 @@ void LogArpHeader(TextLog*, Packet*) { // XXX-IPv6 "NOT YET IMPLEMENTED - printing ARP header" } -#endif #if 0 // these must be converted to use TextLog // (or just deleted) -#ifndef NO_NON_ETHER_DECODER /**************************************************************************** * * Function: PrintEapolKey(FILE *) @@ -2066,5 +2057,4 @@ void PrintWifiPkt(FILE * fp, Packet * p) "=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+\n\n"); } #endif -#endif diff --git a/src/log/log_text.h b/src/log/log_text.h index 39ea96e07..8d7af0903 100644 --- a/src/log/log_text.h +++ b/src/log/log_text.h @@ -56,10 +56,7 @@ void LogIPHeader(TextLog*, Packet*); void LogTCPHeader(TextLog*, Packet*); void LogUDPHeader(TextLog*, Packet*); void LogICMPHeader(TextLog*, Packet*); - -#ifndef NO_NON_ETHER_DECODER void LogArpHeader(TextLog*, Packet*); -#endif #endif diff --git a/src/loggers/alert_fast.cc b/src/loggers/alert_fast.cc index 7e3166945..6da897147 100644 --- a/src/loggers/alert_fast.cc +++ b/src/loggers/alert_fast.cc @@ -244,10 +244,10 @@ void FastLogger::alert(Packet *p, const char *msg, Event *event) { if(p->ip_api.is_valid()) LogIPPkt(fast_log, p->ip_api.proto(), p); -#ifndef NO_NON_ETHER_DECODER + else if(p->proto_bits & PROTO_BIT__ARP) LogArpHeader(fast_log, p); -#endif + } TextLog_NewLine(fast_log); TextLog_Flush(fast_log); diff --git a/src/loggers/unified2.cc b/src/loggers/unified2.cc index af80ed5bf..a8107f895 100644 --- a/src/loggers/unified2.cc +++ b/src/loggers/unified2.cc @@ -259,7 +259,7 @@ static void _AlertIP4_v2(Packet *p, const char*, Unified2Config *config, Event * if(p->ip_api.is_valid()) { - const ip::IPHdr* const iph = p->ip_api.get_ip4h(); + const ip::IP4Hdr* const iph = p->ip_api.get_ip4h(); alertdata.ip_source = iph->get_src(); alertdata.ip_destination = iph->get_dst(); alertdata.protocol = GetEventProto(p); diff --git a/src/main/snort.h b/src/main/snort.h index f49650edb..25f4825ff 100644 --- a/src/main/snort.h +++ b/src/main/snort.h @@ -133,9 +133,7 @@ typedef enum _OutputFlag OUTPUT_FLAG__APP_DATA = 0x00000008, /* -d */ OUTPUT_FLAG__SHOW_DATA_LINK = 0x00000010, /* -e */ -#ifndef NO_NON_ETHER_DECODER OUTPUT_FLAG__SHOW_WIFI_MGMT = 0x00000020, /* -w */ -#endif OUTPUT_FLAG__USE_UTC = 0x00000040, /* -U */ OUTPUT_FLAG__INCLUDE_YEAR = 0x00000080, /* -y */ @@ -431,12 +429,10 @@ static inline int ScPcapReset(void) return snort_conf->run_flags & RUN_FLAG__PCAP_RESET; } -#ifndef NO_NON_ETHER_DECODER static inline int ScOutputWifiMgmt(void) { return snort_conf->output_flags & OUTPUT_FLAG__SHOW_WIFI_MGMT; } -#endif static inline uint32_t ScMaxAttrHosts(void) { diff --git a/src/network_inspectors/normalize/norm.cc b/src/network_inspectors/normalize/norm.cc index 70a79800c..cf68e3e26 100644 --- a/src/network_inspectors/normalize/norm.cc +++ b/src/network_inspectors/normalize/norm.cc @@ -152,7 +152,7 @@ static int Norm_Eth (Packet * p, uint8_t layer, int changes) static int Norm_IP4 ( NormalizerConfig* c, Packet * p, uint8_t layer, int changes) { - IPHdr* h = (IPHdr*)(p->layers[layer].start); + IP4Hdr* h = (IP4Hdr*)(p->layers[layer].start); uint16_t fragbits = ntohs(h->ip_off); uint16_t origbits = fragbits; @@ -256,7 +256,7 @@ static int Norm_ICMP4 ( static int Norm_IP6 ( NormalizerConfig* c, Packet * p, uint8_t layer, int changes) { - ip::IP6RawHdr* h = (ip::IP6RawHdr*)(p->layers[layer].start); + ip::IP6Hdr* h = (ip::IP6Hdr*)(p->layers[layer].start); if ( Norm_IsEnabled(c, NORM_IP6_TTL) ) { diff --git a/src/network_inspectors/port_scan/port_scan.cc b/src/network_inspectors/port_scan/port_scan.cc index 3c4f7cf44..6971dda6f 100644 --- a/src/network_inspectors/port_scan/port_scan.cc +++ b/src/network_inspectors/port_scan/port_scan.cc @@ -384,12 +384,12 @@ static int MakePortscanPkt(PS_PKT *ps_pkt, PS_PROTO *proto, int proto_type, if(p->ip_api.is_ip4()) { - ((IPHdr*)g_tmp_pkt->ip_api.get_ip4h())->set_proto(IPPROTO_PS); + ((IP4Hdr*)g_tmp_pkt->ip_api.get_ip4h())->set_proto(IPPROTO_PS); } else { // since ip_api.is_valid() && !ip4h, this is automatically ip6h - ((ip::IP6RawHdr*)g_tmp_pkt->ip_api.get_ip6h())->set_proto(IPPROTO_PS); + ((ip::IP6Hdr*)g_tmp_pkt->ip_api.get_ip6h())->set_proto(IPPROTO_PS); } switch(proto_type) @@ -421,7 +421,7 @@ static int MakePortscanPkt(PS_PKT *ps_pkt, PS_PROTO *proto, int proto_type, // FIXIT: IP4 is gauranteed to have been set in update(). Is IP6() // also gauranteed? if(g_tmp_pkt->ip_api.is_ip6()) - ((ip::IP6RawHdr*)g_tmp_pkt->ip_api.get_ip6h())->set_len(htons((uint16_t)ip_size)); + ((ip::IP6Hdr*)g_tmp_pkt->ip_api.get_ip6h())->set_len(htons((uint16_t)ip_size)); return 0; } diff --git a/src/parser/cmd_line.cc b/src/parser/cmd_line.cc index 88925cdc4..e3445d40c 100644 --- a/src/parser/cmd_line.cc +++ b/src/parser/cmd_line.cc @@ -558,7 +558,7 @@ static void config_test_mode(SnortConfig* sc, const char*) sc->run_flags |= RUN_FLAG__TEST; } -#if !defined(NO_NON_ETHER_DECODER) && defined(DLT_IEEE802_11) +#if defined(DLT_IEEE802_11) static void config_show_wifi_mgt(SnortConfig* sc, const char*) { sc->output_flags |= OUTPUT_FLAG__SHOW_WIFI_MGMT; @@ -792,7 +792,7 @@ static ConfigFunc basic_opts[] = { "W", config_ignore, // spec opt "lists available interfaces" }, -#if !defined(NO_NON_ETHER_DECODER) && defined(DLT_IEEE802_11) +#if defined(DLT_IEEE802_11) { "w", config_show_wifi_mgt, "dump 802.11 management and control frames" }, #endif diff --git a/src/protocols/eapol.h b/src/protocols/eapol.h index 62eb710c7..2bccde0b0 100644 --- a/src/protocols/eapol.h +++ b/src/protocols/eapol.h @@ -22,8 +22,6 @@ #ifndef PROTOCOLS_EAPOL_H #define PROTOCOLS_EAPOL_H -#ifndef NO_NON_ETHER_DECODER - namespace eapol { @@ -93,5 +91,4 @@ struct EapolKey } -#endif /* NO_NON_ETHER_DECODER */ #endif /* EAPOL_H */ diff --git a/src/protocols/icmp4.h b/src/protocols/icmp4.h index 62d033761..71216889c 100644 --- a/src/protocols/icmp4.h +++ b/src/protocols/icmp4.h @@ -172,7 +172,7 @@ struct ICMPHdr /* IP header for unreach */ struct ih_ip { - ip::IPHdr *ip; + ip::IP4Hdr *ip; /* options and then 64 bits of data */ } ip; diff --git a/src/protocols/ip.cc b/src/protocols/ip.cc index 8006787c2..3b15745d3 100644 --- a/src/protocols/ip.cc +++ b/src/protocols/ip.cc @@ -34,7 +34,7 @@ void IpApi::reset() dst_p = nullptr; } -void IpApi::set(const IPHdr* h4) +void IpApi::set(const IP4Hdr* h4) { ip4h = h4; ip6h = nullptr; @@ -42,7 +42,7 @@ void IpApi::set(const IPHdr* h4) dst_p = nullptr; } -void IpApi::set(const ip::IP6RawHdr* h6) +void IpApi::set(const ip::IP6Hdr* h6) { ip6h = h6; ip4h = nullptr; @@ -52,15 +52,15 @@ void IpApi::set(const ip::IP6RawHdr* h6) bool IpApi::set(const uint8_t* raw_ip_data) { - const IPHdr* h4 = reinterpret_cast(raw_ip_data); + const IP4Hdr* h4 = reinterpret_cast(raw_ip_data); if (h4->get_ver() == 4) { set(h4); return true; } - const ip::IP6RawHdr* h6 = - reinterpret_cast(raw_ip_data); + const ip::IP6Hdr* h6 = + reinterpret_cast(raw_ip_data); if (h6->get_ver() != 6) return false; @@ -169,7 +169,7 @@ const uint8_t* IpApi::ip_data() const return reinterpret_cast(ip4h) + (ip4h->get_hlen() << 2); if (ip6h) - return reinterpret_cast(ip6h) + (ip6h->get_hlen() << 2); + return reinterpret_cast(ip6h) + IP6_HEADER_LEN; return nullptr; } diff --git a/src/protocols/ip.h b/src/protocols/ip.h index ddf8bb753..d72f838ee 100644 --- a/src/protocols/ip.h +++ b/src/protocols/ip.h @@ -55,8 +55,8 @@ public: // IpApi(); constructor and destructor MUST remain a trivial. Adding // ~IpApi(); any non-trivial code will cause a compilation failure. - void set(const IPHdr* h4); - void set(const IP6RawHdr* h6); + void set(const IP4Hdr* h4); + void set(const IP6Hdr* h6); bool set(const uint8_t* raw_ip_data); void reset(); const sfip_t *get_src(); @@ -86,10 +86,10 @@ public: inline bool is_ip4() const { return ip4h; } - inline const IPHdr* get_ip4h() const + inline const IP4Hdr* get_ip4h() const { return ip4h; } - inline const IP6RawHdr* get_ip6h() const + inline const IP6Hdr* get_ip6h() const { return ip6h; } inline uint16_t tos() const @@ -135,8 +135,8 @@ private: sfip_t dst; const sfip_t *src_p; const sfip_t *dst_p; - const IPHdr* ip4h; - const IP6RawHdr* ip6h; + const IP4Hdr* ip4h; + const IP6Hdr* ip6h; }; diff --git a/src/protocols/ipv4.h b/src/protocols/ipv4.h index 0265cd543..f58bc1e33 100644 --- a/src/protocols/ipv4.h +++ b/src/protocols/ipv4.h @@ -92,7 +92,7 @@ struct IpOptions // This must be a standard layour struct! -struct IPHdr +struct IP4Hdr { uint8_t ip_verhl; /* version & header length */ uint8_t ip_tos; /* type of service */ @@ -188,7 +188,7 @@ static inline bool isPrivateIP(uint32_t addr) /* we need to change them as well as get them */ // TYPEDEF WHICH NEED TO BE DELETED -typedef ip::IPHdr IPHdr; +typedef ip::IP4Hdr IP4Hdr; constexpr uint8_t IPOPT_EOL = 0x00; diff --git a/src/protocols/ipv6.h b/src/protocols/ipv6.h index 793873768..97d30d78d 100644 --- a/src/protocols/ipv6.h +++ b/src/protocols/ipv6.h @@ -118,7 +118,7 @@ struct snort_in6_addr }; }; -struct IP6RawHdr +struct IP6Hdr { uint32_t ip6_vtf; /* 4 bits version, 8 bits TC,len 20 bits flow-ID */ diff --git a/src/protocols/layer.cc b/src/protocols/layer.cc index 120e37487..fa1f0bde0 100644 --- a/src/protocols/layer.cc +++ b/src/protocols/layer.cc @@ -170,10 +170,10 @@ uint8_t get_outer_ip_next_pro(const Packet* const p) { case ETHERTYPE_IPV4: case IPPROTO_ID_IPIP: - return reinterpret_cast(layers[i].start)->get_proto(); + return reinterpret_cast(layers[i].start)->get_proto(); case ETHERTYPE_IPV6: case IPPROTO_ID_IPV6: - return reinterpret_cast(layers[i].start)->get_next(); + return reinterpret_cast(layers[i].start)->get_next(); default: break; } @@ -217,8 +217,8 @@ bool set_inner_ip_api(const Packet* const p, case ETHERTYPE_IPV4: case IPPROTO_ID_IPIP: { - const ip::IPHdr* ip4h = - reinterpret_cast(lyr->start); + const ip::IP4Hdr* ip4h = + reinterpret_cast(lyr->start); api.set(ip4h); curr_layer--; return true; @@ -226,8 +226,8 @@ bool set_inner_ip_api(const Packet* const p, case ETHERTYPE_IPV6: case IPPROTO_ID_IPV6: { - const ip::IP6RawHdr* ip6h = - reinterpret_cast(lyr->start); + const ip::IP6Hdr* ip6h = + reinterpret_cast(lyr->start); api.set(ip6h); curr_layer--; return true; @@ -258,8 +258,8 @@ bool set_outer_ip_api(const Packet* const p, case ETHERTYPE_IPV4: case IPPROTO_ID_IPIP: { - const ip::IPHdr* ip4h = - reinterpret_cast(lyr->start); + const ip::IP4Hdr* ip4h = + reinterpret_cast(lyr->start); api.set(ip4h); curr_layer++; return true; @@ -267,8 +267,8 @@ bool set_outer_ip_api(const Packet* const p, case ETHERTYPE_IPV6: case IPPROTO_ID_IPV6: { - const ip::IP6RawHdr* ip6h = - reinterpret_cast(lyr->start); + const ip::IP6Hdr* ip6h = + reinterpret_cast(lyr->start); api.set(ip6h); curr_layer++; return true; @@ -297,15 +297,15 @@ bool set_api_ip_embed_icmp(const Packet* p, ip::IpApi& api) { if (lyr->prot_id == IP_EMBEDDED_IN_ICMP4) { - const ip::IPHdr* ip4h = - reinterpret_cast(lyr->start); + const ip::IP4Hdr* ip4h = + reinterpret_cast(lyr->start); api.set(ip4h); return true; } else if (lyr->prot_id == IP_EMBEDDED_IN_ICMP6) { - const ip::IP6RawHdr* ip6h = - reinterpret_cast(lyr->start); + const ip::IP6Hdr* ip6h = + reinterpret_cast(lyr->start); api.set(ip6h); return true; } @@ -317,30 +317,15 @@ bool set_api_ip_embed_icmp(const Packet* p, ip::IpApi& api) return false; } -const uint8_t* get_prot_embed_icmp(const Packet* const p) -{ - return find_inner_layer(p->layers, - p->num_layers, - PROT_EMBEDDED_IN_ICMP); -} -const tcp::TCPHdr* get_tcp_embed_icmp(const Packet* const p) -{ - return reinterpret_cast( - get_prot_embed_icmp(p)); -} +const tcp::TCPHdr* get_tcp_embed_icmp(const ip::IpApi& api) +{ return reinterpret_cast(api.ip_data()); } -const udp::UDPHdr* get_udp_embed_icmp(const Packet* const p) -{ - return reinterpret_cast( - get_prot_embed_icmp(p)); -} +const udp::UDPHdr* get_udp_embed_icmp(const ip::IpApi& api) +{ return reinterpret_cast(api.ip_data()); } -const icmp::ICMPHdr* get_icmp_embed_icmp(const Packet* const p) -{ - return reinterpret_cast( - get_prot_embed_icmp(p)); -} +const icmp::ICMPHdr* get_icmp_embed_icmp(const ip::IpApi& api) +{ return reinterpret_cast(api.ip_data()); } } // namespace layer diff --git a/src/protocols/layer.h b/src/protocols/layer.h index 65e12310e..8c0c854e1 100644 --- a/src/protocols/layer.h +++ b/src/protocols/layer.h @@ -109,16 +109,21 @@ const udp::UDPHdr* get_outer_udp_lyr(const Packet* const); // RETURN: // true - ip layer found and api set // false - ip layer NOT found, api reset -bool set_api_ip_embed_icmp(const Packet*); bool set_api_ip_embed_icmp(const Packet*, ip::IpApi& api); -// When a protocol is embedded in ICMP, this function -// will return a pointer to the layer. Use the -// proto_bits to determine what this layer is! -const uint8_t* get_prot_embed_icmp(const Packet* const); -const tcp::TCPHdr* get_tcp_embed_icmp(const Packet* const); -const udp::UDPHdr* get_udp_embed_icmp(const Packet* const); -const icmp::ICMPHdr* get_icmp_embed_icmp(const Packet* const); +// a helper function when the api to be set is inside the packet +bool set_api_ip_embed_icmp(const Packet* p); + +/* + *When a protocol is embedded in ICMP, these functions + * will return a pointer to the layer. Use the + * proto_bits before calling these function to determine + * what this layer is! + */ +const tcp::TCPHdr* get_tcp_embed_icmp(const ip::IpApi&); +const udp::UDPHdr* get_udp_embed_icmp(const ip::IpApi&); +const icmp::ICMPHdr* get_icmp_embed_icmp(const ip::IpApi&); + int get_inner_ip_lyr(const Packet* const p); diff --git a/src/protocols/linux_sll.h b/src/protocols/linux_sll.h index 844b4527d..b1692bce0 100644 --- a/src/protocols/linux_sll.h +++ b/src/protocols/linux_sll.h @@ -22,8 +22,6 @@ #ifndef PROTOCOLS_LINUX_SLL_H #define PROTOCOLS_LINUX_SLL_H -#ifndef NO_NON_ETHER_DECODER - namespace linux_sll { @@ -61,5 +59,4 @@ typedef struct _SLLHdr { } // namespace ssl -#endif /* NO_NON_ETHER_DECODER */ #endif /* LINUX_SLL_H */ diff --git a/src/protocols/packet.h b/src/protocols/packet.h index 5166cc5ad..cc07e901c 100644 --- a/src/protocols/packet.h +++ b/src/protocols/packet.h @@ -225,7 +225,6 @@ struct Packet const uint8_t *ip_frag_start; - const uint8_t *tcp_options_data; Layer layers[LAYER_MAX]; /* decoded encapsulations */ @@ -291,52 +290,36 @@ struct Packet #define BIT(i) (0x1 << (i-1)) -static inline int PacketWasCooked(const Packet* p) -{ - return ( p->packet_flags & PKT_PSEUDO ) != 0; -} +static inline int PacketWasCooked(const Packet* const p) +{ return ( p->packet_flags & PKT_PSEUDO ) != 0; } -static inline bool IsPortscanPacket(const Packet *p) -{ - return ( PacketWasCooked(p) && (p->pseudo_type == PSEUDO_PKT_PS)); -} +static inline bool IsPortscanPacket(const Packet* const p) +{ return ( PacketWasCooked(p) && (p->pseudo_type == PSEUDO_PKT_PS)); } -static inline uint8_t GetEventProto(const Packet *p) +static inline uint8_t GetEventProto(const Packet* const p) { if (IsPortscanPacket(p)) return p->ps_proto; return p->ip_api.proto(); // return 0 if invalid } -static inline bool PacketHasFullPDU (const Packet* p) -{ - return ( (p->packet_flags & PKT_PDU_FULL) == PKT_PDU_FULL ); -} +static inline bool PacketHasFullPDU (const Packet* const p) +{ return ( (p->packet_flags & PKT_PDU_FULL) == PKT_PDU_FULL ); } -static inline bool PacketHasStartOfPDU (const Packet* p) -{ - return ( (p->packet_flags & PKT_PDU_HEAD) != 0 ); -} +static inline bool PacketHasStartOfPDU (const Packet* const p) +{ return ( (p->packet_flags & PKT_PDU_HEAD) != 0 ); } -static inline bool PacketHasPAFPayload (const Packet* p) -{ - return ( (p->packet_flags & PKT_REBUILT_STREAM) || PacketHasFullPDU(p) ); -} +static inline bool PacketHasPAFPayload (const Packet* const p) +{ return ( (p->packet_flags & PKT_REBUILT_STREAM) || PacketHasFullPDU(p) ); } -static inline bool PacketIsRebuilt (const Packet* p) -{ - return ( (p->packet_flags & (PKT_REBUILT_STREAM|PKT_REBUILT_FRAG)) != 0 ); -} +static inline bool PacketIsRebuilt (const Packet* const p) +{ return ( (p->packet_flags & (PKT_REBUILT_STREAM|PKT_REBUILT_FRAG)) != 0 ); } -static inline void SetExtraData (Packet* p, uint32_t xid) -{ - p->xtradata_mask |= BIT(xid); -} +static inline void SetExtraData (Packet* p, const uint32_t xid) +{ p->xtradata_mask |= BIT(xid); } -static inline uint16_t EXTRACT_16BITS(const uint8_t* p) -{ - return ntohs(*(uint16_t*)(p)); -} +static inline uint16_t EXTRACT_16BITS(const uint8_t* const p) +{ return ntohs(*(uint16_t*)(p)); } #ifdef WORDS_MUSTALIGN @@ -354,9 +337,7 @@ static inline uint16_t EXTRACT_16BITS(const uint8_t* p) /* allows unaligned ntohl parameter - dies w/SIGBUS on SPARCs */ static inline uint32_t EXTRACT_32BITS(const uint8_t* p) - { - return ntohl(*(uint32_t *)p); - } + { return ntohl(*(uint32_t *)p); } #endif /* WORDS_MUSTALIGN */ #endif diff --git a/src/protocols/protocol_ids.h b/src/protocols/protocol_ids.h index e68094886..482f02815 100644 --- a/src/protocols/protocol_ids.h +++ b/src/protocols/protocol_ids.h @@ -70,7 +70,6 @@ constexpr uint16_t PROTOCOL_TEREDO = 0x0101; constexpr uint16_t PROTOCOL_GTP = 0x0102; constexpr uint16_t IP_EMBEDDED_IN_ICMP4 = 0x0103; constexpr uint16_t IP_EMBEDDED_IN_ICMP6 = 0x0104; -constexpr uint16_t PROT_EMBEDDED_IN_ICMP = 0x0105; diff --git a/src/protocols/wlan.h b/src/protocols/wlan.h index bc1cf1c2b..d22795172 100644 --- a/src/protocols/wlan.h +++ b/src/protocols/wlan.h @@ -22,7 +22,7 @@ #ifndef PROTOCOLS_WLAN_H #define PROTOCOLS_WLAN_H -#ifndef NO_NON_ETHER_DECODER +#include namespace wlan { @@ -86,7 +86,3 @@ struct WifiHdr } // namespace wlan #endif - -#endif - - diff --git a/src/stream/icmp/icmp_session.cc b/src/stream/icmp/icmp_session.cc index a0ca49999..c5f0a5254 100644 --- a/src/stream/icmp/icmp_session.cc +++ b/src/stream/icmp/icmp_session.cc @@ -97,13 +97,13 @@ static int ProcessIcmpUnreach(Packet *p) if (p->proto_bits & PROTO_BIT__TCP_EMBED_ICMP) { - const tcp::TCPHdr* tcph = layer::get_tcp_embed_icmp(p); + const tcp::TCPHdr* tcph = layer::get_tcp_embed_icmp(iph); sport = ntohs(tcph->th_sport); dport = ntohs(tcph->th_dport); } else if (p->proto_bits & PROTO_BIT__UDP_EMBED_ICMP) { - const udp::UDPHdr* udph = layer::get_udp_embed_icmp(p); + const udp::UDPHdr* udph = layer::get_udp_embed_icmp(iph); sport = ntohs(udph->uh_sport); dport = ntohs(udph->uh_dport); diff --git a/src/stream/ip/ip_defrag.cc b/src/stream/ip/ip_defrag.cc index 0044ffa80..76296f9a4 100644 --- a/src/stream/ip/ip_defrag.cc +++ b/src/stream/ip/ip_defrag.cc @@ -905,7 +905,7 @@ static void FragRebuild(FragTracker *ft, Packet *p) if (p->ip_api.is_ip4()) { - ip::IPHdr* iph = const_cast(dpkt->ip_api.get_ip4h()); + ip::IP4Hdr* iph = const_cast(dpkt->ip_api.get_ip4h()); /* * if there are IP options, copy those in as well @@ -1001,7 +1001,7 @@ static void FragRebuild(FragTracker *ft, Packet *p) } else /* Inner/only is IP6 */ { - ip::IP6RawHdr* rawHdr = const_cast(dpkt->ip_api.get_ip6h()); + ip::IP6Hdr* rawHdr = const_cast(dpkt->ip_api.get_ip6h()); if ( !rawHdr ) {