"Fossies" - the Fresh Open Source Software Archive

Member "snort3_extra-3.1.51.0/src/codecs/cd_ppp/cd_ppp.cc" (20 Dec 2022, 2808 Bytes) of package /linux/misc/snort3_extra-3.1.51.0.tar.gz:

    1 //--------------------------------------------------------------------------
    2 // Copyright (C) 2014-2022 Cisco and/or its affiliates. All rights reserved.
    3 //
    4 // This program is free software; you can redistribute it and/or modify it
    5 // under the terms of the GNU General Public License Version 2 as published
    6 // by the Free Software Foundation.  You may not use, modify or distribute
    7 // this program under any other version of the GNU General Public License.
    8 //
    9 // This program is distributed in the hope that it will be useful, but
   10 // WITHOUT ANY WARRANTY; without even the implied warranty of
   11 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
   12 // General Public License for more details.
   13 //
   14 // You should have received a copy of the GNU General Public License along
   15 // with this program; if not, write to the Free Software Foundation, Inc.,
   16 // 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
   17 //--------------------------------------------------------------------------
   18 // cd_ppp.cc author Josh Rosenbaum <jrosenba@cisco.com>
   19 
   20 #include <daq_dlt.h>
   21 
   22 #include "framework/codec.h"
   23 
   24 using namespace snort;
   25 
   26 #define PPP_NAME "ppp"
   27 #define PPP_HELP_STR "support for point-to-point encapsulation"
   28 #define PPP_HELP ADD_DLT(PPP_HELP_STR, DLT_PPP)
   29 
   30 namespace
   31 {
   32 class PPPCodec : public Codec
   33 {
   34 public:
   35     PPPCodec() : Codec(PPP_NAME) { }
   36 
   37     bool decode(const RawData&, CodecData&, DecodeData&) override;
   38     void get_data_link_type(std::vector<int>&) override;
   39 };
   40 } // namespace
   41 
   42 static constexpr uint8_t CHDLC_ADDR_BROADCAST = 0xff;
   43 static constexpr uint8_t CHDLC_CTRL_UNNUMBERED = 0x03;
   44 
   45 void PPPCodec::get_data_link_type(std::vector<int>& v)
   46 { v.push_back(DLT_PPP); }
   47 
   48 bool PPPCodec::decode(const RawData& raw, CodecData& codec, DecodeData&)
   49 {
   50     if (raw.len < 2)
   51         return false;
   52 
   53     if (raw.data[0] == CHDLC_ADDR_BROADCAST && raw.data[1] == CHDLC_CTRL_UNNUMBERED)
   54     {
   55         /*
   56          * Check for full HDLC header (rfc1662 section 3.2)
   57          */
   58         codec.lyr_len = 2;
   59     }
   60 
   61     codec.next_prot_id = ProtocolId::ETHERTYPE_PPP;
   62     return true;
   63 }
   64 
   65 //-------------------------------------------------------------------------
   66 // api
   67 //-------------------------------------------------------------------------
   68 
   69 static Codec* ctor(Module*)
   70 { return new PPPCodec(); }
   71 
   72 static void dtor(Codec* cd)
   73 { delete cd; }
   74 
   75 static const CodecApi ppp_api =
   76 {
   77     {
   78         PT_CODEC,
   79         sizeof(CodecApi),
   80         CDAPI_VERSION,
   81         0,
   82         API_RESERVED,
   83         API_OPTIONS,
   84         PPP_NAME,
   85         PPP_HELP,
   86         nullptr, // mod_ctor
   87         nullptr, // mod_dtor
   88     },
   89     nullptr, // pinit
   90     nullptr, // pterm
   91     nullptr, // tinit
   92     nullptr, // tterm
   93     ctor,
   94     dtor,
   95 };
   96 
   97 SO_PUBLIC const BaseApi* snort_plugins[] =
   98 {
   99     &ppp_api.base,
  100     nullptr
  101 };