"Fossies" - the Fresh Open Source Software Archive

Member "snort3_extra-3.0.3-1/src/ips_options/ips_urg/ips_urg.cc" (23 Sep 2020, 4602 Bytes) of package /linux/misc/snort3_extra-3.0.3-1.tar.gz:


As a special service "Fossies" has tried to format the requested source page into HTML format using (guessed) C and C++ source code syntax highlighting (style: standard) with prefixed line numbers and code folding option. Alternatively you can here view or download the uninterpreted source code file. For more information about "ips_urg.cc" see the Fossies "Dox" file reference documentation.

    1 //--------------------------------------------------------------------------
    2 // Copyright (C) 2014-2020 Cisco and/or its affiliates. All rights reserved.
    3 //
    4 // This program is free software; you can redistribute it and/or modify it
    5 // under the terms of the GNU General Public License Version 2 as published
    6 // by the Free Software Foundation.  You may not use, modify or distribute
    7 // this program under any other version of the GNU General Public License.
    8 //
    9 // This program is distributed in the hope that it will be useful, but
   10 // WITHOUT ANY WARRANTY; without even the implied warranty of
   11 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
   12 // General Public License for more details.
   13 //
   14 // You should have received a copy of the GNU General Public License along
   15 // with this program; if not, write to the Free Software Foundation, Inc.,
   16 // 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
   17 //--------------------------------------------------------------------------
   18 
   19 // ips_urg.cc author Russ Combs <rucombs@cisco.com>
   20 
   21 #include "framework/ips_option.h"
   22 #include "framework/module.h"
   23 #include "framework/range.h"
   24 #include "hash/hash_key_operations.h"
   25 #include "profiler/profiler.h"
   26 #include "protocols/packet.h"
   27 #include "protocols/tcp.h"
   28 
   29 using namespace snort;
   30 
   31 static const char* s_name = "urg";
   32 static const char* s_help = "detection for TCP urgent pointer";
   33 
   34 static THREAD_LOCAL ProfileStats tcpUrgPerfStats;
   35 
   36 //-------------------------------------------------------------------------
   37 // option
   38 //-------------------------------------------------------------------------
   39 
   40 class TcpUrgOption : public IpsOption
   41 {
   42 public:
   43     TcpUrgOption(const RangeCheck& c) : IpsOption(s_name)
   44     { config = c; }
   45 
   46     uint32_t hash() const override;
   47     bool operator==(const IpsOption&) const override;
   48 
   49     EvalStatus eval(Cursor&, Packet*) override;
   50 
   51 private:
   52     RangeCheck config;
   53 };
   54 
   55 uint32_t TcpUrgOption::hash() const
   56 {
   57     uint32_t a, b, c;
   58 
   59     a = config.op;
   60     b = config.min;
   61     c = config.max;
   62 
   63     mix_str(a,b,c,get_name());
   64     finalize(a,b,c);
   65 
   66     return c;
   67 }
   68 
   69 bool TcpUrgOption::operator==(const IpsOption& ips) const
   70 {
   71     if ( strcmp(s_name, ips.get_name()) )
   72         return false;
   73 
   74     const TcpUrgOption& rhs = (const TcpUrgOption&)ips;
   75     return ( config == rhs.config );
   76 }
   77 
   78 IpsOption::EvalStatus TcpUrgOption::eval(Cursor&, Packet* p)
   79 {
   80     Profile profile(tcpUrgPerfStats);
   81 
   82     if ( p->ptrs.tcph and p->ptrs.tcph->are_flags_set(TH_URG) and
   83         config.eval(p->ptrs.tcph->urp()) )
   84     {
   85         return MATCH;
   86     }
   87 
   88     return NO_MATCH;
   89 }
   90 
   91 //-------------------------------------------------------------------------
   92 // module
   93 //-------------------------------------------------------------------------
   94 
   95 #define RANGE "0:65535"
   96 
   97 static const Parameter s_params[] =
   98 {
   99     { "~range", Parameter::PT_INTERVAL, RANGE, nullptr,
  100       "check if tcp urgent offset is in given range" },
  101 
  102     { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
  103 };
  104 
  105 class UrgModule : public Module
  106 {
  107 public:
  108     UrgModule() : Module(s_name, s_help, s_params) { }
  109 
  110     bool begin(const char*, int, SnortConfig*) override;
  111     bool set(const char*, Value&, SnortConfig*) override;
  112 
  113     ProfileStats* get_profile() const override
  114     { return &tcpUrgPerfStats; }
  115 
  116     Usage get_usage() const override
  117     { return DETECT; }
  118 
  119 public:
  120     RangeCheck data;
  121 };
  122 
  123 bool UrgModule::begin(const char*, int, SnortConfig*)
  124 {
  125     data.init();
  126     return true;
  127 }
  128 
  129 bool UrgModule::set(const char*, Value& v, SnortConfig*)
  130 {
  131     if ( !v.is("~range") )
  132         return false;
  133 
  134     return data.validate(v.get_string(), RANGE);
  135 }
  136 
  137 //-------------------------------------------------------------------------
  138 // api methods
  139 //-------------------------------------------------------------------------
  140 
  141 static Module* mod_ctor()
  142 {
  143     return new UrgModule;
  144 }
  145 
  146 static void mod_dtor(Module* m)
  147 {
  148     delete m;
  149 }
  150 
  151 static IpsOption* urg_ctor(Module* p, OptTreeNode*)
  152 {
  153     UrgModule* m = (UrgModule*)p;
  154     return new TcpUrgOption(m->data);
  155 }
  156 
  157 static void urg_dtor(IpsOption* p)
  158 {
  159     delete p;
  160 }
  161 
  162 static const IpsApi urg_api =
  163 {
  164     {
  165         PT_IPS_OPTION,
  166         sizeof(IpsApi),
  167         IPSAPI_VERSION,
  168         0,
  169         API_RESERVED,
  170         API_OPTIONS,
  171         s_name,
  172         s_help,
  173         mod_ctor,
  174         mod_dtor
  175     },
  176     OPT_TYPE_DETECTION,
  177     1, PROTO_BIT__TCP,
  178     nullptr, // pinit
  179     nullptr, // pterm
  180     nullptr, // tinit
  181     nullptr, // tterm
  182     urg_ctor,
  183     urg_dtor,
  184     nullptr
  185 };
  186 
  187 SO_PUBLIC const BaseApi* snort_plugins[] =
  188 {
  189     &urg_api.base,
  190     nullptr
  191 };
  192