From: Josh Date: Wed, 17 Sep 2014 19:07:00 +0000 (-0400) Subject: removing sf_protocols.h from Snort++. Adding protocol 'IDs' X-Git-Tag: 3.0.0-233~1410^2^2^2~1 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=44d4f2afa77729c36196b43b4d985ee4b80c32be;p=thirdparty%2Fsnort3.git removing sf_protocols.h from Snort++. Adding protocol 'IDs' --- diff --git a/src/codecs/CMakeLists.txt b/src/codecs/CMakeLists.txt index ae0cc12b6..3bbbce908 100644 --- a/src/codecs/CMakeLists.txt +++ b/src/codecs/CMakeLists.txt @@ -8,7 +8,6 @@ add_subdirectory(misc) set(CODEC_INCLUDES decode_module.h codec_events.h - sf_protocols.h ) add_library( codecs STATIC diff --git a/src/codecs/Makefile.am b/src/codecs/Makefile.am index cd9cd684e..57e019998 100644 --- a/src/codecs/Makefile.am +++ b/src/codecs/Makefile.am @@ -6,13 +6,11 @@ noinst_LIBRARIES = libcodecs.a x_include_HEADERS = \ codec_events.h \ -decode_module.h \ -sf_protocols.h +decode_module.h libcodecs_a_SOURCES = \ codec_api.cc \ -codec_api.h \ -sf_protocols.h +codec_api.h SUBDIRS = \ diff --git a/src/codecs/ip/cd_auth.cc b/src/codecs/ip/cd_auth.cc index fe6044a6e..23f1c64d0 100644 --- a/src/codecs/ip/cd_auth.cc +++ b/src/codecs/ip/cd_auth.cc @@ -29,7 +29,6 @@ #include "framework/codec.h" #include "codecs/codec_events.h" #include "protocols/protocol_ids.h" -#include "codecs/sf_protocols.h" #include "protocols/ipv6.h" #include "protocols/packet.h" #include "codecs/ip/ip_util.h" @@ -67,8 +66,6 @@ public: AuthCodec() : Codec(CD_AUTH_NAME){}; ~AuthCodec(){}; - - virtual PROTO_ID get_proto_id() { return PROTO_AH; }; virtual void get_protocol_ids(std::vector& v); virtual bool decode(const RawData&, CodecData&, SnortData&); }; diff --git a/src/codecs/ip/cd_gre.cc b/src/codecs/ip/cd_gre.cc index 023d0492a..85979a703 100644 --- a/src/codecs/ip/cd_gre.cc +++ b/src/codecs/ip/cd_gre.cc @@ -27,7 +27,6 @@ #include "codecs/codec_events.h" #include "protocols/packet.h" #include "protocols/protocol_ids.h" -#include "codecs/sf_protocols.h" #include "protocols/gre.h" #include "log/text_log.h" #include "protocols/packet_manager.h" @@ -64,13 +63,10 @@ public: GreCodec() : Codec(CD_GRE_NAME){}; ~GreCodec(){}; - virtual PROTO_ID get_proto_id() { return PROTO_GRE; }; virtual void get_protocol_ids(std::vector& v); virtual bool decode(const RawData&, CodecData&, SnortData&); void log(TextLog* const, const uint8_t* /*raw_pkt*/, const Packet* const); - - }; static const uint32_t GRE_HEADER_LEN = 4; diff --git a/src/codecs/ip/cd_hop_opts.cc b/src/codecs/ip/cd_hop_opts.cc index b8775c81f..2d3c17c30 100644 --- a/src/codecs/ip/cd_hop_opts.cc +++ b/src/codecs/ip/cd_hop_opts.cc @@ -123,14 +123,10 @@ bool Ipv6HopOptsCodec::update(Packet* p, Layer* lyr, uint32_t* len) //------------------------------------------------------------------------- static Codec* ctor(Module*) -{ - return new Ipv6HopOptsCodec(); -} +{ return new Ipv6HopOptsCodec(); } static void dtor(Codec *cd) -{ - delete cd; -} +{ delete cd; } static const CodecApi ipv6_hopopts_api = { diff --git a/src/codecs/ip/cd_icmp4.cc b/src/codecs/ip/cd_icmp4.cc index d0b96d82b..c452d7f6c 100644 --- a/src/codecs/ip/cd_icmp4.cc +++ b/src/codecs/ip/cd_icmp4.cc @@ -31,7 +31,6 @@ #include "codecs/codec_events.h" #include "codecs/ip/checksum.h" #include "codecs/decode_module.h" -#include "codecs/sf_protocols.h" #include "codecs/ip/ip_util.h" #include "protocols/protocol_ids.h" #include "protocols/packet.h" @@ -91,7 +90,6 @@ public: Icmp4Codec() : Codec(CD_ICMP4_NAME){}; ~Icmp4Codec() {}; - virtual PROTO_ID get_proto_id() { return PROTO_ICMP4; }; virtual void get_protocol_ids(std::vector&); virtual bool decode(const RawData&, CodecData&, SnortData&); virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in); diff --git a/src/codecs/ip/cd_icmp6.cc b/src/codecs/ip/cd_icmp6.cc index d30f04ce4..1d4df68f4 100644 --- a/src/codecs/ip/cd_icmp6.cc +++ b/src/codecs/ip/cd_icmp6.cc @@ -31,7 +31,6 @@ #include "protocols/icmp6.h" #include "protocols/icmp4.h" #include "codecs/decode_module.h" -#include "codecs/sf_protocols.h" #include "codecs/decode_module.h" #include "codecs/codec_events.h" #include "codecs/ip/checksum.h" @@ -79,7 +78,6 @@ public: ~Icmp6Codec(){}; - virtual PROTO_ID get_proto_id() { return PROTO_ICMP6; }; virtual void get_protocol_ids(std::vector& v); virtual bool decode(const RawData&, CodecData&, SnortData&); virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in); @@ -92,11 +90,8 @@ public: } // anonymous namespace - void Icmp6Codec::get_protocol_ids(std::vector& v) -{ - v.push_back(IPPROTO_ICMPV6); -} +{ v.push_back(IPPROTO_ID_ICMPV6); } //-------------------------------------------------------------------- // decode.c::ICMP6 diff --git a/src/codecs/ip/cd_ipv4.cc b/src/codecs/ip/cd_ipv4.cc index 094cbaed8..b80c3db8f 100644 --- a/src/codecs/ip/cd_ipv4.cc +++ b/src/codecs/ip/cd_ipv4.cc @@ -42,7 +42,6 @@ #include "main/thread.h" #include "stream/stream_api.h" #include "codecs/decode_module.h" -#include "codecs/sf_protocols.h" #include "protocols/ip.h" #include "protocols/ipv4_options.h" #include "log/text_log.h" @@ -100,7 +99,6 @@ public: Ipv4Codec() : Codec(CD_IPV4_NAME){}; ~Ipv4Codec(){}; - virtual PROTO_ID get_proto_id() { return PROTO_IP4; }; virtual void get_protocol_ids(std::vector& v); virtual bool decode(const RawData&, CodecData&, SnortData&); virtual void log(TextLog* const, const uint8_t* /*raw_pkt*/, diff --git a/src/codecs/ip/cd_ipv6.cc b/src/codecs/ip/cd_ipv6.cc index da8bfc74d..8665084fb 100644 --- a/src/codecs/ip/cd_ipv6.cc +++ b/src/codecs/ip/cd_ipv6.cc @@ -37,7 +37,6 @@ #include "main/snort.h" #include "packet_io/active.h" #include "codecs/decode_module.h" -#include "codecs/sf_protocols.h" #include "protocols/protocol_ids.h" #include "protocols/packet_manager.h" #include "log/text_log.h" @@ -93,7 +92,6 @@ public: Ipv6Codec() : Codec(CD_IPV6_NAME){}; ~Ipv6Codec(){}; - virtual PROTO_ID get_proto_id() { return PROTO_IP6; }; virtual void get_protocol_ids(std::vector& v); virtual bool decode(const RawData&, CodecData&, SnortData&); virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in); diff --git a/src/codecs/ip/cd_tcp.cc b/src/codecs/ip/cd_tcp.cc index a1ad4c84d..ab6d0df7c 100644 --- a/src/codecs/ip/cd_tcp.cc +++ b/src/codecs/ip/cd_tcp.cc @@ -28,7 +28,6 @@ #include "framework/codec.h" #include "codecs/decode_module.h" #include "codecs/ip/checksum.h" -#include "codecs/sf_protocols.h" #include "protocols/tcp.h" #include "protocols/tcp_options.h" #include "protocols/ipv6.h" @@ -95,8 +94,6 @@ public: }; virtual ~TcpCodec(){}; - - virtual PROTO_ID get_proto_id() { return PROTO_TCP; }; virtual void get_protocol_ids(std::vector& v); virtual void log(TextLog* const, const uint8_t* /*raw_pkt*/, const Packet* const); @@ -123,7 +120,7 @@ static inline void TCPMiscTests(const SnortData& codec, void TcpCodec::get_protocol_ids(std::vector& v) { - v.push_back(IPPROTO_TCP); + v.push_back(IPPROTO_ID_TCP); } bool TcpCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort) diff --git a/src/codecs/ip/cd_udp.cc b/src/codecs/ip/cd_udp.cc index 70ed190f1..6f4cc2537 100644 --- a/src/codecs/ip/cd_udp.cc +++ b/src/codecs/ip/cd_udp.cc @@ -39,7 +39,6 @@ #include "framework/codec.h" #include "packet_io/active.h" #include "codecs/codec_events.h" -#include "codecs/sf_protocols.h" #include "snort_config.h" #include "parser/config_file.h" #include "codecs/ip/ip_util.h" @@ -120,7 +119,6 @@ public: ~UdpCodec(){}; - virtual PROTO_ID get_proto_id() { return PROTO_UDP; }; virtual void get_protocol_ids(std::vector& v); virtual bool decode(const RawData&, CodecData&, SnortData&); diff --git a/src/codecs/link/cd_arp.cc b/src/codecs/link/cd_arp.cc index e446c84c2..6dd2adaa9 100644 --- a/src/codecs/link/cd_arp.cc +++ b/src/codecs/link/cd_arp.cc @@ -23,7 +23,6 @@ #include "codecs/decode_module.h" #include "codecs/codec_events.h" #include "protocols/protocol_ids.h" -#include "codecs/sf_protocols.h" #include "protocols/arp.h" #include "protocols/packet.h" #include "log/text_log.h" @@ -56,8 +55,6 @@ public: ArpCodec() : Codec(CD_ARP_NAME){}; ~ArpCodec(){}; - - virtual PROTO_ID get_proto_id() { return PROTO_ARP; }; virtual void get_protocol_ids(std::vector& v); virtual bool decode(const RawData&, CodecData&, SnortData&); }; diff --git a/src/codecs/link/cd_erspan2.cc b/src/codecs/link/cd_erspan2.cc index 13b4441e0..e5aeea3ab 100644 --- a/src/codecs/link/cd_erspan2.cc +++ b/src/codecs/link/cd_erspan2.cc @@ -24,7 +24,6 @@ #include "codecs/decode_module.h" #include "codecs/codec_events.h" #include "protocols/protocol_ids.h" -#include "codecs/sf_protocols.h" #include "protocols/packet.h" #define CD_ERSPAN2_NAME "erspan2" @@ -56,7 +55,6 @@ public: Erspan2Codec() : Codec(CD_ERSPAN2_NAME){}; ~Erspan2Codec(){}; - virtual PROTO_ID get_proto_id() { return PROTO_ERSPAN; }; virtual void get_protocol_ids(std::vector& v); virtual bool decode(const RawData&, CodecData&, SnortData&); diff --git a/src/codecs/link/cd_erspan3.cc b/src/codecs/link/cd_erspan3.cc index 4c213222e..92a80dec3 100644 --- a/src/codecs/link/cd_erspan3.cc +++ b/src/codecs/link/cd_erspan3.cc @@ -26,7 +26,6 @@ #include "codecs/decode_module.h" #include "codecs/codec_events.h" #include "protocols/protocol_ids.h" -#include "codecs/sf_protocols.h" #include "protocols/packet.h" #define CD_ERSPAN3_NAME "erspan3" @@ -60,8 +59,6 @@ public: virtual void get_protocol_ids(std::vector& v); virtual bool decode(const RawData&, CodecData&, SnortData&); - - virtual PROTO_ID get_proto_id() { return PROTO_ERSPAN; }; }; diff --git a/src/codecs/link/cd_mpls.cc b/src/codecs/link/cd_mpls.cc index 0d6f0257f..b8d4006e0 100644 --- a/src/codecs/link/cd_mpls.cc +++ b/src/codecs/link/cd_mpls.cc @@ -32,7 +32,6 @@ #include "packet_io/active.h" #include "protocols/protocol_ids.h" #include "protocols/mpls.h" -#include "codecs/sf_protocols.h" #include "main/snort_config.h" #include "main/snort.h" #include "log/text_log.h" @@ -116,7 +115,6 @@ public: MplsCodec() : Codec(CD_MPLS_NAME){}; ~MplsCodec(){}; - virtual PROTO_ID get_proto_id() { return PROTO_MPLS; }; virtual void get_protocol_ids(std::vector& v); virtual bool decode(const RawData&, CodecData&, SnortData&); virtual void log(TextLog* const, const uint8_t* /*raw_pkt*/, diff --git a/src/codecs/link/cd_ppp_encap.cc b/src/codecs/link/cd_ppp_encap.cc index 30b5e771f..177d4eccb 100644 --- a/src/codecs/link/cd_ppp_encap.cc +++ b/src/codecs/link/cd_ppp_encap.cc @@ -27,7 +27,6 @@ #include "framework/codec.h" #include "protocols/protocol_ids.h" #include "snort.h" -#include "codecs/sf_protocols.h" #include "main/snort_debug.h" #define CD_PPPENCAP_NAME "ppp_encap" @@ -42,10 +41,8 @@ public: PppEncap() : Codec(CD_PPPENCAP_NAME){}; ~PppEncap(){}; - virtual PROTO_ID get_proto_id() { return PROTO_PPP_ENCAP; }; virtual void get_protocol_ids(std::vector& v); virtual bool decode(const RawData&, CodecData&, SnortData&); - }; const static uint16_t PPP_IP = 0x0021; /* Internet Protocol */ diff --git a/src/codecs/link/cd_pppoe.cc b/src/codecs/link/cd_pppoe.cc index f235e5622..5ebdd28ea 100644 --- a/src/codecs/link/cd_pppoe.cc +++ b/src/codecs/link/cd_pppoe.cc @@ -25,7 +25,6 @@ #include "codecs/decode_module.h" #include "codecs/codec_events.h" #include "protocols/packet.h" -#include "codecs/sf_protocols.h" #include "protocols/layer.h" #include "main/snort_debug.h" @@ -300,7 +299,6 @@ public: ~PPPoEDiscCodec() {}; - virtual PROTO_ID get_proto_id() { return PROTO_PPPOE; }; virtual void get_protocol_ids(std::vector& v); virtual bool decode(const RawData&, CodecData&, SnortData&); virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in); @@ -394,7 +392,6 @@ public: ~PPPoESessCodec() {}; - virtual PROTO_ID get_proto_id() { return PROTO_PPPOE; }; virtual void get_protocol_ids(std::vector& v); virtual bool decode(const RawData&, CodecData&, SnortData&); virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in); diff --git a/src/codecs/link/cd_vlan.cc b/src/codecs/link/cd_vlan.cc index c505e486f..31cfcf54b 100644 --- a/src/codecs/link/cd_vlan.cc +++ b/src/codecs/link/cd_vlan.cc @@ -32,7 +32,6 @@ #include "protocols/vlan.h" #include "protocols/eth.h" #include "protocols/protocol_ids.h" -#include "codecs/sf_protocols.h" #include "protocols/packet_manager.h" #include "log/text_log.h" @@ -66,7 +65,6 @@ public: VlanCodec() : Codec(CD_VLAN_NAME){}; ~VlanCodec(){}; - virtual PROTO_ID get_proto_id() { return PROTO_VLAN; }; virtual void get_protocol_ids(std::vector& v); virtual bool decode(const RawData&, CodecData&, SnortData&); virtual void log(TextLog* const, const uint8_t* /*raw_pkt*/, diff --git a/src/codecs/misc/cd_gtp.cc b/src/codecs/misc/cd_gtp.cc index fa986be5d..26a9432bf 100644 --- a/src/codecs/misc/cd_gtp.cc +++ b/src/codecs/misc/cd_gtp.cc @@ -31,7 +31,6 @@ #include "protocols/packet.h" #include "codecs/codec_events.h" #include "packet_io/active.h" -#include "codecs/sf_protocols.h" #include "protocols/protocol_ids.h" #include "codecs/decode_module.h" @@ -70,7 +69,6 @@ public: GtpCodec() : Codec(CD_GTP_NAME){}; ~GtpCodec(){}; - virtual PROTO_ID get_proto_id() { return PROTO_GTP; }; virtual void get_protocol_ids(std::vector& v); virtual bool decode(const RawData&, CodecData&, SnortData&); virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in); diff --git a/src/codecs/root/cd_eth.cc b/src/codecs/root/cd_eth.cc index 4aba0f1f5..4b2505145 100644 --- a/src/codecs/root/cd_eth.cc +++ b/src/codecs/root/cd_eth.cc @@ -31,7 +31,6 @@ #include "protocols/eth.h" #include "codecs/codec_events.h" #include "protocols/packet_manager.h" -#include "codecs/sf_protocols.h" #include "log/text_log.h" #define CD_ETH_NAME "eth" @@ -63,8 +62,6 @@ public: EthCodec() : Codec(CD_ETH_NAME){}; ~EthCodec(){}; - - virtual PROTO_ID get_proto_id() { return PROTO_ETH; }; virtual void get_protocol_ids(std::vector&); virtual void get_data_link_type(std::vector&); virtual void log(TextLog* const, const uint8_t* /*raw_pkt*/, diff --git a/src/codecs/sf_protocols.h b/src/codecs/sf_protocols.h deleted file mode 100644 index 12ed527aa..000000000 --- a/src/codecs/sf_protocols.h +++ /dev/null @@ -1,98 +0,0 @@ -/* $Id: sf_protocols.h,v 1.10 2013-02-07 17:51:29 ssturges Exp $ */ -/**************************************************************************** - * - * Copyright (C) 2005-2013 Sourcefire, Inc. - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License Version 2 as - * published by the Free Software Foundation. You may not use, modify or - * distribute this program under any other version of the GNU General - * Public License. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. - * - ****************************************************************************/ - -#ifndef SF_PROTOCOLS_H -#define SF_PROTOCOLS_H - -typedef enum { - PROTO_ETH, // DecodeEthPkt - - PROTO_IP4, // DecodeIP - // DecodeIPOptions - handled with IP4 - PROTO_ICMP4, // DecodeICMP - PROTO_ICMP_IP4, // DecodeICMPEmbeddedIP - - PROTO_UDP, // DecodeUDP - PROTO_TCP, // DecodeTCP - // DecodeTCPOptions - handled with TCP - - PROTO_IP6, // DecodeIPV6 - // DecodeIPV6Extensions - nothing to do here, calls below - PROTO_IP6_HOP_OPTS, // DecodeIPV6Options - ip6 hop, dst, rte, and frag exts - PROTO_IP6_DST_OPTS, - PROTO_ICMP6, // DecodeICMP6 - PROTO_ICMP_IP6, // DecodeICMPEmbeddedIP6 - PROTO_VLAN, // DecodeVlan - PROTO_GRE, // DecodeGRE - // DecodeTransBridging - basically same as DecodeEthPkt - PROTO_ERSPAN, // DecodeERSPANType2 and DecodeERSPANType3 - PROTO_PPPOE, // DecodePPPoEPkt - PROTO_PPP_ENCAP, // DecodePppPktEncapsulated - PROTO_MPLS, // DecodeMPLS - decoder changes pkth len/caplen! - // DecodeEthOverMPLS - basically same as straight eth - PROTO_ARP, // DecodeARP - PROTO_GTP, // DecodeGTP - PROTO_AH, // DecodeAH - Authentication Header (IPSec stuff) - - PROTO_TR, // DecodeTRPkt - PROTO_FDDI, // DecodeFDDIPkt - PROTO_LSLL, // DecodeLinuxSLLPkt sockaddr_ll for "any" device and - // certain misbehaving link layer encapsulations - PROTO_80211, // DecodeIEEE80211Pkt - PROTO_SLIP, // DecodeSlipPkt - actually, based on header size, this - // must be CSLIP (TCP/IP header compression) but all it - // does is skip over the presumed header w/o expanding - // and then jumps into IP4 decoding only; also, the actual - // esc/end sequences must already have been removed because - // there is no attempt to do that. - PROTO_L2I4, // DecodeI4LRawIPPkt - always skips 2 bytes and then does - // IP4 decoding only - PROTO_L2I4C, // DecodeI4LCiscoIPPkt -always skips 4 bytes and then does - // IP4 decoding only - PROTO_CHDLC, // DecodeChdlcPkt - skips 4 bytes and decodes IP4 only. - PROTO_PFLOG, // DecodePflog - PROTO_OLD_PFLOG, // DecodeOldPflog - PROTO_PPP, // DecodePppPkt - weird - optionally skips addr and cntl - // bytes; what about flag and protocol? - // calls only DecodePppPktEncapsulated. - PROTO_PPP_SERIAL, // DecodePppSerialPkt - also weird - requires addr, cntl, - // and proto (no flag) but optionally skips only 2 bytes - // (presumably the trailer w/chksum is already stripped) - // Calls either DecodePppPktEncapsulated or DecodeChdlcPkt. - PROTO_ENC, // DecodeEncPkt - skips 12 bytes and decodes IP4 only. - // (add family + "spi" + "flags" - don't know what this is) - PROTO_EAP, // DecodeEAP - PROTO_EAPOL, // DecodeEapol - leaf decoder - PROTO_EAPOL_KEY, // DecodeEapolKey - leaf decoder - - PROTO_MAX -} PROTO_ID; - - // DecodeIPX - just counts; no decoding - // DecodeEthLoopback - same as ipx - // DecodeRawPkt - jumps straight into IP4 decoding - // there is nothing to do - // DecodeNullPkt - same as DecodeRawPkt - - -#endif // __PROTOCOLS_H__ - diff --git a/src/framework/codec.h b/src/framework/codec.h index e4dbf2d74..5f799050f 100644 --- a/src/framework/codec.h +++ b/src/framework/codec.h @@ -27,7 +27,6 @@ #include "main/snort_types.h" #include "framework/base_api.h" -#include "codecs/sf_protocols.h" // unfortunately necessary due to use of Ipapi in struct #include "protocols/ip.h" @@ -330,8 +329,6 @@ public: // Get the codec's name inline const char* get_name() const {return name; }; - // used for backwards compatability. - virtual PROTO_ID get_proto_id() { return PROTO_AH; }; // Registers this Codec's data link type (as defined by libpcap) virtual void get_data_link_type(std::vector&) {}; // Register the code's protocol ID's and Ethertypes diff --git a/src/log/log_text.cc b/src/log/log_text.cc index 1f2a84471..d04e3b4f8 100644 --- a/src/log/log_text.cc +++ b/src/log/log_text.cc @@ -67,6 +67,7 @@ #include "protocols/eapol.h" #include "protocols/ipv4_options.h" #include "protocols/tcp_options.h" +#include "protocols/packet_manager.h" /*-------------------------------------------------------------------- * utility functions @@ -1468,6 +1469,9 @@ void LogNetData (TextLog* log, const uint8_t* data, const int len, Packet *p) const uint8_t* pb = data; const uint8_t* end = data + len; + const uint8_t ipv4_id = PacketManager::proto_id(IPPROTO_ID_IPIP); + const uint8_t ipv6_id = PacketManager::proto_id(IPPROTO_ID_IPV6); + int offset = 0; char conv[] = "0123456789ABCDEF"; /* xlation lookup table */ int ip_ob_start, ip_ob_end, byte_pos, char_pos; @@ -1503,11 +1507,13 @@ void LogNetData (TextLog* log, const uint8_t* data, const int len, Packet *p) if(p && ScObfuscate() ) { int num_layers = p->num_layers; + uint8_t lyr_proto = 0; + for ( i = 0; i < num_layers; i++ ) { - if ( p->layers[i].proto == PROTO_IP4 - || p->layers[i].proto == PROTO_IP6 - ) + lyr_proto = PacketManager::proto_id(p->layers[i].prot_id); + + if ( lyr_proto == ipv4_id || lyr_proto == ipv6_id) { if(p->layers[i].length && p->layers[i].start) break; @@ -1519,7 +1525,7 @@ void LogNetData (TextLog* log, const uint8_t* data, const int len, Packet *p) if(ip_start > 0 ) { ip_ob_start = ip_start + 10; - if(p->layers[i].proto == PROTO_IP4) + if(lyr_proto == ipv4_id) ip_ob_end = ip_ob_start + 2 + 2*(sizeof(struct in_addr)); else ip_ob_end = ip_ob_start + 2 + 2*(sizeof(struct in6_addr)); diff --git a/src/main/modules.cc b/src/main/modules.cc index c20240810..5d88f302a 100644 --- a/src/main/modules.cc +++ b/src/main/modules.cc @@ -1754,7 +1754,7 @@ static const Parameter xxx_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; -static const char* _help = +static const char* xxx_help = "configure "; class XXXModule : public Module diff --git a/src/managers/codec_manager.h b/src/managers/codec_manager.h index cd5afd863..a29467bda 100644 --- a/src/managers/codec_manager.h +++ b/src/managers/codec_manager.h @@ -69,7 +69,6 @@ public: // print all of the codec plugins static void dump_plugins(); - private: struct CodecApiWrapper; diff --git a/src/network_inspectors/normalize/norm.cc b/src/network_inspectors/normalize/norm.cc index 6eff4cc3c..44f5efb3d 100644 --- a/src/network_inspectors/normalize/norm.cc +++ b/src/network_inspectors/normalize/norm.cc @@ -107,8 +107,8 @@ int Norm_Packet (NormalizerConfig* c, Packet* p) while ( lyr > 0 ) { - PROTO_ID proto = p->layers[--lyr].proto; - NormalFunc n = c->normalizers[proto]; + uint16_t proto = p->layers[--lyr].prot_id; + NormalFunc n = c->normalizers[PacketManager::proto_id(proto)]; if ( n ) changes = n(c, p, lyr, changes); } @@ -560,7 +560,7 @@ int Norm_SetConfig (NormalizerConfig* nc) } if ( Norm_IsEnabled(nc, NORM_IP4) ) { - nc->normalizers[PROTO_IP4] = Norm_IP4; + nc->normalizers[PacketManager::proto_id(ETHERTYPE_IPV4)] = Norm_IP4; } if ( Norm_IsEnabled(nc, NORM_IP4_TRIM) ) { @@ -573,22 +573,21 @@ int Norm_SetConfig (NormalizerConfig* nc) } if ( Norm_IsEnabled(nc, NORM_ICMP4) ) { - nc->normalizers[PROTO_ICMP4] = Norm_ICMP4; + nc->normalizers[PacketManager::proto_id(IPPROTO_ID_ICMPV4)] = Norm_ICMP4; } if ( Norm_IsEnabled(nc, NORM_IP6) ) { - nc->normalizers[PROTO_IP6] = Norm_IP6; - nc->normalizers[PROTO_IP6_HOP_OPTS] = Norm_IP6_Opts; - nc->normalizers[PROTO_IP6_DST_OPTS] = Norm_IP6_Opts; + nc->normalizers[PacketManager::proto_id(IPPROTO_ID_IPV6)] = Norm_IP6; + nc->normalizers[PacketManager::proto_id(IPPROTO_ID_HOPOPTS)] = Norm_IP6_Opts; + nc->normalizers[PacketManager::proto_id(IPPROTO_ID_DSTOPTS)] = Norm_IP6_Opts; } if ( Norm_IsEnabled(nc, NORM_ICMP6) ) { - nc->normalizers[PROTO_ICMP6] = Norm_ICMP6; + nc->normalizers[PacketManager::proto_id(IPPROTO_ID_ICMPV6)] = Norm_ICMP6; } if ( Norm_IsEnabled(nc, NORM_TCP) ) { - nc->normalizers[PROTO_TCP] = Norm_TCP; + nc->normalizers[PacketManager::proto_id(IPPROTO_ID_TCP)] = Norm_TCP; } return 0; } - diff --git a/src/network_inspectors/normalize/norm.h b/src/network_inspectors/normalize/norm.h index 8af1cb749..2808c6122 100644 --- a/src/network_inspectors/normalize/norm.h +++ b/src/network_inspectors/normalize/norm.h @@ -22,11 +22,12 @@ #ifndef NORM_H #define NORM_H -#include "protocols/packet.h" #include "snort.h" #include "normalize.h" +#include "protocols/packet_manager.h" struct NormalizerConfig; +struct Packet; // all normalizers look like this: // the return is 1 if packet was changed, else 0 @@ -40,7 +41,7 @@ struct NormalizerConfig // these must be in the same order PROTO_IDs are defined! // if entry is NULL, proto doesn't have normalization or it is disabled - NormalFunc normalizers[PROTO_MAX]; + NormalFunc normalizers[PacketManager::max_protocols()]; }; int Norm_SetConfig(NormalizerConfig*); diff --git a/src/packet_io/active.cc b/src/packet_io/active.cc index d12b8de40..fb8a8ca1d 100644 --- a/src/packet_io/active.cc +++ b/src/packet_io/active.cc @@ -38,6 +38,7 @@ #include "protocols/packet_manager.h" #include "packet_io/sfdaq.h" #include "protocols/tcp.h" +#include "protocols/protocol_ids.h" #define MAX_ATTEMPTS 20 @@ -73,10 +74,12 @@ static int Active_Close(void); static int Active_SendEth(const DAQ_PktHdr_t*, int, const uint8_t*, uint32_t); static int Active_SendIp(const DAQ_PktHdr_t*, int, const uint8_t*, uint32_t); -static inline PROTO_ID GetInnerProto (const Packet* p) +static inline uint16_t GetInnerProto (const Packet* p) { - if ( !p->num_layers ) return PROTO_MAX; - return ( p->layers[p->num_layers-1].proto ); + if ( !p->num_layers ) + return FINISHED_DECODE; + + return ( p->layers[p->num_layers-1].prot_id ); } //-------------------------------------------------------------------- @@ -235,7 +238,7 @@ void Active_InjectData ( int Active_IsRSTCandidate(const Packet* p) { - if ( GetInnerProto(p) != PROTO_TCP ) + if ( GetInnerProto(p) != IPPROTO_ID_TCP ) return 0; if ( !p->ptrs.tcph ) @@ -252,15 +255,16 @@ int Active_IsRSTCandidate(const Packet* p) int Active_IsUNRCandidate(const Packet* p) { // FIXIT-J allow unr to tcp/udp/icmp4/icmp6 only or for all - switch ( GetInnerProto(p) ) { - case PROTO_UDP: - case PROTO_TCP: - case PROTO_ICMP4: - case PROTO_ICMP6: - return 1; + switch ( GetInnerProto(p) ) + { + case IPPROTO_ID_UDP: + case IPPROTO_ID_TCP: + case IPPROTO_ID_ICMPV4: + case IPPROTO_ID_ICMPV6: + return 1; - default: - break; + default: + break; } return 0; } diff --git a/src/protocols/layer.h b/src/protocols/layer.h index 8cdaac5f2..32f537b98 100644 --- a/src/protocols/layer.h +++ b/src/protocols/layer.h @@ -24,7 +24,6 @@ #include #include "main/snort_types.h" -#include "codecs/sf_protocols.h" struct Layer { @@ -43,7 +42,6 @@ struct Layer { * (layers_entire_length) - length; * (ip::IP4Hdr*) ip4h->get_hlen() * 4 - length; */ - PROTO_ID proto; }; diff --git a/src/protocols/packet_manager.cc b/src/protocols/packet_manager.cc index deba3d582..55cc6efd2 100644 --- a/src/protocols/packet_manager.cc +++ b/src/protocols/packet_manager.cc @@ -84,13 +84,11 @@ static THREAD_LOCAL SnortData tmp_ptrs; static inline void push_layer(Packet *p, uint16_t prot_id, const uint8_t *hdr_start, - uint32_t len, - Codec *const cd) + uint32_t len) { // We check to ensure num_layer < MAX_LAYERS before this function call Layer& lyr = p->layers[p->num_layers++]; - lyr.proto = cd->get_proto_id(); lyr.prot_id = prot_id; lyr.start = hdr_start; lyr.length = (uint16_t)len; @@ -207,7 +205,7 @@ void PacketManager::decode( // internal statistics and record keeping - push_layer(p, prev_prot_id, pkt, codec_data.lyr_len, CodecManager::s_protocols[mapped_prot]); + push_layer(p, prev_prot_id, pkt, codec_data.lyr_len); s_stats[mapped_prot + stat_offset]++; // add correct decode for previous layer mapped_prot = CodecManager::s_proto_map[codec_data.next_prot_id]; prev_prot_id = codec_data.next_prot_id; @@ -401,7 +399,6 @@ int PacketManager::encode_format_with_daq_info ( const uint8_t* b = c->pkt + (p->layers[i].start - p->pkt); // == c->pkt + p->layers[i].len lyr = c->layers + i; - lyr->proto = p->layers[i].proto; lyr->prot_id = p->layers[i].prot_id; lyr->length = p->layers[i].length; lyr->start = (uint8_t*)b; diff --git a/src/protocols/packet_manager.h b/src/protocols/packet_manager.h index 5cfc858a0..55c26a88d 100644 --- a/src/protocols/packet_manager.h +++ b/src/protocols/packet_manager.h @@ -26,7 +26,7 @@ #include "main/snort_types.h" #include "framework/codec.h" -#include "protocols/packet.h" +#include "protocols/packet.h" // FIXIT-L remove #include "framework/counts.h" #include "managers/codec_manager.h" #include "main/thread.h" @@ -105,6 +105,23 @@ public: // print this packets information, layer by layer static void log_protocols(TextLog* const, const Packet* const); + + + + /* Accessor functions -- any object in Snort++ can now convert a + * protocol to its mapped value. + * + * The equivelant of Snort's PROTO_ID */ + static constexpr std::size_t max_protocols() // compile time constant + { return CodecManager::s_protocols.size(); } + + /* If a proto was registered in a Codec's get_protocol_ids() function, + * this function will return the 'ID' of the Codec to which the proto belongs. + * If none of the loaded Codecs registered that proto, this function will + * return zero. */ + static inline uint8_t proto_id(uint16_t proto) + { return CodecManager::s_proto_map[proto]; } + private: // STATISTICS!! diff --git a/src/protocols/protocol_ids.h b/src/protocols/protocol_ids.h index 83150d646..c099dd785 100644 --- a/src/protocols/protocol_ids.h +++ b/src/protocols/protocol_ids.h @@ -1,6 +1,5 @@ /* -** Copyright (C) 2002-2013 Sourcefire, Inc. -** Copyright (C) 1998-2002 Martin Roesch +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. ** ** This program is free software; you can redistribute it and/or modify ** it under the terms of the GNU General Public License Version 2 as @@ -51,6 +50,8 @@ constexpr uint16_t IPPROTO_ID_HOPOPTS = 0; constexpr uint16_t IPPROTO_ID_ICMPV4 = 1; constexpr uint16_t IPPROTO_ID_IPIP = 4; +constexpr uint16_t IPPROTO_ID_TCP = 6; +constexpr uint16_t IPPROTO_ID_UDP = 17; constexpr uint16_t IPPROTO_ID_IPV6 = 41; constexpr uint16_t IPPROTO_ID_ROUTING = 43; constexpr uint16_t IPPROTO_ID_FRAGMENT = 44;