"Fossies" - the Fresh Open Source Software Archive 
Member "snort3_extra-3.0.3-1/src/ips_options/ips_wscale/ips_wscale.cc" (23 Sep 2020, 5013 Bytes) of package /linux/misc/snort3_extra-3.0.3-1.tar.gz:
As a special service "Fossies" has tried to format the requested source page into HTML format using (guessed) C and C++ source code syntax highlighting (style:
standard) with prefixed line numbers and
code folding option.
Alternatively you can here
view or
download the uninterpreted source code file.
For more information about "ips_wscale.cc" see the
Fossies "Dox" file reference documentation.
1 //--------------------------------------------------------------------------
2 // Copyright (C) 2017-2020 Cisco and/or its affiliates. All rights reserved.
3 //
4 // This program is free software; you can redistribute it and/or modify it
5 // under the terms of the GNU General Public License Version 2 as published
6 // by the Free Software Foundation. You may not use, modify or distribute
7 // this program under any other version of the GNU General Public License.
8 //
9 // This program is distributed in the hope that it will be useful, but
10 // WITHOUT ANY WARRANTY; without even the implied warranty of
11 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 // General Public License for more details.
13 //
14 // You should have received a copy of the GNU General Public License along
15 // with this program; if not, write to the Free Software Foundation, Inc.,
16 // 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
17 //--------------------------------------------------------------------------
18
19 // ips_wscale.cc author Russ Combs <rucombs@cisco.com>
20
21 #include "framework/ips_option.h"
22 #include "framework/module.h"
23 #include "framework/range.h"
24 #include "hash/hash_key_operations.h"
25 #include "profiler/profiler.h"
26 #include "protocols/packet.h"
27 #include "protocols/tcp.h"
28 #include "protocols/tcp_options.h"
29
30 using namespace snort;
31
32 static const char* s_name = "wscale";
33 static const char* s_help = "detection for TCP window scale";
34
35 static THREAD_LOCAL ProfileStats tcpWscalePerfStats;
36
37 //-------------------------------------------------------------------------
38 // option
39 //-------------------------------------------------------------------------
40
41 class TcpWscaleOption : public IpsOption
42 {
43 public:
44 TcpWscaleOption(const RangeCheck& c) : IpsOption(s_name)
45 { config = c; }
46
47 uint32_t hash() const override;
48 bool operator==(const IpsOption&) const override;
49
50 EvalStatus eval(Cursor&, Packet*) override;
51
52 private:
53 RangeCheck config;
54 };
55
56 uint32_t TcpWscaleOption::hash() const
57 {
58 uint32_t a, b, c;
59
60 a = config.op;
61 b = config.min;
62 c = config.max;
63
64 mix_str(a,b,c,get_name());
65 finalize(a,b,c);
66
67 return c;
68 }
69
70 bool TcpWscaleOption::operator==(const IpsOption& ips) const
71 {
72 if ( strcmp(s_name, ips.get_name()) )
73 return false;
74
75 const TcpWscaleOption& rhs = (const TcpWscaleOption&)ips;
76 return ( config == rhs.config );
77 }
78
79 static bool get_wscale(Packet* p, uint16_t& wscale)
80 {
81 if ( !p->ptrs.tcph )
82 return false;
83
84 tcp::TcpOptIterator iter(p->ptrs.tcph, p);
85
86 for (const auto& opt : iter)
87 {
88 if (opt.code == tcp::TcpOptCode::WSCALE)
89 {
90 wscale = opt.data[0];
91 return true;
92 }
93 }
94 return false;
95 }
96
97 IpsOption::EvalStatus TcpWscaleOption::eval(Cursor&, Packet* p)
98 {
99 Profile profile(tcpWscalePerfStats);
100 uint16_t wscale;
101
102 if ( get_wscale(p, wscale) and config.eval(wscale) )
103 return MATCH;
104
105 return NO_MATCH;
106 }
107
108 //-------------------------------------------------------------------------
109 // module
110 //-------------------------------------------------------------------------
111
112 #define RANGE "0:65535"
113
114 static const Parameter s_params[] =
115 {
116 { "~range", Parameter::PT_INTERVAL, RANGE, nullptr,
117 "check if TCP window scale is in given range" },
118
119 { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
120 };
121
122 class WscaleModule : public Module
123 {
124 public:
125 WscaleModule() : Module(s_name, s_help, s_params) { }
126
127 bool begin(const char*, int, SnortConfig*) override;
128 bool set(const char*, Value&, SnortConfig*) override;
129
130 ProfileStats* get_profile() const override
131 { return &tcpWscalePerfStats; }
132
133 Usage get_usage() const override
134 { return DETECT; }
135
136 public:
137 RangeCheck data;
138 };
139
140 bool WscaleModule::begin(const char*, int, SnortConfig*)
141 {
142 data.init();
143 return true;
144 }
145
146 bool WscaleModule::set(const char*, Value& v, SnortConfig*)
147 {
148 if ( !v.is("~range") )
149 return false;
150
151 return data.validate(v.get_string(), RANGE);
152 }
153
154 //-------------------------------------------------------------------------
155 // api methods
156 //-------------------------------------------------------------------------
157
158 static Module* mod_ctor()
159 {
160 return new WscaleModule;
161 }
162
163 static void mod_dtor(Module* m)
164 {
165 delete m;
166 }
167
168 static IpsOption* wscale_ctor(Module* p, OptTreeNode*)
169 {
170 WscaleModule* m = (WscaleModule*)p;
171 return new TcpWscaleOption(m->data);
172 }
173
174 static void wscale_dtor(IpsOption* p)
175 {
176 delete p;
177 }
178
179 static const IpsApi wscale_api =
180 {
181 {
182 PT_IPS_OPTION,
183 sizeof(IpsApi),
184 IPSAPI_VERSION,
185 0,
186 API_RESERVED,
187 API_OPTIONS,
188 s_name,
189 s_help,
190 mod_ctor,
191 mod_dtor
192 },
193 OPT_TYPE_DETECTION,
194 1, PROTO_BIT__TCP,
195 nullptr, // pinit
196 nullptr, // pterm
197 nullptr, // tinit
198 nullptr, // tterm
199 wscale_ctor,
200 wscale_dtor,
201 nullptr
202 };
203
204 SO_PUBLIC const BaseApi* snort_plugins[] =
205 {
206 &wscale_api.base,
207 nullptr
208 };
209