From: Russ Combs Date: Tue, 9 Sep 2014 20:10:59 +0000 (-0400) Subject: updated binder when and fixed pkt dir X-Git-Tag: 3.0.0-233~1414^2~5 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=be819032729e3bee5642882aa2cb3bc366ec9e72;p=thirdparty%2Fsnort3.git updated binder when and fixed pkt dir --- diff --git a/ChangeLog b/ChangeLog index 2b413a7d4..6bd3b05f7 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,7 @@ +119 +-- updated binder +-- fixed packet direction + 118 -- fixed bind action -- tweaked main loop diff --git a/doc/tips.txt b/doc/tips.txt index ab047125a..8dbde54c6 100644 --- a/doc/tips.txt +++ b/doc/tips.txt @@ -59,6 +59,15 @@ The following pointers will help you get started: git checkout master git merge brname +* check the commit history for a : + + git log + +* diff specific committed versions of a (using the unambiguous + commit prefixes): + +git diff f072c3... ff38ce... lua/snort.lua + === Building * you need luajit from luajit.org; build from source. diff --git a/src/flow/flow.cc b/src/flow/flow.cc index 627479077..886c50a42 100644 --- a/src/flow/flow.cc +++ b/src/flow/flow.cc @@ -245,7 +245,7 @@ void Flow::set_direction(Packet* p) { if (proto == IPPROTO_TCP) { - if (p->tcph->th_sport == client_port) + if (p->sp == client_port) { p->packet_flags |= PKT_FROM_CLIENT; } @@ -256,7 +256,7 @@ void Flow::set_direction(Packet* p) } else if (proto == IPPROTO_UDP && p->udph ) { - if (p->udph->uh_sport == client_port) + if (p->sp == client_port) { p->packet_flags |= PKT_FROM_CLIENT; } @@ -274,7 +274,7 @@ void Flow::set_direction(Packet* p) { if (proto == IPPROTO_TCP) { - if (p->tcph->th_dport == client_port) + if (p->dp == client_port) { p->packet_flags |= PKT_FROM_SERVER; } @@ -285,7 +285,7 @@ void Flow::set_direction(Packet* p) } else if (proto == IPPROTO_UDP && p->udph ) { - if (p->udph->uh_dport == client_port) + if (p->dp == client_port) { p->packet_flags |= PKT_FROM_SERVER; } @@ -297,8 +297,7 @@ void Flow::set_direction(Packet* p) else { p->packet_flags |= PKT_FROM_SERVER; - } - } + } } } else /* IS_IP6(p) */ { @@ -308,7 +307,7 @@ void Flow::set_direction(Packet* p) { if (proto == IPPROTO_TCP) { - if (p->tcph->th_sport == client_port) + if (p->sp == client_port) { p->packet_flags |= PKT_FROM_CLIENT; } @@ -319,7 +318,7 @@ void Flow::set_direction(Packet* p) } else if (proto == IPPROTO_UDP && p->udph ) { - if (p->udph->uh_sport == client_port) + if (p->sp == client_port) { p->packet_flags |= PKT_FROM_CLIENT; } @@ -337,7 +336,7 @@ void Flow::set_direction(Packet* p) { if (proto == IPPROTO_TCP) { - if (p->tcph->th_dport == client_port) + if (p->dp == client_port) { p->packet_flags |= PKT_FROM_SERVER; } @@ -348,7 +347,7 @@ void Flow::set_direction(Packet* p) } else if (proto == IPPROTO_UDP && p->udph ) { - if (p->udph->uh_dport == client_port) + if (p->dp == client_port) { p->packet_flags |= PKT_FROM_SERVER; } diff --git a/src/flow/flow.h b/src/flow/flow.h index 028a6263f..357d031e1 100644 --- a/src/flow/flow.h +++ b/src/flow/flow.h @@ -1,6 +1,6 @@ /**************************************************************************** * -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. + * Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. * Copyright (C) 2013-2013 Sourcefire, Inc. * * This program is free software; you can redistribute it and/or modify @@ -217,9 +217,12 @@ public: // FIXIT-M privatize if possible Inspector* gadget; const char* service; + unsigned policy_id; + int flow_state; // FIXIT-H wow - this is poorly encapsulated! did i do that? :( FlowState s5_state; // FIXIT-L rename this (s5 not appropriate) + // FIXIT-L can client and server ip and port be removed from flow? sfip_t client_ip; // FIXIT-L family and bits should be changed to uint16_t sfip_t server_ip; // or uint8_t to reduce sizeof from 24 to 20 diff --git a/src/flow/flow_control.cc b/src/flow/flow_control.cc index e69f5762f..c40918686 100644 --- a/src/flow/flow_control.cc +++ b/src/flow/flow_control.cc @@ -26,6 +26,7 @@ #endif #include +#include #include "flow/flow_cache.h" #include "flow/expect_cache.h" @@ -208,6 +209,10 @@ void FlowControl::reset_prunes (int proto) cache->reset_prunes(); } +//------------------------------------------------------------------------- +// packet foo +//------------------------------------------------------------------------- + void FlowControl::set_key(FlowKey* key, Packet* p) { ip::IpApi* ip_api = &p->ip_api; @@ -249,12 +254,68 @@ void FlowControl::set_key(FlowKey* key, Packet* p) } } -static bool is_bidirectional(Flow* flow) +static bool is_bidirectional(const Flow* flow) { constexpr unsigned bidir = SSNFLAG_SEEN_CLIENT | SSNFLAG_SEEN_SERVER; return (flow->s5_state.session_flags & bidir) == bidir; } +// FIXIT-L init_roles* should take const Packet* +static void init_roles_tcp(Packet* p, Flow* flow) +{ + if (TCP_ISFLAGSET(p->tcph, TH_SYN) && + !TCP_ISFLAGSET(p->tcph, TH_ACK)) + { + flow->s5_state.direction = FROM_CLIENT; + sfip_copy(flow->client_ip, p->ip_api.get_src()); + flow->client_port = ntohs(p->tcph->th_sport); + sfip_copy(flow->server_ip, p->ip_api.get_dst()); + flow->server_port = ntohs(p->tcph->th_dport); + } + else if (TCP_ISFLAGSET(p->tcph, (TH_SYN|TH_ACK))) + { + flow->s5_state.direction = FROM_SERVER; + sfip_copy(flow->client_ip, p->ip_api.get_dst()); + flow->client_port = ntohs(p->tcph->th_dport); + sfip_copy(flow->server_ip, p->ip_api.get_src()); + flow->server_port = ntohs(p->tcph->th_sport); + } + else if (p->sp > p->dp) + { + flow->s5_state.direction = FROM_CLIENT; + sfip_copy(flow->client_ip, p->ip_api.get_src()); + flow->client_port = ntohs(p->tcph->th_sport); + sfip_copy(flow->server_ip, p->ip_api.get_dst()); + flow->server_port = ntohs(p->tcph->th_dport); + } + else + { + flow->s5_state.direction = FROM_SERVER; + sfip_copy(flow->client_ip, p->ip_api.get_dst()); + flow->client_port = ntohs(p->tcph->th_dport); + sfip_copy(flow->server_ip, p->ip_api.get_src()); + flow->server_port = ntohs(p->tcph->th_sport); + } +} + +static void init_roles_udp(Packet* p, Flow* flow) +{ + flow->s5_state.direction = FROM_SENDER; + sfip_copy(flow->client_ip, p->ip_api.get_src()); + flow->client_port = ntohs(p->udph->uh_sport); + sfip_copy(flow->server_ip, p->ip_api.get_dst()); + flow->server_port = ntohs(p->udph->uh_dport); +} + +static void init_roles(Packet* p, Flow* flow) +{ + if ( flow->protocol == IPPROTO_TCP ) + init_roles_tcp(p, flow); + + else if ( flow->protocol == IPPROTO_UDP ) + init_roles_udp(p, flow); +} + unsigned FlowControl::process(FlowCache* cache, Packet* p) { unsigned news = 0; @@ -269,7 +330,11 @@ unsigned FlowControl::process(FlowCache* cache, Packet* p) p->flow = flow; if ( !flow->flow_state ) + { + init_roles(p, flow); binder->eval(p); + ++news; + } switch ( flow->flow_state ) { diff --git a/src/framework/module.h b/src/framework/module.h index 36e4a6679..60f9b1489 100644 --- a/src/framework/module.h +++ b/src/framework/module.h @@ -18,7 +18,6 @@ */ // module.h author Russ Combs -// FIXIT-H add brief help string to modules // FIXIT-H add optional default config to modules // FIXIT-M add trace param(s) // FIXIT-M add memcap related diff --git a/src/network_inspectors/binder/Makefile.am b/src/network_inspectors/binder/Makefile.am index ee67ee13c..cf50a91a2 100644 --- a/src/network_inspectors/binder/Makefile.am +++ b/src/network_inspectors/binder/Makefile.am @@ -1,8 +1,10 @@ AUTOMAKE_OPTIONS=foreign no-dependencies file_list = \ -binder.cc binder.h \ -bind_module.cc bind_module.h +binder.cc \ +binding.h \ +bind_module.cc \ +bind_module.h #if STATIC_INSPECTORS noinst_LIBRARIES = libbinder.a diff --git a/src/network_inspectors/binder/bind_module.cc b/src/network_inspectors/binder/bind_module.cc index 4e77e2da4..7addfb1a6 100644 --- a/src/network_inspectors/binder/bind_module.cc +++ b/src/network_inspectors/binder/bind_module.cc @@ -27,8 +27,9 @@ #include using namespace std; -#include "binder.h" +#include "binding.h" #include "protocols/packet.h" +#include "parser/parse_ip.h" THREAD_LOCAL BindStats bstats; @@ -47,7 +48,9 @@ static const char* bind_pegs[] = static const Parameter binder_when_params[] = { - { "policy_id", Parameter::PT_STRING, nullptr, nullptr, + // FIXIT when.policy_id should be an arbitrary string auto converted + // into index for binder matching and lookups + { "policy_id", Parameter::PT_INT, "0:", nullptr, "unique ID for selection of this config by external logic" }, { "vlans", Parameter::PT_BIT_LIST, "4095", nullptr, @@ -79,9 +82,6 @@ static const Parameter binder_use_params[] = { "file", Parameter::PT_STRING, nullptr, nullptr, "use configuration in given file" }, - { "policy_id", Parameter::PT_STRING, nullptr, nullptr, - "use configuration in given policy" }, - { "service", Parameter::PT_STRING, nullptr, nullptr, "override automatic service identification" }, @@ -120,21 +120,18 @@ ProfileStats* BinderModule::get_profile() const bool BinderModule::set(const char* fqn, Value& v, SnortConfig*) { // both - if ( !strcmp(fqn, "binder.when.policy_id") ) - work->when_id = v.get_string(); - - else if ( !strcmp(fqn, "binder.use.policy_id") ) - work->use_id = v.get_string(); - - else if ( !strcmp(fqn, "binder.when.service") ) - work->when_svc = v.get_string(); + if ( !strcmp(fqn, "binder.when.service") ) + work->when.svc = v.get_string(); else if ( !strcmp(fqn, "binder.use.service") ) - work->use_svc = v.get_string(); + work->use.svc = v.get_string(); // when + else if ( v.is("policy_id") ) + work->when.id = v.get_long(); + else if ( v.is("nets") ) - work->nets = v.get_string(); + work->when.nets = sfip_var_from_string(v.get_string()); else if ( v.is("proto") ) { @@ -142,29 +139,29 @@ bool BinderModule::set(const char* fqn, Value& v, SnortConfig*) { PROTO_BIT__ALL, PROTO_BIT__IP, PROTO_BIT__ICMP, PROTO_BIT__TCP, PROTO_BIT__UDP }; - work->protos = mask[v.get_long()]; + work->when.protos = mask[v.get_long()]; } else if ( v.is("ports") ) - v.get_bits(work->ports); + v.get_bits(work->when.ports); else if ( v.is("role") ) - work->role = (BindRole)v.get_long(); + work->when.role = (BindRole)v.get_long(); else if ( v.is("vlans") ) - v.get_bits(work->vlans); + v.get_bits(work->when.vlans); // use else if ( v.is("action") ) - work->action = (BindAction)(v.get_long() + 1); + work->use.action = (BindAction)(v.get_long() + 1); else if ( v.is("file") ) - work->file = v.get_string(); + work->use.file = v.get_string(); else if ( v.is("name") ) - work->name = v.get_string(); + work->use.name = v.get_string(); else if ( v.is("type") ) - work->type = v.get_string(); + work->use.type = v.get_string(); else return false; diff --git a/src/network_inspectors/binder/binder.cc b/src/network_inspectors/binder/binder.cc index 3c5849bb6..1c5425001 100644 --- a/src/network_inspectors/binder/binder.cc +++ b/src/network_inspectors/binder/binder.cc @@ -18,11 +18,10 @@ */ // binder.cc author Russ Combs -#include "binder.h" - #include using namespace std; +#include "binding.h" #include "bind_module.h" #include "flow/flow.h" #include "framework/inspector.h" @@ -39,17 +38,93 @@ using namespace std; THREAD_LOCAL ProfileStats bindPerfStats; //------------------------------------------------------------------------- -// helpers +// binding //------------------------------------------------------------------------- Binding::Binding() { - role = BR_EITHER; - protos = PROTO_BIT__ALL; - action = BA_INSPECT; - ports.set(); + when.nets = nullptr; + when.protos = PROTO_BIT__ALL; + + when.vlans.set(); + when.ports.set(); + + when.role = BR_EITHER; + use.action = BA_INSPECT; +} + +Binding::~Binding() +{ + if ( when.nets ) + sfvar_free(when.nets); +} + +bool Binding::check_policy(const Flow* flow) const +{ + if ( !when.id ) + return true; + + if ( when.id == flow->policy_id ) + return true; + + return false; +} + +bool Binding::check_addr(const Flow* flow) const +{ + if ( !when.nets ) + return true; + + if ( sfvar_ip_in(when.nets, &flow->client_ip) ) + return true; + + if ( sfvar_ip_in(when.nets, &flow->server_ip) ) + return true; + + return false; } +bool Binding::check_proto(const Flow* flow) const +{ + unsigned mask = when.protos; + unsigned bit = 0; + + switch ( flow->protocol ) + { + case IPPROTO_IP: bit = PROTO_BIT__IP; break; + case IPPROTO_ICMP: bit = PROTO_BIT__ICMP; break; + case IPPROTO_TCP: bit = PROTO_BIT__TCP; break; + case IPPROTO_UDP: bit = PROTO_BIT__UDP; break; + } + return ( mask & bit ) != 0; +} + +bool Binding::check_vlan(const Flow* flow) const +{ + unsigned v = flow->key->vlan_tag; + return when.vlans.test(v); +} + +bool Binding::check_port(const Flow* flow) const +{ + return when.ports.test(flow->server_port); +} + +bool Binding::check_service(const Flow* flow) const +{ + if ( !flow->service ) + return when.svc.empty(); + + if ( when.svc == flow->service ) + return true; + + return false; +} + +//------------------------------------------------------------------------- +// helpers +//------------------------------------------------------------------------- + // FIXIT-H bind this is a temporary hack. note that both ends must be set // independently and that we must ref count inspectors. static void set_session(Flow* flow, const char* key) @@ -71,25 +146,12 @@ static void set_session(Flow* flow) flow->clouseau = nullptr; } -static bool check_proto(const Flow* flow, unsigned mask) -{ - unsigned bit = 0; - - switch ( flow->protocol ) - { - case IPPROTO_IP: bit = PROTO_BIT__IP; break; - case IPPROTO_ICMP: bit = PROTO_BIT__ICMP; break; - case IPPROTO_TCP: bit = PROTO_BIT__TCP; break; - case IPPROTO_UDP: bit = PROTO_BIT__UDP; break; - } - return ( mask & bit ) != 0; -} - //------------------------------------------------------------------------- // class stuff //------------------------------------------------------------------------- -class Binder : public Inspector { +class Binder : public Inspector +{ public: Binder(vector); ~Binder(); @@ -100,15 +162,14 @@ public: void eval(Packet*); int exec(int, void*); - Inspector* find_inspector(const char*); - void add(Binding* b) { bindings.push_back(b); }; private: - Binding* get_binding(Flow*, Packet*); - BindAction apply(Flow*, Binding*); void init_flow(Flow*); + Binding* get_binding(const Flow*); + BindAction apply(Flow*, Binding*); + Inspector* find_inspector(const Flow*); private: vector bindings; @@ -129,7 +190,7 @@ void Binder::eval(Packet* p) { Flow* flow = p->flow; - Binding* pb = get_binding(flow, p); + Binding* pb = get_binding(flow); flow->flow_state = apply(flow, pb); ++bstats.verdicts[flow->flow_state - 1]; @@ -137,30 +198,21 @@ void Binder::eval(Packet* p) } // FIXIT-H implement inspector lookup from policy / bindings -Inspector* Binder::find_inspector(const char* s) +Inspector* Binder::find_inspector(const Flow* flow) { - Binding* pb; - unsigned i, sz = bindings.size(); + Binding* pb = get_binding(flow); - for ( i = 0; i < sz; i++ ) - { - pb = bindings[i]; - - if ( pb->when_svc == s ) - break; - } - - if ( i == sz ) + if ( !pb ) return nullptr; - Inspector* ins = InspectorManager::get_inspector(pb->type.c_str()); + Inspector* ins = InspectorManager::get_inspector(pb->use.type.c_str()); return ins; } int Binder::exec(int, void* pv) { Flow* flow = (Flow*)pv; - Inspector* ins = find_inspector(flow->service); + Inspector* ins = find_inspector(flow); if ( ins ) flow->set_gadget(ins); @@ -182,35 +234,49 @@ int Binder::exec(int, void* pv) return 0; } -// FIXIT-H bind services - this is a temporary hack that just looks at ports, -// need to examine all key fields for matching. ultimately need a routing -// table, scapegoat tree, etc. -Binding* Binder::get_binding(Flow* flow, Packet* p) +// FIXIT-L this is a simple linear search until functionality is nailed +// down. performance could be improved by breaking bindings up into +// multiple lists by proto and service or by using a more sophisticated +// approach like routing tables, avl or scapegoat tree, etc. +Binding* Binder::get_binding(const Flow* flow) { Binding* pb; unsigned i, sz = bindings.size(); - // FIXIT-H called before stream runs - these flags aren't set - // (below is structured to work by accident on initial syn until fixed) - Port port = (p->packet_flags & PKT_FROM_SERVER) ? p->sp : p->dp; - for ( i = 0; i < sz; i++ ) { pb = bindings[i]; - if ( !check_proto(flow, pb->protos) ) + // FIXIT-H file must be implemented and should not be in runtime + // list of bindings + if ( pb->use.file.size() ) + continue; + + if ( !pb->check_policy(flow) ) + continue; + + if ( !pb->check_vlan(flow) ) continue; - if ( pb->ports.test(port) ) - break; + // FIXIT-H need to check role and addr/ports relative to it + if ( !pb->check_addr(flow) ) + continue; + + if ( !pb->check_proto(flow) ) + continue; + + if ( !pb->check_port(flow) ) + continue; + + if ( !pb->check_service(flow) ) + continue; + + return pb; } // absent a specific rule, we must choose a course of action // so we act as if binder wasn't configured at all - if ( i == sz ) - return nullptr; - - return pb; + return nullptr; } BindAction Binder::apply(Flow* flow, Binding* pb) @@ -218,24 +284,24 @@ BindAction Binder::apply(Flow* flow, Binding* pb) if ( !pb ) return BA_ALLOW; - if ( pb->action != BA_INSPECT ) + if ( pb->use.action != BA_INSPECT ) { - if ( pb->action == BA_BLOCK ) + if ( pb->use.action == BA_BLOCK ) stream.drop_traffic(flow, SSN_DIR_BOTH); - return pb->action; + return pb->use.action; } init_flow(flow); Inspector* ins; - if ( !pb->type.size() || pb->type == "wizard" ) + if ( !pb->use.type.size() || pb->use.type == "wizard" ) { ins = InspectorManager::get_wizard(); flow->set_clouseau(ins); } else { - ins = InspectorManager::get_inspector(pb->type.c_str()); + ins = InspectorManager::get_inspector(pb->use.type.c_str()); flow->set_gadget(ins); } return BA_INSPECT; diff --git a/src/network_inspectors/binder/binder.h b/src/network_inspectors/binder/binding.h similarity index 74% rename from src/network_inspectors/binder/binder.h rename to src/network_inspectors/binder/binding.h index ecb076755..847a69be3 100644 --- a/src/network_inspectors/binder/binder.h +++ b/src/network_inspectors/binder/binding.h @@ -24,6 +24,9 @@ #include #include "framework/bits.h" +#include "sfip/sf_ipvar.h" + +class Flow; enum BindRole { @@ -39,26 +42,40 @@ enum BindAction BA_INSPECT }; -struct Binding +struct BindWhen { - // when - std::string when_id; - std::string when_svc; + unsigned id; + std::string svc; VlanList vlans; - std::string nets; + sfip_var_t* nets; unsigned protos; PortList ports; BindRole role; +}; - // use +struct BindUse +{ BindAction action; - std::string use_id; - std::string use_svc; + std::string svc; std::string type; std::string name; std::string file; +}; + +struct Binding +{ + BindWhen when; + BindUse use; Binding(); + ~Binding(); + + bool check_port(const Flow*) const; + bool check_vlan(const Flow*) const; + bool check_addr(const Flow*) const; + bool check_proto(const Flow*) const; + bool check_policy(const Flow*) const; + bool check_service(const Flow*) const; }; #endif diff --git a/src/stream/tcp/stream_paf.cc b/src/stream/tcp/stream_paf.cc index 17cca4464..ec7f983d1 100644 --- a/src/stream/tcp/stream_paf.cc +++ b/src/stream/tcp/stream_paf.cc @@ -158,8 +158,7 @@ static bool s5_paf_callback ( static inline bool s5_paf_eval ( StreamSplitter* ss, PAF_State* ps, Flow* ssn, - uint16_t, uint32_t flags, - const uint8_t* data, uint32_t len, FlushType* ft) + uint32_t flags, const uint8_t* data, uint32_t len, FlushType* ft) { DEBUG_WRAP(DebugMessage(DEBUG_STREAM_PAF, "%s: paf=%d, idx=%u, len=%u, fpt=%u\n", @@ -236,7 +235,7 @@ void s5_paf_clear (PAF_State* ps) uint32_t s5_paf_check ( StreamSplitter* ss, PAF_State* ps, Flow* ssn, const uint8_t* data, uint32_t len, uint32_t total, - uint32_t seq, uint16_t port, uint32_t* flags) + uint32_t seq, uint32_t* flags) { DEBUG_WRAP(DebugMessage(DEBUG_STREAM_PAF, "%s: len=%u, amt=%u, seq=%u, cur=%u, pos=%u, fpt=%u, tot=%u, paf=%d\n", @@ -276,7 +275,7 @@ uint32_t s5_paf_check ( uint32_t idx = s5_idx; uint32_t shift, fp; - bool cont = s5_paf_eval(ss, ps, ssn, port, *flags, data, len, &ft); + bool cont = s5_paf_eval(ss, ps, ssn, *flags, data, len, &ft); if ( ft != FT_NOP ) { diff --git a/src/stream/tcp/stream_paf.h b/src/stream/tcp/stream_paf.h index 5c1d1c599..68296a607 100644 --- a/src/stream/tcp/stream_paf.h +++ b/src/stream/tcp/stream_paf.h @@ -73,7 +73,7 @@ static inline uint32_t s5_paf_active (PAF_State* ps) uint32_t s5_paf_check( StreamSplitter* paf_config, PAF_State*, Flow* ssn, const uint8_t* data, uint32_t len, uint32_t total, - uint32_t seq, uint16_t port, uint32_t* flags); + uint32_t seq, uint32_t* flags); #endif diff --git a/src/stream/tcp/tcp_session.cc b/src/stream/tcp/tcp_session.cc index ef436a189..1f06d2eaa 100644 --- a/src/stream/tcp/tcp_session.cc +++ b/src/stream/tcp/tcp_session.cc @@ -311,12 +311,6 @@ THREAD_LOCAL Memcap* tcp_memcap = nullptr; #define STREAM5_DEBUG_WRAP(x) #endif -/* client/server ip/port dereference */ -#define tcp_client_ip flow->client_ip -#define tcp_client_port flow->client_port -#define tcp_server_ip flow->server_ip -#define tcp_server_port flow->server_port - #define SL_BUF_FLUSHED 1 struct TcpDataBlock @@ -768,13 +762,13 @@ static void PrintTcpSession(TcpSession *ts) char buf[64]; LogMessage("TcpSession:\n"); - sfip_ntop(&ts->tcp_server_ip, buf, sizeof(buf)); + sfip_ntop(&ts->flow->server_ip, buf, sizeof(buf)); LogMessage(" server IP: %s\n", buf); - sfip_ntop(&ts->tcp_client_ip, buf, sizeof(buf)); + sfip_ntop(&ts->flow->client_ip, buf, sizeof(buf)); LogMessage(" client IP: %s\n", buf); - LogMessage(" server port: %d\n", ts->tcp_server_port); - LogMessage(" client port: %d\n", ts->tcp_client_port); + LogMessage(" server port: %d\n", ts->flow->server_port); + LogMessage(" client port: %d\n", ts->flow->client_port); LogMessage(" flags: 0x%X\n", ts->flow->s5_state.session_flags); @@ -2626,7 +2620,7 @@ static void TraceSession (const Flow* lws) { fprintf(stdout, " LWS: ST=0x%x SF=0x%x CP=%u SP=%u\n", (unsigned)lws->session_state, lws->s5_state.session_flags, - (unsigned)ntohs(lws->client_port), (unsigned)ntohs(lws->server_port) + lws->client_port, lws->server_port ); } @@ -4720,10 +4714,6 @@ static int ProcessTcp( "session direction.\n");); /* SYN packet from client */ lwssn->s5_state.direction = FROM_CLIENT; - sfip_copy(lwssn->client_ip, p->ip_api.get_src()); - lwssn->client_port = p->tcph->th_sport; - sfip_copy(lwssn->server_ip, p->ip_api.get_dst()); - lwssn->server_port = p->tcph->th_dport; lwssn->session_state |= STREAM5_STATE_SYN; if (require3Way || (Stream5PacketHasWscale(p) & TF_WSCALE) || @@ -4755,10 +4745,6 @@ static int ProcessTcp( "Stream5 SYN|ACK PACKET, establishing lightweight" "session direction.\n");); lwssn->s5_state.direction = FROM_SERVER; - sfip_copy(lwssn->client_ip, p->ip_api.get_dst()); - lwssn->client_port = p->tcph->th_dport; - sfip_copy(lwssn->server_ip, p->ip_api.get_src()); - lwssn->server_port = p->tcph->th_sport; } lwssn->session_state |= STREAM5_STATE_SYN_ACK; @@ -4788,21 +4774,10 @@ static int ProcessTcp( /* create session on data, need to figure out direction, etc */ /* Assume from client, can update later */ if (p->sp > p->dp) - { lwssn->s5_state.direction = FROM_CLIENT; - sfip_copy(lwssn->client_ip, p->ip_api.get_src()); - lwssn->client_port = p->tcph->th_sport; - sfip_copy(lwssn->server_ip, p->ip_api.get_dst()); - lwssn->server_port = p->tcph->th_dport; - } else - { lwssn->s5_state.direction = FROM_SERVER; - sfip_copy(lwssn->client_ip, p->ip_api.get_dst()); - lwssn->client_port = p->tcph->th_dport; - sfip_copy(lwssn->server_ip, p->ip_api.get_src()); - lwssn->server_port = p->tcph->th_sport; - } + lwssn->session_state |= STREAM5_STATE_MIDSTREAM; lwssn->s5_state.session_flags |= SSNFLAG_MIDSTREAM; @@ -4955,10 +4930,6 @@ static int ProcessTcp( !TCP_ISFLAGSET(p->tcph, TH_ACK)) { lwssn->s5_state.direction = FROM_CLIENT; - sfip_copy(lwssn->client_ip, p->ip_api.get_src()); - lwssn->client_port = p->tcph->th_sport; - sfip_copy(lwssn->server_ip, p->ip_api.get_dst()); - lwssn->server_port = p->tcph->th_dport; lwssn->session_state = STREAM5_STATE_SYN; lwssn->set_ttl(p, true); NewTcpSession(p, lwssn, tdb, config); @@ -4974,10 +4945,6 @@ static int ProcessTcp( else if (TCP_ISFLAGSET(p->tcph, (TH_SYN|TH_ACK))) { lwssn->s5_state.direction = FROM_SERVER; - sfip_copy(lwssn->client_ip, p->ip_api.get_dst()); - lwssn->client_port = p->tcph->th_dport; - sfip_copy(lwssn->server_ip, p->ip_api.get_src()); - lwssn->server_port = p->tcph->th_sport; lwssn->session_state = STREAM5_STATE_SYN_ACK; lwssn->set_ttl(p, false); NewTcpSession(p, lwssn, tdb, config); @@ -5826,7 +5793,6 @@ static inline uint32_t flush_pdu_ips ( TcpSession* ssn, StreamTracker* trk, Packet* pkt, uint32_t* flags) { bool to_srv = ( *flags == PKT_FROM_CLIENT ); - uint16_t srv_port = ( to_srv ? pkt->dp : pkt->sp ); uint32_t total = 0, avail; StreamSegment* seg; PROFILE_VARS; @@ -5853,7 +5819,7 @@ static inline uint32_t flush_pdu_ips ( flush_pt = s5_paf_check( trk->splitter, &trk->paf_state, ssn->flow, - seg->payload, size, total, seg->seq, srv_port, flags); + seg->payload, size, total, seg->seq, flags); if ( flush_pt > 0 ) { @@ -5966,7 +5932,6 @@ static inline uint32_t flush_pdu_ackd ( TcpSession* ssn, StreamTracker* trk, Packet* pkt, uint32_t* flags) { bool to_srv = ( *flags == PKT_FROM_CLIENT ); - uint16_t srv_port = ( to_srv ? pkt->sp : pkt->dp ); uint32_t total = 0; StreamSegment* seg; PROFILE_VARS; @@ -5997,7 +5962,7 @@ static inline uint32_t flush_pdu_ackd ( flush_pt = s5_paf_check( trk->splitter, &trk->paf_state, ssn->flow, - seg->payload, size, total, seg->seq, srv_port, flags); + seg->payload, size, total, seg->seq, flags); if ( flush_pt > 0 ) { @@ -6196,7 +6161,7 @@ int GetTcpRebuiltPackets(Packet *p, Flow *ssn, /* StreamTracker is the opposite of the ip of the reassembled * packet --> it came out the queue for the other side */ - if (sfip_equals(p->ip_api.get_src(), &tcpssn->tcp_client_ip)) + if (sfip_equals(p->ip_api.get_src(), &tcpssn->flow->client_ip)) { st = &tcpssn->server; } @@ -6244,7 +6209,7 @@ int GetTcpStreamSegments(Packet *p, Flow *ssn, /* StreamTracker is the opposite of the ip of the reassembled * packet --> it came out the queue for the other side */ - if (sfip_equals(p->ip_api.get_src(), &tcpssn->tcp_client_ip)) + if (sfip_equals(p->ip_api.get_src(), &tcpssn->flow->client_ip)) st = &tcpssn->server; else st = &tcpssn->client; @@ -6283,7 +6248,7 @@ int Stream5AddSessionAlertTcp( Stream5AlertInfo* ai; TcpSession *tcpssn = (TcpSession*)lwssn->session; - if (sfip_equals(p->ip_api.get_src(),&tcpssn->tcp_client_ip)) + if (sfip_equals(p->ip_api.get_src(),&tcpssn->flow->client_ip)) { st = &tcpssn->server; } @@ -6321,7 +6286,7 @@ int Stream5CheckSessionAlertTcp(Flow *lwssn, Packet *p, uint32_t gid, uint32_t s return 0; } - if (sfip_equals(p->ip_api.get_src(), &tcpssn->tcp_client_ip)) + if (sfip_equals(p->ip_api.get_src(), &tcpssn->flow->client_ip)) { st = &tcpssn->server; } @@ -6355,7 +6320,7 @@ int Stream5UpdateSessionAlertTcp ( uint32_t seq_num; TcpSession *tcpssn = (TcpSession*)lwssn->session; - if (sfip_equals(p->ip_api.get_src(), &tcpssn->tcp_client_ip)) + if (sfip_equals(p->ip_api.get_src(), &tcpssn->flow->client_ip)) { st = &tcpssn->server; } @@ -6390,7 +6355,7 @@ void Stream5SetExtraDataTcp (Flow* lwssn, Packet* p, uint32_t xid) StreamTracker *st; TcpSession *tcpssn = (TcpSession*)lwssn->session; - if (sfip_equals(p->ip_api.get_src(),&tcpssn->tcp_client_ip)) + if (sfip_equals(p->ip_api.get_src(),&tcpssn->flow->client_ip)) st = &tcpssn->server; else st = &tcpssn->client; @@ -6403,7 +6368,7 @@ void Stream5ClearExtraDataTcp (Flow* lwssn, Packet* p, uint32_t xid) StreamTracker *st; TcpSession *tcpssn = (TcpSession*)lwssn->session; - if (sfip_equals(p->ip_api.get_src(),&tcpssn->tcp_client_ip)) + if (sfip_equals(p->ip_api.get_src(),&tcpssn->flow->client_ip)) st = &tcpssn->server; else st = &tcpssn->client; @@ -6636,7 +6601,7 @@ void TcpSession::update_direction( uint16_t tmpPort; StreamTracker tmpTracker; - if (sfip_equals(&tcp_client_ip, ip) && (tcp_client_port == port)) + if (sfip_equals(&flow->client_ip, ip) && (flow->client_port == port)) { if ((dir == SSN_DIR_CLIENT) && (flow->s5_state.direction == SSN_DIR_CLIENT)) { @@ -6644,7 +6609,7 @@ void TcpSession::update_direction( return; } } - else if (sfip_equals(&tcp_server_ip, ip) && (tcp_server_port == port)) + else if (sfip_equals(&flow->server_ip, ip) && (flow->server_port == port)) { if ((dir == SSN_DIR_SERVER) && (flow->s5_state.direction == SSN_DIR_SERVER)) { @@ -6656,12 +6621,12 @@ void TcpSession::update_direction( /* Swap them -- leave flow->s5_state.direction the same */ /* XXX: Gotta be a more efficient way to do this without the memcpy */ - tmpIp = tcp_client_ip; - tmpPort = tcp_client_port; - tcp_client_ip = tcp_server_ip; - tcp_client_port = tcp_server_port; - tcp_server_ip = tmpIp; - tcp_server_port = tmpPort; + tmpIp = flow->client_ip; + tmpPort = flow->client_port; + flow->client_ip = flow->server_ip; + flow->client_port = flow->server_port; + flow->server_ip = tmpIp; + flow->server_port = tmpPort; #ifdef HAVE_DAQ_ADDRESS_SPACE_ID SwapPacketHeaderFoo(this); diff --git a/src/stream/udp/udp_session.cc b/src/stream/udp/udp_session.cc index 4213d17ee..0da66c81d 100644 --- a/src/stream/udp/udp_session.cc +++ b/src/stream/udp/udp_session.cc @@ -45,11 +45,8 @@ #include "perf_monitor/perf.h" #include "profiler.h" -/* sender/responder ip/port dereference */ -#define udp_sender_ip flow->client_ip -#define udp_sender_port flow->client_port -#define udp_responder_ip flow->server_ip -#define udp_responder_port flow->server_port +// NOTE: sender is assumed to be client +// responder is assumed to be server THREAD_LOCAL SessionStats udpStats; THREAD_LOCAL ProfileStats udp_perf_stats; @@ -156,10 +153,6 @@ bool UdpSession::setup(Packet* p) &flow->server_ip, SFS_STATE_UDP_CREATED); flow->s5_state.direction = FROM_SENDER; - sfip_copy(flow->client_ip, p->ip_api.get_src()); - flow->client_port = p->udph->uh_sport; - sfip_copy(flow->server_ip, p->ip_api.get_dst()); - flow->server_port = p->udph->uh_dport; if ( flow_con->expected_flow(flow, p) ) return false; @@ -179,7 +172,7 @@ void UdpSession::update_direction( sfip_t tmpIp; uint16_t tmpPort; - if (sfip_equals(&udp_sender_ip, ip) && (udp_sender_port == port)) + if (sfip_equals(&flow->client_ip, ip) && (flow->client_port == port)) { if ((dir == SSN_DIR_SENDER) && (flow->s5_state.direction == SSN_DIR_SENDER)) { @@ -187,7 +180,7 @@ void UdpSession::update_direction( return; } } - else if (sfip_equals(&udp_responder_ip, ip) && (udp_responder_port == port)) + else if (sfip_equals(&flow->server_ip, ip) && (flow->server_port == port)) { if ((dir == SSN_DIR_RESPONDER) && (flow->s5_state.direction == SSN_DIR_RESPONDER)) { @@ -197,12 +190,12 @@ void UdpSession::update_direction( } /* Swap them -- leave flow->s5_state.direction the same */ - tmpIp = udp_sender_ip; - tmpPort = udp_sender_port; - udp_sender_ip = udp_responder_ip; - udp_sender_port = udp_responder_port; - udp_responder_ip = tmpIp; - udp_responder_port = tmpPort; + tmpIp = flow->client_ip; + tmpPort = flow->client_port; + flow->client_ip = flow->server_ip; + flow->client_port = flow->server_port; + flow->server_ip = tmpIp; + flow->server_port = tmpPort; } int UdpSession::process(Packet *p)