/* * Copyright (C) 2002 scott campbell * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. * * ----------------------------------------------------------------------- * spp_dns_session.h version 1.1, Jan 2002 * */ /* all the includes */ #ifndef __SP_TEMPLATE_H__ #define __SP_TEMPLATE_H__ #include "snort.h" #include #include #include /* here we begin the series of defs stolen from arpa/nameser.h and arpa/nameser_compat.h * along with any others that seem to make our day easyer */ #define PLUGIN_TEMPLATE_NUMBER 0 #define QFIXEDSZ 4 /* #/bytes of fixed data in query */ #define NS_MAXDNAME 1025 /* maximum domain name */ #define MAXDNAME NS_MAXDNAME #define NS_CMPRSFLGS 0xc0 /* Flag bits indicating name compression. */ #define DNS_LABELTYPE_BITSTRING 0x41 #define NS_TYPE_ELT 0x40 /* EDNS0 extended label type */ #define NS_INT16SZ 2 /* #/bytes of data in a u_int16_t */ #define NS_INT32SZ 4 /* #/bytes of data in a u_int32_t */ #define NS_MAXCDNAME 255 /* maximum compressed domain name */ #ifdef SPRINTF_CHAR # define SPRINTF(x) strlen(sprintf/**/x) #else # define SPRINTF(x) ((size_t)sprintf x) #endif /* * Inline versions of get/put short/long. Pointer is advanced. */ #define uchar_t unsigned char #define NS_GET16(s, cp) do { \ register uchar_t *t_cp = (uchar_t *)(cp); \ (s) = ((uint16_t)t_cp[0] << 8) \ | ((uint16_t)t_cp[1]) \ ; \ (cp) += NS_INT16SZ; \ } while (0) #define NS_GET32(l, cp) do { \ register uchar_t *t_cp = (uchar_t *)(cp); \ (l) = ((uint32_t)t_cp[0] << 24) \ | ((uint32_t)t_cp[1] << 16) \ | ((uint32_t)t_cp[2] << 8) \ | ((uint32_t)t_cp[3]) \ ; \ (cp) += NS_INT32SZ; \ } while (0) #define GETSHORT NS_GET16 #define GETLONG NS_GET32 #define QUESTION 0; #define RESPONSE 1; /* data structures used in the spp */ struct list { int ch; u_long time; u_long id; u_long srcip; u_long dstip; u_long session; u_long instance; struct list *next_rec; struct list *prev_rec; }; /* typedefs for the structure and pointer */ typedef struct list LIST; typedef LIST *LISTPTR; /* set up the HEADER type */ typedef struct { unsigned id :16; /* query identification number */ #if defined(WORDS_BIGENDIAN) /* fields in third byte */ unsigned qr: 1; /* response flag */ unsigned opcode: 4; /* purpose of message */ unsigned aa: 1; /* authoritive answer */ unsigned tc: 1; /* truncated message */ unsigned rd: 1; /* recursion desired */ /* fields in fourth byte */ unsigned ra: 1; /* recursion available */ unsigned unused :1; /* unused bits (MBZ as of 4.9.3a3) */ unsigned ad: 1; /* authentic data from named */ unsigned cd: 1; /* checking disabled by resolver */ unsigned rcode :4; /* response code */ //#endif #else /* fields in third byte */ unsigned rd :1; /* recursion desired */ unsigned tc :1; /* truncated message */ unsigned aa :1; /* authoritive answer */ unsigned opcode :4; /* purpose of message */ unsigned qr :1; /* response flag */ /* fields in fourth byte */ unsigned rcode :4; /* response code */ unsigned cd: 1; /* checking disabled by resolver */ unsigned ad: 1; /* authentic data from named */ unsigned unused :1; /* unused bits (MBZ as of 4.9.3a3) */ unsigned ra :1; /* recursion available */ #endif /* remaining bytes */ unsigned qdcount :16; /* number of question entries */ unsigned ancount :16; /* number of answer entries */ unsigned nscount :16; /* number of authority entries */ unsigned arcount :16; /* number of resource entries */ } DNS_HEADER; /* function prototypes */ LISTPTR add_to_list( DNS_HEADER *dnsheader, Packet *p, LISTPTR); void show_list(LISTPTR); u_long TcpStreamTime(); LISTPTR time_scan_list(LISTPTR); int search_list(DNS_HEADER *dnsheader, Packet *p, LISTPTR); void SetupDnsSession(); void TemplateRuleParseFunction(char *, OptTreeNode *); int TemplateDetectorFunction(Packet *, struct _OptTreeNode *, OptFpList *); void ParseTemplateArgs(char *args); void PreprocFunction(Packet *p); void PreprocCleanExitFunction(int signal); void DnsSessionInit(u_char *args); int skipName(); int skipToData(); void dnsErrorHand(int et, Packet *p); void packetClean(u_char *read_ptr, u_char *endOfData, DNS_HEADER *dnsheader, Packet *p); /* new stuff */ int special(int); int printable(int); int encode_bitsring(const char **, const char *,char **, char **, const char *); int labellen(const u_char *); int decode_bitstring(const char **, char *, const char *); int dn_expand(const u_char *, const u_char *, const u_char *, char *, int); int ns_name_uncompress(const u_char *, const u_char *, const u_char *, char *, size_t); int ns_name_unpack(const u_char *, const u_char *, const u_char *, u_char *, size_t); int ns_name_ntop(const u_char *, char *, size_t); #endif /* __SP_TEMPLATE_H__ */