Some things Snort++ can do today that Snort can not do:
* regex fast patterns, not just literals
-* FlatBuffers perf monitor logs
+* FlatBuffers and JSON perf monitor logs
* LuaJIT scriptable rule options and loggers
* pub/sub inspection events (currently used by sip and http to appid)
* JIT buffer stuffers (notably with new http_inspect)
return 0;
}
-/**Reset all data structures and free all memory.
- */
-void TagCacheReset()
-{
- sfxhash_make_empty(ssn_tag_cache_ptr);
- sfxhash_make_empty(host_tag_cache_ptr);
-}
-
/**
* swap the sips and dips, dp's and sp's
*
void CleanupTag();
int CheckTagList(Packet*, Event&, void**);
void SetTags(Packet*, const OptTreeNode*, uint16_t);
-void TagCacheReset();
-#endif /* TAG_H */
+#endif
return (current_block);
}
-// Get the file size captured in the file buffer
-uint64_t FileCapture::get_capture_size() const
-{
- return capture_size;
-}
-
/*
* writing file data to the disk.
*
// nullptr: end of file or fail to get file
FileCaptureBlock* get_file_data(uint8_t** buff, int* size);
- // Get the file size captured in the file buffer
- // Returns: the size of file in bytes
- uint64_t get_capture_size() const;
-
// Store files on local disk
void store_file();
return fd;
}
-void FileFlows::save_to_pending_context()
-{
- if (pending_context != main_context)
- delete(pending_context);
- pending_context = main_context;
-}
-
void FileFlows::set_current_file_context(FileContext* ctx)
{
current_context = ctx;
static unsigned flow_id;
private:
- void save_to_pending_context();
void init_file_context(FileDirection, FileContext*);
FileContext* find_main_file_context(FilePosition, FileDirection, size_t id = 0);
FileContext* main_context = nullptr;
return node;
}
-void FileIdentifier::verify_magic_offset(FileMagicData* parent, FileMagicData* current)
-{
- if ((parent) && (parent->content.size() + parent->offset > current->offset))
- {
- ParseError("magic content at offset %u overlaps with offset %u.",
- parent->offset, current->offset);
- return;
- }
-}
-
IdentifierNode* FileIdentifier::create_trie_from_magic(FileMagicRule& rule, uint32_t type_id)
{
IdentifierNode* current;
void* calloc_mem(size_t size);
void set_node_state_shared(IdentifierNode* start);
IdentifierNode* clone_node(IdentifierNode* start);
- void verify_magic_offset(FileMagicData* parent, FileMagicData* current);
bool update_next(IdentifierNode* start, IdentifierNode** next_ptr, IdentifierNode* append);
IdentifierNode* create_trie_from_magic(FileMagicRule& rule, uint32_t type_id);
void update_trie(IdentifierNode* start, IdentifierNode* append);
return direction;
}
-void FileInfo::set_file_sig_sha256(uint8_t* signature)
-{
- sha256 = signature;
-}
-
uint8_t* FileInfo::get_file_sig_sha256() const
{
return (sha256);
uint64_t get_file_size() const;
void set_file_direction(FileDirection dir);
FileDirection get_file_direction() const;
- void set_file_sig_sha256(uint8_t* signature);
uint8_t* get_file_sig_sha256() const;
std::string sha_to_string(const uint8_t* sha256);
void set_file_id(size_t index);
sip, dip, curtime);
}
-/* empty out active entries */
-void detection_filter_reset_active()
-{
- if (detection_filter_hash == NULL)
- return;
-
- sfxhash_make_empty(detection_filter_hash);
-}
-
THD_NODE* detection_filter_create(DetectionFilterConfig* df_config, THDX_STRUCT* thdx)
{
if (df_config == NULL)
void detection_filter_term();
void detection_filter_print_config(DetectionFilterConfig*);
-void detection_filter_reset_active();
int detection_filter_test(void*, const SfIp* sip, const SfIp* dip, long curtime);
struct THD_NODE* detection_filter_create(DetectionFilterConfig*, struct THDX_STRUCT*);
p->pkth->ts.tv_sec, SFRF_COUNT_INCREMENT);
}
-/* empty out active entries */
-void RateFilter_ResetActive()
-{
- SFRF_Flush();
-}
-
void RateFilter_PrintConfig(RateFilterConfig*)
{
// FIXIT-L print from module
void RateFilter_PrintConfig(RateFilterConfig*);
int RateFilter_Test(const OptTreeNode*, Packet*);
-void RateFilter_ResetActive();
#endif
#ifdef THD_DEBUG
char buf[24];
printf("THD_DEBUG: Key THD_NODE IP=%s,",
- printIP((unsigned)sfthd_node->ip_address), buf, sizeof(buf) );
+ printIP((unsigned)sfthd_node->ip_address, buf, sizeof(buf)) );
printf(" MASK=%s\n", printIP((unsigned)sfthd_node->ip_mask, buf, sizeof(buf)) );
printf("THD_DEBUG: PKT SIP=%s\n", printIP((unsigned)sip, buf, sizeof(buf)) );
printf("THD_DEBUG: PKT DIP=%s\n", printIP((unsigned)dip, buf, sizeof(buf)) );
thd_checked = 0;
}
-/* empty out active entries */
-void sfthreshold_reset_active()
-{
- if (thd_runtime == NULL)
- return;
-
- if (thd_runtime->ip_nodes != NULL)
- sfxhash_make_empty(thd_runtime->ip_nodes);
-
- if (thd_runtime->ip_gnodes != NULL)
- sfxhash_make_empty(thd_runtime->ip_gnodes);
-}
-
int sfthreshold_create(struct SnortConfig*, ThresholdConfig*, THDX_STRUCT*);
int sfthreshold_test(unsigned int, unsigned int, const SfIp*, const SfIp*, long curtime);
void print_thresholding(ThresholdConfig*, unsigned shutdown);
-void sfthreshold_reset_active();
void sfthreshold_free();
#endif
sfmemcap_free(&t->mc, p);
}
-/*
- * User access to the memory management, do they need it ? WaitAndSee
- */
-void* sfxhash_alloc(SFXHASH* t, unsigned nbytes)
-{
- return s_alloc(t, nbytes);
-}
-
-void sfxhash_free(SFXHASH* t, void* p)
-{
- s_free(t, p);
-}
-
static int sfxhash_nearest_powerof2(int nrows)
{
nrows -= 1;
return nrows;
}
-int sfxhash_calcrows(int num)
-{
- return sfxhash_nearest_powerof2(num);
-// return sf_nearest_prime( nrows );
-}
-
/*
* Create a new hash table
*
}
}
-/*!
- * Set Splay mode : Splays nodes to front of list on each access
- *
- * t SFXHASH table pointer
- * n boolean flag toggles splaying of hash nodes
- *
- */
-void sfxhash_splaymode(SFXHASH* t, int n)
-{
- t->splay = n;
-}
-
/*!
* Free all nodes in the free list
*
return nullptr;
}
-/**
- * Walk the global list
- *
- * n current node
- *
- * return the next node in the list or nullptr when at the end
- */
-SFXHASH_NODE* sfxhash_gnext(SFXHASH_NODE* n)
-{
- if (n)
- {
- return n->gnext;
- }
-
- return nullptr;
-}
-
/**
* Walk the global list
*
return nullptr;
}
-/*!
- * Return the most recently used node from the global list
- *
- * t SFXHASH table pointer
- *
- * return SFXHASH_NODE* valid pointer to a node
- * retval 0 node not found
- *
- */
-SFXHASH_NODE* sfxhash_mru_node(SFXHASH* t)
-{
- SFXHASH_NODE* hnode = sfxhash_ghead(t);
- if ( hnode )
- return hnode;
-
- return nullptr;
-}
-
-/*!
- * Return the least recently used node from the global list
- *
- * t SFXHASH table pointer
- *
- * return SFXHASH_NODE* valid pointer to a node
- * retval 0 node not found
- *
- */
-SFXHASH_NODE* sfxhash_lru_node(SFXHASH* t)
-{
- SFXHASH_NODE* hnode = t->gtail;
- if ( hnode )
- return hnode;
-
- return nullptr;
-}
-
-/*!
- * Get some hash table statistics. NOT FOR REAL TIME USE.
- *
- *
- * t SFXHASH table pointer
- * param filled how many
- *
- * return max depth of the table
- *
- */
-unsigned sfxhash_maxdepth(SFXHASH* t)
-{
- unsigned max_depth = 0;
-
- SFXHASH_NODE* hnode;
-
- for ( unsigned i = 0; i < t->nrows; i++ )
- {
- unsigned cur_depth = 0;
-
- for (hnode = t->table[i]; hnode != nullptr; hnode = hnode->next)
- {
- cur_depth++;
- }
-
- if (cur_depth > max_depth)
- max_depth = cur_depth;
- }
-
- return max_depth;
-}
-
/*
* Unlink and free the node
*/
return -1;
}
-int sfxhash_add_return_data_ptr(SFXHASH* t, const void* key, void** data)
-{
- if ( !t->datasize )
- return SFXHASH_ERR;
-
- *data = nullptr;
-
- return sfxhash_add_ex(t, key, nullptr, data);
-}
-
/*
* -----------------------------------------------------------------------------------------
* Test Driver for Hashing
SFXHASH_FREE_FCN usrfree;
};
-SO_PUBLIC int sfxhash_calcrows(int num);
SO_PUBLIC SFXHASH* sfxhash_new(int nrows, int keysize, int datasize, unsigned long memcap,
int anr_flag,
SFXHASH_FREE_FCN anrfunc,
SO_PUBLIC void* sfxhash_mru(SFXHASH* t);
SO_PUBLIC void* sfxhash_lru(SFXHASH* t);
-SO_PUBLIC SFXHASH_NODE* sfxhash_mru_node(SFXHASH* t);
-SO_PUBLIC SFXHASH_NODE* sfxhash_lru_node(SFXHASH* t);
SO_PUBLIC void* sfxhash_find(SFXHASH* h, void* key);
SO_PUBLIC SFXHASH_NODE* sfxhash_find_node(SFXHASH* t, const void* key);
SO_PUBLIC SFXHASH_NODE* sfxhash_findnext(SFXHASH* h);
SO_PUBLIC SFXHASH_NODE* sfxhash_ghead(SFXHASH* h);
-SO_PUBLIC SFXHASH_NODE* sfxhash_gnext(SFXHASH_NODE* n);
SO_PUBLIC void sfxhash_gmovetofront(SFXHASH* t, SFXHASH_NODE* hnode);
-SO_PUBLIC void sfxhash_splaymode(SFXHASH* h, int mode);
-
-SO_PUBLIC void* sfxhash_alloc(SFXHASH* t, unsigned nbytes);
-SO_PUBLIC void sfxhash_free(SFXHASH* t, void* p);
SO_PUBLIC int sfxhash_free_node(SFXHASH* t, SFXHASH_NODE* node);
-SO_PUBLIC unsigned sfxhash_maxdepth(SFXHASH* t);
-
SO_PUBLIC int sfxhash_set_keyops(SFXHASH* h,
unsigned (* hash_fcn)(SFHASHFCN* p, unsigned char* d, int n),
int (* keycmp_fcn)(const void* s1, const void* s2, size_t n));
SO_PUBLIC SFXHASH_NODE* sfxhash_gfindfirst(SFXHASH* t);
SO_PUBLIC SFXHASH_NODE* sfxhash_gfindnext(SFXHASH* t);
-SO_PUBLIC int sfxhash_add_return_data_ptr(SFXHASH* t, const void* key, void** data);
#endif
}
}
-void PrintPacketData(const uint8_t* data, const uint32_t len)
-{
- uint32_t i, j;
- uint32_t total_len = 0;
- uint8_t hex_buf[16];
- uint8_t char_buf[16];
- const char* length_chars =
- " 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15\n"
- "------------------------------------------------------\n";
-
- LogMessage("%s", length_chars);
-
- for (i = 0; i <= len; i++)
- {
- if ((i%16 == 0) && (i != 0))
- {
- LogMessage("%04x ", total_len);
- total_len += 16;
-
- for (j = 0; j < 16; j++)
- {
- LogMessage("%02x ", hex_buf[j]);
- if (j == 7)
- LogMessage(" ");
- }
-
- LogMessage(" ");
-
- for (j = 0; j < 16; j++)
- {
- LogMessage("%c", char_buf[j]);
- if (j == 7)
- LogMessage(" ");
- }
-
- LogMessage("\n");
- }
-
- if (i == len)
- break;
-
- hex_buf[i%16] = data[i];
-
- if (isprint((int)data[i]))
- char_buf[i%16] = data[i];
- else
- char_buf[i%16] = '.';
- }
-
- if ((i-total_len) > 0)
- {
- LogMessage("%04x ", total_len);
-
- for (j = 0; j < i-total_len; j++)
- {
- LogMessage("%02x ", hex_buf[j]);
- if (j == 7)
- LogMessage(" ");
- }
-
- if (j < 8)
- LogMessage(" ");
- LogMessage("%*s", (16-j)*3, "");
- LogMessage(" ");
-
- for (j = 0; j < i-total_len; j++)
- {
- LogMessage("%c", char_buf[j]);
- if (j == 7)
- LogMessage(" ");
- }
- }
-
- LogMessage("\n");
-}
-
void log_safec_error(const char* msg, void*, int e)
{
static THREAD_LOCAL unsigned safec_errors = 0;
// FIXIT-M do not call FatalError() during runtime
SO_PUBLIC NORETURN void FatalError(const char*, ...) __attribute__((format (printf, 1, 2)));
-SO_PUBLIC void PrintPacketData(const uint8_t*, const uint32_t);
-
void log_safec_error(const char*, void*, int);
class Dumper
return ignore_data;
}
-void DecodeConfig::set_max_mime_mem(int max)
-{
- max_mime_mem = max;
-}
-
-int DecodeConfig::get_max_mime_mem()
-{
- return max_mime_mem;
-}
-
void DecodeConfig::set_b64_depth(int depth)
{
b64_depth = depth;
#include "main/snort_types.h"
/*These are temporary values*/
-#define DEFAULT_MAX_MIME_MEM 838860
#define DEFAULT_MIME_MEMCAP 838860
#define DEFAULT_DEPTH 1464
#define MAX_LOG_MEMCAP 104857600
#define MIN_LOG_MEMCAP 3276
-#define MAX_MIME_MEM 104857600
#define MIN_MIME_MEM 3276
#define MAX_DEPTH 65535
#define MIN_DEPTH -1
public:
void set_ignore_data(bool);
bool is_ignore_data();
- void set_max_mime_mem(int);
- int get_max_mime_mem();
+
void set_b64_depth(int);
int get_b64_depth();
+
void set_qp_depth(int);
int get_qp_depth();
+
void set_bitenc_depth(int);
int get_bitenc_depth();
+
void set_uu_depth(int);
int get_uu_depth();
+
int64_t get_file_depth();
bool is_decoding_enabled();
void sync_all_depths();
private:
bool ignore_data = false;
- int max_mime_mem = DEFAULT_MAX_MIME_MEM;
int b64_depth = DEFAULT_DEPTH;
int qp_depth = DEFAULT_DEPTH;
int bitenc_depth = DEFAULT_DEPTH;
return 0;
}
-#ifdef XXXX
-/* copy a simple alpha string */
-static void POPeekString(POParser* p, char* s, int smax)
-{
- int c;
- int cnt = 0;
- int k = p->slen;
-
- smax--;
-
- s[0] = 0;
-
- while ( k > 0 && cnt < smax )
- {
- c = p->s[ cnt ];
-
- if ( c == 0 )
- break;
- if ( !isalpha(c) )
- break;
-
- s[ cnt++ ] = c;
- s[ cnt ] = 0;
- k--;
- }
-}
-
-static void POGetString(POParser* p, char* s, int smax)
-{
- int c;
- int cnt = 0;
-
- smax--;
-
- s[0] = 0;
-
- while ( p->slen > 0 && cnt < smax )
- {
- c = p->s[ 0 ];
-
- if ( c == 0 )
- break;
- if ( !isalpha(c) )
- break;
-
- s[ cnt++ ] = c;
- s[ cnt ] = 0;
- p->slen--;
- p->s++;
- }
-}
-
-#endif
-
/*
Skip whitespace : ' ', '\t', '\n'
*/
void OrderRuleLists(SnortConfig*, const char*);
void PrintRuleOrder(RuleListNode*);
-const char* VarGet(SnortConfig*, const char*);
char* ProcessFileOption(SnortConfig*, const char*);
void SetRuleStates(SnortConfig*);
return NULL;
}
-/****************************************************************************
- *
- * Function: VarGet(SnortConfig *, char *)
- *
- * Purpose: get the contents of a variable
- *
- * Arguments: name => the name of the variable
- *
- * Returns: char * to contents of variable or ParseErrors on an
- * undefined variable name
- *
- ***************************************************************************/
-const char* VarGet(SnortConfig*, const char* name)
-{
- IpsPolicy* dp = get_ips_policy();
- VarEntry* var_table = dp->var_table;
- vartable_t* ip_vartable = dp->ip_vartable;
- sfip_var_t* var;
-
-// XXX-IPv6 This function should never be used if IP6 support is enabled!
-// In fact it won't presently even work for IP variables since the raw ASCII
-// value is never stored, and is never meant to be used.
-
- if ((var = sfvt_lookup_var(ip_vartable, name)) == NULL)
- {
- /* Do the old style lookup since it wasn't found in
- * the variable table */
- if (var_table != NULL)
- {
- VarEntry* p = var_table;
- do
- {
- if (strcasecmp(p->name, name) == 0)
- return p->value;
- p = p->next;
- }
- while (p != var_table);
- }
-
- ParseError("undefined variable name: %s.", name);
- }
-
- return name;
-}
-
/****************************************************************************
*
* Function: ExpandVars()
int VarIsIpAddr(vartable_t* ip_vartable, const char* value);
int VarIsIpList(vartable_t* ip_vartable, const char* value);
void DisallowCrossTableDuplicateVars(SnortConfig*, const char* name, VarType var_type);
-const char* VarGet(SnortConfig*, const char* name);
-/*
- * Same as VarGet - but this does not Fatal out if a var is not found
- */
-const char* VarSearch(SnortConfig*, const char* name);
+const char* VarSearch(SnortConfig*, const char* name);
const char* ExpandVars(SnortConfig*, const char* string);
#endif
return nullptr;
}
-/********************************************************************
- * Function: DCE2_CStackNew()
- *
- * Creates and initializes a new static sized stack object. The
- * static stack uses a fixed size array and uses indexes to
- * indicate the start and end of the stack. This type of
- * stack can become full since it is a fixed size. Used for
- * performance reasons since new nodes do not need to be
- * allocated on the fly.
- *
- * Arguments:
- * int
- * The size that should be allocated for the static
- * stack storage.
- * DCE2_CStackDataFree
- * An optional free function for the data inserted into
- * the stack. If NULL is passed in, the user will be
- * responsible for freeing data left in the stack.
- *
- * Returns:
- * DCE2_CStack *
- * Pointer to a new stack object.
- *
- ********************************************************************/
-DCE2_CStack* DCE2_CStackNew(int size, DCE2_CStackDataFree df)
-{
- DCE2_CStack* cstack;
-
- if (size <= 0)
- return nullptr;
-
- cstack = (DCE2_CStack*)snort_calloc(sizeof(DCE2_CStack));
- cstack->data_free = df;
- cstack->stack = (void**)snort_calloc(size, sizeof(void*));
-
- cstack->size = size;
- cstack->tail_idx = DCE2_SENTINEL;
- cstack->cur_idx = DCE2_SENTINEL;
-
- return cstack;
-}
-
-/********************************************************************
- * Function: DCE2_CStackPush()
- *
- * Inserts data into the static stack.
- *
- * Arguments:
- * DCE2_CStack *
- * A pointer to the stack object.
- * void *
- * Pointer to the data to insert into the stack.
- *
- * Returns:
- * DCE2_Ret
- * DCE2_RET__ERROR if the stack is full or the stack object
- * passed in is NULL.
- * DCE2_RET__SUCCESS if the data is successfully added to
- * the stack.
- *
- ********************************************************************/
-DCE2_Ret DCE2_CStackPush(DCE2_CStack* cstack, void* data)
-{
- if (cstack == nullptr)
- return DCE2_RET__ERROR;
-
- if (cstack->num_nodes == (uint32_t)cstack->size)
- return DCE2_RET__ERROR;
-
- if (cstack->tail_idx == DCE2_SENTINEL)
- cstack->tail_idx = 0;
- else
- cstack->tail_idx++;
-
- cstack->stack[cstack->tail_idx] = data;
- cstack->num_nodes++;
-
- return DCE2_RET__SUCCESS;
-}
-
-/********************************************************************
- * Function: DCE2_CStackPop()
- *
- * Removes and returns the data in the last node in the stack.
- * Note that the user will have to free the data returned. The
- * data free function only applies to data that is in the stack
- * when it is emptied or destroyed.
- *
- * Arguments:
- * DCE2_CStack *
- * A pointer to the stack object.
- *
- * Returns:
- * void *
- * The data in the last node in the stack.
- * NULL if there are no items in the stack or the stack object
- * passed in is NULL.
- *
- ********************************************************************/
-void* DCE2_CStackPop(DCE2_CStack* cstack)
-{
- void* data;
-
- if (cstack == nullptr)
- return nullptr;
-
- if (cstack->num_nodes == 0)
- return nullptr;
-
- data = cstack->stack[cstack->tail_idx];
- cstack->stack[cstack->tail_idx] = nullptr;
-
- if (cstack->tail_idx == 0)
- cstack->tail_idx = DCE2_SENTINEL;
- else
- cstack->tail_idx--;
-
- cstack->num_nodes--;
-
- return data;
-}
-
-/********************************************************************
- * Function: DCE2_CStackTop()
- *
- * Returns the data on top of the stack. Does not remove the data
- * from the stack.
- *
- * Arguments:
- * DCE2_CStack *
- * A pointer to the stack object.
- *
- * Returns:
- * void *
- * The data on top of the stack.
- * NULL if there are no items in the stack or the stack object
- * passed in is NULL.
- *
- ********************************************************************/
-void* DCE2_CStackTop(DCE2_CStack* cstack)
-{
- if (cstack == nullptr)
- return nullptr;
-
- if (cstack->num_nodes == 0)
- return nullptr;
-
- return cstack->stack[cstack->tail_idx];
-}
-
-/********************************************************************
- * Function: DCE2_CStackEmpty()
- *
- * Removes all of the nodes in a stack. Does not delete the stack
- * object itself or the storage array. Calls data free function
- * for data if it is not NULL.
- *
- * Arguments:
- * DCE2_CStack *
- * A pointer to the stack object.
- *
- * Returns: None
- *
- ********************************************************************/
-void DCE2_CStackEmpty(DCE2_CStack* cstack)
-{
- if (cstack == nullptr)
- return;
-
- while (!DCE2_CStackIsEmpty(cstack))
- {
- void* data = DCE2_CStackPop(cstack);
-
- if ((data != nullptr) && (cstack->data_free != nullptr))
- cstack->data_free(data);
- }
-
- cstack->num_nodes = 0;
- cstack->tail_idx = DCE2_SENTINEL;
- cstack->cur_idx = DCE2_SENTINEL;
-}
-
-/********************************************************************
- * Function: DCE2_CStackDestroy()
- *
- * Destroys the stack object and all of the data associated with it.
- *
- * Arguments:
- * DCE2_CStack *
- * A pointer to the stack object.
- *
- * Returns: None
- *
- ********************************************************************/
-void DCE2_CStackDestroy(DCE2_CStack* cstack)
-{
- if (cstack == nullptr)
- return;
-
- DCE2_CStackEmpty(cstack);
- snort_free((void*)cstack->stack);
- snort_free((void*)cstack);
-}
-
DCE2_QueueNode* prev;
};
-typedef DCE2_ListDataFree DCE2_CStackDataFree;
-
-struct DCE2_CStack
-{
- uint32_t num_nodes;
- DCE2_CStackDataFree data_free;
- int size;
- void** stack;
- int tail_idx;
- int cur_idx;
-};
-
/********************************************************************
* Public function prototypes
********************************************************************/
void DCE2_QueueRemoveCurrent(DCE2_Queue*);
void* DCE2_QueueLast(DCE2_Queue*);
-DCE2_CStack* DCE2_CStackNew(int, DCE2_CStackDataFree);
-DCE2_Ret DCE2_CStackPush(DCE2_CStack*, void*);
-void* DCE2_CStackPop(DCE2_CStack*);
-void* DCE2_CStackTop(DCE2_CStack*);
-static inline int DCE2_CStackIsEmpty(DCE2_CStack*);
-void DCE2_CStackEmpty(DCE2_CStack*);
-void DCE2_CStackDestroy(DCE2_CStack*);
-
/********************************************************************
* Function: DCE2_ListIsEmpty()
*
return 0;
}
-/********************************************************************
- * Function: DCE2_CStackIsEmpty()
- *
- * Determines whether or not the stack has any items in it
- * currently.
- *
- ********************************************************************/
-static inline int DCE2_CStackIsEmpty(DCE2_CStack* cstack)
-{
- if (cstack == nullptr)
- return 1;
- if (cstack->num_nodes == 0)
- return 1;
- return 0;
-}
-
#endif
snort_free(FTPBounce);
}
-void CleanupFTPClientConf(void* clientConf)
-{
- FTP_CLIENT_PROTO_CONF* ClientConf = (FTP_CLIENT_PROTO_CONF*)clientConf;
- if (ClientConf == NULL)
- return;
-
- /* Iterate through each bounce_lookup for this client */
- ftp_bounce_lookup_cleanup(&ClientConf->bounce_lookup);
-}
-
/*
* Function: CheckFTPCmdOptions(FTP_SERVER_PROTO_CONF *serverConf)
*
void CleanupFTPServerConf(void* serverConf);
void CleanupFTPCMDConf(void* ftpCmd);
-void CleanupFTPClientConf(void* clientConf);
void CleanupFTPBounceTo(void* ftpBounce);
int CheckFTPServerConfigs(SnortConfig*, FTP_SERVER_PROTO_CONF*);
#include "hash/sfhashfcn.h"
-/********************************************************************
- * Function: SIP_IsEmptyStr()
- *
- * Checks if string is NULL, empty or just spaces.
- * String must be 0 terminated.
- *
- * Arguments:
- * char * - string to check
- *
- * Returns:
- * 1 if string is NULL, empty or just spaces
- * 0 otherwise
- *
- ********************************************************************/
-int SIP_IsEmptyStr(char* str)
-{
- char* end;
-
- if (str == NULL)
- return 1;
-
- end = str + strlen(str);
-
- while ((str < end) && isspace((int)*str))
- str++;
-
- if (str == end)
- return 1;
-
- return 0;
-}
-
/*
* Trim spaces non-destructively on both sides of string : '', \t, \n, \r
* If string is empty return 0, otherwise 1
#include "sip_config.h"
-int SIP_IsEmptyStr(char*);
int SIP_TrimSP(const char*, const char*, char**, char**);
SIPMethodNode* SIP_FindMethod(SIPMethodlist, const char* method, unsigned int);
uint32_t strToHash(const char*, int);
return ss;
}
-bool Stream::is_paf_active(Flow* flow, bool to_server)
-{
- assert(flow && flow->session);
- StreamSplitter* ss = flow->session->get_splitter(to_server);
- return ss && ss->is_paf();
-}
-
//-------------------------------------------------------------------------
// extra data foo
//-------------------------------------------------------------------------
static void set_splitter(Flow*, bool toServer, class StreamSplitter* = nullptr);
static StreamSplitter* get_splitter(Flow*, bool toServer);
- static bool is_paf_active(Flow*, bool toServer);
// Turn off inspection for potential session. Adds session identifiers to a hash table.
// TCP only.
{
// sanity check since this is called externally
assert(p->ptrs.tcph);
+ assert(p->flow == flow);
- assert(!p or p->flow == flow);
DetectionEngine::onload(flow);
TcpStreamTracker* talker, * listener;
LogMessage(" Require 3-Way Handshake: after %d seconds\n", config->hs_timeout);
}
-//-------------------------------------------------------------------------
-// attribute table foo
-//-------------------------------------------------------------------------
-
-int TcpStreamConfig::verify_config(SnortConfig*)
-{
- return 0;
-}
-
return false;
}
- int verify_config(SnortConfig*);
void show_config();
static void show_config(TcpStreamConfig*);
return NULL;
}
-/*
-*
-*/
-KEYNODE* KMapFindFirstKey(KMAP* km)
-{
- km->keynext = km->keylist;
-
- if (!km->keynext)
- {
- return NULL;
- }
-
- return km->keynext;
-}
-
/*
*
*/
return km->keynext->userdata;
}
-/*
-*
-*/
-KEYNODE* KMapFindNextKey(KMAP* km)
-{
- if ( !km->keynext )
- return 0;
-
- km->keynext = km->keynext->next;
-
- if ( !km->keynext )
- return 0;
-
- return km->keynext;
-}
-
/*
*
*/
SO_PUBLIC void* KMapFindFirst(KMAP* km);
SO_PUBLIC void* KMapFindNext(KMAP* km);
-SO_PUBLIC KEYNODE* KMapFindFirstKey(KMAP* km);
-SO_PUBLIC KEYNODE* KMapFindNextKey(KMAP* km);
-
#endif
s_free(s);
}
-void sfqueue_free(SF_QUEUE* s)
-{
- sflist_free (s);
-}
-
void sfqueue_add(SF_QUEUE*, NODE_DATA);
NODE_DATA sfqueue_remove(SF_QUEUE*);
int sfqueue_count(SF_QUEUE*);
-void sfqueue_free(SF_QUEUE*);
void sfqueue_free_all(SF_QUEUE*, void (* free)(void*) );
#endif
mc->nblocks= 0;
}
-/*
-* Create and Init a MEMCAP - use free to release it
-*/
-MEMCAP* sfmemcap_new(unsigned nbytes)
-{
- MEMCAP* mc = (MEMCAP*)snort_calloc(sizeof(MEMCAP));
- sfmemcap_init(mc, nbytes);
- return mc;
-}
-
-/*
-* Release the memcap structure
-*/
-void sfmemcap_delete(MEMCAP* p)
-{
- if (p)
- snort_free(p);
-}
-
/*
* Allocate some memory
*/
fprintf(stderr, " nblocks= %d blocks\n",mc->nblocks);
}
-/*
-* String Dup Some memory.
-*/
-char* sfmemcap_SnortStrdup(MEMCAP* mc, const char* str)
-{
- int data_size = strlen(str) + 1;
- char* data = (char*)sfmemcap_alloc(mc, data_size);
-
- if (data == NULL)
- {
- return 0;
- }
-
- SnortStrncpy(data, str, data_size);
-
- return data;
-}
-
-/*
-* Dup Some memory.
-*/
-void* sfmemcap_dupmem(MEMCAP* mc, void* src, unsigned long n)
-{
- void* data = (char*)sfmemcap_alloc(mc, n);
- if (data == NULL)
- {
- return 0;
- }
-
- memcpy(data, src, n);
-
- return data;
-}
-
// FIXIT-L could be refactored as a class but should be deleted
void sfmemcap_init(MEMCAP* mc, unsigned long nbytes);
-MEMCAP* sfmemcap_new(unsigned nbytes);
-void sfmemcap_delete(MEMCAP* mc);
void* sfmemcap_alloc(MEMCAP* mc, unsigned long nbytes);
void sfmemcap_showmem(MEMCAP* mc);
void sfmemcap_free(MEMCAP* mc, void* memory);
-char* sfmemcap_SnortStrdup(MEMCAP* mc, const char* str);
-void* sfmemcap_dupmem(MEMCAP* mc, void* src, unsigned long n);
#endif
static void UnescapeDecode(char*, uint16_t, char**, char**, uint16_t*, JSState*, uint8_t*);
-void InitJSNormLookupTable() {}
-
static inline int outBounds(const char* start, const char* end, char* ptr)
{
if ((ptr >= start) && (ptr < end))
js.allowed_levels = 1;
js.alerts = 0;
- InitJSNormLookupTable();
ret = JSNormalizeDecode(input, bytes_read, output, sizeof(output),&ptr, &bytes_copied, &js, NULL);
if( ret == RET_OK)
{
void keep_jsnorm_lib(); // FIXIT-L eliminate; required to keep symbols for dyn plugins
-SO_PUBLIC void InitJSNormLookupTable();
-
SO_PUBLIC int JSNormalizeDecode(
char*, uint16_t, char*, uint16_t destlen, char**, int*, JSState*, uint8_t*);
projects / thirdparty / snort3.git / commitdiff
