From: Josh Date: Mon, 21 Jul 2014 20:26:12 +0000 (-0400) Subject: apdating codecs to pass regression tests. Fixing typos. X-Git-Tag: 3.0.0-233~1175^2~14^2~7 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=8279d4c0fe05efe1c856f6216ef18578936dde2b;p=thirdparty%2Fsnort3.git apdating codecs to pass regression tests. Fixing typos. --- diff --git a/cmake/includePredefinedPackages.cmake b/cmake/includePredefinedPackages.cmake index e238755ad..b6cd86185 100644 --- a/cmake/includePredefinedPackages.cmake +++ b/cmake/includePredefinedPackages.cmake @@ -14,3 +14,4 @@ find_package(DNET REQUIRED) # optional libraries find_package(Asciidoc QUIET) find_package(DBLATEX QUIET) +find_package(Ruby QUIET) diff --git a/src/codecs/ip/cd_auth.cc b/src/codecs/ip/cd_auth.cc index acb9215ff..c7aab26ce 100644 --- a/src/codecs/ip/cd_auth.cc +++ b/src/codecs/ip/cd_auth.cc @@ -45,7 +45,7 @@ public: virtual PROTO_ID get_proto_id() { return PROTO_AH; }; virtual void get_protocol_ids(std::vector& v); - virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, + virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); }; @@ -58,13 +58,13 @@ void AhCodec::get_protocol_ids(std::vector& v) v.push_back(IPPROTO_ID_AH); } -bool AhCodec::decode(const uint8_t *raw_pkt, const uint32_t len, +bool AhCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) { IP6Extension *ah = (IP6Extension *)raw_pkt; - if (len < ipv6::min_ext_len()) + if (raw_len < ipv6::min_ext_len()) { codec_events::decoder_event(p, DECODE_AUTH_HDR_TRUNC); return false; @@ -72,7 +72,7 @@ bool AhCodec::decode(const uint8_t *raw_pkt, const uint32_t len, lyr_len = sizeof(*ah) + (ah->ip6e_len << 2); - if (lyr_len > len) + if (lyr_len > raw_len) { codec_events::decoder_event(p, DECODE_AUTH_HDR_BAD_LEN); return false; diff --git a/src/codecs/ip/cd_dstopts.cc b/src/codecs/ip/cd_dstopts.cc index 266c90afd..3bd89338a 100644 --- a/src/codecs/ip/cd_dstopts.cc +++ b/src/codecs/ip/cd_dstopts.cc @@ -47,7 +47,7 @@ public: virtual void get_protocol_ids(std::vector& v); - virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, + virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); virtual bool update(Packet*, Layer*, uint32_t* len); @@ -64,7 +64,7 @@ struct IP6Dest } // anonymous namespace -bool Ipv6DSTOptsCodec::decode(const uint8_t *raw_pkt, const uint32_t len, +bool Ipv6DSTOptsCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) { const IP6Dest *dsthdr = reinterpret_cast(raw_pkt); @@ -74,7 +74,7 @@ bool Ipv6DSTOptsCodec::decode(const uint8_t *raw_pkt, const uint32_t len, ipv6_util::CheckIPv6ExtensionOrder(p); - if(len < sizeof(IP6Dest)) + if(raw_len < sizeof(IP6Dest)) { codec_events::decoder_event(p, DECODE_IPV6_TRUNCATED_EXT); return false; @@ -92,7 +92,7 @@ bool Ipv6DSTOptsCodec::decode(const uint8_t *raw_pkt, const uint32_t len, } lyr_len = sizeof(IP6Dest) + (dsthdr->ip6dest_len << 3); - if(lyr_len > len) + if(lyr_len > raw_len) { codec_events::decoder_event(p, DECODE_IPV6_TRUNCATED_EXT); return false; @@ -104,7 +104,7 @@ bool Ipv6DSTOptsCodec::decode(const uint8_t *raw_pkt, const uint32_t len, p->ip6_extension_count++; next_prot_id = dsthdr->ip6dest_nxt; - if ( ipv6_util::CheckIPV6HopOptions(raw_pkt, len, p)) + if ( ipv6_util::CheckIPV6HopOptions(raw_pkt, raw_len, p)) return true; return false; } diff --git a/src/codecs/ip/cd_esp.cc b/src/codecs/ip/cd_esp.cc index a887e27ef..26ed8db6f 100644 --- a/src/codecs/ip/cd_esp.cc +++ b/src/codecs/ip/cd_esp.cc @@ -43,7 +43,7 @@ public: virtual void get_protocol_ids(std::vector& v); - virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, + virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); }; @@ -75,13 +75,13 @@ void EspCodec::get_protocol_ids(std::vector& v) * This is more of a heuristic -- there is no ESP field that specifies * the encryption type (or lack thereof). * - * Arguments: pkt => ptr to the packet data - * len => length from here to the end of the packet - * p => ptr to the Packet struct being filled out + * Arguments: pkt => ptr to the packet data + * raw_len => length from here to the end of the packet + * p => ptr to the Packet struct being filled out * * Returns: void function */ -bool EspCodec::decode(const uint8_t *raw_pkt, const uint32_t len, +bool EspCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) { const uint8_t *esp_payload; @@ -93,15 +93,14 @@ bool EspCodec::decode(const uint8_t *raw_pkt, const uint32_t len, /* The ESP header contains a crypto Initialization Vector (IV) and a sequence number. Skip these. */ - if (len < (ESP_HEADER_LEN + ESP_AUTH_DATA_LEN + ESP_TRAILER_LEN)) + if (raw_len < (ESP_HEADER_LEN + ESP_AUTH_DATA_LEN + ESP_TRAILER_LEN)) { /* Truncated ESP traffic. Bail out here and inspect the rest as payload. */ codec_events::decoder_event(p, DECODE_ESP_HEADER_TRUNC); p->data = raw_pkt; - p->dsize = (uint16_t) len; + p->dsize = (uint16_t) raw_len; return false; } - esp_payload = raw_pkt + ESP_HEADER_LEN; /* The Authentication Data at the end of the packet is variable-length. RFC 2406 says that Encryption and Authentication algorithms MUST NOT @@ -109,37 +108,46 @@ bool EspCodec::decode(const uint8_t *raw_pkt, const uint32_t len, The mandatory algorithms for Authentication are HMAC-MD5-96 and HMAC-SHA-1-96, so we assume a 12-byte authentication data at the end. */ - lyr_len = (ESP_HEADER_LEN + ESP_AUTH_DATA_LEN + ESP_TRAILER_LEN); + uint32_t guessed_len = raw_len - (ESP_HEADER_LEN + ESP_AUTH_DATA_LEN + ESP_TRAILER_LEN); - pad_length = *(esp_payload + len - lyr_len); - next_prot_id = *(esp_payload + len + 1 - lyr_len); + lyr_len = ESP_HEADER_LEN; + esp_payload = raw_pkt + ESP_HEADER_LEN; + pad_length = *(esp_payload + guessed_len); + next_prot_id = *(esp_payload + guessed_len + 1); /* Adjust the packet length to account for the padding. If the padding length is too big, this is probably encrypted traffic. */ - if (pad_length < len) + if (pad_length < raw_len) { - lyr_len += (pad_length); + const_cast(raw_len) -= pad_length; } else { p->packet_flags |= PKT_TRUST; + lyr_len = ESP_HEADER_LEN; // we want data to begin at (pkt + ESP_HEADER_LEN) next_prot_id = FINISHED_DECODE; return true; } - // If we cant' decode the pakcer anymore, this is probably encrypted. - // set the data pointers and pretend this is an ip datagram. - if (!PacketManager::has_codec(next_prot_id)) + if (PacketManager::has_codec(next_prot_id)) { + /* Attempt to decode the inner payload. + There is a small chance that an encrypted next_header would become a + different valid next_header. The PKT_UNSURE_ENCAP flag tells the next + decoder stage to silently ignore invalid headers. */ p->packet_flags |= PKT_UNSURE_ENCAP; + const_cast(raw_len) -= (ESP_AUTH_DATA_LEN + ESP_TRAILER_LEN); + p->packet_flags |= PKT_ESP_LYR_PRESENT; } - else + else { + // If we cant' decode the packet anymore, this is probably encrypted. + // set the data pointers and pretend this is an ip datagram. p->packet_flags |= PKT_TRUST; p->data = esp_payload; - p->dsize = (u_short) len - lyr_len; + p->dsize = (u_short) raw_len - lyr_len; } return true; diff --git a/src/codecs/ip/cd_frag.cc b/src/codecs/ip/cd_frag.cc index d41c6ca21..682d38f5a 100644 --- a/src/codecs/ip/cd_frag.cc +++ b/src/codecs/ip/cd_frag.cc @@ -47,7 +47,7 @@ public: ~Ipv6FragCodec() {}; - virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, + virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); virtual void get_protocol_ids(std::vector&); @@ -58,7 +58,7 @@ public: } // namespace -bool Ipv6FragCodec::decode(const uint8_t *raw_pkt, const uint32_t len, +bool Ipv6FragCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) { const IP6Frag *ip6frag_hdr = reinterpret_cast(raw_pkt); @@ -66,7 +66,7 @@ bool Ipv6FragCodec::decode(const uint8_t *raw_pkt, const uint32_t len, fpEvalIpProtoOnlyRules(snort_conf->ip_proto_only_lists, p, IPPROTO_ID_FRAGMENT); ipv6_util::CheckIPv6ExtensionOrder(p); - if(len < ipv6::min_ext_len() ) + if(raw_len < ipv6::min_ext_len() ) { codec_events::decoder_event(p, DECODE_IPV6_TRUNCATED_EXT); return false; @@ -79,7 +79,7 @@ bool Ipv6FragCodec::decode(const uint8_t *raw_pkt, const uint32_t len, } // already checked for short pacekt above - if (len == sizeof(IP6Frag)) + if (raw_len == sizeof(IP6Frag)) { codec_events::decoder_event(p, DECODE_ZERO_LENGTH_FRAG); return false; @@ -114,7 +114,7 @@ bool Ipv6FragCodec::decode(const uint8_t *raw_pkt, const uint32_t len, ipv6_util::CheckIPv6ExtensionOrder(p); lyr_len = sizeof(IP6Frag); - p->ip_frag_len = (uint16_t)(len - lyr_len); + p->ip_frag_len = (uint16_t)(raw_len - lyr_len); if ( p->frag_flag && ((p->frag_offset > 0) || (ip6frag_hdr->ip6f_nxt != IPPROTO_UDP)) ) diff --git a/src/codecs/ip/cd_gre.cc b/src/codecs/ip/cd_gre.cc index 726b6cf46..0eb04559d 100644 --- a/src/codecs/ip/cd_gre.cc +++ b/src/codecs/ip/cd_gre.cc @@ -43,7 +43,7 @@ public: virtual PROTO_ID get_proto_id() { return PROTO_GRE; }; virtual void get_protocol_ids(std::vector& v); - virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, + virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); @@ -93,13 +93,13 @@ void GreCodec::get_protocol_ids(std::vector& v) * * Notes: see RFCs 1701, 2784 and 2637 */ -bool GreCodec::decode(const uint8_t *raw_pkt, const uint32_t len, +bool GreCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) { - if (len < GRE_HEADER_LEN) + if (raw_len < GRE_HEADER_LEN) { codec_events::decoder_alert_encapsulated(p, DECODE_GRE_DGRAM_LT_GREHDR, - raw_pkt, len); + raw_pkt, raw_len); return false; } @@ -108,7 +108,7 @@ bool GreCodec::decode(const uint8_t *raw_pkt, const uint32_t len, /* discard packet - multiple GRE encapsulation */ /* not sure if this is ever used but I am assuming it is not */ codec_events::decoder_alert_encapsulated(p, DECODE_IP_MULTIPLE_ENCAPSULATION, - raw_pkt, len); + raw_pkt, raw_len); return false; } @@ -127,7 +127,7 @@ bool GreCodec::decode(const uint8_t *raw_pkt, const uint32_t len, if (GRE_RECUR(greh) || GRE_FLAGS(greh)) { codec_events::decoder_alert_encapsulated(p, DECODE_GRE_INVALID_HEADER, - raw_pkt, len); + raw_pkt, raw_len); return false; } @@ -154,7 +154,7 @@ bool GreCodec::decode(const uint8_t *raw_pkt, const uint32_t len, while (1) { lyr_len += GRE_SRE_HEADER_LEN; - if (lyr_len > len) + if (lyr_len > raw_len) break; sre_addrfamily = ntohs(*((uint16_t *)sre_ptr)); @@ -182,7 +182,7 @@ bool GreCodec::decode(const uint8_t *raw_pkt, const uint32_t len, GRE_RECUR(greh) || GRE_V1_FLAGS(greh)) { codec_events::decoder_alert_encapsulated(p, DECODE_GRE_V1_INVALID_HEADER, - raw_pkt, len); + raw_pkt, raw_len); return false; } @@ -190,7 +190,7 @@ bool GreCodec::decode(const uint8_t *raw_pkt, const uint32_t len, if (GRE_PROTO(greh) != ETHERTYPE_PPP) { codec_events::decoder_alert_encapsulated(p, DECODE_GRE_V1_INVALID_HEADER, - raw_pkt, len); + raw_pkt, raw_len); return false; } @@ -198,7 +198,7 @@ bool GreCodec::decode(const uint8_t *raw_pkt, const uint32_t len, if (!(GRE_KEY(greh))) { codec_events::decoder_alert_encapsulated(p, DECODE_GRE_V1_INVALID_HEADER, - raw_pkt, len); + raw_pkt, raw_len); return false; } @@ -214,14 +214,14 @@ bool GreCodec::decode(const uint8_t *raw_pkt, const uint32_t len, default: codec_events::decoder_alert_encapsulated(p, DECODE_GRE_INVALID_VERSION, - raw_pkt, len); + raw_pkt, raw_len); return false; } - if (lyr_len > len) + if (lyr_len > raw_len) { codec_events::decoder_alert_encapsulated(p, DECODE_GRE_DGRAM_LT_GREHDR, - raw_pkt, len); + raw_pkt, raw_len); return false; } diff --git a/src/codecs/ip/cd_hopopts.cc b/src/codecs/ip/cd_hopopts.cc index 9158a4f86..6a13f006b 100644 --- a/src/codecs/ip/cd_hopopts.cc +++ b/src/codecs/ip/cd_hopopts.cc @@ -45,7 +45,7 @@ public: ~Ipv6HopOptsCodec() {}; virtual void get_protocol_ids(std::vector& v); - virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, + virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); virtual bool update(Packet*, Layer*, uint32_t* len); }; @@ -67,13 +67,13 @@ struct IP6HopByHop * Class functions */ -bool Ipv6HopOptsCodec::decode(const uint8_t *raw_pkt, const uint32_t len, +bool Ipv6HopOptsCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) { const IP6HopByHop *hbh_hdr = reinterpret_cast(raw_pkt); - if (len < sizeof(IP6HopByHop)) + if (raw_len < sizeof(IP6HopByHop)) { codec_events::decoder_event(p, DECODE_IPV6_TRUNCATED_EXT); return false; @@ -92,7 +92,7 @@ bool Ipv6HopOptsCodec::decode(const uint8_t *raw_pkt, const uint32_t len, lyr_len = sizeof(IP6HopByHop) + (hbh_hdr->ip6hbh_len << 3); next_prot_id = (uint16_t) hbh_hdr->ip6hbh_nxt; - if(lyr_len > len) + if(lyr_len > raw_len) { codec_events::decoder_event(p, DECODE_IPV6_TRUNCATED_EXT); return false; @@ -103,7 +103,7 @@ bool Ipv6HopOptsCodec::decode(const uint8_t *raw_pkt, const uint32_t len, p->ip6_extension_count++; - if ( ipv6_util::CheckIPV6HopOptions(raw_pkt, len, p)) + if ( ipv6_util::CheckIPV6HopOptions(raw_pkt, raw_len, p)) return true; return false; } diff --git a/src/codecs/ip/cd_icmp4.cc b/src/codecs/ip/cd_icmp4.cc index aa4e22176..7aec1caae 100644 --- a/src/codecs/ip/cd_icmp4.cc +++ b/src/codecs/ip/cd_icmp4.cc @@ -52,7 +52,7 @@ public: virtual PROTO_ID get_proto_id() { return PROTO_ICMP4; }; virtual void get_protocol_ids(std::vector&); - virtual bool decode(const uint8_t* raw_packet, const uint32_t raw_len, + virtual bool decode(const uint8_t* raw_packet, const uint32_t& raw_len, Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id); virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in); virtual bool update(Packet*, Layer*, uint32_t* len); @@ -90,7 +90,7 @@ void Icmp4Codec::get_protocol_ids(std::vector &v) * * Returns: void function */ -bool Icmp4Codec::decode(const uint8_t* raw_pkt, const uint32_t raw_len, +bool Icmp4Codec::decode(const uint8_t* raw_pkt, const uint32_t& raw_len, Packet *p, uint16_t &lyr_len, uint16_t& /*next_prot_id*/) { if(raw_len < icmp4::hdr_len()) diff --git a/src/codecs/ip/cd_icmp6.cc b/src/codecs/ip/cd_icmp6.cc index 39e8b4c06..ed13f121e 100644 --- a/src/codecs/ip/cd_icmp6.cc +++ b/src/codecs/ip/cd_icmp6.cc @@ -49,7 +49,7 @@ public: virtual PROTO_ID get_proto_id() { return PROTO_ICMP6; }; virtual void get_protocol_ids(std::vector& v); - virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, + virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in); virtual bool update(Packet*, Layer*, uint32_t* len); @@ -74,13 +74,13 @@ void Icmp6Codec::get_protocol_ids(std::vector& v) // decode.c::ICMP6 //-------------------------------------------------------------------- -bool Icmp6Codec::decode(const uint8_t* raw_pkt, const uint32_t len, +bool Icmp6Codec::decode(const uint8_t* raw_pkt, const uint32_t& raw_len, Packet* p, uint16_t &lyr_len, uint16_t & /* next_prot_id */) { - if(len < icmp6::hdr_min_len()) + if(raw_len < icmp6::hdr_min_len()) { DEBUG_WRAP(DebugMessage(DEBUG_DECODE, - "WARNING: Truncated ICMP6 header (%d bytes).\n", len);); + "WARNING: Truncated ICMP6 header (%d bytes).\n", raw_len);); codec_events::decoder_event(p, DECODE_ICMP6_HDR_TRUNC); return false; @@ -97,7 +97,7 @@ bool Icmp6Codec::decode(const uint8_t* raw_pkt, const uint32_t len, if(IS_IP4(p)) { - csum = checksum::cksum_add((uint16_t *)(p->icmp6h), len); + csum = checksum::cksum_add((uint16_t *)(p->icmp6h), raw_len); } /* IPv6 traffic */ else @@ -107,9 +107,9 @@ bool Icmp6Codec::decode(const uint8_t* raw_pkt, const uint32_t len, COPY4(ph6.dip, p->ip6h->ip_dst.ip32); ph6.zero = 0; ph6.protocol = GET_IPH_PROTO(p); - ph6.len = htons((u_short)len); + ph6.len = htons((u_short)raw_len); - csum = checksum::icmp_cksum((uint16_t *)(p->icmp6h), len, &ph6); + csum = checksum::icmp_cksum((uint16_t *)(p->icmp6h), raw_len, &ph6); } if(csum) { @@ -123,7 +123,7 @@ bool Icmp6Codec::decode(const uint8_t* raw_pkt, const uint32_t len, } } - p->dsize = (u_short)(len - icmp6::hdr_min_len()); + p->dsize = (u_short)(raw_len - icmp6::hdr_min_len()); p->data = raw_pkt + icmp6::hdr_min_len(); DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "ICMP type: %d code: %d\n", @@ -147,7 +147,7 @@ bool Icmp6Codec::decode(const uint8_t* raw_pkt, const uint32_t len, else { DEBUG_WRAP(DebugMessage(DEBUG_DECODE, - "WARNING: Truncated ICMP Echo header (%d bytes).\n", len);); + "WARNING: Truncated ICMP Echo header (%d bytes).\n", raw_len);); codec_events::decoder_event(p, DECODE_ICMP_DGRAM_LT_ICMPHDR); @@ -175,7 +175,7 @@ bool Icmp6Codec::decode(const uint8_t* raw_pkt, const uint32_t len, else { DEBUG_WRAP(DebugMessage(DEBUG_DECODE, - "WARNING: Truncated ICMP header (%d bytes).\n", len);); + "WARNING: Truncated ICMP header (%d bytes).\n", raw_len);); codec_events::decoder_event(p, DECODE_ICMP_DGRAM_LT_ICMPHDR); @@ -211,7 +211,7 @@ bool Icmp6Codec::decode(const uint8_t* raw_pkt, const uint32_t len, else { DEBUG_WRAP(DebugMessage(DEBUG_DECODE, - "WARNING: Truncated ICMP header (%d bytes).\n", len);); + "WARNING: Truncated ICMP header (%d bytes).\n", raw_len);); codec_events::decoder_event(p, DECODE_ICMP_DGRAM_LT_ICMPHDR); @@ -238,7 +238,7 @@ bool Icmp6Codec::decode(const uint8_t* raw_pkt, const uint32_t len, else { DEBUG_WRAP(DebugMessage(DEBUG_DECODE, - "WARNING: Truncated ICMP header (%d bytes).\n", len);); + "WARNING: Truncated ICMP header (%d bytes).\n", raw_len);); codec_events::decoder_event(p, DECODE_ICMP_DGRAM_LT_ICMPHDR); @@ -265,7 +265,7 @@ bool Icmp6Codec::decode(const uint8_t* raw_pkt, const uint32_t len, else { DEBUG_WRAP(DebugMessage(DEBUG_DECODE, - "WARNING: Truncated ICMP header (%d bytes).\n", len);); + "WARNING: Truncated ICMP header (%d bytes).\n", raw_len);); codec_events::decoder_event(p, DECODE_ICMP_DGRAM_LT_ICMPHDR); @@ -292,7 +292,7 @@ bool Icmp6Codec::decode(const uint8_t* raw_pkt, const uint32_t len, else { DEBUG_WRAP(DebugMessage(DEBUG_DECODE, - "WARNING: Truncated ICMP header (%d bytes).\n", len);); + "WARNING: Truncated ICMP header (%d bytes).\n", raw_len);); codec_events::decoder_event(p, DECODE_ICMP_DGRAM_LT_ICMPHDR); diff --git a/src/codecs/ip/cd_igmp.cc b/src/codecs/ip/cd_igmp.cc index b03d20498..1d2b2ccbd 100644 --- a/src/codecs/ip/cd_igmp.cc +++ b/src/codecs/ip/cd_igmp.cc @@ -39,7 +39,7 @@ public: ~IgmpCodec() {}; - virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, + virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); virtual void get_protocol_ids(std::vector&); @@ -54,12 +54,12 @@ public: -bool IgmpCodec::decode(const uint8_t *raw_pkt, const uint32_t len, +bool IgmpCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *p, uint16_t& /*lyr_len*/, uint16_t& /*next_prot_id*/) { int i, alert = 0; - if (len >= 1 && raw_pkt[0] == 0x11) + if (raw_len >= 1 && raw_pkt[0] == 0x11) { if (p->ip_options_data != NULL) { if (p->ip_options_len >= 2) { diff --git a/src/codecs/ip/cd_ipv4.cc b/src/codecs/ip/cd_ipv4.cc index f935ed9a6..03122f1eb 100644 --- a/src/codecs/ip/cd_ipv4.cc +++ b/src/codecs/ip/cd_ipv4.cc @@ -59,7 +59,7 @@ public: virtual PROTO_ID get_proto_id() { return PROTO_IP4; }; virtual void get_protocol_ids(std::vector& v); - virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, + virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in); virtual bool update(Packet*, Layer*, uint32_t* len); @@ -160,19 +160,17 @@ void Ipv4Codec::get_protocol_ids(std::vector& v) * * Returns: void function */ -bool Ipv4Codec::decode(const uint8_t *raw_pkt, const uint32_t len, +bool Ipv4Codec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) { uint32_t ip_len; /* length from the start of the ip hdr to the pkt end */ uint16_t hlen; /* ip header length */ - DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Packet!\n");); - /* do a little validation */ - if(len < ipv4::hdr_len()) + if(raw_len < ipv4::hdr_len()) { DEBUG_WRAP(DebugMessage(DEBUG_DECODE, - "WARNING: Truncated IP4 header (%d bytes).\n", len);); + "WARNING: Truncated IP4 header (%d bytes).\n", raw_len);); if ((p->packet_flags & PKT_UNSURE_ENCAP) == 0) codec_events::decoder_event(p, DECODE_IP4_HDR_TRUNC); @@ -187,7 +185,7 @@ bool Ipv4Codec::decode(const uint8_t *raw_pkt, const uint32_t len, if (p->encapsulated) { codec_events::decoder_alert_encapsulated(p, DECODE_IP_MULTIPLE_ENCAPSULATION, - raw_pkt, len); + raw_pkt, raw_len); return false; } @@ -236,12 +234,12 @@ bool Ipv4Codec::decode(const uint8_t *raw_pkt, const uint32_t len, return false; } - if (ip_len > len) + if (ip_len > raw_len) { DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "IP Len field is %d bytes bigger than captured length.\n" " (ip.len: %lu, cap.len: %lu)\n", - ip_len - len, ip_len, len);); + ip_len - raw_len, ip_len, raw_len);); codec_events::decoder_event(p, DECODE_IPV4_DGRAM_GT_CAPLEN); @@ -323,9 +321,9 @@ bool Ipv4Codec::decode(const uint8_t *raw_pkt, const uint32_t len, /* set the real IP length for logging */ p->actual_ip_len = (uint16_t) ip_len; - p->packet_flags |= PKT_NEW_IP_LEN; /* set the remaining packet length */ + const_cast(raw_len) = ip_len; ip_len -= hlen; /* check for fragmented packets */ diff --git a/src/codecs/ip/cd_ipv6.cc b/src/codecs/ip/cd_ipv6.cc index f845b0783..af363e564 100644 --- a/src/codecs/ip/cd_ipv6.cc +++ b/src/codecs/ip/cd_ipv6.cc @@ -48,7 +48,7 @@ public: virtual PROTO_ID get_proto_id() { return PROTO_IP6; }; virtual void get_protocol_ids(std::vector& v); - virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, + virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in); virtual bool update(Packet*, Layer*, uint32_t* len); @@ -130,16 +130,15 @@ void Ipv6Codec::get_protocol_ids(std::vector& v) } -bool Ipv6Codec::decode(const uint8_t *raw_pkt, const uint32_t len, +bool Ipv6Codec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) { ipv6::IP6RawHdr *hdr; uint32_t payload_len; - hdr = reinterpret_cast(const_cast(raw_pkt)); - if(len < ipv6::hdr_len()) + if(raw_len < ipv6::hdr_len()) { if ((p->packet_flags & PKT_UNSURE_ENCAP) == 0) codec_events::decoder_event(p, DECODE_IPV6_TRUNCATED); @@ -169,7 +168,7 @@ bool Ipv6Codec::decode(const uint8_t *raw_pkt, const uint32_t len, { codec_events::decoder_alert_encapsulated(p, DECODE_IP_MULTIPLE_ENCAPSULATION, - raw_pkt, len); + raw_pkt, raw_len); goto decodeipv6_fail; } else @@ -183,9 +182,9 @@ bool Ipv6Codec::decode(const uint8_t *raw_pkt, const uint32_t len, payload_len = ntohs(hdr->ip6plen) + ipv6::hdr_len(); - if(payload_len != len) + if(payload_len != raw_len) { - if (payload_len > len) + if (payload_len > raw_len) { if ((p->packet_flags & PKT_UNSURE_ENCAP) == 0) codec_events::decoder_event(p, DECODE_IPV6_DGRAM_GT_CAPLEN); @@ -228,11 +227,10 @@ bool Ipv6Codec::decode(const uint8_t *raw_pkt, const uint32_t len, p->actual_ip_len = ntohs(p->ip6h->len); p->ip_data = raw_pkt + ipv6::hdr_len(); p->ip_dsize = ntohs(p->ip6h->len); - p->packet_flags |= PKT_NEW_IP_LEN; p->proto_bits |= PROTO_BIT__IP; + // extra ipv6 header will be removed in PacketManager + const_cast(raw_len) = p->actual_ip_len + ipv6::hdr_len(); - - lyr_len = sizeof(*hdr); IPV6MiscTests(p); next_prot_id = GET_IPH_PROTO(p); diff --git a/src/codecs/ip/cd_mobility.cc b/src/codecs/ip/cd_mobility.cc index bf2a8442a..ea5a2f3c0 100644 --- a/src/codecs/ip/cd_mobility.cc +++ b/src/codecs/ip/cd_mobility.cc @@ -42,7 +42,7 @@ public: virtual void get_protocol_ids(std::vector&); - virtual bool decode(const uint8_t *raw_pkt, const uint32_t raw_len, + virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); }; @@ -57,7 +57,7 @@ void MobilityCodec::get_protocol_ids(std::vector& v) v.push_back(IPPROTO_ID_MOBILITY); } -bool MobilityCodec::decode(const uint8_t* raw_pkt, const uint32_t raw_len, +bool MobilityCodec::decode(const uint8_t* raw_pkt, const uint32_t& raw_len, Packet* p, uint16_t& /*lyr_len*/, uint16_t& /*next_prot_id*/) { codec_events::decoder_event(p, DECODE_IP_BAD_PROTO); diff --git a/src/codecs/ip/cd_no_next.cc b/src/codecs/ip/cd_no_next.cc index 4cb14d07e..9172627e0 100644 --- a/src/codecs/ip/cd_no_next.cc +++ b/src/codecs/ip/cd_no_next.cc @@ -46,7 +46,7 @@ public: ~Ipv6NoNextCodec() {}; - virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, + virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); virtual void get_protocol_ids(std::vector&); }; @@ -55,7 +55,7 @@ public: } // namespace -bool Ipv6NoNextCodec::decode(const uint8_t* /*raw_pkt*/, const uint32_t /*len*/, +bool Ipv6NoNextCodec::decode(const uint8_t* /*raw_pkt*/, const uint32_t& /*raw_len*/, Packet *p, uint16_t& lyr_len, uint16_t& /*next_prot_id*/) { /* See if there are any ip_proto only rules that match */ diff --git a/src/codecs/ip/cd_pgm.cc b/src/codecs/ip/cd_pgm.cc index dc5e6f01e..ea3d9d372 100644 --- a/src/codecs/ip/cd_pgm.cc +++ b/src/codecs/ip/cd_pgm.cc @@ -40,7 +40,7 @@ public: ~PgmCodec() {}; - virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, + virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); virtual void get_protocol_ids(std::vector&); @@ -141,7 +141,7 @@ static inline int pgm_nak_detect (uint8_t *data, uint16_t length) { // private functions //------------------------------------------------------------------------- -bool PgmCodec::decode(const uint8_t* /*raw_pkt*/, const uint32_t /*len*/, +bool PgmCodec::decode(const uint8_t* /*raw_pkt*/, const uint32_t& /*raw_len*/, Packet *p, uint16_t& /*lyr_len*/, uint16_t& /*next_prot_id*/) { if ( pgm_nak_detect((uint8_t *)p->data, p->dsize) == PGM_NAK_VULN ) diff --git a/src/codecs/ip/cd_routing.cc b/src/codecs/ip/cd_routing.cc index 24d884818..a7625d5f0 100644 --- a/src/codecs/ip/cd_routing.cc +++ b/src/codecs/ip/cd_routing.cc @@ -46,7 +46,7 @@ public: ~Ipv6RoutingCodec() {}; - virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, + virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); virtual void get_protocol_ids(std::vector&); @@ -78,7 +78,7 @@ struct IP6Route0 } // namespace -bool Ipv6RoutingCodec::decode(const uint8_t *raw_pkt, const uint32_t len, +bool Ipv6RoutingCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) { const IP6Route *rte = reinterpret_cast(raw_pkt); @@ -87,7 +87,7 @@ bool Ipv6RoutingCodec::decode(const uint8_t *raw_pkt, const uint32_t len, ipv6_util::CheckIPv6ExtensionOrder(p); - if(len < ipv6::min_ext_len()) + if(raw_len < ipv6::min_ext_len()) { codec_events::decoder_event(p, DECODE_IPV6_TRUNCATED_EXT); return false; @@ -99,7 +99,7 @@ bool Ipv6RoutingCodec::decode(const uint8_t *raw_pkt, const uint32_t len, return false; } - if (len < sizeof(IP6Route)) + if (raw_len < sizeof(IP6Route)) { codec_events::decoder_event(p, DECODE_IPV6_TRUNCATED_EXT); return false; @@ -121,7 +121,7 @@ bool Ipv6RoutingCodec::decode(const uint8_t *raw_pkt, const uint32_t len, } lyr_len = ipv6::min_ext_len() + (rte->ip6rte_len << 3); - if(lyr_len > len) + if(lyr_len > raw_len) { codec_events::decoder_event(p, DECODE_IPV6_TRUNCATED_EXT); return false; diff --git a/src/codecs/ip/cd_sun_nd.cc b/src/codecs/ip/cd_sun_nd.cc index 1e9570698..35c0d9ccc 100644 --- a/src/codecs/ip/cd_sun_nd.cc +++ b/src/codecs/ip/cd_sun_nd.cc @@ -42,7 +42,7 @@ public: virtual void get_protocol_ids(std::vector&); - virtual bool decode(const uint8_t *raw_pkt, const uint32_t raw_len, + virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); }; @@ -57,7 +57,7 @@ void SunNdCodec::get_protocol_ids(std::vector& v) v.push_back(IPPROTO_ID_SUN_ND); } -bool SunNdCodec::decode(const uint8_t* raw_pkt, const uint32_t raw_len, +bool SunNdCodec::decode(const uint8_t* raw_pkt, const uint32_t& raw_len, Packet* p, uint16_t& /*lyr_len*/, uint16_t& /*next_prot_id*/) { codec_events::decoder_event(p, DECODE_IP_BAD_PROTO); diff --git a/src/codecs/ip/cd_swipe.cc b/src/codecs/ip/cd_swipe.cc index bf06ba673..763b7b67a 100644 --- a/src/codecs/ip/cd_swipe.cc +++ b/src/codecs/ip/cd_swipe.cc @@ -40,7 +40,7 @@ public: virtual ~SwipeCodec(){}; virtual void get_protocol_ids(std::vector& v); - virtual bool decode(const uint8_t* raw_packet, const uint32_t raw_len, + virtual bool decode(const uint8_t* raw_packet, const uint32_t& raw_len, Packet *p, uint16_t &lyr_len, uint16_t &); }; } // namespace @@ -53,7 +53,7 @@ void SwipeCodec::get_protocol_ids(std::vector &proto_ids) } -bool SwipeCodec::decode(const uint8_t* /*raw_packet*/, const uint32_t /*raw_len*/, +bool SwipeCodec::decode(const uint8_t* /*raw_packet*/, const uint32_t& /*raw_len*/, Packet *p, uint16_t& /*lyr_len*/, uint16_t& /*next_prot_id*/) { // currently unsupported diff --git a/src/codecs/ip/cd_tcp.cc b/src/codecs/ip/cd_tcp.cc index c2fd3dea4..82220ed01 100644 --- a/src/codecs/ip/cd_tcp.cc +++ b/src/codecs/ip/cd_tcp.cc @@ -62,7 +62,7 @@ public: virtual PROTO_ID get_proto_id() { return PROTO_TCP; }; virtual void get_protocol_ids(std::vector& v); - virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, + virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *, uint16_t &lyr_len, uint16_t &); virtual bool encode(EncState*, Buffer* out, const uint8_t *raw_in); virtual bool update(Packet*, Layer*, uint32_t* len); @@ -108,13 +108,13 @@ void TcpCodec::get_protocol_ids(std::vector& v) * * Returns: void function */ -bool TcpCodec::decode(const uint8_t *raw_pkt, const uint32_t len, +bool TcpCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *p, uint16_t &lyr_len, uint16_t& /*next_prot_id*/) { - if(len < tcp::hdr_len()) + if(raw_len < tcp::hdr_len()) { DEBUG_WRAP(DebugMessage(DEBUG_DECODE, - "TCP packet (len = %d) cannot contain " "20 byte header\n", len);); + "TCP packet (len = %d) cannot contain " "20 byte header\n", raw_len);); codec_events::decoder_event(p, DECODE_TCP_DGRAM_LT_TCPHDR); @@ -129,7 +129,7 @@ bool TcpCodec::decode(const uint8_t *raw_pkt, const uint32_t len, lyr_len = TCP_OFFSET(p->tcph) << 2; DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "TCP th_off is %d, passed len is %lu\n", - TCP_OFFSET(p->tcph), (unsigned long)len);); + TCP_OFFSET(p->tcph), (unsigned long)raw_len);); if(lyr_len < tcp::hdr_len()) { @@ -143,11 +143,11 @@ bool TcpCodec::decode(const uint8_t *raw_pkt, const uint32_t len, return false; } - if(lyr_len > len) + if(lyr_len > raw_len) { DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "TCP Data Offset(%d) < longer than payload(%d)!\n", - TCP_OFFSET(p->tcph) << 2, len);); + TCP_OFFSET(p->tcph) << 2, raw_len);); codec_events::decoder_event(p, DECODE_TCP_LARGE_OFFSET); @@ -169,12 +169,12 @@ bool TcpCodec::decode(const uint8_t *raw_pkt, const uint32_t len, /* setup the pseudo header for checksum calculation */ ph.zero = 0; ph.protocol = GET_IPH_PROTO(p); - ph.len = htons((uint16_t)len); + ph.len = htons((uint16_t)raw_len); /* if we're being "stateless" we probably don't care about the TCP * checksum, but it's not bad to keep around for shits and giggles */ /* calculate the checksum */ - csum = checksum::tcp_cksum((uint16_t *)(p->tcph), len, &ph); + csum = checksum::tcp_cksum((uint16_t *)(p->tcph), raw_len, &ph); } /* IPv6 traffic */ @@ -185,10 +185,10 @@ bool TcpCodec::decode(const uint8_t *raw_pkt, const uint32_t len, COPY4(ph6.dip, p->ip6h->ip_dst.ip32); ph6.zero = 0; ph6.protocol = GET_IPH_PROTO(p); - ph6.len = htons((uint16_t)len); + ph6.len = htons((uint16_t)raw_len); - csum = checksum::tcp_cksum((uint16_t *)(p->tcph), len, &ph6); + csum = checksum::tcp_cksum((uint16_t *)(p->tcph), raw_len, &ph6); } if(csum) @@ -290,9 +290,9 @@ bool TcpCodec::decode(const uint8_t *raw_pkt, const uint32_t len, /* set the data pointer and size */ p->data = (uint8_t *) (raw_pkt + lyr_len); - if(lyr_len < len) + if(lyr_len < raw_len) { - p->dsize = (uint16_t)(len - lyr_len); + p->dsize = (uint16_t)(raw_len - lyr_len); } else { diff --git a/src/codecs/ip/cd_udp.cc b/src/codecs/ip/cd_udp.cc index a2f18695b..df54682c6 100644 --- a/src/codecs/ip/cd_udp.cc +++ b/src/codecs/ip/cd_udp.cc @@ -59,7 +59,7 @@ public: virtual PROTO_ID get_proto_id() { return PROTO_UDP; }; virtual void get_protocol_ids(std::vector& v); - virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, + virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); virtual bool encode(EncState*, Buffer* out, const uint8_t *raw_in); @@ -86,7 +86,7 @@ void UdpCodec::get_protocol_ids(std::vector& v) } -bool UdpCodec::decode(const uint8_t *raw_pkt, const uint32_t len, +bool UdpCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) { uint16_t uhlen; @@ -95,10 +95,10 @@ bool UdpCodec::decode(const uint8_t *raw_pkt, const uint32_t len, if (p->proto_bits & (PROTO_BIT__TEREDO | PROTO_BIT__GTP)) p->outer_udph = p->udph; - if(len < sizeof(udp::UDPHdr)) + if(raw_len < sizeof(udp::UDPHdr)) { DEBUG_WRAP(DebugMessage(DEBUG_DECODE, - "Truncated UDP header (%d bytes)\n", len);); + "Truncated UDP header (%d bytes)\n", raw_len);); codec_events::decoder_event(p, DECODE_UDP_DGRAM_LT_UDPHDR); @@ -131,7 +131,7 @@ bool UdpCodec::decode(const uint8_t *raw_pkt, const uint32_t len, fragmented_udp_flag = 1; } - /* verify that the header len is a valid value */ + /* verify that the header raw_len is a valid value */ if(uhlen < UDP_HEADER_LEN) { codec_events::decoder_event(p, DECODE_UDP_DGRAM_INVALID_LENGTH); @@ -141,14 +141,14 @@ bool UdpCodec::decode(const uint8_t *raw_pkt, const uint32_t len, } /* make sure there are enough bytes as designated by length field */ - if(uhlen > len) + if(uhlen > raw_len) { codec_events::decoder_event(p, DECODE_UDP_DGRAM_SHORT_PACKET); PopUdp(p); return false; } - else if(uhlen < len) + else if(uhlen < raw_len) { codec_events::decoder_event(p, DECODE_UDP_DGRAM_LONG_PACKET); @@ -201,7 +201,7 @@ bool UdpCodec::decode(const uint8_t *raw_pkt, const uint32_t len, COPY4(ph6.dip, p->ip6h->ip_dst.ip32); ph6.zero = 0; ph6.protocol = GET_IPH_PROTO(p); - ph6.len = htons((u_short)len); + ph6.len = htons((u_short)raw_len); csum = checksum::udp_cksum((uint16_t *)(p->udph), uhlen, &ph6); } diff --git a/src/codecs/link/cd_arp.cc b/src/codecs/link/cd_arp.cc index 30475019d..d5567c10f 100644 --- a/src/codecs/link/cd_arp.cc +++ b/src/codecs/link/cd_arp.cc @@ -43,7 +43,7 @@ public: virtual PROTO_ID get_proto_id() { return PROTO_ARP; }; virtual void get_protocol_ids(std::vector& v); - virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, + virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *, uint16_t &lyr_len, uint16_t &); }; @@ -75,10 +75,10 @@ void ArpCodec::get_protocol_ids(std::vector& v) * * Returns: void function */ -bool ArpCodec::decode(const uint8_t* /*raw_pkt*/, const uint32_t len, +bool ArpCodec::decode(const uint8_t* /*raw_pkt*/, const uint32_t& raw_len, Packet *p, uint16_t &lyr_len, uint16_t& /* next_prot_id */) { - if(len < sizeof(EtherARP)) + if(raw_len < sizeof(EtherARP)) { codec_events::decoder_event(p, DECODE_ARP_TRUNCATED); return false; diff --git a/src/codecs/link/cd_eapol.cc b/src/codecs/link/cd_eapol.cc index 622233421..d117ecb91 100644 --- a/src/codecs/link/cd_eapol.cc +++ b/src/codecs/link/cd_eapol.cc @@ -41,7 +41,7 @@ public: ~EapolCodec() {}; - virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, + virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); virtual void get_protocol_ids(std::vector&); @@ -107,22 +107,22 @@ void DecodeEapolKey(const uint8_t* /*pkt*/, uint32_t len, Packet * p) ************** main codec functions ************ *************************************************/ -bool EapolCodec::decode(const uint8_t *raw_pkt, const uint32_t len, +bool EapolCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *p, uint16_t & /*lyr_len*/, uint16_t &/*next_prot_id */) { const eapol::EtherEapol* eplh = reinterpret_cast(raw_pkt); - if(len < sizeof(eapol::EtherEapol)) + if(raw_len < sizeof(eapol::EtherEapol)) { codec_events::decoder_event(p, DECODE_EAPOL_TRUNCATED); return false; } if (eplh->eaptype == EAPOL_TYPE_EAP) { - DecodeEAP(raw_pkt + sizeof(eapol::EtherEapol), len - sizeof(eapol::EtherEapol), p); + DecodeEAP(raw_pkt + sizeof(eapol::EtherEapol), raw_len - sizeof(eapol::EtherEapol), p); } else if(eplh->eaptype == EAPOL_TYPE_KEY) { - DecodeEapolKey(raw_pkt + sizeof(eapol::EtherEapol), len - sizeof(eapol::EtherEapol), p); + DecodeEapolKey(raw_pkt + sizeof(eapol::EtherEapol), raw_len - sizeof(eapol::EtherEapol), p); } return true; diff --git a/src/codecs/link/cd_erspan2.cc b/src/codecs/link/cd_erspan2.cc index 161fb97b3..1acea62ba 100644 --- a/src/codecs/link/cd_erspan2.cc +++ b/src/codecs/link/cd_erspan2.cc @@ -37,7 +37,7 @@ public: virtual PROTO_ID get_proto_id() { return PROTO_ERSPAN; }; virtual void get_protocol_ids(std::vector& v); - virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, + virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); }; @@ -78,15 +78,16 @@ void Erspan2Codec::get_protocol_ids(std::vector& v) * Returns: void function * */ -bool Erspan2Codec::decode(const uint8_t *raw_pkt, const uint32_t len, +bool Erspan2Codec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) { lyr_len = sizeof(ERSpanType2Hdr); ERSpanType2Hdr *erSpan2Hdr = (ERSpanType2Hdr *)raw_pkt; - if (len < sizeof(ERSpanType2Hdr)) + if (raw_len < sizeof(ERSpanType2Hdr)) { - codec_events::decoder_alert_encapsulated(p, DECODE_ERSPAN2_DGRAM_LT_HDR, raw_pkt, len); + codec_events::decoder_alert_encapsulated(p, DECODE_ERSPAN2_DGRAM_LT_HDR, + raw_pkt, raw_len); return false; } @@ -95,7 +96,7 @@ bool Erspan2Codec::decode(const uint8_t *raw_pkt, const uint32_t len, /* discard packet - multiple encapsulation */ /* not sure if this is ever used but I am assuming it is not */ codec_events::decoder_alert_encapsulated(p, DECODE_IP_MULTIPLE_ENCAPSULATION, - raw_pkt, len); + raw_pkt, raw_len); return false; } @@ -104,7 +105,7 @@ bool Erspan2Codec::decode(const uint8_t *raw_pkt, const uint32_t len, if (erspan_version(erSpan2Hdr) != 0x01) /* Type 2 == version 0x01 */ { codec_events::decoder_alert_encapsulated(p, DECODE_ERSPAN_HDR_VERSION_MISMATCH, - raw_pkt, len); + raw_pkt, raw_len); return false; } diff --git a/src/codecs/link/cd_erspan3.cc b/src/codecs/link/cd_erspan3.cc index 45715d175..369ca523b 100644 --- a/src/codecs/link/cd_erspan3.cc +++ b/src/codecs/link/cd_erspan3.cc @@ -38,7 +38,7 @@ public: virtual void get_protocol_ids(std::vector& v); - virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, + virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); virtual PROTO_ID get_proto_id() { return PROTO_ERSPAN; }; @@ -102,16 +102,16 @@ void Erspan3Codec::get_protocol_ids(std::vector& v) * Returns: void function * */ -bool Erspan3Codec::decode(const uint8_t *raw_pkt, const uint32_t len, +bool Erspan3Codec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) { lyr_len = sizeof(ERSpanType3Hdr); ERSpanType3Hdr *erSpan3Hdr = (ERSpanType3Hdr *)raw_pkt; - if (len < sizeof(ERSpanType3Hdr)) + if (raw_len < sizeof(ERSpanType3Hdr)) { codec_events::decoder_alert_encapsulated(p, DECODE_ERSPAN3_DGRAM_LT_HDR, - raw_pkt, len); + raw_pkt, raw_len); return false; } @@ -120,7 +120,7 @@ bool Erspan3Codec::decode(const uint8_t *raw_pkt, const uint32_t len, /* discard packet - multiple encapsulation */ /* not sure if this is ever used but I am assuming it is not */ codec_events::decoder_alert_encapsulated(p, DECODE_IP_MULTIPLE_ENCAPSULATION, - raw_pkt, len); + raw_pkt, raw_len); return false; } @@ -129,7 +129,7 @@ bool Erspan3Codec::decode(const uint8_t *raw_pkt, const uint32_t len, if (erspan_version(erSpan3Hdr) != 0x02) /* Type 3 == version 0x02 */ { codec_events::decoder_alert_encapsulated(p, DECODE_ERSPAN_HDR_VERSION_MISMATCH, - raw_pkt, len); + raw_pkt, raw_len); return false; } diff --git a/src/codecs/link/cd_eth_loopback.cc b/src/codecs/link/cd_eth_loopback.cc index 1b45159da..51002aa4c 100644 --- a/src/codecs/link/cd_eth_loopback.cc +++ b/src/codecs/link/cd_eth_loopback.cc @@ -38,7 +38,7 @@ public: virtual void get_protocol_ids(std::vector& v); - virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, + virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); @@ -55,7 +55,7 @@ void EthLoopbackCodec::get_protocol_ids(std::vector& v) v.push_back(ETHERNET_TYPE_LOOP); } -bool EthLoopbackCodec::decode(const uint8_t* /*raw_pkt*/, const uint32_t /*raw_len*/, +bool EthLoopbackCodec::decode(const uint8_t* /*raw_pkt*/, const uint32_t& /*raw_len*/, Packet* /*p*/, uint16_t& /*lyr_len*/, uint16_t& /*next_prot_id*/) { diff --git a/src/codecs/link/cd_mpls.cc b/src/codecs/link/cd_mpls.cc index a549c409a..45366d6d3 100644 --- a/src/codecs/link/cd_mpls.cc +++ b/src/codecs/link/cd_mpls.cc @@ -45,7 +45,7 @@ public: virtual PROTO_ID get_proto_id() { return PROTO_MPLS; }; virtual void get_protocol_ids(std::vector& v); - virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, + virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); }; @@ -68,7 +68,7 @@ void MplsCodec::get_protocol_ids(std::vector& v) } -bool MplsCodec::decode(const uint8_t *raw_pkt, const uint32_t len, +bool MplsCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) { const uint32_t* tmpMplsHdr; @@ -80,11 +80,11 @@ bool MplsCodec::decode(const uint8_t *raw_pkt, const uint32_t len, uint8_t bos = 0; uint8_t ttl; uint8_t chainLen = 0; - uint32_t stack_len = len; + uint32_t stack_len = raw_len; int iRet = 0; - UpdateMPLSStats(&sfBase, len, Active_PacketWasDropped()); + UpdateMPLSStats(&sfBase, raw_len, Active_PacketWasDropped()); tmpMplsHdr = (const uint32_t *) raw_pkt; while (!bos) diff --git a/src/codecs/link/cd_pppencap.cc b/src/codecs/link/cd_pppencap.cc index b1fc7e59b..d29c59a3b 100644 --- a/src/codecs/link/cd_pppencap.cc +++ b/src/codecs/link/cd_pppencap.cc @@ -42,7 +42,7 @@ public: virtual PROTO_ID get_proto_id() { return PROTO_PPP_ENCAP; }; virtual void get_protocol_ids(std::vector& v); - virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, + virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); }; @@ -73,7 +73,7 @@ void PppEncap::get_protocol_ids(std::vector& v) * * Returns: void function */ -bool PppEncap::decode(const uint8_t *raw_pkt, const uint32_t len, +bool PppEncap::decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) { static THREAD_LOCAL bool had_vj = false; @@ -100,7 +100,7 @@ bool PppEncap::decode(const uint8_t *raw_pkt, const uint32_t len, /* do a little validation: * */ - if(len < 2) + if(raw_len < 2) { if (ScLogVerbose()) { @@ -140,11 +140,11 @@ bool PppEncap::decode(const uint8_t *raw_pkt, const uint32_t len, case PPP_VJ_UCOMP: /* VJ compression modifies the protocol field. It must be set * to tcp (only TCP packets can be VJ compressed) */ - if(len < (lyr_len + ipv4::hdr_len())) + if(raw_len < (lyr_len + ipv4::hdr_len())) { if (ScLogVerbose()) ErrorMessage("PPP VJ min packet length > captured len! " - "(%d bytes)\n", len); + "(%d bytes)\n", raw_len); return false; } diff --git a/src/codecs/link/cd_pppoe.cc b/src/codecs/link/cd_pppoe.cc index a24b0e9af..bee6468b2 100644 --- a/src/codecs/link/cd_pppoe.cc +++ b/src/codecs/link/cd_pppoe.cc @@ -284,7 +284,7 @@ public: virtual PROTO_ID get_proto_id() { return PROTO_PPPOE; }; virtual void get_protocol_ids(std::vector& v); - virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, + virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in); }; @@ -298,7 +298,7 @@ void PPPoEDiscCodec::get_protocol_ids(std::vector& v) } -bool PPPoEDiscCodec::decode(const uint8_t *raw_pkt, const uint32_t raw_len, +bool PPPoEDiscCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) { return pppoepkt_decode(raw_pkt, raw_len, p, PppoepktType::DISCOVERY, @@ -387,7 +387,7 @@ public: virtual PROTO_ID get_proto_id() { return PROTO_PPPOE; }; virtual void get_protocol_ids(std::vector& v); - virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, + virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in); }; @@ -401,7 +401,7 @@ void PPPoESessCodec::get_protocol_ids(std::vector& v) } -bool PPPoESessCodec::decode(const uint8_t *raw_pkt, const uint32_t raw_len, +bool PPPoESessCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) { return pppoepkt_decode(raw_pkt, raw_len, p, PppoepktType::SESSION, diff --git a/src/codecs/link/cd_transbridge.cc b/src/codecs/link/cd_transbridge.cc index 2d478630f..f13a2bbe5 100644 --- a/src/codecs/link/cd_transbridge.cc +++ b/src/codecs/link/cd_transbridge.cc @@ -46,7 +46,7 @@ public: virtual void get_protocol_ids(std::vector& v); - virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, + virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); }; @@ -76,7 +76,7 @@ void TransbridgeCodec::get_protocol_ids(std::vector& v) * convention needed to be changed and the stuff at the beginning * wasn't needed since we are already deep into the packet */ -bool TransbridgeCodec::decode(const uint8_t *raw_pkt, const uint32_t raw_len, +bool TransbridgeCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) { if(raw_len < eth::hdr_len()) diff --git a/src/codecs/link/cd_vlan.cc b/src/codecs/link/cd_vlan.cc index de8edfd7d..6a5ca791a 100644 --- a/src/codecs/link/cd_vlan.cc +++ b/src/codecs/link/cd_vlan.cc @@ -44,7 +44,7 @@ public: virtual PROTO_ID get_proto_id() { return PROTO_VLAN; }; virtual void get_protocol_ids(std::vector& v); - virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, + virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); }; @@ -79,10 +79,10 @@ void VlanCodec::get_protocol_ids(std::vector& v) } -bool VlanCodec::decode(const uint8_t *raw_pkt, const uint32_t len, +bool VlanCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) { - if(len < sizeof(vlan::VlanTagHdr)) + if(raw_len < sizeof(vlan::VlanTagHdr)) { codec_events::decoder_event(p, DECODE_BAD_VLAN); @@ -109,7 +109,7 @@ bool VlanCodec::decode(const uint8_t *raw_pkt, const uint32_t len, */ if(ntohs(vh->vth_proto) <= ETHERNET_MAX_LEN_ENCAP) { - if(len < sizeof(vlan::VlanTagHdr) + sizeof(EthLlc)) + if(raw_len < sizeof(vlan::VlanTagHdr) + sizeof(EthLlc)) { codec_events::decoder_event(p, DECODE_BAD_VLAN_ETHLLC); @@ -128,7 +128,7 @@ bool VlanCodec::decode(const uint8_t *raw_pkt, const uint32_t len, if(ehllc->dsap == ETH_DSAP_IP && ehllc->ssap == ETH_SSAP_IP) { - if ( len < len_vlan_llc_other() ) + if (raw_len < len_vlan_llc_other()) { codec_events::decoder_event(p, DECODE_BAD_VLAN_OTHER); diff --git a/src/codecs/misc/cd_default.cc b/src/codecs/misc/cd_default.cc index 23c311258..6f5674d14 100644 --- a/src/codecs/misc/cd_default.cc +++ b/src/codecs/misc/cd_default.cc @@ -41,7 +41,7 @@ public: ~DefaultCodec(){}; virtual void get_protocol_ids(std::vector& v); - virtual bool decode(const uint8_t*, const uint32_t, + virtual bool decode(const uint8_t*, const uint32_t&, Packet*, uint16_t&, uint16_t&) { return false; }; }; diff --git a/src/codecs/misc/cd_gtp.cc b/src/codecs/misc/cd_gtp.cc index d2a8c4c1f..c458fe0f4 100644 --- a/src/codecs/misc/cd_gtp.cc +++ b/src/codecs/misc/cd_gtp.cc @@ -48,7 +48,7 @@ public: virtual PROTO_ID get_proto_id() { return PROTO_GTP; }; virtual void get_protocol_ids(std::vector& v); - virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, + virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in); virtual bool update(Packet*, Layer*, uint32_t* len); @@ -84,7 +84,7 @@ void GtpCodec::get_protocol_ids(std::vector& v) * */ -bool GtpCodec::decode(const uint8_t *raw_pkt, const uint32_t len, +bool GtpCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) { uint8_t next_hdr_type; @@ -99,7 +99,7 @@ bool GtpCodec::decode(const uint8_t *raw_pkt, const uint32_t len, if (p->GTPencapsulated) { codec_events::decoder_alert_encapsulated(p, DECODE_GTP_MULTIPLE_ENCAPSULATION, - raw_pkt, len); + raw_pkt, raw_len); return false; } else @@ -107,7 +107,7 @@ bool GtpCodec::decode(const uint8_t *raw_pkt, const uint32_t len, p->GTPencapsulated = 1; } /*Check the length*/ - if (len < GTP_MIN_LEN) + if (raw_len < GTP_MIN_LEN) return false; /* We only care about PDU*/ if ( hdr->type != 255) @@ -125,7 +125,7 @@ bool GtpCodec::decode(const uint8_t *raw_pkt, const uint32_t len, lyr_len = GTP_V0_HEADER_LEN; /*Check header fields*/ - if (len < lyr_len) + if (raw_len < lyr_len) { codec_events::decoder_event(p, DECODE_GTP_BAD_LEN); return false; @@ -134,10 +134,10 @@ bool GtpCodec::decode(const uint8_t *raw_pkt, const uint32_t len, p->proto_bits |= PROTO_BIT__GTP; /*Check the length field. */ - if (len != ((unsigned int)ntohs(hdr->length) + lyr_len)) + if (raw_len != ((unsigned int)ntohs(hdr->length) + lyr_len)) { DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Calculated length %d != %d in header.\n", - len - lyr_len, ntohs(hdr->length));); + raw_len - lyr_len, ntohs(hdr->length));); codec_events::decoder_event(p, DECODE_GTP_BAD_LEN); return false; } @@ -153,7 +153,7 @@ bool GtpCodec::decode(const uint8_t *raw_pkt, const uint32_t len, lyr_len = GTP_V1_HEADER_LEN; /*Check optional fields*/ - if (len < lyr_len) + if (raw_len < lyr_len) { codec_events::decoder_event(p, DECODE_GTP_BAD_LEN); return false; @@ -165,7 +165,7 @@ bool GtpCodec::decode(const uint8_t *raw_pkt, const uint32_t len, { uint16_t ext_hdr_len; /*check length before reading data*/ - if (len < (uint32_t)(lyr_len + 4)) + if (raw_len < (uint32_t)(lyr_len + 4)) { codec_events::decoder_event(p, DECODE_GTP_BAD_LEN); return false; @@ -182,7 +182,7 @@ bool GtpCodec::decode(const uint8_t *raw_pkt, const uint32_t len, lyr_len += ext_hdr_len * 4; /*check length before reading data*/ - if (len < lyr_len) + if (raw_len < lyr_len) { codec_events::decoder_event(p, DECODE_GTP_BAD_LEN); return false; @@ -196,10 +196,10 @@ bool GtpCodec::decode(const uint8_t *raw_pkt, const uint32_t len, p->proto_bits |= PROTO_BIT__GTP; /*Check the length field. */ - if (len != ((unsigned int)ntohs(hdr->length) + GTP_MIN_LEN)) + if (raw_len != ((unsigned int)ntohs(hdr->length) + GTP_MIN_LEN)) { DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Calculated length %d != %d in header.\n", - len - GTP_MIN_LEN, ntohs(hdr->length));); + raw_len - GTP_MIN_LEN, ntohs(hdr->length));); codec_events::decoder_event(p, DECODE_GTP_BAD_LEN); return false; } @@ -215,7 +215,7 @@ bool GtpCodec::decode(const uint8_t *raw_pkt, const uint32_t len, Active_SetTunnelBypass(); - if (len > 0) + if (raw_len > 0) { p->packet_flags |= PKT_UNSURE_ENCAP; diff --git a/src/codecs/misc/cd_teredo.cc b/src/codecs/misc/cd_teredo.cc index dab3cf358..37c4eeaa1 100644 --- a/src/codecs/misc/cd_teredo.cc +++ b/src/codecs/misc/cd_teredo.cc @@ -49,7 +49,7 @@ public: ~TeredoCodec(){}; virtual void get_protocol_ids(std::vector& v); - virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, + virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); }; @@ -61,10 +61,10 @@ void TeredoCodec::get_protocol_ids(std::vector& v) v.push_back(PROTOCOL_TEREDO); } -bool TeredoCodec::decode(const uint8_t *raw_pkt, const uint32_t len, +bool TeredoCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) { - if (len < teredo::min_hdr_len()) + if (raw_len < teredo::min_hdr_len()) return false; /* Decode indicators. If both are present, Auth always comes before Origin. */ @@ -72,13 +72,13 @@ bool TeredoCodec::decode(const uint8_t *raw_pkt, const uint32_t len, { uint8_t client_id_length, auth_data_length; - if (len < teredo::min_indicator_auth_len()) + if (raw_len < teredo::min_indicator_auth_len()) return false; client_id_length = *(raw_pkt + 2); auth_data_length = *(raw_pkt + 3); - if (len < (uint32_t)(teredo::min_indicator_auth_len() + client_id_length + auth_data_length)) + if (raw_len < (uint32_t)(teredo::min_indicator_auth_len() + client_id_length + auth_data_length)) return false; raw_pkt += (teredo::min_indicator_auth_len() + client_id_length + auth_data_length); @@ -87,7 +87,7 @@ bool TeredoCodec::decode(const uint8_t *raw_pkt, const uint32_t len, if (ntohs(*(uint16_t *)raw_pkt) == teredo::indicator_origin()) { - if (len < teredo::indicator_origin_len()) + if (raw_len < teredo::indicator_origin_len()) return false; raw_pkt += teredo::indicator_origin_len(); diff --git a/src/codecs/root/cd_eth.cc b/src/codecs/root/cd_eth.cc index 81ca55c8a..a3dd10eed 100644 --- a/src/codecs/root/cd_eth.cc +++ b/src/codecs/root/cd_eth.cc @@ -46,7 +46,7 @@ public: virtual PROTO_ID get_proto_id() { return PROTO_ETH; }; virtual void get_protocol_ids(std::vector&) {}; virtual void get_data_link_type(std::vector&); - virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, + virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id); virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in); virtual bool update(Packet*, Layer*, uint32_t* len); @@ -78,15 +78,15 @@ void EthCodec::get_data_link_type(std::vector&v) * * Returns: void function */ -bool EthCodec::decode(const uint8_t *raw_pkt, const uint32_t len, +bool EthCodec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *p, uint16_t &lyr_len, uint16_t& next_prot_id) { /* do a little validation */ - if(len < eth::hdr_len()) + if(raw_len < eth::hdr_len()) { DEBUG_WRAP(DebugMessage(DEBUG_DECODE, - "WARNING: Truncated eth header (%d bytes).\n", len);); + "WARNING: Truncated eth header (%d bytes).\n", raw_len);); codec_events::decoder_event(p, DECODE_ETH_HDR_TRUNC); diff --git a/src/codecs/root/cd_linux_sll.cc b/src/codecs/root/cd_linux_sll.cc index ac852702e..0d9def620 100644 --- a/src/codecs/root/cd_linux_sll.cc +++ b/src/codecs/root/cd_linux_sll.cc @@ -43,7 +43,7 @@ public: virtual void get_data_link_type(std::vector&); - virtual bool decode(const uint8_t *raw_pkt, const uint32_t raw_len, + virtual bool decode(const uint8_t *raw_pkt, const uint32_t &raw_len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); }; @@ -66,7 +66,7 @@ void LinuxSllCodec::get_data_link_type(std::vector&v) #endif } -bool LinuxSllCodec::decode(const uint8_t *raw_pkt, const uint32_t raw_len, +bool LinuxSllCodec::decode(const uint8_t *raw_pkt, const uint32_t &raw_len, Packet* /*p*/, uint16_t &lyr_len, uint16_t &next_prot_id) { /* do a little validation */ diff --git a/src/codecs/root/cd_null.cc b/src/codecs/root/cd_null.cc index 6325ea65e..cdeff7f42 100644 --- a/src/codecs/root/cd_null.cc +++ b/src/codecs/root/cd_null.cc @@ -42,7 +42,7 @@ public: ~NullCodec() {}; - virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, + virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); virtual void get_data_link_type(std::vector&); @@ -67,7 +67,7 @@ static const uint16_t NULL_HDRLEN = 4; * * Returns: void function */ -bool NullCodec::decode(const uint8_t* /*raw_pkt*/, const uint32_t raw_len, +bool NullCodec::decode(const uint8_t* /*raw_pkt*/, const uint32_t& raw_len, Packet* /*p*/, uint16_t &lyr_len, uint16_t &next_prot_id) { DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "NULL Packet!\n"); ); diff --git a/src/codecs/root/cd_raw4.cc b/src/codecs/root/cd_raw4.cc index 88068be78..85c68cae7 100644 --- a/src/codecs/root/cd_raw4.cc +++ b/src/codecs/root/cd_raw4.cc @@ -41,7 +41,7 @@ public: ~Raw4Codec() {}; - virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, + virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); virtual void get_data_link_type(std::vector&); @@ -70,7 +70,7 @@ public: * * Returns: void function */ -bool Raw4Codec::decode(const uint8_t* /*raw_pkt*/, const uint32_t /*raw_len*/, +bool Raw4Codec::decode(const uint8_t* /*raw_pkt*/, const uint32_t& /*raw_len*/, Packet* /*p*/, uint16_t& /*lyr_len*/, uint16_t &next_prot_id) { DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Raw IP4 Packet!\n");); diff --git a/src/codecs/root/cd_raw6.cc b/src/codecs/root/cd_raw6.cc index 38a26232a..23b58dd23 100644 --- a/src/codecs/root/cd_raw6.cc +++ b/src/codecs/root/cd_raw6.cc @@ -40,7 +40,7 @@ public: Raw6Codec() : Codec(CD_RAW6_NAME){}; ~Raw6Codec() {}; - virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, + virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); virtual void get_data_link_type(std::vector&); @@ -51,7 +51,7 @@ public: // raw packets are predetermined to be ip4 (above) or ip6 (below) by the DLT -bool Raw6Codec::decode(const uint8_t* /*raw_pkt*/, const uint32_t /*raw_len*/, +bool Raw6Codec::decode(const uint8_t* /*raw_pkt*/, const uint32_t& /*raw_len*/, Packet* /*p*/, uint16_t& /*lyr_len*/, uint16_t& next_prot_id) { DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Raw IP6 Packet!\n");); diff --git a/src/codecs/root/cd_wlan.cc b/src/codecs/root/cd_wlan.cc index 92680056c..b21138c24 100644 --- a/src/codecs/root/cd_wlan.cc +++ b/src/codecs/root/cd_wlan.cc @@ -43,7 +43,7 @@ public: ~WlanCodec() {}; - virtual bool decode(const uint8_t *raw_pkt, const uint32_t raw_len, + virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); virtual void get_data_link_type(std::vector&); @@ -76,7 +76,7 @@ void WlanCodec::get_data_link_type(std::vector&v) #endif } -bool WlanCodec::decode(const uint8_t *raw_pkt, const uint32_t raw_len, +bool WlanCodec::decode(const uint8_t *raw_pkt, const uint32_t &raw_len, Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) { uint32_t cap_len = raw_len; diff --git a/src/codecs/template.cc b/src/codecs/template.cc index 3841fea72..8dfc5911a 100644 --- a/src/codecs/template.cc +++ b/src/codecs/template.cc @@ -47,7 +47,7 @@ public: ~NameCodec() {}; - virtual bool decode(const uint8_t *raw_pkt, const uint32_t raw_len, + virtual bool decode(const uint8_t *raw_pkt, const uint32_t &raw_len, Packet *, uint16_t &lyr_len, uint16_t &next_prot_id); virtual void get_protocol_ids(std::vector&); @@ -80,7 +80,7 @@ void NameCodec::get_protocol_ids(std::vector& v) // v.push_back(PROTO_TYPE); } -bool NameCodec::decode(const uint8_t *raw_pkt, const uint32_t raw_len, +bool NameCodec::decode(const uint8_t *raw_pkt, const uint32_t &raw_len, Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) { // reinterpret the raw data into this codec's data format diff --git a/src/framework/codec.h b/src/framework/codec.h index ea6823573..ff3582179 100644 --- a/src/framework/codec.h +++ b/src/framework/codec.h @@ -120,7 +120,7 @@ public: // Register the code's protocol ID's and Ethertypes virtual void get_protocol_ids(std::vector&) {}; // decode function - virtual bool decode(const uint8_t* raw_packet, const uint32_t raw_len, + virtual bool decode(const uint8_t* raw_packet, const uint32_t& raw_len, Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id) = 0; // diff --git a/src/managers/packet_manager.cc b/src/managers/packet_manager.cc index 260e67dda..58f3071d8 100644 --- a/src/managers/packet_manager.cc +++ b/src/managers/packet_manager.cc @@ -434,8 +434,8 @@ void PacketManager::decode( uint16_t prot_id; uint8_t mapped_prot = grinder; uint16_t prev_prot_id = FINISHED_DECODE; - uint16_t len, lyr_len; - + uint16_t lyr_len = 0; + uint32_t len = 0; DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Packet!\n"); DebugMessage(DEBUG_DECODE, "caplen: %lu pktlen: %lu\n", @@ -466,31 +466,32 @@ void PacketManager::decode( len -= lyr_len; pkt += lyr_len; lyr_len = 0; - - // since the IP length and the packet length may not be equal. - if (p->packet_flags & PKT_NEW_IP_LEN) - { - len = p->ip_dsize; - p->packet_flags &= ~PKT_NEW_IP_LEN; - } } // if the final protocol ID is not the default codec, a Codec failed if (prev_prot_id != FINISHED_DECODE) { - // if the codec exists, it failed - if(s_proto_map[prev_prot_id]) - s_stats[discards]++; - else - s_stats[other_codecs]++; + if (!(p->packet_flags & PKT_UNSURE_ENCAP)) + { + // if the codec exists, it failed + if(s_proto_map[prev_prot_id]) + s_stats[discards]++; + else + s_stats[other_codecs]++; + } + + if (p->packet_flags & PKT_ESP_LYR_PRESENT) + p->packet_flags |= PKT_TRUST; } if (p->ip6_extension_count > 0) ipv6_util::CheckIPv6ExtensionOrder(p); s_stats[mapped_prot + stat_offset]++; + p->packet_flags &= ~PKT_ESP_LYR_PRESENT; // cleanup. Just in case. p->dsize = len; p->data = pkt; + PREPROC_PROFILE_END(decodePerfStats); } @@ -707,8 +708,6 @@ SO_PUBLIC void PacketManager::encode_update (Packet* p) || (p->packet_flags & PKT_RESIZED) ) pkth->caplen = pkth->pktlen = len; - - p->packet_flags &= ~PKT_LOGGED; } //------------------------------------------------------------------------- diff --git a/src/protocols/packet.h b/src/protocols/packet.h index dd2dc54aa..5a064d394 100644 --- a/src/protocols/packet.h +++ b/src/protocols/packet.h @@ -96,24 +96,21 @@ extern "C" { #define PKT_IP_RULE 0x00040000 /* this packet is being evaluated against an IP rule */ #define PKT_IP_RULE_2ND 0x00080000 /* this packet is being evaluated against an IP rule */ -#define PKT_LOGGED 0x00100000 /* this packet has been logged */ -#define PKT_PSEUDO 0x00200000 /* is a pseudo packet */ -#define PKT_MODIFIED 0x00400000 /* packet had normalizations, etc. */ -#define PKT_RESIZED 0x00800000 /* packet has new size; must set modified too */ +#define PKT_PSEUDO 0x00100000 /* is a pseudo packet */ +#define PKT_MODIFIED 0x00200000 /* packet had normalizations, etc. */ +#define PKT_RESIZED 0x00300000 /* packet has new size; must set modified too */ // neither of these flags will be set for (full) retransmissions or non-data segments // a partial overlap results in out of sequence condition // out of sequence condition is sticky -#define PKT_STREAM_ORDER_OK 0x01000000 /* this segment is in order, w/o gaps */ -#define PKT_STREAM_ORDER_BAD 0x02000000 /* this stream had at least one gap */ -#define PKT_REASSEMBLED_OLD 0x04000000 /* for backwards compat with so rules */ - -#define PKT_IPREP_SOURCE_TRIGGERED 0x08000000 -#define PKT_IPREP_DATA_SET 0x10000000 -#define PKT_FILE_EVENT_SET 0x20000000 -#define PKT_NEW_IP_LEN 0X40000000 /* For Codecs to tell PacketManger a new length should be set */ -// 0x40000000 are available +#define PKT_STREAM_ORDER_OK 0x00800000 /* this segment is in order, w/o gaps */ +#define PKT_STREAM_ORDER_BAD 0x01000000 /* this stream had at least one gap */ +#define PKT_REASSEMBLED_OLD 0x02000000 /* for backwards compat with so rules */ + +#define PKT_FILE_EVENT_SET 0x04000000 +#define PKT_ESP_LYR_PRESENT 0x08000000 +// 0x40000000 are available #define PKT_PDU_FULL (PKT_PDU_HEAD | PKT_PDU_TAIL) #define REASSEMBLED_PACKET_FLAGS (PKT_REBUILT_STREAM|PKT_REASSEMBLED_OLD) diff --git a/tools/snort2lua/config_states/config_checksums.cc b/tools/snort2lua/config_states/config_checksums.cc index 108e6bb5f..8bd3a5441 100644 --- a/tools/snort2lua/config_states/config_checksums.cc +++ b/tools/snort2lua/config_states/config_checksums.cc @@ -31,9 +31,9 @@ namespace config namespace { -template +template class ConfigChecksum : public ConversionState { public: @@ -60,7 +60,9 @@ public: } }; -template +template static ConversionState* config_checksum_ctor(Converter* cv, LuaData* ld) { if (lua_option_name) diff --git a/tools/snort2lua/config_states/config_no_option.cc b/tools/snort2lua/config_states/config_no_option.cc index 405f09a43..391d31cf3 100644 --- a/tools/snort2lua/config_states/config_no_option.cc +++ b/tools/snort2lua/config_states/config_no_option.cc @@ -45,7 +45,9 @@ public: } // namespace -template +template static ConversionState* config_true_no_opt_ctor(Converter* cv, LuaData* ld) { ld->open_table(*lua_table_name); @@ -62,7 +64,9 @@ static ConversionState* config_true_no_opt_ctor(Converter* cv, LuaData* ld) return new DeadCode(cv, ld); } -template +template static ConversionState* config_false_no_opt_ctor(Converter* cv, LuaData* ld) { ld->open_table(*lua_table_name); diff --git a/tools/snort2lua/config_states/config_one_int_option.cc b/tools/snort2lua/config_states/config_one_int_option.cc index ac51cc90e..533b41dd4 100644 --- a/tools/snort2lua/config_states/config_one_int_option.cc +++ b/tools/snort2lua/config_states/config_one_int_option.cc @@ -57,7 +57,8 @@ public: (lua_option) && (*snort_option).compare(*lua_option)) { - ld->add_diff_option_comment("config " + *snort_option + ":", *lua_option); + ld->add_diff_option_comment("config " + *snort_option + + ":", *lua_option); } bool retval = parse_int_option(*lua_option, stream); diff --git a/tools/snort2lua/config_states/config_one_string_option.cc b/tools/snort2lua/config_states/config_one_string_option.cc index a8d3ab893..ae70bd8f4 100644 --- a/tools/snort2lua/config_states/config_one_string_option.cc +++ b/tools/snort2lua/config_states/config_one_string_option.cc @@ -56,7 +56,8 @@ public: // if the two names are not equal ... if((*snort_option).compare(*lua_option)) - ld->add_diff_option_comment("config " + *snort_option + ":", *lua_option); + ld->add_diff_option_comment("config " + *snort_option + + ":", *lua_option); // get length (stringstream will not read spaces...which we want) const int pos = stream.tellg(); diff --git a/tools/snort2lua/data/dt_data.h b/tools/snort2lua/data/dt_data.h index 1e40568b2..a9bc90a3c 100644 --- a/tools/snort2lua/data/dt_data.h +++ b/tools/snort2lua/data/dt_data.h @@ -50,7 +50,7 @@ public: static inline void set_difference_print() {mode = PrintMode::DIFFERENCES; } static inline bool is_difference_mode() { return mode == PrintMode::DIFFERENCES; } inline bool failed_conversions() { return !errors->empty() || !bad_rules->empty(); } - inline bool contains_rules() { return rules.size() != 0; } + inline bool contains_rules() { return rules.size() > 0; } friend std::ostream &operator<<(std::ostream&, const LuaData &); diff --git a/tools/snort2lua/data/dt_table.cc b/tools/snort2lua/data/dt_table.cc index d4ac93fb0..113d3719d 100644 --- a/tools/snort2lua/data/dt_table.cc +++ b/tools/snort2lua/data/dt_table.cc @@ -61,6 +61,18 @@ Table::~Table() delete comments; } +bool Table::has_differences() +{ + if (!comments->empty()) + return true; + + for (Table* t : tables) + if (t->has_differences()) + return true; + + return false; +} + Table* Table::open_table() { Table *t = new Table(depth + 1); @@ -177,10 +189,17 @@ std::ostream &operator<<( std::ostream& out, const Table &t) for (Variable* v : t.lists) out << (*v) << ",\n"; + + for (Table* sub_t : t.tables) + out << (*sub_t) << ",\n"; + } + else + { + for (Table* sub_t : t.tables) + if (sub_t->has_differences()) + out << (*sub_t) << ",\n"; } - for (Table* sub_t : t.tables) - out << (*sub_t) << ",\n"; // don't add a comma if the depth is zero if(t.depth == 0) diff --git a/tools/snort2lua/data/dt_table.h b/tools/snort2lua/data/dt_table.h index d808ceecc..7baabf822 100644 --- a/tools/snort2lua/data/dt_table.h +++ b/tools/snort2lua/data/dt_table.h @@ -38,7 +38,8 @@ public: Table(std::string name, int depth); virtual ~Table(); - inline std::string get_name(){ return name; }; + inline std::string get_name(){ return name; } + bool has_differences(); Table* open_table(); Table* open_table(std::string); bool add_option(std::string, int val); diff --git a/tools/snort2lua/output_states/out_csv.cc b/tools/snort2lua/output_states/out_csv.cc index fb19d8d03..297770191 100644 --- a/tools/snort2lua/output_states/out_csv.cc +++ b/tools/snort2lua/output_states/out_csv.cc @@ -67,91 +67,148 @@ bool AlertCsv::convert(std::istringstream& data_stream) std::istringstream format(keyword); while (std::getline(format, val, ',')) { - std::string new_val = std::string(); + bool tmpval = true; if (!val.compare("default")) ld->add_deleted_comment("default"); else if (!val.compare("timestamp")) - new_val = "timestamp"; + tmpval = ld->add_list_to_table("csv", "timestamp"); else if (!val.compare("msg")) - new_val = "msg"; + tmpval = ld->add_list_to_table("csv", "msg"); + + else if (!val.compare("proto")) + tmpval = ld->add_list_to_table("csv", "proto"); + + else if (!val.compare("dst")) + tmpval = ld->add_list_to_table("csv", "dst"); + + else if (!val.compare("src")) + tmpval = ld->add_list_to_table("csv", "src"); + + else if (!val.compare("ttl")) + tmpval = ld->add_list_to_table("csv", "ttl"); + + else if (!val.compare("id")) + tmpval = ld->add_list_to_table("csv", "id"); + + else if (!val.compare("tos")) + tmpval = ld->add_list_to_table("csv", "tos"); else if (!val.compare("sig_generator")) - new_val = "gid"; + { + ld->add_diff_option_comment("sig_generator", "gid"); + tmpval = ld->add_list_to_table("csv", "gid"); + } else if (!val.compare("sid_id")) - new_val = "sid"; + { + ld->add_diff_option_comment("sid_id", "sid"); + tmpval = ld->add_list_to_table("csv", "sid"); + } else if (!val.compare("sig_rev")) - new_val = "rev"; - - else if (!val.compare("proto")) - new_val = "proto"; - - else if (!val.compare("src")) - new_val = "src"; + { + ld->add_diff_option_comment("sig_rev", "rev"); + tmpval = ld->add_list_to_table("csv", "rev"); + } else if (!val.compare("srcport")) - new_val = "src_port"; - - else if (!val.compare("dst")) - new_val = "dst"; + { + ld->add_diff_option_comment("srcport", "src_port"); + tmpval = ld->add_list_to_table("csv", "src_port"); + } else if (!val.compare("dstport")) - new_val = "dst_port"; + { + ld->add_diff_option_comment("dstport", "dst_port"); + tmpval = ld->add_list_to_table("csv", "dst_port"); + } else if (!val.compare("ethsrc")) - new_val = "eth_src"; + { + ld->add_diff_option_comment("ethsrc", "eth_src"); + tmpval = ld->add_list_to_table("csv", "eth_src"); + } else if (!val.compare("ethdst")) - new_val = "eth_dst"; + { + ld->add_diff_option_comment("ethdst", "eth_dst"); + tmpval = ld->add_list_to_table("csv", "eth_dst"); + } else if (!val.compare("ethlen")) - new_val = "eth_len"; + { + ld->add_diff_option_comment("ethlen", "eth_len"); + tmpval = ld->add_list_to_table("csv", "eth_len"); + } else if (!val.compare("tcpflags")) - new_val = "tcp_flags"; + { + ld->add_diff_option_comment("tcpflags", "tcp_flags"); + tmpval = ld->add_list_to_table("csv", "tcp_flags"); + } else if (!val.compare("tcpseq")) - new_val = "tcp_seq"; + { + ld->add_diff_option_comment("tcpseq", "tcp_seq"); + tmpval = ld->add_list_to_table("csv", "tcp_seq"); + } else if (!val.compare("tcpack")) - new_val = "tcp_ack"; + { + ld->add_diff_option_comment("tcpack", "tcp_ack"); + tmpval = ld->add_list_to_table("csv", "tcp_ack"); + } else if (!val.compare("tcplen")) - new_val = "tcp_len"; + { + ld->add_diff_option_comment("tcplen", "tcp_len"); + tmpval = ld->add_list_to_table("csv", "tcp_len"); + } else if (!val.compare("tcpwindow")) - new_val = "tcp_win"; - - else if (!val.compare("ttl")) - new_val = "ttl"; - - else if (!val.compare("tos")) - new_val = "tos"; - - else if (!val.compare("id")) - new_val = "id"; + { + ld->add_diff_option_comment("tcpwindow", "tcp_win"); + tmpval = ld->add_list_to_table("csv", "tcp_win"); + } else if (!val.compare("dgmlen")) - new_val = "dgm_len"; + { + ld->add_diff_option_comment("dgmlen", "dgm_len"); + tmpval = ld->add_list_to_table("csv", "dgm_len"); + } else if (!val.compare("iplen")) - new_val = "ip_len"; + { + ld->add_diff_option_comment("iplen", "ip_len"); + tmpval = ld->add_list_to_table("csv", "ip_len"); + } else if (!val.compare("icmptype")) - new_val = "icmp_type"; + { + ld->add_diff_option_comment("icmptype", "icmp_type"); + tmpval = ld->add_list_to_table("csv", "icmp_type"); + } else if (!val.compare("icmpcode")) - new_val = "icmp_code"; + { + ld->add_diff_option_comment("icmpcode", "icmp_code"); + tmpval = ld->add_list_to_table("csv", "icmp_code"); + } else if (!val.compare("icmpid")) - new_val = "icmp_id"; + { + ld->add_diff_option_comment("icmpid", "icmp_id"); + tmpval = ld->add_list_to_table("csv", "icmp_id"); + } else if (!val.compare("icmpseq")) - new_val = "icmp_seq"; + { + ld->add_diff_option_comment("icmpseq", "icmp_seq"); + tmpval = ld->add_list_to_table("csv", "icmp_seq"); + } else { @@ -159,14 +216,8 @@ bool AlertCsv::convert(std::istringstream& data_stream) retval = false; } - if (!new_val.empty()) - { - if (val.compare(new_val)) - ld->add_diff_option_comment(val, new_val); - - if (!ld->add_list_to_table("csv", new_val)) - retval = false; - } + if (retval && !tmpval) + retval = false; } if (!(data_stream >> limit)) @@ -186,11 +237,6 @@ bool AlertCsv::convert(std::istringstream& data_stream) retval = ld->add_option_to_table("limit", limit) && retval; retval = ld->add_option_to_table("units", units) && retval; - - // If we read something, more data available and bad input - if (data_stream >> keyword) - retval = false; - return retval; } diff --git a/tools/snort2lua/output_states/out_unified2.cc b/tools/snort2lua/output_states/out_unified2.cc index bfc6ffc90..d16cbaf2c 100644 --- a/tools/snort2lua/output_states/out_unified2.cc +++ b/tools/snort2lua/output_states/out_unified2.cc @@ -98,7 +98,7 @@ public: template static ConversionState* unified2_ctor(Converter* cv, LuaData* ld) { - ld->open_top_level_table("unified2"); // in case there are no arguments + ld->open_top_level_table("unified2"); // create table in case there are no arguments ld->close_table(); return new Unified2(cv, ld); } diff --git a/tools/snort2lua/preprocessor_states/pps_perfmonitor.cc b/tools/snort2lua/preprocessor_states/pps_perfmonitor.cc index d20e6bbb4..edb192663 100644 --- a/tools/snort2lua/preprocessor_states/pps_perfmonitor.cc +++ b/tools/snort2lua/preprocessor_states/pps_perfmonitor.cc @@ -38,6 +38,7 @@ public: PerfMonitor(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {}; virtual ~PerfMonitor() {}; virtual bool convert(std::istringstream& data_stream); + private: bool parse_file_option(std::istringstream& data_stream, std::string orig_name, @@ -56,7 +57,6 @@ bool PerfMonitor::parse_file_option(std::istringstream& data_stream, ld->add_comment_to_table(orig_name + " deprecated. If '" + option_name + " = true', Snort++ automatically prints to '" + new_file_name + "'"); - ld->add_diff_option_comment(orig_name, option_name + " = true"); tmpval = ld->add_option_to_table(option_name, true); if (eat_option(data_stream)) // we no longer care about the file name. @@ -113,16 +113,25 @@ bool PerfMonitor::convert(std::istringstream& data_stream) "file", "perf_monitor.csv"); else if (!keyword.compare("snortfile")) + { + ld->add_diff_option_comment("snortfile", "file = true"); parse_file_option(data_stream, "snortfile", "file", "perf_monitor.csv"); + } else if (!keyword.compare("flow-file")) + { + ld->add_diff_option_comment("flow-file", "flow_file = true"); parse_file_option(data_stream, "flow-file", "flow_file", "perf_monitor_flow.csv"); + } else if (!keyword.compare("flow-ip-file")) + { + ld->add_diff_option_comment("flow-ip-file", "flow_ip_file = true"); parse_file_option(data_stream, "flow-ip-file", "flow_ip_file", "perf_monitor_flow_ip.csv"); + } else if (!keyword.compare("accumulate")) { diff --git a/tools/snort2lua/preprocessor_states/pps_stream_tcp.cc b/tools/snort2lua/preprocessor_states/pps_stream_tcp.cc index 96fd7717a..47c2a37ee 100644 --- a/tools/snort2lua/preprocessor_states/pps_stream_tcp.cc +++ b/tools/snort2lua/preprocessor_states/pps_stream_tcp.cc @@ -101,23 +101,57 @@ bool StreamTcp::parse_ports(std::istringstream& stream) return false; if( !dir.compare("client")) + { + ld->add_diff_option_comment("ports client", "client_ports"); opt_name = "client_ports"; + } else if( !dir.compare("server")) + { + ld->add_diff_option_comment("ports server", "server_ports"); opt_name = "server_ports"; + } else if( !dir.compare("both")) + { + ld->add_diff_option_comment("ports both", "both_ports"); opt_name = "both_ports"; + } else return false; +#if 0 + // do nothing if no ports provided + if (stream >> protocol ) + { + ld->open_top_level_table("binder"); + ld->open_table(); + ld->open_table("when"); + ld->add_option_to_table("proto", "tcp"); + + + if (!protocol.compare("all")) + + else if (!protocol.compare("none")) + + else + do + { + + }while(stream >> protocol); + + while (stream >> protocol) + tmpval = ld->add_list_to_table(lua_dir, protocol) && tmpval; + } + while(stream >> s_val) retval = ld->add_list_to_table(opt_name, s_val) && retval; - ld->add_diff_option_comment("port " + dir, opt_name); + +#endif return retval; } @@ -147,12 +181,10 @@ bool StreamTcp::parse_protocol(std::istringstream& stream) else return false; - // TODO: update funcitnoality if Snort++ StreamTcpModule is updated while (stream >> protocol) tmpval = ld->add_list_to_table(lua_dir, protocol) && tmpval; - ld->add_diff_option_comment("protocol " + dir, lua_dir); return true; } diff --git a/tools/snort2lua/snort2lua.cc b/tools/snort2lua/snort2lua.cc index 472721fff..4f1fb8e2c 100644 --- a/tools/snort2lua/snort2lua.cc +++ b/tools/snort2lua/snort2lua.cc @@ -337,6 +337,22 @@ int main (int argc, char* argv[]) + + + cv.initialize(&init_state_ctor, &ld); + + // MAIN LOOP!! walk through every input file and begin converting! + option::Option* opt = options[CONF_FILE]; + do { + if (cv.convert_file(std::string(opt->arg)) < 0) + { + print_line("Failed Conversion of file " + std::string(opt->arg)); + fail = true; + } + } while ((opt = opt->next())); + + + // if no rule file is specified (or the same output and rule file specified), // rules will be printed in the 'default_rules' variable. Set that up // now. Otherwise, set up the include file. @@ -362,21 +378,6 @@ int main (int argc, char* argv[]) } - - cv.initialize(&init_state_ctor, &ld); - - // MAIN LOOP!! walk through every input file and begin converting! - option::Option* opt = options[CONF_FILE]; - do { - if (cv.convert_file(std::string(opt->arg)) < 0) - { - print_line("Failed Conversion of file " + std::string(opt->arg)); - fail = true; - } - } while ((opt = opt->next())); - - - // finally, lets print the converter to file std::ofstream out; diff --git a/tools/snort2lua/utils/snort2lua_util.cc b/tools/snort2lua/utils/snort2lua_util.cc index bee4469b6..9fb02fc35 100644 --- a/tools/snort2lua/utils/snort2lua_util.cc +++ b/tools/snort2lua/utils/snort2lua_util.cc @@ -27,6 +27,7 @@ #include #include #include +#include #include "utils/snort2lua_util.h" #include "conversion_state.h"