From: Josh Date: Mon, 28 Apr 2014 21:06:39 +0000 (-0400) Subject: ethertype's mapped to array of Codecs X-Git-Tag: 3.0.0-233~1542^2~12 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d7e585869f010f253ec00687e5c830ca4d2ed190;p=thirdparty%2Fsnort3.git ethertype's mapped to array of Codecs --- diff --git a/src/codecs/CMakeLists.txt b/src/codecs/CMakeLists.txt index faaaa1ca8..403deb021 100644 --- a/src/codecs/CMakeLists.txt +++ b/src/codecs/CMakeLists.txt @@ -19,8 +19,6 @@ endif(ENABLE_NON_ETHER_DECODERS) add_library( codecs STATIC - codec_events.cc - codec_events.h encode.h encode.cc decode.h @@ -29,8 +27,6 @@ add_library( codecs STATIC decode_module.cc codec_api.h codec_api.cc - codec_stats.h - codec_stats.cc ) diff --git a/src/codecs/basic/CMakeLists.txt b/src/codecs/basic/CMakeLists.txt index 404d3c44f..ba4205201 100644 --- a/src/codecs/basic/CMakeLists.txt +++ b/src/codecs/basic/CMakeLists.txt @@ -9,10 +9,12 @@ add_library( basic_codecs STATIC cd_tcp.cc cd_udp.cc cd_eth.cc - cd_esp.cc # Incluse esp here because it MUST be statically linked due to its dependance on the packet manager + cd_esp.cc # due to its dependance on the packet manager, esp must be statically linked. + cd_null.cc ) target_link_libraries( basic_codecs protocols framework + events ) diff --git a/src/codecs/basic/cd_esp.cc b/src/codecs/basic/cd_esp.cc index ce70f1025..650bfc21a 100644 --- a/src/codecs/basic/cd_esp.cc +++ b/src/codecs/basic/cd_esp.cc @@ -37,10 +37,11 @@ namespace class EspCodec : public Codec { public: - EspCodec() : Codec("ESP"){}; + EspCodec() : Codec("esp"){}; ~EspCodec(){}; + virtual void get_protocol_ids(std::vector& v); virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, Packet *, uint16_t &lyr_len, int &next_prot_id); @@ -53,22 +54,14 @@ const uint32_t ESP_HEADER_LEN = 8; const uint32_t ESP_AUTH_DATA_LEN = 12; const uint32_t ESP_TRAILER_LEN = 2; -struct CdPegs{ - PegCount processed = 0; - PegCount discards = 0; -}; - -std::vector peg_names = -{ - "NameCodec_processed", - "NameCodec_discards", -}; +} // anonymous namespace -} // anonymous namespace -static THREAD_LOCAL CdPegs counts; -static CdPegs gcounts; +void EspCodec::get_protocol_ids(std::vector& v) +{ + v.push_back(ESP_PROT_ID); +} @@ -153,11 +146,6 @@ bool EspCodec::decode(const uint8_t *raw_pkt, const uint32_t len, return true; } -static void get_protocol_ids(std::vector& v) -{ - v.push_back(ESP_PROT_ID); -} - static Codec* ctor() { return new EspCodec(); @@ -168,18 +156,23 @@ static void dtor(Codec *cd) delete cd; } -static const char* name = "esp_codec"; +static const char* name = "esp"; static const CodecApi esp_api = { - { PT_CODEC, name, CDAPI_PLUGIN_V0, 0, nullptr, nullptr }, + { + PT_CODEC, + name, + CDAPI_PLUGIN_V0, + 0, + nullptr, + nullptr, + }, NULL, // pinit NULL, // pterm NULL, // tinit NULL, // tterm ctor, // ctor dtor, // dtor - NULL, // get_dlt() - get_protocol_ids, }; diff --git a/src/codecs/basic/cd_eth.cc b/src/codecs/basic/cd_eth.cc index ac81d9bdb..312b41290 100644 --- a/src/codecs/basic/cd_eth.cc +++ b/src/codecs/basic/cd_eth.cc @@ -38,10 +38,12 @@ namespace class EthCodec : public Codec { public: - EthCodec() : Codec("Eth"){}; + EthCodec() : Codec("eth"){}; ~EthCodec(){}; + virtual void get_protocol_ids(std::vector& v) {}; + virtual void get_data_link_type(std::vector&); virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, Packet *p, uint16_t &lyr_len, int &next_prot_id); @@ -54,6 +56,11 @@ public: } // anonymous +void EthCodec::get_data_link_type(std::vector&v) +{ + v.push_back(DLT_EN10MB); +} + //-------------------------------------------------------------------- // decode.c::Ethernet @@ -210,12 +217,6 @@ void Eth_Format (EncodeFlags f, const Packet* p, Packet* c, Layer* lyr) // api //------------------------------------------------------------------------- -static void get_data_link_type(std::vector&v) -{ - v.push_back(DLT_EN10MB); -} - - static Codec* ctor() { return new EthCodec(); @@ -226,19 +227,23 @@ static void dtor(Codec *cd) delete cd; } -static const char* name = "eth_codec"; - +static const char* name = "eth"; static const CodecApi eth_api = { - { PT_CODEC, name, CDAPI_PLUGIN_V0, 0, nullptr, nullptr }, - NULL, // pinit - NULL, // pterm - NULL, // tinit - NULL, // tterm + { + PT_CODEC, + name, + CDAPI_PLUGIN_V0, + 0, + nullptr, + nullptr, + }, + nullptr, // pinit + nullptr, // pterm + nullptr, // tinit + nullptr, // tterm ctor, // ctor dtor, // dtor - get_data_link_type, - NULL, }; const BaseApi* cd_eth = ð_api.base; diff --git a/src/codecs/basic/cd_icmp4.cc b/src/codecs/basic/cd_icmp4.cc index aa2df3cfe..19a888349 100644 --- a/src/codecs/basic/cd_icmp4.cc +++ b/src/codecs/basic/cd_icmp4.cc @@ -49,6 +49,7 @@ public: Icmp4Codec() : Codec("icmp4"){}; ~Icmp4Codec() {}; + virtual void get_protocol_ids(std::vector&); virtual bool decode(const uint8_t* raw_packet, const uint32_t raw_len, Packet *p, uint16_t &lyr_len, int &next_prot_id); @@ -68,6 +69,11 @@ private: } // namespace +void Icmp4Codec::get_protocol_ids(std::vector &v) +{ + v.push_back(IPPROTO_ICMP); +} + @@ -554,24 +560,23 @@ static void dtor(Codec *cd) delete cd; } -static void get_protocol_ids(std::vector &proto_ids) -{ - proto_ids.push_back(IPPROTO_ICMP); -} - -static const char* name = "icmp4_codec"; - +static const char* name = "icmp4"; static const CodecApi icmp4_api = { - { PT_CODEC, name, CDAPI_PLUGIN_V0, 0, nullptr, nullptr }, + { + PT_CODEC, + name, + CDAPI_PLUGIN_V0, + 0, + nullptr, + nullptr + }, NULL, // pinit NULL, // pterm NULL, // tinit NULL, // tterm ctor, // ctor dtor, // dtor - NULL, - get_protocol_ids, }; diff --git a/src/codecs/basic/cd_icmp6.cc b/src/codecs/basic/cd_icmp6.cc index ed769145d..37aab6206 100644 --- a/src/codecs/basic/cd_icmp6.cc +++ b/src/codecs/basic/cd_icmp6.cc @@ -39,13 +39,15 @@ namespace class Icmp6Codec : public Codec { public: - Icmp6Codec() : Codec("Icmp6"){}; + Icmp6Codec() : Codec("icmp6"){}; ~Icmp6Codec(){}; + virtual void get_protocol_ids(std::vector& v); virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, Packet *, uint16_t &lyr_len, int &next_prot_id); + // DELETE from here and below #include "codecs/sf_protocols.h" virtual inline PROTO_ID get_proto_id() { return PROTO_ICMP6; }; @@ -57,6 +59,12 @@ public: } // anonymous namespace +void Icmp6Codec::get_protocol_ids(std::vector& v) +{ + v.push_back(IPPROTO_ICMPV6); +} + + static void DecodeICMPEmbeddedIP6(const uint8_t *pkt, const uint32_t len, Packet *p); static unsigned short in_chksum_icmp6(pseudoheader6 *, unsigned short *, int); @@ -597,11 +605,6 @@ static unsigned short in_chksum_icmp6(pseudoheader6 *ph, } -static void get_protocol_ids(std::vector& v) -{ - v.push_back(IPPROTO_ICMPV6); -} - static Codec* ctor() { return new Icmp6Codec(); @@ -612,19 +615,24 @@ static void dtor(Codec *cd) delete cd; } -static const char* name = "icmp6_codec"; +static const char* name = "icmp6"; static const CodecApi ipv6_api = { - { PT_CODEC, name, CDAPI_PLUGIN_V0, 0, nullptr, nullptr }, + { + PT_CODEC, + name, + CDAPI_PLUGIN_V0, + 0, + nullptr, + nullptr, + }, NULL, // pinit NULL, // pterm NULL, // tinit NULL, // tterm ctor, // ctor dtor, // dtor - NULL, - get_protocol_ids }; diff --git a/src/codecs/basic/cd_ipv4.cc b/src/codecs/basic/cd_ipv4.cc index 706762771..1b64e2d8b 100644 --- a/src/codecs/basic/cd_ipv4.cc +++ b/src/codecs/basic/cd_ipv4.cc @@ -51,6 +51,7 @@ public: Ipv4Codec() : Codec("ipv4"){}; ~Ipv4Codec(){}; + virtual void get_protocol_ids(std::vector& v); virtual bool decode(const uint8_t *raw_packet, const uint32_t len, Packet *, uint16_t &lyr_len, int &next_prot_id); @@ -91,6 +92,12 @@ static inline unsigned short in_chksum_ip( unsigned short *, int); static void DecodeIPOptions(const uint8_t *start, uint32_t o_len, Packet *p); +void Ipv4Codec::get_protocol_ids(std::vector& v) +{ + v.push_back(ipv4::ethertype_ip()); + v.push_back(ipv4::prot_id()); +} + //-------------------------------------------------------------------- // prot_ipv4.cc::IP4 decoder //-------------------------------------------------------------------- @@ -984,25 +991,23 @@ static void dtor(Codec *cd) } -static void get_protocol_ids(std::vector& v) -{ - v.push_back(ipv4::ethertype_ip()); - v.push_back(ipv4::prot_id()); -} - -static const char* name = "ipv4_decode"; - +static const char* name = "ipv4"; static const CodecApi ipv4_api = { - { PT_CODEC, name, CDAPI_PLUGIN_V0, 0, nullptr, nullptr }, + { + PT_CODEC, + name, + CDAPI_PLUGIN_V0, + 0, + nullptr, + nullptr + }, ipv4_codec_ginit, // pinit ipv4_codec_gterm, // pterm NULL, // tinit NULL, // tterm ctor, // ctor dtor, // dtor - NULL, - get_protocol_ids, }; diff --git a/src/codecs/basic/cd_ipv6.cc b/src/codecs/basic/cd_ipv6.cc index 3a927ac96..5491d4d5b 100644 --- a/src/codecs/basic/cd_ipv6.cc +++ b/src/codecs/basic/cd_ipv6.cc @@ -1,5 +1,3 @@ -/* $Id: decode.c,v 1.285 2013-06-29 03:03:00 rcombs Exp $ */ - /* ** Copyright (C) 2002-2013 Sourcefire, Inc. ** Copyright (C) 1998-2002 Martin Roesch @@ -42,6 +40,7 @@ public: Ipv6Codec() : Codec("ipv6"){}; ~Ipv6Codec(){}; + virtual void get_protocol_ids(std::vector& v); virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, Packet *, uint16_t &lyr_len, int &next_prot_id); @@ -62,6 +61,11 @@ static inline int IPV6ExtensionOrder(uint8_t type); static void CheckIPV6Multicast(Packet *p); static inline int CheckTeredoPrefix(ipv6::IP6RawHdr *hdr); +void Ipv6Codec::get_protocol_ids(std::vector& v) +{ + v.push_back(ipv6::ethertype()); + v.push_back(ipv6::prot_id()); +} //-------------------------------------------------------------------- // decode.c::IP6 decoder @@ -983,11 +987,6 @@ EncStatus Opt6_Update (Packet* p, Layer* lyr, uint32_t* len) // api //------------------------------------------------------------------------- -static void get_protocol_ids(std::vector& v) -{ - v.push_back(ipv6::ethertype()); - v.push_back(ipv6::prot_id()); -} static Codec* ctor() { @@ -999,18 +998,23 @@ static void dtor(Codec *cd) delete cd; } -static const char* name = "ipv6_codec"; +static const char* name = "ipv6"; static const CodecApi ipv6_api = { - { PT_CODEC, name, CDAPI_PLUGIN_V0, 0, nullptr, nullptr }, + { + PT_CODEC, + name, + CDAPI_PLUGIN_V0, + 0, + nullptr, + nullptr, + }, NULL, // pinit NULL, // pterm NULL, // tinit NULL, // tterm ctor, // ctor dtor, // dtor - NULL, - get_protocol_ids, }; diff --git a/src/codecs/plugins/cd_none.cc b/src/codecs/basic/cd_null.cc similarity index 59% rename from src/codecs/plugins/cd_none.cc rename to src/codecs/basic/cd_null.cc index a836d6024..e1cbae62c 100644 --- a/src/codecs/plugins/cd_none.cc +++ b/src/codecs/basic/cd_null.cc @@ -1,5 +1,3 @@ -/* $Id: decode.c,v 1.285 2013-06-29 03:03:00 rcombs Exp $ */ - /* ** Copyright (C) 2002-2013 Sourcefire, Inc. ** Copyright (C) 1998-2002 Martin Roesch @@ -19,56 +17,53 @@ ** along with this program; if not, write to the Free Software ** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */ +// cd_null.cc author Josh Rosenbaum #ifdef HAVE_CONFIG_H #include "config.h" #endif -#if 0 - -#ifdef HAVE_DUMBNET_H -#include -#else -#include -#endif -#endif #include "framework/codec.h" #include "events/codec_events.h" +#include "codecs/decode_module.h" + namespace { -class NameCodec : public Codec +class NullCodec : public Codec { public: - NameCodec() : Codec("NAME"){}; - ~NameCodec(); - + NullCodec() : Codec("null"){}; + ~NullCodec(){}; + virtual void get_protocol_ids(std::vector& v); virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, - Packet *, uint16_t &lyr_len, int &next_prot_id); - - virtual void get_protocol_ids(std::vector&); - virtual void get_data_link_type(std::vector&){}; - + Packet *, uint16_t &lyr_len, int &next_prot_id) { return false; }; + virtual inline bool is_default_codec() { return true; }; }; -} // anonymous namespace +} // namespace + + + +//------------------------------------------------------------------------- +// api +//------------------------------------------------------------------------- -void NameCodec::get_protocol_ids(std::vector& v) +void NullCodec::get_protocol_ids(std::vector& v) { - v.push_back(ipv6::ethertype()); - v.push_back(IPPROTO_IPV6); + // placeholder to avoid error } static Codec* ctor() { - return new NameCodec(); + return new NullCodec(); } static void dtor(Codec *cd) @@ -76,11 +71,18 @@ static void dtor(Codec *cd) delete cd; } -static const char* name = "name_codec"; -static const CodecApi ipv6_api = +static const char* name = "null"; +static const CodecApi null_api = { - { PT_CODEC, name, CDAPI_PLUGIN_V0, 0 }, + { + PT_CODEC, + name, + CDAPI_PLUGIN_V0, + 0, + nullptr, + nullptr, + }, NULL, // pinit NULL, // pterm NULL, // tinit @@ -89,3 +91,4 @@ static const CodecApi ipv6_api = dtor, // dtor }; +const BaseApi* cd_null = &null_api.base; diff --git a/src/codecs/basic/cd_tcp.cc b/src/codecs/basic/cd_tcp.cc index 17964a022..6c082cc3f 100644 --- a/src/codecs/basic/cd_tcp.cc +++ b/src/codecs/basic/cd_tcp.cc @@ -50,16 +50,18 @@ namespace class TcpCodec : public Codec { public: - TcpCodec() : Codec("Tcp") + TcpCodec() : Codec("tcp") { }; virtual ~TcpCodec(){}; + virtual void get_protocol_ids(std::vector& v); virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, Packet *, uint16_t &lyr_len, int &next_prot_id); + // DELETE #include "codecs/sf_protocols.h" virtual inline PROTO_ID get_proto_id() { return PROTO_TCP; }; @@ -86,6 +88,12 @@ static inline unsigned short in_chksum_tcp(pseudoheader *, unsigned short *, int static inline unsigned short in_chksum_tcp6(pseudoheader6 *, unsigned short *, int); +void TcpCodec::get_protocol_ids(std::vector& v) +{ + v.push_back(IPPROTO_TCP); +} + + /* * Function: DecodeTCP(uint8_t *, const uint32_t, Packet *) * @@ -1005,7 +1013,6 @@ static void tcp_codec_ginit() { SynToMulticastDstIp = IpAddrSetParse(snort_conf, "[232.0.0.0/8,233.0.0.0/8,239.0.0.0/8]"); - if( SynToMulticastDstIp == NULL ) FatalError("Could not initialize SynToMulticastDstIp\n"); @@ -1031,24 +1038,23 @@ static void dtor(Codec *cd) delete cd; } -void get_protocol_ids(std::vector& v) -{ - v.push_back(IPPROTO_TCP); -} - -static const char* name = "tcp_codec"; - +static const char* name = "tcp"; static const CodecApi tcp_api = { - { PT_CODEC, name, CDAPI_PLUGIN_V0, 0, nullptr, nullptr }, + { + PT_CODEC, + name, + CDAPI_PLUGIN_V0, + 0, + nullptr, + nullptr, + }, tcp_codec_ginit, // pinit tcp_codec_gterm, // pterm NULL, // tinit NULL, // tterm ctor, // ctor dtor, // dtor - NULL, - get_protocol_ids, }; const BaseApi* cd_tcp = &tcp_api.base; diff --git a/src/codecs/basic/cd_udp.cc b/src/codecs/basic/cd_udp.cc index 9b678ad67..5f8b06508 100644 --- a/src/codecs/basic/cd_udp.cc +++ b/src/codecs/basic/cd_udp.cc @@ -50,6 +50,7 @@ public: ~UdpCodec(){}; + virtual void get_protocol_ids(std::vector& v); virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, Packet *, uint16_t &lyr_len, int &next_prot_id); @@ -74,6 +75,12 @@ static inline unsigned short in_chksum_udp(pseudoheader *, unsigned short *, int +void UdpCodec::get_protocol_ids(std::vector& v) +{ + v.push_back(IPPROTO_UDP); +} + + bool UdpCodec::decode(const uint8_t *raw_pkt, const uint32_t len, Packet *p, uint16_t &lyr_len, int &next_prot_id) { @@ -599,12 +606,6 @@ static inline unsigned short in_chksum_udp(pseudoheader *ph, // api //------------------------------------------------------------------------- - -static void get_protocol_ids(std::vector& v) -{ - v.push_back(IPPROTO_UDP); -} - static Codec* ctor() { return new UdpCodec(); @@ -615,19 +616,24 @@ static void dtor(Codec *cd) delete cd; } -static const char* name = "udp_codec"; +static const char* name = "udp"; static const CodecApi udp_api = { - { PT_CODEC, name, CDAPI_PLUGIN_V0, 0, nullptr, nullptr }, - NULL, // pinit - NULL, // pterm - NULL, // tinit - NULL, // tterm + { + PT_CODEC, + name, + CDAPI_PLUGIN_V0, + 0, + nullptr, + nullptr + }, + nullptr, // pinit + nullptr, // pterm + nullptr, // tinit + nullptr, // tterm ctor, // ctor dtor, // dtor - NULL, - get_protocol_ids, }; diff --git a/src/codecs/codec_api.cc b/src/codecs/codec_api.cc index ee50e0b3c..b1ae3aa40 100644 --- a/src/codecs/codec_api.cc +++ b/src/codecs/codec_api.cc @@ -17,15 +17,44 @@ ** along with this program; if not, write to the Free Software ** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */ +// packet_manager.cc author Josh Rosenbaum + +#include "codec_api.h" #ifdef HAVE_CONFIG_H #include "config.h" #endif -#include "codec_api.h" #include "framework/codec.h" +extern const BaseApi* cd_eth; +extern const BaseApi* cd_ipv4; +extern const BaseApi* cd_ipv6; +extern const BaseApi* cd_icmp4; +extern const BaseApi* cd_icmp6; +extern const BaseApi* cd_tcp; +extern const BaseApi* cd_udp; +extern const BaseApi* cd_esp; +extern const BaseApi* cd_null; + +#ifdef STATIC_DECODERS +extern const BaseApi* cd_ah; +extern const BaseApi* cd_arp; +extern const BaseApi* cd_erspan2; +extern const BaseApi* cd_erspan3; +extern const BaseApi* cd_ethloopback; +extern const BaseApi* cd_gre; +extern const BaseApi* cd_gtp; +extern const BaseApi* cd_mpls; +extern const BaseApi* cd_pppencap; +extern const BaseApi* cd_pppoe; +extern const BaseApi* cd_swipe; +extern const BaseApi* cd_teredo; +extern const BaseApi* cd_transbridge; +extern const BaseApi* cd_vlan; +#endif + const BaseApi* codecs[] = { cd_eth, @@ -36,6 +65,7 @@ const BaseApi* codecs[] = cd_tcp, cd_udp, cd_esp, + cd_null, #ifdef STATIC_DECODERS cd_ah, diff --git a/src/codecs/codec_api.h b/src/codecs/codec_api.h index 45aa8f8d0..7e3f0b661 100644 --- a/src/codecs/codec_api.h +++ b/src/codecs/codec_api.h @@ -21,35 +21,7 @@ #ifndef CODECS_H #define CODECS_H -struct BaseApi; -extern const BaseApi* cd_eth; -extern const BaseApi* cd_ipv4; -extern const BaseApi* cd_ipv6; -extern const BaseApi* cd_icmp4; -extern const BaseApi* cd_icmp6; -extern const BaseApi* cd_tcp; -extern const BaseApi* cd_udp; -extern const BaseApi* cd_esp; - -#ifdef STATIC_DECODERS -extern const BaseApi* cd_ah; -extern const BaseApi* cd_arp; -extern const BaseApi* cd_erspan2; -extern const BaseApi* cd_erspan3; -extern const BaseApi* cd_ethloopback; -extern const BaseApi* cd_gre; -extern const BaseApi* cd_gtp; -extern const BaseApi* cd_mpls; -extern const BaseApi* cd_pppencap; -extern const BaseApi* cd_pppoe; -extern const BaseApi* cd_swipe; -extern const BaseApi* cd_teredo; -extern const BaseApi* cd_transbridge; -extern const BaseApi* cd_vlan; - -#endif - -extern const BaseApi* codecs[]; +extern const struct BaseApi* codecs[]; #endif diff --git a/src/codecs/plugins/CMakeLists.txt b/src/codecs/plugins/CMakeLists.txt index 320a6190b..9232726f6 100644 --- a/src/codecs/plugins/CMakeLists.txt +++ b/src/codecs/plugins/CMakeLists.txt @@ -16,4 +16,7 @@ add_library( codec_plugins STATIC cd_pppoepkt.cc ) +target_link_libraries( codec_plugins + events +) diff --git a/src/codecs/plugins/cd_ah.cc b/src/codecs/plugins/cd_ah.cc index 1c3f9b44f..8b4029ae0 100644 --- a/src/codecs/plugins/cd_ah.cc +++ b/src/codecs/plugins/cd_ah.cc @@ -39,6 +39,7 @@ public: ~AhCodec(){}; + virtual void get_protocol_ids(std::vector& v); virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, Packet *, uint16_t &lyr_len, int &next_prot_id); @@ -54,6 +55,11 @@ static const uint16_t AH_PROT_ID = 51; // RFC 4302 } // anonymous namespace +void AhCodec::get_protocol_ids(std::vector& v) +{ + v.push_back(AH_PROT_ID); +} + bool AhCodec::decode(const uint8_t *raw_pkt, const uint32_t len, Packet *p, uint16_t &lyr_len, int &next_prot_id) @@ -77,11 +83,6 @@ bool AhCodec::decode(const uint8_t *raw_pkt, const uint32_t len, // api //------------------------------------------------------------------------- -static void get_protocol_ids(std::vector& v) -{ - v.push_back(AH_PROT_ID); -} - static Codec* ctor() { return new AhCodec(); @@ -92,18 +93,23 @@ static void dtor(Codec *cd) delete cd; } -static const char* name = "ah_codec"; +static const char* name = "ah"; static const CodecApi ah_api = { - { PT_CODEC, name, CDAPI_PLUGIN_V0, 0 }, - NULL, // pinit - NULL, // pterm - NULL, // tinit - NULL, // tterm + { + PT_CODEC, + name, + CDAPI_PLUGIN_V0, + 0, + nullptr, + nullptr, + }, + nullptr, // pinit + nullptr, // pterm + nullptr, // tinit + nullptr, // tterm ctor, // ctor dtor, // dtor - nullptr, - get_protocol_ids, }; diff --git a/src/codecs/plugins/cd_arp.cc b/src/codecs/plugins/cd_arp.cc index 4dde063e9..e80216b76 100644 --- a/src/codecs/plugins/cd_arp.cc +++ b/src/codecs/plugins/cd_arp.cc @@ -34,10 +34,11 @@ namespace class ArpCodec : public Codec { public: - ArpCodec() : Codec("Arp"){}; + ArpCodec() : Codec("arp"){}; ~ArpCodec(){}; + virtual void get_protocol_ids(std::vector& v); virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, Packet *, uint16_t &lyr_len, int &next_prot_id); @@ -54,6 +55,12 @@ static const uint16_t ETHERNET_TYPE_ARP = 0x0806; +void ArpCodec::get_protocol_ids(std::vector& v) +{ + v.push_back(ETHERNET_TYPE_ARP); + v.push_back(ETHERNET_TYPE_REVARP); +} + //-------------------------------------------------------------------- // decode.c::ARP @@ -97,12 +104,10 @@ bool ArpCodec::decode(const uint8_t *raw_pkt, const uint32_t len, +//------------------------------------------------------------------------- +// api +//------------------------------------------------------------------------- -static void get_protocol_ids(std::vector& v) -{ - v.push_back(ETHERNET_TYPE_ARP); - v.push_back(ETHERNET_TYPE_REVARP); -} static Codec* ctor() { @@ -114,32 +119,23 @@ static void dtor(Codec *cd) delete cd; } -static void sum() -{ -// sum_stats((PegCount*)&gdc, (PegCount*)&dc, array_size(dc_pegs)); -// memset(&dc, 0, sizeof(dc)); -} - -static void stats() -{ -// show_percent_stats((PegCount*)&gdc, dc_pegs, array_size(dc_pegs), -// "decoder"); -} - - - -static const char* name = "arp_codec"; +static const char* name = "arp"; static const CodecApi arp_api = { - { PT_CODEC, name, CDAPI_PLUGIN_V0, 0 }, - NULL, // pinit - NULL, // pterm - NULL, // tinit - NULL, // tterm + { + PT_CODEC, + name, + CDAPI_PLUGIN_V0, + 0, + nullptr, + nullptr, + }, + nullptr, // pinit + nullptr, // pterm + nullptr, // tinit + nullptr, // tterm ctor, // ctor dtor, // dtor - NULL, // get_dlt - get_protocol_ids, }; #ifdef BUILDING_SO diff --git a/src/codecs/plugins/cd_dstopts.cc b/src/codecs/plugins/cd_dstopts.cc index 54bdfd3a3..8ad048d61 100644 --- a/src/codecs/plugins/cd_dstopts.cc +++ b/src/codecs/plugins/cd_dstopts.cc @@ -47,6 +47,7 @@ public: ~NameCodec(); + virtual void get_protocol_ids(std::vector& v); virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, Packet *, uint16_t &lyr_len, int &next_prot_id); diff --git a/src/codecs/plugins/cd_erspan2.cc b/src/codecs/plugins/cd_erspan2.cc index 4a83f1677..bd4151127 100644 --- a/src/codecs/plugins/cd_erspan2.cc +++ b/src/codecs/plugins/cd_erspan2.cc @@ -17,7 +17,7 @@ ** along with this program; if not, write to the Free Software ** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */ -// cd_esp.cc author Josh Rosenbaum +// cd_erspan2.cc author Josh Rosenbaum #include "framework/codec.h" @@ -31,9 +31,10 @@ namespace class Erspan2Codec : public Codec { public: - Erspan2Codec() : Codec("ERSPAN_2"){}; + Erspan2Codec() : Codec("erspan2"){}; ~Erspan2Codec(){}; + virtual void get_protocol_ids(std::vector& v); virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, Packet *, uint16_t &lyr_len, int &next_prot_id); @@ -53,7 +54,10 @@ struct ERSpanType2Hdr const uint16_t ETHERTYPE_ERSPAN_TYPE2 = 0x88be; } // namespace - +void Erspan2Codec::get_protocol_ids(std::vector& v) +{ + v.push_back(ETHERTYPE_ERSPAN_TYPE2); +} /* @@ -100,17 +104,15 @@ bool Erspan2Codec::decode(const uint8_t *raw_pkt, const uint32_t len, return false; } - - next_prot_id = ETHERTYPE_TRANS_ETHER_BRIDGING; // huh? + next_prot_id = ETHERTYPE_TRANS_ETHER_BRIDGING; return true; } +//------------------------------------------------------------------------- +// api +//------------------------------------------------------------------------- -static void get_protocol_ids(std::vector& v) -{ - v.push_back(ETHERTYPE_ERSPAN_TYPE2); -} static Codec* ctor() { @@ -123,7 +125,7 @@ static void dtor(Codec *cd) } -static const char* name = "erspan2_codec"; +static const char* name = "erspan2"; static const CodecApi erspan2_api = { { PT_CODEC, name, CDAPI_PLUGIN_V0, 0 }, @@ -133,8 +135,6 @@ static const CodecApi erspan2_api = NULL, // tterm ctor, // ctor dtor, // dtor - nullptr, - get_protocol_ids, }; #ifdef BUILDING_SO diff --git a/src/codecs/plugins/cd_erspan3.cc b/src/codecs/plugins/cd_erspan3.cc index 1cc5e3ac5..d66251112 100644 --- a/src/codecs/plugins/cd_erspan3.cc +++ b/src/codecs/plugins/cd_erspan3.cc @@ -33,10 +33,11 @@ namespace class Erspan3Codec : public Codec { public: - Erspan3Codec() : Codec("ERSPAN_3"){}; + Erspan3Codec() : Codec("erspan3"){}; ~Erspan3Codec(){}; + virtual void get_protocol_ids(std::vector& v); virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, Packet *, uint16_t &lyr_len, int &next_prot_id); @@ -60,6 +61,13 @@ struct ERSpanType3Hdr const uint16_t ETHERTYPE_ERSPAN_TYPE3 = 0x22eb; } // anonymous namespace + +void Erspan3Codec::get_protocol_ids(std::vector& v) +{ + v.push_back(ETHERTYPE_ERSPAN_TYPE3); +} + + /* * Function: DecodeERSPANType3(uint8_t *, uint32_t, Packet *) * @@ -114,11 +122,6 @@ bool Erspan3Codec::decode(const uint8_t *raw_pkt, const uint32_t len, // api //------------------------------------------------------------------------- -static void get_protocol_ids(std::vector& v) -{ - v.push_back(ETHERTYPE_ERSPAN_TYPE3); -} - static Codec* ctor() { return new Erspan3Codec(); @@ -130,18 +133,23 @@ static void dtor(Codec *cd) } -static const char* name = "erspan3_codec"; +static const char* name = "erspan3"; static const CodecApi erspan3_api = { - { PT_CODEC, name, CDAPI_PLUGIN_V0, 0 }, - NULL, // pinit - NULL, // pterm - NULL, // tinit - NULL, // tterm + { + PT_CODEC, + name, + CDAPI_PLUGIN_V0, + 0, + nullptr, + nullptr, + }, + nullptr, // pinit + nullptr, // pterm + nullptr, // tinit + nullptr, // tterm ctor, // ctor dtor, // dtor - nullptr, // get_dlt - get_protocol_ids, }; diff --git a/src/codecs/plugins/cd_ethloopback.cc b/src/codecs/plugins/cd_ethloopback.cc index 17e1390e2..3780883a5 100644 --- a/src/codecs/plugins/cd_ethloopback.cc +++ b/src/codecs/plugins/cd_ethloopback.cc @@ -17,7 +17,7 @@ ** along with this program; if not, write to the Free Software ** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */ -// cd_vlan.cc author Josh Rosenbaum +// cd_ethloopback.cc author Josh Rosenbaum #include "framework/codec.h" @@ -30,10 +30,11 @@ namespace class EthLoopbackCodec : public Codec { public: - EthLoopbackCodec() : Codec("Ethloopback"){}; + EthLoopbackCodec() : Codec("ethloopback"){}; ~EthLoopbackCodec(){}; + virtual void get_protocol_ids(std::vector& v); virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, Packet *, uint16_t &lyr_len, int &next_prot_id); @@ -45,6 +46,12 @@ const uint16_t ETHERNET_TYPE_LOOP = 0x9000; } // anonymous namespace + +void EthLoopbackCodec::get_protocol_ids(std::vector& v) +{ + v.push_back(ETHERNET_TYPE_LOOP); +} + bool EthLoopbackCodec::decode(const uint8_t *raw_pkt, const uint32_t len, Packet *p, uint16_t &lyr_len, int &next_prot_id) { @@ -56,7 +63,6 @@ bool EthLoopbackCodec::decode(const uint8_t *raw_pkt, const uint32_t len, // if (p->greh != NULL) // dc.gre_loopback++; - next_prot_id = -1; return true; } @@ -66,10 +72,6 @@ bool EthLoopbackCodec::decode(const uint8_t *raw_pkt, const uint32_t len, //------------------------------------------------------------------------- -static void get_protocol_ids(std::vector& v) -{ - v.push_back(ETHERNET_TYPE_LOOP); -} static Codec* ctor() { @@ -81,18 +83,23 @@ static void dtor(Codec *cd) delete cd; } -static const char* name = "ethloopback_codec"; +static const char* name = "ethloopback"; static const CodecApi ethloopback_api = { - { PT_CODEC, name, CDAPI_PLUGIN_V0, 0 }, - NULL, // pinit - NULL, // pterm - NULL, // tinit - NULL, // tterm + { + PT_CODEC, + name, + CDAPI_PLUGIN_V0, + 0, + nullptr, + nullptr, + }, + nullptr, // pinit + nullptr, // pterm + nullptr, // tinit + nullptr, // tterm ctor, // ctor dtor, // dtor - nullptr, // get_dlt - get_protocol_ids, }; diff --git a/src/codecs/plugins/cd_fragment.cc b/src/codecs/plugins/cd_fragment.cc index e98cbf8e0..571fe53aa 100644 --- a/src/codecs/plugins/cd_fragment.cc +++ b/src/codecs/plugins/cd_fragment.cc @@ -1,5 +1,3 @@ -/* $Id: decode.c,v 1.285 2013-06-29 03:03:00 rcombs Exp $ */ - /* ** Copyright (C) 2002-2013 Sourcefire, Inc. ** Copyright (C) 1998-2002 Martin Roesch @@ -43,10 +41,11 @@ namespace class NameCodec : public Codec { public: - NameCodec() : Codec("NAME"){}; + NameCodec() : Codec("fragment"){}; ~NameCodec(); + virtual void get_protocol_ids(std::vector& v); virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, Packet *, uint16_t &lyr_len, int &next_prot_id); diff --git a/src/codecs/plugins/cd_gre.cc b/src/codecs/plugins/cd_gre.cc index 10d8c040e..5e087755d 100644 --- a/src/codecs/plugins/cd_gre.cc +++ b/src/codecs/plugins/cd_gre.cc @@ -33,10 +33,11 @@ namespace class GreCodec : public Codec { public: - GreCodec() : Codec("GRE"){}; + GreCodec() : Codec("gre"){}; ~GreCodec(){}; + virtual void get_protocol_ids(std::vector& v); virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, Packet *, uint16_t &lyr_len, int &next_prot_id); @@ -68,22 +69,14 @@ static const uint32_t GRE_V1_ACK_LEN = 4; #define GRE_RECUR(x) (x->flags & 0x07) #define GRE_FLAGS(x) (x->version & 0xF8) -#if 0 -#define GRE_HEADER_LEN 4 -#define GRE_CHKSUM_LEN 2 -#define GRE_OFFSET_LEN 2 -#define GRE_KEY_LEN 4 -#define GRE_SEQ_LEN 4 -#define GRE_SRE_HEADER_LEN 4 -#endif - } // anonymous namespace +void GreCodec::get_protocol_ids(std::vector& v) +{ + v.push_back(GRE_PROT_ID); +} -//-------------------------------------------------------------------- -// decode.c::GRE -//-------------------------------------------------------------------- /* * Function: DecodeGRE(uint8_t *, uint32_t, Packet *) @@ -251,10 +244,6 @@ void GRE_Format (EncodeFlags, const Packet*, Packet* c, Layer* lyr) // api //------------------------------------------------------------------------- -static void get_protocol_ids(std::vector& v) -{ - v.push_back(GRE_PROT_ID); -} static Codec* ctor() { @@ -266,18 +255,23 @@ static void dtor(Codec *cd) delete cd; } -static const char* name = "gre_codec"; +static const char* name = "gre"; static const CodecApi gre_api = { - { PT_CODEC, name, CDAPI_PLUGIN_V0, 0 }, - NULL, // pinit - NULL, // pterm - NULL, // tinit - NULL, // tterm + { + PT_CODEC, + name, + CDAPI_PLUGIN_V0, + 0, + nullptr, + nullptr, + }, + nullptr, // pinit + nullptr, // pterm + nullptr, // tinit + nullptr, // tterm ctor, // ctor dtor, // dtor - nullptr, - get_protocol_ids, }; #ifdef BUILDING_SO diff --git a/src/codecs/plugins/cd_gtp.cc b/src/codecs/plugins/cd_gtp.cc index 865a66d7c..1806fcad2 100644 --- a/src/codecs/plugins/cd_gtp.cc +++ b/src/codecs/plugins/cd_gtp.cc @@ -44,10 +44,10 @@ namespace class GtpCodec : public Codec { public: - GtpCodec() : Codec("GTP"){}; + GtpCodec() : Codec("gtp"){}; ~GtpCodec(){}; - + virtual void get_protocol_ids(std::vector& v); virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, Packet *, uint16_t &lyr_len, int &next_prot_id); @@ -60,6 +60,10 @@ public: } // anonymous namespace +void GtpCodec::get_protocol_ids(std::vector& v) +{ + v.push_back(PROTOCOL_GTP); +} /* Function: DecodeGTP(uint8_t *, uint32_t, Packet *) * @@ -271,10 +275,9 @@ EncStatus GTP_Update (Packet*, Layer* lyr, uint32_t* len) #endif -static void get_protocol_ids(std::vector& v) -{ - v.push_back(PROTOCOL_GTP); -} +//------------------------------------------------------------------------- +// api +//------------------------------------------------------------------------- static Codec* ctor() { @@ -286,18 +289,23 @@ static void dtor(Codec *cd) delete cd; } -static const char* name = "gtp_codec"; +static const char* name = "gtp"; static const CodecApi gtp_api = { - { PT_CODEC, name, CDAPI_PLUGIN_V0, 0 }, + { + PT_CODEC, + name, + CDAPI_PLUGIN_V0, + 0, + nullptr, + nullptr + }, NULL, // pinit NULL, // pterm NULL, // tinit NULL, // tterm ctor, // ctor dtor, // dtor - NULL, - get_protocol_ids, }; #ifdef BUILDING_SO diff --git a/src/codecs/plugins/cd_hopopts.cc b/src/codecs/plugins/cd_hopopts.cc index a836d6024..dc23d8ec1 100644 --- a/src/codecs/plugins/cd_hopopts.cc +++ b/src/codecs/plugins/cd_hopopts.cc @@ -1,5 +1,3 @@ -/* $Id: decode.c,v 1.285 2013-06-29 03:03:00 rcombs Exp $ */ - /* ** Copyright (C) 2002-2013 Sourcefire, Inc. ** Copyright (C) 1998-2002 Martin Roesch @@ -43,10 +41,12 @@ namespace class NameCodec : public Codec { public: - NameCodec() : Codec("NAME"){}; + NameCodec() : Codec("hopopts"){}; ~NameCodec(); + + virtual void get_protocol_ids(std::vector& v); virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, Packet *, uint16_t &lyr_len, int &next_prot_id); diff --git a/src/codecs/plugins/cd_mpls.cc b/src/codecs/plugins/cd_mpls.cc index 665f059ac..60cb20f9d 100644 --- a/src/codecs/plugins/cd_mpls.cc +++ b/src/codecs/plugins/cd_mpls.cc @@ -39,10 +39,10 @@ namespace class MplsCodec : public Codec { public: - MplsCodec() : Codec("MPLS"){}; + MplsCodec() : Codec("mpls"){}; ~MplsCodec(){}; - + virtual void get_protocol_ids(std::vector& v); virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, Packet *, uint16_t &lyr_len, int &next_prot_id); @@ -63,6 +63,13 @@ const static uint32_t NUM_RESERVED_LABELS = 16; static int checkMplsHdr(uint32_t, uint8_t, uint8_t, uint8_t, Packet *); +void MplsCodec::get_protocol_ids(std::vector& v) +{ + v.push_back(ETHERNET_TYPE_MPLS_UNICAST); + v.push_back(ETHERNET_TYPE_MPLS_MULTICAST); +} + + bool MplsCodec::decode(const uint8_t *raw_pkt, const uint32_t len, Packet *p, uint16_t &lyr_len, int &next_prot_id) { @@ -251,12 +258,9 @@ static int checkMplsHdr( return iRet; } - -static void get_protocol_ids(std::vector& v) -{ - v.push_back(ETHERNET_TYPE_MPLS_UNICAST); - v.push_back(ETHERNET_TYPE_MPLS_MULTICAST); -} +//------------------------------------------------------------------------- +// api +//------------------------------------------------------------------------- static Codec* ctor() { @@ -268,18 +272,23 @@ static void dtor(Codec *cd) delete cd; } -static const char* name = "mpls_codec"; +static const char* name = "mpls"; static const CodecApi mpls_api = { - { PT_CODEC, name, CDAPI_PLUGIN_V0, 0 }, - NULL, // pinit - NULL, // pterm - NULL, // tinit - NULL, // tterm + { + PT_CODEC, + name, + CDAPI_PLUGIN_V0, + 0, + nullptr, + nullptr, + }, + nullptr, // pinit + nullptr, // pterm + nullptr, // tinit + nullptr, // tterm ctor, // ctor dtor, // dtor - nullptr, // get_dlt - get_protocol_ids, }; #ifdef BUILDING_SO diff --git a/src/codecs/plugins/cd_pppencap.cc b/src/codecs/plugins/cd_pppencap.cc index e878fd59a..44f8b683d 100644 --- a/src/codecs/plugins/cd_pppencap.cc +++ b/src/codecs/plugins/cd_pppencap.cc @@ -37,10 +37,11 @@ namespace class PppEncap : public Codec { public: - PppEncap() : Codec("PPPEncapsulation"){}; + PppEncap() : Codec("ppp_encap"){}; ~PppEncap(){}; + virtual void get_protocol_ids(std::vector& v); virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, Packet *, uint16_t &lyr_len, int &next_prot_id); @@ -56,10 +57,13 @@ const static uint16_t PPP_VJ_COMP = 0x002d; /* VJ compressed TCP/IP */ const static uint16_t PPP_VJ_UCOMP = 0x002f; /* VJ uncompressed TCP/IP */ const static uint16_t PPP_IPX = 0x002b; /* Novell IPX Protocol */ -} // anonymous namespace - +} // namespace +void PppEncap::get_protocol_ids(std::vector& v) +{ + v.push_back(ETHERTYPE_PPP); +} /* @@ -174,11 +178,6 @@ bool PppEncap::decode(const uint8_t *raw_pkt, const uint32_t len, // api //------------------------------------------------------------------------- -static void get_protocol_ids(std::vector& v) -{ - v.push_back(ETHERTYPE_PPP); -} - static Codec* ctor() { return new PppEncap(); @@ -189,18 +188,23 @@ static void dtor(Codec *cd) delete cd; } -static const char* name = "pppencap_codec"; +static const char* name = "ppp_encap"; static const CodecApi pppencap_api = { - { PT_CODEC, name, CDAPI_PLUGIN_V0, 0 }, - NULL, // pinit - NULL, // pterm - NULL, // tinit - NULL, // tterm + { + PT_CODEC, + name, + CDAPI_PLUGIN_V0, + 0, + nullptr, + nullptr, + }, + nullptr, // pinit + nullptr, // pterm + nullptr, // tinit + nullptr, // tterm ctor, // ctor dtor, // dtor - nullptr, // get_dlt - get_protocol_ids, }; #ifdef BUILDING_SO diff --git a/src/codecs/plugins/cd_pppoepkt.cc b/src/codecs/plugins/cd_pppoepkt.cc index 0a38970c2..feebdd698 100644 --- a/src/codecs/plugins/cd_pppoepkt.cc +++ b/src/codecs/plugins/cd_pppoepkt.cc @@ -31,10 +31,11 @@ namespace class PPPoEPkt : public Codec { public: - PPPoEPkt() : Codec("PPP_over_Eth"){}; + PPPoEPkt() : Codec("ppp_over_eth"){}; ~PPPoEPkt(){}; + virtual void get_protocol_ids(std::vector& v); virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, Packet *, uint16_t &lyr_len, int &next_prot_id); @@ -70,7 +71,14 @@ const uint16_t PPPoE_TAG_AC_SYSTEM_ERROR = 0x0202; const uint16_t PPPoE_TAG_GENERIC_ERROR = 0x0203; -} // anonymous namespace +} // namespace + + +void PPPoEPkt::get_protocol_ids(std::vector& v) +{ + v.push_back(ETHERNET_TYPE_PPPoE_DISC); + v.push_back(ETHERNET_TYPE_PPPoE_SESS); +} //-------------------------------------------------------------------- @@ -283,11 +291,9 @@ EncStatus PPPoE_Encode (EncState* enc, Buffer* in, Buffer* out) } #endif -static void get_protocol_ids(std::vector& v) -{ - v.push_back(ETHERNET_TYPE_PPPoE_DISC); - v.push_back(ETHERNET_TYPE_PPPoE_SESS); -} +//------------------------------------------------------------------------- +// api +//------------------------------------------------------------------------- static Codec* ctor() { @@ -299,18 +305,23 @@ static void dtor(Codec *cd) delete cd; } -static const char* name = "pppoepkt_codec"; +static const char* name = "ppp_over_eth"; static const CodecApi pppoe_api = { - { PT_CODEC, name, CDAPI_PLUGIN_V0, 0 }, - NULL, // pinit - NULL, // pterm - NULL, // tinit - NULL, // tterm + { + PT_CODEC, + name, + CDAPI_PLUGIN_V0, + 0, + nullptr, + nullptr, + }, + nullptr, // pinit + nullptr, // pterm + nullptr, // tinit + nullptr, // tterm ctor, // ctor dtor, // dtor - nullptr, - get_protocol_ids, }; diff --git a/src/codecs/plugins/cd_teredo.cc b/src/codecs/plugins/cd_teredo.cc index ba2fcd12e..989f80d86 100644 --- a/src/codecs/plugins/cd_teredo.cc +++ b/src/codecs/plugins/cd_teredo.cc @@ -50,13 +50,20 @@ public: TeredoCodec() : Codec("teredo"){}; ~TeredoCodec(){}; - + virtual void get_protocol_ids(std::vector& v); virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, Packet *, uint16_t &lyr_len, int &next_prot_id); }; } // anonymous namespace + +void TeredoCodec::get_protocol_ids(std::vector& v) +{ + v.push_back(PROTOCOL_TEREDO); +} + + bool TeredoCodec::decode(const uint8_t *raw_pkt, const uint32_t len, Packet *p, uint16_t &lyr_len, int &next_prot_id) { @@ -114,10 +121,9 @@ bool TeredoCodec::decode(const uint8_t *raw_pkt, const uint32_t len, -static void get_protocol_ids(std::vector& v) -{ - v.push_back(PROTOCOL_TEREDO); -} +//------------------------------------------------------------------------- +// api +//------------------------------------------------------------------------- static Codec* ctor() { @@ -130,18 +136,22 @@ static void dtor(Codec *cd) } static const char* name = "teredo"; - static const CodecApi teredo_api = { - { PT_CODEC, name, CDAPI_PLUGIN_V0, 0 }, - NULL, // pinit - NULL, // pterm - NULL, // tinit - NULL, // tterm + { + PT_CODEC, + name, + CDAPI_PLUGIN_V0, + 0, + nullptr, + nullptr + }, + nullptr, // pinit + nullptr, // pterm + nullptr, // tinit + nullptr, // tterm ctor, // ctor dtor, // dtor - NULL, - get_protocol_ids }; diff --git a/src/codecs/plugins/cd_transbridge.cc b/src/codecs/plugins/cd_transbridge.cc index 55c6c9e54..9b2c06f43 100644 --- a/src/codecs/plugins/cd_transbridge.cc +++ b/src/codecs/plugins/cd_transbridge.cc @@ -39,10 +39,11 @@ namespace class TransbridgeCodec : public Codec { public: - TransbridgeCodec() : Codec("Transbridge"){}; + TransbridgeCodec() : Codec("transbridge"){}; ~TransbridgeCodec(){}; + virtual void get_protocol_ids(std::vector& v); virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, Packet *, uint16_t &lyr_len, int &next_prot_id); @@ -51,6 +52,10 @@ public: } // anonymous namespace +void TransbridgeCodec::get_protocol_ids(std::vector& v) +{ + v.push_back(ETHERTYPE_TRANS_ETHER_BRIDGING); // defined in ethertypes.h" +} /* @@ -97,10 +102,6 @@ bool TransbridgeCodec::decode(const uint8_t *raw_pkt, const uint32_t len, // api //------------------------------------------------------------------------- -static void get_protocol_ids(std::vector& v) -{ - v.push_back(ETHERTYPE_TRANS_ETHER_BRIDGING); // defined in ethertypes.h" -} static Codec* ctor() { @@ -112,18 +113,23 @@ static void dtor(Codec *cd) delete cd; } -static const char* name = "transbridge_codec"; +static const char* name = "transbridge"; static const CodecApi transbridge_api = { - { PT_CODEC, name, CDAPI_PLUGIN_V0, 0 }, - NULL, // pinit - NULL, // pterm - NULL, // tinit - NULL, // tterm + { + PT_CODEC, + name, + CDAPI_PLUGIN_V0, + 0, + nullptr, + nullptr + }, + nullptr, // pinit + nullptr, // pterm + nullptr, // tinit + nullptr, // tterm ctor, // ctor dtor, // dtor - nullptr, - get_protocol_ids, }; diff --git a/src/codecs/plugins/cd_vlan.cc b/src/codecs/plugins/cd_vlan.cc index 44f44657b..fb9c97d2b 100644 --- a/src/codecs/plugins/cd_vlan.cc +++ b/src/codecs/plugins/cd_vlan.cc @@ -40,6 +40,7 @@ public: ~VlanCodec(){}; + virtual void get_protocol_ids(std::vector& v); virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, Packet *, uint16_t &lyr_len, int &next_prot_id); @@ -49,30 +50,23 @@ public: virtual inline PROTO_ID get_proto_id() { return PROTO_VLAN; }; }; -struct CdPegs{ - PegCount processed = 0; - PegCount discards = 0; -}; - -std::vector peg_names = -{ - "NameCodec_processed", - "NameCodec_discards", -}; - +} // namespace -} // anonymous namespace - -static THREAD_LOCAL CdPegs counts; -static CdPegs gcounts; static const uint16_t ETHERNET_TYPE_8021Q = 0x8100; + static inline uint32_t len_vlan_llc_other() { return (sizeof(VlanTagHdr) + sizeof(EthLlc) + sizeof(EthLlcOther)); } +void VlanCodec::get_protocol_ids(std::vector& v) +{ + v.push_back(ETHERNET_TYPE_8021Q); +} + + bool VlanCodec::decode(const uint8_t *raw_pkt, const uint32_t len, Packet *p, uint16_t &lyr_len, int &next_prot_id) { @@ -184,13 +178,6 @@ void VLAN_Format (EncodeFlags, const Packet*, Packet* c, Layer* lyr) // api //------------------------------------------------------------------------- - - -static void get_protocol_ids(std::vector& v) -{ - v.push_back(ETHERNET_TYPE_8021Q); -} - static Codec* ctor() { return new VlanCodec(); @@ -201,18 +188,23 @@ static void dtor(Codec *cd) delete cd; } -static const char* name = "vlan_codec"; +static const char* name = "vlan"; static const CodecApi vlan_api = { - { PT_CODEC, name, CDAPI_PLUGIN_V0, 0 }, - NULL, // pinit - NULL, // pterm - NULL, // tinit - NULL, // tterm + { + PT_CODEC, + name, + CDAPI_PLUGIN_V0, + 0, + nullptr, + nullptr, + }, + nullptr, // pinit + nullptr, // pterm + nullptr, // tinit + nullptr, // tterm ctor, // ctor dtor, // dtor - NULL, // get_dlt - get_protocol_ids, }; diff --git a/src/codecs/template.cc b/src/codecs/template.cc index d7c95aa50..67b313c74 100644 --- a/src/codecs/template.cc +++ b/src/codecs/template.cc @@ -36,7 +36,7 @@ class NameCodec : public Codec { public: NameCodec() : Codec("NAME"){}; - ~NameCodec(); + ~NameCodec() {}; virtual bool decode(const uint8_t *raw_pkt, const uint32_t len, diff --git a/src/events/CMakeLists.txt b/src/events/CMakeLists.txt index c02fa127c..7c31c1ffb 100644 --- a/src/events/CMakeLists.txt +++ b/src/events/CMakeLists.txt @@ -12,6 +12,7 @@ add_library (events STATIC event_wrapper.h sfeventq.cc sfeventq.h + codec_events.cc ) install (FILES ${INCLUDES} diff --git a/src/events/codec_events.h b/src/events/codec_events.h index e69de29bb..b9c5a6fe9 100644 --- a/src/events/codec_events.h +++ b/src/events/codec_events.h @@ -0,0 +1,54 @@ +/* +** Copyright (C) 2002-2013 Sourcefire, Inc. +** Copyright (C) 1998-2002 Martin Roesch +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +#ifndef CODEC_EVENTS_H +#define CODEC_EVENTS_H + +#include + +// included for DECODE_INDEX_MAX +#include "detection/generators.h" +//#include "utils/sfActionQueue.h" +#include "network_inspectors/normalize/normalize.h" +#include "protocols/packet.h" +#include "time/profiler.h" +#include "codecs/decode_module.h" + +namespace codec_events +{ + + void exec_ip_chksm_drop(Packet*); + void exec_udp_chksm_drop (Packet *); + void exec_tcp_chksm_drop (Packet*); + void exec_hop_drop(Packet* p, int sid); + void exec_ttl_drop (Packet *data, int sid); + void exec_icmp_chksm_drop (Packet*); + + void decoder_event (Packet *, int); + void decoder_alert_encapsulated( + Packet *p, int sid, const uint8_t *pkt, uint32_t len); + + int ScNormalDrop (NormFlags nf); + +} //namespace codec_events + + +#endif + diff --git a/src/events/codec_events.h.bak b/src/events/codec_events.h.bak deleted file mode 100644 index b9c5a6fe9..000000000 --- a/src/events/codec_events.h.bak +++ /dev/null @@ -1,54 +0,0 @@ -/* -** Copyright (C) 2002-2013 Sourcefire, Inc. -** Copyright (C) 1998-2002 Martin Roesch -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -#ifndef CODEC_EVENTS_H -#define CODEC_EVENTS_H - -#include - -// included for DECODE_INDEX_MAX -#include "detection/generators.h" -//#include "utils/sfActionQueue.h" -#include "network_inspectors/normalize/normalize.h" -#include "protocols/packet.h" -#include "time/profiler.h" -#include "codecs/decode_module.h" - -namespace codec_events -{ - - void exec_ip_chksm_drop(Packet*); - void exec_udp_chksm_drop (Packet *); - void exec_tcp_chksm_drop (Packet*); - void exec_hop_drop(Packet* p, int sid); - void exec_ttl_drop (Packet *data, int sid); - void exec_icmp_chksm_drop (Packet*); - - void decoder_event (Packet *, int); - void decoder_alert_encapsulated( - Packet *p, int sid, const uint8_t *pkt, uint32_t len); - - int ScNormalDrop (NormFlags nf); - -} //namespace codec_events - - -#endif - diff --git a/src/framework/codec.h b/src/framework/codec.h index 1a8cef33c..41107319d 100644 --- a/src/framework/codec.h +++ b/src/framework/codec.h @@ -39,11 +39,6 @@ struct Packet; // to be useful, these must be explicit (*_V0, *_V1, ...) #define CDAPI_PLUGIN_V0 0 -//------------------------------------------------------------------------- -// FIXIT just starting points for Codec and CodecApi - - - class Codec { @@ -52,33 +47,33 @@ public: virtual bool decode(const uint8_t* raw_packet, const uint32_t raw_len, Packet *p, uint16_t &lyr_len, int &next_prot_id) = 0; - - // do nothing unless methods overridden. - // ONE OF THESE METHODS MUST BE IMPLEMENTED!! + // Get the codec's name virtual inline const char* get_name(){return name; }; + // Registers this Codec's data link type (as defined by libpcap) + virtual void get_data_link_type(std::vector&) {}; + // Register the code's protocol ID's and Ethertypes + virtual void get_protocol_ids(std::vector&) = 0; + // used by packet manager to determine the default/null codec + virtual inline bool is_default_codec() { return false; }; + // DELETE virtual inline PROTO_ID get_proto_id() { return PROTO_MAX; }; protected: Codec(const char* s) { name = s; }; - - private: const char* name; }; -struct _daq_pkthdr; -typedef int (*cd_eval_f)(void*, Packet*); //typedef cd_eval_f (*cd_new_f)(const char* key, void**); typedef Codec* (*cd_new_f)(); typedef void (*cd_del_f)(Codec *); typedef void (*cd_aux_f)(); -typedef bool (*decode_f)(const uint8_t *, const uint32_t, Packet *, uint16_t &, uint16_t &); typedef void (*cd_dlt_f)(std::vector&v); typedef void (*cd_prot_id_f)(std::vector&); @@ -92,7 +87,6 @@ struct CodecApi { BaseApi base; - // these may be nullptr cd_aux_f ginit; // initialize global plugin data cd_aux_f gterm; // clean-up pinit() @@ -103,9 +97,6 @@ struct CodecApi // these must be set cd_new_f ctor; // get eval optional instance data cd_del_f dtor; // clean up instance data - - cd_dlt_f dlt; // get the data link type - cd_prot_id_f proto_id; // get the protocol ids }; #endif diff --git a/src/managers/packet_manager.cc b/src/managers/packet_manager.cc index 496eafdfc..2aae893dc 100644 --- a/src/managers/packet_manager.cc +++ b/src/managers/packet_manager.cc @@ -69,12 +69,9 @@ static THREAD_LOCAL std::array s_stats static std::array g_stats; static THREAD_LOCAL CdGenPegs pkt_cnt; -static std::array s_proto_map; -static std::array s_protocols; - -extern const BaseApi* cd_unimplemented; -static THREAD_LOCAL uint8_t grinder; -static bool initial_instatiation = true; +static std::array s_proto_map{}; +static std::array s_protocols{}; +static THREAD_LOCAL uint8_t grinder = 0; //------------------------------------------------------------------------- // helper functions @@ -117,9 +114,6 @@ void PacketManager::add_plugin(const CodecApi* api) api->base.name); s_codecs.push_back(api); - - if (api->ginit) - api->ginit(); } void PacketManager::release_plugins() @@ -148,132 +142,75 @@ void PacketManager::dump_plugins() void PacketManager::instantiate(const CodecApi* cd_api, Module* m, SnortConfig* sc) { + static uint16_t codec_id = 1; + std::vector ids; + const CodecApi *p = GetApi(cd_api->base.name); if(!p) - { ParseError("Unknown codec: '%s'.", cd_api->base.name); - } - else - { - p->ctor(); - } -} + // global init here to ensure the global policy has already been configured + if (p->ginit) + p->ginit(); + Codec *cd = p->ctor(); + cd->get_protocol_ids(ids); + for (auto id : ids) + { + if(s_proto_map[id] != 0) + WarningMessage("The Codecs %s and %s have both been registered " + "for protocol_id %d. Codec %s will be used\n", + s_protocols[s_proto_map[id]]->get_name(), cd->get_name(), + id, cd->get_name()); -//------------------------------------------------------------------------- -// grinder -//------------------------------------------------------------------------- - -void PacketManager::decode( - Packet* p, const DAQ_PktHdr_t* pkthdr, const uint8_t* pkt) -{ - PROFILE_VARS; - int curr_prot_id, next_prot_id; - uint16_t len, lyr_len; - - PREPROC_PROFILE_START(decodePerfStats); - - // initialize all of the relevent data to decode this packet - memset(p, 0, PKT_ZERO_LEN); - p->pkth = pkthdr; - p->pkt = pkt; - len = pkthdr->caplen; - curr_prot_id = GRINDER_ID; - pkt_cnt.total_processed++; + s_proto_map[id] = codec_id; + } - // loop until the protocol id is no longer valid - while(curr_prot_id >= 0 && curr_prot_id < max_protocol_id) + if(cd->is_default_codec()) { - if (s_protocols[curr_prot_id] == 0) - { - pkt_cnt.other_codecs++; - break; - } - else if( !s_protocols[curr_prot_id]->decode(pkt, len, p, lyr_len, next_prot_id)) - { - pkt_cnt.discards++; - break; - } - - s_stats[curr_prot_id + stat_offset]++; - PacketClass::PushLayer(p, s_protocols[curr_prot_id], pkt, lyr_len); - curr_prot_id = next_prot_id; - next_prot_id = -1; - len -= lyr_len; - pkt += lyr_len; - lyr_len = 0; + if(s_protocols[0]) + s_protocols[0] = cd; + else + FatalError("Only one Codec may be the registered as default, " + "but both the %s and %s return 'true' when " + " the function default_codec().\n", + s_protocols[0]->get_name(), cd->get_name()); } - p->dsize = len; - p->data = pkt; - PREPROC_PROFILE_END(decodePerfStats); + s_protocols[codec_id++] = cd; } - void PacketManager::set_grinder(void) { - std::vector proto; - std::vector dlt; - bool codec_registered; - uint16_t cd_cnt = 0; - + for ( auto* p : s_codecs ) + if (p->tinit) + p->tinit(); int daq_dlt = DAQ_GetBaseProtocol(); - - for ( auto* p : s_codecs ) + for(int i = 0; i < s_protocols.size(); i++) { - codec_registered = false; - + Codec *cd = s_protocols[i]; + std::vector data_link_types; - // TODO: add module - // null check performed when plugin added. - Codec *cd = p->ctor(); - - - proto.clear(); - if(p->proto_id) - p->proto_id(proto); - for (auto proto_id : proto) - { - if(s_protocols[proto_id] != NULL) - WarningMessage("The Codecs %s and %s have both been registered " - "for protocol_id %d. Codec %s will be used\n", - s_protocols[proto_id]->get_name(), cd->get_name(), - proto_id, cd->get_name()); - s_protocols[proto_id] = cd; - codec_registered = true; - } - // add protocols to the array - - - dlt.clear(); - if(p->dlt) - p->dlt(dlt); - // set the grinder if the data link types match - for (auto curr_dlt : dlt ) + cd->get_data_link_type(data_link_types); + for (auto curr_dlt : data_link_types) { if (curr_dlt == daq_dlt) { - if (s_protocols[GRINDER_ID] != NULL) + if (grinder != 0) WarningMessage("The Codecs %s and %s have both been registered " "as the raw decoder. Codec %s will be used\n", s_protocols[GRINDER_ID]->get_name(), cd->get_name(), cd->get_name()); - s_protocols[GRINDER_ID] = cd; - codec_registered = true; + grinder = i; } } - - if (!codec_registered) - WarningMessage("The Codec %s is never used\n", cd->get_name()); - - - if (p->tinit) - p->tinit(); } + + if(!grinder) + FatalError("Unable to find a Codec with data link type %d!!\n", daq_dlt); } void PacketManager::thread_term() @@ -318,6 +255,55 @@ void PacketManager::accumulate() stats_mutex.unlock(); } +//------------------------------------------------------------------------- +// grinder +//------------------------------------------------------------------------- + +void PacketManager::decode( + Packet* p, const DAQ_PktHdr_t* pkthdr, const uint8_t* pkt) +{ + PROFILE_VARS; + int curr_prot_id, next_prot_id; + uint16_t len, lyr_len; + + PREPROC_PROFILE_START(decodePerfStats); + + // initialize all of the relevent data to decode this packet + memset(p, 0, PKT_ZERO_LEN); + p->pkth = pkthdr; + p->pkt = pkt; + len = pkthdr->caplen; + curr_prot_id = GRINDER_ID; + pkt_cnt.total_processed++; + + // loop until the protocol id is no longer valid + while(curr_prot_id >= 0 && curr_prot_id < max_protocol_id) + { + if (s_protocols[curr_prot_id] == 0) + { + pkt_cnt.other_codecs++; + break; + } + else if( !s_protocols[curr_prot_id]->decode(pkt, len, p, lyr_len, next_prot_id)) + { + pkt_cnt.discards++; + break; + } + + s_stats[curr_prot_id + stat_offset]++; + PacketClass::PushLayer(p, s_protocols[curr_prot_id], pkt, lyr_len); + curr_prot_id = next_prot_id; + next_prot_id = -1; + len -= lyr_len; + pkt += lyr_len; + lyr_len = 0; + } + + p->dsize = len; + p->data = pkt; + PREPROC_PROFILE_END(decodePerfStats); +} + bool PacketManager::has_codec(uint16_t cd_id) { return s_protocols[cd_id] != 0; diff --git a/src/managers/packet_manager.h b/src/managers/packet_manager.h index 373b95377..8d9f47909 100644 --- a/src/managers/packet_manager.h +++ b/src/managers/packet_manager.h @@ -53,9 +53,6 @@ public: static void set_grinder(); // thread_init static void thread_term(); - static void init_codecs(); - static void term_codecs(); - static void decode(Packet*, const struct _daq_pkthdr*, const uint8_t*); static void dump_stats();