-- remove share.h
-- misc FIXITs
-- refactored cmd line parsing and moved options to SnortModule
+-- prioritized all FIXITs; FIXIT-J are for josh to reprioritize
114
-- more FIXIT cleanup
static const char* s_name = "urg";
-// FIXIT profiling is desirable but must be refactored to
+// FIXIT-H profiling is desirable but must be refactored to
// avoid dependence on snort_config.h which snowballs
//#undef PERF_PROFILING
//-------------------------------------------------------------------------
// range check
//-------------------------------------------------------------------------
-// FIXIT this is a stub until we can use range.{h,cc}
+// FIXIT-L this is a stub until we can use range.{h,cc}
struct RangeCheck
{
static void KTrieFree(KTRIENODE *n);
-static unsigned int mtot = 0; // FIXIT 1 / process
+static unsigned int mtot = 0;
unsigned int KTrieMemUsed(void)
{
static const char* s_name = "rewrite";
-// FIXIT ips_replace.cc should part of this lib
-// FIXIT enforce that a rule with a replace option has a replace action
+// FIXIT-L ips_replace.cc should part of this lib
+// FIXIT-L enforce that a rule with a replace option has a replace action
// (and vice-versa)
//--------------------------------------------------------------------------
// queue foo
#include <string>
-// FIXIT these prevent ips replace option and action
+// FIXIT-M these prevent ips replace option and action
// from being dynamically built
void Replace_ResetQueue(void);
void Replace_QueueChange(const std::string&, unsigned);
/* Call OptTreeNode specific output functions */
if(otn->outputFuncs)
{
- ListHead lh; // FIXIT "kinda hackish"
+ ListHead lh; // FIXIT-L "kinda hackish"
lh.LogList = otn->outputFuncs;
CallLogFuncs(p, otn, &lh);
}
bool Icmp4Codec::encode(EncState* enc, Buffer* out, const uint8_t* /*raw_in*/)
{
- // FIXIT: speak with Russ, then get rid of commented lines
+ // FIXIT-J: speak with Russ, then get rid of commented lines
// uint8_t* p;
IcmpHdr* ho;
{ "enable_gtp", Parameter::PT_BOOL, nullptr, "false",
"decode GTP encapsulations" },
- // FIXIT use PT_BIT_LIST
+ // FIXIT-L use PT_BIT_LIST
{ "gtp_ports", Parameter::PT_STRING, nullptr,
"'2152 3386'", "set GTP ports" },
{
if ( v.is("deep_teredo_inspection") )
{
- sc->enable_teredo = v.get_long(); // FIXIT move to existing bitfield
+ sc->enable_teredo = v.get_long(); // FIXIT-L move to existing bitfield
}
else if ( v.is("gtp_ports") )
{
else if ( v.is("enable_gtp") )
{
if ( v.get_bool() )
- sc->enable_gtp = 1; // FIXIT move to existing bitfield
+ sc->enable_gtp = 1; // FIXIT-L move to existing bitfield
}
else
{
if ( v.is("enable_mpls_multicast") )
{
if ( v.get_bool() )
- sc->run_flags |= RUN_FLAG__MPLS_MULTICAST; // FIXIT move to existing bitfield
+ sc->run_flags |= RUN_FLAG__MPLS_MULTICAST; // FIXIT-L move to existing bitfield
}
else if ( v.is("enable_mpls_overlapping_ip") )
{
if ( v.get_bool() )
- sc->run_flags |= RUN_FLAG__MPLS_OVERLAPPING_IP; // FIXIT move to existing bitfield
+ sc->run_flags |= RUN_FLAG__MPLS_OVERLAPPING_IP; // FIXIT-L move to existing bitfield
}
else if ( v.is("max_mpls_stack_depth") )
{
pc.total_alert_pkts++;
#if 0
- // FIXIT this should be a generic feature of otn
+ // FIXIT-M this should be a generic feature of otn
if ( otn->sigInfo.generator != GENERATOR_SPP_REPUTATION )
{
/* Don't include IP Reputation events in count */
return 0;
}
- // FIXIT: Curently, if a rule is found on any IP layer, we
+ // FIXIT-M: Curently, if a rule is found on any IP layer, we
// perform the detect routine on the entire packet.
// Instead, we should only perform detect on that
// layer!!
if (node->option_type == RULE_OPTION_TYPE_LEAF_NODE)
{
/* Update stats for this otn */
- // FIXIT should be sum of instances (only called from main thread)
+ // FIXIT-H should be sum of instances (only called from main thread)
OptTreeNode *otn = (OptTreeNode *)node->option_data;
OtnState* state = otn->state + get_instance_id();
state->ticks += local_stats.ticks;
ClearHttpBuffers();
}
-int IsGzipData(Flow*); // FIXIT these from HI
+int IsGzipData(Flow*); // FIXIT-M these from HI
int IsJSNormData(Flow*);
#endif
return -1;
// skip builtin rules
- if ( !otn->sigInfo.text_rule ) // FIXIT must be set for so rules too!
+ if ( !otn->sigInfo.text_rule ) // FIXIT-H must be set for so rules too!
return -1;
/* Rule not enabled */
** 1 if flagged
**
*/
-// FIXIT this should include frags now that they are in session
+// FIXIT-H this should include frags now that they are in session
static inline int fpAddSessionAlert(Packet *p, OptTreeNode *otn)
{
if ( !p->flow )
** 1 if alert previously generated
**
*/
-// FIXIT this should include frags now that they are in session
+// FIXIT-H this should include frags now that they are in session
static inline int fpSessionAlerted(Packet *p, OptTreeNode *otn)
{
SigInfo *si = &otn->sigInfo;
if (ip_rule)
{
- // FIXIT -- Copying p->ip_data may be unnecessary because when
+ // FIXIT-J -- Copying p->ip_data may be unnecessary because when
// finished evaluating, ip_api will be the innermost
// layer. Right now, ip_api should already be the
// innermost layer
** re-inject the stream we have.
*/
- // FIXIT sdf etc. runs here
+ // FIXIT-M sdf etc. runs here
if ( fp->inspect_stream_insert || !(p->packet_flags & PKT_STREAM_INSERT) )
{
** payload, in case any of the rules have the
** 'rawbytes' option.
*/
- // FIXIT alt buf and file data should be obtained from
+ // FIXIT-H alt buf and file data should be obtained from
// inspector gadget as an extension of above
so = port_group->pgPms[PM_TYPE__CONTENT];
#ifndef GENERATORS_H
#define GENERATORS_H
-// FIXIT migrate all defines to respective modules and delete this file
+// FIXIT-M migrate all defines to respective modules and delete this file
#define GENERATOR_SNORT_ENGINE 1
/* struct for rule classification */
typedef struct _ClassType
{
- // FIXIT type and name are backwards (name -> text, type -> name)
+ // FIXIT-L type and name are backwards (name -> text, type -> name)
char *type; /* classification type */
int id; /* classification id */
char *name; /* "pretty" classification name */
/* G L O B A L S **************************************************/
static THREAD_LOCAL SFXHASH *host_tag_cache_ptr = nullptr;
-// FIXIT utilize Flow instead of separate cache
+// FIXIT-M utilize Flow instead of separate cache
static THREAD_LOCAL SFXHASH *ssn_tag_cache_ptr = nullptr;
static THREAD_LOCAL uint32_t last_prune_time = 0;
#include "snort.h"
-THREAD_LOCAL uint16_t event_id; // FIXIT also incremented in fpLogEvent()
-THREAD_LOCAL SigInfo sig_info; // FIXIT move to stack
+THREAD_LOCAL uint16_t event_id; // FIXIT-M also incremented in fpLogEvent()
+THREAD_LOCAL SigInfo sig_info; // FIXIT-M move to stack
void SetEvent(
Event *event, uint32_t generator, uint32_t id, uint32_t rev,
fpLogEvent(rtn, otn, p);
- return 0; //otn->event_data.event_id; // FIXIT EVENT
+ return 0; //otn->event_data.event_id; // FIXIT-H EVENT
}
/**
mime_hdr_search_mpse = search_api->search_instance_new();
if (mime_hdr_search_mpse == NULL)
{
- // FIXIT make configurable or at least fall back to any
+ // FIXIT-M make configurable or at least fall back to any
// available search engine
FatalError("Could not instantiate ac_bnfa search engine.\n");
}
#ifdef HAVE_OPENSSL_SHA
#include <openssl/sha.h>
#define SHA256CONTEXT SHA256_CTX
-#define SHA256INIT SHA256_Init // FIXIT these are deprecated
+#define SHA256INIT SHA256_Init // FIXIT-M these are deprecated
#define SHA256UPDATE SHA256_Update
#define SHA256FINAL SHA256_Final
#else
detection_filter_hash = sfthd_local_new(df_config->memcap);
if ( detection_filter_hash == NULL )
- return; // FIXIT this is fatal
+ return; // FIXIT-H this is fatal
}
}
void RateFilter_PrintConfig(RateFilterConfig*)
{
- // FIXIT print from module
+ // FIXIT-L print from module
//_printThresholdContext(config);
}
sfthd_node.seconds = seconds;
sfthd_node.ip_address= ip_address;
- // FIXIT convert to std::vector
+ // FIXIT-L convert to std::vector
sfDynArrayCheckBounds ((void **)&thd_objs->sfthd_garray, policyId, &thd_objs->numPoliciesAllocated);
if (thd_objs->sfthd_garray[policyId] == NULL)
{
#include <assert.h>
#include "time/packet_time.h"
-#include "stream/stream_api.h" // FIXIT bad dependency
+#include "stream/stream_api.h" // FIXIT-M bad dependency
#include "zhash.h"
/* Reasonably small, and prime */
-// FIXIT size based on max_tcp + max_udp?
+// FIXIT-L size based on max_tcp + max_udp?
#define MAX_HASH 1021
#define MAX_LIST 8
#define MAX_DATA 4
// -- matching expected sessions are pulled off from the head of the node's
// list struct chain
//
-// FIXIT
-// -- expiration is by node struct but should be by list struct, ie
+// FIXIT-M expiration is by node struct but should be by list struct, ie
// individual sessions, not all sessions to a given 3-tuple
// (this would make pruning a little harder unless we add linkage
// a la FlowCache)
unsigned FlowData:: flow_id = 0;
-// FIXIT can't inline SO_PUBLIC ctor and dtor in header or we get problems:
+// FIXIT-H can't inline SO_PUBLIC ctor and dtor in header or we get problems:
// ld: warning: direct access in FlowData::FlowData(unsigned int,
// Inspector*) to global weak symbol vtable for FlowData means the weak
// symbol cannot be overridden at runtime. This was likely caused by
memset(this, 0, sizeof(*this));
protocol = proto;
- // FIXIT getFlowbitSizeInBytes() should be attribute of ???
+ // FIXIT-M getFlowbitSizeInBytes() should be attribute of ??? (or eliminate)
/* use giFlowbitSize - 1, since there is already 1 byte in the
* StreamFlowData structure */
size_t sz = sizeof(StreamFlowData) + getFlowbitSizeInBytes() - 1;
session->cleanup();
free_application_data();
}
- // FIXIT cleanup() winds up calling clear()
+ // FIXIT-H cleanup() winds up calling clear()
if ( ssn_client )
{
ssn_client->rem_ref();
*/
if (outer_ip_api.is_valid())
{
- // FIXIT!! -- Do we want more than just the outermost
+ // FIXIT-J!! -- Do we want more than just the outermost
// and innermost ttl()?
outer_ttl = outer_ip_api.ttl();
inner_ttl = p->ip_api.ttl();
gadget = nullptr;
};
-public: // FIXIT privatize if possible
+public: // FIXIT-M privatize if possible
// these fields are const after initialization
const FlowKey* key;
class Session* session;
const char* service;
int flow_state;
- FlowState s5_state; // FIXIT rename this (s5 not appropriate)
+ FlowState s5_state; // FIXIT-L rename this (s5 not appropriate)
- sfip_t client_ip; // FIXIT family and bits should be changed to uint16_t
+ sfip_t client_ip; // FIXIT-L family and bits should be changed to uint16_t
sfip_t server_ip; // or uint8_t to reduce sizeof from 24 to 20
uint64_t expire_time;
#include "zhash.h"
#define SESSION_CACHE_FLAG_PURGING 0x01
-#define SESSION_CACHE_FLAG_PRUNING 0x02 // FIXIT not used?
//-------------------------------------------------------------------------
// FlowCache stuff
while ( flow )
{
- // FIXIT this loops forever if 1 flow in cache
+ // FIXIT-L this loops forever if 1 flow in cache
if(flow == save_me)
hash_table->touch();
uint32_t FlowCache::prune_unis()
{
// we may have many or few unis; need to find reasonable ratio
- // FIXIT max_uni should be based on typical ratios seen in perfmon
+ // FIXIT-L max_uni should be based on typical ratios seen in perfmon
const uint32_t max_uni = (max_flows >> 2) + 1;
Flow* curr = uni_tail->prev;
while (
(hash_table->get_count() > 1) &&
((!memCheck && ((hash_table->get_count() > max_cap) || !pruned)) ||
- (memCheck && tcp_memcap->at_max()) )) // FIXIT remove explicit dependence on tcp_memcap
+ (memCheck && tcp_memcap->at_max()) )) // FIXIT-M remove explicit dependence on tcp_memcap
{
unsigned int blocks = 0;
Flow* flow = (Flow*)hash_table->first();
return cache->get(key);
}
-// FIXIT cache* can be put in flow so that lookups by
+// FIXIT-L cache* can be put in flow so that lookups by
// protocol are obviated for existing / initialized flows
void FlowControl::delete_flow (const FlowKey* key)
{
Session(Flow* f) { flow = f; };
public:
- Flow* flow; // FIXIT use reference?
+ Flow* flow; // FIXIT-L use reference?
};
#endif
enum Type
{
IBT_KEY, IBT_HEADER, IBT_BODY,
- IBT_ALT, IBT_FILE, // FIXIT alt and file data are tbd
+ IBT_ALT, IBT_FILE, // FIXIT-M alt and file data are tbd
IBT_MAX
};
const uint8_t* data;
typedef void (*InspectFunc)();
typedef class Session* (*InspectSsnFunc)(class Flow*);
-// FIXIT ensure all provide stats
struct InspectApi
{
BaseApi base;
option_type_t type;
};
-enum RuleOptType // FIXIT is this still useful?
+enum RuleOptType
{
- OPT_TYPE_ACTION = 0,
OPT_TYPE_LOGGING,
OPT_TYPE_DETECTION,
OPT_TYPE_META,
{
BaseApi base;
RuleOptType type;
- unsigned max_per_rule; // FIXIT this must be enforced
- unsigned protos;
+
+ unsigned max_per_rule; // FIXIT-H this must be enforced
+ unsigned protos; // FIXIT-H enforce or delete
IpsOptFunc pinit;
IpsOptFunc pterm;
typedef Logger* (*LogNewFunc)(struct SnortConfig*, class Module*);
typedef void (*LogDelFunc)(Logger*);
-// FIXIT ensure all eh provide stats
struct LogApi
{
BaseApi base;
*/
// module.h author Russ Combs <rucombs@cisco.com>
-// FIXIT
-// -- add lua module default
-// -- add set_default method
-// -- add trace param(s)
-// -- add memcap related
+// FIXIT-H add brief help string to modules
+// FIXIT-H add optional default config to modules
+// FIXIT-M add trace param(s)
+// FIXIT-M add memcap related
+// FIXIT-L add set_default method
#ifndef MODULE_H
#define MODULE_H
struct ProfileStats;
-// FIXIT add brief help string to modules
class Module
{
public:
return v.get_type() == Value::VT_BOOL;
}
-// FIXIT allow multiple , separated ranges
+// FIXIT-L allow multiple , separated ranges
static bool valid_int(Value& v, const char* r)
{
if ( !r )
return true;
}
-// FIXIT allow multiple , separated ranges
+// FIXIT-L allow multiple , separated ranges
static bool valid_real(Value& v, const char* r)
{
if ( !r )
PT_REAL, // double
PT_PORT, // 0 to 64K-1 unless specified otherwise
PT_STRING, // any string less than len chars
+ // range = "(optional)" if not required (eg on cmd line)
PT_SELECT, // any string appearing in range
PT_MULTI, // one or more strings appearing in range
PT_ENUM, // string converted to unsigned by range sequence
const char* name;
Type type;
const void* range; // nullptr|const char*|const Parameter*
- const char* deflt; // FIXIT add defaults for tables and lists
+ const char* deflt;
const char* help;
const char* get_type() const;
#include "framework/base_api.h"
-// FIXIT this must be tied to SnortConfig and moved to trash
-
struct SnortConfig;
// this is the current version of the api
sfhashfcn = sfhashfcn_new(rows);
if ( !sfhashfcn )
- return; // FIXIT can't just return
+ return; // FIXIT-H can't just return
/* Allocate the array of node ptrs */
table = new ZHashNode*[rows];
// If check needed, also check whether previous signal_handler is neither
// SIG_IGN nor SIG_DFL
-// FIXIT convert sigaction, etc. to c++11
+// FIXIT-L convert sigaction, etc. to c++11
static int add_signal(int sig, sighandler_t signal_handler, int check_needed)
{
#ifdef VALGRIND_TESTING
sigset_t set;
sigemptyset(&set);
- // FIXIT this is undefined for multithreaded apps
+ // FIXIT-L this is undefined for multithreaded apps
sigprocmask(SIG_SETMASK, &set, NULL);
# else
sigsetmask(0);
ClearVarNames(otn->opt_func);
data.var_number = AddVarNameToList(&data);
- // FIXIT can this be handled by setting max_per_rule = 2?
+ // FIXIT-H can this be handled by setting max_per_rule = 2?
if (data.var_number >= NUM_BYTE_EXTRACT_VARS)
{
ParseError("Rule has more than %d byte_extract variables.",
static const char* s_name = "byte_test";
-// FIXIT cloned from sf_snort_plugin_api.h
#define CHECK_EQ 0
#define CHECK_NEQ 1
#define CHECK_LT 2
#define CHECK_AND 6
#define CHECK_XOR 7
#define CHECK_ALL 8
-#define CHECK_ATLEASTONE 9
+#define CHECK_GT0 9
#define CHECK_NONE 10
-#define BT_LESS_THAN CHECK_LT
-#define BT_EQUALS CHECK_EQ
-#define BT_GREATER_THAN CHECK_GT
-#define BT_AND CHECK_AND
-#define BT_XOR CHECK_XOR
-#define BT_GREATER_THAN_EQUAL CHECK_GTE
-#define BT_LESS_THAN_EQUAL CHECK_LTE
-#define BT_CHECK_ALL CHECK_ALL
-#define BT_CHECK_ATLEASTONE CHECK_ATLEASTONE
-#define BT_CHECK_NONE CHECK_NONE
-
#define BIG 0
#define LITTLE 1
switch(btd->opcode)
{
- case BT_LESS_THAN: if(value < cmp_value)
- success = 1;
- break;
+ case CHECK_LT:
+ success = (value < cmp_value);
+ break;
- case BT_EQUALS: if(value == cmp_value)
- success = 1;
- break;
+ case CHECK_EQ:
+ success = (value == cmp_value);
+ break;
- case BT_GREATER_THAN: if(value > cmp_value)
- success = 1;
- break;
+ case CHECK_GT:
+ success = (value > cmp_value);
+ break;
- case BT_AND: if ((value & cmp_value) > 0)
- success = 1;
- break;
+ case CHECK_AND:
+ success = ((value & cmp_value) > 0);
+ break;
- case BT_XOR: if ((value ^ cmp_value) > 0)
- success = 1;
- break;
+ case CHECK_XOR:
+ success = ((value ^ cmp_value) > 0);
+ break;
- case BT_GREATER_THAN_EQUAL: if (value >= cmp_value)
- success = 1;
- break;
+ case CHECK_GTE:
+ success = (value >= cmp_value);
+ break;
- case BT_LESS_THAN_EQUAL: if (value <= cmp_value)
- success = 1;
- break;
+ case CHECK_LTE:
+ success = (value <= cmp_value);
+ break;
- case BT_CHECK_ALL: if ((value & cmp_value) == cmp_value)
- success = 1;
- break;
+ case CHECK_ALL:
+ success = ((value & cmp_value) == cmp_value);
+ break;
- case BT_CHECK_ATLEASTONE: if ((value & cmp_value) != 0)
- success = 1;
- break;
+ case CHECK_GT0:
+ success = ((value & cmp_value) != 0);
+ break;
- case BT_CHECK_NONE: if ((value & cmp_value) == 0)
- success = 1;
- break;
+ case CHECK_NONE:
+ success = ((value & cmp_value) == 0);
+ break;
}
if (btd->not_flag)
if (idx.not_flag && strlen(cptr) == 0)
{
- idx.opcode = BT_EQUALS;
+ idx.opcode = CHECK_EQ;
}
else
{
/* set the opcode */
switch(*cptr)
{
- case '<': idx.opcode = BT_LESS_THAN;
+ case '<': idx.opcode = CHECK_LT;
cptr++;
if (*cptr == '=')
- idx.opcode = BT_LESS_THAN_EQUAL;
+ idx.opcode = CHECK_LTE;
else
cptr--;
break;
- case '=': idx.opcode = BT_EQUALS;
+ case '=': idx.opcode = CHECK_EQ;
break;
- case '>': idx.opcode = BT_GREATER_THAN;
+ case '>': idx.opcode = CHECK_GT;
cptr++;
if (*cptr == '=')
- idx.opcode = BT_GREATER_THAN_EQUAL;
+ idx.opcode = CHECK_GTE;
else
cptr--;
break;
- case '&': idx.opcode = BT_AND;
+ case '&': idx.opcode = CHECK_AND;
break;
- case '^': idx.opcode = BT_XOR;
+ case '^': idx.opcode = CHECK_XOR;
break;
default: ParseError(
return pmd;
}
-// FIXIT must ensure that fast_pattern is applied to
+// FIXIT-H must ensure that fast_pattern is applied to
// a fast_pattern inspection buffer
static int fast_pattern_count(OptTreeNode *otn, int list_type)
{
}
pmd->fp_offset = offset;
- pmd->fp = 1; // FIXIT must ensure current buffer is fp compatible
+ pmd->fp = 1; // FIXIT-H must ensure current buffer is fp compatible
}
static void parse_fast_pattern_length(PatternMatchData* pmd, const char *data)
}
pmd->fp_length = length;
- pmd->fp = 1; // FIXIT must ensure current buffer is fp compatible
+ pmd->fp = 1; // FIXIT-H must ensure current buffer is fp compatible
}
//-------------------------------------------------------------------------
pmd->no_case = 1;
else if ( v.is("fast_pattern") )
- pmd->fp = 1; // FIXIT must ensure current buffer is fp compatible
+ pmd->fp = 1; // FIXIT-H must ensure current buffer is fp compatible
else if ( v.is("fast_pattern_offset") )
parse_fast_pattern_offset(pmd, v.get_string());
uint8_t negated; /* search for "not this pattern" */
uint8_t pm_type;
- // FIXIT wasting some memory here:
+ // FIXIT-L wasting some memory here:
// - this is not used by content option logic directly
// - and only used on current eval (not across packets)
// (partly mitigated by only allocating if excpetion_flag is set)
void*, PatternMatchData *dup_pmd,
const uint8_t *current_cursor, const uint8_t *orig_cursor);
-// FIXIT if really needed, would b better as specific method
+// FIXIT-L if really needed, would b better as specific method
// so PMD isn't exposed
PatternMatchData* get_pmd(OptFpList*);
bool is_fast_pattern_only(OptFpList*);
** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
// ips_detection_filter.cc author Russ Combs <rucombs@cisco.com>
-// FIXIT add DetectionFilterOption::eval() instead of special case
+// FIXIT-L add DetectionFilterOption::eval() instead of special case
#include <sys/types.h>
if( group == NULL )
return 0;
- // FIXIT why is the hash lookup done at runtime for flowbits groups?
+ // FIXIT-M why is the hash lookup done at runtime for flowbits groups?
// a pointer to flowbis_grp should be in flowbits config data
// this *should* be safe but iff splay mode is disabled
flowbits_grp = (FLOWBITS_GRP *)sfghash_find(flowbits_grp_hash, group);
delete p;
}
-// FIXIT updating statics during reload is bad, mkay?
+// FIXIT-M updating statics during reload is bad, mkay?
static void flowbits_verify(SnortConfig*)
{
FlowBitsVerify();
}
#if 0
- // FIXIT if add_detection_option() finds a dup, then
+ // FIXIT-M if add_detection_option() finds a dup, then
// we can leak the original group name if same as current
// also, why use new group name instead of original?
char *group_name = ((FLOWBITS_OP *)idx_dup)->group;
mod_dtor
},
OPT_TYPE_DETECTION,
- 0, 0, // FIXIT more than one fragoffset per rule?
+ 1, 0,
nullptr,
nullptr,
nullptr,
if ( !p->flow || !p->flow->gadget )
rval = DETECTION_OPTION_NO_MATCH;
- // FIXIT cache id at parse time for runtime use
+ // FIXIT-P cache id at parse time for runtime use
else if ( !p->flow->gadget->get_buf(key, p, hb) )
rval = DETECTION_OPTION_NO_MATCH;
if ( !p->flow || !p->flow->gadget )
rval = DETECTION_OPTION_NO_MATCH;
- // FIXIT cache id at parse time for runtime use
+ // FIXIT-P cache id at parse time for runtime use
else if ( !p->flow->gadget->get_buf(s_name, p, hb) )
rval = DETECTION_OPTION_NO_MATCH;
#define PCRE_STUDY_JIT_COMPILE 0
#endif
+#define SNORT_PCRE_RELATIVE 0x00010 // relative to the end of the last match
+#define SNORT_PCRE_INVERT 0x00020 // invert detect
+#define SNORT_PCRE_ANCHORED 0x00040
+#define SNORT_OVERRIDE_MATCH_LIMIT 0x00080 // Override default limits on match & match recursion
+
static const char* s_name = "pcre";
/*
delete p;
}
-// FIXIT the thread specific ovector can be allocated and deallocated
+// FIXIT-L the thread specific ovector can be allocated and deallocated
// from the main thread since it isn't literally thread local
void pcre_tinit(SnortConfig* sc)
{
#include <stdint.h>
-// FIXIT poor encapsulation
-#define SNORT_PCRE_RELATIVE 0x00010 // relative to the end of the last match
-#define SNORT_PCRE_INVERT 0x00020 // invert detect
-#define SNORT_PCRE_RAWBYTES 0x00040 // Don't use decoded buffer (if available)
-#define SNORT_PCRE_ANCHORED 0x00080
-#define SNORT_OVERRIDE_MATCH_LIMIT 0x00100 // Override default limits on match & match recursion
-
#include <pcre.h>
struct PcreData
* Warning, this plugin may slow Snort *way* down!
*
*/
-// FIXIT delete this (sp_session) and use session tag instead
+// FIXIT-L delete this (sp_session) and use session tag instead
#ifdef HAVE_CONFIG_H
#include "config.h"
** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
// ips_tag.cc author Russ Combs <rucombs@cisco.com>
-// FIXIT add TagOption::eval() instead of special case
+// FIXIT-L add TagOption::eval() instead of special case
#include <sys/types.h>
return true;
}
-// FIXIT error if named option is set multiple times (general problem)
+// FIXIT-L error if named option is set multiple times (general problem)
// eg: tag:session, packets 10, packets 20;
bool TagModule::set(const char*, Value& v, SnortConfig*)
{
#ifndef RANGE_H
#define RANGE_H
-// FIXIT ideally this would be in framework/ and we'd have just one copy
-// but that breaks dynamic builds so each dynamic ips option plugin has
-// its own copy for now.
+// FIXIT-M ideally this would be in framework/ and we'd have just one copy
+// but that breaks dynamic builds so each dynamic client has its own for now.
// unfortunately, <> was implemented inconsistently. eg:
// dsize implements <> as ( a <= c && c <= b ) and
bool operator==(const RangeCheck&) const;
void init();
- // FIXIT add ttl style syntax
+ // FIXIT-L add ttl style syntax
bool parse(const char* s);
bool eval(long);
};
default:
if (ScLogVerbose())
{
- // FIXIT should only be output once!
+ // FIXIT-L should only be output once!
ErrorMessage("Datalink %i type 2nd layer display is not "
"supported\n", DAQ_GetBaseProtocol());
}
TextLog_Print(log, "%s", "Frag reassembled packet");
break;
default:
- // FIXIT do we get here for portscan or sdf?
+ // FIXIT-L do we get here for portscan or sdf?
TextLog_Print(log, "%s", "Cooked packet");
break;
}
}
- // FIXIT --> log everything in order!!
+ // FIXIT-J --> log everything in order!!
ip::IpApi tmp_api = p->ip_api;
int8_t num_layer = 0;
bool first = true;
}
#if 0
- // FIXIT need to stop analyzers / workers
+ // FIXIT-H need to stop analyzers / workers
// and they should handle the DAQ break / abort
if ( SnortIsInitializing() )
{
else
#endif
{
- // FIXIT this makes no sense from main thread
- // FIXIT exit() segfaults too; looks like something borked in dylib
+ // FIXIT-H this makes no sense from main thread
+ // exit() segfaults too; looks like something borked in dylib
exit(EXIT_FAILURE);
}
}
void ErrorMessageThrottled(ThrottleInfo*,const char*, ...) __attribute__((format (printf, 2, 3)));
-// FIXIT do not call FatalError() during runtime
+// FIXIT-M do not call FatalError() during runtime
NORETURN void FatalError(const char*, ...) __attribute__((format (printf, 1, 2)));
void PrintPacketData(const uint8_t*, const uint32_t);
static const Parameter csv_params[] =
{
- // FIXIT provide PT_FILE and PT_PATH and enforce no
+ // FIXIT-M provide PT_FILE and PT_PATH and enforce no
// path chars in file (outputs file must be in instance dir)
{ "file", Parameter::PT_STRING, nullptr, "stdout",
"name of alert file" },
{ "limit", Parameter::PT_INT, "0:", "0",
"set limit (0 is unlimited)" },
- // FIXIT provide PT_UNITS that converts to multiplier automatically
+ // FIXIT-M provide PT_UNITS that converts to multiplier automatically
{ "units", Parameter::PT_ENUM, "B | K | M | G", "B",
"bytes | KB | MB | GB" },
// alert_sfsocket module
//-------------------------------------------------------------------------
-// FIXIT this file will probably fail to compile on Linux
+// FIXIT-H this file will probably fail to compile on Linux
static const Parameter sfsocket_params[] =
{
if(sid == 0)
return NULL;
- // FIXIT wow - this should be encapsulated somewhere ...
+ // FIXIT-H wow - this should be encapsulated somewhere ...
for (hashNode = sfghash_findfirst(snort_conf->otn_map);
hashNode;
hashNode = sfghash_findnext(snort_conf->otn_map))
// alert foo
//-------------------------------------------------------------------------
-// FIXIT can't message be put in Event?
+// FIXIT-M can't message be put in Event?
static void AlertSyslog(
int priority, Packet *p, const char *msg, Event *event)
{
};
/* this struct is for the alert socket code.... */
-// FIXIT alert unix sock supports l2-l3-l4 encapsulations
+// FIXIT-L alert unix sock supports l2-l3-l4 encapsulations
const unsigned int ALERTMSG_LENGTH = 256;
struct Alertpkt
#define NOPACKET_STRUCT 0x1
/* no transport headers in packet */
#define NO_TRANSHDR 0x2
- uint8_t pkt[65535]; // FIXIT move to end and send actual size
+ uint8_t pkt[65535]; // FIXIT-L move to end and send actual size
uint32_t gid;
uint32_t sid;
static const Parameter unixsock_params[] =
{
- // FIXIT add name param?
+ // FIXIT-L add name param?
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
{
DEBUG_WRAP(DebugMessage(DEBUG_LOG, "Logging Alert data!\n"););
- // FIXIT ugh ...
+ // FIXIT-L ugh ...
memset((char *)&us.alert,0,sizeof(us.alert));
us.alert.gid = event->sig_info->generator;
if (msg)
{
- // FIXIT ugh ...
+ // FIXIT-L ugh ...
memmove( (void *)us.alert.alertmsg, (const void *)msg,
strlen(msg)>ALERTMSG_LENGTH-1 ? ALERTMSG_LENGTH - 1 : strlen(msg));
}
pcap_dump((u_char *)context.dumpd,(struct pcap_pkthdr*)p->pkth,p->pkt);
context.size += dumpSize;
- if (!ScLineBufferedLogging()) // FIXIT misnomer
+ if (!ScLineBufferedLogging()) // FIXIT-L misnomer
{
fflush( (FILE*) context.dumpd );
}
fname_ptr = u2.filepath;
}
- // FIXIT should use open() instead of fopen()
+ // FIXIT-L should use open() instead of fopen()
if ((u2.stream = fopen(fname_ptr, "wb")) == NULL)
{
FatalError("%s(%d) Could not open %s: %s\n",
}
/* If test mode, close and delete the file */
- if (ScTestMode()) // FIXIT eliminate test check; should always remove if empty
+ if (ScTestMode()) // FIXIT-L eliminate test check; should always remove if empty
{
fclose(u2.stream);
u2.stream = NULL;
buf[sizeof(buf)-1] = '\0';
}
-// FIXIT ignoring partial reads for now
+// FIXIT-L ignoring partial reads for now
// using simple text for now so can use telnet as client
// but must parse commands out of stream (ending with \n)
void Request::read(int f)
while ( n-- && isspace(buf[n]) );
}
-// FIXIT supporting only simple strings for now
+// FIXIT-L supporting only simple strings for now
// should support var args formats
void Request::respond(const char* s) const
{
return;
}
if ( write(fd, s, strlen(s)) )
- return; // FIXIT count errors?
+ return; // FIXIT-L count errors?
}
void Request::show_prompt() const
int main_help(lua_State*)
{
#if 0
- // FIXIT this should be generic for all modules
+ // FIXIT-H this should be generic for all modules
RequestMap* map = cmd_set;
while ( map->name )
return 1;
}
-// FIXIT return true if something was done to avoid sleeping
+// FIXIT-L return true if something was done to avoid sleeping
static bool house_keeping()
{
signal_check();
// socket foo
//-------------------------------------------------------------------------
-// FIXIT make these non-blocking
-// FIXIT allow at least 2 remote controls
-// FIXIT bind to configured ip including INADDR_ANY
+// FIXIT-M make these non-blocking
+// FIXIT-M allow at least 2 remote controls
+// FIXIT-M bind to configured ip including INADDR_ANY
// (default is loopback if enabled)
static int listener = -1;
static int remote_control = -1;
return -2;
}
- // FIXIT does this disable time wait for us?
+ // FIXIT-M does this disable time wait for us?
int on = 1;
setsockopt(listener, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on));
return -3;
}
- // FIXIT configure max conns
+ // FIXIT-M configure max conns
if ( listen(listener, 5) < 0 )
{
FatalError("listen failed: %s\n", strerror(errno));
if ( remote_control < 0 )
return -1;
- // FIXIT authenticate, use ssl ?
+ // FIXIT-L authenticate, use ssl ?
return 0;
}
if ( command && command != AC_PAUSE )
return false;
- // FIXIT executing a command while paused
+ // FIXIT-L executing a command while paused
// will cause a resume
command = ac;
return true;
uint64_t get_count() { return count; };
const char* get_source() { return source; };
- // FIXIT add asynchronous response too
+ // FIXIT-M add asynchronous response too
bool execute(AnalyzerCommand);
void set_config(Swapper* ps) { swap = ps; };
//-------------------------------------------------------------------------
-// FIXIT must use SnortModule params
void help_args(const char* pfx)
{
Module* m = get_snort_module();
else if ( v.is("bleedover_warnings_enabled") )
{
if ( v.get_bool() )
- fpDetectSetBleedOverWarnings(fp); // FIXIT these should take arg
+ fpDetectSetBleedOverWarnings(fp); // FIXIT-L these should take arg
}
else if ( v.is("enable_single_rule_group") )
{
p->append = v.get_long() + 1;
else if ( v.is("name") )
- p->filename = SnortStrdup(v.get_string()); // FIXIT use c++ string
- // FIXIT do this after log dir is set
+ p->filename = SnortStrdup(v.get_string()); // FIXIT-L use c++ string
+ // FIXIT-M do this after log dir is set
//p->filename = ProcessFileOption(sc, v.get_string());
else
//-------------------------------------------------------------------------
// classification module
//-------------------------------------------------------------------------
-// FIXIT signature.{h,cc} has type and name confused
+// FIXIT-L signature.{h,cc} has type and name confused
// the keys here make more sense
static const Parameter classification_params[] =
//-------------------------------------------------------------------------
// reference module
//-------------------------------------------------------------------------
-// FIXIT signature.{h,cc} has type and name confused
+// FIXIT-L signature.{h,cc} has type and name confused
// the keys here make more sense
static const Parameter reference_params[] =
static const Parameter alerts_params[] =
{
{ "alert_file", Parameter::PT_STRING, nullptr, nullptr,
- "set the alert output file name (FIXIT delete if not used)" },
+ "set the alert output file name (FIXIT-H delete if not used)" },
{ "alert_with_interface_name", Parameter::PT_BOOL, nullptr, "false",
"include interface in alert info (fast, full, or syslog only)" },
else if ( v.is("log_ipv6_extra_data") )
{
if ( v.get_bool() )
- sc->log_ipv6_extra = 1; // FIXIT move to output|logging_flags
+ sc->log_ipv6_extra = 1; // FIXIT-M move to output|logging_flags
}
else if ( v.is("quiet") )
{
static const Parameter daq_params[] =
{
- // FIXIT should be a list?
+ // FIXIT-L should be a list?
{ "dir", Parameter::PT_STRING, nullptr, nullptr,
"directory where to search for DAQ plugins" },
{ "no_promisc", Parameter::PT_BOOL, nullptr, "false",
"whether to put DAQ device into promiscuous mode" },
- // FIXIT range determined by available plugins
+ // FIXIT-H range determined by available plugins
{ "name", Parameter::PT_STRING, nullptr, "pcap",
"select name of DAQ" },
- // FIXIT should be a list?
+ // FIXIT-L should be a list?
{ "var", Parameter::PT_STRING, nullptr, nullptr,
"list of name=value DAQ-specific parameters" },
//-------------------------------------------------------------------------
// vars module
//-------------------------------------------------------------------------
-// FIXIT signature.{h,cc} has type and name confused
+// FIXIT-L signature.{h,cc} has type and name confused
// the keys here make more sense
static const Parameter vars_params[] =
"count interval" },
{ "new_action", Parameter::PT_SELECT,
- // FIXIT range based on available action plugins
+ // FIXIT-H range based on available action plugins
"alert | drop | log | pass | | reject | sdrop", "alert",
"restrict filter to these addresses according to track" },
// hosts module
//-------------------------------------------------------------------------
-// FIXIT these are cloned from ip_module.cc and tcp_module.cc
+// FIXIT-H these are cloned from ip_module.cc and tcp_module.cc
static const char* ip_policies =
"first | linux | bsd | bsd_right |last | windows | solaris";
typedef unsigned int PolicyId;
-// FIXIT split into separate modules
+// FIXIT-H split into separate modules
//-------------------------------------------------------------------------
// traffic stuff
};
//-------------------------------------------------------------------------
-// binding stuff - FIXIT tbd
+// binding stuff - FIXIT-H tbd
//-------------------------------------------------------------------------
class PolicyMap
//-------------------------------------------------------------------------
// nascent policy management
//-------------------------------------------------------------------------
-// FIXIT need stub binding rule to set these for runtime
-// FIXIT need to set these on load too somehow
+// FIXIT-H need stub binding rule to set these for runtime
+// FIXIT-H need to set these on load too somehow
static THREAD_LOCAL NetworkPolicy* s_traffic_policy = nullptr;
static THREAD_LOCAL InspectionPolicy* s_inspection_policy = nullptr;
#endif
#if 0
-// FIXIT not yet used
+// FIXIT-H not yet used
static void restart()
{
int daemon_mode = ScDaemonMode();
//-------------------------------------------------------------------------
// perf stats
-// FIXIT move these to appropriate modules
+// FIXIT-M move these to appropriate modules
//-------------------------------------------------------------------------
#ifdef PERF_PROFILING
LogMessage("--------------------------------------------------\n");
- // FIXIT config plugin_path won't work like this
+ // FIXIT-H config plugin_path won't work like this
Shell::init();
ModuleManager::init();
ParseRules(snort_conf);
- // FIXIT print should be through generic module list
+ // FIXIT-M print should be through generic module list
// and only print configured / active stuff
//detection_filter_print_config(snort_conf->detection_filter_config);
//RateFilter_PrintConfig(snort_conf->rate_filter_config);
/* Finish up the pcap list and put in the queues */
Trough_SetUp();
- // FIXIT stuff like this that is also done in snort_config.cc::VerifyReload()
+ // FIXIT-L stuff like this that is also done in snort_config.cc::VerifyReload()
// should be refactored
if ((snort_conf->bpf_filter == NULL) && (snort_conf->bpf_file != NULL))
snort_conf->bpf_filter = read_infile(snort_conf->bpf_file);
// much initialization stuff in SnortInit() as possible and to restrict this
// function to those things that depend on DAQ startup or non-root user/group.
//
-// FIXIT breaks DAQ_New()/Start() because packet threads won't be root when
+// FIXIT-H breaks DAQ_New()/Start() because packet threads won't be root when
// opening iface
static void SnortUnprivilegedInit(void)
{
{
DAQ_Term();
- if ( !ScTestMode() ) // FIXIT ideally the check is in one place
+ if ( !ScTestMode() ) // FIXIT-M ideally the check is in one place
PrintStatistics();
CloseLogger();
// reload foo
//-------------------------------------------------------------------------
-// FIXIT refactor this so startup and reload call the same core function to
+// FIXIT-M refactor this so startup and reload call the same core function to
// instantiate things that can be reloaded
static SnortConfig * get_reload_config(void)
{
FlowbitResetCounts();
ParseRules(sc);
- // FIXIT see SnortInit() on config printing
+ // FIXIT-L see SnortInit() on config printing
//detection_filter_print_config(sc->detection_filter_config);
////RateFilter_PrintConfig(sc->rate_filter_config);
//print_thresholding(sc->threshold_config, 0);
Packet* get_current_packet()
{ return &s_packet; }
-// FIXIT for multiple packet threads
+// FIXIT-H for multiple packet threads
// using thread locals for s_pkth and s_data won't work
// will need array of s_packet, s_pkth, and s_data and
// capture all if it is not clear which thread crashed
p->proto_bits = PROTO_BIT__OTHER;
#if 0
- // FIXIT required until decoders are fixed
+ // FIXIT-H required until decoders are fixed (josh)
else if ( !p->family && (p->proto_bits & PROTO_BIT__IP) )
p->proto_bits &= ~PROTO_BIT__IP;
#endif
return verdict;
}
-// FIXIT need to call fail open from a different thread
+// FIXIT-H need to call fail open from a different thread
DAQ_Verdict fail_open(
void*, const DAQ_PktHdr_t*, const uint8_t*)
{
Active_Reset();
PacketManager::encode_reset();
- if ( flow_con ) // FIXIT always instantiate
+ if ( flow_con ) // FIXIT-H always instantiate
flow_con->timeout_flows(4, pkthdr->ts.tv_sec);
#if 0
- // FIXIT do this when idle
- if ( flow_con ) // FIXIT always instantiate
+ // FIXIT-H do this when idle
+ if ( flow_con ) // FIXIT-H always instantiate
flow_con->timeout_flows(16384, time(NULL));
#endif
void snort_thread_init(const char* intf)
{
- // FIXIT the start-up sequence is a little off due to dropping privs
+ // FIXIT-H the start-up sequence is a little off due to dropping privs
DAQ_New(snort_conf, intf);
DAQ_Start();
void snort_rotate();
-// FIXIT may be inlined at some point; on lockdown for now
+// FIXIT-L may be inlined at some point; on lockdown for now
NetworkPolicy* get_network_policy();
InspectionPolicy* get_inspection_policy();
IpsPolicy* get_ips_policy();
void set_main_hook(MainHook_f);
//-------------------------------------------------------------------------
-// FIXIT most of what follows belongs in snort_config.h
+// FIXIT-L most of what follows belongs in snort_config.h
//-------------------------------------------------------------------------
/* D E F I N E S ************************************************************/
}
//-------------------------------------------------------------------------
-// FIXIT should be calling NetworkPolicy methods
+// FIXIT-L should be calling NetworkPolicy methods
static inline int ScIpChecksums(void)
{
return snort_conf->group_id;
}
-// FIXIT this should be feature of otn
+// FIXIT-L this should be feature of otn
#define EventIsInternal(gid) (gid == GENERATOR_INTERNAL)
static inline void EnableInternalEvent(RateFilterConfig *config, uint32_t sid)
#include "detection/treenodes.h"
#include "events/event_queue.h"
#include "stream/stream_api.h"
-#include "port_scan/ps_detect.h" // FIXIT for PS_PROTO_*
+#include "port_scan/ps_detect.h" // FIXIT-L for PS_PROTO_*
#include "utils/strvec.h"
#include "file_api/file_service.h"
#include "target_based/sftarget_reader.h"
sc->tagged_packet_limit = 256;
sc->default_rule_state = RULE_STATE_ENABLED;
- // FIXIT pcre_match_limit* are interdependent
+ // FIXIT-L pcre_match_limit* are interdependent
// somehow a packet thread needs a much lower setting
sc->pcre_match_limit = 1500;
sc->pcre_match_limit_recursion = 1500;
config_file->max_encapsulations = cmd_line->max_encapsulations;
// config file vars are stored differently
- // FIXIT should config_file and cmd_line use the same var list / table?
+ // FIXIT-M should config_file and cmd_line use the same var list / table?
config_file->var_list = NULL;
free(config_file->state);
#endif
//------------------------------------------------------
- // FIXIT command line only stuff, add to conf / module
+ // FIXIT-L command line only stuff, add to conf / module
uint32_t event_log_id; /* -G */
sfip_t obfuscation_net; // -B
char *bpf_filter; // --bpf
//------------------------------------------------------
- // FIXIT non-module stuff - separate config from derived state?
+ // FIXIT-L non-module stuff - separate config from derived state?
char pid_filename[STD_BUF];
char *orig_log_dir; /* set in case of chroot */
#include "snort.h"
#ifdef DEBUG_MSGS
-SO_PUBLIC const char *DebugMessageFile = NULL; // FIXIT use access methods
-SO_PUBLIC int DebugMessageLine = 0; // FIXIT use access methods
+SO_PUBLIC const char *DebugMessageFile = NULL; // FIXIT-M use access methods
+SO_PUBLIC int DebugMessageLine = 0; // FIXIT-M use access methods
int DebugThis(uint64_t level)
{
/* utilities */
#ifndef SIZE_MAX
-#define SIZE_MAX 0xFFFFFFFF // FIXIT not defined for g++?
+#define SIZE_MAX 0xFFFFFFFF // FIXIT-L use c++ define
#endif
#ifndef INT32_MAX
-#define INT32_MAX 0x7FFFFFFF // FIXIT not defined for g++?
+#define INT32_MAX 0x7FFFFFFF // FIXIT-L use c++ define
#endif
#define UNUSED(x) (void)(x)
#include "snort.h"
//-------------------------------------------------------------------------
-// FIXIT instance_id zero indicates main thread during parse time and the
+// FIXIT-L instance_id zero indicates main thread during parse time and the
// first packet thread during runtime. not sure if i'm ok with that.
// works for now.
//-------------------------------------------------------------------------
struct stat s;
if ( stat(file.c_str(), &s) )
- // FIXIT getting random 0750 or 0700 (umask not thread local)?
+ // FIXIT-H getting random 0750 or 0700 (umask not thread local)?
mkdir(file.c_str(), 0770);
file += name;
Output* p, Module* mod, SnortConfig* sc)
{
p->handler = p->api->ctor(sc, mod);
- assert(p->handler); // FIXIT must handle case where not configured
+ assert(p->handler); // FIXIT-H must handle case where not configured
if ( (p->api->flags & OUTPUT_TYPE_FLAG__ALERT) &&
(p->api->flags & OUTPUT_TYPE_FLAG__LOG) )
return;
}
- // FIXIT this loses args if set in conf
+ // FIXIT-H this loses args if set in conf
// emulate a config like name = { }
//mod->begin(name, 0, sc);
//mod->end(name, 0, sc);
p = new PHInstance(*ppc);
- if ( !p->handler ) // FIXIT is this even possible?
+ if ( !p->handler ) // FIXIT-M is this even possible?
{
delete p;
return NULL;
return p;
}
-// FIXIT create a separate list for meta handlers? is there really more than one?
+// FIXIT-M create a separate list for meta handlers? is there really more than one?
void InspectorManager::dispatch_meta (FrameworkPolicy* fp, int type, const uint8_t* data)
{
- // FIXIT change to select instance by policy and pass that in
+ // FIXIT-M change to select instance by policy and pass that in
for ( auto* p : fp->ilist )
p->handler->meta(type, data);
}
// this is per thread
void InspectorManager::thread_init(SnortConfig* sc)
{
- // FIXIT BIND the policy related logic herein moves to binder
+ // FIXIT-H BIND the policy related logic herein moves to binder
Inspector::slot = get_instance_id();
for ( auto* p : sc->framework_config->clist )
void InspectorManager::instantiate(
const InspectApi* api, Module*, SnortConfig* sc)
{
- // FIXIT only configures Lua inspectors in base policy; must be
+ // FIXIT-H only configures Lua inspectors in base policy; must be
// revisited when bindings are implemented
FrameworkConfig* fc = sc->framework_config;
FrameworkPolicy* fp = sc->policy_map->inspection_policy[0]->framework_policy;
- // FIXIT should not need to lookup inspector etc
+ // FIXIT-H should not need to lookup inspector etc
// since given api and mod
const char* keyword = api->base.name;
Inspector::max_slots = sc->max_threads;
s_handlers.sort(PHGlobal::comp);
- // FIXIT use FrameworkConfig or FrameworkPolicy ?
+ // FIXIT-H use FrameworkConfig or FrameworkPolicy ?
//FrameworkConfig* fc = sc->framework_config;
FrameworkPolicy* fp = sc->policy_map->inspection_policy[0]->framework_policy;
bool ok = true;
PHClass& ppc = (*prep)->pp_class;
- // FIXIT these checks can eventually be optimized
+ // FIXIT-P these checks can eventually be optimized
// but they are required to ensure that session and app
// handlers aren't called w/o a session pointer
if ( !p->flow && (ppc.api.type >= IT_SESSION) )
FrameworkPolicy* fp = get_inspection_policy()->framework_policy;
assert(fp);
- // FIXIT structure lists so stream, normalize, etc. aren't
+ // FIXIT-M structure lists so stream, normalize, etc. aren't
// called on reassembled packets
::execute(p, fp->session.vec, fp->session.num);
::execute(p, fp->network.vec, fp->network.num);
if ( flow->clouseau && (p->proto_bits & flow->clouseau->get_api()->proto_bits) )
bumble(p);
- // FIXIT BIND need more than one service inspector?
+ // FIXIT-H BIND need more than one service inspector?
//::execute(p, fp->service.vec, fp->service.num);
if ( flow->gadget && (p->proto_bits & flow->gadget->get_api()->proto_bits) )
flow->gadget->eval(p);
opt->api->pinit(sc);
opt->init = true;
}
- // FIXIT verify api->protos and api->max_per_rule
+ // FIXIT-H verify api->protos and api->max_per_rule
// before calling ctor
current_module = ModuleManager::get_module(key);
return get_params(sfx, p);
}
-// FIXIT vars may have been defined on command line
+// FIXIT-M vars may have been defined on command line
// that mechanism will be replaced with pulling a Lua
// chunk from the command line and stuffing into L
// before setting configs; that will overwrite
//
-// FIXIT should only need one table with
+// FIXIT-M should only need one table with
// dynamically typed vars
//
-// FIXIT this is a hack to tell vars by naming
+// FIXIT-M this is a hack to tell vars by naming
// convention; with one table this is obviated
// but if multiple tables are kept might want
// to change these to a module with parameters
void ModuleManager::load_rules(SnortConfig* sc)
{
- // FIXIT callers of ParseConfigString() should not have to push parse loc
+ // FIXIT-M callers of ParseConfigString() should not have to push parse loc
push_parse_location("builtin");
for ( auto p : s_modules )
while ( r->msg )
{
ss.str("");
- // FIXIT move builtin generation to a better home
- // FIXIT builtins should allow configurable nets and ports
- // FIXIT builtins should have accurate proto
+ // FIXIT-L move builtin generation to a better home
+ // FIXIT-L builtins should allow configurable nets and ports
+ // FIXIT-L builtins should have accurate proto
// (but ip winds up in all others)
- // FIXIT if msg has C escaped embedded quotes, we break
+ // FIXIT-L if msg has C escaped embedded quotes, we break
//ss << "alert tcp any any -> any any ( ";
ss << "alert ( ";
ss << "gid:" << gid << "; ";
while ( r->msg )
{
- // FIXIT builtin gen should be in exactly one place
+ // FIXIT-L builtin gen should be in exactly one place
ss << "alert ( ";
ss << "gid:" << gid << "; ";
ss << "sid:" << r->sid << "; ";
}
// was called during drop stats but actually commented out
-// FIXIT this one has to accumulate across threads
+// FIXIT-M this one has to accumulate across threads
#if 0
void MpseManager::print_qinfo()
{
RefCount() { count = 0; };
- // FIXIT fails on fatal error
+ // FIXIT-L fails on fatal error
//~RefCount() { assert(!count); };
};
add_plugins();
}
-// FIXIT some plugins don't have modules; consider adding them
-// for stray parameters, perfstats, documentation, etc.
void PluginManager::list_plugins()
{
PlugMap::iterator it;
#include "parser/parser.h"
#include "helpers/directory.h"
-// FIXIT this approach results in N * K lua states where
+// FIXIT-P this approach results in N * K lua states where
// N ::= number of instances of script + args and
// K ::= number of threads
// change to create K lua states here for each script + args
#define GZIP_WBITS 31
-// FIXIT make this into a general utility for one shot decompress
+// FIXIT-L make this into a general utility for one shot decompress
// and add class for stream decompress
const char* uncompress(const uint8_t* data, unsigned len)
{
if ( !rule )
return nullptr;
- // FIXIT this approach won't tolerate spaces and might get
+ // FIXIT-L this approach won't tolerate spaces and might get
// fooled by matching content (should it precede this)
char opt[32];
snprintf(opt, sizeof(opt), "soid:%s;", soid);
if ( !rule )
continue;
- // FIXIT need to properly parse rule to avoid
+ // FIXIT-L need to properly parse rule to avoid
// confusing other text for soid option
if ( !(s = strstr(rule, "soid:")) )
continue;
{
sfip_t in;
sfip_set_raw(&in, &p.ipv4_addr, AF_INET);
- // FIXIT replace all inet_ntoa() with thread safe
+ // FIXIT-L replace all inet_ntoa() with thread safe
LogMessage(" %s -> ", inet_ntoa(&in));
for (int i = 0; i < 6; i++)
// helpers
//-------------------------------------------------------------------------
-// FIXIT bind this is a temporary hack. note that both ends must be set
+// FIXIT-H bind this is a temporary hack. note that both ends must be set
// independently and that we must ref count inspectors.
static void set_session(Flow* flow, const char* key)
{
flow->clouseau = nullptr;
}
-// FIXIT use IPPROTO_* directly (any == 0)
+// FIXIT-H use IPPROTO_* directly (any == 0)
static bool check_proto(const Flow* flow, BindProto bp)
{
switch ( bp )
++bstats.total_packets;
}
-// FIXIT implement inspector lookup from policy / bindings
+// FIXIT-H implement inspector lookup from policy / bindings
Inspector* Binder::find_inspector(const char* s)
{
Binding* pb;
return 0;
}
-// FIXIT bind services - this is a temporary hack that just looks at ports,
+// FIXIT-H bind services - this is a temporary hack that just looks at ports,
// need to examine all key fields for matching. ultimately need a routing
// table, scapegoat tree, etc.
int Binder::check_rules(Flow* flow, Packet* p)
Binding* pb;
unsigned i, sz = bindings.size();
- // FIXIT called before stream runs - these flags aren't set
- // (below is structed to work by accident on initial syn until fixed)
+ // FIXIT-H called before stream runs - these flags aren't set
+ // (below is structured to work by accident on initial syn until fixed)
Port port = (p->packet_flags & PKT_FROM_SERVER) ? p->sp : p->dp;
for ( i = 0; i < sz; i++ )
}
if ( i == sz )
- return BA_ALLOW; // default action FIXIT make configurable
+ return BA_ALLOW; // default action FIXIT-H make configurable
if ( pb->action != BA_INSPECT )
return pb->action;
{
if ( !DAQ_CanReplace() )
{
- // FIXIT output only once
+ // FIXIT-L output only once
//LogMessage("WARNING: normalizations disabled because DAQ"
// " can't replace packets.\n");
nc->normalizer_flags = 0x0;
// all normalizers look like this:
// the return is 1 if packet was changed, else 0
-typedef int (*NormalFunc)( // FIXIT why is this exposed?
+typedef int (*NormalFunc)( // FIXIT-L why is this exposed?
struct NormalizerConfig*, Packet*, uint8_t layer, int changes);
struct NormalizerConfig
"sack | echo | partial_order | conn_count | alt_checksum | md5", "false",
"don't clear given option names" },
- // FIXIT provide a byte list for stuff like this
+ // FIXIT-L provide a byte list for stuff like this
{ "allow_codes", Parameter::PT_STRING, nullptr, nullptr,
"don't clear given option codes" },
bool Normalizer::configure(SnortConfig*)
{
- // FIXIT detection policy can't be used by normalizer
+ // FIXIT-M detection policy can't be used by normalizer
// (not set until after normalizer runs)
if ( get_ips_policy()->policy_mode != POLICY_MODE__INLINE )
{
if (CheckSampleInterval(sfPerf, p))
{
cnt = 0;
- perfmon_config = sfPerf; // FIXIT sfPerf isn't propagated far enough
+ perfmon_config = sfPerf; // FIXIT-L sfPerf isn't propagated far enough
if (!(sfPerf->perf_flags & SFPERF_SUMMARY_BASE))
{
void InitPerfStats(SFPERF *sfPerf)
{
- perfmon_config = sfPerf; // FIXIT sfPerf isn't propagated far enough
+ perfmon_config = sfPerf; // FIXIT-L sfPerf isn't propagated far enough
if (sfPerf->perf_flags & SFPERF_BASE)
InitBaseStats(&sfBase);
static void UpdatePerfStats(SFPERF *sfPerf, Packet *p)
{
- perfmon_config = sfPerf; // FIXIT sfPerf isn't propagated far enough
+ perfmon_config = sfPerf; // FIXIT-L sfPerf isn't propagated far enough
bool rebuilt = PacketIsRebuilt(p);
if (sfPerf->perf_flags & SFPERF_BASE)
if (sfPerf == NULL)
return;
- perfmon_config = sfPerf; // FIXIT sfPerf isn't propagated far enough
+ perfmon_config = sfPerf; // FIXIT-L sfPerf isn't propagated far enough
if (sfPerf->perf_flags & SFPERF_SUMMARY_BASE)
sfProcessBaseStats(sfPerf);
/* This function changes the perfmon log files permission if exists.
It is done in the PerfMonitorInit() before Snort changed its user & group.
*/
-// FIXIT this should be deleted; was added as 1-time workaround to
+// FIXIT-L this should be deleted; was added as 1-time workaround to
// get around the borked perms due to a bug that has been fixed
static void PerfMonitorChangeLogFilesPermission(void)
{
PrintConfig(&config);
}
-// FIXIT perfmonitor should be logging to one file and writing record type and
+// FIXIT-L perfmonitor should be logging to one file and writing record type and
// version fields immediately after timestamp like
// seconds, usec, type, version#, data1, data2, ...
bool PerfMonitor::configure(SnortConfig*)
*/
PacketManager::encode_update(g_tmp_pkt);
- // FIXIT: IP4 is gauranteed to have been set in update(). Is IP6()
+ // FIXIT-L: IP4 is gauranteed to have been set in update(). Is IP6()
// also gauranteed?
if(g_tmp_pkt->ip_api.is_ip6())
((ip::IP6Hdr*)g_tmp_pkt->ip_api.get_ip6h())->set_len(htons((uint16_t)ip_size));
bool PortScan::configure(SnortConfig* sc)
{
- // FIXIT use fixed base file name
+ // FIXIT-L use fixed base file name
config->logfile = SnortStrdup("portscan.log");
global = (PsData*)DataManager::acquire(PS_GLOBAL, sc);
MODULE_PROFILE_START(psPerfStats);
++spstats.total_packets;
- memset(&ps_pkt, 0x00, sizeof(PS_PKT)); // FIXIT don't zap unless necessary
+ memset(&ps_pkt, 0x00, sizeof(PS_PKT)); // FIXIT-P don't zap unless necessary
ps_pkt.pkt = (void *)p;
/* See if there is already an exisiting node in the hash table */
mod_dtor
},
IT_PROTOCOL,
- PROTO_BIT__IP|PROTO_BIT__ICMP|PROTO_BIT__TCP|PROTO_BIT__UDP, // FIXIT dynamic assign
+ PROTO_BIT__IP|PROTO_BIT__ICMP|PROTO_BIT__TCP|PROTO_BIT__UDP, // FIXIT-L dynamic assign
nullptr, // buffers
nullptr, // service
nullptr, // pinit
{ return port_scan_rules; }
//-------------------------------------------------------------------------
-// FIXIT ipset_parse() format must be changed to remove comma
+// FIXIT-L ipset_parse() format must be changed to remove comma
// separators between tokens which means using something other than
// space between CIDR and port. the current format is:
// CIDR[ ports][,CIDR[ ports]]*
int Active_IsUNRCandidate(const Packet* p)
{
- // FIXIT allow unr to tcp/udp/icmp4/icmp6 only or for all
+ // FIXIT-J allow unr to tcp/udp/icmp4/icmp6 only or for all
switch ( GetInnerProto(p) ) {
case PROTO_UDP:
case PROTO_TCP:
ActionManager::queue_reject();
break;
- // FIXIT send unr to udp/icmp4/icmp6 only or for all non-tcp?
+ // FIXIT-J send unr to udp/icmp4/icmp6 only or for all non-tcp?
case IPPROTO_UDP:
case IPPROTO_ICMP:
case IPPROTO_ICMPV6:
DAQ_Stop();
DAQ_Delete();
- //DAQ_Term(); FIXIT this must be called from main thread on abort
+ //DAQ_Term(); FIXIT-H this must be called from main thread on abort
}
//--------------------------------------------------------------------
printf("argv[%d]='%s'\n", i, argv[i]);
}
-// FIXIT this chokes on -n -4 because it thinks
+// FIXIT-L this chokes on -n -4 because it thinks
// -4 is another arg instead of an option to -n
bool ArgList::get_arg(const char*& key, const char*& val)
{
#include "managers/event_manager.h"
#include "detection/detect.h"
-// FIXIT defines should be avoided here - the actual option
-// may be from command line (a-b) or from config file (a_b)
-// option should be passed into all parser function for error
-// messages
-#define CONFIG_OPT__POLICY_VERSION "policy_version"
-#ifdef PERF_PROFILING
-# define CONFIG_OPT__PROFILE_MODULES "profile_preprocs"
-# define CONFIG_OPT__PROFILE_RULES "profile_rules"
-#endif
-
#define LOG_NONE "none"
#define LOG_TEXT "text"
#define LOG_PCAP "pcap"
#define OUTPUT_AJK "unified2"
#define OUTPUT_CMG "alert_fast"
-//#define OUTPUT_LOG "alert_syslog" // FIXIT should use?
#define OUTPUT_PCAP "log_tcpdump"
static std::string lua_conf;
DEBUG_WRAP(DebugMessage(DEBUG_INIT, "Enabled year in timestamp\n"););
}
-// FIXIT-L who is calling this? get rid of SnortStrtoul() etc. when
-// all are modularized
-void ConfigSoRuleMemcap(SnortConfig *sc, const char *args)
-{
- char *endptr;
-
- if ( !args )
- return;
-
- sc->so_rule_memcap = SnortStrtoul(args, &endptr, 0);
- if ((errno == ERANGE) || (*endptr != '\0'))
- {
- ParseError("invalid so rule memcap: %s. Memcap must be between "
- "0 and %u inclusive.", args, UINT32_MAX);
- }
-}
-
void ConfigTreatDropAsAlert(SnortConfig *sc, const char*)
{
sc->run_flags |= RUN_FLAG__TREAT_DROP_AS_ALERT;
void ConfigObfuscationMask(SnortConfig*, const char*);
void ConfigQuiet(SnortConfig*, const char*);
void ConfigShowYear(SnortConfig*, const char*);
-void ConfigSoRuleMemcap(SnortConfig*, const char*);
void ConfigTreatDropAsAlert(SnortConfig*, const char*);
void ConfigTreatDropAsIgnore(SnortConfig*, const char*);
void ConfigProcessAllEvents(SnortConfig*, const char*);
void ParseIpVar(SnortConfig *sc, const char* var, const char* val)
{
int ret;
- IpsPolicy* p = get_ips_policy(); // FIXIT double check, see below
+ IpsPolicy* p = get_ips_policy(); // FIXIT-M double check, see below
DisallowCrossTableDuplicateVars(sc, var, VAR_TYPE__IPVAR);
if((ret = sfvt_define(p->ip_vartable, var, val)) != SFIP_SUCCESS)
return p ? p->RuleList : nullptr;
}
-// FIXIT find this a better home
+// FIXIT-L find this a better home
void AddRuleState(SnortConfig* sc, const RuleState& rs)
{
if (sc == NULL)
RuleType get_rule_type(const char*);
ListHead* get_rule_list(SnortConfig*, const char*);
-#if 0
-// FIXIT delete this cruft
-#define ERR_PAIR_COUNT \
- "%s has incorrect argument count; should be %d pairs.", ERR_KEY
-#define ERR_NOT_PAIRED \
- "%s is missing an option or argument to go with: %s.", ERR_KEY, pairs[0]
-#define ERR_EXTRA_OPTION \
- "%s has extra option of type: %s.", ERR_KEY, pairs[0]
-#define ERR_BAD_OPTION \
- "%s has unknown option: %s.", ERR_KEY, pairs[0]
-#define ERR_BAD_VALUE \
- "%s has unknown %s: %s.", ERR_KEY, pairs[0], pairs[1]
-#define ERR_BAD_ARG_COUNT \
- "%s has incorrect argument count.", ERR_KEY
-#define ERR_CREATE \
- "%s could not be created.", ERR_KEY
-#define ERR_CREATE_EX \
- "%s could not be created: %s.", ERR_KEY
-#endif
-
#endif
rtn.proto = ETHERNET_TYPE_IP;
/* This will be set via ip_protos */
- // FIXIT need to add these for a single ip any any rule?
+ // FIXIT-L need to add these for a single ip any any rule?
sc->ip_proto_array[IPPROTO_TCP] = 1;
sc->ip_proto_array[IPPROTO_UDP] = 1;
sc->ip_proto_array[IPPROTO_ICMP] = 1;
ParseError("SO rule %s not loaded.", otn->soid);
else
{
- // FIXIT why isn't this set already? (don't hardcode)
+ // FIXIT-L why isn't this set already? (don't hardcode)
otn->sigInfo.generator = GENERATOR_SNORT_SHARED;
entered = true;
return so_opts;
otn_count++;
rule_count++;
- // FIXIT need more reliable way of knowing type of rule instead of hard
+ // FIXIT-L need more reliable way of knowing type of rule instead of hard
// coding these gids
if ( otn->sigInfo.generator == 1 )
{
#include "target_based/sftarget_reader.h"
#include "events/event_wrapper.h" // see s_hack
-// FIXIT without s_hack, we get this error on Mac:
+// FIXIT-L without s_hack, we get this error on Mac:
// Symbol not found: __Z18GenerateSnortEventP6Packetjj
// Referenced from: /Users/rucombs/install/lib/snort/inspectors/libport_scan.0.dylib
// Expected in: flat namespace
****************************************************************************/
static void DefineAllIfaceVars(SnortConfig *sc)
{
- // FIXIT don't come back here on reload unless we are going to find
+ // FIXIT-L don't come back here on reload unless we are going to find
// new ifaces.
/* Cache retrieved devs so if user is running with dropped privs and
* does a reload, we can use previous values */
VarEntry * VarDefine(SnortConfig *sc, const char *name, const char *value);
int PortVarDefine(SnortConfig *sc, const char *name, const char *s);
-void ParseIpVar(SnortConfig *sc, const char *name, const char *s); // FIXIT actually in parse_conf.cc
+void ParseIpVar(SnortConfig *sc, const char *name, const char *s); // FIXIT-L actually in parse_conf.cc
VarEntry *VarAlloc();
void DeleteVars(VarEntry *var_table);
struct Packet;
-// FIXIT : can I assume api si always valid? i.e. if not ip4, then ipv6?
+// FIXIT-J : can I assume api si always valid? i.e. if not ip4, then ipv6?
// or if not ip4, also make sure its not ip6
namespace ip
/* otherwise defined in /usr/include/ppp_defs.h */
-// FIXIT udph should not be set for udp tunnel
+// FIXIT-J udph should not be set for udp tunnel
// (only if innermost layer == udp)
#define IsUDP(p) (IsIP(p) && !IsTCP(p) && p->udph)
const unsigned char* T, int n, mpse_action_f action,
void* data, int* current_state)
{
- // FIXIT make sure DFA and NFA flavors aren't swapped
+ // FIXIT-H make sure DFA and NFA flavors aren't swapped
return acsmSearchSparseDFA(
obj, (unsigned char *)T, n, action, data, current_state);
};
const unsigned char* T, int n, mpse_action_f action,
void* data, int* current_state )
{
- // FIXIT make sure NFA and DFA flavors aren't swapped
+ // FIXIT-H make sure NFA and DFA flavors aren't swapped
return acsmSearchSparseNFA(
obj, (unsigned char *)T, n, action, data, current_state);
};
return _process_queue( bnfa, Match, data );
}
-// FIXIT eliminate the if-else-
+// FIXIT-L eliminate the if-else-
unsigned bnfaSearch( bnfa_struct_t * bnfa, unsigned char *Tx, int n,
int (*Match)(void * id, void *tree, int index, void *data, void *neg_list),
void *data, unsigned sindex, int* current_state )
/* GLOBALS ********************************************************************/
-static CpaInstanceHandle ipm_instance = NULL; /* instance handle */ // FIXIT 1 / process
+static CpaInstanceHandle ipm_instance = NULL; /* instance handle */
static IntelPmHandles *ipm_handles = NULL;
/* XXX Temporary stat for Intel */
} SearchAPI;
-// FIXIT search_api should be turned into a class
+// FIXIT-L search_api should be turned into a class
// (constructed of an Mpse, not subclassed)
extern SearchAPI *search_api;
#include "sfsnprintfappend.h"
#ifdef PERF_PROFILING
-// FIXIT ftp, http, etc. should not be calling Detect()
+// FIXIT-M ftp, http, etc. should not be calling Detect()
static THREAD_LOCAL int ftppDetectCalled = 0;
static THREAD_LOCAL ProfileStats ftppDetectPerfStats;
* Returns: None
*
*/
-// FIXIT eliminate legacy void* cruft
+// FIXIT-L eliminate legacy void* cruft
int FTPCheckConfigs(SnortConfig* sc, void* pData)
{
FTP_SERVER_PROTO_CONF* config = (FTP_SERVER_PROTO_CONF*)pData;
#if 0
if ( file_api->get_max_file_depth() < 0 )
{
- // FIXIT need to change to IT_SERVICE and FTPTelnetChecks
+ // FIXIT-M need to change to IT_SERVICE and FTPTelnetChecks
// for optimization
}
#endif
DEBUG_WRAP(DebugMessage(DEBUG_FTPTELNET,
"Server packet: %.*s\n", p->dsize, p->data));
- // FIXIT breaks target-based non-standard ports
+ // FIXIT-L breaks target-based non-standard ports
//if ( !ScPafEnabled() )
/* Force flush of client side of stream */
stream.response_flush_stream(p);
strcpy(FTPCmd->cmd_name, cmd);
- // FIXIT make sure pulled from server conf when used if not
+ // FIXIT-L make sure pulled from server conf when used if not
// overridden
//FTPCmd->max_param_len = ServerConf->def_max_param_len;
private:
FTP_SERVER_PROTO_CONF* ftp_server;
- ClientData* ftp_client; // FIXIT delete this when bindings implemented
+ ClientData* ftp_client; // FIXIT-H delete this when bindings implemented
};
FtpServer::FtpServer(FTP_SERVER_PROTO_CONF* server)
delete ftp_server;
if ( ftp_client )
- // FIXIT make sure CleanupFTPClientConf() is called
+ // FIXIT-L make sure CleanupFTPClientConf() is called
DataManager::release(ftp_client);
}
// fc_ = ftp_client
// fs_ = ftp_server
//
-// FIXIT fc is a data module but may need to
+// FIXIT-L fc is a data module but may need to
// be an inspector with separate bindings.
//-------------------------------------------------------------------------
fs_mod_ctor,
mod_dtor
},
- //IT_SESSION, // FIXIT should be service only
IT_SERVICE,
PROTO_BIT__TCP,
nullptr, // buffers
mod_ctor,
mod_dtor
},
- IT_SERVICE, // FIXIT does this still need to be session??
+ IT_SERVICE, // FIXIT-M does this still need to be session??
PROTO_BIT__TCP,
nullptr, // buffers
"ftp-data",
{ "address", Parameter::PT_ADDR, nullptr, nullptr,
"allowed ip address in CIDR format" },
- // FIXIT port and last_port should be replaced with a port list
+ // FIXIT-L port and last_port should be replaced with a port list
{ "port", Parameter::PT_PORT, "1:", nullptr,
"allowed port" },
#define FTP_EVASIVE_TELNET_CMD_STR \
"(ftp) Evasive (incomplete) TELNET CMD on FTP Command Channel"
-// FIXIT convert to Lua and use as module default settings
+// FIXIT-H convert to Lua and use as module default settings
#if 0
static const char* DEFAULT_FTP_CONF[] =
{
"hardcoded_config "
"def_max_param_len 100 "
- // FIXIT should not have to list commands more than once
// eg must appear in at least one *_cmds parameter
"ftp_cmds { USER PASS ACCT CWD CDUP SMNT QUIT REIN TYPE STRU"
" MODE RETR STOR STOU APPE ALLO REST RNFR RNTO ABOR"
TelnetFlowData* fd = new TelnetFlowData;
TELNET_SESSION* Newsession = &fd->session;
- // FIXIT lots of redundancy; clean up and move to ctor
+ // FIXIT-L lots of redundancy; clean up and move to ctor
TelnetResetsession(Newsession);
Newsession->ft_ssn.proto = FTPP_SI_PROTO_TELNET;
Newsession->telnet_conf = GlobalConf;
return FTPP_SI_NO_MODE;
}
-/*
- * // FIXIT this goes away when bindings are implemented
- * Purpose: When a session is initialized, we must select the appropriate
- * server configuration and select the type of inspection based
- * on the source and destination ports.
- *
- * IMPORTANT NOTE:
- * We should check to make sure that there are some unique configurations,
- * otherwise we can just default to the global default and work some magic
- * that way.
- */
static int FTPInitConf(
Packet *p,
FTP_CLIENT_PROTO_CONF **ClientConf,
FTP_SERVER_PROTO_CONF **ServerConf,
FTPP_SI_INPUT *SiInput, int *piInspectMode)
{
- // FIXIT BINDING ftp client and server must set by external bindings
+ // FIXIT-H BINDING ftp client and server must set by external bindings
// at that point these get deleted
FTP_CLIENT_PROTO_CONF *ClientConfSip = get_default_ftp_client();
FTP_CLIENT_PROTO_CONF *ClientConfDip = get_default_ftp_client();
FtpFlowData* fd = new FtpFlowData;
FTP_SESSION* Newsession = &fd->session;
- // FIXIT lots of redundancy; clean up and move to ctor
+ // FIXIT-L lots of redundancy; clean up and move to ctor
FTPResetsession(Newsession);
Newsession->ft_ssn.proto = FTPP_SI_PROTO_FTP;
Newsession->client_conf = ClientConf;
#ifndef HI_UTIL_KMAP_H
#define HI_UTIL_KMAP_H
-// FIXIT this is a dup of the file in http_inspect
+// FIXIT-L this is a dup of the file in http_inspect
#define ALPHABET_SIZE 256
static THREAD_LOCAL unsigned msize=0;
-void * xmalloc(size_t byteSize) // FIXIT eliminate this nonsense
+void * xmalloc(size_t byteSize) // FIXIT-L eliminate this nonsense
{
#ifdef MDEBUG
int * data = (int*) malloc( byteSize + 4 );
*/
#ifndef HI_UTIL_XMALLOC_H
#define HI_UTIL_XMALLOC_H
-// FIXIT this is a dup of the file in http_inspect
+// FIXIT-L this is a dup of the file in http_inspect
#include <sys/types.h>
cur_ptr = start;
- if(/*ServerConf->log_uri &&*/ !stream_ins && hsd) // FIXIT move back to ServerConf?
+ if(/*ServerConf->log_uri &&*/ !stream_ins && hsd) // FIXIT-L move back to ServerConf?
{
SkipBlankSpace(start,end,&cur_ptr);
else
{
hdrs_args->hst_name_hdr = 1;
- if ( hsd && !(hdrs_args->strm_ins) /*&& (ServerConf->log_hostname)*/) // FIXIT move back to ServerConf?
+ if ( hsd && !(hdrs_args->strm_ins) /*&& (ServerConf->log_hostname)*/) // FIXIT-L move back to ServerConf?
{
if(!SetLogBuffers(hsd))
{
{NULL, 0, 0}
};
-// FIXIT verify these don't need to be thread local
+// FIXIT-H verify these don't need to be thread local
void *hi_javascript_search_mpse = NULL;
void *hi_htmltype_search_mpse = NULL;
return position;
}
-// FIXIT extra data masks should only be updated as extra data changes state
+// FIXIT-P extra data masks should only be updated as extra data changes state
// eg just once when captured; this function is called on every packet and
// repeatedly sets the flags on session
static inline void HttpLogFuncs(
if ( iInspectMode == HI_SI_CLIENT_MODE )
{
const HttpBuffer* hb;
- ClearHttpBuffers(); // FIXIT needed here and right above??
+ ClearHttpBuffers(); // FIXIT-P needed here and right above??
if ( session->client.request.uri_norm )
{
file_api->free_mime_session(hsd->mime_ssn);
}
-// FIXIT this should leverage inspector get_buf()
+// FIXIT-H this should leverage inspector get_buf()
int GetHttpTrueIP(Flow* flow, uint8_t **buf, uint32_t *len, uint32_t *type)
{
HttpsessionData* hsd = get_session_data(flow);
{ "decompress_depth", Parameter::PT_INT, "1:65535", "2920",
"maximum amount of decompressed data to process" },
- // FIXIT does this work with bindings?
+ // FIXIT-L does this work with bindings?
{ "detect_anomalous_servers", Parameter::PT_BOOL, nullptr, "false",
"inspect non-configured ports for HTTP - bad idea" },
static const char* profiles = "none | all | apache | iis | iis_40 | iis_50";
-// FIXIT refactor params to create a profile table so that user can define
+// FIXIT-L refactor params to create a profile table so that user can define
// different profiles (like above) and use those. rename existing profile
// to profile_type.
{
if(ServerConf->iis_unicode.on)
{
- // FIXIT iNorm is an int; is it guaranteed to be < 64K?
+ // FIXIT-L iNorm is an int; is it guaranteed to be < 64K?
iNorm = ServerConf->iis_unicode_map[iNorm];
if(iNorm == HI_UI_NON_ASCII_CODEPOINT)
static uint32_t hi_cap = 0;
// stats
-// FIXIT eliminate these counts
+// FIXIT-L eliminate these counts
static THREAD_LOCAL uint32_t hi_paf_calls = 0;
static THREAD_LOCAL uint32_t hi_paf_bytes = 0;
}
else if ( IsHeaderFieldName(p, end, HTTPRESP_HEADER_NAME__CONTENT_ENCODING,
- HTTPRESP_HEADER_LENGTH__CONTENT_ENCODING) /*&& ServerConf->extract_gzip*/ && // FIXIT move back to ServerConf?
+ HTTPRESP_HEADER_LENGTH__CONTENT_ENCODING) /*&& ServerConf->extract_gzip*/ && // FIXIT-L move back to ServerConf?
parse_cont_encoding)
{
p = extract_http_content_encoding(ServerConf, p, start, end, header_ptr, header_field_ptr );
HTTPINSPECT_CONF::HTTPINSPECT_CONF()
{
// can't just zero the whole thing because of embedded objects
- // FIXIT really need explicit assignments or refactor into substruct(s)
+ // FIXIT-L really need explicit assignments or refactor into substruct(s)
// that can simply be zeroed
uint8_t* end = (uint8_t*)&whitespace;
unsigned len = end - (uint8_t*)this;
HTTPINSPECT_CONF::~HTTPINSPECT_CONF()
{
- // FIXIT xfree() etc should go
+ // FIXIT-L xfree() etc should go
xfree(iis_unicode_map_filename);
xfree(iis_unicode_map);
static int HttpInspectVerifyPolicy(SnortConfig*, HTTPINSPECT_CONF* pData)
{
- HttpInspectRegisterXtraDataFuncs(); // FIXIT must be done once
+ HttpInspectRegisterXtraDataFuncs(); // FIXIT-L must be done once
updateConfigFromFileProcessing(pData);
return 0;
HttpInspectInitializeGlobalConfig(config->global);
- // FIXIT must load default unicode map from const char*
CheckGzipConfig(config->global);
CheckMemcap(config->global);
{
HttpFlowData::init();
HI_SearchInit();
- hi_paf_init(0); // FIXIT is cap needed?
+ hi_paf_init(0); // FIXIT-L is cap needed?
InitLookupTables();
InitJSNormLookupTable();
}
return p;
}
-// FIXIT make this incremental based on last position
+// FIXIT-H make this incremental based on last position
const char* HexBook::find_spell(const uint8_t* data, unsigned len) const
{
if ( MagicPage* p = find_spell(data, len, root) )
return p;
}
-// FIXIT make this incremental based on last position
+// FIXIT-H make this incremental based on last position
const char* SpellBook::find_spell(const uint8_t* data, unsigned len) const
{
- // FIXIT make configurable upper bound to limit globbing
+ // FIXIT-L make configurable upper bound to limit globbing
unsigned max = 16;
if ( len > max )
bool Wizard::spellbind(
const MagicPage* m, Flow* f, const uint8_t* data, unsigned len)
{
- // FIXIT convert to stateful find
+ // FIXIT-H convert to stateful find
f->service = m->book.find_spell(data, len);
return f->service != nullptr;
}
#include "config.h"
#endif
-#include "sfrt.h" // FIXIT these includes are circular
+#include "sfrt.h" // FIXIT-L these includes are circular
#include "sfrt_dir.h"
#include <stdarg.h> /* For variadic */
int length;
} tuple_flat_t;
-// FIXIT circular include here
+// FIXIT-L circular include here
#include "sfrt/sfrt_flat_dir.h"
/*******************************************************************/
#include "config.h"
#endif
-#include "sfrt_flat.h" // FIXIT these includes are circular
+#include "sfrt_flat.h" // FIXIT-L these includes are circular
#include "sfrt_flat_dir.h"
#include <stdarg.h> /* For variadic */
void StreamBase::show(SnortConfig*)
{
- // FIXIT SSN print
+ // FIXIT-L SSN print
//Stream5PrintGlobalConfig(&config);
}
}
#if 0
- // FIXIT add method to get exp cache?
+ // FIXIT-L add method to get exp cache?
LogMessage(" Expected Flows\n");
LogMessage(" Expected: %lu\n", exp_cache->get_expects());
LogMessage(" Realized: %lu\n", exp_cache->get_realized());
mod_dtor
},
IT_STREAM,
- PROTO_BIT__ALL, // FIXIT which bits??
+ PROTO_BIT__ALL, // FIXIT-H which bits??
nullptr, // buffers
nullptr, // service
nullptr, // init
#if 0
void icmp_stats()
{
- // FIXIT move these to the actual owner
- // FIXIT need to get these before delete flow_con
+ // FIXIT-L move these to the actual owner
+ // FIXIT-L need to get these before delete flow_con
//flow_con->get_prunes(IPPROTO_UDP, icmpStats.prunes);
}
#endif
/* G L O B A L S **************************************************/
-// FIXIT convert to session memcap
+// FIXIT-M convert to session memcap
static THREAD_LOCAL unsigned long mem_in_use = 0; /* memory in use, used for self pres */
static THREAD_LOCAL FragStats t_stats;
/* Set the 'next' protocol */
if (p->ip6_frag_index > 0)
{
- // FIXIT use of last_extension works but is ugly
+ // FIXIT-J use of last_extension works but is ugly
ip::IP6Extension *last_extension = (ip::IP6Extension *)
(dpkt->pkt + (p->ip6_extensions[p->ip6_frag_index -1].data - p->pkt));
last_extension->ip6e_nxt = ft->protocol;
SnortEventqPush();
p->packet_flags |= (PKT_PSEUDO | PKT_REBUILT_FRAG);
p->pseudo_type = PSEUDO_PKT_IP;
- //Encode_SetPkt(p); // FIXIT needed for responses to defragged packets
+ //Encode_SetPkt(p); // FIXIT-J needed for responses to defragged packets
ProcessPacket(dpkt, dpkt->pkth, dpkt->pkt);
SnortEventqPop();
#include "fpcreate.h"
-// FIXIT integrate into stream api
+// FIXIT-L integrate into stream api
//int fpAddFragAlert(Packet *p, OptTreeNode *otn);
//int fpFragAlerted(Packet *p, OptTreeNode *otn);
int drop_all_fragments(Packet *p);
int new_tracker(Packet *p, FragTracker*);
int add_frag_node(
- // FIXIT too many args
+ // FIXIT-L too many args
FragTracker *ft, Packet*, FragEngine*,
const uint8_t *fragStart, int16_t fragLength,
char lastfrag, int16_t len,
else if ( v.is("session_timeout") )
{
- // FIXIT need to integrate to eliminate redundant data
+ // FIXIT-L need to integrate to eliminate redundant data
config->session_timeout = v.get_long();
config->frag_engine.frag_timeout = v.get_long();
}
int StreamIp::verify_config(SnortConfig*)
{
- // FIXIT needed for defrag?
+ // FIXIT-L needed for defrag?
return 0;
}
#define S5_TRACK_YES 1
#define S5_TRACK_NO 0
-// FIXIT move to proto specific where possible
+// FIXIT-L move to proto specific where possible
#define STREAM5_CONFIG_STATEFUL_INSPECTION 0x00000001
#define STREAM5_CONFIG_LOG_STREAMS 0x00000004
#define STREAM5_CONFIG_REASS_CLIENT 0x00000008
};
/* D A T A S T R U C T U R E S **********************************/
-// FIXIT some of this stuff can be better encapsulated
+// FIXIT-L some of this stuff can be better encapsulated
struct Stream5GlobalConfig
{
// public methods other than ctor / dtor must all be declared SO_PUBLIC
//-------------------------------------------------------------------------
-Stream stream; // FIXIT global for SnortContext
+Stream stream; // FIXIT-L global for SnortContext
Stream::Stream()
{
Stream5SetExtraDataTcp(flow, p, flag);
}
-// FIXIT get pv/flow from packet directly?
+// FIXIT-L get pv/flow from packet directly?
void Stream::clear_extra_data(
Flow* pv, Packet* p, uint32_t flag)
{
* preprocessors and detection plugins.
*/
-// FIXIT stream_api should not be tied to a particular version of stream
+// FIXIT-L stream_api should not be tied to a particular version of stream
#ifndef STREAM_API_H
#define STREAM_API_H
static THREAD_LOCAL StreamBuffer str_buf;
uint32_t StreamSplitter::max()
-{ return 16384; } // FIXIT make default configurable
+{ return 16384; } // FIXIT-H make default configurable
const StreamBuffer* StreamSplitter::reassemble(
Flow*, unsigned, unsigned offset, const uint8_t* p,
}
#if 0
-// FIXIT this should be part of a new splitter
+// FIXIT-H this should be part of a new splitter
static inline int CheckFlushCoercion (
Packet* p, FlushMgr* fm, uint16_t flush_factor
) {
class Flow;
-enum PAF_Status // FIXIT move inside StreamSplitter
+enum PAF_Status // FIXIT-H move inside StreamSplitter
{
PAF_ABORT, // non-paf operation
PAF_START, // internal use only
}
else
{
- // FIXIT PAF need to instantiate atom splitter?
- // FIXIT PAF need to check for ips / on-data
+ // FIXIT-H PAF need to instantiate atom splitter?
+ // FIXIT-H PAF need to check for ips / on-data
if ( srod.direction & SSN_DIR_SERVER )
tcpssn->server.flush_policy = STREAM_FLPOLICY_ON_ACK;
// s5_len and s5_idx are used only during the
// lifetime of s5_paf_check()
-// FIXIT these thread local should be moved into thread context
+// FIXIT-L these thread local should be moved into thread context
static THREAD_LOCAL uint32_t s5_len; // total bytes queued
static THREAD_LOCAL uint32_t s5_idx; // offset from start of queued bytes
}
//--------------------------------------------------------------------
-// FIXIT PAF support multiple scanners
+// FIXIT-L PAF support multiple scanners
static bool s5_paf_callback (
StreamSplitter* ss, PAF_State* ps, Flow* ssn,
"%s: paf=%d, idx=%u, len=%u, fpt=%u\n",
__FUNCTION__, ps->paf, s5_idx, s5_len, ps->fpt);)
- uint16_t fuzz = 0; // FIXIT PAF add a little zippedy-do-dah
+ uint16_t fuzz = 0; // FIXIT-L PAF add a little zippedy-do-dah
switch ( ps->paf )
{
} while ( 1 );
- uint16_t fuzz = 0; // FIXIT PAF add a little zippedy-do-dah
+ uint16_t fuzz = 0; // FIXIT-L PAF add a little zippedy-do-dah
if ( (ps->paf != PAF_FLUSH) && (s5_len > ss->max()+fuzz) )
{
uint32_t fp = s5_paf_flush(ss, ps, FT_MAX, flags);
if ( st->flush_policy )
return ( SegsToFlush(st, 1) > 0 );
- return ( SegsToFlush(st, 2) > 1 ); // FIXIT return false?
+ return ( SegsToFlush(st, 2) > 1 ); // FIXIT-L return false?
}
/* P R O T O T Y P E S ********************************************/
}
//-------------------------------------------------------------------------
-// FIXIT directionality must be fixed per 297 bug fixes
+// FIXIT-L directionality must be fixed per 297 bug fixes
//
// when client ports are configured, that means c2s and is stored on the
// client side; when the session starts, the server policy is obtained from
if ( p->tcph->th_flags & TH_ACK &&
Normalize_IsEnabled(p, NORM_TCP_OPT) )
{
- // FIXIT validate tsecr here (check that it was previously sent)
+ // FIXIT-L validate tsecr here (check that it was previously sent)
// checking for the most recent ts is easy enough must check if
// ts are up to date in retransmitted packets
}
{
#if 0
if (
- // FIXIT these checks are a hack to avoid off by one normalization
+ // FIXIT-L these checks are a hack to avoid off by one normalization
// due to FIN ... if last segment filled a hole, r_nxt_ack is not at
// end of data, FIN is ignored so sequence isn't bumped, and this
// forces seq-- on ACK of FIN. :(
// if a gap exists prior to ack, move ack back to start of gap
StreamSegment* seg = snd->seglist;
- // FIXIT must check ack oob with empty seglist
- // FIXIT add lower gap bound to tracker for efficiency?
+ // FIXIT-L must check ack oob with empty seglist
+ // FIXIT-L add lower gap bound to tracker for efficiency?
while ( seg )
{
uint32_t seq = seg->seq + seg->size;
void tcp_sinit()
{
s5_pkt = PacketManager::encode_new();
- tcp_memcap = new Memcap(26214400); // FIXIT replace with session memcap
- //AtomSplitter::init(); // FIXIT PAF implement
+ tcp_memcap = new Memcap(26214400); // FIXIT-M replace with session memcap
+ //AtomSplitter::init(); // FIXIT-L PAF implement
}
void tcp_sterm()
// * we may flush partial segments
// * must adjust seq->seq and seg->size when a flush gets only the
// initial part of a segment
-// * FIXIT need flag to mark any reassembled packets that have a gap
+// * FIXIT-L need flag to mark any reassembled packets that have a gap
// (if we reassemble such)
static inline int purge_flushed_ackd (TcpSession *tcpssn, StreamTracker *st)
{
}
else if ( !bytes_copied )
{
- // FIXIT change stream splitter default reassemble
+ // FIXIT-P change stream splitter default reassemble
// to copy into external buffer to eliminate this special case
memcpy(flushbuf, ss->payload, bytes_to_copy);
}
break;
/* Check for a gap/missing packet */
- // FIXIT PAF should account for missing data and resume
+ // FIXIT-L PAF should account for missing data and resume
// scanning at the start of next PDU instead of aborting.
- // FIXIT FIN may be in toSeq causing bogus gap counts.
+ // FIXIT-L FIN may be in toSeq causing bogus gap counts.
if ( (ss->next && (ss->seq + ss->size != ss->next->seq)) ||
(!ss->next && (ss->seq + ss->size < toSeq)))
{
if ( !bytes && SEQ_GT(st->r_win_base, st->seglist_base_seq) )
bytes = st->r_win_base - st->seglist_base_seq;
- // FIXIT this should not be necessary here
+ // FIXIT-L this should not be necessary here
st->seglist_base_seq = st->seglist_next->seq;
stop_seq = st->seglist_base_seq + bytes;
return fp;
}
-// FIXIT get_q_sequenced() performance could possibly be
+// FIXIT-L get_q_sequenced() performance could possibly be
// boosted by tracking sequenced bytes as seglist is updated
// to avoid the while loop, etc. below.
static inline uint32_t get_q_sequenced(StreamTracker *st)
return flush_to_seq(tcpssn, st, bytes, p, dir);
}
-// FIXIT flush_stream() calls should be replaced with calls to
+// FIXIT-L flush_stream() calls should be replaced with calls to
// CheckFlushPolicyOn*() with the exception that for the *OnAck() case,
// any available ackd data must be flushed in both directions.
static inline int flush_stream(
#define LCL(p, x) (p->x - p->isn)
#define RMT(p, x, q) (p->x - (q ? q->isn : 0))
-// FIXIT this should not be thread specific
+// FIXIT-L this should not be thread specific
static THREAD_LOCAL int s5_trace_enabled = -1;
static void TraceEvent (
}
/* move the ack boundry up, this is the only way we'll accept data */
- // FIXIT for ips, must move all the way to first hole or right end
+ // FIXIT-L for ips, must move all the way to first hole or right end
if (listener->s_mgr.state_queue == TCP_STATE_NONE)
listener->r_nxt_ack = tdb->end_seq;
{
/* set next ack so we are within the window going forward on
* this side. */
- // FIXIT for ips, must move all the way to first hole or right end
+ // FIXIT-L for ips, must move all the way to first hole or right end
listener->r_nxt_ack = tdb->end_seq;
}
}
/* Set the StreamTcpConfig for each direction (pkt from client) */
- tmp->client.config = dstPolicy; // FIXIT BINDING use external for both dirs
+ tmp->client.config = dstPolicy; // FIXIT-H BINDING use external for both dirs
tmp->server.config = dstPolicy;
CopyMacAddr(p, tmp, FROM_CLIENT);
tmp->server.flags |= Stream5GetWscale(p, &tmp->server.wscale);
/* Set the config for each direction (pkt from server) */
- tmp->server.config = dstPolicy; // FIXIT BINDING use external for both dirs
+ tmp->server.config = dstPolicy; // FIXIT-H BINDING use external for both dirs
tmp->client.config = dstPolicy;
CopyMacAddr(p, tmp, FROM_SERVER);
tmp->client.flags |= Stream5GetWscale(p, &tmp->client.wscale);
/* Set the config for each direction (pkt from client) */
- tmp->client.config = dstPolicy; // FIXIT BINDING use external for both dirs
+ tmp->client.config = dstPolicy; // FIXIT-H BINDING use external for both dirs
tmp->server.config = dstPolicy;
CopyMacAddr(p, tmp, FROM_CLIENT);
tmp->client.flags |= Stream5GetWscale(p, &tmp->client.wscale);
/* Set the config for each direction (pkt from client) */
- tmp->client.config = dstPolicy; // FIXIT BINDING use external for both dirs
+ tmp->client.config = dstPolicy; // FIXIT-H BINDING use external for both dirs
tmp->server.config = dstPolicy;
CopyMacAddr(p, tmp, FROM_CLIENT);
tmp->server.flags |= Stream5GetWscale(p, &tmp->server.wscale);
/* Set the config for each direction (pkt from server) */
- tmp->server.config = dstPolicy; // FIXIT BINDING use external for both dirs
+ tmp->server.config = dstPolicy; // FIXIT-H BINDING use external for both dirs
tmp->client.config = dstPolicy;
CopyMacAddr(p, tmp, FROM_SERVER);
if ( !tcpssn->tcp_init )
{
{
- // FIXIT expected flow should be checked by flow_con before we
+ // FIXIT-L expected flow should be checked by flow_con before we
// get here
char ignore = flow_con->expected_flow(lwssn, p);
"Got SYN pkt on reset ssn, re-SYN-ing\n"););
}
- // FIXIT why flush here instead of just purge?
+ // FIXIT-L why flush here instead of just purge?
// s5_ignored_session() may be disabling detection too soon if we really want to flush
if ( stream.ignored_session(lwssn, p) )
{
}
if ( lwssn->s5_state.session_flags & SSNFLAG_MIDSTREAM )
{
- // FIXIT this should be handled below in fin section
+ // FIXIT-L this should be handled below in fin section
// but midstream sessions fail the seq test
listener->s_mgr.state_queue = TCP_STATE_TIME_WAIT;
listener->s_mgr.transition_seq = tdb->end_seq;
break;
default:
- // FIXIT safe to ignore when inline?
+ // FIXIT-L safe to ignore when inline?
break;
}
}
if(flushed)
{
- // FIXIT - these calls redundant?
+ // FIXIT-L - these calls redundant?
purge_alerts(talker, talker->r_win_base, tcpssn->flow);
purge_to_seq(tcpssn, talker, talker->seglist->seq + flushed);
}
while ( flush_amt > 0 )
{
#if 0
- // FIXIT can't do this with new HI - copy is inevitable
+ // FIXIT-P can't do this with new HI - copy is inevitable
// if this payload is exactly one pdu, don't
// actually flush, just use the raw packet
if ( (tdb->seq == listener->seglist->seq) &&
}
if ( !flags && listener->splitter->is_paf() )
{
- // FIXIT PAF auto disable with multiple splitters?
+ // FIXIT-L PAF auto disable with multiple splitters?
//if ( AutoDisable(listener, talker) )
// return 0;
}
if ( !flags && talker->splitter->is_paf() )
{
- // FIXIT PAF auto disable with multiple splitters?
+ // FIXIT-L PAF auto disable with multiple splitters?
//if ( AutoDisable(talker, listener) )
// return 0;
{
if ( TCP_ISFLAGSET(p->tcph, TH_SYN) &&
!TCP_ISFLAGSET(p->tcph, TH_ACK) )
- flow->session_state = STREAM5_STATE_SYN; // FIXIT same as line 4555
+ flow->session_state = STREAM5_STATE_SYN; // FIXIT-L same as line 4555
assert(flow->session == this);
reset();
return true;
}
-// FIXIT diff betw TcpSessionCleanup() and TcpSessionClear() ?
+// FIXIT-L diff betw TcpSessionCleanup() and TcpSessionClear() ?
// Cleanup() flushes data; Clear() does not flush data
void TcpSession::cleanup()
{
TcpSessionCleanup(flow, 1);
}
-// FIXIT this was originally called by Stream::drop_packet()
+// FIXIT-L this was originally called by Stream::drop_packet()
// which is now calling Session::clear()
void TcpSession::clear()
{
!TCP_ISFLAGSET(p->tcph, TH_ACK))
{
/* SYN only */
- flow->session_state = STREAM5_STATE_SYN; // FIXIT same as line 4511
+ flow->session_state = STREAM5_STATE_SYN; // FIXIT-L same as line 4511
}
else
{
StreamSegment *seglist; /* first queued segment */
StreamSegment *seglist_tail; /* last queued segment */
- // FIXIT seglist_base_seq is the sequence number to flush from
+ // FIXIT-P seglist_base_seq is the sequence number to flush from
// and is valid even when seglist is empty. seglist_next is
// the segment to flush from and is set per packet. should keep
// up to date.
};
-// FIXIT ideally, session tracking would be split from reassembly
+// FIXIT-L ideally, session tracking would be split from reassembly
// into a separate module a la ip_session.cc and ip_defrag.cc
// (of course defrag should also be cleaned up)
class TcpSession : public Session
static int ProcessUdp(
Flow *lwssn, Packet *p, StreamUdpConfig*, SFXHASH_NODE*)
{
- if (lwssn->protocol != IPPROTO_UDP) // FIXIT checked by tcp, icmp, and ip too?
- // FIXIT need to free lwssn and get a new one
+ if (lwssn->protocol != IPPROTO_UDP) // FIXIT-P checked by tcp, icmp, and ip too?
+ // FIXIT-L need to free lwssn and get a new one
{
DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
"Lightweight session not UDP on UDP packet\n"););
#if 0
void udp_stats()
{
- // FIXIT need to get these before delete flow_con
+ // FIXIT-L need to get these before delete flow_con
//flow_con->get_prunes(IPPROTO_UDP, udpStats.prunes);
}
#endif
{
/* Add 1 to max for table purposes
* We use max_hosts to limit memcap, assume 16k per entry costs*/
- // FIXIT 16k per host is no longer true
- // FIXIT init before snort_conf; move to filename and load separately
+ // FIXIT-M 16k per host is no longer true
+ // FIXIT-M init before snort_conf; move to filename and load separately
// this is a hack to get it going
uint32_t max = snort_conf ? ScMaxAttrHosts() : DEFAULT_MAX_ATTRIBUTE_HOSTS;
lookupTable = sfrt_new(DIR_8x16, IPv6, max + 1, (max>>6) + 1);
static THREAD_LOCAL tTargetBasedConfig* curr_cfg = NULL;
static tTargetBasedConfig* next_cfg = NULL;
-// FIXIT ensure these are not used by packet threads
+// FIXIT-H ensure these are not used by packet threads
static HostAttributeEntry *current_host = NULL;
static ApplicationEntry *current_app = NULL;
} ppm_rules_t;
/* suspended rules */
-// FIXIT storing rule tree pointers is a bad idea
+// FIXIT-L storing rule tree pointers is a bad idea
// - no accommodation for reload
// - really not used except to log
// - should be deleted
static THREAD_LOCAL int ppm_n_rules;
/* cleared rules - re-enabled */
-// FIXIT see above re storing rule tree pointers
+// FIXIT-L see above re storing rule tree pointers
static THREAD_LOCAL detection_option_tree_root_t * ppm_crules[MAX_DP_NRULES];
static THREAD_LOCAL int ppm_n_crules;
return 0;
}
-// FIXIT ppm_stats should be rolled into ppm module
+// FIXIT-L ppm_stats should be rolled into ppm module
// (not just peg counts; need module support)
void ppm_sum_stats()
if (numToPrint != -1)
{
- // FIXIT this is fugly; should have a LogMessage() type "file" within
+ // FIXIT-L this is fugly; should have a LogMessage() type "file" within
// TextLog so this if (log) TextLog_Print() else LogMessage() isn't
// necessary.
if(log)
/**Number of additional policies allocated with each re-alloc operation. */
#define POLICY_ALLOCATION_CHUNK 10
-// FIXIT replace with vector
+// FIXIT-L replace with vector
int sfDynArrayCheckBounds (
void ** dynArray,
unsigned int index,
* 0 value means no elements are allocated
* and therefore dynArray[0] will cause memory allocation.
*/
-int sfDynArrayCheckBounds ( // FIXIT replace with std::vector
+int sfDynArrayCheckBounds (
void** dynArray, unsigned int index, unsigned int *maxElements);
#endif
#include "snort_types.h"
#ifndef SIZE_MAX
-#define SIZE_MAX 0xFFFFFFFF // FIXIT use c++ value
+#define SIZE_MAX 0xFFFFFFFF // FIXIT-L use c++ value
#endif
/*point to the start of the unused memory*/
// ensure proper counting of log_limit
SnortEventqResetCounts();
- // FIXIT alert_pkts excludes rep hits
+ // FIXIT-L alert_pkts excludes rep hits
if ( gpc.total_alert_pkts == gpc.alert_pkts )
gpc.total_alert_pkts = 0;
DropStats();
timing_stats();
- // FIXIT below stats need to be made consistent with above
+ // FIXIT-L below stats need to be made consistent with above
fpShowEventStats(snort_conf);
print_thresholding(snort_conf->threshold_config, 1);
if ( pv )
return pv;
- // FIXIT do not FatalError() on runtime allocation failures
+ // FIXIT-M do not FatalError() on runtime allocation failures
FatalError("Unable to allocate memory! (%lu requested)\n", size);
return NULL;
// reentrant.
char* get_tok(char* s, const char* delim);
-/* for getopt */
-extern char *optarg; // FIXIT add header
-extern int optind;
-extern int opterr;
-extern int optopt;
-
#endif /*__UTIL_H__*/
projects / thirdparty / snort3.git / commitdiff
