src/snort.h Source File

00001 /*
00002 ** Copyright (C) 1998-2005 Martin Roesch <roesch@sourcefire.com>
00003 **
00004 ** This program is free software; you can redistribute it and/or modify
00005 ** it under the terms of the GNU General Public License as published by
00006 ** the Free Software Foundation; either version 2 of the License, or
00007 ** (at your option) any later version.
00008 **
00009 ** This program is distributed in the hope that it will be useful,
00010 ** but WITHOUT ANY WARRANTY; without even the implied warranty of
00011 ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
00012 ** GNU General Public License for more details.
00013 **
00014 ** You should have received a copy of the GNU General Public License
00015 ** along with this program; if not, write to the Free Software
00016 ** Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
00017 */
00018 
00019 /* $Id$ */
00020 
00021 #ifndef __SNORT_H__
00022 #define __SNORT_H__
00023 
00024 #ifdef HAVE_CONFIG_H
00025     #include "config.h"
00026 #endif
00027 
00028 #include <sys/types.h>
00029 #include <pcap.h>
00030 #include <stdio.h>
00031 
00032 #include "decode.h"
00033 #include "perf.h"
00034 
00035 #ifdef GIDS
00036 #include "inline.h"
00037 #endif /* GIDS */
00038 
00039 extern SFPERF sfPerf;
00040 
00041 /* Mark this as a modern version of snort */
00042 #define SNORT_20
00043 
00044 /*  I N C L U D E S  **********************************************************/
00045 
00046 /* This macro helps to simplify the differences between Win32 and
00047    non-Win32 code when printing out the name of the interface */
00048 #ifndef WIN32
00049     #define PRINT_INTERFACE(i)  i
00050 #else
00051     #define PRINT_INTERFACE(i)  print_interface(i)
00052 #endif
00053 
00054 /*  D E F I N E S  ************************************************************/
00055 #define BUILD "28"
00056 
00057 #define STD_BUF  1024
00058 
00059 #define RF_ANY_SIP    0x01
00060 #define RF_ANY_DIP    0x02
00061 #define RF_ANY_SP     0x04
00062 #define RF_ANY_DP     0x10
00063 #define RF_ANY_FLAGS  0x20
00064 
00065 #define MAX_PIDFILE_SUFFIX 11 /* uniqueness extension to PID file, see '-R' */
00066 
00067 #ifndef _PATH_VARRUN
00068 extern char _PATH_VARRUN[STD_BUF];
00069 #endif
00070 
00071 #ifndef WIN32
00072     #define DEFAULT_LOG_DIR            "/var/log/snort"
00073     #define DEFAULT_DAEMON_ALERT_FILE  "alert"
00074 #else
00075     #define DEFAULT_LOG_DIR            "log"
00076     #define DEFAULT_DAEMON_ALERT_FILE  "log/alert.ids"
00077 #endif  /* WIN32 */
00078 
00079 /* you can redefine the user ID which is allowed to
00080  * initialize interfaces using pcap and read from them
00081  */
00082 #ifndef SNIFFUSER
00083     #define SNIFFUSER 0
00084 #endif
00085 
00086 
00087 #ifdef ACCESSPERMS
00088     #define FILEACCESSBITS ACCESSPERMS
00089 #else
00090     #ifdef  S_IAMB
00091         #define FILEACCESSBITS S_IAMB
00092     #else
00093         #define FILEACCESSBITS 0x1FF
00094     #endif
00095 #endif    
00096 
00097 #define TIMEBUF_SIZE    26
00098 
00099 
00100 #define ASSURE_ALL    0  /* all TCP alerts fire regardless of stream state */
00101 #define ASSURE_EST    1  /* only established TCP sessions fire alerts */
00102 
00103 #define DO_IP_CHECKSUMS     0x00000001
00104 #define DO_TCP_CHECKSUMS    0x00000002
00105 #define DO_UDP_CHECKSUMS    0x00000004
00106 #define DO_ICMP_CHECKSUMS   0x00000008
00107 
00108 #define LOG_UNIFIED         0x00000001
00109 #define LOG_TCPDUMP         0x00000002
00110 
00111 #define SIGNAL_SNORT_ROTATE_STATS  28
00112 
00113 /*  D A T A  S T R U C T U R E S  *********************************************/
00114 
00115 #define MODE_PACKET_DUMP    1
00116 #define MODE_PACKET_LOG     2
00117 #define MODE_IDS            3
00118 #define MODE_TEST           4
00119 
00120 extern u_int8_t runMode;
00121 
00122 typedef struct _Configuration
00123 {
00124     char *logging_directory;
00125 
00126 } Configuration;
00127 
00128 typedef struct _Capabilities
00129 {
00130     u_int8_t stateful_inspection;
00131 
00132 } Capabilities;
00133 
00134 typedef struct _runtime_config
00135 {
00136     Configuration configuration;
00137     Capabilities capabilities;
00138 } runtime_config;
00139 
00140 #define LOG_ASCII   1
00141 #define LOG_PCAP    2
00142 #define LOG_NONE    3
00143 
00144 #define ALERT_FULL     1
00145 #define ALERT_FAST     2
00146 #define ALERT_NONE     3
00147 #define ALERT_UNSOCK   4
00148 #define ALERT_STDOUT   5
00149 #define ALERT_CMG      6
00150 #define ALERT_SYSLOG   8
00151 
00152 #define MAX_IFS        1
00153 
00154 /* struct to contain the program variables and command line args */
00155 typedef struct _progvars
00156 {
00157     int stateful;
00158     int line_buffer_flag;
00159     int checksums_mode;
00160     int assurance_mode;
00161     int max_pattern;
00162     int test_mode_flag;
00163     int alert_interface_flag;
00164     int verbose_bytedump_flag;
00165     int obfuscation_flag;
00166     int log_cmd_override;
00167     int alert_cmd_override;
00168     int char_data_flag;
00169     int data_flag;
00170     int verbose_flag;
00171     int readmode_flag;
00172     int show2hdr_flag;
00173     int showwifimgmt_flag;
00174     int inline_flag;
00175 #ifdef GIDS
00176 #ifndef IPFW
00177     char layer2_resets;
00178     u_char enet_src[6];
00179 #endif
00180 #ifdef IPFW
00181     int divert_port;
00182     int ipfw_reinject_rule;
00183 #endif /* USE IPFW DIVERT socket instead of IPtables */
00184 #endif /* GIDS */
00185 #ifdef WIN32
00186     int syslog_remote_flag;
00187     char syslog_server[STD_BUF];
00188     int syslog_server_port;
00189 #ifdef ENABLE_WIN32_SERVICE
00190     int terminate_service_flag;
00191     int pause_service_flag;
00192 #endif  /* ENABLE_WIN32_SERVICE */
00193 #endif  /* WIN32 */
00194     int promisc_flag;
00195     int rules_order_flag;
00196     int track_flag;
00197     int daemon_flag;
00198     int quiet_flag;
00199     int pkt_cnt;
00200     int pkt_snaplen;
00201     u_long homenet;
00202     u_long netmask;
00203     u_int32_t obfuscation_net;
00204     u_int32_t obfuscation_mask;
00205     int alert_mode;
00206     int log_plugin_active;
00207     int alert_plugin_active;
00208     u_int32_t log_bitmap;
00209     char pid_filename[STD_BUF];
00210     char *config_file;
00211     char *config_dir;
00212     char *log_dir;
00213     char readfile[STD_BUF];
00214     char pid_path[STD_BUF];
00215     char *interface;
00216     char *pcap_cmd;
00217     char *alert_filename;
00218     char *binLogFile;
00219     int use_utc;
00220     int include_year;
00221     char *chroot_dir;
00222     u_int8_t min_ttl;
00223     u_int8_t log_mode;
00224     int num_rule_types;
00225     char pidfile_suffix[MAX_PIDFILE_SUFFIX+1]; /* room for a null */
00226     DecoderFlags decoder_flags; /* if decode.c alerts are going to be enabled */
00227     char ignore_ports[0x10000]; /* 65536, enough to hold ports */
00228     int rotate_perf_file;
00229     u_int32_t event_log_id;
00230 
00231     int done_processing;
00232 } PV;
00233 
00234 /* struct to collect packet statistics */
00235 typedef struct _PacketCount
00236 {
00237     u_long total;
00238 
00239     u_long other;
00240     u_long tcp;
00241     u_long udp;
00242     u_long icmp;
00243     u_long arp;
00244     u_long eapol;
00245     u_long ipv6;
00246     u_long ipx;
00247     u_long ethloopback;
00248     u_long discards;
00249     u_long alert_pkts;
00250     u_long log_pkts;
00251     u_long pass_pkts;
00252 
00253     u_long frags;           /* number of frags that have come in */
00254     u_long frag_trackers;   /* number of tracking structures generated */
00255     u_long rebuilt_frags;   /* number of packets rebuilt */
00256     u_long frag_incomp;     /* number of frags cleared due to memory issues */
00257     u_long frag_timeout;    /* number of frags cleared due to timeout */
00258     u_long rebuild_element; /* frags that were element of rebuilt pkt */
00259     u_long frag_mem_faults; /* number of times the memory cap was hit */
00260 
00261     u_long tcp_stream_pkts; /* number of packets tcp reassembly touches */
00262     u_long rebuilt_tcp;     /* number of phoney tcp packets generated */
00263     u_long tcp_streams;     /* number of tcp streams created */
00264     u_long rebuilt_segs;    /* number of tcp segments used in rebuilt pkts */
00265     u_long str_mem_faults;  /* number of times the stream memory cap was hit */
00266 
00267   /* wireless statistics */
00268     u_long wifi_mgmt;
00269     u_long wifi_data;
00270     u_long wifi_control; 
00271     u_long assoc_req;
00272     u_long assoc_resp;
00273     u_long reassoc_req;
00274     u_long reassoc_resp;
00275     u_long probe_req;
00276     u_long probe_resp;
00277     u_long beacon;
00278     u_long atim;
00279     u_long dissassoc;
00280     u_long auth;
00281     u_long deauth;
00282     u_long ps_poll;
00283     u_long rts;
00284     u_long cts;
00285     u_long ack;
00286     u_long cf_end;
00287     u_long cf_end_cf_ack;
00288     u_long data;
00289     u_long data_cf_ack;
00290     u_long data_cf_poll;
00291     u_long data_cf_ack_cf_poll;
00292     u_long cf_ack;
00293     u_long cf_poll;
00294     u_long cf_ack_cf_poll;
00295 } PacketCount;
00296 
00297 /*  G L O B A L S  ************************************************************/
00298 extern PV pv;                 /* program vars (command line args) */
00299 extern int datalink;          /* the datalink value */
00300 extern char *progname;        /* name of the program (from argv[0]) */
00301 extern char **progargs;
00302 extern char *username;
00303 extern char *groupname;
00304 extern unsigned long userid;
00305 extern unsigned long groupid;
00306 extern struct passwd *pw;
00307 extern struct group *gr;
00308 extern char *pcap_cmd;        /* the BPF command string */
00309 extern char *pktidx;          /* index ptr for the current packet */
00310 extern pcap_t *pd; /* array of packet descriptors per interface */
00311 
00312 /* backwards compatibility */
00313 extern FILE *alert;           /* alert file ptr */
00314 extern FILE *binlog_ptr;      /* binary log file ptr */
00315 extern int flow;              /* flow var (probably obsolete) */
00316 extern int thiszone;          /* time zone info */
00317 extern PacketCount pc;        /* packet count information */
00318 extern u_long netmasks[33];   /* precalculated netmask array */
00319 extern struct pcap_pkthdr *g_pkthdr; /* packet header ptr */
00320 extern u_char *g_pkt;         /* ptr to the packet data */
00321 extern u_long g_caplen;       /* length of the current packet */
00322 extern char *protocol_names[256];
00323 extern u_int snaplen;
00324 
00325 
00326 typedef void (*grinder_t)(Packet *, struct pcap_pkthdr *, u_char *);  /* ptr to the packet processor */
00327 
00328 extern grinder_t grinder;
00329 
00330 /* Snort run-time configuration struct*/
00331 extern runtime_config snort_runtime;
00332 
00333 /*  P R O T O T Y P E S  ******************************************************/
00334 int SnortMain(int argc, char *argv[]);
00335 int ParseCmdLine(int, char**);
00336 void *InterfaceThread(void *);
00337 int OpenPcap();
00338 void DefineIfaceVar(char *,u_char *, u_char *);
00339 int SetPktProcessor();
00340 void CleanExit(int);
00341 void PcapProcessPacket(char *, struct pcap_pkthdr *, u_char *);
00342 void ProcessPacket(char *, struct pcap_pkthdr *, u_char *, void *);
00343 int ShowUsage(char *);
00344 void SigCantHupHandler(int signal);
00345 
00346 
00347 #endif  /* __SNORT_H__ */