From: Josh Date: Fri, 18 Apr 2014 16:06:08 +0000 (-0400) Subject: Adding erspan2 and erspan3. X-Git-Tag: 3.0.0-233~1559^2~14 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=71bfb7905a5bd3afd2f1f3d2fce9648dfe573724;p=thirdparty%2Fsnort3.git Adding erspan2 and erspan3. --- diff --git a/src/codecs/plugins/CMakeLists.txt b/src/codecs/plugins/CMakeLists.txt index c759d2046..fd2c8b3bf 100644 --- a/src/codecs/plugins/CMakeLists.txt +++ b/src/codecs/plugins/CMakeLists.txt @@ -10,6 +10,8 @@ add_library( codec_plugins STATIC cd_gre.cc cd_mpls.cc cd_transbridge.cc + cd_erspan2.cc + cd_erspan3.cc ) diff --git a/src/codecs/tmp/prot_erspan2.cc b/src/codecs/plugins/cd_erspan2.cc similarity index 55% rename from src/codecs/tmp/prot_erspan2.cc rename to src/codecs/plugins/cd_erspan2.cc index 0d9dd13db..b754e5ab9 100644 --- a/src/codecs/tmp/prot_erspan2.cc +++ b/src/codecs/plugins/cd_erspan2.cc @@ -21,18 +21,42 @@ */ +#include "framework/codec.h" +#include "codecs/codec_events.h" +#include "codecs/decode_module.h" +#include "protocols/ethertypes.h" + +namespace +{ + +class Erspan2Codec : public Codec +{ +public: + Erspan2Codec() : Codec("ERSPAN_2"){}; + ~Erspan2Codec(); + + + virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, + Packet *, uint16_t &p_hdr_len, int &next_prot_id); + + virtual void get_protocol_ids(std::vector&); + virtual void get_data_link_type(std::vector&){}; + +}; -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif -#include "generators.h" -#include "decode.h" -#include "static_include.h" -#include "prot_erspan2.h" +struct ERSpanType2Hdr +{ + uint16_t ver_vlan; + uint16_t flags_spanId; + uint32_t pad; +} ; + +const uint16_t ETHERTYPE_ERSPAN_TYPE2 = 0x88be; +} // anonymous namespace + -#include "decoder_includes.h" /* * Function: DecodeERSPANType2(uint8_t *, uint32_t, Packet *) @@ -47,17 +71,17 @@ * Returns: void function * */ -bool ERSPANType2::Decode(const uint8_t *pkt, const uint32_t len, - Packet *p, uint16_t &p_hdr_len, uint16_t &next_prot_id) +bool Erspan2Codec::decode(const uint8_t *raw_pkt, const uint32_t len, + Packet *p, uint16_t &p_hdr_len, int &next_prot_id) { - uint32_t hlen = sizeof(ERSpanType2Hdr); + p_hdr_len = sizeof(ERSpanType2Hdr); uint32_t payload_len; - ERSpanType2Hdr *erSpan2Hdr = (ERSpanType2Hdr *)pkt; + ERSpanType2Hdr *erSpan2Hdr = (ERSpanType2Hdr *)raw_pkt; if (len < sizeof(ERSpanType2Hdr)) { - CodecEvents::decoder_alert_encapsulated(p, DECODE_ERSPAN2_DGRAM_LT_HDR, pkt, len); - return; + CodecEvents::decoder_alert_encapsulated(p, DECODE_ERSPAN2_DGRAM_LT_HDR, raw_pkt, len); + return false; } if (p->encapsulated) @@ -65,8 +89,8 @@ bool ERSPANType2::Decode(const uint8_t *pkt, const uint32_t len, /* discard packet - multiple encapsulation */ /* not sure if this is ever used but I am assuming it is not */ CodecEvents::decoder_alert_encapsulated(p, DECODE_IP_MULTIPLE_ENCAPSULATION, - pkt, len); - return; + raw_pkt, len); + return false; } /* Check that this is in fact ERSpan Type 2. @@ -74,34 +98,57 @@ bool ERSPANType2::Decode(const uint8_t *pkt, const uint32_t len, if (ERSPAN_VERSION(erSpan2Hdr) != 0x01) /* Type 2 == version 0x01 */ { CodecEvents::decoder_alert_encapsulated(p, DECODE_ERSPAN_HDR_VERSION_MISMATCH, - pkt, len); - return; + raw_pkt, len); + return false; } -// PushLayer(PROTO_ERSPAN, p, pkt, hlen); - payload_len = len - hlen; - - // TODO: Is this actually statis or possible changable? -// DecodeTransBridging(pkt + hlen, payload_len, p); - next_prot_id = GRE_TYPE_TRANS_BRIDGING; // huh? - p_hdr_len = hlen; + next_prot_id = ETHERTYPE_TRANS_ETHER_BRIDGING; // huh? return true; } -static const char* name = "erspan2_decode"; -static const CodecApi erspan2_api = + +void Erspan2Codec::get_protocol_ids(std::vector& v) +{ + v.push_back(ETHERTYPE_ERSPAN_TYPE2); +} + +static Codec* ctor() +{ + return new Erspan2Codec(); +} + +static void dtor(Codec *cd) +{ + delete cd; +} + +static void sum() +{ +// sum_stats((PegCount*)&gdc, (PegCount*)&dc, array_size(dc_pegs)); +// memset(&dc, 0, sizeof(dc)); +} + +static void stats() +{ +// show_percent_stats((PegCount*)&gdc, dc_pegs, array_size(dc_pegs), +// "decoder"); +} + + + +static const char* name = "erspan2_codec"; + +static const CodecApi codec_api = { { PT_CODEC, name, CDAPI_PLUGIN_V0, 0 }, - {ETHERNET_TYPE_ERSPAN_TYPE2}, NULL, // pinit NULL, // pterm NULL, // tinit NULL, // tterm ctor, // ctor dtor, // dtor - NULL, - NULL, + sum, // sum + stats // stats }; - diff --git a/src/codecs/tmp/prot_erspan3.cc b/src/codecs/plugins/cd_erspan3.cc similarity index 54% rename from src/codecs/tmp/prot_erspan3.cc rename to src/codecs/plugins/cd_erspan3.cc index 9ee67ea95..af30e3d53 100644 --- a/src/codecs/tmp/prot_erspan3.cc +++ b/src/codecs/plugins/cd_erspan3.cc @@ -22,18 +22,44 @@ -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif +#include "framework/codec.h" +#include "codecs/codec_events.h" +#include "codecs/decode_module.h" +#include "protocols/ethertypes.h" -#include "generators.h" -#include "decode.h" -#include "static_include.h" +namespace +{ + +class Erspan3Codec : public Codec +{ +public: + Erspan3Codec() : Codec("ERSPAN_3"){}; + ~Erspan3Codec(); + + + virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, + Packet *, uint16_t &p_hdr_len, int &next_prot_id); + + virtual void get_protocol_ids(std::vector&); + virtual void get_data_link_type(std::vector&){}; + +}; -#include "decoder_includes.h" -#include "prot_erspan3.h" +struct ERSpanType3Hdr +{ + uint16_t ver_vlan; + uint16_t flags_spanId; + uint32_t timestamp; + uint16_t pad0; + uint16_t pad1; + uint32_t pad2; + uint32_t pad3; +}; + +const uint16_t ETHERTYPE_ERSPAN_TYPE3 = 0x22eb; +} // anonymous namespace /* * Function: DecodeERSPANType3(uint8_t *, uint32_t, Packet *) @@ -48,17 +74,18 @@ * Returns: void function * */ -void DecodeERSPANType3(const uint8_t *pkt, const uint32_t len, Packet *p) +bool Erspan3Codec::decode(const uint8_t *raw_pkt, const uint32_t len, + Packet *p, uint16_t &p_hdr_len, int &next_prot_id) { - uint32_t hlen = sizeof(ERSpanType3Hdr); + p_hdr_len= sizeof(ERSpanType3Hdr); uint32_t payload_len; - ERSpanType3Hdr *erSpan3Hdr = (ERSpanType3Hdr *)pkt; + ERSpanType3Hdr *erSpan3Hdr = (ERSpanType3Hdr *)raw_pkt; if (len < sizeof(ERSpanType3Hdr)) { CodecEvents::decoder_alert_encapsulated(p, DECODE_ERSPAN3_DGRAM_LT_HDR, - pkt, len); - return; + raw_pkt, len); + return false; } if (p->encapsulated) @@ -66,8 +93,8 @@ void DecodeERSPANType3(const uint8_t *pkt, const uint32_t len, Packet *p) /* discard packet - multiple encapsulation */ /* not sure if this is ever used but I am assuming it is not */ CodecEvents::decoder_alert_encapsulated(p, DECODE_IP_MULTIPLE_ENCAPSULATION, - pkt, len); - return; + raw_pkt, len); + return false; } /* Check that this is in fact ERSpan Type 3. @@ -75,36 +102,57 @@ void DecodeERSPANType3(const uint8_t *pkt, const uint32_t len, Packet *p) if (ERSPAN_VERSION(erSpan3Hdr) != 0x02) /* Type 3 == version 0x02 */ { CodecEvents::decoder_alert_encapsulated(p, DECODE_ERSPAN_HDR_VERSION_MISMATCH, - pkt, len); - return; + raw_pkt, len); + return false; } -// PushLayer(PROTO_ERSPAN, p, pkt, hlen); -// payload_len = len - hlen; -// TODO: Is this the only next protocol which can be called? -// DecodeTransBridging(pkt + hlen, payload_len, p); + next_prot_id = ETHERTYPE_TRANS_ETHER_BRIDGING; + return true; +} - next_prot_id = GRE_TYPE_TRANS_BRIDGING; // huh? - p_hdr_len = hlen; - return true; +void Erspan3Codec::get_protocol_ids(std::vector& v) +{ + v.push_back(ETHERTYPE_ERSPAN_TYPE3); } +static Codec* ctor() +{ + return new Erspan3Codec(); +} + +static void dtor(Codec *cd) +{ + delete cd; +} + +static void sum() +{ +// sum_stats((PegCount*)&gdc, (PegCount*)&dc, array_size(dc_pegs)); +// memset(&dc, 0, sizeof(dc)); +} + +static void stats() +{ +// show_percent_stats((PegCount*)&gdc, dc_pegs, array_size(dc_pegs), +// "decoder"); +} + + -static const char* name = "erspan3_decode"; +static const char* name = "erspan3_codec"; -static const CodecApi erspan3_api = +static const CodecApi codec_api = { { PT_CODEC, name, CDAPI_PLUGIN_V0, 0 }, - {ETHERNET_TYPE_ERSPAN_TYPE3}, NULL, // pinit NULL, // pterm NULL, // tinit NULL, // tterm ctor, // ctor dtor, // dtor - NULL, - NULL + sum, // sum + stats // stats }; diff --git a/src/codecs/tmp/prot_erspan2.h b/src/codecs/tmp/prot_erspan2.h deleted file mode 100644 index 065a24d54..000000000 --- a/src/codecs/tmp/prot_erspan2.h +++ /dev/null @@ -1,33 +0,0 @@ -/* -** Copyright (C) 2002-2013 Sourcefire, Inc. -** Copyright (C) 1998-2002 Martin Roesch -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - - -#ifndef PROT_ERSPAN_TYPE2_H -#define PROT_ERSPAN_TYPE2_H - - -#define ETHERNET_TYPE_ERSPAN_TYPE2 0x88be - - -void DecodeERSPANType2(const uint8_t *, const uint32_t, Packet *); - - -#endif - diff --git a/src/codecs/tmp/prot_erspan3.h b/src/codecs/tmp/prot_erspan3.h deleted file mode 100644 index 120b610ae..000000000 --- a/src/codecs/tmp/prot_erspan3.h +++ /dev/null @@ -1,32 +0,0 @@ -/* -** Copyright (C) 2002-2013 Sourcefire, Inc. -** Copyright (C) 1998-2002 Martin Roesch -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - - -#ifndef PROT_ERSPAN_TYPE3_H -#define PROT_ERSPAN_TYPE3_H - - -#define ETHERNET_TYPE_ERSPAN_TYPE3 0x22eb - -void DecodeERSPANType3(const uint8_t *, const uint32_t, Packet *); - - -#endif - diff --git a/src/protocols/packet.h b/src/protocols/packet.h index 874778b40..e3f69ec24 100644 --- a/src/protocols/packet.h +++ b/src/protocols/packet.h @@ -516,23 +516,6 @@ typedef struct _WifiHdr #endif -typedef struct _ERSpanType2Hdr -{ - uint16_t ver_vlan; - uint16_t flags_spanId; - uint32_t pad; -} ERSpanType2Hdr; - -typedef struct _ERSpanType3Hdr -{ - uint16_t ver_vlan; - uint16_t flags_spanId; - uint32_t timestamp; - uint16_t pad0; - uint16_t pad1; - uint32_t pad2; - uint32_t pad3; -} ERSpanType3Hdr; #define ERSPAN_VERSION(x) ((ntohs(x->ver_vlan) & 0xf000) >> 12) #define ERSPAN_VLAN(x) (ntohs(x->ver_vlan) & 0x0fff)