initial multiple policy binding

diff --git a/ChangeLog b/ChangeLog
index f4c2e42711b6d1343d3de163ce66d09f8e065c74..e4aa389916acc3e6e7e737daf4f450959913bb13 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -7,6 +7,7 @@
 -- fixed valgrind issues
 -- refactored Shells to support multiple files/policies
 -- changed detect reset to accommodate buffer population before reassembly
+-- initial multiple policy binding
 
 119
 -- updated binder

diff --git a/src/main/policy.cc b/src/main/policy.cc
index e1ca2dcef2d84a20563a1f4a4a72a371585179fa..1800044ae1066dfb72126e8d868e8d084e7d138f 100644 (file)
--- a/src/main/policy.cc
+++ b/src/main/policy.cc
@@ -97,10 +97,7 @@ IpsPolicy::~IpsPolicy()
 
 PolicyMap::PolicyMap()
 {
-    shells.push_back(new Shell);
-    inspection_policy.push_back(new InspectionPolicy);
-    ips_policy.push_back(new IpsPolicy);
-    network_policy.push_back(new NetworkPolicy);
+    add_shell(new Shell);
 
     set_inspection_policy(inspection_policy[0]);
     set_ips_policy(ips_policy[0]);
@@ -127,3 +124,57 @@ PolicyMap::~PolicyMap()
     network_policy.clear();
 }
 
+unsigned PolicyMap::add_shell(Shell* sh)
+{ 
+    shells.push_back(sh);
+    inspection_policy.push_back(new InspectionPolicy);
+    ips_policy.push_back(new IpsPolicy);
+    network_policy.push_back(new NetworkPolicy);
+    return shells.size() - 1;
+}
+
+//-------------------------------------------------------------------------
+// policy nav
+//-------------------------------------------------------------------------
+
+static THREAD_LOCAL NetworkPolicy* s_traffic_policy = nullptr;
+static THREAD_LOCAL InspectionPolicy* s_inspection_policy = nullptr;
+static THREAD_LOCAL IpsPolicy* s_detection_policy = nullptr;
+
+NetworkPolicy* get_network_policy()
+{ return s_traffic_policy; }
+
+InspectionPolicy* get_inspection_policy()
+{ return s_inspection_policy; }
+
+IpsPolicy* get_ips_policy()
+{ return s_detection_policy; }
+
+void set_network_policy(NetworkPolicy* p)
+{ s_traffic_policy = p; }
+
+void set_inspection_policy(InspectionPolicy* p)
+{ s_inspection_policy = p; }
+
+void set_ips_policy(IpsPolicy* p)
+{ s_detection_policy = p; }
+
+void set_policies(SnortConfig* sc, unsigned i)
+{
+    PolicyMap* pm = sc->policy_map;
+
+    if ( i < pm->shells.size() )
+    {
+        set_network_policy(pm->network_policy[i]);
+        set_inspection_policy(pm->inspection_policy[i]);
+        set_ips_policy(pm->ips_policy[i]);
+    }
+}
+
+void set_default_policy()
+{
+    set_network_policy(snort_conf->policy_map->network_policy[0]);
+    set_ips_policy(snort_conf->policy_map->ips_policy[0]);
+    set_inspection_policy(snort_conf->policy_map->inspection_policy[0]);
+}
+

diff --git a/src/main/policy.h b/src/main/policy.h
index 8ce58d51f56e755c1fea464dd5acad42de371a05..dba484aeb58418466232faa8bd823b3880290dab 100644 (file)
--- a/src/main/policy.h
+++ b/src/main/policy.h
@@ -141,7 +141,7 @@ public:
 };
 
 //-------------------------------------------------------------------------
-// binding stuff - FIXIT-H tbd
+// binding stuff
 //-------------------------------------------------------------------------
 
 class Shell;
@@ -152,20 +152,7 @@ public:
     PolicyMap();
     ~PolicyMap();
 
-    InspectionPolicy* get_inspection_policy()
-    { return inspection_policy[0]; };
-
-    IpsPolicy* get_ips_policy()
-    { return ips_policy[0]; };
-    
-    NetworkPolicy* get_network_policy()
-    { return network_policy[0]; };
-
-    unsigned add_shell(Shell* sh)
-    { 
-        shells.push_back(sh);
-        return shells.size() - 1;
-    };
+    unsigned add_shell(Shell*);
 
     Shell* get_shell(unsigned i = 0)
     { return i < shells.size() ? shells[i] : nullptr; };
@@ -177,5 +164,21 @@ public:  // FIXTHIS-H make impl private
     std::vector<NetworkPolicy*> network_policy;
 };
 
+//-------------------------------------------------------------------------
+// navigator stuff
+//-------------------------------------------------------------------------
+
+// FIXIT-L may be inlined at some point; on lockdown for now
+NetworkPolicy* get_network_policy();
+InspectionPolicy* get_inspection_policy();
+IpsPolicy* get_ips_policy();
+
+void set_network_policy(NetworkPolicy*);
+void set_inspection_policy(InspectionPolicy*);
+void set_ips_policy(IpsPolicy*);
+
+void set_policies(struct SnortConfig*, unsigned = 0);
+void set_default_policy();
+
 #endif
 

diff --git a/src/main/snort.cc b/src/main/snort.cc
index 07b3914975325a70186b67e643263071d972cc80..cabc87c0c42e8c7bce6c779a278ba3a49bc631c3 100644 (file)
--- a/src/main/snort.cc
+++ b/src/main/snort.cc
@@ -131,34 +131,6 @@ static char** snort_argv = NULL;
 static void CleanExit(int);
 static void SnortCleanup();
 
-//-------------------------------------------------------------------------
-// nascent policy management
-//-------------------------------------------------------------------------
-// FIXIT-H need stub binding rule to set these for runtime
-// FIXIT-H need to set these on load too somehow
-
-static THREAD_LOCAL NetworkPolicy* s_traffic_policy = nullptr;
-static THREAD_LOCAL InspectionPolicy* s_inspection_policy = nullptr;
-static THREAD_LOCAL IpsPolicy* s_detection_policy = nullptr;
-
-NetworkPolicy* get_network_policy()
-{ return s_traffic_policy; }
-
-InspectionPolicy* get_inspection_policy()
-{ return s_inspection_policy; }
-
-IpsPolicy* get_ips_policy()
-{ return s_detection_policy; }
-
-void set_network_policy(NetworkPolicy* p)
-{ s_traffic_policy = p; }
-
-void set_inspection_policy(InspectionPolicy* p)
-{ s_inspection_policy = p; }
-
-void set_ips_policy(IpsPolicy* p)
-{ s_detection_policy = p; }
-
 //-------------------------------------------------------------------------
 // utility
 //-------------------------------------------------------------------------
@@ -300,7 +272,7 @@ static void init_policy(SnortConfig* sc)
     else
         pm = POLICY_MODE__PASSIVE;
 
-    sc->get_ips_policy()->policy_mode = pm;
+    get_ips_policy()->policy_mode = pm;
 }
 
 static void SnortInit(int argc, char **argv)
@@ -718,27 +690,10 @@ void CapturePacket()
     }
 }
 
-void set_default_policy()
+static void set_policy(Packet* p)  // FIXIT-H delete this?
 {
-    set_network_policy(snort_conf->policy_map->network_policy[0]);
-    set_ips_policy(snort_conf->policy_map->ips_policy[0]);
-    set_inspection_policy(snort_conf->policy_map->inspection_policy[0]);
-}
-
-static void set_policy(Packet*)  // FIX SSN implement based on bindings
-{
-   // for now need to just get stream_* inspectors and call appropriately 
-#if 0
-    int vlanId = (p->vh) ? vlan::vth_vlan(p->vh) : -1;
-    const sfip_t *srcIp = p->ptrs.ip_api.get_src(); // returns nullptr if not set
-    const sfip_t *dstIp = p->ptrs.ip_api.get_dst();
-
-    //set policy id for this packet
-    setCurrentPolicy(snort_conf, sfGetApplicablePolicyId(
-        snort_conf->policy_config, vlanId, srcIp, dstIp));
-#else
     set_default_policy();
-#endif
+    p->user_policy_id = get_ips_policy()->user_policy_id;
 }
 
 void DecodeRebuiltPacket (
@@ -750,8 +705,7 @@ void DecodeRebuiltPacket (
 
     p->flow = lws;
 
-    set_policy(p);  // FIX SSN rebuilt should reuse original bindings
-    p->user_policy_id = get_ips_policy()->user_policy_id;
+    set_policy(p);  // FIXIT-H rebuilt should reuse original bindings from flow
 
     SnortEventqPop();
 }
@@ -797,9 +751,7 @@ DAQ_Verdict ProcessPacket(
         p->proto_bits &= ~PROTO_BIT__IP;
 #endif
 
-    set_policy(p);
-
-    p->user_policy_id = get_ips_policy()->user_policy_id;
+    set_policy(p);  // FIXIT-H should not need this here
 
     /* just throw away the packet if we are configured to ignore this port */
     if ( !(p->packet_flags & PKT_IGNORE) )

diff --git a/src/main/snort.h b/src/main/snort.h
index 75f96ab4ebcab1036447c16d0c5c6da8acb14384..6a0889bbb58c44c42a486c7eac3c3d52e0d4f7ae 100644 (file)
--- a/src/main/snort.h
+++ b/src/main/snort.h
@@ -57,15 +57,6 @@ void snort_thread_term();
 void snort_idle();
 void snort_rotate();
 
-// FIXIT-L may be inlined at some point; on lockdown for now
-NetworkPolicy* get_network_policy();
-InspectionPolicy* get_inspection_policy();
-IpsPolicy* get_ips_policy();
-
-void set_network_policy(NetworkPolicy*);
-void set_inspection_policy(InspectionPolicy*);
-void set_ips_policy(IpsPolicy*);
-
 void CapturePacket();
 void DecodeRebuiltPacket (Packet*, const DAQ_PktHdr_t*, const uint8_t* pkt, Flow*);
 void DetectRebuiltPacket (Packet*);
@@ -76,8 +67,6 @@ DAQ_Verdict ProcessPacket(Packet*, const DAQ_PktHdr_t*, const uint8_t* pkt);
 DAQ_Verdict fail_open(void*, const DAQ_PktHdr_t*, const uint8_t*);
 DAQ_Verdict packet_callback(void*, const DAQ_PktHdr_t*, const uint8_t*);
 
-void set_default_policy();
-
 typedef void (*MainHook_f)(Packet*);
 void set_main_hook(MainHook_f);
 
@@ -217,62 +206,62 @@ static inline int ScLogQuiet(void)
 
 static inline int ScIpChecksums(void)
 {
-    return snort_conf->get_network_policy()->checksum_eval & CHECKSUM_FLAG__IP;
+    return get_network_policy()->checksum_eval & CHECKSUM_FLAG__IP;
 }
 
 static inline int ScIpChecksumDrops(void)
 {
-    return snort_conf->get_network_policy()->checksum_drop & CHECKSUM_FLAG__IP;
+    return get_network_policy()->checksum_drop & CHECKSUM_FLAG__IP;
 }
 
 static inline int ScUdpChecksums(void)
 {
-    return snort_conf->get_network_policy()->checksum_eval & CHECKSUM_FLAG__UDP;
+    return get_network_policy()->checksum_eval & CHECKSUM_FLAG__UDP;
 }
 
 static inline int ScUdpChecksumDrops(void)
 {
-    return snort_conf->get_network_policy()->checksum_drop & CHECKSUM_FLAG__UDP;
+    return get_network_policy()->checksum_drop & CHECKSUM_FLAG__UDP;
 }
 
 static inline int ScTcpChecksums(void)
 {
-    return snort_conf->get_network_policy()->checksum_eval & CHECKSUM_FLAG__TCP;
+    return get_network_policy()->checksum_eval & CHECKSUM_FLAG__TCP;
 }
 
 static inline int ScTcpChecksumDrops(void)
 {
-    return snort_conf->get_network_policy()->checksum_drop & CHECKSUM_FLAG__TCP;
+    return get_network_policy()->checksum_drop & CHECKSUM_FLAG__TCP;
 }
 
 static inline int ScIcmpChecksums(void)
 {
-    return snort_conf->get_network_policy()->checksum_eval & CHECKSUM_FLAG__ICMP;
+    return get_network_policy()->checksum_eval & CHECKSUM_FLAG__ICMP;
 }
 
 static inline int ScIcmpChecksumDrops(void)
 {
-    return snort_conf->get_network_policy()->checksum_drop & CHECKSUM_FLAG__ICMP;
+    return get_network_policy()->checksum_drop & CHECKSUM_FLAG__ICMP;
 }
 
 static inline uint8_t ScMinTTL(void)
 {
-    return snort_conf->get_network_policy()->min_ttl;
+    return get_network_policy()->min_ttl;
 }
 
 static inline uint8_t ScNewTTL(void)
 {
-    return snort_conf->get_network_policy()->new_ttl;
+    return get_network_policy()->new_ttl;
 }
 
 static inline int ScInlineMode(void)
 {
-    return ((snort_conf->get_ips_policy()->policy_mode) == POLICY_MODE__INLINE );
+    return ((get_ips_policy()->policy_mode) == POLICY_MODE__INLINE );
 }
 
 static inline int ScInlineTestMode(void)
 {
-    return ((snort_conf->get_ips_policy()->policy_mode) == POLICY_MODE__INLINE_TEST );
+    return ((get_ips_policy()->policy_mode) == POLICY_MODE__INLINE_TEST );
 }
 
 //-------------------------------------------------------------------------

diff --git a/src/main/snort_config.h b/src/main/snort_config.h
index 5aeb058b8daa457560fa8eddbda724f77455371e..d293253a9df5caa237f97b9b52481f63509245c6 100644 (file)
--- a/src/main/snort_config.h
+++ b/src/main/snort_config.h
@@ -282,13 +282,13 @@ struct SnortConfig
 #endif
 
     InspectionPolicy* get_inspection_policy()
-    { return policy_map->get_inspection_policy(); };
+    { return policy_map->inspection_policy[0]; };
 
     IpsPolicy* get_ips_policy()
-    { return policy_map->get_ips_policy(); };
+    { return policy_map->ips_policy[0]; };
 
     NetworkPolicy* get_network_policy()
-    { return policy_map->get_network_policy(); };
+    { return policy_map->network_policy[0]; };
 };
 
 SnortConfig* SnortConfNew(void);

diff --git a/src/managers/inspector_manager.cc b/src/managers/inspector_manager.cc
index 808ffb11a5fe033309d363abb707e51b9ebab5d9..9088d8cf05e16d7be0898d7acf44a427b95d6cb5 100644 (file)
--- a/src/managers/inspector_manager.cc
+++ b/src/managers/inspector_manager.cc
@@ -451,10 +451,8 @@ void InspectorManager::thread_term(SnortConfig* sc)
 void InspectorManager::instantiate(
     const InspectApi* api, Module*, SnortConfig* sc)
 {
-    // FIXIT-H only configures inspectors in base policy; must be 
-    // revisited when bindings are implemented
     FrameworkConfig* fc = sc->framework_config;
-    FrameworkPolicy* fp = sc->policy_map->inspection_policy[0]->framework_policy;
+    FrameworkPolicy* fp = get_inspection_policy()->framework_policy;
 
     // FIXIT-H should not need to lookup inspector etc
     // since given api and mod
@@ -502,13 +500,8 @@ static void instantiate_binder(SnortConfig* sc, FrameworkPolicy* fp)
     fp->binder = get_instance(fp, bind_id)->handler;
 }
 
-bool InspectorManager::configure(SnortConfig *sc)
+static bool configure(SnortConfig* sc, FrameworkPolicy* fp)
 {
-    sort(s_handlers.begin(), s_handlers.end(), PHGlobal::comp);
-
-    // FIXIT-H do we need more than one framework policy?
-    // if so, must vectorize(), etc. multiple times
-    FrameworkPolicy* fp = sc->policy_map->inspection_policy[0]->framework_policy;
     bool ok = true;
 
     for ( auto* p : fp->ilist )
@@ -517,12 +510,23 @@ bool InspectorManager::configure(SnortConfig *sc)
     sort(fp->ilist.begin(), fp->ilist.end(), PHInstance::comp);
     fp->vectorize();
 
-    if ( fp->service.num && !fp->binder && get_wizard() )
+    if ( fp->service.num && !fp->binder && InspectorManager::get_wizard() )
         instantiate_binder(sc, fp);
 
     return ok;
 }
 
+bool InspectorManager::configure(SnortConfig *sc)
+{
+    sort(s_handlers.begin(), s_handlers.end(), PHGlobal::comp);
+    bool ok = true;
+
+    for ( auto* p : sc->policy_map->inspection_policy )
+        ok = ::configure(sc, p->framework_policy) && ok;
+
+    return ok;
+}
+
 void InspectorManager::print_config(SnortConfig *sc)
 {
     InspectionPolicy* pi = get_inspection_policy();

diff --git a/src/network_inspectors/binder/bind_module.cc b/src/network_inspectors/binder/bind_module.cc
index 344bbcf7da12a1df7ffa28eb8ceed8c7042343da..66b9537719055c13c7c8629e01cae1f96a97d7f3 100644 (file)
--- a/src/network_inspectors/binder/bind_module.cc
+++ b/src/network_inspectors/binder/bind_module.cc
@@ -214,7 +214,7 @@ void BinderModule::add(unsigned proto, const char* type)
     bindings.push_back(b);
 }
 
-vector<Binding*> BinderModule::get_data()
+vector<Binding*>& BinderModule::get_data()
 {
     return bindings;  // move semantics
 }

diff --git a/src/network_inspectors/binder/bind_module.h b/src/network_inspectors/binder/bind_module.h
index 17f452affed2894e60b8ef379378747931a08be4..9d6c34527ae54fcfd2abd5cf146716761c919a21 100644 (file)
--- a/src/network_inspectors/binder/bind_module.h
+++ b/src/network_inspectors/binder/bind_module.h
@@ -57,7 +57,7 @@ public:
     PegCount* get_counts() const;
     ProfileStats* get_profile() const;
 
-    std::vector<Binding*> get_data();
+    std::vector<Binding*>& get_data();
 private:
     Binding* work;
     std::vector<Binding*> bindings;

diff --git a/src/network_inspectors/binder/binder.cc b/src/network_inspectors/binder/binder.cc
index dfbdf8f8e3cade5cfa208702df88aaabb0cc5846..9e2121c0895d186376656e9c5176391313d1fd37 100644 (file)
--- a/src/network_inspectors/binder/binder.cc
+++ b/src/network_inspectors/binder/binder.cc
@@ -172,7 +172,7 @@ static void set_session(Flow* flow)
 class Binder : public Inspector
 {
 public:
-    Binder(vector<Binding*>);
+    Binder(vector<Binding*>&);
     ~Binder();
 
     void show(SnortConfig*)
@@ -194,9 +194,9 @@ private:
     vector<Binding*> bindings;
 };
 
-Binder::Binder(vector<Binding*> v)
+Binder::Binder(vector<Binding*>& v)
 {
-    bindings = v;
+    bindings = std::move(v);
 }
 
 Binder::~Binder()
@@ -364,7 +364,7 @@ static void mod_dtor(Module* m)
 static Inspector* bind_ctor(Module* m)
 {
     BinderModule* mod = (BinderModule*)m;
-    vector<Binding*> pb = mod->get_data();
+    vector<Binding*>& pb = mod->get_data();
     return new Binder(pb);
 }
 

diff --git a/src/parser/parser.cc b/src/parser/parser.cc
index 3afd8f8a852688e95b4591dc7beb5fc635aee6c0..2f138cf0e0c3086cf10198f4ead4434c6f0aa602 100644 (file)
--- a/src/parser/parser.cc
+++ b/src/parser/parser.cc
@@ -565,6 +565,15 @@ static void IntegrityCheckRules(SnortConfig *sc)
     //DEBUG_WRAP(DebugMessage(DEBUG_DETECT, "OK\n"););
 }
 
+static void parse_file(SnortConfig* sc, Shell* sh)
+{
+    const char* fname = sh->get_file();
+    LogMessage("Loading %s:\n", fname);
+    push_parse_location(fname);
+    sh->configure(sc);
+    pop_parse_location();
+}
+
 //-------------------------------------------------------------------------
 // public methods
 //-------------------------------------------------------------------------
@@ -643,12 +652,10 @@ SnortConfig * ParseSnortConf(const SnortConfig* boot_conf)
         if ( !sh )
             break;
 
-        fname = sh->get_file();
-        LogMessage("Loading %s:\n", fname);
-        push_parse_location(fname);
-        sh->configure(sc);
-        pop_parse_location();
+        set_policies(sc, i);
+        parse_file(sc, sh);
     }
+    set_policies(sc);
     return sc;
 }
 

diff --git a/src/service_inspectors/ftp_telnet/ftp_module.cc b/src/service_inspectors/ftp_telnet/ftp_module.cc
index da009941d8d0b723bb1f581bc8e8d14663eb21a1..9bf26574a4b60300a617bbf40b9caff81671af7a 100644 (file)
--- a/src/service_inspectors/ftp_telnet/ftp_module.cc
+++ b/src/service_inspectors/ftp_telnet/ftp_module.cc
@@ -227,43 +227,6 @@ FtpCmd::FtpCmd(std::string& key, std::string& fmt, int num)
 #define FTP_EVASIVE_TELNET_CMD_STR               \
         "(ftp) Evasive (incomplete) TELNET CMD on FTP Command Channel"
 
-// FIXIT-H convert to Lua and use as module default settings
-#if 0
-static const char* DEFAULT_FTP_CONF[] =
-{
-    "hardcoded_config "
-    "def_max_param_len 100 "
-
-    // eg must appear in at least one *_cmds parameter
-    "ftp_cmds { USER PASS ACCT CWD CDUP SMNT QUIT REIN TYPE STRU"
-              " MODE RETR STOR STOU APPE ALLO REST RNFR RNTO ABOR"
-              " DELE RMD MKD PWD LIST NLST SITE SYST STAT HELP NOOP } "
-    "ftp_cmds { AUTH ADAT PROT PBSZ CONF ENC } "
-    "ftp_cmds { PORT PASV LPRT LPSV EPRT EPSV } "
-    "ftp_cmds { FEAT OPTS } "
-    "ftp_cmds { MDTM REST SIZE MLST MLSD } "
-
-    "alt_max_param_len 0 { CDUP QUIT REIN PASV STOU ABOR PWD SYST NOOP } ",
-
-    "cmd_validity MODE < char SBC > "
-    "cmd_validity STRU < char FRPO [ string ] > "
-    "cmd_validity ALLO < int [ char R int ] > "
-    "cmd_validity TYPE < { char AE [ char NTC ] | char I | char L [ number ] } > "
-    "cmd_validity PORT < host_port > "
-    "cmd_validity LPRT < long_host_port > "
-    "cmd_validity EPRT < extd_host_port > "
-    "cmd_validity EPSV < [ { '1' | '2' | 'ALL' } ] > ",
-
-    "data_chan_cmds { PORT PASV LPRT LPSV EPRT EPSV } "
-    "data_xfer_cmds { RETR STOR STOU APPE LIST NLST } "
-    "file_put_cmds { STOR STOU } "
-    "file_get_cmds { RETR } "
-    "login_cmds { USER PASS } "
-    "dir_cmds { CWD 250 CDUP 250 PWD 257 } "
-    "encr_cmds { AUTH } "
-};
-#endif
-
 //-------------------------------------------------------------------------
 
 static const Parameter ftp_server_validity_params[] =