{ return (ssn_state.session_flags & SSNFLAG_BLOCK) != 0; }
bool full_inspection() const
- { return flow_state <= FlowState::INSPECT; }
+ { return (flow_state <= FlowState::INSPECT) and !is_inspection_disabled(); }
void set_state(FlowState fs)
{ flow_state = fs; }
}
void disable_inspection()
- {
- disable_inspect = true;
- }
+ { disable_inspect = true; }
- bool is_inspection_disabled()
- {
- return disable_inspect;
- }
+ bool is_inspection_disabled() const
+ { return disable_inspect; }
bool is_offloaded() const
{ return flow_flags & FLOW_IS_OFFLOADED; }
off(0)
{ }
-void Codec::codec_event(const CodecData& codec, CodecSid sid)
+void Codec::codec_event(const CodecData&, CodecSid sid)
{
- if ( codec.codec_flags & CODEC_STREAM_REBUILT )
- return;
-
DetectionEngine::queue_event(GID_DECODE, sid);
}
T* data;
};
+// at present there is no sequencing among like types except that appid
+// is always first among controls.
+
enum InspectorType
{
- IT_PASSIVE, // config only, or data consumer
+ IT_PASSIVE, // config only, or data consumer (eg file_log, binder, ftp_client)
IT_BINDER, // maps config to traffic
IT_WIZARD, // guesses service inspector
- IT_PACKET, // processes raw packets
- IT_NETWORK, // process packets w/o service
- IT_STREAM, // flow tracking and reassembly
- IT_SERVICE, // reassemble and process service PDUs
- IT_PROBE, // process all packets after above
+ IT_PACKET, // processes raw packets only (eg normalize, capture)
+ IT_STREAM, // flow tracking and reassembly (eg ip, tcp, udp)
+ IT_NETWORK, // process packets w/o service (eg arp, bo, rep)
+ IT_SERVICE, // extract and analyze service PDUs (eg dce, http, ssl)
+ IT_CONTROL, // process all packets before detection (eg appid)
+ IT_PROBE, // process all packets after detection (eg perf_monitor, port_scan)
IT_MAX
};
{
aux_counts.rx_bytes += pkthdr->caplen;
- PacketManager::decode(p, pkthdr, pkt);
+ PacketManager::decode(p, pkthdr, pkt, is_frag);
assert(p->pkth && p->pkt);
PacketTracer::add_header_info(p);
// FIXIT-L define module names just once
#define bind_id "binder"
#define wiz_id "wizard"
+#define app_id "appid"
//-------------------------------------------------------------------------
// list stuff
void add(PHInstance* p)
{ vec[num++] = p; }
+
+ void add_control(PHInstance*);
};
+// FIXIT-L a more sophisticated approach to handling controls etc. may be
+// warranted such as a configuration or priority scheme (a la 2X). for
+// now we only require that appid run first among controls.
+
+void PHVector::add_control(PHInstance* p)
+{
+ const char* name = p->pp_class.api.base.name;
+
+ if ( strcmp(name, app_id) or !num )
+ add(p);
+
+ else
+ {
+ add(vec[0]);
+ vec[0] = p;
+ }
+}
+
struct FrameworkPolicy
{
PHInstanceList ilist;
PHVector network;
PHVector session;
PHVector service;
+ PHVector control;
PHVector probe;
Inspector* binder;
network.alloc(ilist.size());
session.alloc(ilist.size());
service.alloc(ilist.size());
+ control.alloc(ilist.size());
probe.alloc(ilist.size());
for ( auto* p : ilist )
wizard = p->handler;
break;
+ case IT_CONTROL:
+ control.add_control(p);
+ break;
+
case IT_PROBE:
probe.add(p);
break;
return pi->framework_policy->binder;
}
-Inspector* InspectorManager::get_wizard()
-{
- InspectionPolicy* pi = get_inspection_policy();
-
- if ( !pi || !pi->framework_policy )
- return nullptr;
-
- return pi->framework_policy->wizard;
-}
-
// FIXIT-P cache get_inspector() returns or provide indexed lookup
Inspector* InspectorManager::get_inspector(const char* key, bool dflt_only)
{
flow->session->restart(p);
}
-bool InspectorManager::full_inspection(FrameworkPolicy* fp, Packet* p)
+void InspectorManager::full_inspection(Packet* p)
{
Flow* flow = p->flow;
- if ( !flow->service )
- ::execute(p, fp->network.vec, fp->network.num);
-
- else if ( flow->clouseau and !p->is_cooked() )
+ if ( flow->service and flow->clouseau and !p->is_cooked() )
bumble(p);
- if ( p->disable_inspect )
- return false;
-
- else if ( !p->dsize )
+ if ( !p->dsize )
DetectionEngine::disable_content(p);
else if ( flow->gadget && flow->gadget->likes(p) )
flow->gadget->eval(p);
s_clear = true;
}
-
- return true;
}
+// FIXIT-M split stream base processing out of it_session so that flow lookup
+// can be done first to avoid executing it_packet on disabled flows. also
+// leverage knowledge of flow creation so that reputation (possibly a new
+// it_xxx) is run just once per flow (and all non-flow packets).
+
void InspectorManager::execute(Packet* p)
{
FrameworkPolicy* fp = get_inspection_policy()->framework_policy;
assert(fp);
- // FIXIT-M blocked flows should not be normalized
if ( !p->is_cooked() )
::execute(p, fp->packet.vec, fp->packet.num);
if ( !p->has_paf_payload() )
::execute(p, fp->session.vec, fp->session.num);
- if( p->disable_inspect )
- return;
-
- Flow* flow = p->flow;
+ // must check between each ::execute()
+ if ( p->disable_inspect )
+ return;
- if ( !flow )
+ if ( !p->flow )
+ {
::execute(p, fp->network.vec, fp->network.num);
- else if ( flow->full_inspection() )
+ if ( p->disable_inspect )
+ return;
+
+ ::execute(p, fp->control.vec, fp->control.num);
+ }
+ else
{
- if(!full_inspection(fp, p))
- return;
+ if ( !p->flow->service )
+ ::execute(p, fp->network.vec, fp->network.num);
+
+ if ( p->disable_inspect )
+ return;
+
+ if ( p->flow->full_inspection() )
+ full_inspection(p);
+
+ if ( !p->disable_inspect and !p->flow->is_inspection_disabled() )
+ ::execute(p, fp->control.vec, fp->control.num);
}
}
SO_PUBLIC static Inspector* get_inspector(const char* key, bool dflt_only = false);
SO_PUBLIC static Inspector* get_binder();
- static Inspector* get_wizard();
SO_PUBLIC static Inspector* acquire(const char* key, SnortConfig*);
SO_PUBLIC static void release(Inspector*);
private:
static void bumble(Packet*);
- static bool full_inspection(FrameworkPolicy*, Packet*);
+ static void full_inspection(Packet*);
};
#endif
mod_ctor,
mod_dtor
},
- IT_NETWORK,
+ IT_CONTROL,
(uint16_t)PktType::ANY_IP,
nullptr, // buffers
nullptr, // service
AppIdSession* asd = nullptr;
SipEvent& sip_event = (SipEvent&)event;
-#ifdef DEBUG_APP_ID_SESSIONS
- {
- char src_ip[INET6_ADDRSTRLEN];
- char dst_ip[INET6_ADDRSTRLEN];
- const SfIp* ip;
-
- src_ip[0] = 0;
- ip = p->ptrs.ip_api.get_src();
- sfip_ntop(ip, src_ip, sizeof(src_ip));
- dst_ip[0] = 0;
- ip = p->ptrs.ip_api.get_dst();
- sfip_ntop(ip, dst_ip, sizeof(dst_ip));
- fprintf(SF_DEBUG_FILE, "AppId Sip Snort Callback Session %s-%u -> %s-%u %d\n", src_ip,
- (unsigned)p->src_port, dst_ip, (unsigned)p->dst_port, IsTCP(p) ? IpProtocol::TCP :
- IpProtocol::UDP);
- }
-#endif
if ( flow )
asd = appid_api.get_appid_session(flow);
if ( !asd )
- return;
+ {
+ const Packet* p = sip_event.get_packet();
+ IpProtocol protocol = p->is_tcp() ? IpProtocol::TCP : IpProtocol::UDP;
+ int direction = p->is_from_client() ? APP_ID_FROM_INITIATOR : APP_ID_FROM_RESPONDER;
+ asd = AppIdSession::allocate_session(p, protocol, direction);
+ }
client_handler(sip_event, asd);
service_handler(sip_event, asd);
Active::drop_packet(p, true);
// disable all preproc analysis and detection for this packet
DetectionEngine::disable_all(p);
- p->disable_inspect = true;
- if (p->flow)
- {
- p->flow->set_state(Flow::FlowState::BLOCK);
- p->flow->disable_inspection();
- }
-
+ Active::block_session(p, true);
reputationstats.blacklisted++;
}
else if (MONITORED == decision)
DetectionEngine::queue_event(GID_REPUTATION, REPUTATION_EVENT_WHITELIST);
p->packet_flags |= PKT_IGNORE;
DetectionEngine::disable_all(p);
- p->disable_inspect = true;
- if (p->flow)
- {
- p->flow->set_state(Flow::FlowState::ALLOW);
- p->flow->disable_inspection();
- }
+ Active::allow_session(p);
reputationstats.whitelisted++;
}
}
return retry_queued;
}
-void Active::block_session(const Packet* p, bool force)
+void Active::allow_session(Packet* p)
+{
+ active_action = ACT_PASS;
+
+ if ( p->flow )
+ {
+ p->flow->set_state(Flow::FlowState::ALLOW);
+ p->flow->disable_inspection();
+ }
+
+ p->disable_inspect = true;
+}
+
+void Active::block_session(Packet* p, bool force)
{
update_status(p, force);
active_action = ACT_BLOCK;
if ( force or SnortConfig::inline_mode() or SnortConfig::treat_drop_as_ignore() )
Stream::block_flow(p);
+
+ p->disable_inspect = true;
}
-void Active::reset_session(const Packet* p, bool force)
+void Active::reset_session(Packet* p, bool force)
{
update_status(p, force);
active_action = ACT_RESET;
p->flow->set_state(Flow::FlowState::RESET);
}
}
+
+ p->disable_inspect = true;
}
void Active::set_delayed_action(ActiveAction action, bool force)
active_status = AST_FORCE;
}
-void Active::apply_delayed_action(const Packet* p)
+void Active::apply_delayed_action(Packet* p)
{
bool force = (active_status == AST_FORCE);
static void drop_packet(const Packet*, bool force = false);
static void daq_drop_packet(const Packet*);
- static bool daq_retry_packet(const Packet *p);
+ static bool daq_retry_packet(const Packet*);
- static void block_session(const Packet* p, bool force = false);
- static void reset_session(const Packet* p, bool force = false);
+ static void allow_session(Packet*);
+
+ static void block_session(Packet*, bool force = false);
+ static void reset_session(Packet*, bool force = false);
static void block_again()
{ active_action = ACT_BLOCK; }
static void set_delayed_action(ActiveAction, bool force = false);
- static void apply_delayed_action(const Packet* p);
+ static void apply_delayed_action(Packet*);
private:
static bool open(const char*);
s_stats[other_codecs]++;
if ( (to_utype(ProtocolId::MIN_UNASSIGNED_IP_PROTO) <= to_utype(prev_prot_id)) &&
- (to_utype(prev_prot_id) <= std::numeric_limits<uint8_t>::max()) &&
- !(codec_data.codec_flags & CODEC_STREAM_REBUILT) )
+ (to_utype(prev_prot_id) <= std::numeric_limits<uint8_t>::max()) )
{
DetectionEngine::queue_event(GID_DECODE, DECODE_IP_UNASSIGNED_PROTO);
}
// Postpone clear till inspection is completed
flow->session_state |= STREAM_STATE_BLOCK_PENDING;
+
+ flow->disable_inspection();
}
void Stream::drop_flow(const Packet* p)
projects / thirdparty / snort3.git / commitdiff
