-- add alternate fast patterns for dce_udp endianness
-- removed underscores from all peg counts
-- document sensitive data use
--- user manual refactoring and updages
+-- user manual refactoring and updates
16/11/21 - build 219
{
const u_char* crlf = (u_char*)SnortStrnStr((const char*)ptr, end - ptr, "\n");
result->uri = ptr;
+
if (crlf)
{
if (crlf[-1] == '\r')
result->uri_end = crlf - 1;
else
result->uri_end = crlf;
- ptr = crlf;
}
else
{
return ( hdr_name == rhs.hdr_name );
}
-static bool find(
+static bool find_hdr(
const string& s, const InspectionBuffer& b, Cursor& c)
{
const char* h = s.c_str();
return DETECTION_OPTION_MATCH;
}
- if ( find(hdr_name, hb, c) )
+ if ( find_hdr(hdr_name, hb, c) )
return DETECTION_OPTION_MATCH;
return DETECTION_OPTION_NO_MATCH;
{
trie_nmatches++;
data = context;
- printf("id=%d found at index=%d, %s\n",id,index,gargv[id]);
+ printf("id=%u found at index=%d, %s\n", id, index, gargv[id]);
return 0;
}
std::string name;
std::string chunk;
- static const char* type;
-
protected:
LuaApi(std::string& s, std::string& c)
{
n != 0;
n = sfxhash_findnext(t) )
{
- printf("hash-findfirst/next: n=%x, key=%s, data=%s\n", n, n->key, n->data);
+ printf("hash-findfirst/next: n=%p, key=%s, data=%s\n", n, n->key, n->data);
/*
remove node we are looking at, this is first/next safe.
bool HashModule::begin(const char*, int, SnortConfig*)
{
+ assert(!hmd);
hmd = new HashMatchData;
return true;
}
return false;
// FIXIT-M only basic modules and inspectors can be reloaded at present
- if ( Snort::is_reloading() && h && h->api && h->api->type != PT_INSPECTOR )
+ if ( Snort::is_reloading() and h->api and h->api->type != PT_INSPECTOR )
return false;
Module* m = h->mod;
bool AppIdInspector::configure(SnortConfig*)
{
+ assert(!active_config);
active_config = new AppIdConfig( ( AppIdModuleConfig* )config);
get_data_bus().subscribe(HTTP_REQUEST_HEADER_EVENT_KEY, new HttpEventHandler(HttpEventHandler::REQUEST_EVENT));
{
sfip_ntop(cliIp, src_ip, sizeof(src_ip));
sfip_ntop(srvIp, dst_ip, sizeof(dst_ip));
- LogMessage("AppIdDbg %s related flow %s for %s-%u -> %s-%u %u\n",
- asd->session_logging_id, asd ? "created" : "creation failed",
- src_ip, (unsigned)cliPort, dst_ip, (unsigned)srvPort, (unsigned)proto);
+ LogMessage("AppIdDbg %s related flow created for %s-%u -> %s-%u %u\n",
+ asd->session_logging_id,
+ src_ip, (unsigned)cliPort, dst_ip, (unsigned)srvPort, (unsigned)proto);
}
asd->in_expected_cache = true;
snort_free(temp_host);
/* if referred_id feature id disabled, referer will be null */
- if (referer && (!payload_found || AppInfoManager::get_instance().get_app_info_flags(data->payload_id, APPINFO_FLAG_REFERRED)))
+ if (referer && (!payload_found ||
+ AppInfoManager::get_instance().get_app_info_flags(data->payload_id, APPINFO_FLAG_REFERRED)))
{
referer_start = referer;
char* referer_offset = (char*)service_strstr((uint8_t*)referer_start, URL_SCHEME_MAX_LEN,
(uint8_t*)URL_SCHEME_END_PATTERN, sizeof(URL_SCHEME_END_PATTERN)-1);
- if (referer_offset)
- {
- referer_offset += sizeof(URL_SCHEME_END_PATTERN)-1;
- }
- else
+
+ if ( !referer_offset )
return 0;
+ referer_offset += sizeof(URL_SCHEME_END_PATTERN)-1;
referer_start = referer_offset;
referer_len = strlen(referer_start);
referer_path = strchr(referer_start, '/');
referer_path_len = 1;
}
- if (referer_start && referer_len > 0)
+ if ( referer_len > 0 )
{
data = nullptr;
patterns[0].pattern = (uint8_t*)referer_start;
bool PortScanModule::begin(const char*, int, SnortConfig*)
{
+ assert(!config);
config = new PortscanConfig;
return true;
}
bool PortScanGlobalModule::begin(const char*, int, SnortConfig*)
{
+ assert(!common);
common = new PsCommon;
common->memcap = 1048576;
return true;
ReputationModule::~ReputationModule()
{
if ( conf )
- {
delete conf;
- }
}
const RuleMap* ReputationModule::get_rules() const
bool ReputationModule::begin(const char*, int, SnortConfig*)
{
+ assert(!conf);
conf = new ReputationConfig;
-
return true;
}
* swap on big endian hardware */
#ifdef WORDS_BIGENDIAN
#define SWAP_BYTES(a) \
+ a = \
((((uint32_t)(a) & 0xFF000000) >> 24) | \
(((uint32_t)(a) & 0x00FF0000) >> 8) | \
(((uint32_t)(a) & 0x0000FF00) << 8) | \
(((uint32_t)(a) & 0x000000FF) << 24))
#else
-#define SWAP_BYTES(a) (a)
+#define SWAP_BYTES(a)
#endif
static unsigned po_rule_hash_func(SFHASHFCN* p, unsigned char* k, int n)
/* Since the input is really an int, put the bytes into a normalized
* order so that the hash function returns consistent results across
* on BE & LE hardware. */
- ikey = SWAP_BYTES(ikey);
+ SWAP_BYTES(ikey);
/* Set a pointer to the key to pass to the hashing function */
key = (unsigned char*)&ikey;
DCE2_SmbVersion DCE2_Smb2Version(const Packet* p)
{
/* Only check reassembled SMB2 packet*/
- if (p->has_paf_payload() &&
- (p->dsize > sizeof(NbssHdr) + sizeof(DCE2_SMB_ID)))
+ if ( p->has_paf_payload() and
+ (p->dsize > sizeof(NbssHdr) + 4) ) // DCE2_SMB_ID is u32
{
Smb2Hdr* smb_hdr = (Smb2Hdr*)(p->data + sizeof(NbssHdr));
uint32_t smb_version_id = SmbId((SmbNtHdr*)smb_hdr);
+
if (smb_version_id == DCE2_SMB_ID)
return DCE2_SMB_VERISON_1;
+
else if (smb_version_id == DCE2_SMB2_ID)
return DCE2_SMB_VERISON_2;
}
#define DCE2_MOVE(data_ptr, data_len, amount) \
{ data_len -= (amount); data_ptr = (uint8_t*)data_ptr + (amount); }
-#endif /* _DCE2_UTILS_H_ */
+#endif
}
// Move just past byte count field which is the end of the command
- DCE2_MOVE(nb_ptr, nb_len, com_info.cmd_size);
+ nb_len -= com_info.cmd_size;
// Validate that there is enough data to be able to process the command
if (nb_len < DCE2_SmbGetMinByteCount(smb_com, (uint8_t)com_info.smb_type))
static THREAD_LOCAL ProfileStats dnp3_obj_perf_stats;
-static int dnp3_decode_object(uint8_t* buf, uint16_t buflen, uint8_t rule_group, uint8_t rule_var)
+static int dnp3_decode_object(
+ uint8_t* buf, uint16_t buflen, uint8_t rule_group, uint8_t rule_var)
{
uint8_t group, var;
/* Decode var */
var = *buf;
- buf++;
- buflen--;
/* Match the rule option here, quit decoding if we found the right header. */
if ((group == rule_group) && (var == rule_var))
}
static uint16_t ParseDNSHeader(
- const unsigned char* data,
- uint16_t bytes_unused,
- DNSData* dnsSessionData)
+ const unsigned char* data, uint16_t bytes_unused, DNSData* dnsSessionData)
{
- if (bytes_unused == 0)
- {
- return bytes_unused;
- }
+ if ( !bytes_unused )
+ return 0;
switch (dnsSessionData->state)
{
dnsSessionData->length = ((uint8_t)*data) << 8;
dnsSessionData->state = DNS_RESP_STATE_LENGTH_PART;
data++;
- bytes_unused--;
- if (bytes_unused == 0)
- {
- return bytes_unused;
- }
- /* Fall through */
+
+ if ( !--bytes_unused )
+ return 0;
+ // Fall through
+
case DNS_RESP_STATE_LENGTH_PART:
dnsSessionData->length |= ((uint8_t)*data);
dnsSessionData->state = DNS_RESP_STATE_HDR_ID;
data++;
- bytes_unused--;
- if (bytes_unused == 0)
- {
- return bytes_unused;
- }
- /* Fall through */
+
+ if ( !--bytes_unused )
+ return 0;
+ // Fall through
+
case DNS_RESP_STATE_HDR_ID:
dnsSessionData->hdr.id = (uint8_t)*data << 8;
- data++;
- bytes_unused--;
dnsSessionData->state = DNS_RESP_STATE_HDR_ID_PART;
- if (bytes_unused == 0)
- {
- return bytes_unused;
- }
- /* Fall through */
+ data++;
+
+ if ( !--bytes_unused )
+ return 0;
+ // Fall through
+
case DNS_RESP_STATE_HDR_ID_PART:
dnsSessionData->hdr.id |= (uint8_t)*data;
- data++;
- bytes_unused--;
dnsSessionData->state = DNS_RESP_STATE_HDR_FLAGS;
- if (bytes_unused == 0)
- {
- return bytes_unused;
- }
- /* Fall through */
+ data++;
+
+ if ( !--bytes_unused )
+ return 0;
+ // Fall through
+
case DNS_RESP_STATE_HDR_FLAGS:
dnsSessionData->hdr.flags = (uint8_t)*data << 8;
- data++;
- bytes_unused--;
dnsSessionData->state = DNS_RESP_STATE_HDR_FLAGS_PART;
- if (bytes_unused == 0)
- {
- return bytes_unused;
- }
- /* Fall through */
+ data++;
+
+ if ( !--bytes_unused )
+ return 0;
+ // Fall through
+
case DNS_RESP_STATE_HDR_FLAGS_PART:
dnsSessionData->hdr.flags |= (uint8_t)*data;
- data++;
- bytes_unused--;
dnsSessionData->state = DNS_RESP_STATE_HDR_QS;
- if (bytes_unused == 0)
- {
- return bytes_unused;
- }
- /* Fall through */
+ data++;
+
+ if ( !--bytes_unused )
+ return 0;
+ // Fall through
+
case DNS_RESP_STATE_HDR_QS:
dnsSessionData->hdr.questions = (uint8_t)*data << 8;
- data++;
- bytes_unused--;
dnsSessionData->state = DNS_RESP_STATE_HDR_QS_PART;
- if (bytes_unused == 0)
- {
- return bytes_unused;
- }
- /* Fall through */
+ data++;
+
+ if ( !--bytes_unused )
+ return 0;
+ // Fall through
+
case DNS_RESP_STATE_HDR_QS_PART:
dnsSessionData->hdr.questions |= (uint8_t)*data;
- data++;
- bytes_unused--;
dnsSessionData->state = DNS_RESP_STATE_HDR_ANSS;
- if (bytes_unused == 0)
- {
- return bytes_unused;
- }
- /* Fall through */
+ data++;
+
+ if ( !--bytes_unused )
+ return 0;
+ // Fall through
+
case DNS_RESP_STATE_HDR_ANSS:
dnsSessionData->hdr.answers = (uint8_t)*data << 8;
- data++;
- bytes_unused--;
dnsSessionData->state = DNS_RESP_STATE_HDR_ANSS_PART;
- if (bytes_unused == 0)
- {
- return bytes_unused;
- }
- /* Fall through */
+ data++;
+
+ if ( !--bytes_unused )
+ return 0;
+ // Fall through
+
case DNS_RESP_STATE_HDR_ANSS_PART:
dnsSessionData->hdr.answers |= (uint8_t)*data;
- data++;
- bytes_unused--;
dnsSessionData->state = DNS_RESP_STATE_HDR_AUTHS;
- if (bytes_unused == 0)
- {
- return bytes_unused;
- }
- /* Fall through */
+ data++;
+
+ if ( !--bytes_unused )
+ return 0;
+ // Fall through
+
case DNS_RESP_STATE_HDR_AUTHS:
dnsSessionData->hdr.authorities = (uint8_t)*data << 8;
- data++;
- bytes_unused--;
dnsSessionData->state = DNS_RESP_STATE_HDR_AUTHS_PART;
- if (bytes_unused == 0)
- {
- return bytes_unused;
- }
- /* Fall through */
+ data++;
+
+ if ( !--bytes_unused )
+ return 0;
+ // Fall through
+
case DNS_RESP_STATE_HDR_AUTHS_PART:
dnsSessionData->hdr.authorities |= (uint8_t)*data;
- data++;
- bytes_unused--;
dnsSessionData->state = DNS_RESP_STATE_HDR_ADDS;
- if (bytes_unused == 0)
- {
- return bytes_unused;
- }
- /* Fall through */
+ data++;
+
+ if ( !--bytes_unused )
+ return 0;
+ // Fall through
+
case DNS_RESP_STATE_HDR_ADDS:
dnsSessionData->hdr.additionals = (uint8_t)*data << 8;
- data++;
- bytes_unused--;
dnsSessionData->state = DNS_RESP_STATE_HDR_ADDS_PART;
- if (bytes_unused == 0)
- {
- return bytes_unused;
- }
- /* Fall through */
+ data++;
+
+ if ( !--bytes_unused )
+ return 0;
+ // Fall through
+
case DNS_RESP_STATE_HDR_ADDS_PART:
dnsSessionData->hdr.additionals |= (uint8_t)*data;
- data++;
- bytes_unused--;
dnsSessionData->state = DNS_RESP_STATE_QUESTION;
- if (bytes_unused == 0)
- {
- return bytes_unused;
- }
- /* Fall through */
- default:
- /* Continue -- we're beyond the header */
+ bytes_unused--;
break;
}
}
static uint16_t ParseDNSName(
- const unsigned char* data,
- uint16_t bytes_unused,
- DNSData* dnsSessionData)
+ const unsigned char* data, uint16_t bytes_unused, DNSData* dnsSessionData)
{
uint16_t bytes_required = dnsSessionData->curr_txt.txt_len -
dnsSessionData->curr_txt.txt_bytes_seen;
}
static uint16_t ParseDNSQuestion(
- const unsigned char* data,
- uint16_t bytes_unused,
- DNSData* dnsSessionData)
+ const unsigned char* data, uint16_t bytes_unused, DNSData* dnsSessionData)
{
uint16_t bytes_used = 0;
uint16_t new_bytes_unused = 0;
- if (bytes_unused == 0)
- {
- return bytes_unused;
- }
+ if ( !bytes_unused )
+ return 0;
if (dnsSessionData->curr_rec_state < DNS_RESP_STATE_Q_NAME_COMPLETE)
{
data = data + bytes_used;
bytes_unused = new_bytes_unused;
- if (bytes_unused == 0)
- {
- /* ran out of data */
- return bytes_unused;
- }
+ if ( !bytes_unused )
+ return 0; /* ran out of data */
}
else
{
{
case DNS_RESP_STATE_Q_TYPE:
dnsSessionData->curr_q.type = (uint8_t)*data << 8;
- data++;
- bytes_unused--;
dnsSessionData->curr_rec_state = DNS_RESP_STATE_Q_TYPE_PART;
- if (bytes_unused == 0)
- {
- return bytes_unused;
- }
- /* Fall through */
+ data++;
+
+ if ( !--bytes_unused )
+ return 0;
+ // Fall through
+
case DNS_RESP_STATE_Q_TYPE_PART:
dnsSessionData->curr_q.type |= (uint8_t)*data;
- data++;
- bytes_unused--;
dnsSessionData->curr_rec_state = DNS_RESP_STATE_Q_CLASS;
- if (bytes_unused == 0)
- {
- return bytes_unused;
- }
- /* Fall through */
+ data++;
+
+ if ( !--bytes_unused )
+ return 0;
+ // Fall through
+
case DNS_RESP_STATE_Q_CLASS:
dnsSessionData->curr_q.dns_class = (uint8_t)*data << 8;
- data++;
- bytes_unused--;
dnsSessionData->curr_rec_state = DNS_RESP_STATE_Q_CLASS_PART;
- if (bytes_unused == 0)
- {
- return bytes_unused;
- }
- /* Fall through */
+ data++;
+
+ if ( !--bytes_unused )
+ return 0;
+ // Fall through
+
case DNS_RESP_STATE_Q_CLASS_PART:
dnsSessionData->curr_q.dns_class |= (uint8_t)*data;
- data++;
- bytes_unused--;
dnsSessionData->curr_rec_state = DNS_RESP_STATE_Q_COMPLETE;
- if (bytes_unused == 0)
- {
- return bytes_unused;
- }
- /* Fall through */
- default:
- /* Continue -- we're beyond this question */
+ bytes_unused--;
break;
}
}
static uint16_t ParseDNSAnswer(
- const unsigned char* data,
- uint16_t bytes_unused,
- DNSData* dnsSessionData)
+ const unsigned char* data, uint16_t bytes_unused, DNSData* dnsSessionData)
{
uint16_t bytes_used = 0;
uint16_t new_bytes_unused = 0;
- if (bytes_unused == 0)
- {
- return bytes_unused;
- }
+ if ( !bytes_unused )
+ return 0;
if (dnsSessionData->curr_rec_state < DNS_RESP_STATE_RR_NAME_COMPLETE)
{
}
bytes_unused = new_bytes_unused;
- if (bytes_unused == 0)
- {
- /* ran out of data */
- return bytes_unused;
- }
+ if ( !bytes_unused )
+ return 0; /* ran out of data */
}
switch (dnsSessionData->curr_rec_state)
{
case DNS_RESP_STATE_RR_TYPE:
dnsSessionData->curr_rr.type = (uint8_t)*data << 8;
- data++;
- bytes_unused--;
dnsSessionData->curr_rec_state = DNS_RESP_STATE_RR_TYPE_PART;
- if (bytes_unused == 0)
- {
- return bytes_unused;
- }
- /* Fall through */
+ data++;
+
+ if ( !--bytes_unused )
+ return 0;
+ // Fall through
+
case DNS_RESP_STATE_RR_TYPE_PART:
dnsSessionData->curr_rr.type |= (uint8_t)*data;
- data++;
- bytes_unused--;
dnsSessionData->curr_rec_state = DNS_RESP_STATE_RR_CLASS;
- if (bytes_unused == 0)
- {
- return bytes_unused;
- }
- /* Fall through */
+ data++;
+
+ if ( !--bytes_unused )
+ return 0;
+ // Fall through
+
case DNS_RESP_STATE_RR_CLASS:
dnsSessionData->curr_rr.dns_class = (uint8_t)*data << 8;
- data++;
- bytes_unused--;
dnsSessionData->curr_rec_state = DNS_RESP_STATE_RR_CLASS_PART;
- if (bytes_unused == 0)
- {
- return bytes_unused;
- }
- /* Fall through */
+ data++;
+
+ if ( !--bytes_unused )
+ return 0;
+ // Fall through
+
case DNS_RESP_STATE_RR_CLASS_PART:
dnsSessionData->curr_rr.dns_class |= (uint8_t)*data;
- data++;
- bytes_unused--;
dnsSessionData->curr_rec_state = DNS_RESP_STATE_RR_TTL;
- if (bytes_unused == 0)
- {
- return bytes_unused;
- }
- /* Fall through */
+ data++;
+
+ if ( !--bytes_unused )
+ return 0;
+ // Fall through
+
case DNS_RESP_STATE_RR_TTL:
dnsSessionData->curr_rr.ttl = (uint8_t)*data << 24;
- data++;
- bytes_unused--;
dnsSessionData->curr_rec_state = DNS_RESP_STATE_RR_TTL_PART;
dnsSessionData->bytes_seen_curr_rec = 1;
- if (bytes_unused == 0)
- {
- return bytes_unused;
- }
- /* Fall through */
+ data++;
+
+ if ( !--bytes_unused )
+ return 0;
+ // Fall through
+
case DNS_RESP_STATE_RR_TTL_PART:
while (dnsSessionData->bytes_seen_curr_rec < 4)
{
dnsSessionData->curr_rr.ttl |=
(uint8_t)*data << (4-dnsSessionData->bytes_seen_curr_rec)*8;
data++;
- bytes_unused--;
- if (bytes_unused == 0)
- {
- return bytes_unused;
- }
+
+ if ( !--bytes_unused )
+ return 0;
}
dnsSessionData->curr_rec_state = DNS_RESP_STATE_RR_RDLENGTH;
- /* Fall through */
+ // Fall through
+
case DNS_RESP_STATE_RR_RDLENGTH:
dnsSessionData->curr_rr.length = (uint8_t)*data << 8;
- data++;
- bytes_unused--;
dnsSessionData->curr_rec_state = DNS_RESP_STATE_RR_RDLENGTH_PART;
- if (bytes_unused == 0)
- {
- return bytes_unused;
- }
- /* Fall through */
+ data++;
+
+ if ( !--bytes_unused )
+ return 0;
+ // Fall through
+
case DNS_RESP_STATE_RR_RDLENGTH_PART:
dnsSessionData->curr_rr.length |= (uint8_t)*data;
- data++;
- bytes_unused--;
dnsSessionData->curr_rec_state = DNS_RESP_STATE_RR_RDATA_START;
- if (bytes_unused == 0)
- {
- return bytes_unused;
- }
- /* Fall through */
- default:
- /* Continue -- we're beyond this answer */
+ bytes_unused--;
break;
}
bool TelnetModule::begin(const char*, int, SnortConfig*)
{
+ assert(!conf);
conf = new TELNET_PROTO_CONF;
return true;
}
bool ImapModule::begin(const char*, int, SnortConfig*)
{
+ assert(!config);
config = new IMAP_PROTO_CONF;
-
return true;
}
bool PopModule::begin(const char*, int, SnortConfig*)
{
+ assert(!config);
config = new POP_PROTO_CONF;
-
return true;
}
uint16_t maxViaLen; // Maximum Via field size
uint16_t maxContactLen; // Maximum Contact field size
uint16_t maxContentLen; // Maximum Content length
- uint8_t ignoreChannel; // Whether to ignore media channels found by SIP PP
+ bool ignoreChannel; // Whether to ignore media channels found by SIP PP
};
// API to parse method list
bool SipModule::set(const char*, Value& v, SnortConfig*)
{
if ( v.is("ignore_call_channel") )
- conf->ignoreChannel = 1;
+ conf->ignoreChannel = v.get_bool();
else if ( v.is("max_call_id_len") )
conf->maxCallIdLen = v.get_long();
bool SipModule::begin(const char*, int, SnortConfig*)
{
+ assert(!conf);
conf = new SIP_PROTO_CONF;
- conf->ignoreChannel = 0;
- conf->maxNumSessions = 10000;
- conf->maxNumDialogsInSession = 4;
- conf->maxUriLen = 256;
- conf->maxCallIdLen = 256;
- conf->maxRequestNameLen = 20;
- conf->maxFromLen = 256;
- conf->maxToLen = 256;
-
- conf->maxViaLen = 1024;
- conf->maxContactLen = 256;
- conf->maxContentLen = 1024;
conf->methodsConfig = SIP_METHOD_NULL;
conf->methods = NULL;
sip_methods = default_methods;
+
return true;
}
static void PrintSshConf(SSH_PROTO_CONF* config)
{
- if (config == NULL)
+ if ( !config )
return;
LogMessage("SSH config: \n");
- LogMessage(" Max Encrypted Packets: %d %s \n",
- config->MaxEncryptedPackets,
- config->MaxEncryptedPackets
- == SSH_DEFAULT_MAX_ENC_PKTS ?
- "(Default)" : "");
- LogMessage(" Max Server Version String Length: %d %s \n",
- config->MaxServerVersionLen,
- config->MaxServerVersionLen
- == SSH_DEFAULT_MAX_SERVER_VERSION_LEN ?
- "(Default)" : "");
-
- LogMessage(" MaxClientBytes: %d %s \n",
- config->MaxClientBytes,
- config->MaxClientBytes
- == SSH_DEFAULT_MAX_CLIENT_BYTES ?
- "(Default)" : "");
+
+ LogMessage(" Max Encrypted Packets: %d\n", config->MaxEncryptedPackets);
+ LogMessage(" Max Server Version String Length: %d\n", config->MaxServerVersionLen);
+ LogMessage(" MaxClientBytes: %d\n", config->MaxClientBytes);
LogMessage("\n");
}
uint16_t MaxServerVersionLen;
};
-#define SSH_DEFAULT_MAX_ENC_PKTS 25
-#define SSH_DEFAULT_MAX_CLIENT_BYTES 19600
-#define SSH_DEFAULT_MAX_SERVER_VERSION_LEN 80
-
#endif
bool SshModule::begin(const char*, int, SnortConfig*)
{
+ assert(!conf);
conf = new SSH_PROTO_CONF;
- conf->MaxClientBytes = SSH_DEFAULT_MAX_CLIENT_BYTES;
- conf->MaxEncryptedPackets = SSH_DEFAULT_MAX_ENC_PKTS;
- conf->MaxServerVersionLen = SSH_DEFAULT_MAX_SERVER_VERSION_LEN;
- return true;
-}
-
-bool SshModule::end(const char*, int, SnortConfig*)
-{
return true;
}
bool set(const char*, Value&, SnortConfig*) override;
bool begin(const char*, int, SnortConfig*) override;
- bool end(const char*, int, SnortConfig*) override;
unsigned get_gid() const override
{ return GID_SSH; }
bool SslModule::set(const char*, Value& v, SnortConfig*)
{
if ( v.is("trust_servers") )
- {
- if (v.get_bool())
- conf->trustservers = true;
- }
+ conf->trustservers = v.get_bool();
+
else if ( v.is("max_heartbeat_length") )
conf->max_heartbeat_len = v.get_long();
bool SslModule::begin(const char*, int, SnortConfig*)
{
+ assert(!conf);
conf = new SSL_PROTO_CONF;
- conf->max_heartbeat_len = 0;
- conf->trustservers = false;
return true;
}
projects / thirdparty / snort3.git / commitdiff
