From 30fdc374795f2a52210da207da36376843187a56 Mon Sep 17 00:00:00 2001 From: Jeff Barber Date: Fri, 22 May 2015 16:43:03 -0400 Subject: [PATCH 1/4] Refactor to make bro use a common Packet object. Do a better job of parsing layer 2 and keeping track of layer 3 proto. Add support for raw packet event, including Layer2 headers. --- aux/plugins | 2 +- scripts/base/init-bare.bro | 27 +++ src/CMakeLists.txt | 1 + src/Conn.cc | 8 +- src/Conn.h | 4 +- src/IP.cc | 31 ++- src/IP.h | 7 +- src/L2.cc | 104 +++++++++ src/L2.h | 38 +++ src/Net.cc | 17 +- src/Net.h | 7 +- src/Packet.h | 88 +++++++ src/RemoteSerializer.cc | 8 +- src/Serializer.cc | 61 ++--- src/Serializer.h | 58 ----- src/Sessions.cc | 220 ++++++++---------- src/Sessions.h | 30 +-- src/analyzer/protocol/arp/ARP.cc | 24 +- src/analyzer/protocol/arp/ARP.h | 6 +- src/bro.bif | 67 +++--- src/event.bif | 19 +- src/iosource/PktDumper.h | 16 +- src/iosource/PktSrc.cc | 138 +++++++---- src/iosource/PktSrc.h | 32 +-- src/iosource/pcap/Dumper.cc | 5 +- src/iosource/pcap/Source.cc | 5 +- src/types.bif | 12 + testing/btest/Baseline/core.raw_packet/output | 48 ++++ testing/btest/Traces/icmp_dot1q.trace | Bin 0 -> 1710 bytes testing/btest/Traces/raw_packets.trace | Bin 0 -> 6641 bytes testing/btest/core/raw_packet.bro | 9 + .../btest/plugins/pktdumper-plugin/src/Foo.cc | 4 +- .../btest/plugins/pktsrc-plugin/src/Foo.cc | 9 +- testing/btest/plugins/pktsrc-plugin/src/Foo.h | 1 - 34 files changed, 677 insertions(+), 429 deletions(-) create mode 100644 src/L2.cc create mode 100644 src/L2.h create mode 100644 src/Packet.h create mode 100644 testing/btest/Baseline/core.raw_packet/output create mode 100644 testing/btest/Traces/icmp_dot1q.trace create mode 100644 testing/btest/Traces/raw_packets.trace create mode 100644 testing/btest/core/raw_packet.bro diff --git a/aux/plugins b/aux/plugins index 475beed1e9..b6359657a7 160000 --- a/aux/plugins +++ b/aux/plugins @@ -1 +1 @@ -Subproject commit 475beed1e9688f572ee60c196e07c0fa72e1ed9f +Subproject commit b6359657a7ad053c6bb4de392d8c17cdd80b88b6 diff --git a/scripts/base/init-bare.bro b/scripts/base/init-bare.bro index 23f4fd43dd..49df5d12be 100644 --- a/scripts/base/init-bare.bro +++ b/scripts/base/init-bare.bro @@ -740,6 +740,7 @@ type pcap_packet: record { caplen: count; ##< The number of bytes captured (<= *len*). len: count; ##< The length of the packet in bytes, including link-level header. data: string; ##< The payload of the packet, including link-level header. + link_type: link_encap; ##< L2 link encapsulation type }; ## GeoIP location information. @@ -1495,6 +1496,32 @@ type pkt_hdr: record { icmp: icmp_hdr &optional; ##< The ICMP header if an ICMP packet. }; +## Values extracted from the layer 2 header. +## +## .. bro:see:: pkt_hdr +type l2_hdr: record { + encap: link_encap; ##< L2 link encapsulation + len: count; ##< Total frame length on wire + cap_len: count; ##< Captured length + src: string &optional; ##< L2 source (if ethernet) + dst: string &optional; ##< L2 destination (if ethernet) + vlan: count &optional; ##< Outermost VLAN tag if any (and ethernet) + eth_type: count &optional; ##< Innermost Ethertype (if ethernet) + proto: layer3_proto; ##< L3 proto +}; + +## A raw packet header, consisting of L2 header and everything in pkt_hdr above. +## +## .. bro:see:: raw_packet pkt_hdr +type raw_pkt_hdr: record { + l2: l2_hdr; ##< Layer 3 and above header + ip: ip4_hdr &optional; ##< The IPv4 header if an IPv4 packet. + ip6: ip6_hdr &optional; ##< The IPv6 header if an IPv6 packet. + tcp: tcp_hdr &optional; ##< The TCP header if a TCP packet. + udp: udp_hdr &optional; ##< The UDP header if a UDP packet. + icmp: icmp_hdr &optional; ##< The ICMP header if an ICMP packet. +}; + ## A Teredo origin indication header. See :rfc:`4380` for more information ## about the Teredo protocol. ## diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt index bdbd3839ce..59b9f8d1b6 100644 --- a/src/CMakeLists.txt +++ b/src/CMakeLists.txt @@ -297,6 +297,7 @@ set(bro_SRCS IntSet.cc IP.cc IPAddr.cc + L2.cc List.cc Reporter.cc NFA.cc diff --git a/src/Conn.cc b/src/Conn.cc index 96e71ca52d..5c1a58a7b1 100644 --- a/src/Conn.cc +++ b/src/Conn.cc @@ -241,12 +241,8 @@ void Connection::NextPacket(double t, int is_orig, const u_char*& data, int& record_packet, int& record_content, // arguments for reproducing packets - const struct pcap_pkthdr* hdr, - const u_char* const pkt, - int hdr_size) + const Packet *pkt) { - current_hdr = hdr; - current_hdr_size = hdr_size; current_timestamp = t; current_pkt = pkt; @@ -264,8 +260,6 @@ void Connection::NextPacket(double t, int is_orig, else last_time = t; - current_hdr = 0; - current_hdr_size = 0; current_timestamp = 0; current_pkt = 0; } diff --git a/src/Conn.h b/src/Conn.h index 20e60d2617..62a1aa9613 100644 --- a/src/Conn.h +++ b/src/Conn.h @@ -86,9 +86,7 @@ public: const u_char*& data, int& record_packet, int& record_content, // arguments for reproducing packets - const struct pcap_pkthdr* hdr, - const u_char* const pkt, - int hdr_size); + const Packet *pkt); HashKey* Key() const { return key; } void ClearKey() { key = 0; } diff --git a/src/IP.cc b/src/IP.cc index 783c08da39..97db1bb93d 100644 --- a/src/IP.cc +++ b/src/IP.cc @@ -325,26 +325,33 @@ RecordVal* IP_Hdr::BuildIPHdrVal() const } RecordVal* IP_Hdr::BuildPktHdrVal() const - { +{ static RecordType* pkt_hdr_type = 0; - static RecordType* tcp_hdr_type = 0; - static RecordType* udp_hdr_type = 0; - static RecordType* icmp_hdr_type = 0; if ( ! pkt_hdr_type ) { pkt_hdr_type = internal_type("pkt_hdr")->AsRecordType(); + } + RecordVal* pkt_hdr = new RecordVal(pkt_hdr_type); + return BuildPktHdrVal(pkt_hdr, 0); +} + +RecordVal* IP_Hdr::BuildPktHdrVal(RecordVal* pkt_hdr, int sindex) const + { + static RecordType* tcp_hdr_type = 0; + static RecordType* udp_hdr_type = 0; + static RecordType* icmp_hdr_type = 0; + + if ( ! tcp_hdr_type ) + { tcp_hdr_type = internal_type("tcp_hdr")->AsRecordType(); udp_hdr_type = internal_type("udp_hdr")->AsRecordType(); icmp_hdr_type = internal_type("icmp_hdr")->AsRecordType(); } - - RecordVal* pkt_hdr = new RecordVal(pkt_hdr_type); - if ( ip4 ) - pkt_hdr->Assign(0, BuildIPHdrVal()); + pkt_hdr->Assign(sindex + 0, BuildIPHdrVal()); else - pkt_hdr->Assign(1, BuildIPHdrVal()); + pkt_hdr->Assign(sindex + 1, BuildIPHdrVal()); // L4 header. const u_char* data = Payload(); @@ -368,7 +375,7 @@ RecordVal* IP_Hdr::BuildPktHdrVal() const tcp_hdr->Assign(6, new Val(tp->th_flags, TYPE_COUNT)); tcp_hdr->Assign(7, new Val(ntohs(tp->th_win), TYPE_COUNT)); - pkt_hdr->Assign(2, tcp_hdr); + pkt_hdr->Assign(sindex + 2, tcp_hdr); break; } @@ -381,7 +388,7 @@ RecordVal* IP_Hdr::BuildPktHdrVal() const udp_hdr->Assign(1, new PortVal(ntohs(up->uh_dport), TRANSPORT_UDP)); udp_hdr->Assign(2, new Val(ntohs(up->uh_ulen), TYPE_COUNT)); - pkt_hdr->Assign(3, udp_hdr); + pkt_hdr->Assign(sindex + 3, udp_hdr); break; } @@ -392,7 +399,7 @@ RecordVal* IP_Hdr::BuildPktHdrVal() const icmp_hdr->Assign(0, new Val(icmpp->icmp_type, TYPE_COUNT)); - pkt_hdr->Assign(4, icmp_hdr); + pkt_hdr->Assign(sindex + 4, icmp_hdr); break; } diff --git a/src/IP.h b/src/IP.h index b91c9130e4..bfd3ce8a41 100644 --- a/src/IP.h +++ b/src/IP.h @@ -574,8 +574,13 @@ public: */ RecordVal* BuildPktHdrVal() const; -private: + /** + * Same as above, but simply add our values into the record at the + * specified starting index. + */ + RecordVal* BuildPktHdrVal(RecordVal* pkt_hdr, int sindex) const; +private: const struct ip* ip4; const struct ip6_hdr* ip6; bool del; diff --git a/src/L2.cc b/src/L2.cc new file mode 100644 index 0000000000..9b277e9e9e --- /dev/null +++ b/src/L2.cc @@ -0,0 +1,104 @@ +// See the file "COPYING" in the main distribution directory for copyright. + +#include "L2.h" +#include "IP.h" +#include "Type.h" +#include "Val.h" +#include "Var.h" +#include "NetVar.h" + +extern "C" { +#include +#include +#include +#include +#include +#include +#ifdef HAVE_NET_ETHERNET_H +#include +#elif defined(HAVE_SYS_ETHERNET_H) +#include +#elif defined(HAVE_NETINET_IF_ETHER_H) +#include +#elif defined(HAVE_NET_ETHERTYPES_H) +#include +#endif +} + + +Val *L2_Hdr::fmt_eui48(const u_char *mac) const + { + char buf[20]; + snprintf(buf, sizeof buf, "%02x:%02x:%02x:%02x:%02x:%02x", + mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]); + return new StringVal(buf); + } + +RecordVal* L2_Hdr::BuildPktHdrVal() const + { + static RecordType* l2_hdr_type = 0; + static RecordType* raw_pkt_hdr_type = 0; + + if ( ! raw_pkt_hdr_type ) + { + raw_pkt_hdr_type = internal_type("raw_pkt_hdr")->AsRecordType(); + l2_hdr_type = internal_type("l2_hdr")->AsRecordType(); + } + + RecordVal* pkt_hdr = new RecordVal(raw_pkt_hdr_type); + RecordVal* l2_hdr = new RecordVal(l2_hdr_type); + int is_ethernet = ( pkt->link_type == DLT_EN10MB ) ? 1 : 0; + int l3 = BifEnum::layer3_proto::l3_unknown; + if ( pkt->l3_proto == AF_INET ) + l3 = BifEnum::layer3_proto::l3_ipv4; + else if ( pkt->l3_proto == AF_INET6 ) + l3 = BifEnum::layer3_proto::l3_ipv6; + + // l2_hdr layout: + // encap: link_encap; ##< L2 link encapsulation + // len: count; ##< Total frame length on wire + // cap_len: count; ##< Captured length + // src: string &optional; ##< L2 source (if ethernet) + // dst: string &optional; ##< L2 destination (if ethernet) + // vlan: count &optional; ##< VLAN tag if any (and ethernet) + // ethertype: count &optional; ##< If ethernet + // proto: layer3_proto; ##< L3 proto + if ( is_ethernet ) + { + // Ethernet header layout is: + // dst[6bytes] src[6bytes] ethertype[2bytes]... + l2_hdr->Assign(0, new EnumVal(BifEnum::link_encap::link_ethernet, BifType::Enum::link_encap)); + l2_hdr->Assign(3, fmt_eui48(pkt->data + 6)); // src + l2_hdr->Assign(4, fmt_eui48(pkt->data)); // dst + if ( pkt->vlan ) + l2_hdr->Assign(5, new Val(pkt->vlan, TYPE_COUNT)); + l2_hdr->Assign(6, new Val(pkt->eth_type, TYPE_COUNT)); + if ( pkt->eth_type == ETHERTYPE_ARP || pkt->eth_type == ETHERTYPE_REVARP ) + { + // We also identify ARP for L3 over ethernet + l3 = BifEnum::layer3_proto::l3_arp; + } + } + else + { + l2_hdr->Assign(0, new EnumVal(BifEnum::link_encap::link_unknown, BifType::Enum::link_encap)); + } + l2_hdr->Assign(1, new Val(pkt->len, TYPE_COUNT)); + l2_hdr->Assign(2, new Val(pkt->cap_len, TYPE_COUNT)); + l2_hdr->Assign(7, new EnumVal(l3, BifType::Enum::layer3_proto)); + pkt_hdr->Assign(0, l2_hdr); + + if ( pkt->l3_proto == AF_INET ) + { + IP_Hdr ip_hdr((const struct ip*)(pkt->data + pkt->hdr_size), false); + return ip_hdr.BuildPktHdrVal(pkt_hdr, 1); + } + else if ( pkt->l3_proto == AF_INET6 ) + { + IP_Hdr ip6_hdr((const struct ip6_hdr*)(pkt->data + pkt->hdr_size), false, pkt->cap_len); + return ip6_hdr.BuildPktHdrVal(pkt_hdr, 1); + } + else + return pkt_hdr; + } + diff --git a/src/L2.h b/src/L2.h new file mode 100644 index 0000000000..588e9fb445 --- /dev/null +++ b/src/L2.h @@ -0,0 +1,38 @@ +#ifndef l2_h +#define l2_h + +#include "config.h" +#include "net_util.h" +#include "IP.h" +#include "Reporter.h" +#include "Val.h" +#include "Type.h" +#include "Packet.h" +#include + +/** + * A class that wraps an L2 packet. + */ +class L2_Hdr { +public: + L2_Hdr(const Packet *arg_pkt) + : pkt(arg_pkt) + { + } + + ~L2_Hdr() + { + } + + /** + * Returns a raw_pkt_hdr RecordVal, which includes L2 and also + * everything in IP_Hdr (i.e. IP4/6 + tcp/udp/icmp) + */ + RecordVal* BuildPktHdrVal() const; + +private: + Val *fmt_eui48(const u_char *mac) const; + const Packet *pkt; +}; + +#endif diff --git a/src/Net.cc b/src/Net.cc index af542cb1a6..4237b9f54d 100644 --- a/src/Net.cc +++ b/src/Net.cc @@ -62,10 +62,8 @@ double bro_start_network_time; // timestamp of first packet double last_watchdog_proc_time = 0.0; // value of above during last watchdog bool terminating = false; // whether we're done reading and finishing up -const struct pcap_pkthdr* current_hdr = 0; -const u_char* current_pkt = 0; +const Packet *current_pkt = 0; int current_dispatched = 0; -int current_hdr_size = 0; double current_timestamp = 0.0; iosource::PktSrc* current_pktsrc = 0; iosource::IOSource* current_iosrc = 0; @@ -109,7 +107,7 @@ RETSIGTYPE watchdog(int /* signo */) int frac_pst = int((processing_start_time - int_pst) * 1e6); - if ( current_hdr ) + if ( current_pkt ) { if ( ! pkt_dumper ) { @@ -127,10 +125,7 @@ RETSIGTYPE watchdog(int /* signo */) if ( pkt_dumper ) { - iosource::PktDumper::Packet p; - p.hdr = current_hdr; - p.data = current_pkt; - pkt_dumper->Dump(&p); + pkt_dumper->Dump(current_pkt); } } @@ -240,9 +235,7 @@ void expire_timers(iosource::PktSrc* src_ps) max_timer_expires - current_dispatched); } -void net_packet_dispatch(double t, const struct pcap_pkthdr* hdr, - const u_char* pkt, int hdr_size, - iosource::PktSrc* src_ps) +void net_packet_dispatch(double t, const Packet* pkt, iosource::PktSrc* src_ps) { if ( ! bro_start_network_time ) bro_start_network_time = t; @@ -278,7 +271,7 @@ void net_packet_dispatch(double t, const struct pcap_pkthdr* hdr, } } - sessions->DispatchPacket(t, hdr, pkt, hdr_size, src_ps); + sessions->DispatchPacket(t, pkt, src_ps); mgr.Drain(); if ( sp ) diff --git a/src/Net.h b/src/Net.h index 2e466f8c7f..d19bd9083c 100644 --- a/src/Net.h +++ b/src/Net.h @@ -19,8 +19,7 @@ extern void net_get_final_stats(); extern void net_finish(int drain_events); extern void net_delete(); // Reclaim all memory, etc. extern void net_update_time(double new_network_time); -extern void net_packet_dispatch(double t, const struct pcap_pkthdr* hdr, - const u_char* pkt, int hdr_size, +extern void net_packet_dispatch(double t, const Packet* pkt, iosource::PktSrc* src_ps); extern void expire_timers(iosource::PktSrc* src_ps = 0); extern void termination_signal(); @@ -74,10 +73,8 @@ extern bool using_communication; // Snaplen passed to libpcap. extern int snaplen; -extern const struct pcap_pkthdr* current_hdr; -extern const u_char* current_pkt; +extern const Packet* current_pkt; extern int current_dispatched; -extern int current_hdr_size; extern double current_timestamp; extern iosource::PktSrc* current_pktsrc; extern iosource::IOSource* current_iosrc; diff --git a/src/Packet.h b/src/Packet.h new file mode 100644 index 0000000000..05c826ec5f --- /dev/null +++ b/src/Packet.h @@ -0,0 +1,88 @@ +#ifndef packet_h +#define packet_h + +#include "Desc.h" +#include "IP.h" + +// A link-layer packet. +// +// Note that for serialization we don't use much of the support provided by +// the serialization framework. Serialize/Unserialize do all the work by +// themselves. In particular, Packets aren't derived from SerialObj. They are +// completely seperate and self-contained entities, and we don't need any of +// the sophisticated features like object caching. + +class Packet { +public: + Packet() + { + } + // Construct and initialize from packet data. + Packet(int arg_link_type, struct timeval *arg_ts, uint32 arg_caplen, + uint32 arg_len, const u_char *arg_data, int arg_free = false, + std::string arg_tag = std::string(""), uint32 arg_hdrsize = 0, + int arg_l3_proto = -1) + { + Init(arg_link_type, arg_ts, arg_caplen, arg_len, arg_data, arg_free, arg_tag, + arg_hdrsize, arg_l3_proto); + } + + ~Packet() + { + if ( free ) + delete [] data; + } + + // Initialize with data from pointer + void Init(int arg_link_type, struct timeval *arg_ts, uint32 arg_caplen, + uint32 arg_len, const u_char *arg_data, int arg_free = false, + std::string arg_tag = std::string(""), uint32 arg_hdrsize = 0, + int arg_l3_proto = -1) + { + link_type = arg_link_type; + ts = *arg_ts; + cap_len = arg_caplen; + len = arg_len; + free = arg_free; + if ( free ) + { + data = new u_char [cap_len]; + memcpy(const_cast(data), arg_data, cap_len); + } + else + data = arg_data; + hdr_size = arg_hdrsize; + l3_proto = arg_l3_proto; + tag = arg_tag; + time = ts.tv_sec + double(ts.tv_usec) / 1e6; + eth_type = 0; + vlan = 0; + } + + const IP_Hdr IP() const + { return IP_Hdr((struct ip *) (data + hdr_size), true); } + + void Describe(ODesc* d) const; + + bool Serialize(SerialInfo* info) const; + static Packet* Unserialize(UnserialInfo* info); + + std::string tag; // Used in serialization + double time; // Timestamp reconstituted as float + + struct timeval ts; // Capture timestamp + const u_char* data; // Packet data. + uint32 link_type; // pcap link_type (DLT_EN10MB, DLT_RAW, etc) + uint32 cap_len; // Captured packet length + uint32 len; // Actual length on wire + uint32 hdr_size; // Layer 2 header size + uint32 l3_proto; // Layer 3 protocol identified (if any) + uint32 eth_type; // If L2==ethernet, innermost ethertype field + uint32 vlan; // (Outermost) VLan tag if any, else 0 + +private: + // should we delete associated packet memory upon destruction. + bool free; +}; + +#endif // packet_h diff --git a/src/RemoteSerializer.cc b/src/RemoteSerializer.cc index d359c1ea5d..44ec678a0f 100644 --- a/src/RemoteSerializer.cc +++ b/src/RemoteSerializer.cc @@ -1453,7 +1453,7 @@ void RemoteSerializer::Process() if ( packets.length() ) { BufferedPacket* bp = packets[0]; - Packet* p = bp->p; + const Packet* p = bp->p; // FIXME: The following chunk of code is copied from // net_packet_dispatch(). We should change that function @@ -1465,14 +1465,12 @@ void RemoteSerializer::Process() current_dispatched = tmgr->Advance(network_time, max_timer_expires); - current_hdr = p->hdr; - current_pkt = p->pkt; + current_pkt = p; current_pktsrc = 0; current_iosrc = this; - sessions->NextPacket(p->time, p->hdr, p->pkt, p->hdr_size); + sessions->NextPacket(p->time, p); mgr.Drain(); - current_hdr = 0; // done with these current_pkt = 0; current_iosrc = 0; diff --git a/src/Serializer.cc b/src/Serializer.cc index 7306b0ded0..54266de1d0 100644 --- a/src/Serializer.cc +++ b/src/Serializer.cc @@ -1133,12 +1133,14 @@ void Packet::Describe(ODesc* d) const bool Packet::Serialize(SerialInfo* info) const { - return SERIALIZE(uint32(hdr->ts.tv_sec)) && - SERIALIZE(uint32(hdr->ts.tv_usec)) && - SERIALIZE(uint32(hdr->len)) && - SERIALIZE(link_type) && - info->s->Write(tag.c_str(), 0, "tag") && - info->s->Write((const char*) pkt, hdr->caplen, "data"); + return SERIALIZE(uint32(ts.tv_sec)) && + SERIALIZE(uint32(ts.tv_usec)) && + SERIALIZE(uint32(len)) && + SERIALIZE(uint32(link_type)) && + SERIALIZE(uint32(hdr_size)) && + SERIALIZE(uint32(l3_proto)) && + info->s->Write(tag.c_str(), tag.length(), "tag") && + info->s->Write((const char*)data, cap_len, "data"); } static BroFile* profiling_output = 0; @@ -1149,49 +1151,31 @@ static iosource::PktDumper* dump = 0; Packet* Packet::Unserialize(UnserialInfo* info) { - Packet* p = new Packet("", true); - pcap_pkthdr* hdr = new pcap_pkthdr; + struct timeval ts; + uint32 len, link_type, hdr_size, l3_proto; - uint32 tv_sec, tv_usec, len; - - if ( ! (UNSERIALIZE(&tv_sec) && - UNSERIALIZE(&tv_usec) && + if ( ! (UNSERIALIZE((uint32 *)&ts.tv_sec) && + UNSERIALIZE((uint32 *)&ts.tv_usec) && UNSERIALIZE(&len) && - UNSERIALIZE(&p->link_type)) ) - { - delete p; - delete hdr; + UNSERIALIZE(&link_type) && + UNSERIALIZE(&hdr_size) && + UNSERIALIZE(&l3_proto)) ) return 0; - } - - hdr->ts.tv_sec = tv_sec; - hdr->ts.tv_usec = tv_usec; - hdr->len = len; char* tag; if ( ! info->s->Read((char**) &tag, 0, "tag") ) - { - delete p; - delete hdr; return 0; - } - char* pkt; + const u_char* pkt; int caplen; if ( ! info->s->Read((char**) &pkt, &caplen, "data") ) { - delete p; - delete hdr; delete [] tag; return 0; } - hdr->caplen = uint32(caplen); - p->hdr = hdr; - p->pkt = (u_char*) pkt; - p->tag = tag; - p->hdr_size = iosource::PktSrc::GetLinkHeaderSize(p->link_type); - + Packet *p = new Packet(link_type, &ts, caplen, len, pkt, true, + std::string(tag), hdr_size, l3_proto); delete [] tag; // For the global timer manager, we take the global network_time as the @@ -1199,7 +1183,7 @@ Packet* Packet::Unserialize(UnserialInfo* info) if ( p->tag == "" ) p->time = timer_mgr->Time(); else - p->time = p->hdr->ts.tv_sec + double(p->hdr->ts.tv_usec) / 1e6; + p->time = p->ts.tv_sec + double(p->ts.tv_usec) / 1e6; if ( time_machine_profiling ) { @@ -1208,7 +1192,7 @@ Packet* Packet::Unserialize(UnserialInfo* info) new BroFile("tm-prof.packets.log", "w"); profiling_output->Write(fmt("%.6f %s %d\n", current_time(), - (p->tag != "" ? p->tag.c_str() : "-"), hdr->len)); + (p->tag != "" ? p->tag.c_str() : "-"), p->len)); } #ifdef DEBUG @@ -1219,10 +1203,7 @@ Packet* Packet::Unserialize(UnserialInfo* info) if ( dump ) { - iosource::PktDumper::Packet dp; - dp.hdr = p->hdr; - dp.data = p->pkt; - dump->Dump(&dp); + dump->Dump(p); } } #endif diff --git a/src/Serializer.h b/src/Serializer.h index 558dce2086..43a9943cc5 100644 --- a/src/Serializer.h +++ b/src/Serializer.h @@ -378,64 +378,6 @@ protected: }; - -// A link-layer packet. -// -// Eventually we should use something like this consistently throughout Bro, -// replacing the current packet arguments in functions like *::NextPacket(). -// Before doing this, though, we should consider provisioning for packet -// formats other than just libpcap by designing a more abstract interface. -// -// Note that for serialization we don't use much of the support provided by -// the serialization framework. Serialize/Unserialize do all the work by -// themselves. In particular, Packets aren't derived from SerialObj. They are -// completely seperate and self-contained entities, and we don't need any of -// the sophisticated features like object caching. - -class Packet { -public: - // Argument is whether we should delete associatd memory upon - // destruction. - Packet(TimerMgr::Tag arg_tag, bool arg_free = false) - { - time = 0.0; - hdr = 0; - pkt = 0; - hdr_size = 0; - free = arg_free; - tag = arg_tag; - link_type = 0; - } - - ~Packet() - { - if ( free ) - { - delete hdr; - delete [] pkt; - } - } - - const IP_Hdr IP() const - { return IP_Hdr((struct ip *) (pkt + hdr_size), true); } - - void Describe(ODesc* d) const; - - bool Serialize(SerialInfo* info) const; - static Packet* Unserialize(UnserialInfo* info); - - const struct pcap_pkthdr* hdr; - const u_char* pkt; - TimerMgr::Tag tag; - uint32 link_type; - - double time; - int hdr_size; - -private: - bool free; -}; - extern FileSerializer* event_serializer; extern FileSerializer* state_serializer; diff --git a/src/Sessions.cc b/src/Sessions.cc index 086216e93d..e1c9e29c16 100644 --- a/src/Sessions.cc +++ b/src/Sessions.cc @@ -15,6 +15,7 @@ #include "Sessions.h" #include "Reporter.h" #include "OSFinger.h" +#include "L2.h" #include "analyzer/protocol/icmp/ICMP.h" #include "analyzer/protocol/udp/UDP.h" @@ -165,98 +166,85 @@ void NetSessions::Done() { } -void NetSessions::DispatchPacket(double t, const struct pcap_pkthdr* hdr, - const u_char* pkt, int hdr_size, +void NetSessions::DispatchPacket(double t, const Packet* pkt, iosource::PktSrc* src_ps) { - const struct ip* ip_hdr = 0; - const u_char* ip_data = 0; - int proto = 0; - - if ( hdr->caplen >= hdr_size + sizeof(struct ip) ) - { - ip_hdr = reinterpret_cast(pkt + hdr_size); - if ( hdr->caplen >= unsigned(hdr_size + (ip_hdr->ip_hl << 2)) ) - ip_data = pkt + hdr_size + (ip_hdr->ip_hl << 2); - } - - if ( encap_hdr_size > 0 && ip_data ) - // Blanket encapsulation - hdr_size += encap_hdr_size; - - NextPacket(t, hdr, pkt, hdr_size); + NextPacket(t, pkt); } -void NetSessions::NextPacket(double t, const struct pcap_pkthdr* hdr, - const u_char* const pkt, int hdr_size) +void NetSessions::NextPacket(double t, const Packet* pkt) + { + ProcNextPacket(t, pkt); + if ( raw_packet ) + { + val_list* vl = new val_list(); + L2_Hdr l2_hdr(pkt); + vl->append(l2_hdr.BuildPktHdrVal()); + mgr.QueueEvent(raw_packet, vl); + } + } + +void NetSessions::ProcNextPacket(double t, const Packet *pkt) { SegmentProfiler(segment_logger, "processing-packet"); if ( pkt_profiler ) - pkt_profiler->ProfilePkt(t, hdr->caplen); + pkt_profiler->ProfilePkt(t, pkt->cap_len); ++num_packets_processed; dump_this_packet = 0; if ( record_all_packets ) - DumpPacket(hdr, pkt); + DumpPacket(pkt); - // ### The following isn't really correct. What we *should* - // do is understanding the different link layers in order to - // find the network-layer protocol ID. That's a big - // portability pain, though, unless we just assume everything's - // Ethernet .... not great, given the potential need to deal - // with PPP or FDDI (for some older traces). So instead - // we look to see if what we have is consistent with an - // IPv4 packet. If not, it's either ARP or IPv6 or weird. - - if ( hdr_size > static_cast(hdr->caplen) ) + if ( pkt->hdr_size > pkt->cap_len ) { - Weird("truncated_link_frame", hdr, pkt); + Weird("truncated_link_frame", pkt); return; } - uint32 caplen = hdr->caplen - hdr_size; - if ( caplen < sizeof(struct ip) ) - { - Weird("truncated_IP", hdr, pkt); - return; - } + uint32 caplen = pkt->cap_len - pkt->hdr_size; - const struct ip* ip = (const struct ip*) (pkt + hdr_size); - - if ( ip->ip_v == 4 ) + if ( pkt->l3_proto == AF_INET ) { - IP_Hdr ip_hdr(ip, false); - DoNextPacket(t, hdr, &ip_hdr, pkt, hdr_size, 0); - } - - else if ( ip->ip_v == 6 ) - { - if ( caplen < sizeof(struct ip6_hdr) ) + if ( caplen < sizeof(struct ip) ) { - Weird("truncated_IP", hdr, pkt); + Weird("truncated_IP", pkt); return; } - IP_Hdr ip_hdr((const struct ip6_hdr*) (pkt + hdr_size), false, caplen); - DoNextPacket(t, hdr, &ip_hdr, pkt, hdr_size, 0); + const struct ip* ip = (const struct ip*) (pkt->data + pkt->hdr_size); + IP_Hdr ip_hdr(ip, false); + DoNextPacket(t, pkt, &ip_hdr, 0); } - else if ( analyzer::arp::ARP_Analyzer::IsARP(pkt, hdr_size) ) + else if ( pkt->l3_proto == AF_INET6 ) + { + if ( caplen < sizeof(struct ip6_hdr) ) + { + Weird("truncated_IP", pkt); + return; + } + + IP_Hdr ip_hdr((const struct ip6_hdr*) (pkt->data + pkt->hdr_size), false, caplen); + DoNextPacket(t, pkt, &ip_hdr, 0); + } + + else if ( analyzer::arp::ARP_Analyzer::IsARP(pkt) ) { if ( arp_analyzer ) - arp_analyzer->NextPacket(t, hdr, pkt, hdr_size); + arp_analyzer->NextPacket(t, pkt); } else { - Weird("unknown_packet_type", hdr, pkt); + Weird("unknown_packet_type", pkt); return; } + if ( dump_this_packet && ! record_all_packets ) - DumpPacket(hdr, pkt); + DumpPacket(pkt); } int NetSessions::CheckConnectionTag(Connection* conn) @@ -337,26 +325,25 @@ static unsigned int gre_header_len(uint16 flags) return len; } -void NetSessions::DoNextPacket(double t, const struct pcap_pkthdr* hdr, - const IP_Hdr* ip_hdr, const u_char* const pkt, - int hdr_size, const EncapsulationStack* encapsulation) +void NetSessions::DoNextPacket(double t, const Packet* pkt, const IP_Hdr* ip_hdr, + const EncapsulationStack* encapsulation) { - uint32 caplen = hdr->caplen - hdr_size; + uint32 caplen = pkt->cap_len - pkt->hdr_size; const struct ip* ip4 = ip_hdr->IP4_Hdr(); uint32 len = ip_hdr->TotalLen(); if ( len == 0 ) { // TCP segmentation offloading can zero out the ip_len field. - Weird("ip_hdr_len_zero", hdr, pkt, encapsulation); + Weird("ip_hdr_len_zero", pkt, encapsulation); // Cope with the zero'd out ip_len field by using the caplen. - len = hdr->caplen - hdr_size; + len = pkt->cap_len - pkt->hdr_size; } - if ( hdr->len < len + hdr_size ) + if ( pkt->len < len + pkt->hdr_size ) { - Weird("truncated_IP", hdr, pkt, encapsulation); + Weird("truncated_IP", pkt, encapsulation); return; } @@ -368,7 +355,7 @@ void NetSessions::DoNextPacket(double t, const struct pcap_pkthdr* hdr, if ( ! ignore_checksums && ip4 && ones_complement_checksum((void*) ip4, ip_hdr_len, 0) != 0xffff ) { - Weird("bad_IP_checksum", hdr, pkt, encapsulation); + Weird("bad_IP_checksum", pkt, encapsulation); return; } @@ -393,7 +380,7 @@ void NetSessions::DoNextPacket(double t, const struct pcap_pkthdr* hdr, } else { - f = NextFragment(t, ip_hdr, pkt + hdr_size); + f = NextFragment(t, ip_hdr, pkt->data + pkt->hdr_size); const IP_Hdr* ih = f->ReassembledPkt(); if ( ! ih ) // It didn't reassemble into anything yet. @@ -437,7 +424,7 @@ void NetSessions::DoNextPacket(double t, const struct pcap_pkthdr* hdr, if ( ! ignore_checksums && mobility_header_checksum(ip_hdr) != 0xffff ) { - Weird("bad_MH_checksum", hdr, pkt, encapsulation); + Weird("bad_MH_checksum", pkt, encapsulation); return; } @@ -449,7 +436,7 @@ void NetSessions::DoNextPacket(double t, const struct pcap_pkthdr* hdr, } if ( ip_hdr->NextProto() != IPPROTO_NONE ) - Weird("mobility_piggyback", hdr, pkt, encapsulation); + Weird("mobility_piggyback", pkt, encapsulation); return; } @@ -457,7 +444,7 @@ void NetSessions::DoNextPacket(double t, const struct pcap_pkthdr* hdr, int proto = ip_hdr->NextProto(); - if ( CheckHeaderTrunc(proto, len, caplen, hdr, pkt, encapsulation) ) + if ( CheckHeaderTrunc(proto, len, caplen, pkt, encapsulation) ) return; const u_char* data = ip_hdr->Payload(); @@ -664,7 +651,7 @@ void NetSessions::DoNextPacket(double t, const struct pcap_pkthdr* hdr, else it->second.second = network_time; - DoNextInnerPacket(t, hdr, inner, encapsulation, + DoNextInnerPacket(t, pkt, inner, encapsulation, ip_tunnels[tunnel_idx].first); return; @@ -677,13 +664,13 @@ void NetSessions::DoNextPacket(double t, const struct pcap_pkthdr* hdr, // not sure the reason for the No Next header in the packet. if ( ! ( encapsulation && encapsulation->LastType() == BifEnum::Tunnel::TEREDO ) ) - Weird("ipv6_no_next", hdr, pkt); + Weird("ipv6_no_next", pkt); return; } default: - Weird(fmt("unknown_protocol_%d", proto), hdr, pkt, encapsulation); + Weird(fmt("unknown_protocol_%d", proto), pkt, encapsulation); return; } @@ -756,8 +743,7 @@ void NetSessions::DoNextPacket(double t, const struct pcap_pkthdr* hdr, pkt_hdr_val ? pkt_hdr_val->Ref() : ip_hdr->BuildPktHdrVal()); conn->NextPacket(t, is_orig, ip_hdr, len, caplen, data, - record_packet, record_content, - hdr, pkt, hdr_size); + record_packet, record_content, pkt); if ( f ) { @@ -772,40 +758,52 @@ void NetSessions::DoNextPacket(double t, const struct pcap_pkthdr* hdr, else { - int hdr_len = data - pkt; - DumpPacket(hdr, pkt, hdr_len); // just save the header + int hdr_len = data - pkt->data; + DumpPacket(pkt, hdr_len); // just save the header } } } -void NetSessions::DoNextInnerPacket(double t, const struct pcap_pkthdr* hdr, +void NetSessions::DoNextInnerPacket(double t, const Packet* pkt, const IP_Hdr* inner, const EncapsulationStack* prev, const EncapsulatingConn& ec) { - struct pcap_pkthdr fake_hdr; - fake_hdr.caplen = fake_hdr.len = inner->TotalLen(); + uint32 caplen, len; + caplen = len = inner->TotalLen(); - if ( hdr ) - fake_hdr.ts = hdr->ts; + struct timeval ts; + int link_type, l3_proto; + + if ( pkt ) + ts = pkt->ts; else { - fake_hdr.ts.tv_sec = (time_t) network_time; - fake_hdr.ts.tv_usec = (suseconds_t) - ((network_time - (double)fake_hdr.ts.tv_sec) * 1000000); + ts.tv_sec = (time_t) network_time; + ts.tv_usec = (suseconds_t) + ((network_time - (double)ts.tv_sec) * 1000000); } - const u_char* pkt = 0; + const u_char* data = 0; if ( inner->IP4_Hdr() ) - pkt = (const u_char*) inner->IP4_Hdr(); + { + data = (const u_char*) inner->IP4_Hdr(); + l3_proto = AF_INET; + } else - pkt = (const u_char*) inner->IP6_Hdr(); + { + data = (const u_char*) inner->IP6_Hdr(); + l3_proto = AF_INET6; + } EncapsulationStack* outer = prev ? new EncapsulationStack(*prev) : new EncapsulationStack(); outer->Add(ec); - DoNextPacket(t, &fake_hdr, inner, pkt, 0, outer); + // Construct fake packet for DoNextPacket + Packet p; + p.Init(DLT_RAW, &ts, caplen, len, data, false, "", 0, l3_proto); + DoNextPacket(t, &p, inner, outer); delete inner; delete outer; @@ -843,8 +841,7 @@ int NetSessions::ParseIPPacket(int caplen, const u_char* const pkt, int proto, } bool NetSessions::CheckHeaderTrunc(int proto, uint32 len, uint32 caplen, - const struct pcap_pkthdr* h, - const u_char* p, const EncapsulationStack* encap) + const Packet* p, const EncapsulationStack* encap) { uint32 min_hdr_len = 0; switch ( proto ) { @@ -876,13 +873,13 @@ bool NetSessions::CheckHeaderTrunc(int proto, uint32 len, uint32 caplen, if ( len < min_hdr_len ) { - Weird("truncated_header", h, p, encap); + Weird("truncated_header", p, encap); return true; } if ( caplen < min_hdr_len ) { - Weird("internally_truncated_header", h, p, encap); + Weird("internally_truncated_header", p, encap); return true; } @@ -1387,45 +1384,26 @@ void NetSessions::ExpireTimerMgrs() } } -void NetSessions::DumpPacket(const struct pcap_pkthdr* hdr, - const u_char* pkt, int len) +void NetSessions::DumpPacket(const Packet *pkt, int len) { if ( ! pkt_dumper ) return; - if ( len == 0 ) + if ( len != 0 ) { - iosource::PktDumper::Packet p; - p.hdr = hdr; - p.data = pkt; - pkt_dumper->Dump(&p); - } - - else - { - struct pcap_pkthdr h = *hdr; - h.caplen = len; - if ( h.caplen > hdr->caplen ) + if ( (uint32)len > pkt->cap_len ) reporter->InternalError("bad modified caplen"); - - iosource::PktDumper::Packet p; - p.hdr = &h; - p.data = pkt; - pkt_dumper->Dump(&p); + else + const_cast(pkt)->cap_len = len; } + + pkt_dumper->Dump(pkt); } -void NetSessions::Internal(const char* msg, const struct pcap_pkthdr* hdr, - const u_char* pkt) +void NetSessions::Weird(const char* name, const Packet* pkt, + const EncapsulationStack* encap) { - DumpPacket(hdr, pkt); - reporter->InternalError("%s", msg); - } - -void NetSessions::Weird(const char* name, const struct pcap_pkthdr* hdr, - const u_char* pkt, const EncapsulationStack* encap) - { - if ( hdr ) + if ( pkt ) dump_this_packet = 1; if ( encap && encap->LastType() != BifEnum::Tunnel::NONE ) diff --git a/src/Sessions.h b/src/Sessions.h index c46c092263..51539c42ef 100644 --- a/src/Sessions.h +++ b/src/Sessions.h @@ -15,8 +15,6 @@ #include -struct pcap_pkthdr; - class EncapsulationStack; class Connection; class OSFingerprint; @@ -71,8 +69,7 @@ public: // Main entry point for packet processing. Dispatches the packet // either through NextPacket(), optionally employing the packet // sorter first. - void DispatchPacket(double t, const struct pcap_pkthdr* hdr, - const u_char* const pkt, int hdr_size, + void DispatchPacket(double t, const Packet* pkt, iosource::PktSrc* src_ps); void Done(); // call to drain events before destructing @@ -106,8 +103,8 @@ public: void GetStats(SessionStats& s) const; - void Weird(const char* name, const struct pcap_pkthdr* hdr, - const u_char* pkt, const EncapsulationStack* encap = 0); + void Weird(const char* name, const Packet* pkt, + const EncapsulationStack* encap = 0); void Weird(const char* name, const IP_Hdr* ip, const EncapsulationStack* encap = 0); @@ -133,9 +130,8 @@ public: icmp_conns.Length(); } - void DoNextPacket(double t, const struct pcap_pkthdr* hdr, - const IP_Hdr* ip_hdr, const u_char* const pkt, - int hdr_size, const EncapsulationStack* encapsulation); + void DoNextPacket(double t, const Packet *pkt, const IP_Hdr* ip_hdr, + const EncapsulationStack* encapsulation); /** * Wrapper that recurses on DoNextPacket for encapsulated IP packets. @@ -151,7 +147,7 @@ public: * the most-recently found depth of encapsulation. * @param ec The most-recently found depth of encapsulation. */ - void DoNextInnerPacket(double t, const struct pcap_pkthdr* hdr, + void DoNextInnerPacket(double t, const Packet *pkt, const IP_Hdr* inner, const EncapsulationStack* prev, const EncapsulatingConn& ec); @@ -218,24 +214,20 @@ protected: TransportProto transport_proto, uint8 tcp_flags, bool& flip_roles); - void NextPacket(double t, const struct pcap_pkthdr* hdr, - const u_char* const pkt, int hdr_size); + void NextPacket(double t, const Packet* pkt); + + void ProcNextPacket(double t, const Packet *pkt); // Record the given packet (if a dumper is active). If len=0 // then the whole packet is recorded, otherwise just the first // len bytes. - void DumpPacket(const struct pcap_pkthdr* hdr, const u_char* pkt, - int len=0); - - void Internal(const char* msg, const struct pcap_pkthdr* hdr, - const u_char* pkt); + void DumpPacket(const Packet *pkt, int len=0); // For a given protocol, checks whether the header's length as derived // from lower-level headers or the length actually captured is less // than that protocol's minimum header size. bool CheckHeaderTrunc(int proto, uint32 len, uint32 caplen, - const struct pcap_pkthdr* hdr, const u_char* pkt, - const EncapsulationStack* encap); + const Packet *pkt, const EncapsulationStack* encap); CompositeHash* ch; PDict(Connection) tcp_conns; diff --git a/src/analyzer/protocol/arp/ARP.cc b/src/analyzer/protocol/arp/ARP.cc index b3ef5383ce..862bd742ee 100644 --- a/src/analyzer/protocol/arp/ARP.cc +++ b/src/analyzer/protocol/arp/ARP.cc @@ -19,10 +19,14 @@ ARP_Analyzer::~ARP_Analyzer() { } -bool ARP_Analyzer::IsARP(const u_char* pkt, int hdr_size) +// Assume pkt->hdr_size indicates size of the Layer 2 header. +bool ARP_Analyzer::IsARP(const Packet* pkt) { + if ( pkt->hdr_size < 2 ) + return false; + unsigned short network_protocol = - *(unsigned short*) (pkt + hdr_size - 2); + *(unsigned short*) (pkt->data + pkt->hdr_size - 2); switch ( ntohs(network_protocol) ) { case ETHERTYPE_ARP: @@ -93,16 +97,16 @@ bool ARP_Analyzer::IsARP(const u_char* pkt, int hdr_size) #endif -void ARP_Analyzer::NextPacket(double t, const struct pcap_pkthdr* hdr, - const u_char* const pkt, int hdr_size) +void ARP_Analyzer::NextPacket(double t, const Packet* pkt) { + const u_char *data = pkt->data; // Check whether the packet is OK ("inspired" in tcpdump's print-arp.c). const struct arp_pkthdr* ah = - (const struct arp_pkthdr*) (pkt + hdr_size); + (const struct arp_pkthdr*) (data + pkt->hdr_size); // Check the size. - int min_length = (ar_tpa(ah) - (char*) (pkt + hdr_size)) + ah->ar_pln; - int real_length = hdr->caplen - hdr_size; + int min_length = (ar_tpa(ah) - (char*) (data + pkt->hdr_size)) + ah->ar_pln; + int real_length = pkt->cap_len - pkt->hdr_size; if ( min_length > real_length ) { Corrupted("truncated_ARP"); @@ -158,7 +162,7 @@ void ARP_Analyzer::NextPacket(double t, const struct pcap_pkthdr* hdr, // Check MAC src address = ARP sender MAC address. - if ( memcmp((const char*) (pkt+6), ar_sha(ah), ah->ar_hln) ) + if ( memcmp((const char*) (data+6), ar_sha(ah), ah->ar_hln) ) { BadARP(ah, "weird-arp-sha"); return; @@ -167,12 +171,12 @@ void ARP_Analyzer::NextPacket(double t, const struct pcap_pkthdr* hdr, // Check the code is supported. switch ( ntohs(ah->ar_op) ) { case ARPOP_REQUEST: - RREvent(arp_request, pkt+6, pkt, + RREvent(arp_request, data+6, data, ar_spa(ah), ar_sha(ah), ar_tpa(ah), ar_tha(ah)); break; case ARPOP_REPLY: - RREvent(arp_reply, pkt+6, pkt, + RREvent(arp_reply, data+6, data, ar_spa(ah), ar_sha(ah), ar_tpa(ah), ar_tha(ah)); break; diff --git a/src/analyzer/protocol/arp/ARP.h b/src/analyzer/protocol/arp/ARP.h index ad771b8db9..9f7142c846 100644 --- a/src/analyzer/protocol/arp/ARP.h +++ b/src/analyzer/protocol/arp/ARP.h @@ -24,6 +24,7 @@ #endif #include "NetVar.h" +#include "Packet.h" extern "C" { #include @@ -36,8 +37,7 @@ public: ARP_Analyzer(); virtual ~ARP_Analyzer(); - void NextPacket(double t, const struct pcap_pkthdr* hdr, - const u_char* const pkt, int hdr_size); + void NextPacket(double t, const Packet* pkt); void Describe(ODesc* d) const; void RREvent(EventHandlerPtr e, const u_char* src, const u_char* dst, @@ -45,7 +45,7 @@ public: const char* tpa, const char* tha); // Whether a packet is of interest for ARP analysis. - static bool IsARP(const u_char* pkt, int hdr_size); + static bool IsARP(const Packet *pkt); protected: AddrVal* ConstructAddrVal(const void* addr); diff --git a/src/bro.bif b/src/bro.bif index 037b236cc0..4eb1f89041 100644 --- a/src/bro.bif +++ b/src/bro.bif @@ -20,6 +20,7 @@ #include "Reporter.h" #include "IPAddr.h" #include "util.h" +#include "Packet.h" #include "file_analysis/Manager.h" #include "iosource/Manager.h" @@ -3238,11 +3239,10 @@ const char* conn_id_string(Val* c) ## .. bro:see:: dump_packet get_current_packet send_current_packet function dump_current_packet%(file_name: string%) : bool %{ - const struct pcap_pkthdr* hdr; - const u_char* pkt; + const Packet* pkt; if ( ! current_pktsrc || - ! current_pktsrc->GetCurrentPacket(&hdr, &pkt) ) + ! current_pktsrc->GetCurrentPacket(&pkt) ) return new Val(0, TYPE_BOOL); if ( ! addl_pkt_dumper ) @@ -3250,13 +3250,10 @@ function dump_current_packet%(file_name: string%) : bool if ( addl_pkt_dumper ) { - iosource::PktDumper::Packet p; - p.hdr = hdr; - p.data = pkt; - addl_pkt_dumper->Dump(&p); + addl_pkt_dumper->Dump(pkt); } - return new Val(! addl_pkt_dumper->IsError(), TYPE_BOOL); + return new Val( !!addl_pkt_dumper && ! addl_pkt_dumper->IsError(), TYPE_BOOL); %} ## Returns the currently processed PCAP packet. @@ -3267,26 +3264,27 @@ function dump_current_packet%(file_name: string%) : bool ## .. bro:see:: dump_current_packet dump_packet send_current_packet function get_current_packet%(%) : pcap_packet %{ - const struct pcap_pkthdr* hdr; - const u_char* data; + const Packet* p; RecordVal* pkt = new RecordVal(pcap_packet); if ( ! current_pktsrc || - ! current_pktsrc->GetCurrentPacket(&hdr, &data) ) + ! current_pktsrc->GetCurrentPacket(&p) ) { pkt->Assign(0, new Val(0, TYPE_COUNT)); pkt->Assign(1, new Val(0, TYPE_COUNT)); pkt->Assign(2, new Val(0, TYPE_COUNT)); pkt->Assign(3, new Val(0, TYPE_COUNT)); pkt->Assign(4, new StringVal("")); + pkt->Assign(5, new EnumVal(BifEnum::link_encap::link_unknown, BifType::Enum::link_encap)); return pkt; } - pkt->Assign(0, new Val(uint32(hdr->ts.tv_sec), TYPE_COUNT)); - pkt->Assign(1, new Val(uint32(hdr->ts.tv_usec), TYPE_COUNT)); - pkt->Assign(2, new Val(hdr->caplen, TYPE_COUNT)); - pkt->Assign(3, new Val(hdr->len, TYPE_COUNT)); - pkt->Assign(4, new StringVal(hdr->caplen, (const char*) data)); + pkt->Assign(0, new Val(uint32(p->ts.tv_sec), TYPE_COUNT)); + pkt->Assign(1, new Val(uint32(p->ts.tv_usec), TYPE_COUNT)); + pkt->Assign(2, new Val(p->cap_len, TYPE_COUNT)); + pkt->Assign(3, new Val(p->len, TYPE_COUNT)); + pkt->Assign(4, new StringVal(p->cap_len, (const char*)p->data)); + pkt->Assign(5, new EnumVal(p->link_type, BifType::Enum::link_encap)); return pkt; %} @@ -3302,26 +3300,29 @@ function get_current_packet%(%) : pcap_packet ## .. bro:see:: get_current_packet dump_current_packet send_current_packet function dump_packet%(pkt: pcap_packet, file_name: string%) : bool %{ - struct pcap_pkthdr hdr; - const val_list* pkt_vl = pkt->AsRecord(); - - hdr.ts.tv_sec = (*pkt_vl)[0]->AsCount(); - hdr.ts.tv_usec = (*pkt_vl)[1]->AsCount(); - hdr.caplen = (*pkt_vl)[2]->AsCount(); - hdr.len = (*pkt_vl)[3]->AsCount(); - if ( ! addl_pkt_dumper ) addl_pkt_dumper = iosource_mgr->OpenPktDumper(file_name->CheckString(), true); if ( addl_pkt_dumper ) { - iosource::PktDumper::Packet p; - p.hdr = &hdr; - p.data = (*pkt_vl)[4]->AsString()->Bytes(); + struct timeval ts; + uint32 caplen, len, link_type; + u_char *data; + + const val_list* pkt_vl = pkt->AsRecord(); + + ts.tv_sec = (*pkt_vl)[0]->AsCount(); + ts.tv_usec = (*pkt_vl)[1]->AsCount(); + caplen = (*pkt_vl)[2]->AsCount(); + len = (*pkt_vl)[3]->AsCount(); + data = (*pkt_vl)[4]->AsString()->Bytes(); + link_type = (*pkt_vl)[5]->AsEnum(); + Packet p(link_type, &ts, caplen, len, data, true); + addl_pkt_dumper->Dump(&p); } - return new Val(addl_pkt_dumper->IsError(), TYPE_BOOL); + return new Val(!!addl_pkt_dumper && !addl_pkt_dumper->IsError(), TYPE_BOOL); %} %%{ @@ -4800,20 +4801,16 @@ function send_ping%(p: event_peer, seq: count%) : bool ## dump_packet dump_current_packet get_current_packet function send_current_packet%(p: event_peer%) : bool %{ - Packet pkt(""); + const Packet* pkt; if ( ! current_pktsrc || - ! current_pktsrc->GetCurrentPacket(&pkt.hdr, &pkt.pkt) ) + ! current_pktsrc->GetCurrentPacket(&pkt) ) return new Val(0, TYPE_BOOL); RemoteSerializer::PeerID id = p->AsRecordVal()->Lookup(0)->AsCount(); - pkt.time = pkt.hdr->ts.tv_sec + double(pkt.hdr->ts.tv_usec) / 1e6; - pkt.hdr_size = current_pktsrc->HdrSize(); - pkt.link_type = current_pktsrc->LinkType(); - SerialInfo info(remote_serializer); - return new Val(remote_serializer->SendPacket(&info, id, pkt), TYPE_BOOL); + return new Val(remote_serializer->SendPacket(&info, id, *pkt), TYPE_BOOL); %} ## Returns the peer who generated the last event. diff --git a/src/event.bif b/src/event.bif index 6531bef6d8..3e4454c627 100644 --- a/src/event.bif +++ b/src/event.bif @@ -225,11 +225,20 @@ event udp_session_done%(u: connection%); ## ``ANALYZER_*`` constants right now. event scheduled_analyzer_applied%(c: connection, a: Analyzer::Tag%); -## Generated for every packet Bro sees. This is a very low-level and expensive -## event that should be avoided when at all possible. It's usually infeasible to -## handle when processing even medium volumes of traffic in real-time. That -## said, if you work from a trace and want to do some packet-level analysis, -## it may come in handy. +## Generated for every packet Bro sees that has a valid link layer header. This +## is a very very low-level and expensive event that should be avoided when at +## all possible. +## +## p: Information from the header of the packet that triggered the event. +## +## .. bro:see:: new_packet packet_contents +event raw_packet%(p: raw_pkt_hdr%); + +## Generated for almost every packet Bro sees. This is a very low-level and +## expensive event that should be avoided when at all possible. It's usually +## infeasible to handle when processing even medium volumes of traffic in +## real-time. That said, if you work from a trace and want to do some +## packet-level analysis, it may come in handy. ## ## c: The connection the packet is part of. ## diff --git a/src/iosource/PktDumper.h b/src/iosource/PktDumper.h index 56555c247a..dcfda2030b 100644 --- a/src/iosource/PktDumper.h +++ b/src/iosource/PktDumper.h @@ -3,6 +3,7 @@ #ifndef IOSOURCE_PKTSRC_PKTDUMPER_H #define IOSOURCE_PKTSRC_PKTDUMPER_H +#include "Packet.h" #include "IOSource.h" namespace iosource { @@ -12,21 +13,6 @@ namespace iosource { */ class PktDumper { public: - /** - * Structure describing a packet. - */ - struct Packet { - /** - * The pcap header associated with the packet. - */ - const struct pcap_pkthdr* hdr; - - /** - * The full content of the packet. - */ - const unsigned char* data; - }; - /** * Constructor. */ diff --git a/src/iosource/PktSrc.cc b/src/iosource/PktSrc.cc index 5612c32e51..cb451088f5 100644 --- a/src/iosource/PktSrc.cc +++ b/src/iosource/PktSrc.cc @@ -147,7 +147,7 @@ void PktSrc::Info(const std::string& msg) void PktSrc::Weird(const std::string& msg, const Packet* p) { - sessions->Weird(msg.c_str(), p->hdr, p->data, 0); + sessions->Weird(msg.c_str(), p, 0); } void PktSrc::InternalError(const std::string& msg) @@ -197,20 +197,20 @@ double PktSrc::CheckPseudoTime() if ( remote_trace_sync_interval ) { - if ( next_sync_point == 0 || current_packet.ts >= next_sync_point ) + if ( next_sync_point == 0 || current_packet.time >= next_sync_point ) { int n = remote_serializer->SendSyncPoint(); next_sync_point = first_timestamp + n * remote_trace_sync_interval; remote_serializer->Log(RemoteSerializer::LogInfo, fmt("stopping at packet %.6f, next sync-point at %.6f", - current_packet.ts, next_sync_point)); + current_packet.time, next_sync_point)); return 0; } } - double pseudo_time = current_packet.ts - first_timestamp; + double pseudo_time = current_packet.time - first_timestamp; double ct = (current_time(true) - first_wallclock) * pseudo_realtime; return pseudo_time <= ct ? bro_start_time + pseudo_time : 0; @@ -261,7 +261,7 @@ double PktSrc::NextTimestamp(double* local_network_time) return -1.0; } - return current_packet.ts; + return current_packet.time; } void PktSrc::Process() @@ -272,20 +272,21 @@ void PktSrc::Process() if ( ! ExtractNextPacketInternal() ) return; - int pkt_hdr_size = props.hdr_size; - // Unfortunately some packets on the link might have MPLS labels // while others don't. That means we need to ask the link-layer if // labels are in place. bool have_mpls = false; + int l3_proto = 0; int protocol = 0; const u_char* data = current_packet.data; + current_packet.link_type = props.link_type; switch ( props.link_type ) { case DLT_NULL: { protocol = (data[3] << 24) + (data[2] << 16) + (data[1] << 8) + data[0]; + data += GetLinkHeaderSize(props.link_type); // From the Wireshark Wiki: "AF_INET6, unfortunately, has // different values in {NetBSD,OpenBSD,BSD/OS}, @@ -294,16 +295,14 @@ void PktSrc::Process() // as the AF_ value." As we may be reading traces captured on // platforms other than what we're running on, we accept them // all here. - if ( protocol != AF_INET - && protocol != AF_INET6 - && protocol != 24 - && protocol != 28 - && protocol != 30 ) + if ( protocol == 24 || protocol == 28 || protocol == 30 ) + protocol = AF_INET6; + if ( protocol != AF_INET && protocol != AF_INET6 ) { Weird("non_ip_packet_in_null_transport", ¤t_packet); goto done; } - + l3_proto = protocol; break; } @@ -311,7 +310,8 @@ void PktSrc::Process() { // Get protocol being carried from the ethernet frame. protocol = (data[12] << 8) + data[13]; - + data += GetLinkHeaderSize(props.link_type); + current_packet.eth_type = protocol; switch ( protocol ) { // MPLS carried over the ethernet frame. @@ -319,39 +319,43 @@ void PktSrc::Process() // Remove the data link layer and denote a // header size of zero before the IP header. have_mpls = true; - data += GetLinkHeaderSize(props.link_type); - pkt_hdr_size = 0; break; // VLAN carried over the ethernet frame. + // 802.1q / 802.1ad case 0x8100: - data += GetLinkHeaderSize(props.link_type); + case 0x9100: + current_packet.vlan = ((data[0] << 8) + data[1]) & 0xfff; + protocol = ((data[2] << 8) + data[3]); + data += 4; // Skip the vlan header // Check for MPLS in VLAN. - if ( ((data[2] << 8) + data[3]) == 0x8847 ) + if ( protocol == 0x8847 ) + { have_mpls = true; + break; + } - data += 4; // Skip the vlan header - pkt_hdr_size = 0; - - // Check for 802.1ah (Q-in-Q) containing IP. - // Only do a second layer of vlan tag - // stripping because there is no - // specification that allows for deeper - // nesting. - if ( ((data[2] << 8) + data[3]) == 0x0800 ) - data += 4; + // Check for double-tagged (802.1ad) + if ( protocol == 0x8100 || protocol == 0x9100 ) + { + protocol = ((data[2] << 8) + data[3]); + data += 4; // Skip the vlan header + } + current_packet.eth_type = protocol; break; // PPPoE carried over the ethernet frame. case 0x8864: - data += GetLinkHeaderSize(props.link_type); protocol = (data[6] << 8) + data[7]; data += 8; // Skip the PPPoE session and PPP header - pkt_hdr_size = 0; - if ( protocol != 0x0021 && protocol != 0x0057 ) + if ( protocol == 0x0021 ) + l3_proto = AF_INET; + else if ( protocol == 0x0057 ) + l3_proto = AF_INET6; + else { // Neither IPv4 nor IPv6. Weird("non_ip_packet_in_pppoe_encapsulation", ¤t_packet); @@ -360,6 +364,14 @@ void PktSrc::Process() break; } + // Normal path to determine Layer 3 protocol: + if ( !have_mpls && !l3_proto ) + { + if ( protocol == 0x800 ) + l3_proto = AF_INET; + else if ( protocol == 0x86dd ) + l3_proto = AF_INET6; + } break; } @@ -367,17 +379,19 @@ void PktSrc::Process() { // Get PPP protocol. protocol = (data[2] << 8) + data[3]; + data += GetLinkHeaderSize(props.link_type); if ( protocol == 0x0281 ) { // MPLS Unicast. Remove the data link layer and // denote a header size of zero before the IP header. have_mpls = true; - data += GetLinkHeaderSize(props.link_type); - pkt_hdr_size = 0; } - - else if ( protocol != 0x0021 && protocol != 0x0057 ) + else if ( protocol == 0x0021 ) + l3_proto = AF_INET; + else if ( protocol == 0x0057 ) + l3_proto = AF_INET6; + else { // Neither IPv4 nor IPv6. Weird("non_ip_packet_in_ppp_encapsulation", ¤t_packet); @@ -385,6 +399,14 @@ void PktSrc::Process() } break; } + default: + { + // Assume we're pointing at IP. Just figure out which version. + data += GetLinkHeaderSize(props.link_type); + const struct ip* ip = (const struct ip *)data; + l3_proto = ( ip->ip_v == 4 ) ? AF_INET : AF_INET6; + break; + } } if ( have_mpls ) @@ -396,19 +418,53 @@ void PktSrc::Process() { end_of_stack = *(data + 2) & 0x01; data += 4; + if ( data >= current_packet.data + current_packet.cap_len ) + { + Weird("no_mpls_payload", ¤t_packet); + goto done; + } } + + // We assume that what remains is IP + if ( data + sizeof(struct ip) >= current_packet.data + current_packet.cap_len ) + { + Weird("no_ip_in_mpls_payload", ¤t_packet); + goto done; + } + const struct ip* ip = (const struct ip *)data; + l3_proto = ( ip->ip_v == 4 ) ? AF_INET : AF_INET6; } + else if ( encap_hdr_size ) + { + // Blanket encapsulation + // We assume that what remains is IP + data += encap_hdr_size; + if ( data + sizeof(struct ip) >= current_packet.data + current_packet.cap_len ) + { + Weird("no_ip_left_after_encap", ¤t_packet); + goto done; + } + const struct ip* ip = (const struct ip *)data; + l3_proto = ( ip->ip_v == 4 ) ? AF_INET : AF_INET6; + } + + // We've now determined (a) AF_INET (IPv4) vs (b) AF_INET6 (IPv6) vs + // (c) AF_UNSPEC (0 == anything else) + current_packet.l3_proto = l3_proto; + + // Calculate how much header we've used up. + current_packet.hdr_size = data - current_packet.data; if ( pseudo_realtime ) { current_pseudo = CheckPseudoTime(); - net_packet_dispatch(current_pseudo, current_packet.hdr, data, pkt_hdr_size, this); + net_packet_dispatch(current_pseudo, ¤t_packet, this); if ( ! first_wallclock ) first_wallclock = current_time(true); } else - net_packet_dispatch(current_packet.ts, current_packet.hdr, data, pkt_hdr_size, this); + net_packet_dispatch(current_packet.time, ¤t_packet, this); done: have_packet = 0; @@ -440,8 +496,9 @@ bool PktSrc::ExtractNextPacketInternal() if ( ExtractNextPacket(¤t_packet) ) { + current_packet.l3_proto = AF_UNSPEC; if ( ! first_timestamp ) - first_timestamp = current_packet.ts; + first_timestamp = current_packet.time; SetIdle(false); have_packet = true; @@ -524,12 +581,11 @@ bool PktSrc::ApplyBPFFilter(int index, const struct pcap_pkthdr *hdr, const u_ch return pcap_offline_filter(code->GetProgram(), hdr, pkt); } -bool PktSrc::GetCurrentPacket(const pcap_pkthdr** hdr, const u_char** pkt) +bool PktSrc::GetCurrentPacket(const Packet** pkt) { if ( ! have_packet ) return false; - *hdr = current_packet.hdr; - *pkt = current_packet.data; + *pkt = ¤t_packet; return true; } diff --git a/src/iosource/PktSrc.h b/src/iosource/PktSrc.h index 2400219fd0..0f20bb3a0a 100644 --- a/src/iosource/PktSrc.h +++ b/src/iosource/PktSrc.h @@ -6,6 +6,7 @@ #include "IOSource.h" #include "BPF_Program.h" #include "Dict.h" +#include "Packet.h" declare(PDict,BPF_Program); @@ -165,14 +166,12 @@ public: /** * Returns the packet currently being processed, if available. * - * @param hdr A pointer to pass the header of the current packet back. - * * @param pkt A pointer to pass the content of the current packet * back. * * @return True if the current packet is available, or false if not. */ - bool GetCurrentPacket(const pcap_pkthdr** hdr, const u_char** pkt); + bool GetCurrentPacket(const Packet** hdr); // PacketSource interace for derived classes to override. @@ -225,6 +224,13 @@ public: */ static int GetLinkHeaderSize(int link_type); + /** + * Return the pcap link encapsulation type we started with. + * + * @return DLT_EN10MB (etc.) + */ + int GetLinkEncap(void); + protected: friend class Manager; @@ -274,26 +280,6 @@ protected: Properties(); }; - /** - * Structure describing a packet. - */ - struct Packet { - /** - * Time associated with the packet. - */ - double ts; - - /** - * The pcap header associated with the packet. - */ - const struct ::pcap_pkthdr* hdr; - - /** - * The full content of the packet. - */ - const u_char* data; - }; - /** * Called from the implementations of \a Open() to signal that the * source has been successully opened. diff --git a/src/iosource/pcap/Dumper.cc b/src/iosource/pcap/Dumper.cc index 5d0b5e599b..e924e882a1 100644 --- a/src/iosource/pcap/Dumper.cc +++ b/src/iosource/pcap/Dumper.cc @@ -101,7 +101,10 @@ bool PcapDumper::Dump(const Packet* pkt) if ( ! dumper ) return false; - pcap_dump((u_char*) dumper, pkt->hdr, pkt->data); + // Reconstitute the pcap_pkthdr + const struct pcap_pkthdr phdr = { + .ts = pkt->ts, .caplen = pkt->cap_len, .len = pkt->len }; + pcap_dump((u_char*) dumper, &phdr, pkt->data); return true; } diff --git a/src/iosource/pcap/Source.cc b/src/iosource/pcap/Source.cc index 7645903c2a..45e8c89298 100644 --- a/src/iosource/pcap/Source.cc +++ b/src/iosource/pcap/Source.cc @@ -167,9 +167,8 @@ bool PcapSource::ExtractNextPacket(Packet* pkt) return false; } - pkt->ts = current_hdr.ts.tv_sec + double(current_hdr.ts.tv_usec) / 1e6; - pkt->hdr = ¤t_hdr; - pkt->data = last_data = data; + last_data = data; + pkt->Init(props.link_type, ¤t_hdr.ts, current_hdr.caplen, current_hdr.len, data); if ( current_hdr.len == 0 || current_hdr.caplen == 0 ) { diff --git a/src/types.bif b/src/types.bif index 180112dd8c..18a204d2b8 100644 --- a/src/types.bif +++ b/src/types.bif @@ -184,6 +184,18 @@ type EncapsulatingConn: record; module GLOBAL; +enum link_encap %{ + link_ethernet, + link_unknown, +%} + +enum layer3_proto %{ + l3_ipv4, + l3_ipv6, + l3_arp, + l3_unknown, +%} + type gtpv1_hdr: record; type gtp_create_pdp_ctx_request_elements: record; type gtp_create_pdp_ctx_response_elements: record; diff --git a/testing/btest/Baseline/core.raw_packet/output b/testing/btest/Baseline/core.raw_packet/output new file mode 100644 index 0000000000..314fbea931 --- /dev/null +++ b/testing/btest/Baseline/core.raw_packet/output @@ -0,0 +1,48 @@ +[l2=[encap=link_ethernet, len=215, cap_len=215, src=e8:de:27:ff:c0:78, dst=ff:ff:ff:ff:ff:ff, vlan=, eth_type=2048, proto=l3_ipv4], ip=[hl=20, tos=0, len=201, id=0, ttl=64, p=17, src=192.168.1.1, dst=255.255.255.255], ip6=, tcp=, udp=[sport=40190/udp, dport=7437/udp, ulen=181], icmp=] +[l2=[encap=link_ethernet, len=68, cap_len=68, src=60:f8:1d:c9:8c:fa, dst=e8:de:27:ff:c0:78, vlan=, eth_type=2048, proto=l3_ipv4], ip=[hl=20, tos=0, len=54, id=52261, ttl=64, p=6, src=192.168.1.103, dst=64.4.23.176], ip6=, tcp=[sport=65493/tcp, dport=40031/tcp, seq=2642773190, ack=2891276360, hl=32, dl=2, flags=24, win=4096], udp=, icmp=] +[l2=[encap=link_ethernet, len=60, cap_len=60, src=e8:de:27:ff:c0:77, dst=01:80:c2:00:00:00, vlan=, eth_type=38, proto=l3_unknown], ip=, ip6=, tcp=, udp=, icmp=] +[l2=[encap=link_ethernet, len=78, cap_len=78, src=60:f8:1d:c9:8c:fa, dst=e8:de:27:ff:c0:78, vlan=, eth_type=2048, proto=l3_ipv4], ip=[hl=20, tos=0, len=64, id=32575, ttl=64, p=17, src=192.168.1.103, dst=192.168.1.1], ip6=, tcp=, udp=[sport=65170/udp, dport=53/udp, ulen=44], icmp=] +[l2=[encap=link_ethernet, len=78, cap_len=78, src=60:f8:1d:c9:8c:fa, dst=e8:de:27:ff:c0:78, vlan=, eth_type=2048, proto=l3_ipv4], ip=[hl=20, tos=0, len=64, id=55466, ttl=64, p=17, src=192.168.1.103, dst=192.168.1.1], ip6=, tcp=, udp=[sport=53129/udp, dport=53/udp, ulen=44], icmp=] +[l2=[encap=link_ethernet, len=92, cap_len=92, src=60:f8:1d:c9:8c:fa, dst=e8:de:27:ff:c0:78, vlan=, eth_type=2048, proto=l3_ipv4], ip=[hl=20, tos=0, len=78, id=32240, ttl=64, p=17, src=192.168.1.103, dst=192.168.1.1], ip6=, tcp=, udp=[sport=53129/udp, dport=53/udp, ulen=58], icmp=] +[l2=[encap=link_ethernet, len=85, cap_len=85, src=60:f8:1d:c9:8c:fa, dst=e8:de:27:ff:c0:78, vlan=, eth_type=2048, proto=l3_ipv4], ip=[hl=20, tos=0, len=71, id=53895, ttl=64, p=17, src=192.168.1.103, dst=192.168.1.1], ip6=, tcp=, udp=[sport=57932/udp, dport=53/udp, ulen=51], icmp=] +[l2=[encap=link_ethernet, len=60, cap_len=60, src=e8:de:27:ff:c0:77, dst=01:80:c2:00:00:00, vlan=, eth_type=38, proto=l3_unknown], ip=, ip6=, tcp=, udp=, icmp=] +[l2=[encap=link_ethernet, len=42, cap_len=42, src=00:50:56:3e:93:6b, dst=ff:ff:ff:ff:ff:ff, vlan=, eth_type=2054, proto=l3_arp], ip=, ip6=, tcp=, udp=, icmp=] +[l2=[encap=link_ethernet, len=42, cap_len=42, src=00:50:56:3e:93:6b, dst=ff:ff:ff:ff:ff:ff, vlan=, eth_type=2054, proto=l3_arp], ip=, ip6=, tcp=, udp=, icmp=] +[l2=[encap=link_ethernet, len=307, cap_len=307, src=e8:de:27:ff:c0:78, dst=01:00:5e:7f:ff:fa, vlan=, eth_type=2048, proto=l3_ipv4], ip=[hl=20, tos=0, len=293, id=0, ttl=4, p=17, src=192.168.1.1, dst=239.255.255.250], ip6=, tcp=, udp=[sport=45335/udp, dport=1900/udp, ulen=273], icmp=] +[l2=[encap=link_ethernet, len=316, cap_len=316, src=e8:de:27:ff:c0:78, dst=01:00:5e:7f:ff:fa, vlan=, eth_type=2048, proto=l3_ipv4], ip=[hl=20, tos=0, len=302, id=0, ttl=4, p=17, src=192.168.1.1, dst=239.255.255.250], ip6=, tcp=, udp=[sport=45335/udp, dport=1900/udp, ulen=282], icmp=] +[l2=[encap=link_ethernet, len=379, cap_len=379, src=e8:de:27:ff:c0:78, dst=01:00:5e:7f:ff:fa, vlan=, eth_type=2048, proto=l3_ipv4], ip=[hl=20, tos=0, len=365, id=0, ttl=4, p=17, src=192.168.1.1, dst=239.255.255.250], ip6=, tcp=, udp=[sport=45335/udp, dport=1900/udp, ulen=345], icmp=] +[l2=[encap=link_ethernet, len=371, cap_len=371, src=e8:de:27:ff:c0:78, dst=01:00:5e:7f:ff:fa, vlan=, eth_type=2048, proto=l3_ipv4], ip=[hl=20, tos=0, len=357, id=0, ttl=4, p=17, src=192.168.1.1, dst=239.255.255.250], ip6=, tcp=, udp=[sport=45335/udp, dport=1900/udp, ulen=337], icmp=] +[l2=[encap=link_ethernet, len=60, cap_len=60, src=e8:de:27:ff:c0:77, dst=01:80:c2:00:00:00, vlan=, eth_type=38, proto=l3_unknown], ip=, ip6=, tcp=, udp=, icmp=] +[l2=[encap=link_ethernet, len=355, cap_len=355, src=e8:de:27:ff:c0:78, dst=01:00:5e:7f:ff:fa, vlan=, eth_type=2048, proto=l3_ipv4], ip=[hl=20, tos=0, len=341, id=0, ttl=4, p=17, src=192.168.1.1, dst=239.255.255.250], ip6=, tcp=, udp=[sport=45335/udp, dport=1900/udp, ulen=321], icmp=] +[l2=[encap=link_ethernet, len=42, cap_len=42, src=00:50:56:3e:93:6b, dst=ff:ff:ff:ff:ff:ff, vlan=, eth_type=2054, proto=l3_arp], ip=, ip6=, tcp=, udp=, icmp=] +[l2=[encap=link_ethernet, len=387, cap_len=387, src=e8:de:27:ff:c0:78, dst=01:00:5e:7f:ff:fa, vlan=, eth_type=2048, proto=l3_ipv4], ip=[hl=20, tos=0, len=373, id=0, ttl=4, p=17, src=192.168.1.1, dst=239.255.255.250], ip6=, tcp=, udp=[sport=45335/udp, dport=1900/udp, ulen=353], icmp=] +[l2=[encap=link_ethernet, len=316, cap_len=316, src=e8:de:27:ff:c0:78, dst=01:00:5e:7f:ff:fa, vlan=, eth_type=2048, proto=l3_ipv4], ip=[hl=20, tos=0, len=302, id=0, ttl=4, p=17, src=192.168.1.1, dst=239.255.255.250], ip6=, tcp=, udp=[sport=45335/udp, dport=1900/udp, ulen=282], icmp=] +[l2=[encap=link_ethernet, len=375, cap_len=375, src=e8:de:27:ff:c0:78, dst=01:00:5e:7f:ff:fa, vlan=, eth_type=2048, proto=l3_ipv4], ip=[hl=20, tos=0, len=361, id=0, ttl=4, p=17, src=192.168.1.1, dst=239.255.255.250], ip6=, tcp=, udp=[sport=45335/udp, dport=1900/udp, ulen=341], icmp=] +[l2=[encap=link_ethernet, len=369, cap_len=369, src=e8:de:27:ff:c0:78, dst=01:00:5e:7f:ff:fa, vlan=, eth_type=2048, proto=l3_ipv4], ip=[hl=20, tos=0, len=355, id=0, ttl=4, p=17, src=192.168.1.1, dst=239.255.255.250], ip6=, tcp=, udp=[sport=45335/udp, dport=1900/udp, ulen=335], icmp=] +[l2=[encap=link_ethernet, len=316, cap_len=316, src=e8:de:27:ff:c0:78, dst=01:00:5e:7f:ff:fa, vlan=, eth_type=2048, proto=l3_ipv4], ip=[hl=20, tos=0, len=302, id=0, ttl=4, p=17, src=192.168.1.1, dst=239.255.255.250], ip6=, tcp=, udp=[sport=45335/udp, dport=1900/udp, ulen=282], icmp=] +[l2=[encap=link_ethernet, len=371, cap_len=371, src=e8:de:27:ff:c0:78, dst=01:00:5e:7f:ff:fa, vlan=, eth_type=2048, proto=l3_ipv4], ip=[hl=20, tos=0, len=357, id=0, ttl=4, p=17, src=192.168.1.1, dst=239.255.255.250], ip6=, tcp=, udp=[sport=45335/udp, dport=1900/udp, ulen=337], icmp=] +[l2=[encap=link_ethernet, len=381, cap_len=381, src=e8:de:27:ff:c0:78, dst=01:00:5e:7f:ff:fa, vlan=, eth_type=2048, proto=l3_ipv4], ip=[hl=20, tos=0, len=367, id=0, ttl=4, p=17, src=192.168.1.1, dst=239.255.255.250], ip6=, tcp=, udp=[sport=45335/udp, dport=1900/udp, ulen=347], icmp=] +[l2=[encap=link_ethernet, len=215, cap_len=215, src=e8:de:27:ff:c0:78, dst=ff:ff:ff:ff:ff:ff, vlan=, eth_type=2048, proto=l3_ipv4], ip=[hl=20, tos=0, len=201, id=0, ttl=64, p=17, src=192.168.1.1, dst=255.255.255.255], ip6=, tcp=, udp=[sport=40190/udp, dport=7437/udp, ulen=181], icmp=] +[l2=[encap=link_ethernet, len=98, cap_len=98, src=00:50:56:3e:93:6b, dst=e8:de:27:ff:c0:78, vlan=, eth_type=2048, proto=l3_ipv4], ip=[hl=20, tos=0, len=84, id=29257, ttl=64, p=1, src=192.168.1.104, dst=192.168.1.1], ip6=, tcp=, udp=, icmp=[icmp_type=8]] +[l2=[encap=link_ethernet, len=98, cap_len=98, src=e8:de:27:ff:c0:78, dst=00:50:56:3e:93:6b, vlan=, eth_type=2048, proto=l3_ipv4], ip=[hl=20, tos=0, len=84, id=3684, ttl=64, p=1, src=192.168.1.1, dst=192.168.1.104], ip6=, tcp=, udp=, icmp=[icmp_type=0]] +[l2=[encap=link_ethernet, len=112, cap_len=112, src=60:f8:1d:c9:8c:fa, dst=e8:de:27:ff:c0:78, vlan=, eth_type=2048, proto=l3_ipv4], ip=[hl=20, tos=0, len=98, id=56893, ttl=64, p=6, src=192.168.1.103, dst=74.125.21.138], ip6=, tcp=[sport=49171/tcp, dport=443/tcp, seq=3725176031, ack=445274592, hl=32, dl=46, flags=24, win=4096], udp=, icmp=] +[l2=[encap=link_ethernet, len=66, cap_len=66, src=60:f8:1d:c9:8c:fa, dst=e8:de:27:ff:c0:78, vlan=, eth_type=2048, proto=l3_ipv4], ip=[hl=20, tos=0, len=52, id=22643, ttl=64, p=6, src=192.168.1.103, dst=74.125.21.138], ip6=, tcp=[sport=49171/tcp, dport=443/tcp, seq=3725176077, ack=445274652, hl=32, dl=0, flags=16, win=4094], udp=, icmp=] +[l2=[encap=link_ethernet, len=112, cap_len=112, src=60:f8:1d:c9:8c:fa, dst=e8:de:27:ff:c0:78, vlan=, eth_type=2048, proto=l3_ipv4], ip=[hl=20, tos=0, len=98, id=85, ttl=64, p=6, src=192.168.1.103, dst=74.125.21.138], ip6=, tcp=[sport=49171/tcp, dport=443/tcp, seq=3725176077, ack=445274652, hl=32, dl=46, flags=24, win=4096], udp=, icmp=] +[l2=[encap=link_ethernet, len=97, cap_len=97, src=60:f8:1d:c9:8c:fa, dst=e8:de:27:ff:c0:78, vlan=, eth_type=2048, proto=l3_ipv4], ip=[hl=20, tos=0, len=83, id=28558, ttl=64, p=6, src=192.168.1.103, dst=74.125.21.138], ip6=, tcp=[sport=49171/tcp, dport=443/tcp, seq=3725176123, ack=445274652, hl=32, dl=31, flags=24, win=4096], udp=, icmp=] +[l2=[encap=link_ethernet, len=66, cap_len=66, src=60:f8:1d:c9:8c:fa, dst=e8:de:27:ff:c0:78, vlan=, eth_type=2048, proto=l3_ipv4], ip=[hl=20, tos=0, len=52, id=36529, ttl=64, p=6, src=192.168.1.103, dst=74.125.21.138], ip6=, tcp=[sport=49171/tcp, dport=443/tcp, seq=3725176154, ack=445274652, hl=32, dl=0, flags=17, win=4096], udp=, icmp=] +[l2=[encap=link_ethernet, len=60, cap_len=60, src=e8:de:27:ff:c0:77, dst=01:80:c2:00:00:00, vlan=, eth_type=38, proto=l3_unknown], ip=, ip6=, tcp=, udp=, icmp=] +[l2=[encap=link_ethernet, len=64, cap_len=64, src=00:19:06:ea:b8:c1, dst=ff:ff:ff:ff:ff:ff, vlan=123, eth_type=2054, proto=l3_arp], ip=, ip6=, tcp=, udp=, icmp=] +[l2=[encap=link_ethernet, len=64, cap_len=64, src=00:18:73:de:57:c1, dst=ff:ff:ff:ff:ff:ff, vlan=123, eth_type=2054, proto=l3_arp], ip=, ip6=, tcp=, udp=, icmp=] +[l2=[encap=link_ethernet, len=64, cap_len=64, src=00:18:73:de:57:c1, dst=ff:ff:ff:ff:ff:ff, vlan=123, eth_type=2054, proto=l3_arp], ip=, ip6=, tcp=, udp=, icmp=] +[l2=[encap=link_ethernet, len=64, cap_len=64, src=00:19:06:ea:b8:c1, dst=00:18:73:de:57:c1, vlan=123, eth_type=2054, proto=l3_arp], ip=, ip6=, tcp=, udp=, icmp=] +[l2=[encap=link_ethernet, len=118, cap_len=118, src=00:18:73:de:57:c1, dst=00:19:06:ea:b8:c1, vlan=123, eth_type=2048, proto=l3_ipv4], ip=[hl=20, tos=0, len=100, id=5, ttl=255, p=1, src=192.168.123.2, dst=192.168.123.1], ip6=, tcp=, udp=, icmp=[icmp_type=8]] +[l2=[encap=link_ethernet, len=64, cap_len=64, src=00:19:06:ea:b8:c1, dst=ff:ff:ff:ff:ff:ff, vlan=123, eth_type=2054, proto=l3_arp], ip=, ip6=, tcp=, udp=, icmp=] +[l2=[encap=link_ethernet, len=64, cap_len=64, src=00:18:73:de:57:c1, dst=00:19:06:ea:b8:c1, vlan=123, eth_type=2054, proto=l3_arp], ip=, ip6=, tcp=, udp=, icmp=] +[l2=[encap=link_ethernet, len=118, cap_len=118, src=00:18:73:de:57:c1, dst=00:19:06:ea:b8:c1, vlan=123, eth_type=2048, proto=l3_ipv4], ip=[hl=20, tos=0, len=100, id=6, ttl=255, p=1, src=192.168.123.2, dst=192.168.123.1], ip6=, tcp=, udp=, icmp=[icmp_type=8]] +[l2=[encap=link_ethernet, len=118, cap_len=118, src=00:19:06:ea:b8:c1, dst=00:18:73:de:57:c1, vlan=123, eth_type=2048, proto=l3_ipv4], ip=[hl=20, tos=0, len=100, id=6, ttl=255, p=1, src=192.168.123.1, dst=192.168.123.2], ip6=, tcp=, udp=, icmp=[icmp_type=0]] +[l2=[encap=link_ethernet, len=118, cap_len=118, src=00:18:73:de:57:c1, dst=00:19:06:ea:b8:c1, vlan=123, eth_type=2048, proto=l3_ipv4], ip=[hl=20, tos=0, len=100, id=7, ttl=255, p=1, src=192.168.123.2, dst=192.168.123.1], ip6=, tcp=, udp=, icmp=[icmp_type=8]] +[l2=[encap=link_ethernet, len=118, cap_len=118, src=00:19:06:ea:b8:c1, dst=00:18:73:de:57:c1, vlan=123, eth_type=2048, proto=l3_ipv4], ip=[hl=20, tos=0, len=100, id=7, ttl=255, p=1, src=192.168.123.1, dst=192.168.123.2], ip6=, tcp=, udp=, icmp=[icmp_type=0]] +[l2=[encap=link_ethernet, len=118, cap_len=118, src=00:18:73:de:57:c1, dst=00:19:06:ea:b8:c1, vlan=123, eth_type=2048, proto=l3_ipv4], ip=[hl=20, tos=0, len=100, id=8, ttl=255, p=1, src=192.168.123.2, dst=192.168.123.1], ip6=, tcp=, udp=, icmp=[icmp_type=8]] +[l2=[encap=link_ethernet, len=118, cap_len=118, src=00:19:06:ea:b8:c1, dst=00:18:73:de:57:c1, vlan=123, eth_type=2048, proto=l3_ipv4], ip=[hl=20, tos=0, len=100, id=8, ttl=255, p=1, src=192.168.123.1, dst=192.168.123.2], ip6=, tcp=, udp=, icmp=[icmp_type=0]] +[l2=[encap=link_ethernet, len=118, cap_len=118, src=00:18:73:de:57:c1, dst=00:19:06:ea:b8:c1, vlan=123, eth_type=2048, proto=l3_ipv4], ip=[hl=20, tos=0, len=100, id=9, ttl=255, p=1, src=192.168.123.2, dst=192.168.123.1], ip6=, tcp=, udp=, icmp=[icmp_type=8]] +[l2=[encap=link_ethernet, len=118, cap_len=118, src=00:19:06:ea:b8:c1, dst=00:18:73:de:57:c1, vlan=123, eth_type=2048, proto=l3_ipv4], ip=[hl=20, tos=0, len=100, id=9, ttl=255, p=1, src=192.168.123.1, dst=192.168.123.2], ip6=, tcp=, udp=, icmp=[icmp_type=0]] diff --git a/testing/btest/Traces/icmp_dot1q.trace b/testing/btest/Traces/icmp_dot1q.trace new file mode 100644 index 0000000000000000000000000000000000000000..7c73c6266267385853ddd06a4cb418e62d082d2d GIT binary patch literal 1710 zcmb`Htxp3n7>C~;<2aIq1;;F)5DWqV!N(>b!66YC1mPbb12IK{Apy4l!GR)~Lrsvt zHtZZ&f+7KjKp*c%dhPB?Ce~hV={4)`o<8rpy>=dM1IU3MaSWjFp?bQzHU2mT6`a!@ z^MGRb-E5rz)S?hn1Yr&WS$n>(Dfte~a6@WP-rHv;Z{qNMC!NP@m=Yv;K`IO%FEQ_T zvXJJ><|#<>B*o1~d8KKSC%g1{Kb+@HC)<=)m^U?FfFoR_Tasi4`-4q@eHccwYNJf2 zC9VkSH>{s_9YLK@nDV`U7{$@S`^H#YmdDywK5b+?9{zeROT!S_Lk|G5q7a= zx#*w?sg)-e2X^1OT^I`O!aKz__HCbEPsA=(Ef;NcF~l9~$wd{rJ)v;BFcjK_cZ$6w gi^AO(qwHeEa?wH;^2hGU#l^Bk;dWstvdCA%>V!Z literal 0 HcmV?d00001 diff --git a/testing/btest/Traces/raw_packets.trace b/testing/btest/Traces/raw_packets.trace new file mode 100644 index 0000000000000000000000000000000000000000..4fc64c429b2b785c735386adfb5f3db1aab16677 GIT binary patch literal 6641 zcmds63v5$m6#g&kN+}c=55dW#A_E!R?RLF=T|m1h+Z^rKI&h%K?d|PW*xK3$8z5m( zlz>PAgaiY`7#|S?1p*j(L>{8SfF?Me5=24-qedhsFdp-qdpovL7y}x&c$3rh-roOw z=X~G!&wuZ~hJBmg>p~Qy`LHSpq2Q$9!nE>SUO|q*ceEzyxNv%S)9yMI$s^V~WBbSKms}kgc~)J)dQ>*~?RHl1F)fqnMtQTdFrQjC7IQc`jdV`%{;$GqW+b zV5n$aB7b9UxX%Slv*80J$%XsSx`butmY$q;cJ$&S;PcFHUC9{mhep-!ZT4JChGl0bz!@R+ z5vmiMPQZCXh@PWQgol_BH6D=k_>%8X($WXf#<3lNKEh7dp>e6RJUIAW^8aODY zQt)}*p321Fj9Gp$LGab!ZxnhjI^UM}1p z1ZXj_+vZ+G?{)t~dFPg{Ner}j?<<8Y3PIW*@VV%4P^1}^Q0)u5c)vfvD~1RGtfP?0 zzWLorIpCnhV2wMx0I`O;o3YLoLniv!*G}zk!BTs?o)8^mbit6q9}ZR}0z`ESUB>|A z6A~X`(bwTO)g%pqMU&?jDVg}}@);^6p;Sbv0Ewh?2)PPwfdjscIu0Y3&U%=UCtzel z9YyqzF&agt&TDFvslsBXQh_3(Ncw6h;81@yH8pM;(6yRMnlQv>cNFGVXw$R>4o67_ zOht{lz+UFyw3&KKdZxh;F^1Dw7)GPc$;v6nqjT&wN2$G-)7J2HG+!x>)!}c&_M9w7 zq20!5t3n|^myw~fWTxwk=5+8X4bSjYy3*@vsx@jG0EGQsKNs-%LN0NpM-cI18K(^f zU4D+Q_RNF}WqG9&^GZ3b$L|Yfn9><-d5ITeWV9`922VBW@-jdThdnNiF)~h*-k_)5 z0&k>Q#>CKOgPWywZl~L6;ax6croeGA*cvrb_>C%oi~;)4Vkk_HQ20a?g~?kkcOZrB z&Gytz_A<^YdqFO|S1{ zazq%2#UXH%wu6)hH%i8fn|EX`WndfI7r8EAu!7n~-ii)Gxn0JJfiqGFQeTlMP0 zuF9iNsLAUf6k3c};fPobQDX6xY$p?|xxRs!9A8b1&nq=VH!p}e(!*!m=HMfU*Pa+< zF{wb02VUi`a~&uNuJRT)V>TL`@LXeX@ifarMVk#y6K!G{)~GkRU2eT8PU}(opkyvr zUeSYY~lZgGH~4*E4SWpkyxpn4a*!kE;daJCMs(J*C#; z_VCr!9^Na6t=}Lfu`25qv?=a(wdz2&_?naBj zXI}^+{%$TBe}g7@(d0q(y?fnKrQF6pl$Nlu5j{46$9rc)%F*M%k$3e78SUQ^?Xh)6 zT?ZCzdwc5?$Kib`+t)L{r+9}dSMN}6&RfytihlOEJrzseNBnJjm4t_E&|)$w^DROA zwYa<5iqQ?DrHlZ-4-gSyRLZD7Fq#aW@K7zC*|co(^6>R}Q)hfRY}cw^Uzv)42LbTj h6fW6>fD3Qj0XSI#OzKU#9*PD;kNtjD#^pZ>{{n^9b({bI literal 0 HcmV?d00001 diff --git a/testing/btest/core/raw_packet.bro b/testing/btest/core/raw_packet.bro new file mode 100644 index 0000000000..cb1ee94b0f --- /dev/null +++ b/testing/btest/core/raw_packet.bro @@ -0,0 +1,9 @@ +# @TEST-EXEC: bro -b -r $TRACES/raw_packets.trace %INPUT >output +# @TEST-EXEC: bro -b -r $TRACES/icmp_dot1q.trace %INPUT >>output +# @TEST-EXEC: btest-diff output + +event raw_packet(p: raw_pkt_hdr) + { + print p; + } + diff --git a/testing/btest/plugins/pktdumper-plugin/src/Foo.cc b/testing/btest/plugins/pktdumper-plugin/src/Foo.cc index fdd364b034..c68eec809a 100644 --- a/testing/btest/plugins/pktdumper-plugin/src/Foo.cc +++ b/testing/btest/plugins/pktdumper-plugin/src/Foo.cc @@ -29,8 +29,8 @@ void Foo::Close() bool Foo::Dump(const Packet* pkt) { - double t = double(pkt->hdr->ts.tv_sec) + double(pkt->hdr->ts.tv_usec) / 1e6; - fprintf(stdout, "Dumping to %s: %.6f len %u\n", props.path.c_str(), t, (unsigned int)pkt->hdr->len); + double t = double(pkt->ts.tv_sec) + double(pkt->ts.tv_usec) / 1e6; + fprintf(stdout, "Dumping to %s: %.6f len %u\n", props.path.c_str(), t, (unsigned int)pkt->len); return true; } diff --git a/testing/btest/plugins/pktsrc-plugin/src/Foo.cc b/testing/btest/plugins/pktsrc-plugin/src/Foo.cc index b08bc51d72..afd5621d0f 100644 --- a/testing/btest/plugins/pktsrc-plugin/src/Foo.cc +++ b/testing/btest/plugins/pktsrc-plugin/src/Foo.cc @@ -45,12 +45,9 @@ bool Foo::ExtractNextPacket(Packet* pkt) return false; } - hdr.ts.tv_sec = 1409193037; - hdr.ts.tv_usec = 0; - hdr.caplen = hdr.len = packet.size(); - pkt->ts = hdr.ts.tv_sec; - pkt->hdr = &hdr; - pkt->data = (const u_char *)packet.c_str(); + struct timeval ts = { 1409193037, 0 }; + pkt->Init(props.link_type, &ts, packet.size(), packet.size(), + (const u_char *)packet.c_str()); return true; } diff --git a/testing/btest/plugins/pktsrc-plugin/src/Foo.h b/testing/btest/plugins/pktsrc-plugin/src/Foo.h index 902ac0e37a..922b300b61 100644 --- a/testing/btest/plugins/pktsrc-plugin/src/Foo.h +++ b/testing/btest/plugins/pktsrc-plugin/src/Foo.h @@ -26,7 +26,6 @@ protected: private: Properties props; string packet; - struct pcap_pkthdr hdr; }; } From 72fca3ee26301a168b709a7558d4d941aaa61611 Mon Sep 17 00:00:00 2001 From: Jeff Barber Date: Thu, 28 May 2015 16:58:23 -0400 Subject: [PATCH 2/4] Make enums work for non-C++11 config --- src/L2.cc | 12 ++++++------ src/bro.bif | 2 +- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/src/L2.cc b/src/L2.cc index 9b277e9e9e..33865071dc 100644 --- a/src/L2.cc +++ b/src/L2.cc @@ -48,11 +48,11 @@ RecordVal* L2_Hdr::BuildPktHdrVal() const RecordVal* pkt_hdr = new RecordVal(raw_pkt_hdr_type); RecordVal* l2_hdr = new RecordVal(l2_hdr_type); int is_ethernet = ( pkt->link_type == DLT_EN10MB ) ? 1 : 0; - int l3 = BifEnum::layer3_proto::l3_unknown; + int l3 = BifEnum::l3_unknown; if ( pkt->l3_proto == AF_INET ) - l3 = BifEnum::layer3_proto::l3_ipv4; + l3 = BifEnum::l3_ipv4; else if ( pkt->l3_proto == AF_INET6 ) - l3 = BifEnum::layer3_proto::l3_ipv6; + l3 = BifEnum::l3_ipv6; // l2_hdr layout: // encap: link_encap; ##< L2 link encapsulation @@ -67,7 +67,7 @@ RecordVal* L2_Hdr::BuildPktHdrVal() const { // Ethernet header layout is: // dst[6bytes] src[6bytes] ethertype[2bytes]... - l2_hdr->Assign(0, new EnumVal(BifEnum::link_encap::link_ethernet, BifType::Enum::link_encap)); + l2_hdr->Assign(0, new EnumVal(BifEnum::link_ethernet, BifType::Enum::link_encap)); l2_hdr->Assign(3, fmt_eui48(pkt->data + 6)); // src l2_hdr->Assign(4, fmt_eui48(pkt->data)); // dst if ( pkt->vlan ) @@ -76,12 +76,12 @@ RecordVal* L2_Hdr::BuildPktHdrVal() const if ( pkt->eth_type == ETHERTYPE_ARP || pkt->eth_type == ETHERTYPE_REVARP ) { // We also identify ARP for L3 over ethernet - l3 = BifEnum::layer3_proto::l3_arp; + l3 = BifEnum::l3_arp; } } else { - l2_hdr->Assign(0, new EnumVal(BifEnum::link_encap::link_unknown, BifType::Enum::link_encap)); + l2_hdr->Assign(0, new EnumVal(BifEnum::link_unknown, BifType::Enum::link_encap)); } l2_hdr->Assign(1, new Val(pkt->len, TYPE_COUNT)); l2_hdr->Assign(2, new Val(pkt->cap_len, TYPE_COUNT)); diff --git a/src/bro.bif b/src/bro.bif index 4eb1f89041..af42a9bd5f 100644 --- a/src/bro.bif +++ b/src/bro.bif @@ -3275,7 +3275,7 @@ function get_current_packet%(%) : pcap_packet pkt->Assign(2, new Val(0, TYPE_COUNT)); pkt->Assign(3, new Val(0, TYPE_COUNT)); pkt->Assign(4, new StringVal("")); - pkt->Assign(5, new EnumVal(BifEnum::link_encap::link_unknown, BifType::Enum::link_encap)); + pkt->Assign(5, new EnumVal(BifEnum::link_unknown, BifType::Enum::link_encap)); return pkt; } From 97ab422e173c805d09c356084f4940fe1ba5bb71 Mon Sep 17 00:00:00 2001 From: Jeff Barber Date: Mon, 1 Jun 2015 10:34:28 -0400 Subject: [PATCH 3/4] Packet::IP()-created IP_Hdr should not free --- src/Packet.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/Packet.h b/src/Packet.h index 05c826ec5f..0f3077eeec 100644 --- a/src/Packet.h +++ b/src/Packet.h @@ -60,7 +60,7 @@ public: } const IP_Hdr IP() const - { return IP_Hdr((struct ip *) (data + hdr_size), true); } + { return IP_Hdr((struct ip *) (data + hdr_size), false); } void Describe(ODesc* d) const; From 49ece39cb6ca566ab72acf446abfa63b58fed082 Mon Sep 17 00:00:00 2001 From: Jeff Barber Date: Tue, 2 Jun 2015 16:35:23 -0400 Subject: [PATCH 4/4] One more tinker to Packet -- ensure no uninitialized values --- src/Packet.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/Packet.h b/src/Packet.h index 0f3077eeec..838aebfc96 100644 --- a/src/Packet.h +++ b/src/Packet.h @@ -16,6 +16,8 @@ class Packet { public: Packet() { + struct timeval ts = {0, 0}; + Init(0, &ts, 0, 0, 0); } // Construct and initialize from packet data. Packet(int arg_link_type, struct timeval *arg_ts, uint32 arg_caplen,