From: Josh Date: Fri, 6 Jun 2014 18:08:34 +0000 (-0400) Subject: removing pointers from packet struct. adding unit test options to cmake. X-Git-Tag: 3.0.0-233~1496^2 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=649bfe900b319c86dfed4889d7be44ec386ddffe;p=thirdparty%2Fsnort3.git removing pointers from packet struct. adding unit test options to cmake. --- diff --git a/cmake/FindCHECK.cmake b/cmake/FindCHECK.cmake index 5e4e50796..11da7497d 100644 --- a/cmake/FindCHECK.cmake +++ b/cmake/FindCHECK.cmake @@ -5,26 +5,26 @@ set(ERROR_MESSAGE 'make check' command" ) -find_library(CHECK_LIBRARY - NAMES check -) -find_path (CHECK_INCLUDE_DIRS +find_path (CHECK_INCLUDE_DIR NAMES check.h ) +find_library(CHECK_LIBRARIES + NAMES check +) include(FindPackageHandleStandardArgs) find_package_handle_standard_args(CHECK - REQUIRED_VARS CHECK_INCLUDE_DIRS CHECK_INCLUDE_DIRS + REQUIRED_VARS CHECK_INCLUDE_DIR CHECK_LIBRARIES FAIL_MESSAGE "${ERROR_MESSAGE}" ) mark_as_advanced( - CHECK_INCLUDE_DIRS - CHECK_LIBRARIES + CHECK_INCLUDE_DIR + CHECK_LIBRARIES ) diff --git a/cmake/setConfigureOptions.cmake b/cmake/setConfigureOptions.cmake index f3ba6bc2f..3fd059913 100644 --- a/cmake/setConfigureOptions.cmake +++ b/cmake/setConfigureOptions.cmake @@ -86,6 +86,10 @@ if(ENABLE_PROFILE AND CMAKE_COMPILER_IS_GNUCXX) endif() +if (BUILD_UNIT_TESTS) + enable_testing() +endif() + # sanity checks to re-check and set all necesssary variables if (NOT ASCIIDOC_FOUND) diff --git a/doc/CMakeLists.txt b/doc/CMakeLists.txt index 4ddd1c393..06d708054 100644 --- a/doc/CMakeLists.txt +++ b/doc/CMakeLists.txt @@ -1,7 +1,9 @@ # -# This list of built sources MUST be kept up to date with -# the actual build targets located at the bottom of src/CMakelists.txt +# Assuming a file the source file is 'file_name.txt' the BUILT_SOURCES +# files will be created with the following command +# +# snort --help-file_name > file_name.txt # set(BUILT_SOURCES builtin.txt @@ -9,6 +11,8 @@ set(BUILT_SOURCES config.txt options.txt gids.txt +# version.txt Required special formatting. manually add below. + CACHE INTERNAL "sources to be built" FORCE ) set (UNBUILT_SOURCES @@ -16,10 +20,10 @@ set (UNBUILT_SOURCES differences.txt style.txt tips.txt - images/snort.png + plugins.txt +# images/snort.png # images directory is manually included as an a2x option ) - if (MAKE_HTML_DOC) set(HTML_DOCS snort_manual.html @@ -32,46 +36,42 @@ if (MAKE_PDF_DOC) set(PDF_DOCS snort_manual.pdf) endif() - # Docuements to be built set (EXTRA_DIST ${HTML_DOCS} ${PDF_DOCS}) -############################################################################### -############################################################################### - - - - - ############################################################################### ############################################################################### ############################################################################### # # -# Since we'd lke to keep the source tree unpolluted, only build targets # -# in the build directory. The rest of this file creates custom commands to # -# copy all of the documents into the doc/ directory. # +# Since we'd lke to keep the source tree unpolluted, create all targets in # +# the build directory. This section adds custom commands to copy all of the # +# BUILT_SOURCES into this directory and create all of the UNBUILT_SOURCES in # +# this directory. # +# # +# NOTE: BUILT_SOURCES recipes are actually defined in src/CMakeLists.txt to # +# ensure a file dependency on Snort. This section copies those built sources # +# into this directory. # # # ############################################################################### - -# Due to the depency on the snort executable, the files are created in a -# different directory and copied into the top level of the build directory -# This next loop copies all of the appropriate files into the doc direcotry - +# copy built files into this directory set (TARGET_DIR ${CMAKE_BINARY_DIR}) -foreach (file ${BUILT_SOURCES}) +foreach (file ${BUILT_SOURCES};version.txt) set(input ${CMAKE_BINARY_DIR}/${file}) set (output ${CMAKE_CURRENT_BINARY_DIR}/${file}) + # create this custom file name so it can be used below. Doesn't actually + # build the file itself. add_custom_command( OUTPUT ${input} COMMAND ${CMAKE_COMMAND} -E touch_nocreate ${input} ) + # complementary section to the foreach loop at the bottom of src/CMakeLists.txt add_custom_command( OUTPUT ${output} COMMAND ${CMAKE_COMMAND} @@ -88,17 +88,6 @@ foreach (file ${BUILT_SOURCES}) endforeach(file) -#copying the images directory! -add_custom_target(copy_images DEPENDS images) -add_custom_command( - OUTPUT images - COMMAND ${CMAKE_COMMAND} - -E copy_directory ${CMAKE_CURRENT_SOURCE_DIR}/images ${CMAKE_CURRENT_BINARY_DIR}/images - COMMENT "Copying doc/images. If the doc/images directory changes, rerun the cmake command!!" -) -set_source_files_properties(images SYMBOLIC "YES") - - # Copy all distributed files into the binary tree (necessary for asciidocs). # Then create a dependency between the new and old files. foreach (file ${UNBUILT_SOURCES}) @@ -106,13 +95,11 @@ foreach (file ${UNBUILT_SOURCES}) OUTPUT ${CMAKE_CURRENT_BINARY_DIR}/${file} COMMAND ${CMAKE_COMMAND} -E copy ${CMAKE_CURRENT_SOURCE_DIR}/${file} ${CMAKE_CURRENT_BINARY_DIR}/${file} - MAIN_DEPENDENCY ${CMAKE_CURRENT_SOURCE_DIR}/${file} - DEPENDS copy_images + MAIN_DEPENDENCY ${file} COMMENT "Copying ${file} into binary directory" ) list(APPEND UNBUILT_SOURCES_BINARY_PATH "${CMAKE_CURRENT_BINARY_DIR}/${file}") -# set(UNBUILT_SOURCES_BINARY_PATH "${UNBUILT_SOURCES_BINARY_PATH} ${CMAKE_CURRENT_BINARY_DIR}/${file}") endforeach(file) foreach (file ${EXTRA_DIST}) @@ -129,19 +116,18 @@ set (ALL_SOURCES ############################################################################### ############################################################################### -# This part contains all of the custom commmands for creating the actual -# documentation. +# create the recipes for building the files -set (PDF_ARGUMENTS --icons --icons-dir=./images/icons -a imagesdir=./images) +set (PDF_ARGUMENTS --icons --icons-dir=./images/icons --resource=${CMAKE_CURRENT_SOURCE_DIR}/images ) set (HTML_ARGUMENTS --copy --attribute linkcss --attribute stylesdir --attribute disable-javascript --attribute quirks! ${PDF_ARGUMENTS}) add_custom_command(OUTPUT snort_manual.html COMMAND ${ASCIIDOC_A2X_EXE} -f xhtml ${HTML_ARGUMENTS} - --resource=${CMAKE_CURRENT_BINARY_DIR} - --destination-dir=${CMAKE_CURRENT_BINARY_DIR} + --resource=${CMAKE_CURRENT_BINARY_DIR} + --destination-dir=${CMAKE_CURRENT_BINARY_DIR} ${CMAKE_CURRENT_BINARY_DIR}/snort_manual.txt DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/snort_manual.txt ${ALL_SOURCES} COMMENT "Documents: building snort_manual.html" @@ -169,7 +155,7 @@ add_custom_command(OUTPUT snort_manual.tgz zcf snort_manual.tgz ${CMAKE_CURRENT_BINARY_DIR}/snort_manual.chunked MAIN_DEPENDENCY ${CMAKE_CURRENT_SOURCE_DIR}/snort_manual.txt - DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/images ${ALL_SOURCES} + DEPENDS ${ALL_SOURCES} COMMENT "Documents: building snort_manual.tgz" ) @@ -178,9 +164,9 @@ add_custom_command(OUTPUT images.tgz zcf images.tgz --exclude callouts --exclude README - -C ${CMAKE_CURRENT_BINARY_DIR}/images + -C ${CMAKE_CURRENT_SOURCE_DIR}/images . - DEPENDS ${CMAKE_CURRENT_BINARY_DIR}/images ${ALL_SOURCES} + DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/images ${ALL_SOURCES} COMMENT "Documents: building images.tgz" ) @@ -188,14 +174,14 @@ add_custom_command(OUTPUT images.tgz ############################################################################### ############################################################################### -# Finally, the commands to create the manuals, and the command to install the -# manuals +# Finally, the commands to set the manual dependencies and install the +# built documents add_custom_target(snort_manuals ALL DEPENDS ${EXTRA_DIST} ) -add_dependencies(snort_manuals snort) +add_dependencies(snort_manuals snort ${ALL_SOURCES}) diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt index fcecea75a..1e972ab0e 100644 --- a/src/CMakeLists.txt +++ b/src/CMakeLists.txt @@ -23,7 +23,7 @@ include_directories(target_based) include_directories(time) include_directories(utils) -add_executable(snort +add_executable( snort main.h main.cc ) @@ -39,12 +39,11 @@ if (STATIC_INSPECTORS) endif(STATIC_INSPECTORS) if (BUILD_UNIT_TESTS) - set( UNIT_TESTS_LIBRARIES test) + set( UNIT_TESTS_LIBRARIES unit_tests) add_subdirectory(test) endif( BUILD_UNIT_TESTS) -set_default_visibility_compile_flag(snort) -target_link_libraries(snort +target_link_libraries( snort main target_based log @@ -137,105 +136,51 @@ install(TARGETS snort ) ############################################################################## -# -# This is the documents seciton of the cmake file. Yes, I hate that I am -# putting this stuff in the src directory instead of the doc directory, -# but these files are dependent on the Snort executable. Since complete -# platform independence is the goal, these command need a file level -# dependcy on snort, which means they need to be here -# -# When creating new files, follow these directions -# 1) Copy an entire segment (include the set, add_custom_command, -# and add_custom_target pieces) -# 2) Change the ARGS to create the file you want -# 3) Add the file name to list of BUILT_SOURCES at the top of -# doc/CMakeLists.txt -# +# # +# This is the documents section of the file. It needs to be in same # +# directory or subdirectory as snort to create a valid file dependency on # +# snort. To build another .txt file with a dependcy on snort, add the file # +# to the BUILT_SOURCES variable located at the top of doc/CMakeLists.txt. # +# If the new file's name is new_file.txt, cmake will automatcially run the # +# command # +# # +# >> snort --help-file_name > file_name.txt # +# # +# to creat the new file. Notice that the extension is missing in the help # +# command. If the command does not exist, the behavior is undefined but # +# will likely lead to error. # +# # ############################################################################## - if (MAKE_PDF_DOC OR MAKE_HTML_DOC) + foreach(file ${BUILT_SOURCES}) + set(TARGET_DIR ${CMAKE_BINARY_DIR}) + set(output ${TARGET_DIR}/${file}) + get_filename_component(file_name "${file}" NAME_WE) - set(TARGET_DIR ${CMAKE_BINARY_DIR}) - - - set(file builtin.txt) - - set(output ${TARGET_DIR}/${file}) - add_custom_command( - OUTPUT ${output} - COMMAND snort --markup --help-builtin > ${output} - MAIN_DEPENDENCY snort - COMMENT "Documents: building ${output}" - ) - get_filename_component(file_name "${file}" NAME_WE) - add_custom_target(doc_${file_name} ALL DEPENDS ${output} ) - - - set(file commands.txt) - - set(output ${TARGET_DIR}/${file}) - add_custom_command( - OUTPUT ${output} - COMMAND snort --markup --help-commands > ${output} - MAIN_DEPENDENCY snort - COMMENT "Documents: building ${output}" - ) - get_filename_component(file_name "${file}" NAME_WE) - add_custom_target(doc_${file_name} ALL DEPENDS ${output} ) - - - - set(file config.txt) + add_custom_command( + OUTPUT ${output} + COMMAND snort --markup --help-${file_name} | sort > ${output} + DEPENDS snort + COMMENT "Documents: building ${output}" + ) + add_custom_target(doc_${file_name} ALL DEPENDS ${output} ) - set(output ${TARGET_DIR}/${file}) - add_custom_command( - OUTPUT ${output} - COMMAND snort --markup --help-config > ${output} - MAIN_DEPENDENCY snort - COMMENT "Documents: building ${output}" - ) - get_filename_component(file_name "${file}" NAME_WE) - add_custom_target(doc_${file_name} ALL DEPENDS ${output}) - - - set(file options.txt) - - set(output ${TARGET_DIR}/${file}) - add_custom_command( - OUTPUT ${output} - COMMAND snort --markup --help > ${output} - MAIN_DEPENDENCY snort - COMMENT "Documents: building ${output}" - ) - get_filename_component(file_name "${file}" NAME_WE) - add_custom_target(doc_${file_name} ALL DEPENDS ${output}) - - - set(file gids.txt) + endforeach() - set(output ${TARGET_DIR}/${file}) - add_custom_command( - OUTPUT ${output} - COMMAND snort --markup --help-gids > ${output} - MAIN_DEPENDENCY snort - COMMENT "Documents: building ${output}" - ) - get_filename_component(file_name "${file}" NAME_WE) - add_custom_target(doc_${file_name} ALL DEPENDS ${output}) + # version is different since it outputs to standard out. set(file version.txt) set(output ${TARGET_DIR}/${file}) add_custom_command( OUTPUT ${output} COMMAND snort -V 2>&1 | grep -v Using > ${output} - MAIN_DEPENDENCY snort + DEPENDS snort COMMENT "Documents: building ${output}" ) - get_filename_component(file_name "${file}" NAME_WE) - add_custom_target(doc_${file_name} ALL DEPENDS ${output}) + add_custom_target(doc_version ALL DEPENDS ${output}) endif() diff --git a/src/Makefile.am b/src/Makefile.am index 4433dec44..499cbf43b 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -60,6 +60,7 @@ packet_io/libpacket_io.a \ helpers/libhelpers.a \ sfip/libsfip.a \ sfrt/libsfrt.a \ +protocols/libprotocols.a \ utils/libutils.a SUBDIRS = \ diff --git a/src/codecs/CMakeLists.txt b/src/codecs/CMakeLists.txt index fd87319fe..8cf13e556 100644 --- a/src/codecs/CMakeLists.txt +++ b/src/codecs/CMakeLists.txt @@ -7,7 +7,6 @@ add_subdirectory(misc) add_library( codecs STATIC - decode.h decode_module.h codec_api.h codec_api.cc @@ -17,6 +16,7 @@ add_library( codecs STATIC codec_events.h checksum.h checksum.cc + template.cc # for development purposes. Keep the template up to date ) diff --git a/src/codecs/Makefile.am b/src/codecs/Makefile.am index d2f0d0704..ff49b8de9 100644 --- a/src/codecs/Makefile.am +++ b/src/codecs/Makefile.am @@ -6,9 +6,7 @@ noinst_LIBRARIES += libcodec_utils.a libcodecs_a_SOURCES = \ codec_api.cc \ codec_api.h \ -decode.h \ decode_module.h \ -layer.h \ sf_protocols.h libcodec_utils_a_SOURCES = \ diff --git a/src/codecs/checksum.cc b/src/codecs/checksum.cc index 00a5604ea..a020cc3e1 100644 --- a/src/codecs/checksum.cc +++ b/src/codecs/checksum.cc @@ -37,7 +37,7 @@ uint16_t cksum_add(const uint16_t *buf, size_t len, uint32_t cksum) if (len > 1 ) { - sn = ((len / 2) & 0xF); // len divided by two mod 16 == len/2 % 16 + sn = ((len / 2) & 0xF); // == len/2 % 16 n = (((len / 2) + 15) / 16) ; // ceiling of (len / 2) / 16 switch (sn) { diff --git a/src/codecs/checksum.h b/src/codecs/checksum.h index 5c0370f6b..ef3171d6c 100644 --- a/src/codecs/checksum.h +++ b/src/codecs/checksum.h @@ -26,17 +26,8 @@ #include "config.h" #endif -#ifndef WIN32 -#include -#include -#include -#else /* !WIN32 */ -#include -#ifndef IFNAMSIZ -#define IFNAMESIZ MAX_ADAPTER_NAME -#endif /* !IFNAMSIZ */ -#endif /* !WIN32 */ - +#include +#include namespace checksum diff --git a/src/codecs/codec_api.cc b/src/codecs/codec_api.cc index 38d16d867..02f236376 100644 --- a/src/codecs/codec_api.cc +++ b/src/codecs/codec_api.cc @@ -27,18 +27,14 @@ #include "framework/codec.h" -// root decoders +// root codecs extern const BaseApi* cd_eth; extern const BaseApi* cd_raw4; extern const BaseApi* cd_raw6; -extern const BaseApi* cd_null_root; +extern const BaseApi* cd_null; -#ifndef NO_NON_ETHER_DECODER - -#endif - -// decoders +// other codecs extern const BaseApi* cd_ipv4; extern const BaseApi* cd_ipv6; extern const BaseApi* cd_icmp4; @@ -59,12 +55,16 @@ extern const BaseApi* cd_gre; extern const BaseApi* cd_gtp; extern const BaseApi* cd_hopopts; extern const BaseApi* cd_igmp; +extern const BaseApi* cd_mobility; extern const BaseApi* cd_mpls; extern const BaseApi* cd_no_next; +extern const BaseApi* cd_pim; extern const BaseApi* cd_pgm; extern const BaseApi* cd_pppencap; -extern const BaseApi* cd_pppoe; +extern const BaseApi* cd_pppoepkt_disc; +extern const BaseApi* cd_pppoepkt_sess; extern const BaseApi* cd_routing; +extern const BaseApi* cd_sun_nd; extern const BaseApi* cd_swipe; extern const BaseApi* cd_teredo; extern const BaseApi* cd_transbridge; @@ -72,6 +72,9 @@ extern const BaseApi* cd_vlan; #ifndef NO_NON_ETHER_DECODER extern const BaseApi* cd_eapol; +extern const BaseApi* cd_linux_sll; +extern const BaseApi* cd_tr; +extern const BaseApi* cd_wlan; #endif @@ -83,11 +86,8 @@ const BaseApi* codecs[] = cd_eth, cd_raw4, cd_raw6, - cd_null_root, + cd_null, -#ifndef NO_NON_ETHER_DECODER - -#endif // non root codeccs cd_ipv4, @@ -110,12 +110,16 @@ const BaseApi* codecs[] = cd_gtp, cd_hopopts, cd_igmp, + cd_mobility, cd_mpls, cd_no_next, + cd_pim, cd_pgm, cd_pppencap, - cd_pppoe, + cd_pppoepkt_disc, + cd_pppoepkt_sess, cd_routing, + cd_sun_nd, cd_swipe, cd_teredo, cd_transbridge, @@ -123,6 +127,9 @@ const BaseApi* codecs[] = #ifndef NO_NON_ETHER_DECODER cd_eapol, + cd_linux_sll, + cd_tr, + cd_wlan, #endif #endif diff --git a/src/codecs/codec_events.cc b/src/codecs/codec_events.cc index c06b1d2bf..b15ddb444 100644 --- a/src/codecs/codec_events.cc +++ b/src/codecs/codec_events.cc @@ -86,7 +86,5 @@ void codec_events::decoder_alert_encapsulated( p->data = pkt; p->dsize = (uint16_t)len; - - p->greh = NULL; } diff --git a/src/codecs/decode.h b/src/codecs/decode.h deleted file mode 100644 index 903007010..000000000 --- a/src/codecs/decode.h +++ /dev/null @@ -1,147 +0,0 @@ -/* -** Copyright (C) 2002-2013 Sourcefire, Inc. -** Copyright (C) 1998-2002 Martin Roesch -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -#ifndef DECODE_H -#define DECODE_H - -/* I N C L U D E S **********************************************************/ - -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif - -#include -#include -#include - -#ifndef WIN32 -#include -#include -#include -#else /* !WIN32 */ -#include -#ifndef IFNAMSIZ -#define IFNAMESIZ MAX_ADAPTER_NAME -#endif /* !IFNAMSIZ */ -#endif /* !WIN32 */ - -extern "C" { -#include -#include -} - -#include "snort_types.h" -#include "protocols/packet.h" -#include "profiler.h" -#include "protocols/mpls.h" - - - - - -/* D E F I N E S ************************************************************/ - -#if 0 -#define ETH_DSAP_SNA 0x08 /* SNA */ -#define ETH_SSAP_SNA 0x00 /* SNA */ -#define ETH_DSAP_STP 0x42 /* Spanning Tree Protocol */ -#define ETH_SSAP_STP 0x42 /* Spanning Tree Protocol */ -#define ETH_DSAP_IP 0xaa /* IP */ -#define ETH_SSAP_IP 0xaa /* IP */ - -#define ETH_ORG_CODE_ETHR 0x000000 /* Encapsulated Ethernet */ -#define ETH_ORG_CODE_CDP 0x00000c /* Cisco Discovery Proto */ -#endif - - -#define DEFAULT_MPLS_PAYLOADTYPE MPLS_PAYLOADTYPE_IPV4 -#define DEFAULT_LABELCHAIN_LENGTH -1 - - -#define MAX_PORTS 65536 - -#if 0 -/* ppp header structure - * - * Actually, this is the header for RFC1332 Section 3 - * IPCP Configuration Options for sending IP datagrams over a PPP link - * - */ -struct ppp_header { - unsigned char address; - unsigned char control; - unsigned short protocol; -}; - -#ifndef PPP_HDRLEN - #define PPP_HDRLEN sizeof(struct ppp_header) -#endif - -/* otherwise defined in /usr/include/ppp_defs.h */ -#ifndef PPP_MTU - #define PPP_MTU 1500 -#endif - -#endif - - -#define IP_OPTMAX 40 -#define IP6_EXTMAX 8 -#define TCP_OPTLENMAX 40 /* (((2^4) - 1) * 4 - TCP_HEADER_LEN) */ - - - - - -static inline uint16_t EXTRACT_16BITS(const uint8_t* p) -{ - return ntohs(*(uint16_t*)(p)); -} - -#ifdef WORDS_MUSTALIGN - -#if defined(__GNUC__) -/* force word-aligned ntohl parameter */ - static inline uint32_t EXTRACT_32BITS(const uint8_t* p) - { - uint32_t tmp; - memmove(&tmp, p, sizeof(uint32_t)); - return ntohl(tmp); - } -#endif /* __GNUC__ */ - -#else - -/* allows unaligned ntohl parameter - dies w/SIGBUS on SPARCs */ - static inline uint32_t EXTRACT_32BITS(const uint8_t* p) - { - return ntohl(*(uint32_t *)p); - } -#endif /* WORDS_MUSTALIGN */ - - - -const unsigned int ALERTMSG_LENGTH = 256; -const int16_t SFTARGET_UNKNOWN_PROTOCOL = -1; - - - -#endif - diff --git a/src/codecs/ip/CMakeLists.txt b/src/codecs/ip/CMakeLists.txt index 57e182f90..7e19417ed 100644 --- a/src/codecs/ip/CMakeLists.txt +++ b/src/codecs/ip/CMakeLists.txt @@ -16,10 +16,13 @@ if( STATIC_DECODERS ) cd_igmp_module.h cd_igmp_module.cc cd_no_next.cc + cd_mobility.cc + cd_pim.cc cd_pgm.cc cd_pgm_module.h cd_pgm_module.cc cd_routing.cc + cd_sun_nd.cc cd_swipe.cc ) @@ -30,9 +33,12 @@ else() add_shared_library(cd_gre codecs cd_gre.cc cd_gre_module.h cd_gre_module.cc) add_shared_library(cd_hopopts codecs cd_hopopts.cc) add_shared_library(cd_igmp codecs cd_igmp.cc cd_igmp_module.h cd_igmp_module.cc) + add_shared_library(cd_mobility codecs cd_mobility.cc) add_shared_library(cd_no_next codecs cd_no_next.cc) + add_shared_library(cd_pim codecs cd_pim.cc) add_shared_library(cd_pgm codecs cd_pgm.cc cd_pgm_module.h cd_pgm_module.cc) add_shared_library(cd_routing codecs cd_routing.cc) + add_shared_library(cd_sun_nd codecs cd_sun_nd.cc) add_shared_library(cd_swipe codecs cd_swipe.cc) endif() diff --git a/src/codecs/ip/Makefile.am b/src/codecs/ip/Makefile.am index 10f7fc333..d500b658d 100644 --- a/src/codecs/ip/Makefile.am +++ b/src/codecs/ip/Makefile.am @@ -39,11 +39,14 @@ cd_hopopts.cc \ cd_igmp.cc \ cd_igmp_module.h \ cd_igmp_module.cc \ +cd_mobility.cc \ cd_no_next.cc \ +cd_pim.cc \ cd_pgm.cc \ cd_pgm_module.h \ cd_pgm_module.cc \ cd_routing.cc \ +cd_sun_nd.cc \ cd_swipe.cc @@ -64,11 +67,26 @@ libcd_gre_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO libcd_gre_la_LDFLAGS = -export-dynamic -shared libcd_gre_la_SOURCES = cd_gre.cc cd_gre_module.h cd_gre_module.cc +ehlib_LTLIBRARIES += libcd_mobility.la +libcd_mobility_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO +libcd_mobility_la_LDFLAGS = -export-dynamic -shared +libcd_mobility_la_SOURCES = cd_mobility.cc + ehlib_LTLIBRARIES += libcd_pgm.la libcd_pgm_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO libcd_pgm_la_LDFLAGS = -export-dynamic -shared libcd_pgm_la_SOURCES = cd_gre.cc cd_pgm_module.h cd_pgm_module.cc +ehlib_LTLIBRARIES += libcd_pim.la +libcd_pim_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO +libcd_pim_la_LDFLAGS = -export-dynamic -shared +libcd_pim_la_SOURCES = cd_pim.cc + +ehlib_LTLIBRARIES += libcd_sun_nd.la +libcd_sun_nd_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO +libcd_sun_nd_la_LDFLAGS = -export-dynamic -shared +libcd_sun_nd_la_SOURCES = cd_sun_nd.cc + # TODO: PUT THESE IN THE LIST #add_shared_library(cd_dstopts codecs cd_dstopts.cc) #add_shared_library(cd_frag codecs cd_frag.cc) diff --git a/src/codecs/ip/cd_ah.cc b/src/codecs/ip/cd_ah.cc index 72c1aaeac..b3bdba9d8 100644 --- a/src/codecs/ip/cd_ah.cc +++ b/src/codecs/ip/cd_ah.cc @@ -31,6 +31,7 @@ #include "codecs/ip/cd_ah_module.h" #include "protocols/protocol_ids.h" #include "protocols/ipv6.h" +#include "codecs/sf_protocols.h" namespace { @@ -42,15 +43,10 @@ public: ~AhCodec(){}; + virtual PROTO_ID get_proto_id() { return PROTO_AH; }; virtual void get_protocol_ids(std::vector& v); virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); - - - // DELETE from here and below - #include "codecs/sf_protocols.h" - virtual inline PROTO_ID get_proto_id() { return PROTO_AH; }; - }; diff --git a/src/codecs/ip/cd_ah_module.h b/src/codecs/ip/cd_ah_module.h index 41d124917..a1171cfd0 100644 --- a/src/codecs/ip/cd_ah_module.h +++ b/src/codecs/ip/cd_ah_module.h @@ -25,7 +25,7 @@ #include "codecs/decode_module.h" -#define CD_AH_NAME "codec_ah" +#define CD_AH_NAME "cd_ah" class AhModule : public DecodeModule { diff --git a/src/codecs/ip/cd_dstopts.cc b/src/codecs/ip/cd_dstopts.cc index 1afc4d9ff..7a8be291c 100644 --- a/src/codecs/ip/cd_dstopts.cc +++ b/src/codecs/ip/cd_dstopts.cc @@ -37,7 +37,7 @@ namespace { -#define CD_DSTOPTS_NAME "codec_ipv6_dstopts" +#define CD_DSTOPTS_NAME "cd_ipv6_dstopts" class Ipv6DSTOptsCodec : public Codec { diff --git a/src/codecs/ip/cd_esp_module.h b/src/codecs/ip/cd_esp_module.h index 96a98f4be..5b0594cbd 100644 --- a/src/codecs/ip/cd_esp_module.h +++ b/src/codecs/ip/cd_esp_module.h @@ -25,7 +25,7 @@ #include "codecs/decode_module.h" -#define CD_ESP_NAME "codec_esp" +#define CD_ESP_NAME "cd_esp" class EspModule : public DecodeModule { diff --git a/src/codecs/ip/cd_frag.cc b/src/codecs/ip/cd_frag.cc index 922ccfe3f..ab9d3f37a 100644 --- a/src/codecs/ip/cd_frag.cc +++ b/src/codecs/ip/cd_frag.cc @@ -38,7 +38,7 @@ namespace { -#define CD_IPV6_FRAG_NAME "codec_ipv6_frag" +#define CD_IPV6_FRAG_NAME "cd_ipv6_frag" class Ipv6FragCodec : public Codec { diff --git a/src/codecs/ip/cd_gre.cc b/src/codecs/ip/cd_gre.cc index 1eb2a2c2d..a7a60db39 100644 --- a/src/codecs/ip/cd_gre.cc +++ b/src/codecs/ip/cd_gre.cc @@ -20,11 +20,17 @@ // cd_gre.cc author Josh Rosenbaum +#ifdef HAVE_CONFIG_H +#include "config.h" +#endif + #include "framework/codec.h" #include "codecs/ip/cd_gre_module.h" #include "codecs/codec_events.h" #include "protocols/packet.h" #include "protocols/protocol_ids.h" +#include "codecs/sf_protocols.h" +#include "protocols/gre.h" namespace { @@ -35,19 +41,14 @@ public: GreCodec() : Codec(CD_GRE_NAME){}; ~GreCodec(){}; - + virtual PROTO_ID get_proto_id() { return PROTO_GRE; }; virtual void get_protocol_ids(std::vector& v); virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); - virtual void format(EncodeFlags, const Packet* p, Packet* c, Layer*); - // DELETE from here and below - #include "codecs/sf_protocols.h" - virtual inline PROTO_ID get_proto_id() { return PROTO_GRE; }; }; -static const uint16_t GRE_PROT_ID = 47; static const uint32_t GRE_HEADER_LEN = 4; static const uint32_t GRE_CHKSUM_LEN = 2; static const uint32_t GRE_OFFSET_LEN = 2; @@ -74,7 +75,7 @@ static const uint32_t GRE_V1_ACK_LEN = 4; void GreCodec::get_protocol_ids(std::vector& v) { - v.push_back(GRE_PROT_ID); + v.push_back(IPPROTO_ID_GRE); } @@ -116,32 +117,32 @@ bool GreCodec::decode(const uint8_t *raw_pkt, const uint32_t len, * figure out the length */ - p->greh = (GREHdr *)raw_pkt; + const gre::GREHdr *greh = reinterpret_cast(raw_pkt); lyr_len = GRE_HEADER_LEN; - switch (GRE_VERSION(p->greh)) + switch (GRE_VERSION(greh)) { case 0x00: /* these must not be set */ - if (GRE_RECUR(p->greh) || GRE_FLAGS(p->greh)) + if (GRE_RECUR(greh) || GRE_FLAGS(greh)) { codec_events::decoder_alert_encapsulated(p, DECODE_GRE_INVALID_HEADER, raw_pkt, len); return false; } - if (GRE_CHKSUM(p->greh) || GRE_ROUTE(p->greh)) + if (GRE_CHKSUM(greh) || GRE_ROUTE(greh)) lyr_len += GRE_CHKSUM_LEN + GRE_OFFSET_LEN; - if (GRE_KEY(p->greh)) + if (GRE_KEY(greh)) lyr_len += GRE_KEY_LEN; - if (GRE_SEQ(p->greh)) + if (GRE_SEQ(greh)) lyr_len += GRE_SEQ_LEN; /* if this flag is set, we need to walk through all of the * Source Route Entries */ - if (GRE_ROUTE(p->greh)) + if (GRE_ROUTE(greh)) { uint16_t sre_addrfamily; uint8_t sre_offset; @@ -177,8 +178,8 @@ bool GreCodec::decode(const uint8_t *raw_pkt, const uint32_t len, /* PPTP */ case 0x01: /* these flags should never be present */ - if (GRE_CHKSUM(p->greh) || GRE_ROUTE(p->greh) || GRE_SSR(p->greh) || - GRE_RECUR(p->greh) || GRE_V1_FLAGS(p->greh)) + if (GRE_CHKSUM(greh) || GRE_ROUTE(greh) || GRE_SSR(greh) || + GRE_RECUR(greh) || GRE_V1_FLAGS(greh)) { codec_events::decoder_alert_encapsulated(p, DECODE_GRE_V1_INVALID_HEADER, raw_pkt, len); @@ -186,7 +187,7 @@ bool GreCodec::decode(const uint8_t *raw_pkt, const uint32_t len, } /* protocol must be 0x880B - PPP */ - if (GRE_PROTO(p->greh) != ETHERTYPE_PPP) + if (GRE_PROTO(greh) != ETHERTYPE_PPP) { codec_events::decoder_alert_encapsulated(p, DECODE_GRE_V1_INVALID_HEADER, raw_pkt, len); @@ -194,7 +195,7 @@ bool GreCodec::decode(const uint8_t *raw_pkt, const uint32_t len, } /* this flag should always be present */ - if (!(GRE_KEY(p->greh))) + if (!(GRE_KEY(greh))) { codec_events::decoder_alert_encapsulated(p, DECODE_GRE_V1_INVALID_HEADER, raw_pkt, len); @@ -203,10 +204,10 @@ bool GreCodec::decode(const uint8_t *raw_pkt, const uint32_t len, lyr_len += GRE_KEY_LEN; - if (GRE_SEQ(p->greh)) + if (GRE_SEQ(greh)) lyr_len += GRE_SEQ_LEN; - if (GRE_V1_ACK(p->greh)) + if (GRE_V1_ACK(greh)) lyr_len += GRE_V1_ACK_LEN; break; @@ -224,18 +225,10 @@ bool GreCodec::decode(const uint8_t *raw_pkt, const uint32_t len, return false; } - next_prot_id = GRE_PROTO(p->greh); + next_prot_id = GRE_PROTO(greh); return true; } -/****************************************************************** - ******************** E N C O D E R ****************************** - ******************************************************************/ - -void GreCodec::format (EncodeFlags, const Packet*, Packet* c, Layer* lyr) -{ - c->greh = (GREHdr*)lyr->start; -} //------------------------------------------------------------------------- diff --git a/src/codecs/ip/cd_gre_module.h b/src/codecs/ip/cd_gre_module.h index 626d36cce..2e0ce889f 100644 --- a/src/codecs/ip/cd_gre_module.h +++ b/src/codecs/ip/cd_gre_module.h @@ -25,7 +25,7 @@ #include "codecs/decode_module.h" -#define CD_GRE_NAME "codec_gre" +#define CD_GRE_NAME "cd_gre" class GreModule : public DecodeModule { diff --git a/src/codecs/ip/cd_hopopts.cc b/src/codecs/ip/cd_hopopts.cc index 00da7c2f4..d0e566b2a 100644 --- a/src/codecs/ip/cd_hopopts.cc +++ b/src/codecs/ip/cd_hopopts.cc @@ -36,7 +36,7 @@ namespace { -#define CD_HOPOPTS_NAME "codec_ipv6_hopopts" +#define CD_HOPOPTS_NAME "cd_ipv6_hopopts" class Ipv6HopOptsCodec : public Codec { diff --git a/src/codecs/ip/cd_icmp4.cc b/src/codecs/ip/cd_icmp4.cc index 28d493afe..e74b1ccac 100644 --- a/src/codecs/ip/cd_icmp4.cc +++ b/src/codecs/ip/cd_icmp4.cc @@ -38,6 +38,7 @@ #include "codecs/checksum.h" #include "protocols/protocol_ids.h" #include "codecs/ip/cd_icmp4_module.h" +#include "codecs/sf_protocols.h" namespace{ @@ -49,17 +50,13 @@ public: Icmp4Codec() : Codec(CD_ICMP4_NAME){}; ~Icmp4Codec() {}; + virtual PROTO_ID get_proto_id() { return PROTO_ICMP4; }; virtual void get_protocol_ids(std::vector&); virtual bool decode(const uint8_t* raw_packet, const uint32_t raw_len, Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id); virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in); virtual bool update(Packet*, Layer*, uint32_t* len); virtual void format(EncodeFlags, const Packet* p, Packet* c, Layer*); - - // DELETE from here and below - #include "codecs/sf_protocols.h" - virtual inline PROTO_ID get_proto_id() { return PROTO_ICMP4; }; - private: void DecodeICMPEmbeddedIP(const uint8_t *pkt, const uint32_t len, Packet *p); diff --git a/src/codecs/ip/cd_icmp4_module.h b/src/codecs/ip/cd_icmp4_module.h index 1f4e3bf79..6eb73cd8a 100644 --- a/src/codecs/ip/cd_icmp4_module.h +++ b/src/codecs/ip/cd_icmp4_module.h @@ -25,7 +25,7 @@ #include "codecs/decode_module.h" -#define CD_ICMP4_NAME "codec_icmp4" +#define CD_ICMP4_NAME "cd_icmp4" class Icmp4Module : public DecodeModule { diff --git a/src/codecs/ip/cd_icmp6.cc b/src/codecs/ip/cd_icmp6.cc index f8efb2528..39e8b4c06 100644 --- a/src/codecs/ip/cd_icmp6.cc +++ b/src/codecs/ip/cd_icmp6.cc @@ -34,6 +34,7 @@ #include "protocols/icmp6.h" #include "protocols/icmp4.h" #include "codecs/ip/cd_icmp6_module.h" +#include "codecs/sf_protocols.h" namespace @@ -46,17 +47,13 @@ public: ~Icmp6Codec(){}; + virtual PROTO_ID get_proto_id() { return PROTO_ICMP6; }; virtual void get_protocol_ids(std::vector& v); virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in); virtual bool update(Packet*, Layer*, uint32_t* len); virtual void format(EncodeFlags, const Packet* p, Packet* c, Layer*); - - - // DELETE from here and below - #include "codecs/sf_protocols.h" - virtual inline PROTO_ID get_proto_id() { return PROTO_ICMP6; }; }; @@ -65,20 +62,14 @@ public: } // anonymous namespace +static void DecodeICMPEmbeddedIP6(const uint8_t *pkt, const uint32_t len, Packet *p); + + void Icmp6Codec::get_protocol_ids(std::vector& v) { v.push_back(IPPROTO_ICMPV6); } - - -static void DecodeICMPEmbeddedIP6(const uint8_t *pkt, const uint32_t len, Packet *p); - -#if 0 -static unsigned short in_chksum_icmp6(pseudoheader6 *, unsigned short *, int); -#endif - - //-------------------------------------------------------------------- // decode.c::ICMP6 //-------------------------------------------------------------------- @@ -166,7 +157,7 @@ bool Icmp6Codec::decode(const uint8_t* raw_pkt, const uint32_t len, } break; - case ICMP6_BIG: + case icmp6::Icmp6Types::BIG: if (p->dsize >= sizeof(ICMP6TooBig)) { ICMP6TooBig *too_big = (ICMP6TooBig *)raw_pkt; @@ -203,7 +194,7 @@ bool Icmp6Codec::decode(const uint8_t* raw_pkt, const uint32_t len, p->data += 4; p->dsize -= 4; - if (p->icmp6h->type == ICMP6_UNREACH) + if (p->icmp6h->type == icmp6::Icmp6Types::UNREACH) { if (p->icmp6h->code == 2) { @@ -517,97 +508,6 @@ void Icmp6Codec::format (EncodeFlags, const Packet*, Packet* c, Layer* lyr) c->icmp6h = (ICMP6Hdr*)lyr->start; } -#if 0 - -/* - * CHECKSUM - */ - - -/* -* checksum icmp6 -*/ - -static unsigned short in_chksum_icmp6(pseudoheader6 *ph, - unsigned short *w, int blen ) -{ - uint16_t *h = (uint16_t *)ph; - unsigned short answer=0; - unsigned int cksum = 0; - - /* PseudoHeader must have 36 bytes */ - cksum = h[0]; - cksum += h[1]; - cksum += h[2]; - cksum += h[3]; - cksum += h[4]; - cksum += h[5]; - cksum += h[6]; - cksum += h[7]; - cksum += h[8]; - cksum += h[9]; - cksum += h[10]; - cksum += h[11]; - cksum += h[12]; - cksum += h[13]; - cksum += h[14]; - cksum += h[15]; - cksum += h[16]; - cksum += h[17]; - - while(blen >=32) - { - cksum += w[0]; - cksum += w[1]; - cksum += w[2]; - cksum += w[3]; - cksum += w[4]; - cksum += w[5]; - cksum += w[6]; - cksum += w[7]; - cksum += w[8]; - cksum += w[9]; - cksum += w[10]; - cksum += w[11]; - cksum += w[12]; - cksum += w[13]; - cksum += w[14]; - cksum += w[15]; - w += 16; - blen -= 32; - } - - while(blen >=8) - { - cksum += w[0]; - cksum += w[1]; - cksum += w[2]; - cksum += w[3]; - w += 4; - blen -= 8; - } - - while(blen > 1) - { - cksum += *w++; - blen -= 2; - } - - if( blen == 1 ) - { - *(unsigned char*)(&answer) = (*(unsigned char*)w); - cksum += answer; - } - - cksum = (cksum >> 16) + (cksum & 0x0000ffff); - cksum += (cksum >> 16); - - - return (unsigned short)(~cksum); -} -#endif - - //------------------------------------------------------------------------- // api //------------------------------------------------------------------------- diff --git a/src/codecs/ip/cd_icmp6_module.h b/src/codecs/ip/cd_icmp6_module.h index 42794601c..d514765af 100644 --- a/src/codecs/ip/cd_icmp6_module.h +++ b/src/codecs/ip/cd_icmp6_module.h @@ -25,7 +25,7 @@ #include "codecs/decode_module.h" -#define CD_ICMP6_NAME "codec_icmp6" +#define CD_ICMP6_NAME "cd_icmp6" class Icmp6Module : public DecodeModule { diff --git a/src/codecs/ip/cd_igmp_module.h b/src/codecs/ip/cd_igmp_module.h index 3c2eefce4..b4902b7e5 100644 --- a/src/codecs/ip/cd_igmp_module.h +++ b/src/codecs/ip/cd_igmp_module.h @@ -25,7 +25,7 @@ #include "codecs/decode_module.h" -#define CD_IGMP_NAME "codec_igmp" +#define CD_IGMP_NAME "cd_igmp" class IgmpModule : public DecodeModule { diff --git a/src/codecs/ip/cd_ipv4.cc b/src/codecs/ip/cd_ipv4.cc index 9088836bb..f935ed9a6 100644 --- a/src/codecs/ip/cd_ipv4.cc +++ b/src/codecs/ip/cd_ipv4.cc @@ -47,6 +47,7 @@ #include "main/thread.h" #include "stream/stream_api.h" #include "codecs/ip/cd_ipv4_module.h" +#include "codecs/sf_protocols.h" namespace{ @@ -56,6 +57,7 @@ public: Ipv4Codec() : Codec(CD_IPV4_NAME){}; ~Ipv4Codec(){}; + virtual PROTO_ID get_proto_id() { return PROTO_IP4; }; virtual void get_protocol_ids(std::vector& v); virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); @@ -63,15 +65,11 @@ public: virtual bool update(Packet*, Layer*, uint32_t* len); virtual void format(EncodeFlags, const Packet* p, Packet* c, Layer*); - // used in random classes throughout Snort++ - - // DELETE from here and below - #include "codecs/sf_protocols.h" - virtual inline PROTO_ID get_proto_id() { return PROTO_IP4; }; private: - - + static uint8_t RevTTL (const EncState* enc, uint8_t ttl); + static uint8_t FwdTTL (const EncState* enc, uint8_t ttl); + static uint8_t GetTTL (const EncState* enc); }; @@ -96,7 +94,7 @@ static void DecodeIPOptions(const uint8_t *start, uint32_t o_len, Packet *p); ************ PRIVATE FUNCTIONS *********** *******************************************/ -static inline uint8_t GetTTL (const EncState* enc) +uint8_t Ipv4Codec::GetTTL (const EncState* enc) { char dir; uint8_t ttl; @@ -121,7 +119,7 @@ static inline uint8_t GetTTL (const EncState* enc) return ttl; } -static inline uint8_t FwdTTL (const EncState* enc, uint8_t ttl) +uint8_t Ipv4Codec::FwdTTL (const EncState* enc, uint8_t ttl) { uint8_t new_ttl = GetTTL(enc); if ( !new_ttl ) @@ -129,7 +127,7 @@ static inline uint8_t FwdTTL (const EncState* enc, uint8_t ttl) return new_ttl; } -static inline uint8_t RevTTL (const EncState* enc, uint8_t ttl) +uint8_t Ipv4Codec::RevTTL (const EncState* enc, uint8_t ttl) { uint8_t new_ttl = GetTTL(enc); if ( !new_ttl ) @@ -380,7 +378,7 @@ bool Ipv4Codec::decode(const uint8_t *raw_pkt, const uint32_t len, p->ip_dsize = (u_short) ip_len; /* See if there are any ip_proto only rules that match */ - fpEvalIpProtoOnlyRules(snort_conf->ip_proto_only_lists, p); + fpEvalIpProtoOnlyRules(snort_conf->ip_proto_only_lists, p, p->iph->ip_proto); p->proto_bits |= PROTO_BIT__IP; @@ -398,8 +396,8 @@ bool Ipv4Codec::decode(const uint8_t *raw_pkt, const uint32_t len, if (GET_IPH_PROTO(p) >= MIN_UNASSIGNED_IP_PROTO) codec_events::decoder_event(p, DECODE_IP_UNASSIGNED_PROTO); - - next_prot_id = p->iph->ip_proto; + else + next_prot_id = p->iph->ip_proto; } else { @@ -411,44 +409,6 @@ bool Ipv4Codec::decode(const uint8_t *raw_pkt, const uint32_t len, return true; } - -/* Function: DecodeIPv4Proto - * - * Gernalized IPv4 next protocol decoder dispatching. - * - * Arguments: proto => IPPROTO value of the next protocol - * pkt => ptr to the packet data - * len => length from here to the end of the packet - * p => pointer to the packet decode struct - * - */ -inline void DecodeIPv4Proto(const uint8_t proto, - const uint8_t *pkt, const uint32_t len, Packet *p) -{ - switch(proto) - { - - - case IPPROTO_IP_MOBILITY: - case IPPROTO_SUN_ND: - case IPPROTO_PIM: - codec_events::decoder_event(p, DECODE_IP_BAD_PROTO); - p->data = pkt; - p->dsize = (uint16_t)len; - return; - - - default: - if (GET_IPH_PROTO(p) >= MIN_UNASSIGNED_IP_PROTO) - codec_events::decoder_event(p, DECODE_IP_UNASSIGNED_PROTO); - - p->data = pkt; - p->dsize = (uint16_t)len; - return; - } -} - - //------------------------------------------------------------------ // decode.c::IP4 misc //-------------------------------------------------------------------- @@ -776,7 +736,6 @@ void Ipv4Codec::format(EncodeFlags f, const Packet* p, Packet* c, Layer* lyr) sfiph_build(c, c->iph, AF_INET); } - //------------------------------------------------------------------------- // api //------------------------------------------------------------------------- diff --git a/src/codecs/ip/cd_ipv4_module.h b/src/codecs/ip/cd_ipv4_module.h index 3d1608678..861795aa1 100644 --- a/src/codecs/ip/cd_ipv4_module.h +++ b/src/codecs/ip/cd_ipv4_module.h @@ -25,7 +25,7 @@ #include "codecs/decode_module.h" -#define CD_IPV4_NAME "codec_ipv4" +#define CD_IPV4_NAME "cd_ipv4" class Ipv4Module : public DecodeModule { diff --git a/src/codecs/ip/cd_ipv6.cc b/src/codecs/ip/cd_ipv6.cc index 2e192693c..c1c9eff24 100644 --- a/src/codecs/ip/cd_ipv6.cc +++ b/src/codecs/ip/cd_ipv6.cc @@ -35,6 +35,7 @@ #include "main/snort.h" #include "packet_io/active.h" #include "codecs/ip/cd_ipv6_module.h" +#include "codecs/sf_protocols.h" namespace { @@ -45,6 +46,7 @@ public: Ipv6Codec() : Codec(CD_IPV6_NAME){}; ~Ipv6Codec(){}; + virtual PROTO_ID get_proto_id() { return PROTO_IP6; }; virtual void get_protocol_ids(std::vector& v); virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); @@ -52,10 +54,11 @@ public: virtual bool update(Packet*, Layer*, uint32_t* len); virtual void format(EncodeFlags, const Packet* p, Packet* c, Layer*); +private: - // DELETE from here and below - #include "codecs/sf_protocols.h" - virtual inline PROTO_ID get_proto_id() { return PROTO_IP6; }; + static uint8_t RevTTL (const EncState* enc, uint8_t ttl); + static uint8_t FwdTTL (const EncState* enc, uint8_t ttl); + static uint8_t GetTTL (const EncState* enc); }; @@ -70,7 +73,7 @@ static inline int CheckTeredoPrefix(ipv6::IP6RawHdr *hdr); ************************* PRIVATE FUNCTIONS ********************** ********************************************************************/ -static inline uint8_t GetTTL (const EncState* enc) +uint8_t Ipv6Codec::GetTTL (const EncState* enc) { char dir; uint8_t ttl; @@ -95,7 +98,7 @@ static inline uint8_t GetTTL (const EncState* enc) return ttl; } -static inline uint8_t FwdTTL (const EncState* enc, uint8_t ttl) +uint8_t Ipv6Codec::FwdTTL (const EncState* enc, uint8_t ttl) { uint8_t new_ttl = GetTTL(enc); if ( !new_ttl ) @@ -103,7 +106,7 @@ static inline uint8_t FwdTTL (const EncState* enc, uint8_t ttl) return new_ttl; } -static inline uint8_t RevTTL (const EncState* enc, uint8_t ttl) +uint8_t Ipv6Codec::RevTTL (const EncState* enc, uint8_t ttl) { uint8_t new_ttl = GetTTL(enc); if ( !new_ttl ) @@ -234,8 +237,6 @@ bool Ipv6Codec::decode(const uint8_t *raw_pkt, const uint32_t len, next_prot_id = GET_IPH_PROTO(p); lyr_len = ipv6::hdr_len(); - -// DecodeIPV6Extensions(GET_IPH_PROTO(p), raw_pkt + ipv6::hdr_len(), ntohs(p->ip6h->len), p); return true; diff --git a/src/codecs/ip/cd_ipv6_module.h b/src/codecs/ip/cd_ipv6_module.h index 95c46043c..ef23eaf08 100644 --- a/src/codecs/ip/cd_ipv6_module.h +++ b/src/codecs/ip/cd_ipv6_module.h @@ -25,7 +25,7 @@ #include "codecs/decode_module.h" -#define CD_IPV6_NAME "codec_ipv6" +#define CD_IPV6_NAME "cd_ipv6" class Ipv6Module : public DecodeModule { diff --git a/src/codecs/ip/cd_mobility.cc b/src/codecs/ip/cd_mobility.cc new file mode 100644 index 000000000..bf2a8442a --- /dev/null +++ b/src/codecs/ip/cd_mobility.cc @@ -0,0 +1,112 @@ +/* +** Copyright (C) 2002-2013 Sourcefire, Inc. +** Copyright (C) 1998-2002 Martin Roesch +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + + + +#ifdef HAVE_CONFIG_H +#include "config.h" +#endif + +#include "framework/codec.h" +#include "codecs/codec_events.h" + + +namespace +{ + +// yes, macros are necessary. The API and class constructor require different strings. +#define CD_MOBILE_NAME "cd_mobility" + +class MobilityCodec : public Codec +{ +public: + MobilityCodec() : Codec(CD_MOBILE_NAME){}; + ~MobilityCodec() {}; + + + virtual void get_protocol_ids(std::vector&); + virtual bool decode(const uint8_t *raw_pkt, const uint32_t raw_len, + Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); + +}; + +const uint16_t IPPROTO_ID_MOBILITY = 55; + +} // namespace + + +void MobilityCodec::get_protocol_ids(std::vector& v) +{ + v.push_back(IPPROTO_ID_MOBILITY); +} + +bool MobilityCodec::decode(const uint8_t* raw_pkt, const uint32_t raw_len, + Packet* p, uint16_t& /*lyr_len*/, uint16_t& /*next_prot_id*/) +{ + codec_events::decoder_event(p, DECODE_IP_BAD_PROTO); + p->data = raw_pkt; + p->dsize = (uint16_t)raw_len; + return true; +} + + +//------------------------------------------------------------------------- +// api +//------------------------------------------------------------------------- + +static Codec* ctor(Module*) +{ + return new MobilityCodec(); +} + +static void dtor(Codec *cd) +{ + delete cd; +} + + +static const CodecApi mobility_api = +{ + { + PT_CODEC, + CD_MOBILE_NAME, + CDAPI_PLUGIN_V0, + 0, + nullptr, + nullptr + }, + nullptr, + nullptr, + nullptr, + nullptr, + ctor, + dtor, +}; + + +#ifdef BUILDING_SO +SO_PUBLIC const BaseApi* snort_plugins[] = +{ + &mobility_api.base, + nullptr +}; +#else +const BaseApi* cd_mobility = &mobility_api.base; +#endif diff --git a/src/codecs/ip/cd_no_next.cc b/src/codecs/ip/cd_no_next.cc index 86c35013f..8fd9a9cf2 100644 --- a/src/codecs/ip/cd_no_next.cc +++ b/src/codecs/ip/cd_no_next.cc @@ -37,7 +37,7 @@ namespace { -#define CD_NO_NEXT_NAME "codec_ipv6_no_next" +#define CD_NO_NEXT_NAME "cd_ipv6_no_next" class Ipv6NoNextCodec : public Codec { diff --git a/src/codecs/ip/cd_pgm_module.h b/src/codecs/ip/cd_pgm_module.h index 09613e7cd..8795c2d15 100644 --- a/src/codecs/ip/cd_pgm_module.h +++ b/src/codecs/ip/cd_pgm_module.h @@ -25,7 +25,7 @@ #include "codecs/decode_module.h" -#define CD_PGM_NAME "codec_pgm" +#define CD_PGM_NAME "cd_pgm" class PgmModule : public DecodeModule { diff --git a/src/codecs/ip/cd_pim.cc b/src/codecs/ip/cd_pim.cc new file mode 100644 index 000000000..334f84c08 --- /dev/null +++ b/src/codecs/ip/cd_pim.cc @@ -0,0 +1,112 @@ +/* +** Copyright (C) 2002-2013 Sourcefire, Inc. +** Copyright (C) 1998-2002 Martin Roesch +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + + + +#ifdef HAVE_CONFIG_H +#include "config.h" +#endif + +#include "framework/codec.h" +#include "codecs/codec_events.h" + + +namespace +{ + +// yes, macros are necessary. The API and class constructor require different strings. +#define CD_PIM_NAME "cd_pim" + +class PimCodec : public Codec +{ +public: + PimCodec() : Codec(CD_PIM_NAME){}; + ~PimCodec() {}; + + + virtual void get_protocol_ids(std::vector&); + virtual bool decode(const uint8_t *raw_pkt, const uint32_t raw_len, + Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); + +}; + +const uint16_t IPPROTO_ID_PIM = 103; + +} // namespace + + +void PimCodec::get_protocol_ids(std::vector& v) +{ + v.push_back(IPPROTO_ID_PIM); +} + +bool PimCodec::decode(const uint8_t* raw_pkt, const uint32_t raw_len, + Packet* p, uint16_t& /*lyr_len*/, uint16_t& /*next_prot_id*/) +{ + codec_events::decoder_event(p, DECODE_IP_BAD_PROTO); + p->data = raw_pkt; + p->dsize = (uint16_t)raw_len; + return true; +} + + +//------------------------------------------------------------------------- +// api +//------------------------------------------------------------------------- + +static Codec* ctor(Module*) +{ + return new PimCodec(); +} + +static void dtor(Codec *cd) +{ + delete cd; +} + + +static const CodecApi pim_api = +{ + { + PT_CODEC, + CD_PIM_NAME, + CDAPI_PLUGIN_V0, + 0, + nullptr, + nullptr + }, + nullptr, + nullptr, + nullptr, + nullptr, + ctor, + dtor, +}; + + +#ifdef BUILDING_SO +SO_PUBLIC const BaseApi* snort_plugins[] = +{ + &pim_api.base, + nullptr +}; +#else +const BaseApi* cd_pim = &pim_api.base; +#endif diff --git a/src/codecs/ip/cd_routing.cc b/src/codecs/ip/cd_routing.cc index a1d54f4c1..e87d3d8ae 100644 --- a/src/codecs/ip/cd_routing.cc +++ b/src/codecs/ip/cd_routing.cc @@ -37,7 +37,7 @@ namespace { -#define CD_IPV6_ROUTING_NAME "codec_ipv6_routing" +#define CD_IPV6_ROUTING_NAME "cd_ipv6_routing" class Ipv6RoutingCodec : public Codec { diff --git a/src/codecs/ip/cd_sun_nd.cc b/src/codecs/ip/cd_sun_nd.cc new file mode 100644 index 000000000..1e9570698 --- /dev/null +++ b/src/codecs/ip/cd_sun_nd.cc @@ -0,0 +1,112 @@ +/* +** Copyright (C) 2002-2013 Sourcefire, Inc. +** Copyright (C) 1998-2002 Martin Roesch +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + + + +#ifdef HAVE_CONFIG_H +#include "config.h" +#endif + +#include "framework/codec.h" +#include "codecs/codec_events.h" + + +namespace +{ + +// yes, macros are necessary. The API and class constructor require different strings. +#define CD_SUN_ND_NAME "cd_sun_nd" + +class SunNdCodec : public Codec +{ +public: + SunNdCodec() : Codec(CD_SUN_ND_NAME){}; + ~SunNdCodec() {}; + + + virtual void get_protocol_ids(std::vector&); + virtual bool decode(const uint8_t *raw_pkt, const uint32_t raw_len, + Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); + +}; + +const uint16_t IPPROTO_ID_SUN_ND = 77; + +} // namespace + + +void SunNdCodec::get_protocol_ids(std::vector& v) +{ + v.push_back(IPPROTO_ID_SUN_ND); +} + +bool SunNdCodec::decode(const uint8_t* raw_pkt, const uint32_t raw_len, + Packet* p, uint16_t& /*lyr_len*/, uint16_t& /*next_prot_id*/) +{ + codec_events::decoder_event(p, DECODE_IP_BAD_PROTO); + p->data = raw_pkt; + p->dsize = (uint16_t)raw_len; + return true; +} + + +//------------------------------------------------------------------------- +// api +//------------------------------------------------------------------------- + +static Codec* ctor(Module*) +{ + return new SunNdCodec(); +} + +static void dtor(Codec *cd) +{ + delete cd; +} + + +static const CodecApi sun_nd_api = +{ + { + PT_CODEC, + CD_SUN_ND_NAME, + CDAPI_PLUGIN_V0, + 0, + nullptr, + nullptr + }, + nullptr, + nullptr, + nullptr, + nullptr, + ctor, + dtor, +}; + + +#ifdef BUILDING_SO +SO_PUBLIC const BaseApi* snort_plugins[] = +{ + &sun_nd_api.base, + nullptr +}; +#else +const BaseApi* cd_sun_nd = &sun_nd_api.base; +#endif diff --git a/src/codecs/ip/cd_swipe.cc b/src/codecs/ip/cd_swipe.cc index 12cce3415..4f0961446 100644 --- a/src/codecs/ip/cd_swipe.cc +++ b/src/codecs/ip/cd_swipe.cc @@ -30,7 +30,7 @@ namespace{ -#define CD_SWIPE_NAME "codec_swipe" +#define CD_SWIPE_NAME "cd_swipe" class SwipeCodec : public Codec diff --git a/src/codecs/ip/cd_tcp.cc b/src/codecs/ip/cd_tcp.cc index b12a1b1a5..c2fd3dea4 100644 --- a/src/codecs/ip/cd_tcp.cc +++ b/src/codecs/ip/cd_tcp.cc @@ -45,6 +45,7 @@ #include "protocols/packet.h" #include "framework/codec.h" #include "codecs/ip/cd_tcp_module.h" +#include "codecs/sf_protocols.h" namespace { @@ -59,17 +60,13 @@ public: virtual ~TcpCodec(){}; + virtual PROTO_ID get_proto_id() { return PROTO_TCP; }; virtual void get_protocol_ids(std::vector& v); virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, Packet *, uint16_t &lyr_len, uint16_t &); virtual bool encode(EncState*, Buffer* out, const uint8_t *raw_in); virtual bool update(Packet*, Layer*, uint32_t* len); virtual void format(EncodeFlags, const Packet* p, Packet* c, Layer*); - - - // DELETE - #include "codecs/sf_protocols.h" - virtual inline PROTO_ID get_proto_id() { return PROTO_TCP; }; }; static sfip_var_t *SynToMulticastDstIp = NULL; @@ -179,18 +176,6 @@ bool TcpCodec::decode(const uint8_t *raw_pkt, const uint32_t len, /* calculate the checksum */ csum = checksum::tcp_cksum((uint16_t *)(p->tcph), len, &ph); -#if 0 - csum = in_chksum_tcp(&ph, (uint16_t *)(p->tcph), len); - uint16_t csum2 = PacketClass::tcp_cksum((uint16_t *)(p->tcph), len, &ph); - - if(csum != csum2) - { - DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "TCP_CHECKSUM_ERROR!!! -> the two checksum are not equal %hu != %hu\n", - csum, csum2);); - uint16_t csum3 = PacketClass::tcp_cksum((uint16_t *)(p->tcph), len, &ph); - } -#endif - } /* IPv6 traffic */ else @@ -204,20 +189,6 @@ bool TcpCodec::decode(const uint8_t *raw_pkt, const uint32_t len, csum = checksum::tcp_cksum((uint16_t *)(p->tcph), len, &ph6); - // TODO::DELETE - #if 0 - csum = in_chksum_tcp6(&ph6, (uint16_t *)(p->tcph), len); - uint16_t csum2 = PacketClass::tcp_cksum((uint16_t *)(p->tcph), len, &ph6); - DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "HELLO!! -> the two checksum are not equal %hu != %hu\n", - csum, csum2);); - - if(csum != csum2) - { - DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "TCP_CHECKSUM_ERROR!!! -> the two checksum are not equal %hu != %hu\n", - csum, csum2);); - uint16_t csum3 = PacketClass::tcp_cksum((uint16_t *)(p->tcph), len, &ph6); - } - #endif } if(csum) diff --git a/src/codecs/ip/cd_tcp_module.h b/src/codecs/ip/cd_tcp_module.h index 904cacff9..49b9b83a6 100644 --- a/src/codecs/ip/cd_tcp_module.h +++ b/src/codecs/ip/cd_tcp_module.h @@ -25,7 +25,7 @@ #include "codecs/decode_module.h" -#define CD_TCP_NAME "codec_tcp" +#define CD_TCP_NAME "cd_tcp" class TcpModule : public DecodeModule { diff --git a/src/codecs/ip/cd_udp.cc b/src/codecs/ip/cd_udp.cc index 9681fae40..a2f18695b 100644 --- a/src/codecs/ip/cd_udp.cc +++ b/src/codecs/ip/cd_udp.cc @@ -45,6 +45,7 @@ #include "packet_io/active.h" #include "codecs/codec_events.h" #include "codecs/ip/cd_udp_module.h" +#include "codecs/sf_protocols.h" namespace { @@ -56,6 +57,7 @@ public: ~UdpCodec(){}; + virtual PROTO_ID get_proto_id() { return PROTO_UDP; }; virtual void get_protocol_ids(std::vector& v); virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); @@ -63,11 +65,6 @@ public: virtual bool encode(EncState*, Buffer* out, const uint8_t *raw_in); virtual bool update(Packet*, Layer*, uint32_t* len); virtual void format(EncodeFlags, const Packet* p, Packet* c, Layer*); - - // DELETE - #include "codecs/sf_protocols.h" - virtual inline PROTO_ID get_proto_id() { return PROTO_UDP; }; - }; @@ -110,7 +107,7 @@ bool UdpCodec::decode(const uint8_t *raw_pkt, const uint32_t len, } /* set the ptr to the start of the UDP header */ - p->inner_udph = p->udph = reinterpret_cast(raw_pkt); + p->udph = reinterpret_cast(raw_pkt); if (!p->frag_flag) { diff --git a/src/codecs/ip/cd_udp_module.h b/src/codecs/ip/cd_udp_module.h index 8ccb2d6f0..7b1117545 100644 --- a/src/codecs/ip/cd_udp_module.h +++ b/src/codecs/ip/cd_udp_module.h @@ -25,7 +25,7 @@ #include "codecs/decode_module.h" -#define CD_UDP_NAME "codec_udp" +#define CD_UDP_NAME "cd_udp" class UdpModule : public DecodeModule { diff --git a/src/codecs/link/CMakeLists.txt b/src/codecs/link/CMakeLists.txt index c91f051b5..8b39e9d10 100644 --- a/src/codecs/link/CMakeLists.txt +++ b/src/codecs/link/CMakeLists.txt @@ -23,7 +23,7 @@ if( STATIC_DECODERS ) cd_vlan_module.cc ) - if(ENABLE_NON_ETHER_DECODER) + if(ENABLE_NON_ETHER_DECODERS) set( PLUGIN_SOURCES ${PLUGIN_SOURCES} cd_eapol.cc diff --git a/src/codecs/link/cd_arp.cc b/src/codecs/link/cd_arp.cc index d256f0b6e..03eea82a8 100644 --- a/src/codecs/link/cd_arp.cc +++ b/src/codecs/link/cd_arp.cc @@ -27,6 +27,9 @@ #include "framework/codec.h" #include "codecs/link/cd_arp_module.h" #include "codecs/codec_events.h" +#include "protocols/protocol_ids.h" +#include "codecs/sf_protocols.h" +#include "protocols/arp.h" namespace { @@ -38,27 +41,22 @@ public: ~ArpCodec(){}; + virtual PROTO_ID get_proto_id() { return PROTO_ARP; }; virtual void get_protocol_ids(std::vector& v); virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, Packet *, uint16_t &lyr_len, uint16_t &); - - // DELETE from here and below - #include "codecs/sf_protocols.h" - virtual inline PROTO_ID get_proto_id() { return PROTO_ARP; }; }; -static const uint16_t ETHERNET_TYPE_REVARP = 0x8035; -static const uint16_t ETHERNET_TYPE_ARP = 0x0806; } // anonymous namespace void ArpCodec::get_protocol_ids(std::vector& v) { - v.push_back(ETHERNET_TYPE_ARP); - v.push_back(ETHERNET_TYPE_REVARP); + v.push_back(ETHERTYPE_ARP); + v.push_back(ETHERTYPE_REVARP); } @@ -77,11 +75,9 @@ void ArpCodec::get_protocol_ids(std::vector& v) * * Returns: void function */ -bool ArpCodec::decode(const uint8_t *raw_pkt, const uint32_t len, +bool ArpCodec::decode(const uint8_t* /*raw_pkt*/, const uint32_t len, Packet *p, uint16_t &lyr_len, uint16_t& /* next_prot_id */) { - p->ah = (EtherARP *) raw_pkt; - if(len < sizeof(EtherARP)) { codec_events::decoder_event(p, DECODE_ARP_TRUNCATED); @@ -89,7 +85,7 @@ bool ArpCodec::decode(const uint8_t *raw_pkt, const uint32_t len, } p->proto_bits |= PROTO_BIT__ARP; - lyr_len = sizeof(*p->ah); + lyr_len = sizeof(EtherARP); return true; } diff --git a/src/codecs/link/cd_arp_module.h b/src/codecs/link/cd_arp_module.h index e73ed7757..4f1098d20 100644 --- a/src/codecs/link/cd_arp_module.h +++ b/src/codecs/link/cd_arp_module.h @@ -25,7 +25,7 @@ #include "codecs/decode_module.h" -#define CD_ARP_NAME "codec_arp" +#define CD_ARP_NAME "cd_arp" class ArpModule : public DecodeModule { diff --git a/src/codecs/link/cd_eapol.cc b/src/codecs/link/cd_eapol.cc index 5a199b92a..b78d201fb 100644 --- a/src/codecs/link/cd_eapol.cc +++ b/src/codecs/link/cd_eapol.cc @@ -27,6 +27,8 @@ #include "framework/codec.h" #include "codecs/link/cd_eapol_module.h" #include "codecs/codec_events.h" +#include "protocols/protocol_ids.h" +#include "protocols/eapol.h" namespace @@ -46,79 +48,6 @@ public: }; -static const uint16_t ETHERTYPE_EAPOL = 0x888e; - - -#ifndef NO_NON_ETHER_DECODER - -/* IEEE 802.1x eapol types */ -#define EAPOL_TYPE_EAP 0x00 /* EAP packet */ -#define EAPOL_TYPE_START 0x01 /* EAPOL start */ -#define EAPOL_TYPE_LOGOFF 0x02 /* EAPOL Logoff */ -#define EAPOL_TYPE_KEY 0x03 /* EAPOL Key */ -#define EAPOL_TYPE_ASF 0x04 /* EAPOL Encapsulated ASF-Alert */ - - -#endif // NO_NON_ETHER_DECODER - - -/* Extensible Authentication Protocol Codes RFC 2284*/ -#define EAP_CODE_REQUEST 0x01 -#define EAP_CODE_RESPONSE 0x02 -#define EAP_CODE_SUCCESS 0x03 -#define EAP_CODE_FAILURE 0x04 -/* EAP Types */ -#define EAP_TYPE_IDENTITY 0x01 -#define EAP_TYPE_NOTIFY 0x02 -#define EAP_TYPE_NAK 0x03 -#define EAP_TYPE_MD5 0x04 -#define EAP_TYPE_OTP 0x05 -#define EAP_TYPE_GTC 0x06 -#define EAP_TYPE_TLS 0x0d - - - -/* Extensible Authentication Protocol Codes RFC 2284*/ -#define EAP_CODE_REQUEST 0x01 -#define EAP_CODE_RESPONSE 0x02 -#define EAP_CODE_SUCCESS 0x03 -#define EAP_CODE_FAILURE 0x04 -/* EAP Types */ -#define EAP_TYPE_IDENTITY 0x01 -#define EAP_TYPE_NOTIFY 0x02 -#define EAP_TYPE_NAK 0x03 -#define EAP_TYPE_MD5 0x04 -#define EAP_TYPE_OTP 0x05 -#define EAP_TYPE_GTC 0x06 -#define EAP_TYPE_TLS 0x0d - - - -struct EtherEapol -{ - uint8_t version; /* EAPOL proto version */ - uint8_t eaptype; /* EAPOL Packet type */ - uint16_t len; /* Packet body length */ -}; - -struct EAPHdr -{ - uint8_t code; - uint8_t id; - uint16_t len; -}; - -struct EapolKey -{ - uint8_t type; - uint8_t length[2]; - uint8_t counter[8]; - uint8_t iv[16]; - uint8_t index; - uint8_t sig[16]; -}; - - } // namespace /************************************************* @@ -138,16 +67,15 @@ struct EapolKey */ void DecodeEAP(const uint8_t * pkt, const uint32_t len, Packet * p) { - const EAPHdr *eaph = reinterpret_cast(pkt); - p->eaph = (EAPHdr *) pkt; - if(len < sizeof(EAPHdr)) + const eapol::EAPHdr *eaph = reinterpret_cast(pkt); + + if(len < sizeof(eapol::EAPHdr)) { codec_events::decoder_event(p, DECODE_EAP_TRUNCATED); return; } if (eaph->code == EAP_CODE_REQUEST || eaph->code == EAP_CODE_RESPONSE) { - p->eaptype = pkt + sizeof(EAPHdr); } return; } @@ -164,10 +92,9 @@ void DecodeEAP(const uint8_t * pkt, const uint32_t len, Packet * p) * * Returns: void function */ -void DecodeEapolKey(const uint8_t * pkt, uint32_t len, Packet * p) +void DecodeEapolKey(const uint8_t* /*pkt*/, uint32_t len, Packet * p) { - p->eapolk = (EapolKey *) pkt; - if(len < sizeof(EapolKey)) + if(len < sizeof(eapol::EapolKey)) { codec_events::decoder_event(p, DECODE_EAPKEY_TRUNCATED); } @@ -183,19 +110,19 @@ void DecodeEapolKey(const uint8_t * pkt, uint32_t len, Packet * p) bool EapolCodec::decode(const uint8_t *raw_pkt, const uint32_t len, Packet *p, uint16_t & /*lyr_len*/, uint16_t &/*next_prot_id */) { - p->eplh = (EtherEapol *) raw_pkt; + const eapol::EtherEapol* eplh = reinterpret_cast(raw_pkt); - if(len < sizeof(EtherEapol)) + if(len < sizeof(eapol::EtherEapol)) { codec_events::decoder_event(p, DECODE_EAPOL_TRUNCATED); return false; } - if (p->eplh->eaptype == EAPOL_TYPE_EAP) { - DecodeEAP(raw_pkt + sizeof(EtherEapol), len - sizeof(EtherEapol), p); + if (eplh->eaptype == EAPOL_TYPE_EAP) { + DecodeEAP(raw_pkt + sizeof(eapol::EtherEapol), len - sizeof(eapol::EtherEapol), p); } - else if(p->eplh->eaptype == EAPOL_TYPE_KEY) { - DecodeEapolKey(raw_pkt + sizeof(EtherEapol), len - sizeof(EtherEapol), p); + else if(eplh->eaptype == EAPOL_TYPE_KEY) { + DecodeEapolKey(raw_pkt + sizeof(eapol::EtherEapol), len - sizeof(eapol::EtherEapol), p); } return true; @@ -238,7 +165,7 @@ static const CodecApi eapol_api = { { PT_CODEC, - CD_NAME_EAPOL, + CD_EAPOL_NAME, CDAPI_PLUGIN_V0, 0, mod_ctor, diff --git a/src/codecs/link/cd_eapol_module.h b/src/codecs/link/cd_eapol_module.h index 1d419f895..cbbbc5acb 100644 --- a/src/codecs/link/cd_eapol_module.h +++ b/src/codecs/link/cd_eapol_module.h @@ -25,7 +25,7 @@ #include "codecs/decode_module.h" -#define CD_EAPOL_NAME "codec_eapol" +#define CD_EAPOL_NAME "cd_eapol" class EapolModule : public DecodeModule { diff --git a/src/codecs/link/cd_erspan2.cc b/src/codecs/link/cd_erspan2.cc index a257d5a52..85fffbe9b 100644 --- a/src/codecs/link/cd_erspan2.cc +++ b/src/codecs/link/cd_erspan2.cc @@ -24,6 +24,7 @@ #include "codecs/link/cd_erspan2_module.h" #include "codecs/codec_events.h" #include "protocols/protocol_ids.h" +#include "codecs/sf_protocols.h" namespace { @@ -34,13 +35,11 @@ public: Erspan2Codec() : Codec(CD_ERSPAN2_NAME){}; ~Erspan2Codec(){}; + virtual PROTO_ID get_proto_id() { return PROTO_ERSPAN; }; virtual void get_protocol_ids(std::vector& v); virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); - // DELETE from here and below - #include "codecs/sf_protocols.h" - virtual inline PROTO_ID get_proto_id() { return PROTO_ERSPAN; }; }; @@ -54,6 +53,12 @@ struct ERSpanType2Hdr const uint16_t ETHERTYPE_ERSPAN_TYPE2 = 0x88be; } // namespace + +static inline uint16_t erspan_version(ERSpanType2Hdr *hdr) +{ + return (ntohs(hdr->ver_vlan) & 0xf000) >> 12; +} + void Erspan2Codec::get_protocol_ids(std::vector& v) { v.push_back(ETHERTYPE_ERSPAN_TYPE2); @@ -96,7 +101,7 @@ bool Erspan2Codec::decode(const uint8_t *raw_pkt, const uint32_t len, /* Check that this is in fact ERSpan Type 2. */ - if (ERSPAN_VERSION(erSpan2Hdr) != 0x01) /* Type 2 == version 0x01 */ + if (erspan_version(erSpan2Hdr) != 0x01) /* Type 2 == version 0x01 */ { codec_events::decoder_alert_encapsulated(p, DECODE_ERSPAN_HDR_VERSION_MISMATCH, raw_pkt, len); diff --git a/src/codecs/link/cd_erspan2_module.h b/src/codecs/link/cd_erspan2_module.h index 2ff2f6454..ec4acf4bd 100644 --- a/src/codecs/link/cd_erspan2_module.h +++ b/src/codecs/link/cd_erspan2_module.h @@ -25,7 +25,7 @@ #include "codecs/decode_module.h" -#define CD_ERSPAN2_NAME "codec_erspan2" +#define CD_ERSPAN2_NAME "cd_erspan2" class Erspan2Module : public DecodeModule { diff --git a/src/codecs/link/cd_erspan3.cc b/src/codecs/link/cd_erspan3.cc index 839293074..63dc7224e 100644 --- a/src/codecs/link/cd_erspan3.cc +++ b/src/codecs/link/cd_erspan3.cc @@ -25,7 +25,7 @@ #include "codecs/link/cd_erspan3_module.h" #include "codecs/codec_events.h" #include "protocols/protocol_ids.h" - +#include "codecs/sf_protocols.h" namespace { @@ -41,9 +41,7 @@ public: virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); - // DELETE from here and below - #include "codecs/sf_protocols.h" - virtual inline PROTO_ID get_proto_id() { return PROTO_ERSPAN; }; + virtual PROTO_ID get_proto_id() { return PROTO_ERSPAN; }; }; @@ -61,6 +59,29 @@ struct ERSpanType3Hdr const uint16_t ETHERTYPE_ERSPAN_TYPE3 = 0x22eb; } // anonymous namespace +static inline uint16_t erspan_version(ERSpanType3Hdr *hdr) +{ + return (ntohs(hdr->ver_vlan) & 0xf000) >> 12; +} + +#if 0 +// keeping these functions around for use in further development + +static inline uint16_t erspan_vlan(ERSpanType3Hdr *hdr) +{ + return ntohs(hdr->ver_vlan) & 0x0fff; +} + +static inline uint16_t erspan_span_id(ERSpanType3Hdr *hdr) +{ + return ntohs(hdr->flags_spanId) & 0x03ff; +} + +static inline uint32_t erspan3_timestamp(ERSpanType3Hdr *hdr) +{ + return hdr->timestamp; +} +#endif void Erspan3Codec::get_protocol_ids(std::vector& v) { @@ -105,7 +126,7 @@ bool Erspan3Codec::decode(const uint8_t *raw_pkt, const uint32_t len, /* Check that this is in fact ERSpan Type 3. */ - if (ERSPAN_VERSION(erSpan3Hdr) != 0x02) /* Type 3 == version 0x02 */ + if (erspan_version(erSpan3Hdr) != 0x02) /* Type 3 == version 0x02 */ { codec_events::decoder_alert_encapsulated(p, DECODE_ERSPAN_HDR_VERSION_MISMATCH, raw_pkt, len); diff --git a/src/codecs/link/cd_erspan3_module.h b/src/codecs/link/cd_erspan3_module.h index 51f8c8f38..f578b9f57 100644 --- a/src/codecs/link/cd_erspan3_module.h +++ b/src/codecs/link/cd_erspan3_module.h @@ -25,7 +25,7 @@ #include "codecs/decode_module.h" -#define CD_ERSPAN3_NAME "codec_erspan3" +#define CD_ERSPAN3_NAME "cd_erspan3" class Erspan3Module : public DecodeModule { diff --git a/src/codecs/link/cd_ethloopback.cc b/src/codecs/link/cd_ethloopback.cc index 9a98a7bc1..82a2bfe9d 100644 --- a/src/codecs/link/cd_ethloopback.cc +++ b/src/codecs/link/cd_ethloopback.cc @@ -27,7 +27,7 @@ namespace { -#define CD_ETHLOOPBACK_NAME "codec_ethloopback" +#define CD_ETHLOOPBACK_NAME "cd_ethloopback" class EthLoopbackCodec : public Codec diff --git a/src/codecs/link/cd_mpls.cc b/src/codecs/link/cd_mpls.cc index 00d14e450..4224d43e3 100644 --- a/src/codecs/link/cd_mpls.cc +++ b/src/codecs/link/cd_mpls.cc @@ -32,6 +32,7 @@ #include "protocols/protocol_ids.h" #include "protocols/mpls.h" #include "codecs/link/cd_mpls_module.h" +#include "codecs/sf_protocols.h" namespace { @@ -42,13 +43,11 @@ public: MplsCodec() : Codec(CD_MPLS_NAME){}; ~MplsCodec(){}; + virtual PROTO_ID get_proto_id() { return PROTO_MPLS; }; virtual void get_protocol_ids(std::vector& v); virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); - // DELETE from here and below - #include "codecs/sf_protocols.h" - virtual inline PROTO_ID get_proto_id() { return PROTO_MPLS; }; }; @@ -72,7 +71,7 @@ void MplsCodec::get_protocol_ids(std::vector& v) bool MplsCodec::decode(const uint8_t *raw_pkt, const uint32_t len, Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) { - uint32_t* tmpMplsHdr; + const uint32_t* tmpMplsHdr; uint32_t mpls_h; uint32_t label; lyr_len= 0; @@ -86,8 +85,7 @@ bool MplsCodec::decode(const uint8_t *raw_pkt, const uint32_t len, int iRet = 0; UpdateMPLSStats(&sfBase, len, Active_PacketWasDropped()); - tmpMplsHdr = (uint32_t *) raw_pkt; - p->mpls = NULL; + tmpMplsHdr = (const uint32_t *) raw_pkt; while (!bos) { @@ -119,7 +117,7 @@ bool MplsCodec::decode(const uint8_t *raw_pkt, const uint32_t len, /** p->mpls = &(p->mplsHdr); **/ - p->mpls = tmpMplsHdr; + p->proto_bits |= PROTO_BIT__MPLS; if(!iRet) { iRet = ScMplsPayloadType(); @@ -132,6 +130,7 @@ bool MplsCodec::decode(const uint8_t *raw_pkt, const uint32_t len, { codec_events::decoder_event(p, DECODE_MPLS_LABEL_STACK); + p->proto_bits &= ~PROTO_BIT__MPLS; p->iph = NULL; p->family = NO_IP; return false; diff --git a/src/codecs/link/cd_mpls_module.cc b/src/codecs/link/cd_mpls_module.cc index cf46002aa..e2eee6f71 100644 --- a/src/codecs/link/cd_mpls_module.cc +++ b/src/codecs/link/cd_mpls_module.cc @@ -57,7 +57,7 @@ static const RuleMap mpls_rules[] = }; //------------------------------------------------------------------------- -// rpc module +// mpls module //------------------------------------------------------------------------- MplsModule::MplsModule() : DecodeModule(CD_MPLS_NAME, mpls_params, mpls_rules) @@ -87,4 +87,3 @@ bool MplsModule::set(const char*, Value& v, SnortConfig* sc) return true; } - diff --git a/src/codecs/link/cd_mpls_module.h b/src/codecs/link/cd_mpls_module.h index cc64c6bf7..8ec811b7e 100644 --- a/src/codecs/link/cd_mpls_module.h +++ b/src/codecs/link/cd_mpls_module.h @@ -25,7 +25,7 @@ #include "codecs/decode_module.h" -#define CD_MPLS_NAME "codec_mpls" +#define CD_MPLS_NAME "cd_mpls" class MplsModule : public DecodeModule { diff --git a/src/codecs/link/cd_pppencap.cc b/src/codecs/link/cd_pppencap.cc index dfd41647d..651266711 100644 --- a/src/codecs/link/cd_pppencap.cc +++ b/src/codecs/link/cd_pppencap.cc @@ -27,11 +27,12 @@ #include "framework/codec.h" #include "protocols/protocol_ids.h" #include "snort.h" +#include "codecs/sf_protocols.h" namespace { -#define CD_PPPENCAP_NAME "codec_ppp_encap" +#define CD_PPPENCAP_NAME "cd_pppencap" class PppEncap : public Codec { @@ -39,13 +40,10 @@ public: PppEncap() : Codec(CD_PPPENCAP_NAME){}; ~PppEncap(){}; + virtual PROTO_ID get_proto_id() { return PROTO_PPP_ENCAP; }; virtual void get_protocol_ids(std::vector& v); virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); - - // DELETE from here and below - #include "codecs/sf_protocols.h" - virtual inline PROTO_ID get_proto_id() { return PROTO_PPP_ENCAP; }; }; diff --git a/src/codecs/link/cd_pppoepkt.cc b/src/codecs/link/cd_pppoepkt.cc index fd12d1b89..65e260994 100644 --- a/src/codecs/link/cd_pppoepkt.cc +++ b/src/codecs/link/cd_pppoepkt.cc @@ -25,32 +25,32 @@ #include "codecs/link/cd_pppoepkt_module.h" #include "codecs/codec_events.h" #include "protocols/packet.h" +#include "codecs/sf_protocols.h" +#include "protocols/layer.h" namespace { -class PPPoEPktCodec : public Codec +enum class PppoepktType { -public: - PPPoEPktCodec() : Codec(CD_PPPOEPKT_NAME){}; - ~PPPoEPktCodec(){}; - + DISCOVERY, + SESSION, +}; - virtual void get_protocol_ids(std::vector& v); - virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, - Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); - virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in); - - // DELETE from here and below - #include "codecs/sf_protocols.h" - virtual inline PROTO_ID get_proto_id() { return PROTO_PPPOE; }; +/* PPPoEHdr Header; eth::EtherHdr plus the PPPoE Header */ +struct PPPoEHdr +{ + unsigned char ver_type; /* pppoe version/type */ + unsigned char code; /* pppoe code CODE_* */ + unsigned short session; /* session id */ + unsigned short length; /* payload length */ + /* payload follows */ }; +} // namespace -const uint16_t PPPOE_HEADER_LEN = 6; -const uint16_t ETHERNET_TYPE_PPPoE_DISC = 0x8863; /* discovery stage */ -const uint16_t ETHERNET_TYPE_PPPoE_SESS = 0x8864; /* session stage */ +const uint16_t PPPOE_HEADER_LEN = 6; /* PPPoE types */ const uint16_t PPPoE_CODE_SESS = 0x00; /* PPPoE session */ @@ -62,7 +62,6 @@ const uint16_t PPPoE_CODE_PADT = 0xa7; /* PPPoE Active Discovery Terminate */ #if 0 /* PPPoE tag types - currently not used*/ - const uint16_t PPPoE_TAG_END_OF_LIST = 0x0000; const uint16_t PPPoE_TAG_SERVICE_NAME = 0x0101; const uint16_t PPPoE_TAG_AC_NAME = 0x0102; @@ -75,37 +74,13 @@ const uint16_t PPPoE_TAG_AC_SYSTEM_ERROR = 0x0202; const uint16_t PPPoE_TAG_GENERIC_ERROR = 0x0203; #endif -} // namespace - -void PPPoEPktCodec::get_protocol_ids(std::vector& v) -{ - v.push_back(ETHERNET_TYPE_PPPoE_DISC); - v.push_back(ETHERNET_TYPE_PPPoE_SESS); -} - - -//-------------------------------------------------------------------- -// decode.c::PPP related -//-------------------------------------------------------------------- - -/* - * Function: DecodePPPoEPkt(Packet *, char *, DAQ_PktHdr_t*, uint8_t*) - * - * Purpose: Decode those fun loving ethernet packets, one at a time! - * - * Arguments: p => pointer to the decoded packet struct - * user => Utility pointer (unused) - * pkthdr => ptr to the packet header - * pkt => pointer to the real live packet data - * - * Returns: void function - * - * see http://www.faqs.org/rfcs/rfc2516.html - * - */ -bool PPPoEPktCodec::decode(const uint8_t *raw_pkt, const uint32_t len, - Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) +static inline bool pppoepkt_decode(const uint8_t *raw_pkt, + const uint32_t len, + Packet *p, + PppoepktType ppp_type, + uint16_t &lyr_len, + uint16_t &next_prot_id) { //PPPoE_Tag *ppppoe_tag=0; //PPPoE_Tag tag; /* needed to avoid alignment problems */ @@ -125,29 +100,24 @@ bool PPPoEPktCodec::decode(const uint8_t *raw_pkt, const uint32_t len, return false; } - DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "%X %X\n", - *p->eh->ether_src, *p->eh->ether_dst);); /* lay the PPP over ethernet structure over the packet data */ - p->pppoeh = (PPPoEHdr *)raw_pkt; + const PPPoEHdr *pppoeh = reinterpret_cast(raw_pkt); /* grab out the network type */ - switch(ntohs(p->eh->ether_type)) + switch(ppp_type) { - case ETHERNET_TYPE_PPPoE_DISC: + case PppoepktType::DISCOVERY: DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "(PPPOE Discovery) ");); break; - case ETHERNET_TYPE_PPPoE_SESS: + case PppoepktType::SESSION: DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "(PPPOE Session) ");); break; - - default: - return false; } #ifdef DEBUG_MSGS - switch(p->pppoeh->code) + switch(pppoeh->code) { case PPPoE_CODE_PADI: /* The Host sends the PADI packet with the DESTINATION_ADDR set @@ -248,21 +218,26 @@ bool PPPoEPktCodec::decode(const uint8_t *raw_pkt, const uint32_t len, DebugMessage(DEBUG_DECODE, "(Unknown)\n"); break; } +#else + UNUSED(pppoeh); + UNUSED(PPPoE_CODE_SESS); + UNUSED(PPPoE_CODE_PADI); + UNUSED(PPPoE_CODE_PADO); + UNUSED(PPPoE_CODE_PADR); + UNUSED(PPPoE_CODE_PADS); + UNUSED(PPPoE_CODE_PADT); #endif - if (ntohs(p->eh->ether_type) != ETHERNET_TYPE_PPPoE_DISC) + if (ppp_type != PppoepktType::DISCOVERY) { -// PushLayer(PROTO_PPPOE, p, pkt, PPPOE_HEADER_LEN); -// DecodePppPktEncapsulated(pkt + PPPOE_HEADER_LEN, len - PPPOE_HEADER_LEN, p); - - // TODO: Why is this specifically PppPktEncapsulated? lyr_len = PPPOE_HEADER_LEN; - next_prot_id = ntohs(p->eh->ether_type); + next_prot_id = ETHERTYPE_PPP; return true; } - return false; + DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Returning early on PPPOE discovery packet\n");); + return true; } @@ -270,7 +245,7 @@ bool PPPoEPktCodec::decode(const uint8_t *raw_pkt, const uint32_t len, ******************** E N C O D E R ****************************** ******************************************************************/ -bool PPPoEPktCodec::encode(EncState* enc, Buffer* out, const uint8_t* raw_in) +static inline bool pppoepkt_encode(EncState* enc, Buffer* out, const uint8_t* raw_in) { int lyr_len = enc->p->layers[enc->layer-1].length; @@ -287,12 +262,67 @@ bool PPPoEPktCodec::encode(EncState* enc, Buffer* out, const uint8_t* raw_in) } +/******************************************************************* + ******************************************************************* + ************* CODECS **************** + ******************************************************************* + *******************************************************************/ + + + + +namespace +{ + +const uint16_t ETHERNET_TYPE_PPPoE_DISC = 0x8863; /* discovery stage */ + +#define CD_PPPOEPKT_DISC_NAME "cd_pppoepkt (disc)" + +class PPPoEPktDiscCodec : public Codec +{ +public: + PPPoEPktDiscCodec() : Codec(CD_PPPOEPKT_DISC_NAME){}; + ~PPPoEPktDiscCodec() {}; + + + virtual PROTO_ID get_proto_id() { return PROTO_PPPOE; }; + virtual void get_protocol_ids(std::vector& v); + virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, + Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); + virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in); +}; + + +} // namespace + +void PPPoEPktDiscCodec::get_protocol_ids(std::vector& v) +{ + v.push_back(ETHERNET_TYPE_PPPoE_DISC); +} + + +bool PPPoEPktDiscCodec::decode(const uint8_t *raw_pkt, const uint32_t raw_len, + Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) +{ + return pppoepkt_decode(raw_pkt, raw_len, p, PppoepktType::DISCOVERY, + lyr_len, next_prot_id); +} + +bool PPPoEPktDiscCodec::encode(EncState *enc, Buffer* out, const uint8_t* raw_in) +{ + return pppoepkt_encode(enc, out, raw_in); +} //------------------------------------------------------------------------- // api //------------------------------------------------------------------------- + +// *** NOTE: THE CODEC HAS A DIFFERENT NAME! +// However, since the module is creating a rule stub and is NOT +// used for configurtion, it doesn't matter. If you want to use the module +// for configuration, ensure the names are identical before continuing! static Module* mod_ctor() { return new PPPoEPktModule; @@ -303,44 +333,142 @@ static void mod_dtor(Module* m) delete m; } -static Codec* ctor(Module *) +static Codec* disc_ctor(Module*) { - return new PPPoEPktCodec(); + return new PPPoEPktDiscCodec(); } -static void dtor(Codec *cd) +static void disc_dtor(Codec *cd) { delete cd; } -static const CodecApi pppoe_api = + +static const CodecApi pppoepkt_disc_api = { { PT_CODEC, - CD_PPPOEPKT_NAME, + CD_PPPOEPKT_DISC_NAME, CDAPI_PLUGIN_V0, 0, mod_ctor, mod_dtor, }, - nullptr, // pinit - nullptr, // pterm - nullptr, // tinit - nullptr, // tterm - ctor, // ctor - dtor, // dtor + nullptr, + nullptr, + nullptr, + nullptr, + disc_ctor, + disc_dtor, }; #ifdef BUILDING_SO SO_PUBLIC const BaseApi* snort_plugins[] = { - &pppoe_api.base, + &pppoepkt_disc_api.base, nullptr }; #else -const BaseApi* cd_pppoe = &pppoe_api.base; +const BaseApi* cd_pppoepkt_disc = &pppoepkt_disc_api.base; #endif +/******************************************************************* + ******************************************************************* + ******************************************************************* + *******************************************************************/ + + + + +namespace +{ + + +#define CD_PPPOEPKT_SESS_NAME "cd_pppoepkt (sess)" +const uint16_t ETHERNET_TYPE_PPPoE_SESS = 0x8864; /* session stage */ + +class PPPoEPktSessCodec : public Codec +{ +public: + PPPoEPktSessCodec() : Codec(CD_PPPOEPKT_SESS_NAME){}; + ~PPPoEPktSessCodec() {}; + + + virtual PROTO_ID get_proto_id() { return PROTO_PPPOE; }; + virtual void get_protocol_ids(std::vector& v); + virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, + Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); + virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in); +}; + + +} // namespace + +void PPPoEPktSessCodec::get_protocol_ids(std::vector& v) +{ + v.push_back(ETHERNET_TYPE_PPPoE_SESS); +} + + +bool PPPoEPktSessCodec::decode(const uint8_t *raw_pkt, const uint32_t raw_len, + Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) +{ + return pppoepkt_decode(raw_pkt, raw_len, p, PppoepktType::SESSION, + lyr_len, next_prot_id); +} + + + +bool PPPoEPktSessCodec::encode(EncState *enc, Buffer* out, const uint8_t* raw_in) +{ + return pppoepkt_encode(enc, out, raw_in); +} + + +//------------------------------------------------------------------------- +// api +//------------------------------------------------------------------------- + + +static Codec* sess_ctor(Module*) +{ + return new PPPoEPktSessCodec(); +} + +static void sess_dtor(Codec *cd) +{ + delete cd; +} + + +static const CodecApi pppoepkt_sess_api = +{ + { + PT_CODEC, + CD_PPPOEPKT_SESS_NAME, + CDAPI_PLUGIN_V0, + 0, + nullptr, + nullptr, + }, + nullptr, + nullptr, + nullptr, + nullptr, + sess_ctor, + sess_dtor, +}; + + +#ifdef BUILDING_SO +SO_PUBLIC const BaseApi* snort_plugins[] = +{ + &pppoepkt_sess_api.base, + nullptr +}; +#else +const BaseApi* cd_pppoepkt_sess = &pppoepkt_sess_api.base; +#endif diff --git a/src/codecs/link/cd_pppoepkt_module.cc b/src/codecs/link/cd_pppoepkt_module.cc index 25120b259..c897d627d 100644 --- a/src/codecs/link/cd_pppoepkt_module.cc +++ b/src/codecs/link/cd_pppoepkt_module.cc @@ -35,9 +35,15 @@ static const RuleMap pppoepkt_rules[] = }; //------------------------------------------------------------------------- -// rpc module +// General PPPoEpkt module. +// +// ***** NOTE: THE CODEC HAS A DIFFERENT NAME! +// * Additionally, this module is used for generator a rule stub ONLY! +// * If you want to create a module for configuration, you must change the +// * names of the correct PPPoEpkt codec //------------------------------------------------------------------------- +/// ^^^ READ THE COMMENT! PPPoEPktModule::PPPoEPktModule() : DecodeModule(CD_PPPOEPKT_NAME, pppoepkt_params, pppoepkt_rules) { } diff --git a/src/codecs/link/cd_pppoepkt_module.h b/src/codecs/link/cd_pppoepkt_module.h index aa9988c61..3137d4b5e 100644 --- a/src/codecs/link/cd_pppoepkt_module.h +++ b/src/codecs/link/cd_pppoepkt_module.h @@ -25,7 +25,15 @@ #include "codecs/decode_module.h" -#define CD_PPPOEPKT_NAME "codec_pppoepkt" +/* + * NOTE: This name reflect the file...NOT the Codec! + * + * Additionally, this module is used for generator a rule stub ONLY! + * If you want to create a module for configuration, you must change the + * names of the correct PPPoEpkt codec + */ + +#define CD_PPPOEPKT_NAME "cd_pppoepkt" class PPPoEPktModule : public DecodeModule { diff --git a/src/codecs/link/cd_transbridge.cc b/src/codecs/link/cd_transbridge.cc index 5e6489554..ee438f488 100644 --- a/src/codecs/link/cd_transbridge.cc +++ b/src/codecs/link/cd_transbridge.cc @@ -36,7 +36,7 @@ namespace { -#define CD_TRANSBRIDGE_NAME "codec_transbridge" +#define CD_TRANSBRIDGE_NAME "cd_transbridge" class TransbridgeCodec : public Codec { @@ -76,23 +76,24 @@ void TransbridgeCodec::get_protocol_ids(std::vector& v) * convention needed to be changed and the stuff at the beginning * wasn't needed since we are already deep into the packet */ -bool TransbridgeCodec::decode(const uint8_t *raw_pkt, const uint32_t len, +bool TransbridgeCodec::decode(const uint8_t *raw_pkt, const uint32_t raw_len, Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) { - if(len < eth::hdr_len()) + if(raw_len < eth::hdr_len()) { codec_events::decoder_alert_encapsulated(p, DECODE_GRE_TRANS_DGRAM_LT_TRANSHDR, - raw_pkt, len); + raw_pkt, raw_len); return false; } /* The Packet struct's ethernet header will now point to the inner ethernet * header of the packet */ - p->eh = (eth::EtherHdr *)raw_pkt; + const eth::EtherHdr *eh = reinterpret_cast(raw_pkt); + p->proto_bits |= PROTO_BIT__ETH; lyr_len = eth::hdr_len(); - next_prot_id = ntohs(p->eh->ether_type); + next_prot_id = ntohs(eh->ether_type); return true; } diff --git a/src/codecs/link/cd_vlan.cc b/src/codecs/link/cd_vlan.cc index e2de8430f..82d43ea5a 100644 --- a/src/codecs/link/cd_vlan.cc +++ b/src/codecs/link/cd_vlan.cc @@ -29,6 +29,9 @@ #include "framework/codec.h" #include "codecs/link/cd_vlan_module.h" #include "codecs/codec_events.h" +#include "protocols/vlan.h" +#include "protocols/protocol_ids.h" +#include "codecs/sf_protocols.h" namespace { @@ -39,39 +42,47 @@ public: VlanCodec() : Codec(CD_VLAN_NAME){}; ~VlanCodec(){}; + virtual PROTO_ID get_proto_id() { return PROTO_VLAN; }; virtual void get_protocol_ids(std::vector& v); virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); - virtual void format(EncodeFlags, const Packet* p, Packet* c, Layer*); +}; + +struct EthLlc +{ + uint8_t dsap; + uint8_t ssap; +} ; - - // DELETE from here and below - #include "codecs/sf_protocols.h" - virtual inline PROTO_ID get_proto_id() { return PROTO_VLAN; }; + +struct EthLlcOther +{ + uint8_t ctrl; + uint8_t org_code[3]; + uint16_t proto_id; }; } // namespace -static const uint16_t ETHERNET_TYPE_8021Q = 0x8100; static const unsigned int ETHERNET_MAX_LEN_ENCAP = 1518; /* 802.3 (+LLC) or ether II ? */ static inline uint32_t len_vlan_llc_other() { - return (sizeof(VlanTagHdr) + sizeof(EthLlc) + sizeof(EthLlcOther)); + return (sizeof(vlan::VlanTagHdr) + sizeof(EthLlc) + sizeof(EthLlcOther)); } void VlanCodec::get_protocol_ids(std::vector& v) { - v.push_back(ETHERNET_TYPE_8021Q); + v.push_back(ETHERTYPE_8021Q); } bool VlanCodec::decode(const uint8_t *raw_pkt, const uint32_t len, Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) { - if(len < sizeof(VlanTagHdr)) + if(len < sizeof(vlan::VlanTagHdr)) { codec_events::decoder_event(p, DECODE_BAD_VLAN); @@ -81,24 +92,24 @@ bool VlanCodec::decode(const uint8_t *raw_pkt, const uint32_t len, return false; } - p->vh = (VlanTagHdr *) raw_pkt; + const vlan::VlanTagHdr *vh = reinterpret_cast(raw_pkt); DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Vlan traffic:\n"); DebugMessage(DEBUG_DECODE, " Priority: %d(0x%X)\n", - VTH_PRIORITY(p->vh), VTH_PRIORITY(p->vh)); - DebugMessage(DEBUG_DECODE, " CFI: %d\n", VTH_CFI(p->vh)); + vlan::vth_priority(vh), vlan::vth_priority(vh)); + DebugMessage(DEBUG_DECODE, " CFI: %d\n", vlan::vth_cfi(vh)); DebugMessage(DEBUG_DECODE, " Vlan ID: %d(0x%04X)\n", - VTH_VLAN(p->vh), VTH_VLAN(p->vh)); + vlan::vth_vlan(vh), vlan::vth_vlan(vh)); DebugMessage(DEBUG_DECODE, " Vlan Proto: 0x%04X\n", - ntohs(p->vh->vth_proto)); + ntohs(vh->vth_proto)); ); /* check to see if we've got an encapsulated LLC layer * http://www.geocities.com/billalexander/ethernet.html */ - if(ntohs(p->vh->vth_proto) <= ETHERNET_MAX_LEN_ENCAP) + if(ntohs(vh->vth_proto) <= ETHERNET_MAX_LEN_ENCAP) { - if(len < sizeof(VlanTagHdr) + sizeof(EthLlc)) + if(len < sizeof(vlan::VlanTagHdr) + sizeof(EthLlc)) { codec_events::decoder_event(p, DECODE_BAD_VLAN_ETHLLC); @@ -107,15 +118,15 @@ bool VlanCodec::decode(const uint8_t *raw_pkt, const uint32_t len, return false; } - p->ehllc = (EthLlc *) (raw_pkt + sizeof(VlanTagHdr)); + const EthLlc *ehllc = reinterpret_cast(raw_pkt + sizeof(vlan::VlanTagHdr)); DEBUG_WRAP( DebugMessage(DEBUG_DECODE, "LLC Header:\n"); - DebugMessage(DEBUG_DECODE, " DSAP: 0x%X\n", p->ehllc->dsap); - DebugMessage(DEBUG_DECODE, " SSAP: 0x%X\n", p->ehllc->ssap); + DebugMessage(DEBUG_DECODE, " DSAP: 0x%X\n", ehllc->dsap); + DebugMessage(DEBUG_DECODE, " SSAP: 0x%X\n", ehllc->ssap); ); - if(p->ehllc->dsap == ETH_DSAP_IP && p->ehllc->ssap == ETH_SSAP_IP) + if(ehllc->dsap == ETH_DSAP_IP && ehllc->ssap == ETH_SSAP_IP) { if ( len < len_vlan_llc_other() ) { @@ -127,43 +138,35 @@ bool VlanCodec::decode(const uint8_t *raw_pkt, const uint32_t len, return false; } - p->ehllcother = (EthLlcOther *) (raw_pkt + sizeof(VlanTagHdr) + sizeof(EthLlc)); + const EthLlcOther *ehllcother = reinterpret_cast(raw_pkt + sizeof(vlan::VlanTagHdr) + sizeof(EthLlc)); DEBUG_WRAP( DebugMessage(DEBUG_DECODE, "LLC Other Header:\n"); DebugMessage(DEBUG_DECODE, " CTRL: 0x%X\n", - p->ehllcother->ctrl); + ehllcother->ctrl); DebugMessage(DEBUG_DECODE, " ORG: 0x%02X%02X%02X\n", - p->ehllcother->org_code[0], p->ehllcother->org_code[1], - p->ehllcother->org_code[2]); + ehllcother->org_code[0], ehllcother->org_code[1], + ehllcother->org_code[2]); DebugMessage(DEBUG_DECODE, " PROTO: 0x%04X\n", - ntohs(p->ehllcother->proto_id)); + ntohs(ehllcother->proto_id)); ); lyr_len = len_vlan_llc_other(); - next_prot_id = ntohs(p->ehllcother->proto_id); + next_prot_id = ntohs(ehllcother->proto_id); } } else { - lyr_len = sizeof(VlanTagHdr); - next_prot_id = ntohs(p->vh->vth_proto); + lyr_len = sizeof(vlan::VlanTagHdr); + next_prot_id = ntohs(vh->vth_proto); } + p->proto_bits |= PROTO_BIT__VLAN; return true; } -/* - * ENCODER - */ -void VlanCodec::format(EncodeFlags, const Packet* /*p*/, Packet* c, Layer*lyr) -{ - c->vh = (VlanTagHdr*)lyr->start; -} - - //------------------------------------------------------------------------- // api //------------------------------------------------------------------------- @@ -188,7 +191,6 @@ static void dtor(Codec *cd) delete cd; } - static const CodecApi vlan_api = { { diff --git a/src/codecs/link/cd_vlan_module.h b/src/codecs/link/cd_vlan_module.h index d4c5e7557..2f2e75c16 100644 --- a/src/codecs/link/cd_vlan_module.h +++ b/src/codecs/link/cd_vlan_module.h @@ -25,7 +25,7 @@ #include "codecs/decode_module.h" -#define CD_VLAN_NAME "codec_vlan" +#define CD_VLAN_NAME "cd_vlan" class VlanModule : public DecodeModule { diff --git a/src/codecs/misc/cd_gtp.cc b/src/codecs/misc/cd_gtp.cc index 347a5d351..70d81ec9e 100644 --- a/src/codecs/misc/cd_gtp.cc +++ b/src/codecs/misc/cd_gtp.cc @@ -25,16 +25,16 @@ #include "config.h" #endif -#include "packet.h" #include "snort_debug.h" +#include "main/snort.h" #include "framework/codec.h" -#include "codecs/misc/cd_gtp_module.h" +#include "protocols/packet.h" #include "codecs/codec_events.h" -#include "snort.h" +#include "codecs/misc/cd_gtp_module.h" #include "protocols/ipv4.h" #include "protocols/ipv6.h" #include "packet_io/active.h" - +#include "codecs/sf_protocols.h" #include "protocols/protocol_ids.h" namespace @@ -46,20 +46,15 @@ public: GtpCodec() : Codec(CD_GTP_NAME){}; ~GtpCodec(){}; + virtual PROTO_ID get_proto_id() { return PROTO_GTP; }; virtual void get_protocol_ids(std::vector& v); virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in); virtual bool update(Packet*, Layer*, uint32_t* len); - - - // DELETE from here and below - #include "codecs/sf_protocols.h" - virtual inline PROTO_ID get_proto_id() { return PROTO_GTP; }; }; - /* GTP basic Header */ struct GTPHdr { diff --git a/src/codecs/misc/cd_gtp_module.h b/src/codecs/misc/cd_gtp_module.h index 2cc2a0012..add09ebe7 100644 --- a/src/codecs/misc/cd_gtp_module.h +++ b/src/codecs/misc/cd_gtp_module.h @@ -25,7 +25,7 @@ #include "codecs/decode_module.h" -#define CD_GTP_NAME "codec_gtp" +#define CD_GTP_NAME "cd_gtp" class GtpModule : public DecodeModule { diff --git a/src/codecs/misc/cd_teredo.cc b/src/codecs/misc/cd_teredo.cc index af20c9ba3..c6b080220 100644 --- a/src/codecs/misc/cd_teredo.cc +++ b/src/codecs/misc/cd_teredo.cc @@ -40,7 +40,7 @@ namespace { -#define CD_TEREDO_NAME "codec_teredo" +#define CD_TEREDO_NAME "cd_teredo" class TeredoCodec : public Codec { diff --git a/src/codecs/root/CMakeLists.txt b/src/codecs/root/CMakeLists.txt index 4d6b6abc8..7456d9817 100644 --- a/src/codecs/root/CMakeLists.txt +++ b/src/codecs/root/CMakeLists.txt @@ -3,37 +3,27 @@ include_directories(${PCAP_INCLUDE_DIR}) -if (ENABLE_NON_ETHER_DECODERS) - set( NON_ETHER_DECODERS - prot_eap.h - prot_eapol.h - prot_eapol.cc - prot_eapolkey.h - prot_eapolkey.cc - ) -endif(ENABLE_NON_ETHER_DECODERS) - if (ENABLE_NON_ETHER_DECODERS) set(NON_ETHER_DECODERS - cd_trk.cc - cd_trk_module.h - cd_trk_module.cc - root_fddi.cc - root_linuxsll.cc - cd_ieee80211.cc - cd_ieee80211_module.h - cd_ieee80211_module.cc - root_slip.cc - root_i4lrawip.cc - root_oldpflog.cc - root_enc.cc - root_ppp.cc - root_pflog.cc - root_pppserial.cc - root_chdlc.cc - root_i4lciscoip.cc - prot_ipx.cc - prot_eap.cc + cd_linux_sll.cc + cd_tr.cc + cd_tr_module.h + cd_tr_module.cc + cd_wlan.cc + cd_wlan_module.h + cd_wlan_module.cc +# root_fddi.cc +# root_slip.cc +# root_i4lrawip.cc +# root_oldpflog.cc +# root_enc.cc +# root_ppp.cc +# root_pflog.cc +# root_pppserial.cc +# root_chdlc.cc +# root_i4lciscoip.cc +# prot_ipx.cc +# prot_eap.cc ) endif (ENABLE_NON_ETHER_DECODERS) @@ -44,7 +34,7 @@ add_library(root_codecs STATIC cd_eth_module.cc cd_raw4.cc cd_raw6.cc - cd_null_root.cc + cd_null.cc ${NON_ETHER_DECODERS} ${PCAP_INCLUDE_DIR}/pcap.h # rebuild if a new libpcap is installed ) diff --git a/src/codecs/root/Makefile.am b/src/codecs/root/Makefile.am index 88a2c2bff..359c23489 100644 --- a/src/codecs/root/Makefile.am +++ b/src/codecs/root/Makefile.am @@ -7,40 +7,50 @@ cd_eth_module.h \ cd_eth_module.cc \ cd_raw4.cc \ cd_raw6.cc \ -cd_null_root.cc +cd_null.cc if ENABLE_NON_ETHER_DECODER if STATIC_DECODERS libroot_codecs_a_SOURCES += \ -cd_trk.cc \ -cd_trk_module.h \ -cd_trk_module.cc \ -root_fddi.cc \ -root_linuxsll.cc \ -cd_ieee80211.cc \ -cd_ieee80211_module.h \ -cd_ieee80211_module.cc \ -root_slip.cc \ -root_i4lrawip.cc \ -root_oldpflog.cc \ -root_enc.cc \ -root_ppp.cc \ -root_pflog.cc \ -root_pppserial.cc \ -root_chdlc.cc \ -root_i4lciscoip.cc +cd_linux_sll.cc \ +cd_tr.cc \ +cd_tr_module.h \ +cd_tr_module.cc \ +cd_wlan.cc \ +cd_wlan_module.h \ +cd_wlan_module.cc +#root_fddi.cc \ +#root_slip.cc \ +#root_i4lrawip.cc \ +#root_oldpflog.cc \ +#root_enc.cc \ +#root_ppp.cc \ +#root_pflog.cc \ +#root_pppserial.cc \ +#root_chdlc.cc \ +#root_i4lciscoip.cc else ehlibdir = $(pkglibdir)/codecs -ehlib_LTLIBRARIES = libcd_trk.la -libcd_trk_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO -libcd_trk_la_LDFLAGS = -export-dynamic -shared -libcd_trk_la_SOURCES = cd_trk.cc cd_trk_module.h cd_trk_module.cc +ehlib_LTLIBRARIES = libcd_tr.la +libcd_tr_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO +libcd_tr_la_LDFLAGS = -export-dynamic -shared +libcd_tr_la_SOURCES = cd_tr.cc cd_tr_module.h cd_tr_module.cc + +ehlib_LTLIBRARIES += libcd_wlan.la +libcd_wlan_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO +libcd_wlan_la_LDFLAGS = -export-dynamic -shared +libcd_wlan_la_SOURCES = cd_wlan.cc cd_wlan_module.h cd_wlan_module.cc + +ehlib_LTLIBRARIES += libcd_linux_sll.la +libcd_linux_sll_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO +libcd_linux_sll_la_LDFLAGS = -export-dynamic -shared +libcd_linux_sll_la_SOURCES = cd_linux_sll.cc endif endif diff --git a/src/codecs/root/cd_eth.cc b/src/codecs/root/cd_eth.cc index 4ccedb3f9..d1c50672f 100644 --- a/src/codecs/root/cd_eth.cc +++ b/src/codecs/root/cd_eth.cc @@ -1,4 +1,3 @@ - /* ** Copyright (C) 2002-2013 Sourcefire, Inc. ** Copyright (C) 1998-2002 Martin Roesch @@ -20,7 +19,6 @@ */ - #ifdef HAVE_CONFIG_H #include "config.h" #endif @@ -33,6 +31,7 @@ #include "protocols/eth.h" #include "codecs/codec_events.h" #include "managers/packet_manager.h" +#include "codecs/sf_protocols.h" namespace { @@ -44,6 +43,7 @@ public: ~EthCodec(){}; + virtual PROTO_ID get_proto_id() { return PROTO_ETH; }; virtual void get_protocol_ids(std::vector&) {}; virtual void get_data_link_type(std::vector&); virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, @@ -51,14 +51,9 @@ public: virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in); virtual bool update(Packet*, Layer*, uint32_t* len); virtual void format(EncodeFlags, const Packet* p, Packet* c, Layer*); - - // DELETE - #include "codecs/sf_protocols.h" - virtual inline PROTO_ID get_proto_id() { return PROTO_ETH; }; - }; -} // anonymous +} // namespace void EthCodec::get_data_link_type(std::vector&v) @@ -103,24 +98,25 @@ bool EthCodec::decode(const uint8_t *raw_pkt, const uint32_t len, } /* lay the ethernet structure over the packet data */ - p->eh = reinterpret_cast(raw_pkt); + const eth::EtherHdr *eh = reinterpret_cast(raw_pkt); DEBUG_WRAP( DebugMessage(DEBUG_DECODE, "%X:%X:%X:%X:%X:%X -> %X:%X:%X:%X:%X:%X\n", - p->eh->ether_src[0], - p->eh->ether_src[1], p->eh->ether_src[2], p->eh->ether_src[3], - p->eh->ether_src[4], p->eh->ether_src[5], p->eh->ether_dst[0], - p->eh->ether_dst[1], p->eh->ether_dst[2], p->eh->ether_dst[3], - p->eh->ether_dst[4], p->eh->ether_dst[5]); + eh->ether_src[0], + eh->ether_src[1], eh->ether_src[2], eh->ether_src[3], + eh->ether_src[4], eh->ether_src[5], eh->ether_dst[0], + eh->ether_dst[1], eh->ether_dst[2], eh->ether_dst[3], + eh->ether_dst[4], eh->ether_dst[5]); ); DEBUG_WRAP( DebugMessage(DEBUG_DECODE, "type:0x%X len:0x%X\n", - ntohs(p->eh->ether_type), p->pkth->pktlen) + ntohs(eh->ether_type), p->pkth->pktlen) ); - next_prot_id = ntohs(p->eh->ether_type); + next_prot_id = ntohs(eh->ether_type); if (next_prot_id > eth::min_ethertype() ) { + p->proto_bits |= PROTO_BIT__ETH; lyr_len = eth::hdr_len(); return true; } @@ -192,7 +188,6 @@ bool EthCodec::update (Packet*, Layer* lyr, uint32_t* len) void EthCodec::format(EncodeFlags f, const Packet* p, Packet* c, Layer* lyr) { eth::EtherHdr* ch = (eth::EtherHdr*)lyr->start; - c->eh = ch; if ( reverse(f) ) { diff --git a/src/codecs/root/cd_eth_module.h b/src/codecs/root/cd_eth_module.h index e1fef3fdf..15f0e10eb 100644 --- a/src/codecs/root/cd_eth_module.h +++ b/src/codecs/root/cd_eth_module.h @@ -25,7 +25,7 @@ #include "codecs/decode_module.h" -#define CD_ETH_NAME "codec_eth" +#define CD_ETH_NAME "cd_eth" class EthModule : public DecodeModule { diff --git a/src/codecs/root/cd_ieee80211.cc b/src/codecs/root/cd_ieee80211.cc deleted file mode 100644 index 64abbc637..000000000 --- a/src/codecs/root/cd_ieee80211.cc +++ /dev/null @@ -1,229 +0,0 @@ -/* $Id: decode.c,v 1.285 2013-06-29 03:03:00 rcombs Exp $ */ - -/* -** Copyright (C) 2002-2013 Sourcefire, Inc. -** Copyright (C) 1998-2002 Martin Roesch -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - - - -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif - -#include "generators.h" -#include "decode.h" -#include "static_include.h" -#include "log/log.h" - -#include "../decoder_includes.h" - - - -#define MINIMAL_IEEE80211_HEADER_LEN 10 /* Ack frames and others */ -#define IEEE802_11_DATA_HDR_LEN 24 /* Header for data packets */ - -/* - * Function: DecodeIEEE80211Pkt(Packet *, char *, DAQ_PktHdr_t*, - * uint8_t*) - * - * Purpose: Decode those fun loving wireless LAN packets, one at a time! - * - * Arguments: p => pointer to the decoded packet struct - * user => Utility pointer (unused) - * pkthdr => ptr to the packet header - * pkt => pointer to the real live packet data - * - * Returns: void function - */ -void DecodeIEEE80211Pkt(Packet * p, const DAQ_PktHdr_t * pkthdr, - const uint8_t * pkt) -{ - uint32_t cap_len = pkthdr->caplen; - PROFILE_VARS; - - PREPROC_PROFILE_START(decodePerfStats); - - dc.total_processed++; - - memset(p, 0, PKT_ZERO_LEN); - - p->pkth = pkthdr; - p->pkt = pkt; - - DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Packet!\n");); - DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "caplen: %lu pktlen: %lu\n", - (unsigned long)cap_len, (unsigned long)pkthdr->pktlen);); - - /* do a little validation */ - if(cap_len < MINIMAL_IEEE80211_HEADER_LEN) - { - if (ScLogVerbose()) - { - ErrorMessage("Captured data length < IEEE 802.11 header length! " - "(%d bytes)\n", cap_len); - } - - PREPROC_PROFILE_END(decodePerfStats); - return; - } - /* lay the wireless structure over the packet data */ - p->wifih = (WifiHdr *) pkt; - - DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "%X %X\n", *p->wifih->addr1, - *p->wifih->addr2);); - - /* determine frame type */ - switch(p->wifih->frame_control & 0x00ff) - { - /* management frames */ - case WLAN_TYPE_MGMT_ASREQ: - case WLAN_TYPE_MGMT_ASRES: - case WLAN_TYPE_MGMT_REREQ: - case WLAN_TYPE_MGMT_RERES: - case WLAN_TYPE_MGMT_PRREQ: - case WLAN_TYPE_MGMT_PRRES: - case WLAN_TYPE_MGMT_BEACON: - case WLAN_TYPE_MGMT_ATIM: - case WLAN_TYPE_MGMT_DIS: - case WLAN_TYPE_MGMT_AUTH: - case WLAN_TYPE_MGMT_DEAUTH: - dc.wifi_mgmt++; - break; - - /* Control frames */ - case WLAN_TYPE_CONT_PS: - case WLAN_TYPE_CONT_RTS: - case WLAN_TYPE_CONT_CTS: - case WLAN_TYPE_CONT_ACK: - case WLAN_TYPE_CONT_CFE: - case WLAN_TYPE_CONT_CFACK: - dc.wifi_control++; - break; - /* Data packets without data */ - case WLAN_TYPE_DATA_NULL: - case WLAN_TYPE_DATA_CFACK: - case WLAN_TYPE_DATA_CFPL: - case WLAN_TYPE_DATA_ACKPL: - - dc.wifi_data++; - break; - case WLAN_TYPE_DATA_DTCFACK: - case WLAN_TYPE_DATA_DTCFPL: - case WLAN_TYPE_DATA_DTACKPL: - case WLAN_TYPE_DATA_DATA: - dc.wifi_data++; - - if(cap_len < IEEE802_11_DATA_HDR_LEN + sizeof(EthLlc)) - { - codec_events::decoder_event(p, DECODE_BAD_80211_ETHLLC, - DECODE_BAD_80211_ETHLLC_STR); - - PREPROC_PROFILE_END(decodePerfStats); - return; - } - - p->ehllc = (EthLlc *) (pkt + IEEE802_11_DATA_HDR_LEN); - -#ifdef DEBUG_MSGS - LogNetData((uint8_t*) p->ehllc, sizeof(EthLlc), NULL); - - printf("LLC Header:\n"); - printf(" DSAP: 0x%X\n", p->ehllc->dsap); - printf(" SSAP: 0x%X\n", p->ehllc->ssap); -#endif - - if(p->ehllc->dsap == ETH_DSAP_IP && p->ehllc->ssap == ETH_SSAP_IP) - { - if(cap_len < IEEE802_11_DATA_HDR_LEN + - sizeof(EthLlc) + sizeof(EthLlcOther)) - { - codec_events::decoder_event(p, DECODE_BAD_80211_OTHER, - DECODE_BAD_80211_OTHER_STR); - - PREPROC_PROFILE_END(decodePerfStats); - return; - } - - p->ehllcother = (EthLlcOther *) (pkt + IEEE802_11_DATA_HDR_LEN + sizeof(EthLlc)); -#ifdef DEBUG_MSGS - LogNetData((uint8_t*)p->ehllcother, sizeof(EthLlcOther), NULL); - - printf("LLC Other Header:\n"); - printf(" CTRL: 0x%X\n", p->ehllcother->ctrl); - printf(" ORG: 0x%02X%02X%02X\n", p->ehllcother->org_code[0], - p->ehllcother->org_code[1], p->ehllcother->org_code[2]); - printf(" PROTO: 0x%04X\n", ntohs(p->ehllcother->proto_id)); -#endif - - switch(ntohs(p->ehllcother->proto_id)) - { - case ETHERNET_TYPE_IP: - DecodeIP(p->pkt + IEEE802_11_DATA_HDR_LEN + sizeof(EthLlc) + - sizeof(EthLlcOther), - cap_len - IEEE802_11_DATA_HDR_LEN - sizeof(EthLlc) - - sizeof(EthLlcOther), p); - PREPROC_PROFILE_END(decodePerfStats); - return; - - case ETHERNET_TYPE_ARP: - case ETHERNET_TYPE_REVARP: - DecodeARP(p->pkt + IEEE802_11_DATA_HDR_LEN + sizeof(EthLlc) + - sizeof(EthLlcOther), - cap_len - IEEE802_11_DATA_HDR_LEN - sizeof(EthLlc) - - sizeof(EthLlcOther), p); - PREPROC_PROFILE_END(decodePerfStats); - return; - case ETHERNET_TYPE_EAPOL: - DecodeEapol(p->pkt + IEEE802_11_DATA_HDR_LEN + sizeof(EthLlc) + - sizeof(EthLlcOther), - cap_len - IEEE802_11_DATA_HDR_LEN - sizeof(EthLlc) - - sizeof(EthLlcOther), p); - PREPROC_PROFILE_END(decodePerfStats); - return; - case ETHERNET_TYPE_8021Q: - DecodeVlan(p->pkt + IEEE802_11_DATA_HDR_LEN , - cap_len - IEEE802_11_DATA_HDR_LEN , p); - PREPROC_PROFILE_END(decodePerfStats); - return; - - case ETHERNET_TYPE_IPV6: - DecodeIPV6(p->pkt + IEEE802_11_DATA_HDR_LEN, - cap_len - IEEE802_11_DATA_HDR_LEN, p); - PREPROC_PROFILE_END(decodePerfStats); - return; - - default: - // TBD add decoder drop event for unknown wifi/eth type - dc.other++; - PREPROC_PROFILE_END(decodePerfStats); - return; - } - } - break; - default: - // TBD add decoder drop event for unknown wlan frame type - dc.other++; - break; - } - - PREPROC_PROFILE_END(decodePerfStats); - return; -} - - diff --git a/src/codecs/root/cd_linux_sll.cc b/src/codecs/root/cd_linux_sll.cc new file mode 100644 index 000000000..951704b56 --- /dev/null +++ b/src/codecs/root/cd_linux_sll.cc @@ -0,0 +1,136 @@ +/* +** Copyright (C) 2002-2013 Sourcefire, Inc. +** Copyright (C) 1998-2002 Martin Roesch +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + + + +#ifdef HAVE_CONFIG_H +#include "config.h" +#endif + +#include +#include "framework/codec.h" +#include "protocols/linux_sll.h" +#include "main/snort.h" + + +namespace +{ + +#define CD_LINUX_SSL_NAME "cd_linux_sll" + +class LinuxSllCodec : public Codec +{ +public: + LinuxSllCodec() : Codec(CD_LINUX_SSL_NAME){}; + ~LinuxSllCodec() {}; + + + virtual void get_data_link_type(std::vector&); + virtual bool decode(const uint8_t *raw_pkt, const uint32_t raw_len, + Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); +}; + +// Create your own Hdr Struct for this layer! +struct NameHdr +{ + uint8_t ver; + uint8_t next_protocol; + uint16_t len; + // additional or different data +}; + +} // namespace + + +void LinuxSllCodec::get_data_link_type(std::vector&v) +{ +#ifdef DLT_LINUX_SLL + v.push_back(DLT_LINUX_SLL); +#endif +} + +bool LinuxSllCodec::decode(const uint8_t *raw_pkt, const uint32_t raw_len, + Packet* /*p*/, uint16_t &lyr_len, uint16_t &next_prot_id) +{ + /* do a little validation */ + if(raw_len < SLL_HDR_LEN) + { + if (ScLogVerbose()) + { + ErrorMessage("Captured data length < SLL header length (your " + "libpcap is broken?)! (%d bytes)\n", raw_len); + } + return false; + } + /* lay the ethernet structure over the packet data */ + const linux_sll::SLLHdr* sllh = reinterpret_cast(raw_pkt); + + /* grab out the network type */ + next_prot_id = ntohs(sllh->sll_protocol); + lyr_len = SLL_HDR_LEN; + return true; +} + + + +//------------------------------------------------------------------------- +// api +//------------------------------------------------------------------------- + +static Codec* ctor(Module*) +{ + return new LinuxSllCodec(); +} + +static void dtor(Codec *cd) +{ + delete cd; +} + + +static const CodecApi linux_ssl_api = +{ + { + PT_CODEC, + CD_LINUX_SSL_NAME, + CDAPI_PLUGIN_V0, + 0, + nullptr, + nullptr, + }, + nullptr, + nullptr, + nullptr, + nullptr, + ctor, + dtor, +}; + + +#ifdef BUILDING_SO +SO_PUBLIC const BaseApi* snort_plugins[] = +{ + &linux_ssl_api.base, + nullptr +}; +#else +const BaseApi* cd_linux_sll = &linux_ssl_api.base; +#endif + diff --git a/src/codecs/root/cd_null_root.cc b/src/codecs/root/cd_null.cc similarity index 86% rename from src/codecs/root/cd_null_root.cc rename to src/codecs/root/cd_null.cc index 4fc68fbbe..6325ea65e 100644 --- a/src/codecs/root/cd_null_root.cc +++ b/src/codecs/root/cd_null.cc @@ -33,13 +33,13 @@ namespace { -#define CD_NULL_NAME "codec_null" +#define CD_NULL_NAME "cd_null" -class NullRootCodec : public Codec +class NullCodec : public Codec { public: - NullRootCodec() : Codec(CD_NULL_NAME){}; - ~NullRootCodec() {}; + NullCodec() : Codec(CD_NULL_NAME){}; + ~NullCodec() {}; virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, @@ -67,7 +67,7 @@ static const uint16_t NULL_HDRLEN = 4; * * Returns: void function */ -bool NullRootCodec::decode(const uint8_t* /*raw_pkt*/, const uint32_t raw_len, +bool NullCodec::decode(const uint8_t* /*raw_pkt*/, const uint32_t raw_len, Packet* /*p*/, uint16_t &lyr_len, uint16_t &next_prot_id) { DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "NULL Packet!\n"); ); @@ -88,7 +88,7 @@ bool NullRootCodec::decode(const uint8_t* /*raw_pkt*/, const uint32_t raw_len, return true; } -void NullRootCodec::get_data_link_type(std::vector&v) +void NullCodec::get_data_link_type(std::vector&v) { v.push_back(DLT_NULL); } @@ -99,7 +99,7 @@ void NullRootCodec::get_data_link_type(std::vector&v) static Codec* ctor(Module*) { - return new NullRootCodec(); + return new NullCodec(); } static void dtor(Codec *cd) @@ -107,7 +107,7 @@ static void dtor(Codec *cd) delete cd; } -static const CodecApi null_root_api = +static const CodecApi null_api = { { PT_CODEC, @@ -129,9 +129,9 @@ static const CodecApi null_root_api = #ifdef BUILDING_SO SO_PUBLIC const BaseApi* snort_plugins[] = { - &null_root_api.base, + &null_api.base, nullptr }; #else -const BaseApi* cd_null_root = &null_root_api.base; +const BaseApi* cd_null = &null_api.base; #endif diff --git a/src/codecs/root/cd_raw4.cc b/src/codecs/root/cd_raw4.cc index 0258dd5a4..062f843b8 100644 --- a/src/codecs/root/cd_raw4.cc +++ b/src/codecs/root/cd_raw4.cc @@ -32,7 +32,7 @@ namespace { -#define CD_RAW4_NAME "codec_raw4" +#define CD_RAW4_NAME "cd_raw4" class Raw4Codec : public Codec { diff --git a/src/codecs/root/cd_raw6.cc b/src/codecs/root/cd_raw6.cc index 6800a1577..38a26232a 100644 --- a/src/codecs/root/cd_raw6.cc +++ b/src/codecs/root/cd_raw6.cc @@ -32,7 +32,7 @@ namespace { -#define CD_RAW6_NAME "codec_raw6" +#define CD_RAW6_NAME "cd_raw6" class Raw6Codec : public Codec { diff --git a/src/codecs/root/cd_trk.cc b/src/codecs/root/cd_tr.cc similarity index 54% rename from src/codecs/root/cd_trk.cc rename to src/codecs/root/cd_tr.cc index c9ccfa8a8..1828f24cc 100644 --- a/src/codecs/root/cd_trk.cc +++ b/src/codecs/root/cd_tr.cc @@ -1,5 +1,3 @@ -/* $Id: decode.c,v 1.285 2013-06-29 03:03:00 rcombs Exp $ */ - /* ** Copyright (C) 2002-2013 Sourcefire, Inc. ** Copyright (C) 1998-2002 Martin Roesch @@ -26,11 +24,28 @@ #include "config.h" #endif -#include "decode.h" +#include +#include "protocols/packet.h" +#include "protocols/token_ring.h" +#include "framework/codec.h" +#include "codecs/codec_events.h" +#include "codecs/root/cd_tr_module.h" +namespace +{ +class TrCodec : public Codec +{ +public: + TrCodec() : Codec(CD_TR_NAME){}; + ~TrCodec() {}; + virtual void get_data_link_type(std::vector&); + virtual bool decode(const uint8_t *raw_pkt, const uint32_t raw_len, + Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); +}; + // THESE ARE NEVER USED!! #define MINIMAL_TOKENRING_HEADER_LEN 22 @@ -39,7 +54,6 @@ // DELETE FIN #define TR_ALEN 6 /* octets in an Ethernet header */ -#define IPARP_SAP 0xaa #define AC 0x10 #define LLC_FRAME 0x40 @@ -53,52 +67,43 @@ #define TR_RCF_FRAME2K 0x20 #define TR_RCF_BROADCAST_MASK 0xC000 -/* - * Function: DecodeTRPkt(Packet *, char *, DAQ_PktHdr_t*, uint8_t*) - * - * Purpose: Decode Token Ring packets! - * - * Arguments: p=> pointer to decoded packet struct - * user => Utility pointer, unused - * pkthdr => ptr to the packet header - * pkt => pointer to the real live packet data - * - * Returns: void function - */ -void DecodeTRPkt(Packet * p, const DAQ_PktHdr_t * pkthdr, const uint8_t * pkt) +} // namespace + + +void TrCodec::get_data_link_type(std::vector&v) { - uint32_t cap_len = pkthdr->caplen; - uint32_t dataoff; /* data offset is variable here */ - PROFILE_VARS; +#ifdef DLT_IEEE802 + v.push_back(DLT_IEEE802); +#endif +} - PREPROC_PROFILE_START(decodePerfStats); - dc.total_processed++; +//void DecodeTRPkt(Packet * p, const DAQ_PktHdr_t * pkthdr, const uint8_t * pkt) +bool TrCodec::decode(const uint8_t *raw_pkt, const uint32_t raw_len, + Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) +{ - memset(p, 0, PKT_ZERO_LEN); + uint32_t cap_len = raw_len; + uint32_t dataoff; /* data offset is variable here */ - p->pkth = pkthdr; - p->pkt = pkt; DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Packet!\n"); DebugMessage(DEBUG_DECODE, "caplen: %lu pktlen: %lu\n", - (unsigned long)cap_len,(unsigned long) pkthdr->pktlen); + (unsigned long)cap_len,(unsigned long) raw_len); ); - if(cap_len < sizeof(Trh_hdr)) + if(cap_len < sizeof(token_ring::Trh_hdr)) { DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Captured data length < Token Ring header length! " "(%d < %d bytes)\n", cap_len, TR_HLEN);); - codec_events::decoder_event(p, DECODE_BAD_TRH, DECODE_BAD_TRH_STR); - - PREPROC_PROFILE_END(decodePerfStats); - return; + codec_events::decoder_event(p, DECODE_BAD_TRH); + return false; } /* lay the tokenring header structure over the packet data */ - p->trh = (Trh_hdr *) pkt; + //const token_ring::Trh_hdr *trh = reinterpret_cast(raw_pkt); /* * according to rfc 1042: @@ -117,23 +122,21 @@ void DecodeTRPkt(Packet * p, const DAQ_PktHdr_t * pkthdr, const uint8_t * pkt) * first I assume that we have single-ring network with no RIF * information presented in frame */ - if(cap_len < (sizeof(Trh_hdr) + sizeof(Trh_llc))) + if(cap_len < (sizeof(token_ring::Trh_hdr) + sizeof(token_ring::Trh_llc))) { DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Captured data length < Token Ring header length! " "(%d < %d bytes)\n", cap_len, - (sizeof(Trh_hdr) + sizeof(Trh_llc)));); + (sizeof(token_ring::Trh_hdr) + sizeof(token_ring::Trh_llc)));); - codec_events::decoder_event(p, DECODE_BAD_TR_ETHLLC, DECODE_BAD_TR_ETHLLC_STR); - - PREPROC_PROFILE_END(decodePerfStats); - return; + codec_events::decoder_event(p, DECODE_BAD_TR_ETHLLC); + return false; } + const token_ring::Trh_llc *trhllc = + reinterpret_cast(raw_pkt + sizeof(token_ring::Trh_hdr)); - p->trhllc = (Trh_llc *) (pkt + sizeof(Trh_hdr)); - - if(p->trhllc->dsap != IPARP_SAP && p->trhllc->ssap != IPARP_SAP) + if(trhllc->dsap != IPARP_SAP && trhllc->ssap != IPARP_SAP) { /* * DSAP != SSAP != 0xAA .. either we are having frame which doesn't @@ -141,44 +144,39 @@ void DecodeTRPkt(Packet * p, const DAQ_PktHdr_t * pkthdr, const uint8_t * pkt) * lattest ... */ - if(cap_len < (sizeof(Trh_hdr) + sizeof(Trh_llc) + sizeof(Trh_mr))) + if(cap_len < (sizeof(token_ring::Trh_hdr) + sizeof(token_ring::Trh_llc) + sizeof(token_ring::Trh_mr))) { DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Captured data length < Token Ring header length! " "(%d < %d bytes)\n", cap_len, - (sizeof(Trh_hdr) + sizeof(Trh_llc) + sizeof(Trh_mr)));); + (sizeof(token_ring::Trh_hdr) + sizeof(token_ring::Trh_llc) + sizeof(token_ring::Trh_mr)));); - codec_events::decoder_event(p, DECODE_BAD_TRHMR, DECODE_BAD_TRHMR_STR); - - PREPROC_PROFILE_END(decodePerfStats); - return; + codec_events::decoder_event(p, DECODE_BAD_TRHMR); + return false; } - p->trhmr = (Trh_mr *) (pkt + sizeof(Trh_hdr)); + const token_ring::Trh_mr* trhmr = + reinterpret_cast(raw_pkt + sizeof(token_ring::Trh_hdr)); - if(cap_len < (sizeof(Trh_hdr) + sizeof(Trh_llc) + - sizeof(Trh_mr) + TRH_MR_LEN(p->trhmr))) + if(cap_len < (sizeof(token_ring::Trh_hdr) + sizeof(token_ring::Trh_llc) + + sizeof(token_ring::Trh_mr) + TRH_MR_LEN(trhmr))) { DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Captured data length < Token Ring header length! " "(%d < %d bytes)\n", cap_len, - (sizeof(Trh_hdr) + sizeof(Trh_llc) + sizeof(Trh_mr)));); - - codec_events::decoder_event(p, DECODE_BAD_TR_MR_LEN, DECODE_BAD_TR_MR_LEN_STR); + (sizeof(token_ring::Trh_hdr) + sizeof(token_ring::Trh_llc) + sizeof(token_ring::Trh_mr)));); - PREPROC_PROFILE_END(decodePerfStats); - return; + codec_events::decoder_event(p, DECODE_BAD_TR_MR_LEN); + return false; } - p->trhllc = (Trh_llc *) (pkt + sizeof(Trh_hdr) + TRH_MR_LEN(p->trhmr)); - dataoff = sizeof(Trh_hdr) + TRH_MR_LEN(p->trhmr) + sizeof(Trh_llc); + dataoff = sizeof(token_ring::Trh_hdr) + TRH_MR_LEN(trhmr) + sizeof(token_ring::Trh_llc); } else { - p->trhllc = (Trh_llc *) (pkt + sizeof(Trh_hdr)); - dataoff = sizeof(Trh_hdr) + sizeof(Trh_llc); + dataoff = sizeof(token_ring::Trh_hdr) + sizeof(token_ring::Trh_llc); } /* @@ -191,49 +189,72 @@ void DecodeTRPkt(Packet * p, const DAQ_PktHdr_t * pkthdr, const uint8_t * pkt) * Assigned Numbers [7] (IP = 2048, ARP = 2054). .. but we would check * SSAP and DSAP and assume this would be enough to trust. */ - if(p->trhllc->dsap != IPARP_SAP && p->trhllc->ssap != IPARP_SAP) + if(trhllc->dsap != IPARP_SAP && trhllc->ssap != IPARP_SAP) { DEBUG_WRAP( DebugMessage(DEBUG_DECODE, "DSAP and SSAP arent set to SNAP\n"); ); - p->trhllc = NULL; - PREPROC_PROFILE_END(decodePerfStats); - return; + return false; } - switch(htons(p->trhllc->ethertype)) - { - case ETHERNET_TYPE_IP: - DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Decoding IP\n");); - DecodeIP(p->pkt + dataoff, cap_len - dataoff, p); - PREPROC_PROFILE_END(decodePerfStats); - return; - - case ETHERNET_TYPE_ARP: - case ETHERNET_TYPE_REVARP: - DEBUG_WRAP( - DebugMessage(DEBUG_DECODE, "Decoding ARP\n"); - ); - dc.arp++; - - PREPROC_PROFILE_END(decodePerfStats); - return; - - case ETHERNET_TYPE_8021Q: - DecodeVlan(p->pkt + dataoff, cap_len - dataoff, p); - PREPROC_PROFILE_END(decodePerfStats); - return; - - default: - DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Unknown network protocol: %d\n", - htons(p->trhllc->ethertype))); - // TBD add decoder drop event for unknown tr/eth type - dc.other++; - PREPROC_PROFILE_END(decodePerfStats); - return; - } + lyr_len = dataoff; + next_prot_id = htons(trhllc->ethertype); + return true; +} - PREPROC_PROFILE_END(decodePerfStats); - return; + + +//------------------------------------------------------------------------- +// api +//------------------------------------------------------------------------- + + +static Module* mod_ctor() +{ + return new TrCodecModule; } +static void mod_dtor(Module* m) +{ + delete m; +} + +static Codec* ctor(Module*) +{ + return new TrCodec(); +} + +static void dtor(Codec *cd) +{ + delete cd; +} + + +static const CodecApi tr_api = +{ + { + PT_CODEC, + CD_TR_NAME, + CDAPI_PLUGIN_V0, + 0, + mod_ctor, + mod_dtor + }, + nullptr, + nullptr, + nullptr, + nullptr, + ctor, + dtor, +}; + + +#ifdef BUILDING_SO +SO_PUBLIC const BaseApi* snort_plugins[] = +{ + &tr_api.base, + nullptr +}; +#else +const BaseApi* cd_tr = &tr_api.base; +#endif diff --git a/src/codecs/root/cd_tr_module.cc b/src/codecs/root/cd_tr_module.cc new file mode 100644 index 000000000..6aa43101a --- /dev/null +++ b/src/codecs/root/cd_tr_module.cc @@ -0,0 +1,50 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// cd_arp_module.cc author Josh Rosenbaum + +#include "codecs/root/cd_tr_module.h" + + +static const Parameter trk_params[] = +{ + { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } +}; + + +static const RuleMap trk_rules[] = +{ + { DECODE_BAD_TRH, "(" CD_TR_NAME ") Bad Token Ring Header" }, + { DECODE_BAD_TR_ETHLLC, "(" CD_TR_NAME ") Bad Token Ring ETHLLC Header" }, + { DECODE_BAD_TR_MR_LEN, "(" CD_TR_NAME ") Bad Token Ring MRLENHeader" }, + { DECODE_BAD_TRHMR, "(" CD_TR_NAME ") Bad Token Ring MR Header" }, + { 0, nullptr } +}; + +//------------------------------------------------------------------------- +// token ring module +//------------------------------------------------------------------------- + +TrCodecModule::TrCodecModule() : DecodeModule(CD_TR_NAME, trk_params, trk_rules) +{ } + +bool TrCodecModule::set(const char*, Value&, SnortConfig*) +{ + return true; +} diff --git a/src/codecs/layer.h b/src/codecs/root/cd_tr_module.h similarity index 68% rename from src/codecs/layer.h rename to src/codecs/root/cd_tr_module.h index 0b86f4228..fcf5dfe71 100644 --- a/src/codecs/layer.h +++ b/src/codecs/root/cd_tr_module.h @@ -1,6 +1,5 @@ /* -** Copyright (C) 2002-2013 Sourcefire, Inc. -** Copyright (C) 1998-2002 Martin Roesch +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. ** ** This program is free software; you can redistribute it and/or modify ** it under the terms of the GNU General Public License Version 2 as @@ -18,18 +17,22 @@ ** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */ -#ifndef LAYER_H -#define LAYER_H +// cd_trk_module.h author Josh Rosenbaum -#include "codecs/sf_protocols.h" +#ifndef CD_TRK_MODULE_H +#define CD_TRK_MODULE_H +#include "codecs/decode_module.h" -struct Layer { - uint16_t prot_id; - PROTO_ID proto; - uint16_t length; - uint8_t* start; -}; +#define CD_TR_NAME "cd_tr" + +class TrCodecModule : public DecodeModule +{ +public: + TrCodecModule(); + + bool set(const char*, Value&, SnortConfig*); +}; #endif diff --git a/src/codecs/root/cd_wlan.cc b/src/codecs/root/cd_wlan.cc new file mode 100644 index 000000000..92680056c --- /dev/null +++ b/src/codecs/root/cd_wlan.cc @@ -0,0 +1,262 @@ +/* +** Copyright (C) 2002-2013 Sourcefire, Inc. +** Copyright (C) 1998-2002 Martin Roesch +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + + + +#ifdef HAVE_CONFIG_H +#include "config.h" +#endif + +#include +#include "framework/codec.h" +#include "codecs/root/cd_wlan_module.h" +#include "codecs/codec_events.h" +#include "protocols/wlan.h" +#include "protocols/protocol_ids.h" +#include "main/snort.h" + +namespace +{ + + +class WlanCodec : public Codec +{ +public: + WlanCodec() : Codec(CD_WLAN_NAME){}; + ~WlanCodec() {}; + + + virtual bool decode(const uint8_t *raw_pkt, const uint32_t raw_len, + Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); + + virtual void get_data_link_type(std::vector&); + +}; + +struct EthLlc +{ + uint8_t dsap; + uint8_t ssap; +} ; + +struct EthLlcOther +{ + uint8_t ctrl; + uint8_t org_code[3]; + uint16_t proto_id; +}; + +#define MINIMAL_IEEE80211_HEADER_LEN 10 /* Ack frames and others */ +#define IEEE802_11_DATA_HDR_LEN 24 /* Header for data packets */ + +} // namespace + + +void WlanCodec::get_data_link_type(std::vector&v) +{ +#ifdef DLT_IEEE802_11 + v.push_back(DLT_IEEE802_11); +#endif +} + +bool WlanCodec::decode(const uint8_t *raw_pkt, const uint32_t raw_len, + Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) +{ + uint32_t cap_len = raw_len; + // reinterpret the raw data into this codec's data format + + + DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Packet!\n");); + DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "caplen: %lu pktlen: %lu\n", + (unsigned long)cap_len, (unsigned long)raw_len);); + + /* do a little validation */ + if(cap_len < MINIMAL_IEEE80211_HEADER_LEN) + { + if (ScLogVerbose()) + { + ErrorMessage("Captured data length < IEEE 802.11 header length! " + "(%d bytes)\n", cap_len); + } + + return false; + } + + /* lay the wireless structure over the packet data */ + const wlan::WifiHdr *wifih = reinterpret_cast(raw_pkt); + + DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "%X %X\n", *wifih->addr1, + *wifih->addr2);); + + /* determine frame type */ + switch(wifih->frame_control & 0x00ff) + { + /* management frames */ + case WLAN_TYPE_MGMT_ASREQ: + case WLAN_TYPE_MGMT_ASRES: + case WLAN_TYPE_MGMT_REREQ: + case WLAN_TYPE_MGMT_RERES: + case WLAN_TYPE_MGMT_PRREQ: + case WLAN_TYPE_MGMT_PRRES: + case WLAN_TYPE_MGMT_BEACON: + case WLAN_TYPE_MGMT_ATIM: + case WLAN_TYPE_MGMT_DIS: + case WLAN_TYPE_MGMT_AUTH: + case WLAN_TYPE_MGMT_DEAUTH: + break; + + /* Control frames */ + case WLAN_TYPE_CONT_PS: + case WLAN_TYPE_CONT_RTS: + case WLAN_TYPE_CONT_CTS: + case WLAN_TYPE_CONT_ACK: + case WLAN_TYPE_CONT_CFE: + case WLAN_TYPE_CONT_CFACK: + break; + /* Data packets without data */ + case WLAN_TYPE_DATA_NULL: + case WLAN_TYPE_DATA_CFACK: + case WLAN_TYPE_DATA_CFPL: + case WLAN_TYPE_DATA_ACKPL: + + break; + case WLAN_TYPE_DATA_DTCFACK: + case WLAN_TYPE_DATA_DTCFPL: + case WLAN_TYPE_DATA_DTACKPL: + case WLAN_TYPE_DATA_DATA: + { + + if(cap_len < IEEE802_11_DATA_HDR_LEN + sizeof(EthLlc)) + { + codec_events::decoder_event(p, DECODE_BAD_80211_ETHLLC); + return false; + } + + const EthLlc *ehllc = reinterpret_cast(raw_pkt + IEEE802_11_DATA_HDR_LEN); + +#ifdef DEBUG_MSGS + LogNetData((uint8_t*) ehllc, sizeof(EthLlc), NULL); + + printf("LLC Header:\n"); + printf(" DSAP: 0x%X\n", ehllc->dsap); + printf(" SSAP: 0x%X\n", ehllc->ssap); +#endif + + if(ehllc->dsap == ETH_DSAP_IP && ehllc->ssap == ETH_SSAP_IP) + { + if(cap_len < IEEE802_11_DATA_HDR_LEN + + sizeof(EthLlc) + sizeof(EthLlcOther)) + { + codec_events::decoder_event(p, DECODE_BAD_80211_OTHER); + return false; + } + + const EthLlcOther *ehllcother = reinterpret_cast(raw_pkt + IEEE802_11_DATA_HDR_LEN + sizeof(EthLlc)); +#ifdef DEBUG_MSGS + LogNetData((uint8_t*)ehllcother, sizeof(EthLlcOther), NULL); + + printf("LLC Other Header:\n"); + printf(" CTRL: 0x%X\n", ehllcother->ctrl); + printf(" ORG: 0x%02X%02X%02X\n", ehllcother->org_code[0], + ehllcother->org_code[1], ehllcother->org_code[2]); + printf(" PROTO: 0x%04X\n", ntohs(ehllcother->proto_id)); +#endif + next_prot_id = ntohs(ehllcother->proto_id); + + switch(ntohs(ehllcother->proto_id)) + { + case ETHERTYPE_IPV4: + case ETHERTYPE_ARP: + case ETHERTYPE_REVARP: + case ETHERTYPE_EAPOL: + lyr_len = IEEE802_11_DATA_HDR_LEN + sizeof(EthLlc) + sizeof(EthLlcOther); + + + case ETHERTYPE_8021Q: + case ETHERTYPE_IPV6: + lyr_len = IEEE802_11_DATA_HDR_LEN; + default: + return false; + } + } + break; + } + default: + break; + } + + return true; +} + + + +//------------------------------------------------------------------------- +// api +//------------------------------------------------------------------------- + +static Module* mod_ctor() +{ + return new WlanCodecModule; +} + +static void mod_dtor(Module* m) +{ + delete m; +} + +static Codec* ctor(Module*) +{ + return new WlanCodec(); +} + +static void dtor(Codec *cd) +{ + delete cd; +} + + +static const CodecApi wlan_api = +{ + { + PT_CODEC, + CD_WLAN_NAME, + CDAPI_PLUGIN_V0, + 0, + mod_ctor, + mod_dtor + }, + nullptr, + nullptr, + nullptr, + nullptr, + ctor, + dtor, +}; + + +#ifdef BUILDING_SO +SO_PUBLIC const BaseApi* snort_plugins[] = +{ + &wlan_api.base, + nullptr +}; +#else +const BaseApi* cd_wlan = &wlan_api.base; +#endif diff --git a/src/codecs/root/cd_wlan_module.cc b/src/codecs/root/cd_wlan_module.cc new file mode 100644 index 000000000..6d9cd0a71 --- /dev/null +++ b/src/codecs/root/cd_wlan_module.cc @@ -0,0 +1,48 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// cd_ieee8021_module.cc author Josh Rosenbaum + +#include "codecs/root/cd_wlan_module.h" + + +static const Parameter wifi_params[] = +{ + { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } +}; + + +static const RuleMap wifi_rules[] = +{ + { DECODE_BAD_80211_ETHLLC, "(" CD_WLAN_NAME ") Bad 802.11 LLC header" }, + { DECODE_BAD_80211_OTHER, "(" CD_WLAN_NAME ") Bad 802.11 Extra LLC Info" }, + { 0, nullptr } +}; + +//------------------------------------------------------------------------- +// wifi module +//------------------------------------------------------------------------- + +WlanCodecModule::WlanCodecModule() : DecodeModule(CD_WLAN_NAME, wifi_params, wifi_rules) +{ } + +bool WlanCodecModule::set(const char*, Value&, SnortConfig*) +{ + return true; +} diff --git a/src/codecs/root/cd_wlan_module.h b/src/codecs/root/cd_wlan_module.h new file mode 100644 index 000000000..554707b2c --- /dev/null +++ b/src/codecs/root/cd_wlan_module.h @@ -0,0 +1,38 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// cd_wlan_module.h author Josh Rosenbaum + +#ifndef CD_WLAN_MODULE_H +#define CD_WLAN_MODULE_H + +#include "codecs/decode_module.h" + + +#define CD_WLAN_NAME "cd_wlan" + +class WlanCodecModule : public DecodeModule +{ +public: + WlanCodecModule(); + + bool set(const char*, Value&, SnortConfig*); +}; + +#endif diff --git a/src/codecs/root/prot_ipx.cc b/src/codecs/root/prot_ipx.cc index 9fa1918c3..fd2a040f3 100644 --- a/src/codecs/root/prot_ipx.cc +++ b/src/codecs/root/prot_ipx.cc @@ -1,5 +1,3 @@ -/* $Id: decode.c,v 1.285 2013-06-29 03:03:00 rcombs Exp $ */ - /* ** Copyright (C) 2002-2013 Sourcefire, Inc. ** Copyright (C) 1998-2002 Martin Roesch @@ -27,7 +25,7 @@ #endif #include "generators.h" -#include "decode.h" +#include "protocols/packet.h" #include "static_include.h" #include "decoder_includes.h" @@ -49,26 +47,28 @@ static const uint16_t ETHERNET_TYPE_IPX = 0x8137; void DecodeIPX(const uint8_t*, uint32_t, Packet *p) { DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "IPX is not supported.\n");); - dc.ipx++; - - if (p->greh != NULL) - dc.gre_ipx++; } static const char* name = "ipx_decode"; static const CodecApi ipx_api = { - { PT_CODEC, name, CDAPI_PLUGIN_V0, 0 }, + { + PT_CODEC, + name, + CDAPI_PLUGIN_V0, + 0, + nullptr, + nullptr, + }, {ETHERNET_TYPE_IPX}, - NULL, // pinit - NULL, // pterm - NULL, // tinit - NULL, // tterm - NULL, // ctor - NULL, // dtor - Ipx::Decode, + nullptr, // pinit + nullptr, // pterm + nullptr, // tinit + nullptr, // tterm + ctor, // ctor + dtor, // dtor }; diff --git a/src/codecs/root/root_chdlc.cc b/src/codecs/root/root_chdlc.cc index 6a3da239b..891aacd82 100644 --- a/src/codecs/root/root_chdlc.cc +++ b/src/codecs/root/root_chdlc.cc @@ -27,7 +27,7 @@ #endif #include "generators.h" -#include "decode.h" +#include "protocols/packet.h" #include "static_include.h" #include "root_chdlc.h" diff --git a/src/codecs/root/root_enc.cc b/src/codecs/root/root_enc.cc index 3a8006afc..d7ff85c2b 100644 --- a/src/codecs/root/root_enc.cc +++ b/src/codecs/root/root_enc.cc @@ -27,7 +27,7 @@ #endif #include "generators.h" -#include "decode.h" +#include "protocols/packet.h" #include "static_include.h" #include "root_enc.h" diff --git a/src/codecs/root/root_fddi.cc b/src/codecs/root/root_fddi.cc index 9cbc5dc67..ff8086bcc 100644 --- a/src/codecs/root/root_fddi.cc +++ b/src/codecs/root/root_fddi.cc @@ -27,12 +27,54 @@ #endif #include "generators.h" -#include "decode.h" +#include "protocols/packet.h" #include "static_include.h" #include "../decoder_includes.h" +anonymous +{ + +/* FDDI header is always this: -worm5er */ +struct Fddi_hdr +{ + uint8_t fc; /* frame control field */ + uint8_t daddr[FDDI_ALEN]; /* src address */ + uint8_t saddr[FDDI_ALEN]; /* dst address */ +} Fddi_hdr; + +/* splitting the llc up because of variable lengths of the LLC -worm5er */ +struct Fddi_llc_saps +{ + uint8_t dsap; + uint8_t ssap; +} Fddi_llc_saps; + +/* I've found sna frames have two addition bytes after the llc saps -worm5er */ +struct Fddi_llc_sna +{ + uint8_t ctrl_fld[2]; +} Fddi_llc_sna; + +/* I've also found other frames that seem to have only one byte... We're only +really intersted in the IP data so, until we want other, I'm going to say +the data is one byte beyond this frame... -worm5er */ +struct Fddi_llc_other +{ + uint8_t ctrl_fld[1]; +} Fddi_llc_other; + +/* Just like TR the ip/arp data is setup as such: -worm5er */ +struct Fddi_llc_iparp +{ + uint8_t ctrl_fld; + uint8_t protid[3]; + uint16_t ethertype; +} Fddi_llc_iparp; + +} // anonymous + /* * Function: DecodeFDDIPkt(Packet *, char *, DAQ_PktHdr_t*, uint8_t*) * @@ -49,16 +91,8 @@ void DecodeFDDIPkt(Packet * p, const DAQ_PktHdr_t * pkthdr, const uint8_t * pkt) { uint32_t cap_len = pkthdr->caplen; uint32_t dataoff = sizeof(Fddi_hdr) + sizeof(Fddi_llc_saps); - PROFILE_VARS; - - PREPROC_PROFILE_START(decodePerfStats); - - dc.total_processed++; - memset(p, 0, PKT_ZERO_LEN); - p->pkth = pkthdr; - p->pkt = pkt; DEBUG_WRAP(DebugMessage(DEBUG_DECODE,"Packet!\n"); DebugMessage(DEBUG_DECODE, "caplen: %lu pktlen: %lu\n", diff --git a/src/codecs/root/root_i4lciscoip.cc b/src/codecs/root/root_i4lciscoip.cc index 0e8454345..314e729b0 100644 --- a/src/codecs/root/root_i4lciscoip.cc +++ b/src/codecs/root/root_i4lciscoip.cc @@ -27,7 +27,7 @@ #endif #include "generators.h" -#include "decode.h" +#include "protocols/packet.h" #include "static_include.h" #include "root_i4lciscoip.h" diff --git a/src/codecs/root/root_i4lrawip.cc b/src/codecs/root/root_i4lrawip.cc index 9ba11fb6f..38a9f3ccc 100644 --- a/src/codecs/root/root_i4lrawip.cc +++ b/src/codecs/root/root_i4lrawip.cc @@ -27,7 +27,7 @@ #endif #include "generators.h" -#include "decode.h" +#include "protocols/packet.h" #include "static_include.h" #include "root_i4lrawip.h" diff --git a/src/codecs/root/root_linuxsll.cc b/src/codecs/root/root_linuxsll.cc deleted file mode 100644 index 3cf38ea1d..000000000 --- a/src/codecs/root/root_linuxsll.cc +++ /dev/null @@ -1,151 +0,0 @@ -/* $Id: decode.c,v 1.285 2013-06-29 03:03:00 rcombs Exp $ */ - -/* -** Copyright (C) 2002-2013 Sourcefire, Inc. -** Copyright (C) 1998-2002 Martin Roesch -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - - - -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif - -#include "generators.h" -#include "decode.h" -#include "static_include.h" - - -#include "../decoder_includes.h" - - -#ifdef DLT_LINUX_SLL // WHERE IS THIS DEFINED!! - - -/* - * Function: DecodeLinuxSLLPkt(Packet *, char *, DAQ_PktHdr_t*, uint8_t*) - * - * Purpose: Decode those fun loving LinuxSLL (linux cooked sockets) - * packets, one at a time! - * - * Arguments: p => pointer to the decoded packet struct - * user => Utility pointer (unused) - * pkthdr => ptr to the packet header - * pkt => pointer to the real live packet data - * - * Returns: void function - */ - -void DecodeLinuxSLLPkt(Packet * p, const DAQ_PktHdr_t * pkthdr, const uint8_t * pkt) -{ - uint32_t cap_len = pkthdr->caplen; - PROFILE_VARS; - - PREPROC_PROFILE_START(decodePerfStats); - - dc.total_processed++; - - memset(p, 0, PKT_ZERO_LEN); - - p->pkth = pkthdr; - p->pkt = pkt; - - DEBUG_WRAP(DebugMessage(DEBUG_DECODE,"Packet!\n"); - DebugMessage(DEBUG_DECODE, "caplen: %lu pktlen: %lu\n", - (unsigned long)cap_len, (unsigned long)pkthdr->pktlen);); - - /* do a little validation */ - if(cap_len < SLL_HDR_LEN) - { - if (ScLogVerbose()) - { - ErrorMessage("Captured data length < SLL header length (your " - "libpcap is broken?)! (%d bytes)\n", cap_len); - } - PREPROC_PROFILE_END(decodePerfStats); - return; - } - /* lay the ethernet structure over the packet data */ - p->sllh = (SLLHdr *) pkt; - - /* grab out the network type */ - switch(ntohs(p->sllh->sll_protocol)) - { - case ETHERNET_TYPE_IP: - DEBUG_WRAP(DebugMessage(DEBUG_DECODE, - "IP datagram size calculated to be %lu bytes\n", - (unsigned long)(cap_len - SLL_HDR_LEN));); - - DecodeIP(p->pkt + SLL_HDR_LEN, cap_len - SLL_HDR_LEN, p); - PREPROC_PROFILE_END(decodePerfStats); - return; - - case ETHERNET_TYPE_ARP: - case ETHERNET_TYPE_REVARP: - DecodeARP(p->pkt + SLL_HDR_LEN, cap_len - SLL_HDR_LEN, p); - PREPROC_PROFILE_END(decodePerfStats); - return; - - case ETHERNET_TYPE_IPV6: - DecodeIPV6(p->pkt + SLL_HDR_LEN, (cap_len - SLL_HDR_LEN), p); - PREPROC_PROFILE_END(decodePerfStats); - return; - - case ETHERNET_TYPE_IPX: - DecodeIPX(p->pkt + SLL_HDR_LEN, (cap_len - SLL_HDR_LEN), p); - PREPROC_PROFILE_END(decodePerfStats); - return; - - case LINUX_SLL_P_802_3: - DEBUG_WRAP(DebugMessage(DEBUG_DATALINK, - "Linux SLL P 802.3 is not supported.\n");); - // TBD add decoder drop event for unsupported linux sll p 802.3 - dc.other++; - PREPROC_PROFILE_END(decodePerfStats); - return; - - case LINUX_SLL_P_802_2: - DEBUG_WRAP(DebugMessage(DEBUG_DATALINK, - "Linux SLL P 802.2 is not supported.\n");); - // TBD add decoder drop event for unsupported linux sll p 802.2 - dc.other++; - PREPROC_PROFILE_END(decodePerfStats); - return; - - case ETHERNET_TYPE_8021Q: - DecodeVlan(p->pkt + SLL_HDR_LEN, cap_len - SLL_HDR_LEN, p); - PREPROC_PROFILE_END(decodePerfStats); - return; - - default: - /* shouldn't go here unless pcap library changes again */ - /* should be a DECODE generated alert */ - DEBUG_WRAP(DebugMessage(DEBUG_DATALINK,"(Unknown) %X is not supported. " - "(need tcpdump snapshots to test. Please contact us)\n", - p->sllh->sll_protocol);); - // TBD add decoder drop event for unknown sll encapsulation - dc.other++; - PREPROC_PROFILE_END(decodePerfStats); - return; - } - - PREPROC_PROFILE_END(decodePerfStats); - return; -} -#endif /* DLT_LINUX_SLL */ - diff --git a/src/codecs/root/root_oldpflog.cc b/src/codecs/root/root_oldpflog.cc index 34a2f83f4..a929ba3da 100644 --- a/src/codecs/root/root_oldpflog.cc +++ b/src/codecs/root/root_oldpflog.cc @@ -27,7 +27,7 @@ #endif #include "generators.h" -#include "decode.h" +#include "protocols/packet.h" #include "static_include.h" #include "root_oldpflog.h" diff --git a/src/codecs/root/root_pflog.cc b/src/codecs/root/root_pflog.cc index ebd6f9947..793dae31a 100644 --- a/src/codecs/root/root_pflog.cc +++ b/src/codecs/root/root_pflog.cc @@ -27,12 +27,120 @@ #endif #include "generators.h" -#include "decode.h" +#include "protocols/packet.h" #include "static_include.h" #include "root_pflog.h" #include "../decoder_includes.h" +namespace +{ + + +/* + * Snort supports 3 versions of the OpenBSD pflog header: + * + * Pflog1_Hdr: CVS = 1.3, DLT_OLD_PFLOG = 17, Length = 28 + * Pflog2_Hdr: CVS = 1.8, DLT_PFLOG = 117, Length = 48 + * Pflog3_Hdr: CVS = 1.12, DLT_PFLOG = 117, Length = 64 + * Pflog3_Hdr: CVS = 1.172, DLT_PFLOG = 117, Length = 100 + * + * Since they have the same DLT, Pflog{2,3}Hdr are distinguished + * by their actual length. The minimum required length excludes + * padding. + */ +/* Old OpenBSD pf firewall pflog0 header + * (information from pf source in kernel) + * the rule, reason, and action codes tell why the firewall dropped it -fleck + */ + +struct Pflog1Hdr +{ + uint32_t af; + char intf[IFNAMSIZ]; + int16_t rule; + uint16_t reason; + uint16_t action; + uint16_t dir; +}; + +#define PFLOG1_HDRLEN (sizeof(struct _Pflog1_hdr)) + +/* + * Note that on OpenBSD, af type is sa_family_t. On linux, that's an unsigned + * short, but on OpenBSD, that's a uint8_t, so we should explicitly use uint8_t + * here. - ronaldo + */ + +#define PFLOG_RULELEN 16 +#define PFLOG_PADLEN 3 + +struct Pflog2Hdr +{ + int8_t length; + uint8_t af; + uint8_t action; + uint8_t reason; + char ifname[IFNAMSIZ]; + char ruleset[PFLOG_RULELEN]; + uint32_t rulenr; + uint32_t subrulenr; + uint8_t dir; + uint8_t pad[PFLOG_PADLEN]; +} ; + +#define PFLOG2_HDRLEN (sizeof(struct _Pflog2_hdr)) +#define PFLOG2_HDRMIN (PFLOG2_HDRLEN - PFLOG_PADLEN) + +struct Pflog3Hdr +{ + int8_t length; + uint8_t af; + uint8_t action; + uint8_t reason; + char ifname[IFNAMSIZ]; + char ruleset[PFLOG_RULELEN]; + uint32_t rulenr; + uint32_t subrulenr; + uint32_t uid; + uint32_t pid; + uint32_t rule_uid; + uint32_t rule_pid; + uint8_t dir; + uint8_t pad[PFLOG_PADLEN]; +}; + +#define PFLOG3_HDRLEN (sizeof(struct _Pflog3_hdr)) +#define PFLOG3_HDRMIN (PFLOG3_HDRLEN - PFLOG_PADLEN) + + +struct Pflog4Hdr +{ + uint8_t length; + uint8_t af; + uint8_t action; + uint8_t reason; + char ifname[IFNAMSIZ]; + char ruleset[PFLOG_RULELEN]; + uint32_t rulenr; + uint32_t subrulenr; + uint32_t uid; + uint32_t pid; + uint32_t rule_uid; + uint32_t rule_pid; + uint8_t dir; + uint8_t rewritten; + uint8_t pad[2]; + uint8_t saddr[16]; + uint8_t daddr[16]; + uint16_t sport; + uint16_t dport; +}; + +#define PFLOG4_HDRLEN sizeof(struct _Pflog4_hdr) +#define PFLOG4_HDRMIN sizeof(struct _Pflog4_hdr) + +} // namespace /* * Function: DecodePflog(Packet *, DAQ_PktHdr_t *, uint8_t *) diff --git a/src/codecs/root/root_ppp.cc b/src/codecs/root/root_ppp.cc index 8496a25b4..ad93a5d2c 100644 --- a/src/codecs/root/root_ppp.cc +++ b/src/codecs/root/root_ppp.cc @@ -27,7 +27,7 @@ #endif #include "generators.h" -#include "decode.h" +#include "protocols/packet.h" #include "static_include.h" #include "root_ppp.h" diff --git a/src/codecs/root/root_pppserial.cc b/src/codecs/root/root_pppserial.cc index e04f6c08e..bca0cbdf3 100644 --- a/src/codecs/root/root_pppserial.cc +++ b/src/codecs/root/root_pppserial.cc @@ -27,7 +27,7 @@ #endif #include "generators.h" -#include "decode.h" +#include "protocols/packet.h" #include "static_include.h" #include "root_pppserial.h" diff --git a/src/codecs/root/root_slip.cc b/src/codecs/root/root_slip.cc index de2359a0b..f1078e5a9 100644 --- a/src/codecs/root/root_slip.cc +++ b/src/codecs/root/root_slip.cc @@ -27,7 +27,7 @@ #endif #include "generators.h" -#include "decode.h" +#include "protocols/packet.h" #include "static_include.h" #include "root_slip.h" diff --git a/src/codecs/template.cc b/src/codecs/template.cc index 445db72c3..3841fea72 100644 --- a/src/codecs/template.cc +++ b/src/codecs/template.cc @@ -80,7 +80,7 @@ void NameCodec::get_protocol_ids(std::vector& v) // v.push_back(PROTO_TYPE); } -bool NameCodec::decode(const uint8_t *raw_pkt, const uint32_t raw_len, +bool NameCodec::decode(const uint8_t *raw_pkt, const uint32_t raw_len, Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) { // reinterpret the raw data into this codec's data format diff --git a/src/detection/detect.h b/src/detection/detect.h index a30651f59..07ba0f8f7 100644 --- a/src/detection/detect.h +++ b/src/detection/detect.h @@ -28,7 +28,7 @@ #endif #include "snort_debug.h" -#include "decode.h" +#include "protocols/packet.h" #include "rules.h" #include "treenodes.h" #include "parser.h" diff --git a/src/detection/detection_util.h b/src/detection/detection_util.h index 5fb59f46b..6713c45de 100644 --- a/src/detection/detection_util.h +++ b/src/detection/detection_util.h @@ -33,7 +33,7 @@ #endif #include "snort_types.h" -#include "decode.h" +#include "protocols/packet.h" #include "detect.h" #include "snort.h" #include "snort_debug.h" diff --git a/src/detection/fpdetect.cc b/src/detection/fpdetect.cc index 4634c85a8..1724f98c3 100644 --- a/src/detection/fpdetect.cc +++ b/src/detection/fpdetect.cc @@ -1556,30 +1556,6 @@ int fpEvalPacket(Packet *p) return fpEvalHeaderIp(p, ip_proto, omd); } -void fpEvalIpProtoOnlyRules(SF_LIST **ip_proto_only_lists, Packet *p) -{ - if ((p != NULL) && IPH_IS_VALID(p)) - { - SF_LIST *l = ip_proto_only_lists[GET_IPH_PROTO(p)]; - OptTreeNode *otn; - - /* If list is NULL, sflist_first returns NULL */ - for (otn = (OptTreeNode *)sflist_first(l); - otn != NULL; - otn = (OptTreeNode *)sflist_next(l)) - { - if (fpEvalRTN(getRuntimeRtnFromOtn(otn), p, 0)) - { - if ( SnortEventqAdd(otn) ) - pc.queue_limit++; - - if ( pass_action(getRuntimeRtnFromOtn(otn)->type) ) - p->packet_flags |= PKT_PASS_RULE; - } - } - } -} - void fpEvalIpProtoOnlyRules(SF_LIST **ip_proto_only_lists, Packet *p, uint8_t proto_id) { if ((p != NULL) && IPH_IS_VALID(p)) diff --git a/src/detection/fpdetect.h b/src/detection/fpdetect.h index eba733dda..5b97beb5e 100644 --- a/src/detection/fpdetect.h +++ b/src/detection/fpdetect.h @@ -36,7 +36,7 @@ #include "fpcreate.h" #include "snort_debug.h" -#include "decode.h" +#include "protocols/packet.h" #include "sflsq.h" #include "time/profiler.h" @@ -103,7 +103,6 @@ void otnx_match_data_init(int); void otnx_match_data_term(); int fpAddMatch( OTNX_MATCH_DATA *omd_local, int pLen, OptTreeNode *otn); -void fpEvalIpProtoOnlyRules(SF_LIST **, Packet *); void fpEvalIpProtoOnlyRules(SF_LIST **, Packet *, uint8_t proto_id); OptTreeNode * GetOTN(uint32_t gid, uint32_t sid); diff --git a/src/detection/pcrm.h b/src/detection/pcrm.h index 766cf87d8..ce565e146 100644 --- a/src/detection/pcrm.h +++ b/src/detection/pcrm.h @@ -30,8 +30,8 @@ #ifndef PCRM_H #define PCRM_H -#include "decode.h" #include "bitop.h" +#include "protocols/packet.h" typedef void * RULE_PTR; diff --git a/src/detection/tag.cc b/src/detection/tag.cc index 15faa0ee2..2ce175367 100644 --- a/src/detection/tag.cc +++ b/src/detection/tag.cc @@ -28,7 +28,7 @@ #include #include -#include "decode.h" +#include "protocols/packet.h" #include "rules.h" #include "treenodes.h" #include "snort_debug.h" diff --git a/src/detection/tag.h b/src/detection/tag.h index 7695a3dac..d0504b030 100644 --- a/src/detection/tag.h +++ b/src/detection/tag.h @@ -29,7 +29,7 @@ #include "rules.h" #include "treenodes.h" #include "event.h" -#include "decode.h" +#include "protocols/packet.h" #define TAG_SESSION 1 diff --git a/src/file_api/file_mime_process.cc b/src/file_api/file_mime_process.cc index 0e00eb64d..7cddfc9b5 100644 --- a/src/file_api/file_mime_process.cc +++ b/src/file_api/file_mime_process.cc @@ -34,7 +34,7 @@ #include "snort_bounds.h" #include "util.h" #include "search_engines/str_search.h" -#include "decode.h" +#include "protocols/packet.h" #include "detection_util.h" MimePcre mime_boundary_pcre; diff --git a/src/file_api/file_resume_block.cc b/src/file_api/file_resume_block.cc index 0ddf2c18f..3fd5108df 100644 --- a/src/file_api/file_resume_block.cc +++ b/src/file_api/file_resume_block.cc @@ -32,7 +32,7 @@ #include "ipv6_port.h" #include "sfxhash.h" #include "util.h" -#include "decode.h" +#include "protocols/packet.h" #include "packet_io/active.h" #include "libs/file_sha256.h" diff --git a/src/file_api/file_resume_block.h b/src/file_api/file_resume_block.h index 474ddc7a9..6df4933bc 100644 --- a/src/file_api/file_resume_block.h +++ b/src/file_api/file_resume_block.h @@ -27,7 +27,7 @@ #ifndef FILE_RESUME_BLOCK_H #define FILE_RESUME_BLOCK_H -#include "decode.h" +#include "protocols/packet.h" #include "file_api.h" void file_resume_block_init(void); diff --git a/src/filters/rate_filter.h b/src/filters/rate_filter.h index 2162001e8..b84aeb0b6 100644 --- a/src/filters/rate_filter.h +++ b/src/filters/rate_filter.h @@ -32,7 +32,7 @@ /* @ingroup rate_filter * @{ */ -#include "decode.h" +#include "protocols/packet.h" #include "rules.h" #include "treenodes.h" #include "filters/sfrf.h" diff --git a/src/flow/CMakeLists.txt b/src/flow/CMakeLists.txt index 95690e225..e85309437 100644 --- a/src/flow/CMakeLists.txt +++ b/src/flow/CMakeLists.txt @@ -17,9 +17,10 @@ add_library ( flow STATIC session.h ) -set_target_properties(flow - PROPERTIES - COMPILE_FLAGS "-fvisibility=default" +set_default_visibility_compile_flag(flow) + +target_link_libraries(flow + protocols ) install(FILES ${FLOW_INCLUDES} diff --git a/src/flow/expect_cache.h b/src/flow/expect_cache.h index 66aefa7a7..909ba3091 100644 --- a/src/flow/expect_cache.h +++ b/src/flow/expect_cache.h @@ -21,7 +21,7 @@ #ifndef EXPECT_CACHE_H #define EXPECT_CACHE_H -#include "decode.h" +#include "protocols/packet.h" #include "ipv6_port.h" class FlowData; diff --git a/src/flow/flow.cc b/src/flow/flow.cc index 44df859a1..63a3c5d77 100644 --- a/src/flow/flow.cc +++ b/src/flow/flow.cc @@ -30,7 +30,7 @@ #include "ips_options/ips_flowbits.h" #include "utils/bitop_funcs.h" #include "utils/util.h" -#include "protocols/decode.h" +#include "protocols/packet.h" unsigned FlowData:: flow_id = 0; diff --git a/src/flow/flow_control.cc b/src/flow/flow_control.cc index 802aaee68..621eeb3a7 100644 --- a/src/flow/flow_control.cc +++ b/src/flow/flow_control.cc @@ -34,6 +34,8 @@ #include "packet_io/sfdaq.h" #include "main/binder.h" #include "utils/stats.h" +#include "protocols/layer.h" +#include "protocols/vlan.h" FlowControl::FlowControl() { @@ -212,12 +214,12 @@ void FlowControl::set_key(FlowKey* key, const Packet* p) uint16_t vlanId; uint16_t addressSpaceId; - if ( p->vh ) - vlanId = (uint16_t)VTH_VLAN(p->vh); + if ( p->proto_bits & PROTO_BIT__VLAN ) + vlanId = vlan::vth_vlan(layer::get_vlan_layer(p)); else vlanId = 0; - if ( p->mpls ) + if ( p->proto_bits & PROTO_BIT__MPLS ) mplsId = p->mplsHdr.label; else mplsId = 0; diff --git a/src/flow/flow_key.cc b/src/flow/flow_key.cc index 855384593..cbb9127ca 100644 --- a/src/flow/flow_key.cc +++ b/src/flow/flow_key.cc @@ -26,7 +26,7 @@ #include "config.h" #endif -#include "protocols/decode.h" +#include "protocols/packet.h" #include "snort.h" #include "utils/util.h" @@ -117,9 +117,9 @@ inline void FlowKey::init6( } else if ( proto == IPPROTO_ICMPV6 ) { - if (srcPort == ICMP6_REPLY) + if (srcPort == icmp6::Icmp6Types::REPLY) { - dstPort = ICMP6_ECHO; /* Treat ICMPv6 echo reply the same as request */ + dstPort = icmp6::Icmp6Types::ECHO; /* Treat ICMPv6 echo reply the same as request */ srcPort = 0; } else /* otherwise, every ICMP type gets different key */ diff --git a/src/framework/codec.h b/src/framework/codec.h index 28b22320f..8eb8371d5 100644 --- a/src/framework/codec.h +++ b/src/framework/codec.h @@ -21,39 +21,41 @@ #define CODEC_H #include +#include #include "snort_types.h" #include "framework/base_api.h" +#include "codecs/sf_protocols.h" +#include "protocols/icmp4.h" #include "packet.h" - -// REMOVE WHEN POSSIBLE!!! - - +struct Packet; struct Layer; -typedef enum { - ENC_TCP_FIN, ENC_TCP_RST, - ENC_UNR_NET, ENC_UNR_HOST, - ENC_UNR_PORT, ENC_UNR_FW, +enum EncodeType{ + ENC_TCP_FIN, + ENC_TCP_RST, + ENC_UNR_NET, + ENC_UNR_HOST, + ENC_UNR_PORT, + ENC_UNR_FW, ENC_TCP_PUSH, ENC_MAX -} EncodeType; - -#define ENC_FLAG_FWD 0x80000000 // send in forward direction -#define ENC_FLAG_SEQ 0x40000000 // VAL bits contain seq adj -#define ENC_FLAG_ID 0x20000000 // use randomized IP ID -#define ENC_FLAG_NET 0x10000000 // stop after innermost network (ip4/6) layer -#define ENC_FLAG_DEF 0x08000000 // stop before innermost ip4 opts or ip6 frag header -#define ENC_FLAG_RAW 0x04000000 // don't encode outer eth header (this is raw ip) -#define ENC_FLAG_RES 0x03000000 // bits reserved for future use -#define ENC_FLAG_VAL 0x00FFFFFF // bits for adjusting seq and/or ack -const uint8_t MIN_TTL = 64; -const uint8_t MAX_TTL = 255; +}; + typedef uint32_t EncodeFlags; +const uint32_t ENC_FLAG_FWD = 0x80000000; // send in forward direction +const uint32_t ENC_FLAG_SEQ = 0x40000000; // VAL bits contain seq adj +const uint32_t ENC_FLAG_ID = 0x20000000; // use randomized IP ID +const uint32_t ENC_FLAG_NET = 0x10000000; // stop after innermost network (ip4/6) layer +const uint32_t ENC_FLAG_DEF = 0x08000000; // stop before innermost ip4 opts or ip6 frag header +const uint32_t ENC_FLAG_RAW = 0x04000000; // don't encode outer eth header (this is raw ip) +const uint32_t ENC_FLAG_RES = 0x03000000; // bits reserved for future use +const uint32_t ENC_FLAG_VAL = 0x00FFFFFF; // bits for adjusting seq and/or ack + -typedef struct { +struct EncState{ EncodeType type; EncodeFlags flags; @@ -65,8 +67,7 @@ typedef struct { const uint8_t* payLoad; uint32_t payLen; uint8_t proto; - -} EncState; +}; // Copied from dnet/blob.h @@ -81,22 +82,7 @@ struct Buffer { }; -static inline bool forward(const EncState *e) -{ - return e->flags & ENC_FLAG_FWD; -} - -static inline bool reverse(const EncodeFlags f) -{ - return !(f & ENC_FLAG_FWD); -} - -static inline uint16_t get_decoded_length(EncState *enc) -{ - return enc->p->layers[enc->layer-1].length; -} - -// Update's the buffer to contain an additional +// Update's the buffer to contain an additional static inline bool update_buffer(Buffer* buf, size_t n) { if ( buf->end + n > (unsigned int)buf->size ) @@ -110,8 +96,6 @@ static inline bool update_buffer(Buffer* buf, size_t n) } - - class Codec { public: @@ -155,9 +139,8 @@ public: virtual bool update(Packet*, Layer*, uint32_t* /*len*/) { return true; }; // formatter virtual void format(EncodeFlags, const Packet* /*orig*/, Packet* /*clone*/, Layer*) {}; - - // DELETE - virtual inline PROTO_ID get_proto_id() { return PROTO_AH; }; + // used for backwards compatability. + virtual PROTO_ID get_proto_id() { return PROTO_AH; }; protected: @@ -167,12 +150,29 @@ protected: }; - inline uint8_t buff_diff(Buffer *buf, uint8_t* ho) + static inline bool forward(const EncState *e) + { + return e->flags & ENC_FLAG_FWD; + } + + static inline bool reverse(const EncodeFlags f) + { + return !(f & ENC_FLAG_FWD); + } + + static inline uint16_t get_decoded_length(EncState *enc) + { + return enc->p->layers[enc->layer-1].length; + } + + + static inline uint8_t buff_diff(Buffer *buf, uint8_t* ho) { return ((uint8_t*)(buf->base+buf->end)-(uint8_t*)ho); } - inline icmp4::IcmpCode get_icmp_code (EncodeType et) { + static inline icmp4::IcmpCode get_icmp_code (EncodeType et) + { switch ( et ) { case EncodeType::ENC_UNR_NET: return icmp4::IcmpCode::NET_UNREACH; case EncodeType::ENC_UNR_HOST: return icmp4::IcmpCode::HOST_UNREACH; @@ -183,6 +183,7 @@ protected: } + private: const char* name; }; diff --git a/src/ips_options/extract.cc b/src/ips_options/extract.cc index 91b1dc7bf..668e0114c 100644 --- a/src/ips_options/extract.cc +++ b/src/ips_options/extract.cc @@ -57,7 +57,7 @@ int byte_extract(int endianess, int bytes_to_grab, const uint8_t *ptr, const uint8_t *start, const uint8_t *end, uint32_t *value) { - if(endianess != LITTLE && endianess != BIG) + if(endianess != ENDIAN_LITTLE && endianess != ENDIAN_BIG) { /* we only support 2 byte formats */ return -2; @@ -84,7 +84,7 @@ int byte_extract(int endianess, int bytes_to_grab, const uint8_t *ptr, *value = (*ptr) & 0xFF; break; case 2: - if(endianess == LITTLE) + if(endianess == ENDIAN_LITTLE) { *value = (*ptr) & 0xFF; *value |= (*(ptr + 1) & 0xFF) << 8; @@ -96,7 +96,7 @@ int byte_extract(int endianess, int bytes_to_grab, const uint8_t *ptr, } break; case 3: - if (endianess == LITTLE) + if (endianess == ENDIAN_LITTLE) { *value = (*ptr) & 0xFF; *value |= ((*(ptr + 1)) & 0xFF) << 8; @@ -110,7 +110,7 @@ int byte_extract(int endianess, int bytes_to_grab, const uint8_t *ptr, } break; case 4: - if(endianess == LITTLE) + if(endianess == ENDIAN_LITTLE) { *value = (*ptr) & 0xFF; *value |= ((*(ptr + 1)) & 0xFF) << 8; @@ -214,7 +214,7 @@ void test_extract(void) value3[2] = 0x00; value3[3] = 0x00; - if(byte_extract(BIG, 2, value1, value1, value1 + 2, &ret)) + if(byte_extract(ENDIAN_BIG, 2, value1, value1, value1 + 2, &ret)) { printf("test 1 failed\n"); } @@ -223,7 +223,7 @@ void test_extract(void) printf("test 1: value: %x %u\n", ret, ret); } - if(byte_extract(LITTLE, 2, value1, value1, value1 + 2, &ret)) + if(byte_extract(ENDIAN_LITTLE, 2, value1, value1, value1 + 2, &ret)) { printf("test 2 failed\n"); } @@ -233,7 +233,7 @@ void test_extract(void) } - if(byte_extract(LITTLE, 2, value1 + 2, value1, value1 + 2, &ret)) + if(byte_extract(ENDIAN_LITTLE, 2, value1 + 2, value1, value1 + 2, &ret)) { printf("test 3 failed correctly\n"); } @@ -243,7 +243,7 @@ void test_extract(void) } - if(byte_extract(BIG, 2, value2, value2, value2 + 2, &ret)) + if(byte_extract(ENDIAN_BIG, 2, value2, value2, value2 + 2, &ret)) { printf("test 1 failed\n"); } @@ -252,7 +252,7 @@ void test_extract(void) printf("test 1: value: %x %u\n", ret, ret); } - if(byte_extract(LITTLE, 2, value2, value2, value2 + 2, &ret)) + if(byte_extract(ENDIAN_LITTLE, 2, value2, value2, value2 + 2, &ret)) { printf("test 2 failed\n"); } @@ -262,7 +262,7 @@ void test_extract(void) } - if(byte_extract(LITTLE, 2, value2 + 2, value2, value2 + 2, &ret)) + if(byte_extract(ENDIAN_LITTLE, 2, value2 + 2, value2, value2 + 2, &ret)) { printf("test 3 failed correctly\n"); } @@ -272,7 +272,7 @@ void test_extract(void) } - if(byte_extract(BIG, 4, value3, value3, value3 + 4, &ret)) + if(byte_extract(ENDIAN_BIG, 4, value3, value3, value3 + 4, &ret)) { printf("test 1 failed\n"); } @@ -281,7 +281,7 @@ void test_extract(void) printf("test 1: value: %x %u\n", ret, ret); } - if(byte_extract(LITTLE, 4, value3, value3, value3 + 4, &ret)) + if(byte_extract(ENDIAN_LITTLE, 4, value3, value3, value3 + 4, &ret)) { printf("test 2 failed\n"); } @@ -291,7 +291,7 @@ void test_extract(void) } - if(byte_extract(LITTLE, 4, value3 + 2, value3, value3 + 4, &ret)) + if(byte_extract(ENDIAN_LITTLE, 4, value3 + 2, value3, value3 + 4, &ret)) { printf("test 3 failed correctly\n"); } @@ -304,7 +304,7 @@ void test_extract(void) for(i=0;i<10;i++) { - if(byte_extract(LITTLE, 4, value3 + i, value3, value3 + 4, &ret)) + if(byte_extract(ENDIAN_LITTLE, 4, value3 + i, value3, value3 + 4, &ret)) { printf("[loop] %d failed correctly\n", i); } diff --git a/src/ips_options/extract.h b/src/ips_options/extract.h index 18fd0e32a..b2039f839 100644 --- a/src/ips_options/extract.h +++ b/src/ips_options/extract.h @@ -24,8 +24,8 @@ #define EXTRACT_H #define ENDIAN_NONE -1 -#define BIG 0 -#define LITTLE 1 +#define ENDIAN_BIG 0 +#define ENDIAN_LITTLE 1 #define ENDIAN_FUNC 2 #define PARSELEN 10 diff --git a/src/ips_options/ips_ack.cc b/src/ips_options/ips_ack.cc index 94cc8c722..d88f7e638 100644 --- a/src/ips_options/ips_ack.cc +++ b/src/ips_options/ips_ack.cc @@ -29,7 +29,7 @@ #include "snort_types.h" #include "detection/treenodes.h" -#include "decode.h" +#include "protocols/packet.h" #include "parser.h" #include "snort_debug.h" #include "util.h" diff --git a/src/ips_options/ips_asn1.cc b/src/ips_options/ips_asn1.cc index 88bea2fbe..191d13c62 100644 --- a/src/ips_options/ips_asn1.cc +++ b/src/ips_options/ips_asn1.cc @@ -64,7 +64,7 @@ #include "snort_bounds.h" #include "snort_debug.h" #include "detection/treenodes.h" -#include "decode.h" +#include "protocols/packet.h" #include "parser.h" #include "util.h" #include "asn1.h" diff --git a/src/ips_options/ips_base64_data.cc b/src/ips_options/ips_base64_data.cc index 59c93f38e..a890ef244 100644 --- a/src/ips_options/ips_base64_data.cc +++ b/src/ips_options/ips_base64_data.cc @@ -33,7 +33,7 @@ #include "snort_types.h" #include "snort_bounds.h" -#include "decode.h" +#include "protocols/packet.h" #include "parser.h" #include "snort_debug.h" #include "util.h" diff --git a/src/ips_options/ips_base64_decode.cc b/src/ips_options/ips_base64_decode.cc index 3ad4c7b84..f6b3183a4 100644 --- a/src/ips_options/ips_base64_decode.cc +++ b/src/ips_options/ips_base64_decode.cc @@ -33,7 +33,7 @@ #include "snort_types.h" #include "snort_bounds.h" -#include "decode.h" +#include "protocols/packet.h" #include "parser.h" #include "snort_debug.h" #include "util.h" diff --git a/src/ips_options/ips_byte_extract.cc b/src/ips_options/ips_byte_extract.cc index fa12b7993..a385a79ef 100644 --- a/src/ips_options/ips_byte_extract.cc +++ b/src/ips_options/ips_byte_extract.cc @@ -471,7 +471,7 @@ static int byte_extract_parse(ByteExtractData *data, char *args) else if (strcmp(token, "little") == 0) { if (data->endianess == ENDIAN_NONE) - data->endianess = LITTLE; + data->endianess = ENDIAN_LITTLE; else ParseError("byte_extract rule option specifies the " "byte order twice. Use only one of 'big', 'little', " @@ -481,7 +481,7 @@ static int byte_extract_parse(ByteExtractData *data, char *args) else if (strcmp(token, "big") == 0) { if (data->endianess == ENDIAN_NONE) - data->endianess = BIG; + data->endianess = ENDIAN_BIG; else ParseError("byte_extract rule option specifies the " "byte order twice. Use only one of 'big', 'little', " @@ -565,7 +565,7 @@ static int byte_extract_parse(ByteExtractData *data, char *args) /* Replace sentinels with defaults */ if (data->endianess == ENDIAN_NONE) - data->endianess = BIG; + data->endianess = ENDIAN_BIG; if (data->data_string_convert_flag && (data->base == 0)) data->base = 10; diff --git a/src/ips_options/ips_byte_jump.cc b/src/ips_options/ips_byte_jump.cc index c4935e002..ee6a8a926 100644 --- a/src/ips_options/ips_byte_jump.cc +++ b/src/ips_options/ips_byte_jump.cc @@ -75,7 +75,7 @@ #include "snort_types.h" #include "snort_bounds.h" #include "detection/treenodes.h" -#include "decode.h" +#include "protocols/packet.h" #include "parser.h" #include "snort_debug.h" #include "util.h" @@ -469,12 +469,12 @@ static void byte_jump_parse(char *data, ByteJumpData *idx) } else if(!strcasecmp(cptr, "little")) { - idx->endianess = LITTLE; + idx->endianess = ENDIAN_LITTLE; } else if(!strcasecmp(cptr, "big")) { /* this is the default */ - idx->endianess = BIG; + idx->endianess = ENDIAN_BIG; } else if(!strcasecmp(cptr, "hex")) { diff --git a/src/ips_options/ips_byte_test.cc b/src/ips_options/ips_byte_test.cc index 4303bec5e..e06e4aebb 100644 --- a/src/ips_options/ips_byte_test.cc +++ b/src/ips_options/ips_byte_test.cc @@ -96,7 +96,7 @@ #include "snort_bounds.h" #include "extract.h" #include "detection/treenodes.h" -#include "decode.h" +#include "protocols/packet.h" #include "parser.h" #include "snort_debug.h" #include "util.h" diff --git a/src/ips_options/ips_cvs.cc b/src/ips_options/ips_cvs.cc index cbf23d488..8de2e2a3b 100644 --- a/src/ips_options/ips_cvs.cc +++ b/src/ips_options/ips_cvs.cc @@ -49,7 +49,7 @@ #include "snort_types.h" #include "detection/treenodes.h" -#include "decode.h" +#include "protocols/packet.h" #include "parser.h" #include "snort_debug.h" #include "util.h" diff --git a/src/ips_options/ips_dsize.cc b/src/ips_options/ips_dsize.cc index 732fb51a2..28c123b84 100644 --- a/src/ips_options/ips_dsize.cc +++ b/src/ips_options/ips_dsize.cc @@ -29,7 +29,7 @@ #include "snort_types.h" #include "detection/treenodes.h" -#include "decode.h" +#include "protocols/packet.h" #include "snort_debug.h" #include "parser.h" #include "util.h" diff --git a/src/ips_options/ips_file_data.cc b/src/ips_options/ips_file_data.cc index 5b3516982..44fc1cf81 100644 --- a/src/ips_options/ips_file_data.cc +++ b/src/ips_options/ips_file_data.cc @@ -31,7 +31,7 @@ #include "snort_types.h" #include "snort_bounds.h" -#include "decode.h" +#include "protocols/packet.h" #include "parser.h" #include "snort_debug.h" #include "util.h" diff --git a/src/ips_options/ips_flags.cc b/src/ips_options/ips_flags.cc index ff234872f..d90c5341d 100644 --- a/src/ips_options/ips_flags.cc +++ b/src/ips_options/ips_flags.cc @@ -30,7 +30,7 @@ #include "snort_types.h" #include "detection/treenodes.h" -#include "decode.h" +#include "protocols/packet.h" #include "parser.h" #include "snort_debug.h" #include "util.h" diff --git a/src/ips_options/ips_flow.cc b/src/ips_options/ips_flow.cc index 40371a6af..050277b8c 100644 --- a/src/ips_options/ips_flow.cc +++ b/src/ips_options/ips_flow.cc @@ -30,7 +30,7 @@ #include "snort_types.h" #include "detection/treenodes.h" -#include "decode.h" +#include "protocols/packet.h" #include "parser.h" #include "snort_debug.h" #include "util.h" diff --git a/src/ips_options/ips_flowbits.cc b/src/ips_options/ips_flowbits.cc index 720f889f0..53307f879 100644 --- a/src/ips_options/ips_flowbits.cc +++ b/src/ips_options/ips_flowbits.cc @@ -51,7 +51,7 @@ #include "snort_types.h" #include "detection/treenodes.h" -#include "decode.h" +#include "protocols/packet.h" #include "parser.h" #include "snort_debug.h" #include "util.h" diff --git a/src/ips_options/ips_fragbits.cc b/src/ips_options/ips_fragbits.cc index 091eb337e..9fd828e29 100644 --- a/src/ips_options/ips_fragbits.cc +++ b/src/ips_options/ips_fragbits.cc @@ -54,7 +54,7 @@ #include "snort_types.h" #include "detection/treenodes.h" -#include "decode.h" +#include "protocols/packet.h" #include "parser.h" #include "snort_debug.h" #include "util.h" diff --git a/src/ips_options/ips_fragoffset.cc b/src/ips_options/ips_fragoffset.cc index ef44bf697..576b31b23 100644 --- a/src/ips_options/ips_fragoffset.cc +++ b/src/ips_options/ips_fragoffset.cc @@ -31,7 +31,7 @@ #include "snort_types.h" #include "detection/treenodes.h" -#include "decode.h" +#include "protocols/packet.h" #include "parser.h" #include "snort_debug.h" #include "util.h" diff --git a/src/ips_options/ips_ftpbounce.cc b/src/ips_options/ips_ftpbounce.cc index 00ee57068..db6fccb25 100644 --- a/src/ips_options/ips_ftpbounce.cc +++ b/src/ips_options/ips_ftpbounce.cc @@ -60,7 +60,7 @@ #include "snort_types.h" #include "snort_bounds.h" #include "detection/treenodes.h" -#include "decode.h" +#include "protocols/packet.h" #include "parser.h" #include "snort_debug.h" #include "util.h" diff --git a/src/ips_options/ips_icmp_id.cc b/src/ips_options/ips_icmp_id.cc index 2c59aa351..108f88d7b 100644 --- a/src/ips_options/ips_icmp_id.cc +++ b/src/ips_options/ips_icmp_id.cc @@ -51,7 +51,7 @@ #include "snort_types.h" #include "detection/treenodes.h" -#include "decode.h" +#include "protocols/packet.h" #include "parser.h" #include "snort_debug.h" #include "util.h" @@ -146,7 +146,7 @@ int IcmpIdOption::eval(Packet *p) PREPROC_PROFILE_START(icmpIdPerfStats); if( (p->icmph->type == ICMP_ECHO || p->icmph->type == ICMP_ECHOREPLY) - || ((uint16_t)p->icmph->type == ICMP6_ECHO || (uint16_t)p->icmph->type == ICMP6_REPLY) + || ((uint16_t)p->icmph->type == icmp6::Icmp6Types::ECHO || (uint16_t)p->icmph->type == icmp6::Icmp6Types::REPLY) ) { /* test the rule ID value against the ICMP extension ID field */ diff --git a/src/ips_options/ips_icmp_seq.cc b/src/ips_options/ips_icmp_seq.cc index 88972054b..d8552922b 100644 --- a/src/ips_options/ips_icmp_seq.cc +++ b/src/ips_options/ips_icmp_seq.cc @@ -50,7 +50,7 @@ #include "snort_types.h" #include "detection/treenodes.h" -#include "decode.h" +#include "protocols/packet.h" #include "parser.h" #include "snort_debug.h" #include "util.h" @@ -145,7 +145,7 @@ int IcmpSeqOption::eval(Packet *p) PREPROC_PROFILE_START(icmpSeqPerfStats); if( (p->icmph->type == ICMP_ECHO || p->icmph->type == ICMP_ECHOREPLY) - || ((uint16_t)p->icmph->type == ICMP6_ECHO || (uint16_t)p->icmph->type == ICMP6_REPLY) + || ((uint16_t)p->icmph->type == icmp6::Icmp6Types::ECHO || (uint16_t)p->icmph->type == icmp6::Icmp6Types::REPLY) ) { /* test the rule ID value against the ICMP extension ID field */ diff --git a/src/ips_options/ips_icode.cc b/src/ips_options/ips_icode.cc index cc8f1789c..366eeae1a 100644 --- a/src/ips_options/ips_icode.cc +++ b/src/ips_options/ips_icode.cc @@ -29,7 +29,7 @@ #include "snort_types.h" #include "treenodes.h" -#include "decode.h" +#include "protocols/packet.h" #include "parser.h" #include "util.h" #include "snort_debug.h" diff --git a/src/ips_options/ips_id.cc b/src/ips_options/ips_id.cc index 43cf2e1ef..95587e574 100644 --- a/src/ips_options/ips_id.cc +++ b/src/ips_options/ips_id.cc @@ -29,7 +29,7 @@ #include "snort_types.h" #include "treenodes.h" -#include "decode.h" +#include "protocols/packet.h" #include "parser.h" #include "snort_debug.h" #include "util.h" diff --git a/src/ips_options/ips_ip_proto.cc b/src/ips_options/ips_ip_proto.cc index 619dcb177..880a84c51 100644 --- a/src/ips_options/ips_ip_proto.cc +++ b/src/ips_options/ips_ip_proto.cc @@ -33,7 +33,7 @@ #include #include "treenodes.h" -#include "decode.h" +#include "protocols/packet.h" #include "parser.h" #include "snort_debug.h" #include "util.h" diff --git a/src/ips_options/ips_ipopts.cc b/src/ips_options/ips_ipopts.cc index 6da747599..fc47f5e06 100644 --- a/src/ips_options/ips_ipopts.cc +++ b/src/ips_options/ips_ipopts.cc @@ -30,7 +30,7 @@ #include "snort_types.h" #include "treenodes.h" -#include "decode.h" +#include "protocols/packet.h" #include "parser.h" #include "snort_debug.h" #include "util.h" diff --git a/src/ips_options/ips_isdataat.cc b/src/ips_options/ips_isdataat.cc index b27f3bae7..ce54eb7d8 100644 --- a/src/ips_options/ips_isdataat.cc +++ b/src/ips_options/ips_isdataat.cc @@ -47,7 +47,7 @@ #include "snort_types.h" #include "snort_bounds.h" #include "treenodes.h" -#include "decode.h" +#include "protocols/packet.h" #include "parser.h" #include "snort_debug.h" #include "util.h" diff --git a/src/ips_options/ips_itype.cc b/src/ips_options/ips_itype.cc index 84cde8b32..b4a80dc42 100644 --- a/src/ips_options/ips_itype.cc +++ b/src/ips_options/ips_itype.cc @@ -29,7 +29,7 @@ #include "snort_types.h" #include "treenodes.h" -#include "decode.h" +#include "protocols/packet.h" #include "parser.h" #include "snort_debug.h" #include "util.h" diff --git a/src/ips_options/ips_pcre.cc b/src/ips_options/ips_pcre.cc index 5e6857dac..091bc5926 100644 --- a/src/ips_options/ips_pcre.cc +++ b/src/ips_options/ips_pcre.cc @@ -33,7 +33,7 @@ #include "snort_bounds.h" #include "treenodes.h" #include "snort_debug.h" -#include "decode.h" +#include "protocols/packet.h" #include "parser.h" #include "util.h" #include "mstring.h" diff --git a/src/ips_options/ips_pkt_data.cc b/src/ips_options/ips_pkt_data.cc index b03466c14..44d51484c 100644 --- a/src/ips_options/ips_pkt_data.cc +++ b/src/ips_options/ips_pkt_data.cc @@ -29,7 +29,7 @@ #include "snort_types.h" #include "snort_bounds.h" -#include "decode.h" +#include "protocols/packet.h" #include "parser.h" #include "snort_debug.h" #include "util.h" diff --git a/src/ips_options/ips_react.cc b/src/ips_options/ips_react.cc index 6006a4f18..b921171d9 100644 --- a/src/ips_options/ips_react.cc +++ b/src/ips_options/ips_react.cc @@ -58,7 +58,7 @@ #include "snort_types.h" #include "snort_debug.h" -#include "decode.h" +#include "protocols/packet.h" #include "managers/packet_manager.h" #include "detection/detection_defines.h" #include "parser.h" diff --git a/src/ips_options/ips_resp.cc b/src/ips_options/ips_resp.cc index b041ccfab..ba0d04a45 100644 --- a/src/ips_options/ips_resp.cc +++ b/src/ips_options/ips_resp.cc @@ -57,7 +57,7 @@ #include "snort_types.h" #include "snort_bounds.h" #include "snort_debug.h" -#include "decode.h" +#include "protocols/packet.h" #include "managers/packet_manager.h" #include "detection/detection_defines.h" #include "mstring.h" diff --git a/src/ips_options/ips_rpc.cc b/src/ips_options/ips_rpc.cc index ebc2e1d9b..44df9474f 100644 --- a/src/ips_options/ips_rpc.cc +++ b/src/ips_options/ips_rpc.cc @@ -29,7 +29,7 @@ #include #include "treenodes.h" -#include "decode.h" +#include "protocols/packet.h" #include "parser.h" #include "snort_debug.h" #include "util.h" diff --git a/src/ips_options/ips_sameip.cc b/src/ips_options/ips_sameip.cc index 07645a17d..ba78eb1ad 100644 --- a/src/ips_options/ips_sameip.cc +++ b/src/ips_options/ips_sameip.cc @@ -30,7 +30,7 @@ #include "snort_types.h" #include "treenodes.h" -#include "decode.h" +#include "protocols/packet.h" #include "parser.h" #include "snort_debug.h" #include "util.h" diff --git a/src/ips_options/ips_seq.cc b/src/ips_options/ips_seq.cc index 48f06943f..409a4a3a8 100644 --- a/src/ips_options/ips_seq.cc +++ b/src/ips_options/ips_seq.cc @@ -29,7 +29,7 @@ #include "snort_types.h" #include "treenodes.h" -#include "decode.h" +#include "protocols/packet.h" #include "parser.h" #include "util.h" #include "snort_debug.h" diff --git a/src/ips_options/ips_session.cc b/src/ips_options/ips_session.cc index e8c0dcb60..041c95fd3 100644 --- a/src/ips_options/ips_session.cc +++ b/src/ips_options/ips_session.cc @@ -56,7 +56,7 @@ #include #include "treenodes.h" -#include "decode.h" +#include "protocols/packet.h" #include "parser.h" #include "snort_debug.h" #include "util.h" diff --git a/src/ips_options/ips_tos.cc b/src/ips_options/ips_tos.cc index 6c72c02c4..86927cc68 100644 --- a/src/ips_options/ips_tos.cc +++ b/src/ips_options/ips_tos.cc @@ -28,7 +28,7 @@ #include #include -#include "decode.h" +#include "protocols/packet.h" #include "parser.h" #include "snort_debug.h" #include "util.h" diff --git a/src/ips_options/ips_ttl.cc b/src/ips_options/ips_ttl.cc index 95487e8bf..76e20cd04 100644 --- a/src/ips_options/ips_ttl.cc +++ b/src/ips_options/ips_ttl.cc @@ -28,7 +28,7 @@ #include "snort_types.h" #include "treenodes.h" -#include "decode.h" +#include "protocols/packet.h" #include "snort_debug.h" #include "parser.h" #include "util.h" diff --git a/src/ips_options/ips_urilen.cc b/src/ips_options/ips_urilen.cc index b87e139d9..9ec6e809b 100644 --- a/src/ips_options/ips_urilen.cc +++ b/src/ips_options/ips_urilen.cc @@ -31,7 +31,7 @@ #include "snort_types.h" #include "treenodes.h" -#include "decode.h" +#include "protocols/packet.h" #include "snort_debug.h" #include "parser.h" #include "util.h" diff --git a/src/ips_options/ips_window.cc b/src/ips_options/ips_window.cc index 38703c91e..739183900 100644 --- a/src/ips_options/ips_window.cc +++ b/src/ips_options/ips_window.cc @@ -30,7 +30,7 @@ #include "snort_types.h" #include "treenodes.h" -#include "decode.h" +#include "protocols/packet.h" #include "parser.h" #include "util.h" #include "snort_debug.h" diff --git a/src/ips_options/replace.cc b/src/ips_options/replace.cc index 60592586f..55fba27d4 100644 --- a/src/ips_options/replace.cc +++ b/src/ips_options/replace.cc @@ -30,7 +30,7 @@ #include "snort_types.h" #include "snort_bounds.h" #include "snort_debug.h" -#include "decode.h" +#include "protocols/packet.h" #include "parser.h" #include "ips_content.h" #include "snort.h" diff --git a/src/log/CMakeLists.txt b/src/log/CMakeLists.txt index c0cb761fa..1555236e2 100644 --- a/src/log/CMakeLists.txt +++ b/src/log/CMakeLists.txt @@ -26,4 +26,5 @@ install(FILES ${LOG_INCLUDES} target_link_libraries(log utils + protocols ) diff --git a/src/log/log.cc b/src/log/log.cc index 2af307451..fdbd2dc0e 100644 --- a/src/log/log.cc +++ b/src/log/log.cc @@ -160,7 +160,7 @@ void snort_print(Packet* p) LogIPPkt(text_log, GET_IPH_PROTO((p)), p); } #ifndef NO_NON_ETHER_DECODER - else if (p->ah != NULL) + else if (p->proto_bits & PROTO_BIT__ARP) { log_mutex.lock(); LogArpHeader(text_log, p); diff --git a/src/log/log.h b/src/log/log.h index 190cc48bc..bb53e3f8e 100644 --- a/src/log/log.h +++ b/src/log/log.h @@ -22,7 +22,7 @@ #ifndef LOG_H #define LOG_H -#include "decode.h" +#include "protocols/packet.h" void CreateTCPFlagString(Packet *, char *); diff --git a/src/log/log_text.cc b/src/log/log_text.cc index d01c65e8e..5fca16ddf 100644 --- a/src/log/log_text.cc +++ b/src/log/log_text.cc @@ -41,13 +41,14 @@ #include "snort_debug.h" #include "signature.h" #include "util_net.h" -#include "decode.h" +#include "protocols/packet.h" #include "snort.h" #include "sf_textlog.h" #include "snort_bounds.h" #include "obfuscation.h" #include "detection_util.h" #include "packet_io/sfdaq.h" +#include "protocols/layer.h" #include "sfip/sf_ip.h" @@ -55,7 +56,11 @@ #include "protocols/ipv6.h" #include "protocols/icmp6.h" #include "protocols/icmp4.h" +#include "protocols/gre.h" +#include "protocols/token_ring.h" #include "protocols/wlan.h" +#include "protocols/linux_sll.h" +#include "protocols/eapol.h" #ifdef HAVE_DUMBNET_H #include @@ -122,33 +127,41 @@ void LogPriorityData(TextLog* log, const Event* e, bool doNewLine) void LogTrHeader(TextLog* log, Packet* p) { + const token_ring::Trh_hdr* trh = + reinterpret_cast(layer::get_root_layer(p)); - TextLog_Print(log, "%X:%X:%X:%X:%X:%X -> ", p->trh->saddr[0], - p->trh->saddr[1], p->trh->saddr[2], p->trh->saddr[3], - p->trh->saddr[4], p->trh->saddr[5]); - TextLog_Print(log, "%X:%X:%X:%X:%X:%X\n", p->trh->daddr[0], - p->trh->daddr[1], p->trh->daddr[2], p->trh->daddr[3], - p->trh->daddr[4], p->trh->daddr[5]); + TextLog_Print(log, "%X:%X:%X:%X:%X:%X -> ", trh->saddr[0], + trh->saddr[1], trh->saddr[2], trh->saddr[3], + trh->saddr[4], trh->saddr[5]); + TextLog_Print(log, "%X:%X:%X:%X:%X:%X\n", trh->daddr[0], + trh->daddr[1], trh->daddr[2], trh->daddr[3], + trh->daddr[4], trh->daddr[5]); + + const token_ring::Trh_llc* trhllc = + reinterpret_cast(trh + sizeof(*trh)); + + TextLog_Print(log, "access control:0x%X frame control:0x%X\n", trh->ac, + trh->fc); - TextLog_Print(log, "access control:0x%X frame control:0x%X\n", p->trh->ac, - p->trh->fc); - if(!p->trhllc) - return; TextLog_Print(log, "DSAP: 0x%X SSAP 0x%X protoID: %X%X%X Ethertype: %X\n", - p->trhllc->dsap, p->trhllc->ssap, p->trhllc->protid[0], - p->trhllc->protid[1], p->trhllc->protid[2], p->trhllc->ethertype); - if(p->trhmr) + trhllc->dsap, trhllc->ssap, trhllc->protid[0], + trhllc->protid[1], trhllc->protid[2], trhllc->ethertype); + + + const token_ring::Trh_mr* trhmr = token_ring::get_trhmr(trhllc); + + if(trhmr) { TextLog_Print(log, "RIF structure is present:\n"); TextLog_Print(log, "bcast: 0x%X length: 0x%X direction: 0x%X largest" "fr. size: 0x%X res: 0x%X\n", - TRH_MR_BCAST(p->trhmr), TRH_MR_LEN(p->trhmr), - TRH_MR_DIR(p->trhmr), TRH_MR_LF(p->trhmr), - TRH_MR_RES(p->trhmr)); + TRH_MR_BCAST(trhmr), TRH_MR_LEN(trhmr), + TRH_MR_DIR(trhmr), TRH_MR_LF(trhmr), + TRH_MR_RES(trhmr)); TextLog_Print(log, "rseg -> %X:%X:%X:%X:%X:%X:%X:%X\n", - p->trhmr->rseg[0], p->trhmr->rseg[1], p->trhmr->rseg[2], - p->trhmr->rseg[3], p->trhmr->rseg[4], p->trhmr->rseg[5], - p->trhmr->rseg[6], p->trhmr->rseg[7]); + trhmr->rseg[0], trhmr->rseg[1], trhmr->rseg[2], + trhmr->rseg[3], trhmr->rseg[4], trhmr->rseg[5], + trhmr->rseg[6], trhmr->rseg[7]); } } #endif // NO_NON_ETHER_DECODER @@ -165,18 +178,20 @@ void LogTrHeader(TextLog* log, Packet* p) */ static void LogEthHeader(TextLog* log, Packet* p) { + const eth::EtherHdr *eh = layer::get_eth_layer(p); + /* src addr */ - TextLog_Print(log, "%02X:%02X:%02X:%02X:%02X:%02X -> ", p->eh->ether_src[0], - p->eh->ether_src[1], p->eh->ether_src[2], p->eh->ether_src[3], - p->eh->ether_src[4], p->eh->ether_src[5]); + TextLog_Print(log, "%02X:%02X:%02X:%02X:%02X:%02X -> ", eh->ether_src[0], + eh->ether_src[1], eh->ether_src[2], eh->ether_src[3], + eh->ether_src[4], eh->ether_src[5]); /* dest addr */ - TextLog_Print(log, "%02X:%02X:%02X:%02X:%02X:%02X ", p->eh->ether_dst[0], - p->eh->ether_dst[1], p->eh->ether_dst[2], p->eh->ether_dst[3], - p->eh->ether_dst[4], p->eh->ether_dst[5]); + TextLog_Print(log, "%02X:%02X:%02X:%02X:%02X:%02X ", eh->ether_dst[0], + eh->ether_dst[1], eh->ether_dst[2], eh->ether_dst[3], + eh->ether_dst[4], eh->ether_dst[5]); /* protocol and pkt size */ - TextLog_Print(log, "type:0x%X len:0x%X\n", ntohs(p->eh->ether_type), + TextLog_Print(log, "type:0x%X len:0x%X\n", ntohs(eh->ether_type), p->pkth->pktlen); } @@ -189,11 +204,13 @@ static void LogMPLSHeader(TextLog* log, Packet* p) static void LogGREHeader(TextLog *log, Packet *p) { - if (p->greh == NULL) + const gre::GREHdr *greh = layer::get_gre_layer(p); + + if (greh == NULL) return; TextLog_Print(log, "GRE version:%u flags:0x%02X ether-type:0x%04X\n", - GRE_VERSION(p->greh), p->greh->flags, GRE_PROTO(p->greh)); + GRE_VERSION(greh), greh->flags, GRE_PROTO(greh)); } #ifndef NO_NON_ETHER_DECODER @@ -211,7 +228,10 @@ static void LogGREHeader(TextLog *log, Packet *p) #ifdef DLT_LINUX_SLL static void LogSLLHeader(TextLog* log, Packet* p) { - switch (ntohs(p->sllh->sll_pkttype)) { + const linux_sll::SLLHdr* sllh = + reinterpret_cast(layer::get_root_layer(p)); + + switch (ntohs(sllh->sll_pkttype)) { case LINUX_SLL_HOST: TextLog_Puts(log, "< "); break; @@ -234,14 +254,14 @@ static void LogSLLHeader(TextLog* log, Packet* p) /* mac addr */ TextLog_Print(log, "l/l len: %i l/l type: 0x%X %02X:%02X:%02X:%02X:%02X:%02X\n", - htons(p->sllh->sll_halen), ntohs(p->sllh->sll_hatype), - p->sllh->sll_addr[0], p->sllh->sll_addr[1], p->sllh->sll_addr[2], - p->sllh->sll_addr[3], p->sllh->sll_addr[4], p->sllh->sll_addr[5]); + htons(sllh->sll_halen), ntohs(sllh->sll_hatype), + sllh->sll_addr[0], sllh->sll_addr[1], sllh->sll_addr[2], + sllh->sll_addr[3], sllh->sll_addr[4], sllh->sll_addr[5]); /* protocol and pkt size */ TextLog_Print(log, "pkt type:0x%X proto: 0x%X len:0x%X\n", - ntohs(p->sllh->sll_pkttype), - ntohs(p->sllh->sll_protocol), p->pkth->pktlen); + ntohs(sllh->sll_pkttype), + ntohs(sllh->sll_protocol), p->pkth->pktlen); } #endif @@ -257,36 +277,39 @@ static void LogSLLHeader(TextLog* log, Packet* p) */ static void LogWifiHeader(TextLog* log, Packet * p) { + const wlan::WifiHdr *wifih = + reinterpret_cast< const wlan::WifiHdr *>(layer::get_root_layer(p)); + /* This assumes we are printing a data packet, could be changed to print other types as well */ const uint8_t *da = NULL, *sa = NULL, *bssid = NULL, *ra = NULL, *ta = NULL; /* per table 4, IEEE802.11 section 7.2.2 */ - if ((p->wifih->frame_control & WLAN_FLAG_TODS) && - (p->wifih->frame_control & WLAN_FLAG_FROMDS)) { - ra = p->wifih->addr1; - ta = p->wifih->addr2; - da = p->wifih->addr3; - sa = p->wifih->addr4; + if ((wifih->frame_control & WLAN_FLAG_TODS) && + (wifih->frame_control & WLAN_FLAG_FROMDS)) { + ra = wifih->addr1; + ta = wifih->addr2; + da = wifih->addr3; + sa = wifih->addr4; } - else if (p->wifih->frame_control & WLAN_FLAG_TODS) { - bssid = p->wifih->addr1; - sa = p->wifih->addr2; - da = p->wifih->addr3; + else if (wifih->frame_control & WLAN_FLAG_TODS) { + bssid = wifih->addr1; + sa = wifih->addr2; + da = wifih->addr3; } - else if (p->wifih->frame_control & WLAN_FLAG_FROMDS) { - da = p->wifih->addr1; - bssid = p->wifih->addr2; - sa = p->wifih->addr3; + else if (wifih->frame_control & WLAN_FLAG_FROMDS) { + da = wifih->addr1; + bssid = wifih->addr2; + sa = wifih->addr3; } else { - da = p->wifih->addr1; - sa = p->wifih->addr2; - bssid = p->wifih->addr3; + da = wifih->addr1; + sa = wifih->addr2; + bssid = wifih->addr3; } /* DO this switch to provide additional info on the type */ - switch(p->wifih->frame_control & 0x00ff) + switch(wifih->frame_control & 0x00ff) { case WLAN_TYPE_MGMT_BEACON: TextLog_Puts(log, "Beacon "); @@ -357,14 +380,14 @@ static void LogWifiHeader(TextLog* log, Packet * p) ra[1], ra[2], ra[3], ra[4], ra[5]); } TextLog_Puts(log, " Flags:"); - if (p->wifih->frame_control & WLAN_FLAG_TODS) TextLog_Puts(log," ToDs"); - if (p->wifih->frame_control & WLAN_FLAG_TODS) TextLog_Puts(log," FrDs"); - if (p->wifih->frame_control & WLAN_FLAG_FRAG) TextLog_Puts(log," Frag"); - if (p->wifih->frame_control & WLAN_FLAG_RETRY) TextLog_Puts(log," Re"); - if (p->wifih->frame_control & WLAN_FLAG_PWRMGMT) TextLog_Puts(log," Pwr"); - if (p->wifih->frame_control & WLAN_FLAG_MOREDAT) TextLog_Puts(log," MD"); - if (p->wifih->frame_control & WLAN_FLAG_WEP) TextLog_Puts(log," Wep"); - if (p->wifih->frame_control & WLAN_FLAG_ORDER) TextLog_Puts(log," Ord"); + if (wifih->frame_control & WLAN_FLAG_TODS) TextLog_Puts(log," ToDs"); + if (wifih->frame_control & WLAN_FLAG_TODS) TextLog_Puts(log," FrDs"); + if (wifih->frame_control & WLAN_FLAG_FRAG) TextLog_Puts(log," Frag"); + if (wifih->frame_control & WLAN_FLAG_RETRY) TextLog_Puts(log," Re"); + if (wifih->frame_control & WLAN_FLAG_PWRMGMT) TextLog_Puts(log," Pwr"); + if (wifih->frame_control & WLAN_FLAG_MOREDAT) TextLog_Puts(log," MD"); + if (wifih->frame_control & WLAN_FLAG_WEP) TextLog_Puts(log," Wep"); + if (wifih->frame_control & WLAN_FLAG_ORDER) TextLog_Puts(log," Ord"); TextLog_NewLine(log); } #endif // NO_NON_ETHER_DECODER @@ -385,23 +408,23 @@ void Log2ndHeader(TextLog* log, Packet* p) switch(DAQ_GetBaseProtocol()) { case DLT_EN10MB: /* Ethernet */ - if(p && p->eh) + if(p && (p->next_layer > 0)) LogEthHeader(log, p); break; #ifndef NO_NON_ETHER_DECODER #ifdef DLT_IEEE802_11 case DLT_IEEE802_11: - if(p && p->wifih) + if(p && (p->next_layer > 0)) LogWifiHeader(log, p); break; #endif case DLT_IEEE802: /* Token Ring */ - if(p && p->trh) + if(p && (p->next_layer > 0)) LogTrHeader(log, p); break; #ifdef DLT_LINUX_SLL case DLT_LINUX_SLL: - if (p && p->sllh) + if (p && (p->next_layer > 0)) LogSLLHeader(log, p); /* Linux cooked sockets */ break; #endif @@ -1666,7 +1689,7 @@ void LogIPPkt(TextLog* log, int type, Packet * p) { Log2ndHeader(log, p); - if ( p->mpls ) + if ( p->proto_bits & PROTO_BIT__MPLS ) { LogMPLSHeader(log, p); } @@ -1674,8 +1697,7 @@ void LogIPPkt(TextLog* log, int type, Packet * p) if ( p->outer_iph ) { LogOuterIPHeader(log, p); - if ( p->greh ) - LogGREHeader(log, p); + LogGREHeader(log, p); // checks for valid gre layer before logging } } @@ -1798,25 +1820,26 @@ void LogArpHeader(TextLog*, Packet*) * Returns: void function * ***************************************************************************/ -static void PrintEapolKey(FILE * fp, Packet * p) +static void PrintEapolKey(FILE * fp, const eapol::EapolKey* eapolk) { + uint16_t length; - if(p->eapolk == NULL) + if(eapolk == NULL) { fprintf(fp, "Eapol Key truncated\n"); return; } fprintf(fp, "KEY type: "); - if (p->eapolk->type == 1) { + if (eapolk->type == 1) { fprintf(fp, "RC4"); } - memcpy(&length, &p->eapolk->length, 2); + memcpy(&length, &eapolk->length, 2); length = ntohs(length); fprintf(fp, " len: %d", length); - fprintf(fp, " index: %d ", p->eapolk->index & 0x7F); - fprintf(fp, p->eapolk->index & 0x80 ? " unicast\n" : " broadcast\n"); + fprintf(fp, " index: %d ", eapolk->index & 0x7F); + fprintf(fp, eapolk->index & 0x80 ? " unicast\n" : " broadcast\n"); } /**************************************************************************** @@ -1830,29 +1853,29 @@ static void PrintEapolKey(FILE * fp, Packet * p) * Returns: void function * ***************************************************************************/ -static void PrintEapolHeader(FILE * fp, Packet * p) +static void PrintEapolHeader(FILE * fp, const eapol::EtherEapol* eplh) { fprintf(fp, "EAPOL type: "); - switch(p->eplh->eaptype) { + switch(eplh->eaptype) { case EAPOL_TYPE_EAP: - fprintf(fp, "EAP"); - break; + fprintf(fp, "EAP"); + break; case EAPOL_TYPE_START: - fprintf(fp, "Start"); - break; + fprintf(fp, "Start"); + break; case EAPOL_TYPE_LOGOFF: - fprintf(fp, "Logoff"); - break; + fprintf(fp, "Logoff"); + break; case EAPOL_TYPE_KEY: - fprintf(fp, "Key"); - break; + fprintf(fp, "Key"); + break; case EAPOL_TYPE_ASF: - fprintf(fp, "ASF Alert"); - break; + fprintf(fp, "ASF Alert"); + break; default: - fprintf(fp, "Unknown"); + fprintf(fp, "Unknown"); } - fprintf(fp, " Len: %d\n", ntohs(p->eplh->len)); + fprintf(fp, " Len: %d\n", ntohs(eplh->len)); } /**************************************************************************** @@ -1866,58 +1889,63 @@ static void PrintEapolHeader(FILE * fp, Packet * p) * Returns: void function * ***************************************************************************/ -static void PrintEAPHeader(FILE * fp, Packet * p) +static void PrintEAPHeader(FILE * fp, const eapol::EAPHdr* eaph) { + uint8_t* eaptype = 0; - if(p->eaph == NULL) + if(eaph == NULL) { fprintf(fp, "EAP header truncated\n"); return; } fprintf(fp, "code: "); - switch(p->eaph->code) { + switch(eaph->code) { case EAP_CODE_REQUEST: - fprintf(fp, "Req "); - break; + fprintf(fp, "Req "); + eaptype = (uint8_t*) (eaph + sizeof(*eaph)); + break; case EAP_CODE_RESPONSE: - fprintf(fp, "Resp"); - break; + fprintf(fp, "Resp"); + eaptype = (uint8_t*) (eaph + sizeof(*eaph)); + break; case EAP_CODE_SUCCESS: - fprintf(fp, "Succ"); - break; + fprintf(fp, "Succ"); + break; case EAP_CODE_FAILURE: - fprintf(fp, "Fail"); - break; + fprintf(fp, "Fail"); + break; } - fprintf(fp, " id: 0x%x len: %d", p->eaph->id, ntohs(p->eaph->len)); - if (p->eaptype != NULL) { - fprintf(fp, " type: "); - switch(*(p->eaptype)) { - case EAP_TYPE_IDENTITY: - fprintf(fp, "id"); - break; - case EAP_TYPE_NOTIFY: - fprintf(fp, "notify"); - break; - case EAP_TYPE_NAK: - fprintf(fp, "nak"); - break; - case EAP_TYPE_MD5: - fprintf(fp, "md5"); - break; - case EAP_TYPE_OTP: - fprintf(fp, "otp"); - break; - case EAP_TYPE_GTC: - fprintf(fp, "token"); - break; - case EAP_TYPE_TLS: - fprintf(fp, "tls"); - break; - default: - fprintf(fp, "undef"); - break; - } + fprintf(fp, " id: 0x%x len: %d", eaph->id, ntohs(eaph->len)); + if (eaptype != NULL) + { + fprintf(fp, " type: "); + switch(*(eaptype)) + { + case EAP_TYPE_IDENTITY: + fprintf(fp, "id"); + break; + case EAP_TYPE_NOTIFY: + fprintf(fp, "notify"); + break; + case EAP_TYPE_NAK: + fprintf(fp, "nak"); + break; + case EAP_TYPE_MD5: + fprintf(fp, "md5"); + break; + case EAP_TYPE_OTP: + fprintf(fp, "otp"); + break; + case EAP_TYPE_GTC: + fprintf(fp, "token"); + break; + case EAP_TYPE_TLS: + fprintf(fp, "tls"); + break; + default: + fprintf(fp, "undef"); + break; + } } fprintf(fp, "\n"); } @@ -1948,12 +1976,22 @@ void PrintEapolPkt(FILE * fp, Packet * p) { Print2ndHeader(fp, p); } - PrintEapolHeader(fp, p); - if (p->eplh->eaptype == EAPOL_TYPE_EAP) { - PrintEAPHeader(fp, p); + + const eapol::EtherEapol* eplh = layer::get_eapol_layer(p); + + if (eplh) + { + PrintEapolHeader(fp, eplh); + if (eplh->eaptype == EAPOL_TYPE_EAP) { + PrintEAPHeader(fp, (const eapol::EAPHdr*) eplh + sizeof(*eplh)); + } + else if (eplh->eaptype == EAPOL_TYPE_KEY) { + PrintEapolKey(fp, (const eapol::EapolKey*) eplh + sizeof(*eplh)); + } } - else if (p->eplh->eaptype == EAPOL_TYPE_KEY) { - PrintEapolKey(fp, p); + else + { + fprintf(fp, "EAP header truncated\n"); } /* dump the application layer data */ diff --git a/src/log/obfuscation.cc b/src/log/obfuscation.cc index dca77f2e9..d17462c64 100644 --- a/src/log/obfuscation.cc +++ b/src/log/obfuscation.cc @@ -31,7 +31,7 @@ extern "C" { #include "snort_types.h" #include "snort_debug.h" -#include "decode.h" +#include "protocols/packet.h" #include "stream/stream_api.h" #include "snort_bounds.h" #include "main/thread.h" diff --git a/src/loggers/CMakeLists.txt b/src/loggers/CMakeLists.txt index 189ec2a47..d0fb31111 100644 --- a/src/loggers/CMakeLists.txt +++ b/src/loggers/CMakeLists.txt @@ -10,7 +10,6 @@ set ( PLUGIN_LIST alert_csv.cc alert_fast.cc alert_full.cc - alert_sf_socket.cc alert_syslog.cc alert_test.cc alert_unixsock.cc @@ -20,6 +19,14 @@ set ( PLUGIN_LIST unified2_common.h ) +if( LINUX ) + set ( PLUGIN_LIST + ${PLUGIN_LIST} + alert_sf_socket.cc + ) +endif() + + if (STATIC_LOGGERS) add_library ( loggers STATIC ${LOGGER_SOURCES} diff --git a/src/loggers/alert_csv.cc b/src/loggers/alert_csv.cc index 2417967a2..ac12584da 100644 --- a/src/loggers/alert_csv.cc +++ b/src/loggers/alert_csv.cc @@ -32,7 +32,7 @@ #include "framework/logger.h" #include "framework/module.h" -#include "decode.h" +#include "protocols/packet.h" #include "parser.h" #include "snort_debug.h" #include "mstring.h" @@ -186,9 +186,13 @@ void CsvLogger::alert(Packet *p, const char *msg, Event *event) int num; char *type; char tcpFlags[9]; + const eth::EtherHdr *eh = nullptr; assert(p); + if (p->proto_bits & PROTO_BIT__ETH) + eh = layer::get_eth_layer(p); + // TBD an enum would be an improvement here for (num = 0; num < numargs; num++) { @@ -239,30 +243,30 @@ void CsvLogger::alert(Packet *p, const char *msg, Event *event) } else if (!strcasecmp("eth_src", type)) { - if (p->eh != NULL) + if (eh) { - TextLog_Print(csv_log, "%02X:%02X:%02X:%02X:%02X:%02X", p->eh->ether_src[0], - p->eh->ether_src[1], p->eh->ether_src[2], p->eh->ether_src[3], - p->eh->ether_src[4], p->eh->ether_src[5]); + TextLog_Print(csv_log, "%02X:%02X:%02X:%02X:%02X:%02X", eh->ether_src[0], + eh->ether_src[1], eh->ether_src[2], eh->ether_src[3], + eh->ether_src[4], eh->ether_src[5]); } } else if (!strcasecmp("eth_dst", type)) { - if (p->eh != NULL) + if (eh) { - TextLog_Print(csv_log, "%02X:%02X:%02X:%02X:%02X:%02X", p->eh->ether_dst[0], - p->eh->ether_dst[1], p->eh->ether_dst[2], p->eh->ether_dst[3], - p->eh->ether_dst[4], p->eh->ether_dst[5]); + TextLog_Print(csv_log, "%02X:%02X:%02X:%02X:%02X:%02X", eh->ether_dst[0], + eh->ether_dst[1], eh->ether_dst[2], eh->ether_dst[3], + eh->ether_dst[4], eh->ether_dst[5]); } } else if (!strcasecmp("eth_type", type)) { - if (p->eh != NULL) - TextLog_Print(csv_log, "0x%X", ntohs(p->eh->ether_type)); + if (eh != NULL) + TextLog_Print(csv_log, "0x%X", ntohs(eh->ether_type)); } else if (!strcasecmp("eth_len", type)) { - if (p->eh != NULL) + if (eh != NULL) TextLog_Print(csv_log, "0x%X", p->pkth->pktlen); } else if (!strcasecmp("udp_len", type)) diff --git a/src/loggers/alert_fast.cc b/src/loggers/alert_fast.cc index 2708de16e..1abad5bdd 100644 --- a/src/loggers/alert_fast.cc +++ b/src/loggers/alert_fast.cc @@ -48,7 +48,7 @@ #include "framework/logger.h" #include "framework/module.h" #include "event.h" -#include "decode.h" +#include "protocols/packet.h" #include "snort_debug.h" #include "parser.h" #include "util.h" @@ -245,7 +245,7 @@ void FastLogger::alert(Packet *p, const char *msg, Event *event) if(IPH_IS_VALID(p)) LogIPPkt(fast_log, GET_IPH_PROTO(p), p); #ifndef NO_NON_ETHER_DECODER - else if(p->ah) + else if(p->proto_bits & PROTO_BIT__ARP) LogArpHeader(fast_log, p); #endif } diff --git a/src/loggers/alert_full.cc b/src/loggers/alert_full.cc index 56a46db42..30cdf083e 100644 --- a/src/loggers/alert_full.cc +++ b/src/loggers/alert_full.cc @@ -47,7 +47,7 @@ #include "framework/logger.h" #include "framework/module.h" #include "event.h" -#include "decode.h" +#include "protocols/packet.h" #include "snort_debug.h" #include "parser.h" #include "util.h" diff --git a/src/loggers/alert_syslog.cc b/src/loggers/alert_syslog.cc index 86f3248de..faaa1329d 100644 --- a/src/loggers/alert_syslog.cc +++ b/src/loggers/alert_syslog.cc @@ -31,7 +31,7 @@ #include "framework/logger.h" #include "framework/module.h" -#include "decode.h" +#include "protocols/packet.h" #include "detect.h" #include "event.h" #include "rules.h" diff --git a/src/loggers/alert_test.cc b/src/loggers/alert_test.cc index c96ebe664..06be0603d 100644 --- a/src/loggers/alert_test.cc +++ b/src/loggers/alert_test.cc @@ -32,7 +32,7 @@ #include "framework/logger.h" #include "framework/module.h" #include "event.h" -#include "decode.h" +#include "protocols/packet.h" #include "snort_debug.h" #include "parser.h" #include "util.h" diff --git a/src/loggers/alert_unixsock.cc b/src/loggers/alert_unixsock.cc index a4192509b..37e1914bd 100644 --- a/src/loggers/alert_unixsock.cc +++ b/src/loggers/alert_unixsock.cc @@ -36,7 +36,7 @@ #include "framework/module.h" #include "snort_types.h" #include "event.h" -#include "decode.h" +#include "protocols/packet.h" #include "parser.h" #include "snort_debug.h" #include "util.h" @@ -58,6 +58,8 @@ struct pcap_pkthdr32 /* this struct is for the alert socket code.... */ // FIXTHIS alert unix sock supports l2-l3-l4 encapsulations + +const unsigned int ALERTMSG_LENGTH = 256; struct Alertpkt { uint8_t alertmsg[ALERTMSG_LENGTH]; /* variable.. */ @@ -155,9 +157,11 @@ static void get_alert_pkt( { if(p) { - if (p->eh) + if (p->proto_bits & PROTO_BIT__ETH) { - us.alert.dlthdr=(char *)p->eh-(char *)p->pkt; + + const eth::EtherHdr *eh = layer::get_eth_layer(p); + us.alert.dlthdr=(char *)eh-(char *)p->pkt; } /* we don't log any headers besides eth yet */ diff --git a/src/loggers/log_tcpdump.cc b/src/loggers/log_tcpdump.cc index 6486d3801..0e877ac05 100644 --- a/src/loggers/log_tcpdump.cc +++ b/src/loggers/log_tcpdump.cc @@ -40,7 +40,7 @@ extern "C" { #include "framework/logger.h" #include "framework/module.h" -#include "decode.h" +#include "protocols/packet.h" #include "event.h" #include "mstring.h" #include "parser.h" diff --git a/src/loggers/unified2.cc b/src/loggers/unified2.cc index 4ef754aab..007bcde8e 100644 --- a/src/loggers/unified2.cc +++ b/src/loggers/unified2.cc @@ -43,10 +43,9 @@ #include "framework/logger.h" #include "framework/module.h" -#include "decode.h" /* for struct in6_addr -- maybe move to snort_types.h? */ +#include "protocols/packet.h" /* for struct in6_addr -- maybe move to snort_types.h? */ #include "snort_types.h" #include "main/analyzer.h" -#include "decode.h" #include "rules.h" #include "treenodes.h" #include "util.h" @@ -63,6 +62,8 @@ #include "detect.h" #include "snort.h" #include "stream/stream_api.h" +#include "protocols/layer.h" +#include "protocols/vlan.h" using namespace std; @@ -273,15 +274,15 @@ static void _AlertIP4_v2(Packet *p, const char*, Unified2Config *config, Event * alertdata.dport_icode = htons(p->dp); } - if((p->mpls) && (config->mpls_event_types)) + if((p->proto_bits & PROTO_BIT__MPLS) && (config->mpls_event_types)) { alertdata.mpls_label = htonl(p->mplsHdr.label); } if(config->vlan_event_types) { - if(p->vh) + if(p->proto_bits & PROTO_BIT__VLAN) { - alertdata.vlanId = htons(VTH_VLAN(p->vh)); + alertdata.vlanId = htons(vlan::vth_vlan(layer::get_vlan_layer(p))); } alertdata.pad2 = htons(p->user_policy_id); @@ -376,15 +377,15 @@ static void _AlertIP6_v2(Packet *p, const char*, Unified2Config *config, Event * alertdata.dport_icode = htons(p->dp); } - if((p->mpls) && (config->mpls_event_types)) + if((p->proto_bits & PROTO_BIT__MPLS) && (config->mpls_event_types)) { alertdata.mpls_label = htonl(p->mplsHdr.label); } if(config->vlan_event_types) { - if(p->vh) + if(p->proto_bits & PROTO_BIT__VLAN) { - alertdata.vlanId = htons(VTH_VLAN(p->vh)); + alertdata.vlanId = htons(vlan::vth_vlan(layer::get_vlan_layer(p))); } alertdata.pad2 = htons(p->user_policy_id); diff --git a/src/main/analyzer.h b/src/main/analyzer.h index a67a6a450..f04eb3900 100644 --- a/src/main/analyzer.h +++ b/src/main/analyzer.h @@ -22,7 +22,7 @@ #define ANALYZER_H #include "snort_types.h" -#include "decode.h" +#include "protocols/packet.h" enum AnalyzerCommand { diff --git a/src/main/snort.cc b/src/main/snort.cc index 3304738c7..1aecb21f1 100644 --- a/src/main/snort.cc +++ b/src/main/snort.cc @@ -54,7 +54,7 @@ using namespace std; #include #include "helpers/process.h" -#include "decode.h" +#include "protocols/packet.h" #include "managers/packet_manager.h" #include "packet_io/sfdaq.h" #include "packet_io/active.h" @@ -764,7 +764,7 @@ static void set_policy(Packet*) // FIX SSN implement based on bindings { // for now need to just get stream_* inspectors and call appropriately #if 0 - int vlanId = (p->vh) ? VTH_VLAN(p->vh) : -1; + int vlanId = (p->vh) ? vlan::vth_vlan(p->vh) : -1; snort_ip_p srcIp = (p->iph) ? GET_SRC_IP((p)) : (snort_ip_p)0; snort_ip_p dstIp = (p->iph) ? GET_DST_IP((p)) : (snort_ip_p)0; diff --git a/src/main/snort.h b/src/main/snort.h index 80002bd80..9bce3a96b 100644 --- a/src/main/snort.h +++ b/src/main/snort.h @@ -32,11 +32,10 @@ #include #include "snort_types.h" -#include "protocols/decode.h" #include "sfip/sf_ipvar.h" #include "main/snort_config.h" #include "snort_types.h" -#include "decode.h" +#include "protocols/packet.h" #include "log/log.h" SnortConfig* reload_config(); diff --git a/src/managers/packet_manager.cc b/src/managers/packet_manager.cc index 3b808f366..d4621d926 100644 --- a/src/managers/packet_manager.cc +++ b/src/managers/packet_manager.cc @@ -47,18 +47,7 @@ namespace { -struct CdGenPegs{ - PegCount total_processed = 0; - PegCount other_codecs = 0; - PegCount discards = 0; -}; -std::vector gen_peg_names = -{ - "total", - "other", - "discards" -}; } // anonymous @@ -67,35 +56,39 @@ std::vector gen_peg_names = THREAD_LOCAL PreprocStats decodePerfStats; #endif - extern const CodecApi* default_codec; - static const uint16_t max_protocol_id = 65535; -static std::vector s_codecs; +static const uint16_t IP_ID_COUNT = 8192; -// when initialization arrays, although the zero is not required -// the compiler complains about a missing-field-initiliezers +// the zero initialization is not required but quiets the compiler +static std::vector s_codecs; static std::array s_proto_map{{0}}; static std::array s_protocols{{0}}; static THREAD_LOCAL uint8_t grinder = 0; // Decoding statistics -static const uint8_t gen_peg_size = 3; // reflects size of CdGenPegs -static const uint8_t stat_offset = gen_peg_size; // different name to simplify code -static THREAD_LOCAL std::array s_stats{{0}}; -static std::array g_stats{{0}}; -static THREAD_LOCAL CdGenPegs pkt_cnt; +// this vector reflects the printed names for the statistics +// before the stat_offset +static const std::vector stat_names = +{ + "total", + "other", + "discards" +}; +static const uint8_t total_processed = 0; +static const uint8_t other_codecs = 1; +static const uint8_t discards = 2; +static const uint8_t stat_offset = 3; +static THREAD_LOCAL std::array s_stats{{0}}; +static std::array g_stats{{0}}; // Encoder Foo -static Packet *encode_pkt; -//static THREAD_LOCAL PegCount g_total_rebuilt_pkts = 0; +static THREAD_LOCAL rand_t* s_rand = NULL; +static THREAD_LOCAL Packet *encode_pkt; static THREAD_LOCAL PegCount total_rebuilt_pkts = 0; static THREAD_LOCAL uint8_t* dst_mac = NULL; - -static const uint16_t IP_ID_COUNT = 8192; -static THREAD_LOCAL rand_t* s_rand = NULL; static THREAD_LOCAL std::array s_id_pool{{0}}; static THREAD_LOCAL std::array s_pkt{{0}}; @@ -106,26 +99,6 @@ static THREAD_LOCAL std::array s_pkt{{0}}; //------------------------------------------------------------------------- -static inline void push_layer(Packet *p, - uint16_t prot_id, - const uint8_t *hdr_start, - uint32_t len) -{ - if ( p->next_layer < LAYER_MAX ) - { - Layer& lyr = p->layers[p->next_layer++]; - lyr.prot_id = prot_id; - lyr.start = (uint8_t*)hdr_start; - lyr.length = (uint16_t)len; - } - else - { - LogMessage("(snort_decoder) WARNING: decoder got too many layers;" - " next proto is something.\n"); - } -} - - static inline void push_layer(Packet *p, uint16_t prot_id, const uint8_t *hdr_start, @@ -142,7 +115,7 @@ static inline void push_layer(Packet *p, } else { - LogMessage("(snort_decoder) WARNING: decoder got too many layers;" + LogMessage("(packet_manager) WARNING: decoder has too many layers;" " next proto is something.\n"); } } @@ -167,7 +140,6 @@ static inline uint8_t* get_inner_ip_hdr(const Packet *p) return nullptr; } - static inline int get_inner_ip_lyr(const Packet *p) { const Layer *layers = p->layers; @@ -207,7 +179,6 @@ static inline uint8_t get_codec(const char* keyword) return 0; } - static const uint8_t* encode_packet( EncState* enc, const Packet* p, uint32_t* len) { @@ -251,39 +222,28 @@ static const uint8_t* encode_packet( return obuf.base + obuf.off; } -static void accumulate() +static inline void accumulate() { static std::mutex stats_mutex; - stats_mutex.lock(); - - s_stats[0] = pkt_cnt.total_processed; - s_stats[1] = pkt_cnt.other_codecs; - s_stats[2] = pkt_cnt.discards; - - // zeroing out the null/default codecs - s_stats[3] = 0; - s_stats[s_proto_map[FINISHED_DECODE] + stat_offset] = 0; + stats_mutex.lock(); sum_stats(&g_stats[0], &s_stats[0], s_stats.size()); - stats_mutex.unlock(); } static bool api_instantiated(const CodecApi* cd_api) { - static std::vector instantiated_api; // all elements initialized to false - - if (instantiated_api.size() != s_codecs.size()) - instantiated_api.resize(s_codecs.size()); + // all elements initialize to false + static std::vector instantiated_api(s_codecs.size()); - std::vector::iterator p = std::find(s_codecs.begin(), s_codecs.end(), cd_api); + std::vector::iterator p = + std::find(s_codecs.begin(), s_codecs.end(), cd_api); if (p == s_codecs.end()) FatalError("PacketManager:: should never reach this code!!" \ "Cannot find Codec %s's api", cd_api->base.name); int pos = p - s_codecs.begin(); - if(instantiated_api[pos]) return true; @@ -399,6 +359,9 @@ void PacketManager::thread_init(void) if(!grinder) FatalError("PacketManager: Unable to find a Codec with data link type %d!!\n", daq_dlt); + if ( !ScReadMode() || ScPcapShow() ) + LogMessage("Decoding with %s\n", s_protocols[grinder]->get_name()); + // ENCODER initialization #ifndef VALGRIND_TESTING @@ -465,7 +428,7 @@ void PacketManager::decode( { PROFILE_VARS; uint16_t prot_id; - uint8_t mapped_prot; + uint8_t mapped_prot = grinder; uint16_t prev_prot_id = FINISHED_DECODE; uint16_t len, lyr_len; @@ -476,8 +439,8 @@ void PacketManager::decode( p->pkth = pkthdr; p->pkt = pkt; len = pkthdr->caplen; - mapped_prot = grinder; - pkt_cnt.total_processed++; + + s_stats[total_processed]++; // loop until the protocol id is no longer valid while(s_protocols[mapped_prot]->decode(pkt, len, p, lyr_len, prot_id)) @@ -502,13 +465,14 @@ void PacketManager::decode( } } - // if the final protocol ID is not the null codec + // if the final protocol ID is not the default codec, a Codec failed if (prev_prot_id != FINISHED_DECODE) { + // if the codec exists, it failed if(s_proto_map[prev_prot_id]) - pkt_cnt.discards++; + s_stats[discards]++; else - pkt_cnt.other_codecs++; + s_stats[other_codecs]++; } s_stats[mapped_prot + stat_offset]++; @@ -523,12 +487,6 @@ bool PacketManager::has_codec(uint16_t cd_id) } - - - - - - //------------------------------------------------------------------------- // encoders operate layer by layer: //------------------------------------------------------------------------- @@ -756,13 +714,15 @@ void PacketManager::dump_stats() { std::vector pkt_names; - for(unsigned int i = 0; i < gen_peg_names.size(); i++) - pkt_names.push_back(gen_peg_names[i]); + // zero out the default codecs + g_stats[3] = 0; + g_stats[s_proto_map[FINISHED_DECODE] + stat_offset] = 0; + for(unsigned int i = 0; i < stat_names.size(); i++) + pkt_names.push_back(stat_names[i]); for(int i = 0; s_protocols[i] != 0; i++) - if(s_protocols[i]) - pkt_names.push_back(s_protocols[i]->get_name()); + pkt_names.push_back(s_protocols[i]->get_name()); show_percent_stats((PegCount*) &g_stats, &pkt_names[0], (unsigned int) pkt_names.size(), "codecs"); diff --git a/src/managers/packet_manager.h b/src/managers/packet_manager.h index 8d53f4d9b..60e48b4bd 100644 --- a/src/managers/packet_manager.h +++ b/src/managers/packet_manager.h @@ -1,5 +1,5 @@ /* -** Copyright (C) 2013-2013 Sourcefire, Inc. +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. ** ** This program is free software; you can redistribute it and/or modify ** it under the terms of the GNU General Public License Version 2 as @@ -22,33 +22,18 @@ #ifndef PACKET_MANAGER_H #define PACKET_MANAGER_H -#include "snort_types.h" +#include +#include #include "framework/codec.h" #include "time/profiler.h" #include "utils/stats.h" #include "snort_config.h" -#include -#include - struct Packet; //------------------------------------------------------------------------- -/* - * E N C O D E R F O O - */ - -// for encodeders -#include "protocols/packet.h" -#include "codecs/sf_protocols.h" -#include "framework/codec.h" - - - - -// TODO --> delete this!! #ifdef PERF_PROFILING extern THREAD_LOCAL PreprocStats decodePerfStats; #endif @@ -57,8 +42,6 @@ extern THREAD_LOCAL PreprocStats decodePerfStats; /* * PacketManager class */ - - class PacketManager { public: diff --git a/src/network_inspectors/arp_spoof/arp_spoof.cc b/src/network_inspectors/arp_spoof/arp_spoof.cc index 4ce95b1ac..1ae919262 100644 --- a/src/network_inspectors/arp_spoof/arp_spoof.cc +++ b/src/network_inspectors/arp_spoof/arp_spoof.cc @@ -80,7 +80,7 @@ #include "snort_types.h" #include "snort_debug.h" #include "detect.h" -#include "decode.h" +#include "protocols/packet.h" #include "event.h" #include "parser.h" #include "mstring.h" @@ -91,6 +91,8 @@ #include "arp_module.h" #include "framework/inspector.h" +#include "protocols/layer.h" +#include "protocols/arp.h" static const uint8_t bcast[6] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff}; @@ -190,24 +192,29 @@ void ArpSpoof::eval(Packet *p) { IPMacEntry *ipme; PROFILE_VARS; + const arp::EtherARP *ah; + const eth::EtherHdr *eh; // preconditions - what we registered for - assert(p->eh && p->ah); + assert((p->proto_bits & PROTO_BIT__ETH) && (p->proto_bits & PROTO_BIT__ARP)); + + ah = layer::get_arp_layer(p); + eh = layer::get_eth_layer(p); /* is the ARP protocol type IP and the ARP hardware type Ethernet? */ - if ((ntohs(p->ah->ea_hdr.ar_hrd) != 0x0001) || - (ntohs(p->ah->ea_hdr.ar_pro) != ETHERNET_TYPE_IP)) + if ((ntohs(ah->ea_hdr.ar_hrd) != 0x0001) || + (ntohs(ah->ea_hdr.ar_pro) != ETHERNET_TYPE_IP)) return; PREPROC_PROFILE_START(arpPerfStats); ++asstats.total_packets; - switch(ntohs(p->ah->ea_hdr.ar_op)) + switch(ntohs(ah->ea_hdr.ar_op)) { case ARPOP_REQUEST: if (config->check_unicast_arp) { - if (memcmp((u_char *)p->eh->ether_dst, (u_char *)bcast, 6) != 0) + if (memcmp((u_char *)eh->ether_dst, (u_char *)bcast, 6) != 0) { SnortEventqAdd(GID_ARP_SPOOF, ARPSPOOF_UNICAST_ARP_REQUEST); @@ -216,8 +223,8 @@ void ArpSpoof::eval(Packet *p) "MODNAME: Unicast request\n");); } } - else if (memcmp((u_char *)p->eh->ether_src, - (u_char *)p->ah->arp_sha, 6) != 0) + else if (memcmp((u_char *)eh->ether_src, + (u_char *)ah->arp_sha, 6) != 0) { SnortEventqAdd(GID_ARP_SPOOF, ARPSPOOF_ETHERFRAME_ARP_MISMATCH_SRC); @@ -227,8 +234,8 @@ void ArpSpoof::eval(Packet *p) } break; case ARPOP_REPLY: - if (memcmp((u_char *)p->eh->ether_src, - (u_char *)p->ah->arp_sha, 6) != 0) + if (memcmp((u_char *)eh->ether_src, + (u_char *)ah->arp_sha, 6) != 0) { SnortEventqAdd(GID_ARP_SPOOF, ARPSPOOF_ETHERFRAME_ARP_MISMATCH_SRC); @@ -236,8 +243,8 @@ void ArpSpoof::eval(Packet *p) DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "MODNAME: Ethernet/ARP mismatch reply src\n");); } - else if (memcmp((u_char *)p->eh->ether_dst, - (u_char *)p->ah->arp_tha, 6) != 0) + else if (memcmp((u_char *)eh->ether_dst, + (u_char *)ah->arp_tha, 6) != 0) { SnortEventqAdd(GID_ARP_SPOOF, ARPSPOOF_ETHERFRAME_ARP_MISMATCH_DST); @@ -254,7 +261,7 @@ void ArpSpoof::eval(Packet *p) return; if ((ipme = LookupIPMacEntryByIP(config->ipmel, - *(uint32_t *)&p->ah->arp_spa)) == NULL) + *(uint32_t *)&ah->arp_spa)) == NULL) { DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "MODNAME: LookupIPMacEntryByIp returned NULL\n");); @@ -268,9 +275,9 @@ void ArpSpoof::eval(Packet *p) /* If the Ethernet source address or the ARP source hardware address * in p doesn't match the MAC address in ipme, then generate an alert */ - if ((memcmp((uint8_t *)p->eh->ether_src, + if ((memcmp((uint8_t *)eh->ether_src, (uint8_t *)ipme->mac_addr, 6)) || - (memcmp((uint8_t *)p->ah->arp_sha, + (memcmp((uint8_t *)ah->arp_sha, (uint8_t *)ipme->mac_addr, 6))) { SnortEventqAdd(GID_ARP_SPOOF, diff --git a/src/network_inspectors/normalize/norm.cc b/src/network_inspectors/normalize/norm.cc index 1eadef348..83970c3a8 100644 --- a/src/network_inspectors/normalize/norm.cc +++ b/src/network_inspectors/normalize/norm.cc @@ -278,7 +278,8 @@ static int Norm_ICMP6 ( { ICMPHdr* h = (ICMPHdr*)(p->layers[layer].start); - if ( ((uint16_t)h->type == ICMP6_ECHO || (uint16_t)h->type == ICMP6_REPLY) && + if ( ((uint16_t)h->type == icmp6::Icmp6Types::ECHO || + (uint16_t)h->type == icmp6::Icmp6Types::REPLY) && (h->code != 0) ) { h->code = static_cast(0); diff --git a/src/network_inspectors/normalize/norm.h b/src/network_inspectors/normalize/norm.h index e8be6c0f8..663a174b4 100644 --- a/src/network_inspectors/normalize/norm.h +++ b/src/network_inspectors/normalize/norm.h @@ -22,7 +22,7 @@ #ifndef NORM_H #define NORM_H -#include "decode.h" +#include "protocols/packet.h" #include "snort.h" #include "normalize.h" diff --git a/src/network_inspectors/perf_monitor/perf.cc b/src/network_inspectors/perf_monitor/perf.cc index 346800ce6..a66ac9483 100644 --- a/src/network_inspectors/perf_monitor/perf.cc +++ b/src/network_inspectors/perf_monitor/perf.cc @@ -47,7 +47,7 @@ #include "main/analyzer.h" #include "util.h" #include "snort_types.h" -#include "decode.h" +#include "protocols/packet.h" #include "snort.h" THREAD_LOCAL SFBASE sfBase; diff --git a/src/network_inspectors/perf_monitor/perf.h b/src/network_inspectors/perf_monitor/perf.h index 1443c86d0..9fe17c17a 100644 --- a/src/network_inspectors/perf_monitor/perf.h +++ b/src/network_inspectors/perf_monitor/perf.h @@ -52,7 +52,8 @@ #include "perf_event.h" #include "snort_types.h" #include "snort_debug.h" -#include "decode.h" +#include "protocols/packet.h" +#include "main/thread.h" // Perf Flags #define SFPERF_BASE 0x00000001 diff --git a/src/network_inspectors/perf_monitor/perf_base.h b/src/network_inspectors/perf_monitor/perf_base.h index 50e2b280f..acf7879c2 100644 --- a/src/network_inspectors/perf_monitor/perf_base.h +++ b/src/network_inspectors/perf_monitor/perf_base.h @@ -36,7 +36,7 @@ #include "sfprocpidstats.h" #include "snort_types.h" #include "snort_debug.h" -#include "decode.h" +#include "protocols/packet.h" #include #include diff --git a/src/network_inspectors/perf_monitor/perf_flow.h b/src/network_inspectors/perf_monitor/perf_flow.h index 21c6d9b77..fe5d40bc8 100644 --- a/src/network_inspectors/perf_monitor/perf_flow.h +++ b/src/network_inspectors/perf_monitor/perf_flow.h @@ -31,7 +31,7 @@ #include "snort_types.h" #include "sfxhash.h" #include "ipv6_port.h" -#include "decode.h" +#include "protocols/packet.h" #define SF_MAX_PKT_LEN 9000 #define SF_MAX_PORT UINT16_MAX diff --git a/src/network_inspectors/port_scan/port_scan.cc b/src/network_inspectors/port_scan/port_scan.cc index 22363cda8..39389703d 100644 --- a/src/network_inspectors/port_scan/port_scan.cc +++ b/src/network_inspectors/port_scan/port_scan.cc @@ -55,7 +55,7 @@ #include "ps_module.h" #include "main/analyzer.h" -#include "decode.h" +#include "protocols/packet.h" #include "managers/packet_manager.h" #include "event.h" #include "event_wrapper.h" diff --git a/src/network_inspectors/port_scan/ps_detect.cc b/src/network_inspectors/port_scan/ps_detect.cc index de90bc6e8..a59ed8a14 100644 --- a/src/network_inspectors/port_scan/ps_detect.cc +++ b/src/network_inspectors/port_scan/ps_detect.cc @@ -110,7 +110,7 @@ #include #include "snort.h" -#include "decode.h" +#include "protocols/packet.h" #include "packet_time.h" #include "sfxhash.h" #include "ipobj.h" diff --git a/src/packet_io/active.h b/src/packet_io/active.h index 297b760ef..62b448b28 100644 --- a/src/packet_io/active.h +++ b/src/packet_io/active.h @@ -26,7 +26,7 @@ #ifndef ACTIVE_H #define ACTIVE_H -#include "decode.h" +#include "protocols/packet.h" #include "snort.h" #include "managers/packet_manager.h" diff --git a/src/parser/parse_otn.cc b/src/parser/parse_otn.cc index 671b768a8..9bf79be0e 100644 --- a/src/parser/parse_otn.cc +++ b/src/parser/parse_otn.cc @@ -55,7 +55,7 @@ #include "util.h" #include "mstring.h" #include "detect.h" -#include "decode.h" +#include "protocols/packet.h" #include "fpcreate.h" #include "tag.h" #include "signature.h" diff --git a/src/parser/parse_rule.cc b/src/parser/parse_rule.cc index b40a13c7f..9719f80db 100644 --- a/src/parser/parse_rule.cc +++ b/src/parser/parse_rule.cc @@ -49,7 +49,7 @@ #include "util.h" #include "mstring.h" #include "detect.h" -#include "decode.h" +#include "protocols/packet.h" #include "fpcreate.h" #include "generators.h" #include "tag.h" diff --git a/src/parser/parser.cc b/src/parser/parser.cc index 9487832a4..324c2d609 100644 --- a/src/parser/parser.cc +++ b/src/parser/parser.cc @@ -48,7 +48,7 @@ #include "util.h" #include "mstring.h" #include "detect.h" -#include "decode.h" +#include "protocols/packet.h" #include "fpcreate.h" #include "tag.h" #include "signature.h" diff --git a/src/parser/parser.h b/src/parser/parser.h index 93f41cfd4..b522bf91a 100644 --- a/src/parser/parser.h +++ b/src/parser/parser.h @@ -30,7 +30,7 @@ #include "snort.h" #include "rules.h" #include "treenodes.h" -#include "decode.h" +#include "protocols/packet.h" #include "main/policy.h" #include "sflsq.h" #include "util.h" diff --git a/src/parser/vars.cc b/src/parser/vars.cc index 7947eca6d..0f7cd4f05 100644 --- a/src/parser/vars.cc +++ b/src/parser/vars.cc @@ -47,7 +47,7 @@ #include "util.h" #include "mstring.h" #include "detect.h" -#include "decode.h" +#include "protocols/packet.h" #include "fpcreate.h" #include "tag.h" #include "signature.h" diff --git a/src/protocols/CMakeLists.txt b/src/protocols/CMakeLists.txt index 1491ecb6d..22f1afc78 100644 --- a/src/protocols/CMakeLists.txt +++ b/src/protocols/CMakeLists.txt @@ -1,24 +1,29 @@ set (PROTOCOL_HEADERS - ipv4.h - tcp.h - packet.h - ipv6.h - udp.h + arp.h + eapol.h eth.h icmp4.h icmp6.h + ipv4.h + ipv6.h gre.h - arp.h - wlan.h - teredo.h + layer.h + linux_sll.h mpls.h + packet.h protocol_ids.h + tcp.h + teredo.h + token_ring.h + udp.h + wlan.h + vlan.h ) add_library (protocols STATIC ${PROTOCOL_HEADERS} - ../codecs/template.cc # CMake complains if we don't compile any files. so use dummy file. Linux will remove all of the symbols anyways. + layer.cc ) install (FILES ${PROTOCOL_HEADERS} diff --git a/src/protocols/Makefile.am b/src/protocols/Makefile.am index 08c8f72de..0e9f1d889 100644 --- a/src/protocols/Makefile.am +++ b/src/protocols/Makefile.am @@ -2,25 +2,31 @@ AUTOMAKE_OPTIONS=foreign no-dependencies x_includedir = $(pkgincludedir)/protocols -x_include_HEADERS = \ -packet.h +noinst_LIBRARIES = libprotocols.a -EXTRA_DIST = \ +x_include_HEADERS = \ arp.h \ -decode.h \ -encode.h \ +eapol.h \ eth.h \ -gre.h \ icmp4.h \ icmp6.h \ ipv4.h \ ipv6.h \ +gre.h \ +layer.h \ +layer.cc \ mpls.h \ protocol_ids.h \ tcp.h \ teredo.h \ +token_ring.h \ udp.h \ -wlan.h +vlan.h \ +wlan.h \ +packet.h -AM_CXXFLAGS = @AM_CXXFLAGS@ +libprotocols_a_SOURCES = \ +layer.cc + +AM_CXXFLAGS = @AM_CXXFLAGS@ diff --git a/src/protocols/arp.h b/src/protocols/arp.h index 8dd60cc3b..2c1ff5c36 100644 --- a/src/protocols/arp.h +++ b/src/protocols/arp.h @@ -22,11 +22,8 @@ #ifndef ARP_H #define ARP_H -namespace arp{ - -namespace detail{ - -} // namespace detail +namespace arp +{ diff --git a/src/protocols/decode.h b/src/protocols/decode.h deleted file mode 100644 index 1e4e8465f..000000000 --- a/src/protocols/decode.h +++ /dev/null @@ -1 +0,0 @@ -#include "codecs/decode.h" diff --git a/src/protocols/eapol.h b/src/protocols/eapol.h new file mode 100644 index 000000000..554f5c4d4 --- /dev/null +++ b/src/protocols/eapol.h @@ -0,0 +1,97 @@ +/* +** Copyright (C) 2002-2013 Sourcefire, Inc. +** Copyright (C) 1998-2002 Martin Roesch +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + + +#ifndef EAPOL_H +#define EAPOL_H + +#ifndef NO_NON_ETHER_DECODER + +namespace eapol +{ + +struct EtherEapol +{ + uint8_t version; /* EAPOL proto version */ + uint8_t eaptype; /* EAPOL Packet type */ + uint16_t len; /* Packet body length */ +}; + +struct EAPHdr +{ + uint8_t code; + uint8_t id; + uint16_t len; +}; + +struct EapolKey +{ + uint8_t type; + uint8_t length[2]; + uint8_t counter[8]; + uint8_t iv[16]; + uint8_t index; + uint8_t sig[16]; +}; + + +/* IEEE 802.1x eapol types */ +#define EAPOL_TYPE_EAP 0x00 /* EAP packet */ +#define EAPOL_TYPE_START 0x01 /* EAPOL start */ +#define EAPOL_TYPE_LOGOFF 0x02 /* EAPOL Logoff */ +#define EAPOL_TYPE_KEY 0x03 /* EAPOL Key */ +#define EAPOL_TYPE_ASF 0x04 /* EAPOL Encapsulated ASF-Alert */ + + + +/* Extensible Authentication Protocol Codes RFC 2284*/ +#define EAP_CODE_REQUEST 0x01 +#define EAP_CODE_RESPONSE 0x02 +#define EAP_CODE_SUCCESS 0x03 +#define EAP_CODE_FAILURE 0x04 +/* EAP Types */ +#define EAP_TYPE_IDENTITY 0x01 +#define EAP_TYPE_NOTIFY 0x02 +#define EAP_TYPE_NAK 0x03 +#define EAP_TYPE_MD5 0x04 +#define EAP_TYPE_OTP 0x05 +#define EAP_TYPE_GTC 0x06 +#define EAP_TYPE_TLS 0x0d + + + +/* Extensible Authentication Protocol Codes RFC 2284*/ +#define EAP_CODE_REQUEST 0x01 +#define EAP_CODE_RESPONSE 0x02 +#define EAP_CODE_SUCCESS 0x03 +#define EAP_CODE_FAILURE 0x04 +/* EAP Types */ +#define EAP_TYPE_IDENTITY 0x01 +#define EAP_TYPE_NOTIFY 0x02 +#define EAP_TYPE_NAK 0x03 +#define EAP_TYPE_MD5 0x04 +#define EAP_TYPE_OTP 0x05 +#define EAP_TYPE_GTC 0x06 +#define EAP_TYPE_TLS 0x0d + +} + +#endif /* NO_NON_ETHER_DECODER */ +#endif /* EAPOL_H */ diff --git a/src/protocols/gre.h b/src/protocols/gre.h index 0761abc19..052d6ef90 100644 --- a/src/protocols/gre.h +++ b/src/protocols/gre.h @@ -24,10 +24,6 @@ namespace gre{ -namespace detail{ - -} // namespace detail - /* GRE related stuff */ struct GREHdr { @@ -40,11 +36,6 @@ struct GREHdr } // namespace gre -typedef gre::GREHdr GREHdr; - - - - #define GRE_VERSION(x) (x->version & 0x07) #define GRE_PROTO(x) ntohs(x->ether_type) diff --git a/src/protocols/icmp6.h b/src/protocols/icmp6.h index b7708a7b4..967b70688 100644 --- a/src/protocols/icmp6.h +++ b/src/protocols/icmp6.h @@ -83,7 +83,7 @@ struct ICMP6NodeInfo //enum class Icmp6Types : std::uint8_t { enum Icmp6Types : std::uint8_t { UNREACH = 1, - ICMP6_TYPE_BIG = 2, + BIG = 2, TIME = 3, PARAMS = 4, ECHO = 128, @@ -111,16 +111,10 @@ inline uint16_t hdr_normal_len() // Things that should be deleted immediately....which I bet will manage to make it into production -#define ICMP6_UNREACH 1 -#define ICMP6_BIG 2 -#define ICMP6_TIME 3 -#define ICMP6_PARAMS 4 -#define ICMP6_ECHO 128 -#define ICMP6_REPLY 129 -#define ICMP6_SOLICITATION 133 -#define ICMP6_ADVERTISEMENT 134 -#define ICMP6_NODE_INFO_QUERY 139 -#define ICMP6_NODE_INFO_RESPONSE 140 +#if 1 +#define ICMP6_ECHO icmp6::Icmp6Types::ECHO +#define ICMP6_REPLY icmp6::Icmp6Types::REPLY +#endif typedef icmp6::ICMP6Hdr ICMP6Hdr; typedef icmp6::ICMP6TooBig ICMP6TooBig; diff --git a/src/protocols/ipv4.h b/src/protocols/ipv4.h index fa56b696b..e288119e3 100644 --- a/src/protocols/ipv4.h +++ b/src/protocols/ipv4.h @@ -23,6 +23,19 @@ #define IPV4_H #include + + +#ifndef WIN32 +#include +#include +#include +#else /* !WIN32 */ +#include +#ifndef IFNAMSIZ +#define IFNAMESIZ MAX_ADAPTER_NAME +#endif /* !IFNAMSIZ */ +#endif /* !WIN32 */ + #include "sfip/sfip_t.h" #include "protocols/protocol_ids.h" // include ipv4 protocol numbers diff --git a/src/protocols/layer.cc b/src/protocols/layer.cc new file mode 100644 index 000000000..4d29af343 --- /dev/null +++ b/src/protocols/layer.cc @@ -0,0 +1,113 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** Copyright (C) 2007-2013 Sourcefire, Inc. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ +// layer.cc author Josh Rosenbaum + + +#include "protocols/packet.h" + +namespace layer +{ + +static inline const uint8_t *find_layer(const Layer *lyr, + uint8_t num_layers, + uint16_t prot_id) +{ + for(int i = num_layers - 1; i >= 0 ; i--) + { + if (lyr->prot_id == prot_id) + return lyr->start; + lyr++; + } + return nullptr; +} + +static inline const uint8_t *find_layer(const Layer *lyr, + uint8_t num_layers, + uint16_t prot_id1, + uint16_t prot_id2) +{ + for(int i = num_layers - 1; i >= 0; i--) + { + if (lyr->prot_id == prot_id1 || + lyr->prot_id == prot_id2) + return lyr->start; + lyr++; + } + return nullptr; +} + +const arp::EtherARP* get_arp_layer(const Packet* p) +{ + uint8_t num_layers = p->next_layer; + const Layer *lyr = p->layers; + + return reinterpret_cast( + find_layer(lyr, num_layers, ETHERTYPE_ARP, ETHERTYPE_REVARP)); +} + +const gre::GREHdr* get_gre_layer(const Packet* p) +{ + uint8_t num_layers = p->next_layer; + const Layer *lyr = p->layers; + + return reinterpret_cast( + find_layer(lyr, num_layers, IPPROTO_ID_GRE)); +} + +const eapol::EtherEapol* get_eapol_layer(const Packet* p) +{ + uint8_t num_layers = p->next_layer; + const Layer *lyr = p->layers; + + return reinterpret_cast( + find_layer(lyr, num_layers, ETHERTYPE_EAPOL)); +} + +const vlan::VlanTagHdr* get_vlan_layer(const Packet* p) +{ + uint8_t num_layers = p->next_layer; + const Layer *lyr = p->layers; + + return reinterpret_cast( + find_layer(lyr, num_layers, ETHERTYPE_8021Q)); +} + +const eth::EtherHdr* get_eth_layer(const Packet* p) +{ + uint8_t num_layers = p->next_layer; + const Layer *lyr = p->layers; + + // First, search for the inner eth layer (transbridging) + const eth::EtherHdr* eh = reinterpret_cast( + find_layer(lyr, num_layers, ETHERTYPE_TRANS_ETHER_BRIDGING)); + + // if no inner eth layer, assume root layer is eth (callers job to confirm) + return eh ? eh : reinterpret_cast(get_root_layer(p)); +} + +const uint8_t* get_root_layer(const Packet* p) +{ + // since token ring is the grinder, its the begining of the packet. + if (p->next_layer > 0) + return p->layers[0].start; + return nullptr; +} + +} // namespace layer diff --git a/src/protocols/layer.h b/src/protocols/layer.h new file mode 100644 index 000000000..5bf3e4f6a --- /dev/null +++ b/src/protocols/layer.h @@ -0,0 +1,83 @@ +/* +** Copyright (C) 2002-2013 Sourcefire, Inc. +** Copyright (C) 1998-2002 Martin Roesch +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +#ifndef LAYER_H +#define LAYER_H + +#include +#include "protocols/protocol_ids.h" +#include "codecs/sf_protocols.h" + + + +struct Layer { + uint16_t prot_id; + PROTO_ID proto; + uint16_t length; + uint8_t* start; +}; + + +// forward declaring relevent structs. Since we're only return a pointer, +// there is no need for the actual header files + +namespace vlan +{ +struct VlanTagHdr; +} + +namespace arp +{ +struct EtherARP; +} + +namespace gre +{ +struct GREHdr; +} + +namespace eapol +{ +struct EtherEapol; +} + +namespace eth +{ +struct EtherHdr; +} + + +// code maintained in header to ensure files to not depend on this library +namespace layer +{ + + +// signatures. No need to go searching for the correct function +const arp::EtherARP* get_arp_layer(const Packet*); +const vlan::VlanTagHdr* get_vlan_layer(const Packet*); +const gre::GREHdr* get_gre_layer(const Packet*); +const eapol::EtherEapol* get_eapol_layer(const Packet*); +const eth::EtherHdr* get_eth_layer(const Packet*); +const uint8_t* get_root_layer(const Packet*); + + +} // namespace layer + +#endif diff --git a/src/protocols/linux_sll.h b/src/protocols/linux_sll.h new file mode 100644 index 000000000..092237fce --- /dev/null +++ b/src/protocols/linux_sll.h @@ -0,0 +1,64 @@ +/* +** Copyright (C) 2002-2013 Sourcefire, Inc. +** Copyright (C) 1998-2002 Martin Roesch +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + + +#ifndef LINUX_SLL_H +#define LINUX_SLL_H + +#ifndef NO_NON_ETHER_DECODER + +namespace linux_sll +{ + + +/* 'Linux cooked captures' data + * (taken from tcpdump source). + */ + +#define SLL_HDR_LEN 16 /* total header length */ +#define SLL_ADDRLEN 8 /* length of address field */ +typedef struct _SLLHdr { + uint16_t sll_pkttype; /* packet type */ + uint16_t sll_hatype; /* link-layer address type */ + uint16_t sll_halen; /* link-layer address length */ + uint8_t sll_addr[SLL_ADDRLEN]; /* link-layer address */ + uint16_t sll_protocol; /* protocol */ +} SLLHdr; + +/* + * ssl_pkttype values. + */ + +#define LINUX_SLL_HOST 0 +#define LINUX_SLL_BROADCAST 1 +#define LINUX_SLL_MULTICAST 2 +#define LINUX_SLL_OTHERHOST 3 +#define LINUX_SLL_OUTGOING 4 + +/* ssl protocol values */ + +#define LINUX_SLL_P_802_3 0x0001 /* Novell 802.3 frames without 802.2 LLC header */ +#define LINUX_SLL_P_802_2 0x0004 /* 802.2 frames (not D/I/X Ethernet) */ + + +} // namespace ssl + +#endif /* NO_NON_ETHER_DECODER */ +#endif /* LINUX_SLL_H */ diff --git a/src/protocols/packet.h b/src/protocols/packet.h index 0d45603b9..eb078d268 100644 --- a/src/protocols/packet.h +++ b/src/protocols/packet.h @@ -50,8 +50,10 @@ extern "C" { #include "sfip/ipv6_port.h" #include "sfip/sf_ip.h" #include "sfip/sf_iph.h" +#include "codecs/sf_protocols.h" -#include "codecs/layer.h" + +#include "protocols/layer.h" #include "protocols/ipv4.h" #include "protocols/ipv6.h" #include "protocols/tcp.h" @@ -59,8 +61,6 @@ extern "C" { #include "protocols/eth.h" #include "protocols/icmp4.h" #include "protocols/icmp6.h" -#include "protocols/arp.h" -#include "protocols/gre.h" #include "protocols/mpls.h" /* D E F I N E S ************************************************************/ @@ -118,7 +118,7 @@ extern "C" { #define REASSEMBLED_PACKET_FLAGS (PKT_REBUILT_STREAM|PKT_REASSEMBLED_OLD) -typedef enum { +enum PseudoPacketType{ PSEUDO_PKT_IP, PSEUDO_PKT_TCP, PSEUDO_PKT_DCE_RPKT, @@ -129,7 +129,7 @@ typedef enum { PSEUDO_PKT_PS, PSEUDO_PKT_SDF, PSEUDO_PKT_MAX -} PseudoPacketType; +} ; /* error flags */ #define PKT_ERR_CKSUM_IP 0x01 @@ -139,298 +139,6 @@ typedef enum { #define PKT_ERR_CKSUM_ANY 0x0F #define PKT_ERR_BAD_TTL 0x10 -/* D A T A S T R U C T U R E S *********************************************/ -class Flow; - -#ifndef NO_NON_ETHER_DECODER -/* Start Token Ring Data Structures */ - -#ifdef _MSC_VER - /* Visual C++ pragma to disable warning messages about nonstandard bit field type */ - #pragma warning( disable : 4214 ) -#endif - -/* LLC structure */ -typedef struct _Trh_llc -{ - uint8_t dsap; - uint8_t ssap; - uint8_t protid[3]; - uint16_t ethertype; -} Trh_llc; - -/* RIF structure - * Linux/tcpdump patch defines tokenring header in dump way, since not - * every tokenring header with have RIF data... we define it separately, and - * a bit more split up - */ - -#ifdef _MSC_VER - /* Visual C++ pragma to disable warning messages about nonstandard bit field type */ - #pragma warning( disable : 4214 ) -#endif - - -/* These are macros to use the bitlevel accesses in the Trh_Mr header - - they haven't been tested and they aren't used much so here is a - listing of what used to be there - - #if defined(WORDS_BIGENDIAN) - uint16_t bcast:3, len:5, dir:1, lf:3, res:4; - #else - uint16_t len:5, length of RIF field, including RC itself - bcast:3, broadcast indicator - res:4, reserved - lf:3, largest frame size - dir:1; direction -*/ - -#define TRH_MR_BCAST(trhmr) ((ntohs((trhmr)->bcast_len_dir_lf_res) & 0xe000) >> 13) -#define TRH_MR_LEN(trhmr) ((ntohs((trhmr)->bcast_len_dir_lf_res) & 0x1F00) >> 8) -#define TRH_MR_DIR(trhmr) ((ntohs((trhmr)->bcast_len_dir_lf_res) & 0x0080) >> 7) -#define TRH_MR_LF(trhmr) ((ntohs((trhmr)->bcast_len_dir_lf_res) & 0x0070) >> 4) -#define TRH_MR_RES(trhmr) ((ntohs((trhmr)->bcast_len_dir_lf_res) & 0x000F)) - -typedef struct _Trh_mr -{ - uint16_t bcast_len_dir_lf_res; /* broadcast/res/framesize/direction */ - uint16_t rseg[8]; -} Trh_mr; -#ifdef _MSC_VER - /* Visual C++ pragma to enable warning messages about nonstandard bit field type */ - #pragma warning( default : 4214 ) -#endif - -#define TR_ALEN 6 /* octets in an Ethernet header */ -#define FDDI_ALEN 6 - -typedef struct _Trh_hdr -{ - uint8_t ac; /* access control field */ - uint8_t fc; /* frame control field */ - uint8_t daddr[TR_ALEN]; /* src address */ - uint8_t saddr[TR_ALEN]; /* dst address */ -} Trh_hdr; - -#ifdef WIN32 - /* Visual C++ pragma to enable warning messages about nonstandard bit field type */ - #pragma warning( default : 4214 ) -#endif -/* End Token Ring Data Structures */ - - -/* Start FDDI Data Structures */ - -/* FDDI header is always this: -worm5er */ -typedef struct _Fddi_hdr -{ - uint8_t fc; /* frame control field */ - uint8_t daddr[FDDI_ALEN]; /* src address */ - uint8_t saddr[FDDI_ALEN]; /* dst address */ -} Fddi_hdr; - -/* splitting the llc up because of variable lengths of the LLC -worm5er */ -typedef struct _Fddi_llc_saps -{ - uint8_t dsap; - uint8_t ssap; -} Fddi_llc_saps; - -/* I've found sna frames have two addition bytes after the llc saps -worm5er */ -typedef struct _Fddi_llc_sna -{ - uint8_t ctrl_fld[2]; -} Fddi_llc_sna; - -/* I've also found other frames that seem to have only one byte... We're only -really intersted in the IP data so, until we want other, I'm going to say -the data is one byte beyond this frame... -worm5er */ -typedef struct _Fddi_llc_other -{ - uint8_t ctrl_fld[1]; -} Fddi_llc_other; - -/* Just like TR the ip/arp data is setup as such: -worm5er */ -typedef struct _Fddi_llc_iparp -{ - uint8_t ctrl_fld; - uint8_t protid[3]; - uint16_t ethertype; -} Fddi_llc_iparp; - -/* End FDDI Data Structures */ - - -/* 'Linux cooked captures' data - * (taken from tcpdump source). - */ - -#define SLL_HDR_LEN 16 /* total header length */ -#define SLL_ADDRLEN 8 /* length of address field */ -typedef struct _SLLHdr { - uint16_t sll_pkttype; /* packet type */ - uint16_t sll_hatype; /* link-layer address type */ - uint16_t sll_halen; /* link-layer address length */ - uint8_t sll_addr[SLL_ADDRLEN]; /* link-layer address */ - uint16_t sll_protocol; /* protocol */ -} SLLHdr; - - -/* - * Snort supports 3 versions of the OpenBSD pflog header: - * - * Pflog1_Hdr: CVS = 1.3, DLT_OLD_PFLOG = 17, Length = 28 - * Pflog2_Hdr: CVS = 1.8, DLT_PFLOG = 117, Length = 48 - * Pflog3_Hdr: CVS = 1.12, DLT_PFLOG = 117, Length = 64 - * Pflog3_Hdr: CVS = 1.172, DLT_PFLOG = 117, Length = 100 - * - * Since they have the same DLT, Pflog{2,3}Hdr are distinguished - * by their actual length. The minimum required length excludes - * padding. - */ -/* Old OpenBSD pf firewall pflog0 header - * (information from pf source in kernel) - * the rule, reason, and action codes tell why the firewall dropped it -fleck - */ - -typedef struct _Pflog1_hdr -{ - uint32_t af; - char intf[IFNAMSIZ]; - int16_t rule; - uint16_t reason; - uint16_t action; - uint16_t dir; -} Pflog1Hdr; - -#define PFLOG1_HDRLEN (sizeof(struct _Pflog1_hdr)) - -/* - * Note that on OpenBSD, af type is sa_family_t. On linux, that's an unsigned - * short, but on OpenBSD, that's a uint8_t, so we should explicitly use uint8_t - * here. - ronaldo - */ - -#define PFLOG_RULELEN 16 -#define PFLOG_PADLEN 3 - -typedef struct _Pflog2_hdr -{ - int8_t length; - uint8_t af; - uint8_t action; - uint8_t reason; - char ifname[IFNAMSIZ]; - char ruleset[PFLOG_RULELEN]; - uint32_t rulenr; - uint32_t subrulenr; - uint8_t dir; - uint8_t pad[PFLOG_PADLEN]; -} Pflog2Hdr; - -#define PFLOG2_HDRLEN (sizeof(struct _Pflog2_hdr)) -#define PFLOG2_HDRMIN (PFLOG2_HDRLEN - PFLOG_PADLEN) - -typedef struct _Pflog3_hdr -{ - int8_t length; - uint8_t af; - uint8_t action; - uint8_t reason; - char ifname[IFNAMSIZ]; - char ruleset[PFLOG_RULELEN]; - uint32_t rulenr; - uint32_t subrulenr; - uint32_t uid; - uint32_t pid; - uint32_t rule_uid; - uint32_t rule_pid; - uint8_t dir; - uint8_t pad[PFLOG_PADLEN]; -} Pflog3Hdr; - -#define PFLOG3_HDRLEN (sizeof(struct _Pflog3_hdr)) -#define PFLOG3_HDRMIN (PFLOG3_HDRLEN - PFLOG_PADLEN) - - -typedef struct _Pflog4_hdr -{ - uint8_t length; - uint8_t af; - uint8_t action; - uint8_t reason; - char ifname[IFNAMSIZ]; - char ruleset[PFLOG_RULELEN]; - uint32_t rulenr; - uint32_t subrulenr; - uint32_t uid; - uint32_t pid; - uint32_t rule_uid; - uint32_t rule_pid; - uint8_t dir; - uint8_t rewritten; - uint8_t pad[2]; - uint8_t saddr[16]; - uint8_t daddr[16]; - uint16_t sport; - uint16_t dport; -} Pflog4Hdr; - -#define PFLOG4_HDRLEN sizeof(struct _Pflog4_hdr) -#define PFLOG4_HDRMIN sizeof(struct _Pflog4_hdr) - -/* - * ssl_pkttype values. - */ - -#define LINUX_SLL_HOST 0 -#define LINUX_SLL_BROADCAST 1 -#define LINUX_SLL_MULTICAST 2 -#define LINUX_SLL_OTHERHOST 3 -#define LINUX_SLL_OUTGOING 4 - -/* ssl protocol values */ - -#define LINUX_SLL_P_802_3 0x0001 /* Novell 802.3 frames without 802.2 LLC header */ -#define LINUX_SLL_P_802_2 0x0004 /* 802.2 frames (not D/I/X Ethernet) */ -#endif // NO_NON_ETHER_DECODER - - -#ifdef _MSC_VER - /* Visual C++ pragma to disable warning messages - * about nonstandard bit field type - */ - #pragma warning( disable : 4214 ) -#endif - -#define VTH_PRIORITY(vh) ((ntohs((vh)->vth_pri_cfi_vlan) & 0xe000) >> 13) -#define VTH_CFI(vh) ((ntohs((vh)->vth_pri_cfi_vlan) & 0x1000) >> 12) -#define VTH_VLAN(vh) ((uint16_t)(ntohs((vh)->vth_pri_cfi_vlan) & 0x0FFF)) - -typedef struct _VlanTagHdr -{ - uint16_t vth_pri_cfi_vlan; - uint16_t vth_proto; /* protocol field... */ -} VlanTagHdr; -#ifdef _MSC_VER - /* Visual C++ pragma to enable warning messages about nonstandard bit field type */ - #pragma warning( default : 4214 ) -#endif - - -typedef struct _EthLlc -{ - uint8_t dsap; - uint8_t ssap; -} EthLlc; - -typedef struct _EthLlcOther -{ - uint8_t ctrl; - uint8_t org_code[3]; - uint16_t proto_id; -} EthLlcOther; /* We must twiddle to align the offset the ethernet header and align * the IP header on solaris -- maybe this will work on HPUX too. @@ -442,142 +150,34 @@ typedef struct _EthLlcOther #endif -#ifndef NO_NON_ETHER_DECODER -/* - * Wireless Header (IEEE 802.11) - */ -typedef struct _WifiHdr -{ - uint16_t frame_control; - uint16_t duration_id; - uint8_t addr1[6]; - uint8_t addr2[6]; - uint8_t addr3[6]; - uint16_t seq_control; - uint8_t addr4[6]; -} WifiHdr; - - -struct EtherEapol -{ - uint8_t version; /* EAPOL proto version */ - uint8_t eaptype; /* EAPOL Packet type */ - uint16_t len; /* Packet body length */ -}; - -struct EAPHdr -{ - uint8_t code; - uint8_t id; - uint16_t len; -}; - -struct EapolKey -{ - uint8_t type; - uint8_t length[2]; - uint8_t counter[8]; - uint8_t iv[16]; - uint8_t index; - uint8_t sig[16]; -}; - - -#endif // NO_NON_ETHER_DECODER - - -/* Can't add any fields not in the real header here - because of how the decoder uses structure overlaying */ -#ifdef _MSC_VER - /* Visual C++ pragma to disable warning messages - * about nonstandard bit field type - */ - #pragma warning( disable : 4214 ) -#endif - - -#define NUM_IP_PROTOS 256 - - -#ifndef IPPROTO_IP_MOBILITY -#define IPPROTO_IP_MOBILITY 55 -#endif -#ifndef IPPROTO_SUN_ND -#define IPPROTO_SUN_ND 77 -#endif -#ifndef IPPROTO_PIM -#define IPPROTO_PIM 103 -#endif - -#define IP_OPTMAX 40 -#define TCP_OPTLENMAX 40 /* (((2^4) - 1) * 4 - TCP_HEADER_LEN) */ -const uint32_t IP6_EXTMAX = 8; - - - -#ifdef _MSC_VER - /* Visual C++ pragma to enable warning messages about nonstandard bit field type */ - #pragma warning( default : 4214 ) -#endif - - -/* Can't add any fields not in the real header here - because of how the decoder uses structure overlaying */ -#ifdef _MSC_VER - /* Visual C++ pragma to disable warning - * messages about nonstandard bit field type - */ - #pragma warning( disable : 4214 ) -#endif - - +/* default mpls flags */ +#define DEFAULT_MPLS_PAYLOADTYPE MPLS_PAYLOADTYPE_IPV4 +#define DEFAULT_LABELCHAIN_LENGTH -1 -#define ERSPAN_VERSION(x) ((ntohs(x->ver_vlan) & 0xf000) >> 12) -#define ERSPAN_VLAN(x) (ntohs(x->ver_vlan) & 0x0fff) -#define ERSPAN_SPAN_ID(x) (ntohs(x->flags_spanId) & 0x03ff) -#define ERSPAN3_TIMESTAMP(x) (x->timestamp) +const int32_t MAX_PORTS = 65536; +const uint16_t NUM_IP_PROTOS = 256; +const int16_t SFTARGET_UNKNOWN_PROTOCOL = -1; +const uint8_t IP_OPTMAX = 40; +const uint8_t TCP_OPTLENMAX = 40; /* (((2^4) - 1) * 4 - TCP_HEADER_LEN) */ +const uint8_t IP6_EXTMAX = 8; +const uint8_t MIN_TTL = 64; +const uint8_t MAX_TTL = 255; -#ifdef _MSC_VER - /* Visual C++ pragma to enable warning messages - * about nonstandard bit field type - */ - #pragma warning( default : 4214 ) -#endif - +/* D A T A S T R U C T U R E S *********************************************/ +class Flow; -typedef struct _Options +struct Options { uint8_t code; uint8_t len; /* length of the data section */ const uint8_t *data; -} Options; - - - - -/* PPPoEHdr Header; eth::EtherHdr plus the PPPoE Header */ -typedef struct _PPPoEHdr -{ - unsigned char ver_type; /* pppoe version/type */ - unsigned char code; /* pppoe code CODE_* */ - unsigned short session; /* session id */ - unsigned short length; /* payload length */ - /* payload follows */ -} PPPoEHdr; - -/* PPPoE tag; the payload is a sequence of these */ -typedef struct _PPPoE_Tag -{ - unsigned short type; /* tag type TAG_* */ - unsigned short length; /* tag length */ - /* payload follows */ -} PPPoE_Tag; +} ; -#define LAYER_MAX 32 +const uint8_t LAYER_MAX = 32; struct Packet { @@ -589,21 +189,12 @@ struct Packet //^^^------------------------------------------------ //vvv----------------------------- - EtherARP *ah; - const eth::EtherHdr *eh; /* standard TCP/IP/Ethernet/ARP headers */ - const VlanTagHdr *vh; - EthLlc *ehllc; - EthLlcOther *ehllcother; - const PPPoEHdr *pppoeh; /* Encapsulated PPP of Ether header */ - const GREHdr *greh; - uint32_t *mpls; const IPHdr *iph, *orig_iph;/* and orig. headers for ICMP_*_UNREACH family */ const IPHdr *inner_iph; /* if IP-in-IP, this will be the inner IP header */ const IPHdr *outer_iph; /* if IP-in-IP, this will be the outer IP header */ const TCPHdr *tcph, *orig_tcph; const udp::UDPHdr *udph, *orig_udph; - const udp::UDPHdr *inner_udph; /* if Teredo + UDP, this will be the inner UDP header */ const udp::UDPHdr *outer_udph; /* if Teredo + UDP, this will be the outer UDP header */ const ICMPHdr *icmph, *orig_icmph; @@ -672,34 +263,6 @@ struct Packet uint8_t GTPencapsulated; uint8_t next_layer; /* index into layers for next encap */ -#ifndef NO_NON_ETHER_DECODER - const Fddi_hdr *fddihdr; /* FDDI support headers */ - Fddi_llc_saps *fddisaps; - Fddi_llc_sna *fddisna; - Fddi_llc_iparp *fddiiparp; - Fddi_llc_other *fddiother; - - const Trh_hdr *trh; /* Token Ring support headers */ - Trh_llc *trhllc; - Trh_mr *trhmr; - - Pflog1Hdr *pf1h; /* OpenBSD pflog interface header - version 1 */ - Pflog2Hdr *pf2h; /* OpenBSD pflog interface header - version 2 */ - Pflog3Hdr *pf3h; /* OpenBSD pflog interface header - version 3 */ - Pflog4Hdr *pf4h; /* OpenBSD pflog interface header - version 4 */ - -#ifdef DLT_LINUX_SLL - const SLLHdr *sllh; /* Linux cooked sockets header */ -#endif -#ifdef DLT_IEEE802_11 - const WifiHdr *wifih; /* wireless LAN header */ -#endif - const EtherEapol *eplh; /* 802.1x EAPOL header */ - const EAPHdr *eaph; - const uint8_t *eaptype; - EapolKey *eapolk; -#endif - // nothing after this point is zeroed ... ipv4::IpOptions ip_options[IP_OPTMAX]; /* ip options decode structure */ Options tcp_options[TCP_OPTLENMAX]; /* tcp options decode struct */ @@ -745,6 +308,9 @@ struct Packet #define PROTO_BIT__ICMP 0x0010 #define PROTO_BIT__TEREDO 0x0020 #define PROTO_BIT__GTP 0x0040 +#define PROTO_BIT__MPLS 0x0080 +#define PROTO_BIT__VLAN 0x0100 +#define PROTO_BIT__ETH 0x0200 #define PROTO_BIT__OTHER 0x8000 #define PROTO_BIT__ALL 0xffff @@ -814,5 +380,31 @@ static inline bool is_ip6(const Packet *p) return p->family == AF_INET6; } +static inline uint16_t EXTRACT_16BITS(const uint8_t* p) +{ + return ntohs(*(uint16_t*)(p)); +} + +#ifdef WORDS_MUSTALIGN + +#if defined(__GNUC__) +/* force word-aligned ntohl parameter */ + static inline uint32_t EXTRACT_32BITS(const uint8_t* p) + { + uint32_t tmp; + memmove(&tmp, p, sizeof(uint32_t)); + return ntohl(tmp); + } +#endif /* __GNUC__ */ + +#else + +/* allows unaligned ntohl parameter - dies w/SIGBUS on SPARCs */ + static inline uint32_t EXTRACT_32BITS(const uint8_t* p) + { + return ntohl(*(uint32_t *)p); + } +#endif /* WORDS_MUSTALIGN */ + #endif diff --git a/src/protocols/protocol_ids.h b/src/protocols/protocol_ids.h index 3b59ecbae..03dce3d0e 100644 --- a/src/protocols/protocol_ids.h +++ b/src/protocols/protocol_ids.h @@ -53,6 +53,7 @@ const uint16_t IPPROTO_ID_IPIP = 4; const uint16_t IPPROTO_ID_IPV6 = 41; const uint16_t IPPROTO_ID_ROUTING = 43; const uint16_t IPPROTO_ID_FRAGMENT = 44; +const uint16_t IPPROTO_ID_GRE = 47; const uint16_t IPPROTO_ID_ESP = 50; const uint16_t IPPROTO_ID_AH = 51; // RFC 4302 const uint16_t IPPROTO_ID_ICMPV6 = 58; @@ -82,9 +83,13 @@ const uint16_t PROTOCOL_GTP = 0x0102; const uint16_t ETHERTYPE_TRANS_ETHER_BRIDGING = 0x6558; const uint16_t ETHERTYPE_IPV4 = 0x0800; +const uint16_t ETHERTYPE_REVARP = 0x8035; +const uint16_t ETHERTYPE_ARP = 0x0806; +const uint16_t ETHERTYPE_8021Q = 0x8100; +const uint16_t ETHERTYPE_IPX = 0x8137; const uint16_t ETHERTYPE_IPV6 = 0x86dd; const uint16_t ETHERTYPE_PPP = 0x880B; -const uint16_t ETHERTYPE_IPX = 0x8137; +const uint16_t ETHERTYPE_EAPOL = 0x888e; #endif diff --git a/src/protocols/token_ring.h b/src/protocols/token_ring.h new file mode 100644 index 000000000..5132eb7ea --- /dev/null +++ b/src/protocols/token_ring.h @@ -0,0 +1,94 @@ +/* +** Copyright (C) 2002-2013 Sourcefire, Inc. +** Copyright (C) 1998-2002 Martin Roesch +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + + +#ifndef TOKEN_RING_H +#define TOKEN_RING_H + +namespace token_ring{ + +/* LLC structure */ +struct Trh_llc +{ + uint8_t dsap; + uint8_t ssap; + uint8_t protid[3]; + uint16_t ethertype; +} ; + +/* RIF structure + * Linux/tcpdump patch defines tokenring header in dump way, since not + * every tokenring header with have RIF data... we define it separately, and + * a bit more split up + */ + + +/* These are macros to use the bitlevel accesses in the Trh_Mr header + + they haven't been tested and they aren't used much so here is a + listing of what used to be there + + #if defined(WORDS_BIGENDIAN) + uint16_t bcast:3, len:5, dir:1, lf:3, res:4; + #else + uint16_t len:5, length of RIF field, including RC itself + bcast:3, broadcast indicator + res:4, reserved + lf:3, largest frame size + dir:1; direction +*/ + +#define TRH_MR_BCAST(trhmr) ((ntohs((trhmr)->bcast_len_dir_lf_res) & 0xe000) >> 13) +#define TRH_MR_LEN(trhmr) ((ntohs((trhmr)->bcast_len_dir_lf_res) & 0x1F00) >> 8) +#define TRH_MR_DIR(trhmr) ((ntohs((trhmr)->bcast_len_dir_lf_res) & 0x0080) >> 7) +#define TRH_MR_LF(trhmr) ((ntohs((trhmr)->bcast_len_dir_lf_res) & 0x0070) >> 4) +#define TRH_MR_RES(trhmr) ((ntohs((trhmr)->bcast_len_dir_lf_res) & 0x000F)) + +struct Trh_mr +{ + uint16_t bcast_len_dir_lf_res; /* broadcast/res/framesize/direction */ + uint16_t rseg[8]; +}; + +#define TR_ALEN 6 /* octets in an Ethernet header */ +#define FDDI_ALEN 6 +#define IPARP_SAP 0xaa + +struct Trh_hdr +{ + uint8_t ac; /* access control field */ + uint8_t fc; /* frame control field */ + uint8_t daddr[TR_ALEN]; /* src address */ + uint8_t saddr[TR_ALEN]; /* dst address */ +}; +/* End Token Ring Data Structures */ + +static inline const Trh_mr* get_trhmr(const Trh_llc* llc) +{ + + if(llc->dsap != IPARP_SAP && llc->ssap != IPARP_SAP) + return reinterpret_cast(llc); + + return nullptr; +} + +} // namespace token_ring + +#endif diff --git a/src/protocols/vlan.h b/src/protocols/vlan.h new file mode 100644 index 000000000..49227c4e9 --- /dev/null +++ b/src/protocols/vlan.h @@ -0,0 +1,53 @@ +/* +** Copyright (C) 2002-2013 Sourcefire, Inc. +** Copyright (C) 1998-2002 Martin Roesch +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + + +#ifndef VLAN_H +#define VLAN_H + +namespace vlan +{ + +struct VlanTagHdr +{ + uint16_t vth_pri_cfi_vlan; + uint16_t vth_proto; /* protocol field... */ +}; + + +static inline uint16_t vth_priority(const VlanTagHdr* vh) +{ + return (ntohs((vh)->vth_pri_cfi_vlan) & 0xe000) >> 13; +} + +static inline uint16_t vth_cfi(const VlanTagHdr* vh) +{ + return (ntohs((vh)->vth_pri_cfi_vlan) & 0x1000) >> 12; +} + +static inline uint16_t vth_vlan(const VlanTagHdr* vh) +{ + return ntohs((vh)->vth_pri_cfi_vlan) & 0x0FFF; +} + +} // namespace vlan + +#endif + diff --git a/src/protocols/wlan.h b/src/protocols/wlan.h index 767767164..d0fe5e0cc 100644 --- a/src/protocols/wlan.h +++ b/src/protocols/wlan.h @@ -22,7 +22,24 @@ #ifndef WLAN_H #define WLAN_H -#include +#ifndef NO_NON_ETHER_DECODER + +namespace wlan +{ + +/* + * Wireless Header (IEEE 802.11) + */ +struct WifiHdr +{ + uint16_t frame_control; + uint16_t duration_id; + uint8_t addr1[6]; + uint8_t addr2[6]; + uint8_t addr3[6]; + uint16_t seq_control; + uint8_t addr4[6]; +} ; /* Frame type/subype combinations with version = 0 */ @@ -66,6 +83,9 @@ #define WLAN_FLAG_WEP 0x4000 /* Wep Enabled 00000010 */ #define WLAN_FLAG_ORDER 0x8000 /* Strict Order 00000001 */ +} // namespace wlan + +#endif #endif diff --git a/src/service_inspectors/back_orifice/back_orifice.cc b/src/service_inspectors/back_orifice/back_orifice.cc index 38e083647..84ecf71c2 100644 --- a/src/service_inspectors/back_orifice/back_orifice.cc +++ b/src/service_inspectors/back_orifice/back_orifice.cc @@ -118,7 +118,7 @@ #include "snort_types.h" #include "detect.h" -#include "decode.h" +#include "protocols/packet.h" #include "event.h" #include "parser.h" #include "snort_debug.h" diff --git a/src/service_inspectors/ftp_telnet/ft_main.h b/src/service_inspectors/ftp_telnet/ft_main.h index 1d90c00aa..ae046c975 100644 --- a/src/service_inspectors/ftp_telnet/ft_main.h +++ b/src/service_inspectors/ftp_telnet/ft_main.h @@ -33,8 +33,9 @@ #define FT_MAIN_H #include "ftpp_ui_config.h" -#include "decode.h" +#include "protocols/packet.h" #include "framework/bits.h" +#include "time/profiler.h" #define BUF_SIZE 1024 diff --git a/src/service_inspectors/ftp_telnet/ftp_parse.h b/src/service_inspectors/ftp_telnet/ftp_parse.h index f4a60a565..63b0c048b 100644 --- a/src/service_inspectors/ftp_telnet/ftp_parse.h +++ b/src/service_inspectors/ftp_telnet/ftp_parse.h @@ -24,7 +24,7 @@ #define FTP_PARSE_H #include "ftpp_ui_config.h" -#include "decode.h" +#include "protocols/packet.h" #include "framework/bits.h" /* diff --git a/src/service_inspectors/ftp_telnet/ftpp_include.h b/src/service_inspectors/ftp_telnet/ftpp_include.h index 28d632ce0..8c71a860b 100644 --- a/src/service_inspectors/ftp_telnet/ftpp_include.h +++ b/src/service_inspectors/ftp_telnet/ftpp_include.h @@ -36,7 +36,7 @@ #include "snort_types.h" #include "sf_ip.h" #include "snort_debug.h" -#include "decode.h" +#include "protocols/packet.h" #define GENERATOR_SPP_FTPP_FTP 125 #define GENERATOR_SPP_FTPP_TELNET 126 diff --git a/src/service_inspectors/ftp_telnet/ftpp_si.h b/src/service_inspectors/ftp_telnet/ftpp_si.h index 241a9164c..2493ca106 100644 --- a/src/service_inspectors/ftp_telnet/ftpp_si.h +++ b/src/service_inspectors/ftp_telnet/ftpp_si.h @@ -44,7 +44,7 @@ #include "ftpp_ui_config.h" #include "ftp_client.h" #include "ftp_server.h" -#include "decode.h" +#include "protocols/packet.h" #include "file_api/file_api.h" #include "stream/stream_api.h" #include "flow/flow.h" diff --git a/src/service_inspectors/ftp_telnet/pp_ftp.h b/src/service_inspectors/ftp_telnet/pp_ftp.h index 464fa7fee..35fd4ad46 100644 --- a/src/service_inspectors/ftp_telnet/pp_ftp.h +++ b/src/service_inspectors/ftp_telnet/pp_ftp.h @@ -39,7 +39,7 @@ #include -//#include "decode.h" +//#include "protocols/packet.h" #include "ftpp_ui_config.h" #include "ftpp_si.h" diff --git a/src/service_inspectors/ftp_telnet/pp_telnet.h b/src/service_inspectors/ftp_telnet/pp_telnet.h index da3769c8c..ed6c23148 100644 --- a/src/service_inspectors/ftp_telnet/pp_telnet.h +++ b/src/service_inspectors/ftp_telnet/pp_telnet.h @@ -44,7 +44,7 @@ /* RFC 1184 defines Abort, Suspend, and End of File telnet optinos */ #define RFC1184 -//#include "decode.h" +//#include "protocols/packet.h" #include "ftpp_ui_config.h" #include "ftpp_si.h" diff --git a/src/service_inspectors/http_inspect/hi_main.cc b/src/service_inspectors/http_inspect/hi_main.cc index 33b374fae..95a9f08ad 100644 --- a/src/service_inspectors/http_inspect/hi_main.cc +++ b/src/service_inspectors/http_inspect/hi_main.cc @@ -62,7 +62,7 @@ #include "snort.h" #include "detect.h" -#include "decode.h" +#include "protocols/packet.h" #include "event.h" #include "generators.h" #include "snort_debug.h" diff --git a/src/service_inspectors/http_inspect/hi_main.h b/src/service_inspectors/http_inspect/hi_main.h index 65353bb40..1a0d84f71 100644 --- a/src/service_inspectors/http_inspect/hi_main.h +++ b/src/service_inspectors/http_inspect/hi_main.h @@ -27,7 +27,7 @@ #include "config.h" #endif -#include "decode.h" +#include "protocols/packet.h" #include "stream/stream_api.h" #include "hi_ui_config.h" #include "util_utf.h" diff --git a/src/service_inspectors/http_inspect/hi_paf.cc b/src/service_inspectors/http_inspect/hi_paf.cc index 19e7fda21..ca54493d9 100644 --- a/src/service_inspectors/http_inspect/hi_paf.cc +++ b/src/service_inspectors/http_inspect/hi_paf.cc @@ -63,7 +63,7 @@ #include "generators.h" #include "hi_events.h" -#include "decode.h" +#include "protocols/packet.h" #include "snort.h" #include "stream/stream_api.h" #include "snort_debug.h" diff --git a/src/service_inspectors/http_inspect/hi_si.h b/src/service_inspectors/http_inspect/hi_si.h index 17cc90920..32b7c6512 100644 --- a/src/service_inspectors/http_inspect/hi_si.h +++ b/src/service_inspectors/http_inspect/hi_si.h @@ -45,7 +45,7 @@ #include "hi_ad.h" #include "ipv6_port.h" -#include "decode.h" +#include "protocols/packet.h" /* ** These are the defines for the different types of diff --git a/src/service_inspectors/http_inspect/http_inspect.cc b/src/service_inspectors/http_inspect/http_inspect.cc index da36b6726..c7daaf40e 100644 --- a/src/service_inspectors/http_inspect/http_inspect.cc +++ b/src/service_inspectors/http_inspect/http_inspect.cc @@ -58,7 +58,7 @@ Undefined symbols for architecture x86_64: #include #include -#include "decode.h" +#include "protocols/packet.h" #include "snort_debug.h" #include "util.h" #include "parser.h" diff --git a/src/service_inspectors/rpc_decode/rpc_decode.cc b/src/service_inspectors/rpc_decode/rpc_decode.cc index d7b31984f..67711fbfa 100644 --- a/src/service_inspectors/rpc_decode/rpc_decode.cc +++ b/src/service_inspectors/rpc_decode/rpc_decode.cc @@ -47,7 +47,7 @@ #include #include "rpc_module.h" -#include "decode.h" +#include "protocols/packet.h" #include "parser.h" #include "snort_debug.h" #include "util.h" diff --git a/src/sfip/sf_iph.cc b/src/sfip/sf_iph.cc index a83e4f0c1..323b61813 100644 --- a/src/sfip/sf_iph.cc +++ b/src/sfip/sf_iph.cc @@ -26,7 +26,7 @@ #include "config.h" #endif #include -#include "decode.h" +#include "protocols/packet.h" #define FAILURE -1 #define SUCCESS 0 diff --git a/src/stream/CMakeLists.txt b/src/stream/CMakeLists.txt index c380780fd..e284e28aa 100644 --- a/src/stream/CMakeLists.txt +++ b/src/stream/CMakeLists.txt @@ -24,6 +24,7 @@ target_link_libraries( stream stream_icmp stream_tcp stream_udp + protocols ) install (FILES ${STREAM_INCLUDES} diff --git a/src/stream/icmp/CMakeLists.txt b/src/stream/icmp/CMakeLists.txt index 92e110ab5..74b6e1d92 100644 --- a/src/stream/icmp/CMakeLists.txt +++ b/src/stream/icmp/CMakeLists.txt @@ -8,3 +8,6 @@ add_library( stream_icmp STATIC stream_icmp.h ) +target_link_libraries( stream_icmp + protocols +) diff --git a/src/stream/icmp/icmp_session.cc b/src/stream/icmp/icmp_session.cc index 5910b9e2d..682040ff4 100644 --- a/src/stream/icmp/icmp_session.cc +++ b/src/stream/icmp/icmp_session.cc @@ -30,7 +30,7 @@ #include "icmp_session.h" #include "snort_types.h" #include "snort_debug.h" -#include "decode.h" +#include "protocols/packet.h" #include "mstring.h" #include "sfxhash.h" #include "util.h" @@ -40,6 +40,8 @@ #include "flow/session.h" #include "perf_monitor/perf.h" #include "profiler.h" +#include "protocols/layer.h" +#include "protocols/vlan.h" static SessionStats gicmpStats; static THREAD_LOCAL SessionStats icmpStats; @@ -135,8 +137,8 @@ static int ProcessIcmpUnreach(Packet *p) skey.port_h = sport; } - if (p->vh) - skey.vlan_tag = (uint16_t)VTH_VLAN(p->vh); + if (p->proto_bits & PROTO_BIT__VLAN) + skey.vlan_tag = vlan::vth_vlan(layer::get_vlan_layer(p)); else skey.vlan_tag = 0; diff --git a/src/stream/ip/ip_defrag.cc b/src/stream/ip/ip_defrag.cc index f4d75dcdf..23464d440 100644 --- a/src/stream/ip/ip_defrag.cc +++ b/src/stream/ip/ip_defrag.cc @@ -85,7 +85,7 @@ #include "snort_bounds.h" #include "log_text.h" #include "detect.h" -#include "decode.h" +#include "protocols/packet.h" #include "managers/packet_manager.h" #include "event.h" #include "util.h" diff --git a/src/stream/stream_api.cc b/src/stream/stream_api.cc index 3e46452a0..060aee815 100644 --- a/src/stream/stream_api.cc +++ b/src/stream/stream_api.cc @@ -45,7 +45,7 @@ #include "icmp/stream_icmp.h" #include "ip/stream_ip.h" #include "mstring.h" -#include "decode.h" +#include "protocols/packet.h" #include "detect.h" #include "generators.h" #include "perf_monitor/perf.h" @@ -54,6 +54,8 @@ #include "ipv6_port.h" #include "ips_options/ips_flowbits.h" #include "snort_debug.h" +#include "protocols/layer.h" +#include "protocols/vlan.h" #include "target_based/sftarget_protocol_reference.h" #include "target_based/sftarget_hostentry.h" @@ -119,8 +121,9 @@ void Stream::populate_session_key(Packet *p, FlowKey *key) GET_SRC_IP(p), p->sp, GET_DST_IP(p), p->dp, GET_IPH_PROTO(p), - p->vh ? VTH_VLAN(p->vh) : 0, - p->mpls ? p->mplsHdr.label : 0, + // if the vlan protocol bit is defined, vlan layer gauranteed to exist + (p->proto_bits & PROTO_BIT__VLAN) ? vlan::vth_vlan(layer::get_vlan_layer(p)) : 0, + (p->proto_bits & PROTO_BIT__MPLS) ? p->mplsHdr.label : 0, addressSpaceId); } diff --git a/src/stream/tcp/stream_tcp.h b/src/stream/tcp/stream_tcp.h index cb3a21b41..0c92da064 100644 --- a/src/stream/tcp/stream_tcp.h +++ b/src/stream/tcp/stream_tcp.h @@ -24,7 +24,7 @@ #include "flow/flow.h" #include "stream/stream_api.h" -#include "decode.h" +#include "protocols/packet.h" #include "target_based/sftarget_protocol_reference.h" #include "framework/bits.h" diff --git a/src/stream/tcp/tcp_session.cc b/src/stream/tcp/tcp_session.cc index b90ee4648..d47916b2e 100644 --- a/src/stream/tcp/tcp_session.cc +++ b/src/stream/tcp/tcp_session.cc @@ -68,7 +68,7 @@ #include "generators.h" #include "snort.h" #include "time/packet_time.h" -#include "decode.h" +#include "protocols/packet.h" #include "managers/packet_manager.h" #include "log_text.h" #include "packet_io/active.h" @@ -4401,17 +4401,20 @@ static inline int ValidMacAddress( { int i, j, ret = 0; - if (p->eh == NULL) + if (!(p->proto_bits & PROTO_BIT__ETH)) return 0; + // if flag is set, gauranteed to have an eth layer + const eth::EtherHdr *eh = layer::get_eth_layer(p); + for ( i = 0; i < 6; ++i ) { - if ((talker->mac_addr[i] != p->eh->ether_src[i])) + if ((talker->mac_addr[i] != eh->ether_src[i])) break; } for ( j = 0; j < 6; ++j ) { - if (listener->mac_addr[j] != p->eh->ether_dst[j]) + if (listener->mac_addr[j] != eh->ether_dst[j]) break; } @@ -4438,16 +4441,19 @@ static inline void CopyMacAddr( int i; /* Not ethernet based, nothing to do */ - if (p->eh == NULL) + if (!(p->proto_bits & PROTO_BIT__ETH)) return; + // if flag is set, gauranteed to have an eth layer + const eth::EtherHdr *eh = layer::get_eth_layer(p); + if (dir == FROM_CLIENT) { /* Client is SRC */ for (i=0;i<6;i++) { - tcpssn->client.mac_addr[i] = p->eh->ether_src[i]; - tcpssn->server.mac_addr[i] = p->eh->ether_dst[i]; + tcpssn->client.mac_addr[i] = eh->ether_src[i]; + tcpssn->server.mac_addr[i] = eh->ether_dst[i]; } } else @@ -4455,8 +4461,8 @@ static inline void CopyMacAddr( /* Server is SRC */ for (i=0;i<6;i++) { - tcpssn->server.mac_addr[i] = p->eh->ether_src[i]; - tcpssn->client.mac_addr[i] = p->eh->ether_dst[i]; + tcpssn->server.mac_addr[i] = eh->ether_src[i]; + tcpssn->client.mac_addr[i] = eh->ether_dst[i]; } } } diff --git a/src/stream/udp/udp_session.cc b/src/stream/udp/udp_session.cc index fbf5f1c7b..aa3cd0b69 100644 --- a/src/stream/udp/udp_session.cc +++ b/src/stream/udp/udp_session.cc @@ -35,7 +35,7 @@ #include "mstring.h" #include "sfxhash.h" #include "util.h" -#include "decode.h" +#include "protocols/packet.h" #include "flow/flow_control.h" #include "flow/session.h" #include "rules.h" diff --git a/src/target_based/sftarget_protocol_reference.h b/src/target_based/sftarget_protocol_reference.h index bbd07f231..a42d3c73f 100644 --- a/src/target_based/sftarget_protocol_reference.h +++ b/src/target_based/sftarget_protocol_reference.h @@ -26,7 +26,7 @@ #ifndef SFTARGET_PROTOCOL_REFERENCE_H #define SFTARGET_PROTOCOL_REFERENCE_H -#include "decode.h" +#include "protocols/packet.h" #include "util.h" #include "sftarget_data.h" diff --git a/src/test/CMakeLists.txt b/src/test/CMakeLists.txt index 1fab5dad9..dc240aee3 100644 --- a/src/test/CMakeLists.txt +++ b/src/test/CMakeLists.txt @@ -1,162 +1,50 @@ -if ( TESTING_ENABLED ) +if ( BUILD_UNIT_TESTS ) -#find_package(GCOV) +find_package(CHECK REQUIRED) +include_directories(${CHECK_INCLUDE_DIR}) +include_directories(${CMAKE_CURRENT_BINARY_DIR}) # for generated files -message ("cmake path = ..${CMAKE_MODULE_PATH}..") -#SET (CHECK_DIR "${CMAKE_MODULE_PATH}") -find_package(CHECK) -find_package(GCOV) - - -# build sf_ip_test - - - -# BUILDING SF_IP_TEST: - - -add_executable (sf_ip_test sf_ip_test.cc) -add_compile_flags (sf_ip_test "--std=gnu++11 -O0 -Wall -fprofile-arcs -ftest-coverage -DSF_IP_TEST -C ${CMAKE_CURRENT_BINARY_DIR}") -add_link_flags (sf_ip_test "-g -O0 -Wall -fprofile-arcs -ftest-coverage -DSF_IP_TEST") -target_link_libraries ( sf_ip_test - policy - sfrt - sfip - utils - ${CHECK_LIBRARY} - ${MATH_LIBRARY} +# Generating build_decl.h Will rebuild every time 'make' is run +add_custom_target(build_suit_decl ALL + COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/build_list.sh ${CMAKE_SOURCE_DIR}/src ${CMAKE_CURRENT_BINARY_DIR} + COMMENT "building suite_decl.h" ) - - -# BUILDING SFTHD_TEST - -#add_executable ( sfthd_test -# sfthd_test.cc -# unit_hacks.cc -# unit_hacks.h -# ${CMAKE_SOURCE_DIR}/src/filters/sfthd.cc -#) - -#add_compile_flags (sfthd_test "-DSFTHD_TEST") -#target_link_libraries ( sfthd_test -# policy -# sfrt -# sfip -# utils -# ${CHECK_LIBRARY} -# ${MATH_LIBRARY} -#) - -# BUILDDING SFRF_TEST - -#add_executable (sfrf_test -# sfrf_test.cc -# unit_hacks.cc -# unit_hacks.h -# ${CMAKE_SOURCE_DIR}/src/filters/sfrf.cc -#) -#add_compile_flags (sfrf_test "-DSFRF_TEST") -#target_link_libraries ( sfrf_test -# policy -# sfrt -# sfip -# utils -# ${CHECK_LIBRARY} -# ${MATH_LIBRARY} -#) - - -# BUILDING SFRF_TEST -#add_executable ( sfrt_test sfrt_test.cc ) -#target_link_libraries (sfrf_test -# policy -# sfrt -# sfip -# utils -# ${CHECK_LIBRARY} -# ${MATH_LIBRARY} -#) - - -ADD_CUSTOM_TARGET( check - COMMAND "${CMAKE_CURRENT_BINARY_DIR}/sf_ip_test" -# COMMAND "${CMAKE_CURRENT_BINARY_DIR}/sfthd_test" -# COMMAND "${CMAKE_CURRENT_BINARY_DIR}/sfrf_test" -# COMMAND "${CMAKE_CURRENT_BINARY_DIR}/sfrt_test" - DEPENDS sf_ip_test -# sfthd_test -# sfrf_test -# sfrt_test +add_custom_command( OUTPUT ${CMAKE_CURRENT_BINARY_DIR}/suite_decl.h + COMMAND ${CMAKE_COMMAND} -E touch_nocreate ${CMAKE_CURRENT_BINARY_DIR}/suite_decl.h + DEPENDS build_suit_decl ) - -# BUILDING AND RUNNING GCOV PROJECTS - -message ("CHECK_LIBRARY = ${CHECK_LIBRARY}") -message ("MATH_LIBRARY = ${MATH_LIBRARY}") - - -add_executable ( sf_ip_gcov_prog - ../sfip/sf_ip.cc - sf_ip_test.cc +# Generating suite_list.h Will rebuild every time 'make' is run +add_custom_target(build_suite_list ALL + COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/build_decl.sh ${CMAKE_SOURCE_DIR}/src ${CMAKE_CURRENT_BINARY_DIR} + COMMENT "building suite_list.h" ) -include_directories("${CMAKE_CURRENT_SOURCE_DIR}/..") -add_compile_flags (sf_ip_gcov_prog "--std=gnu++11 -O0 -Wall -fprofile-arcs -ftest-coverage -DSF_IP_TEST -C ${CMAKE_CURRENT_BINARY_DIR}") -add_link_flags (sf_ip_gcov_prog "-g -O0 -Wall -fprofile-arcs -ftest-coverage -DSF_IP_TEST") -#CFLAGS="-g -O0 -Wall -W -fprofile-arcs -ftest-coverage" -#LDFLAGS="-fprofile-arcs -ftest-coverage" -target_link_libraries ( sf_ip_gcov_prog - ${CHECK_LIBRARY} - ${MATH_LIBRARY} +add_custom_command( OUTPUT ${CMAKE_CURRENT_BINARY_DIR}/suite_list.h + COMMAND ${CMAKE_COMMAND} -E touch_nocreate ${CMAKE_CURRENT_BINARY_DIR}/suite_list.h + DEPENDS build_suite_list ) -message ("current binary directory is ${CMAKE_CURRENT_BINARY_DIR}") - -ADD_CUSTOM_TARGET ( sf_ip_gcov - COMMAND "${CMAKE_CURRENT_BINARY_DIR}/sf_ip_gcov_prog" - COMMAND ${GCOV_EXECUTABLE} - -o ${CMAKE_CURRENT_BINARY_DIR} - ${CMAKE_SOURCE_DIR}/src/sfip/sf_ip.cc - COMMAND ${GCOV_EXECUTABLE} - -o ${CMAKE_CURRENT_BINARY_DIR} - ${CMAKE_CURRENT_SOURCE_DIR}/sf_ip_test.cc - DEPENDS sf_ip_gcov_prog +add_library(unit_tests STATIC + ${CMAKE_CURRENT_BINARY_DIR}/suite_decl.h + ${CMAKE_CURRENT_BINARY_DIR}/suite_list.h + sfip_test.cc + sfrf_test.cc + sfrt_test.cc + sfthd_test.cc + unit_test.cc + unit_test.h ) +target_link_libraries(unit_tests + ${CHECK_LIBRARIES} +) -#ADD_CUSTOM_TARGET ( gcov_tests -# DEPENDS sf_ip_gcov -# sfthc_gcov -# sfrf_gcov -# sfrt_gcov -#) - - -#sf_ip_gcov: -# g++ -g -O0 -Wall -fprofile-arcs -ftest-coverage -o sf_ip_test -DSF_IP_TEST -lm -lcheck -I.. ../sf_ip.cc sf_ip_test.cc -# ./sf_ip_test -# gcov ../sf_ip.cc -# gcov sf_ip_test.cc - -#sfthd_gcov: -# g++ -g -O0 -Wall -fprofile-arcs -ftest-coverage -o sfthd_test -lm -lcheck -I.. -I../.. sfthd_test.cc ../sfthd.cc $(top_builddir)/src/utils/libutils.a -# ./sfthd_test -# gcov ../sfthd.cc -# gcov sfthd_test.cc - -#sfrf_gcov: -# g++ -g -O0 -Wall -fprofile-arcs -ftest-coverage -o sfrf_test -lm -lcheck -I.. -I../.. sfrf_test.cc ../sfrf.cc $(top_builddir)/src/utils/libutils.a -# ./sfrf_test -# gcov ../sfrf.cc -# gcov sfrf_test.cc - -#sfrt_gcov: -# g++ -g -O0 -Wall -fprofile-arcs -ftest-coverage -o sfrt_test -lm -lcheck -I.. -I../.. sfrt_test.cc ../sfrt.cc -# ./sfrt_test -# gcov ../sfrt.cc -# gcov sfrt_test.cc +set_source_files_properties( unit_test.cc PROPERTIES + OBJECT_DEPENDS ${CMAKE_CURRENT_BINARY_DIR}/suite_decl.h + OBJECT_DEPENDS ${CMAKE_CURRENT_BINARY_DIR}/suite_list.h +) -endif( TESTING_ENABLED) +endif() diff --git a/src/test/build_decl.sh b/src/test/build_decl.sh new file mode 100755 index 000000000..a70289d5b --- /dev/null +++ b/src/test/build_decl.sh @@ -0,0 +1,10 @@ +#/bin/bash + +SOURCE_DIR=$1 +FILE=$2/suite_decl.h + +rm -f $FILE ; +for f in `grep -whoR --include \*.cc 'TEST_SUITE[^(]*' $SOURCE_DIR` ; do + echo "extern Suite* $f();" >> $FILE ; +done ; +touch unit_test.cc diff --git a/src/test/build_list.sh b/src/test/build_list.sh new file mode 100755 index 000000000..865a0eda8 --- /dev/null +++ b/src/test/build_list.sh @@ -0,0 +1,10 @@ +#!/bin/bash + +SOURCE_DIR=$1 +FILE=$2/suite_list.h + +rm -f $FILE ; +for f in `grep -whoR --include \*.cc 'TEST_SUITE[^(]*' $SOURCE_DIR` ; do + echo "$f," >> $FILE ; +done ; +touch unit_test.cc diff --git a/src/time/ppm.cc b/src/time/ppm.cc index 4395dfccd..8bf98b6a3 100644 --- a/src/time/ppm.cc +++ b/src/time/ppm.cc @@ -62,7 +62,6 @@ #include "rules.h" #include "treenodes.h" #include "treenodes.h" -#include "decode.h" #include "parser.h" #include "util.h" #include "rules.h" @@ -74,6 +73,7 @@ #include "detection/detect.h" #include "detection/fpdetect.h" #include "actions/actions.h" +#include "protocols/packet.h" #ifdef PPM_MGR