Skip to content

Add support for the FreeBSD 13.1 PFLOG header size #10

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
moracca wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Add support for the FreeBSD 13.1 PFLOG header size #10

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 38 additions & 2 deletions src/codecs/cd_pflog/cd_pflog.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,14 +32,15 @@ using namespace snort;
namespace
{
/*
* Snort supports 3 versions of the OpenBSD pflog header:
* Snort supports 5 versions of the pflog header:
*
* Pflog1_Hdr: CVS = 1.3, DLT_OLD_PFLOG = 17, Length = 28
* Pflog2_Hdr: CVS = 1.8, DLT_PFLOG = 117, Length = 48
* Pflog3_Hdr: CVS = 1.12, DLT_PFLOG = 117, Length = 64
* Pflog4_Hdr: CVS = 1.172, DLT_PFLOG = 117, Length = 100
* PflogFbsdHdr: v13.1, DLT_PFLOG = 117, Length = 72
*
* Since they have the same DLT, Pflog{2,3,4}Hdr are distinguished
* Since they have the same DLT, Pflog{2,3,4,Fbsd}Hdr are distinguished
* by their actual length. The minimum required length excludes
* padding.
*/
Expand Down Expand Up @@ -140,6 +141,31 @@ struct Pflog4Hdr

#define PFLOG4_HDRLEN sizeof(struct Pflog4Hdr)
#define PFLOG4_HDRMIN sizeof(struct Pflog4Hdr)

struct PflogFbsdHdr
{
uint8_t length;
uint8_t af;
uint8_t action;
uint8_t reason;
char ifname[IFNAMSIZ];
char ruleset[PFLOG_RULELEN];
uint32_t rulenr;
uint32_t subrulenr;
uint32_t uid;
uint32_t pid;
uint32_t rule_uid;
uint32_t rule_pid;
uint8_t dir;
uint8_t pad[PFLOG_PADLEN];
uint32_t ridentifier;
uint8_t reserve;
uint8_t pad2[PFLOG_PADLEN];
};

#define PFLOGFBSD_HDRLEN sizeof(PflogFbsdhdr)
#define PFLOGFBSD_HDRMIN (PFLOGFBSD_HDRLEN - PFLOG_PADLEN)

} // namespace

void PflogCodec::get_data_link_type(std::vector<int>& v)
Expand Down Expand Up @@ -186,6 +212,16 @@ bool PflogCodec::decode(const RawData& raw, CodecData& codec, DecodeData&)
padlen = sizeof(pf4h->pad);
break;
}
case PFLOGFBSD_HDRMIN:
{
const PflogFbsdHdr* const pffbsdh =
reinterpret_cast<const PflogFbsdHdr*>(raw.data);
pflen = pffbsdh->length;
hlen = PFLOGFBSD_HDRLEN;
af = pffbsdh->af;
padlen = sizeof(pffbsdh->pad);
break;
}
default:
return false;
}
Expand Down