basic reload restoration

diff --git a/ChangeLog b/ChangeLog
index 4e036ce380f733200cb2bd16add0259987fd9ab3..79c272dace1db9ce61e2d3324779bf8ce8166015 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,6 @@
 121
 -- valgrind fixes
+-- basic reload restoration
 
 120
 -- tweaked --help!

diff --git a/src/detection/fpcreate.cc b/src/detection/fpcreate.cc
index 9a7cdb8501b68ea47ea7009b60383e90d0ba880f..5f361662c3aaed07ef06d34931e06243950d23f4 100644 (file)
--- a/src/detection/fpcreate.cc
+++ b/src/detection/fpcreate.cc
@@ -2220,29 +2220,29 @@ void fpBuildServicePortGroups(
                     FatalError("Could not AddProtocolReference!\n");
 
                 else if( id >= MAX_PROTOCOL_ORDINAL )
-                    LogMessage("protocol-ordinal=%d exceeds "
+                    ParseWarning("protocol-ordinal=%d exceeds "
                         "limit of %d for service=%s\n",id,MAX_PROTOCOL_ORDINAL,srvc);
             }
             else if( id > 0 )
             {
                 if( id < MAX_PROTOCOL_ORDINAL )
                 {
-                    LogMessage("adding protocol-ordinal=%d as service=%s\n",id,srvc);
+                    //LogMessage("adding protocol-ordinal=%d as service=%s\n",id,srvc);
                     sopg[ id ] = pg;
                 }
                 else
-                    LogMessage("protocol-ordinal=%d exceeds "
+                    ParseError("protocol-ordinal=%d exceeds "
                         "limit of %d for service=%s\n",id,MAX_PROTOCOL_ORDINAL,srvc);
             }
             else /* id < 0 */
             {
-                LogMessage("adding protocol-ordinal=%d for "
+                ParseError("adding protocol-ordinal=%d for "
                     "service=%s, can't use that !!!\n",id,srvc);
             }
         }
         else
         {
-            LogMessage("*** failed to create and find a port group for '%s' !!! \n",srvc );
+            ParseError("*** failed to create and find a port group for '%s' !!! \n",srvc );
         }
     }
 }

diff --git a/src/detection/treenodes.cc b/src/detection/treenodes.cc
index ab07fa05fdde418390c531fdc5776259151bdbfb..e3a025090a24ce3275c71837cfdd7b320fd71f89 100644 (file)
--- a/src/detection/treenodes.cc
+++ b/src/detection/treenodes.cc
@@ -118,14 +118,13 @@ void* get_rule_type_data(OptTreeNode* otn, const char* name)
 
     while ( fpl )
     {
-        if ( !fpl->context )
-            continue;
-
-        IpsOption* opt = (IpsOption*)fpl->context;
-
-        if ( !strcmp(opt->get_name(), name) )
-            return fpl->context;
+        if ( fpl->context )
+        {
+            IpsOption* opt = (IpsOption*)fpl->context;
 
+            if ( !strcmp(opt->get_name(), name) )
+                return fpl->context;
+        }
         fpl = fpl->next;
     }
     return nullptr;

diff --git a/src/main/analyzer.cc b/src/main/analyzer.cc
index 0020245b2a8689e212bef3ed6f2524e729205125..fcca76daa06955348862fb578ad32f4862df9aff 100644 (file)
--- a/src/main/analyzer.cc
+++ b/src/main/analyzer.cc
@@ -71,6 +71,7 @@ bool Analyzer::execute(AnalyzerCommand ac)
     // FIXIT-L executing a command while paused
     // will cause a resume
     command = ac;
+    take_break();
     return true;
 }
 
@@ -131,7 +132,7 @@ void Analyzer::analyze()
         if ( DAQ_Acquire(0, main_func, NULL) )
             break;
 
-        // FIXIT-M acquire(0) won't return until no packets, signal, etc.
+        // FIXIT-L acquire(0) won't return until no packets, signal, etc.
         // which makes this idle unlikely to execute under high traffic 
         // conditions; that means the idle processing may not be useful
         // or that we need a hook to do things periodically even when

diff --git a/src/main/analyzer.h b/src/main/analyzer.h
index 3351ac2eb2e7fa45cab5ba669936ce1d350a66ea..773e25048fa9697497b1e686d5ab4d1a40b65957 100644 (file)
--- a/src/main/analyzer.h
+++ b/src/main/analyzer.h
@@ -50,7 +50,7 @@ public:
     bool execute(AnalyzerCommand);
 
     void set_config(Swapper* ps) { swap = ps; };
-    bool swap_pending() { return swap != nullptr; };
+    bool swap_pending() { return command == AC_SWAP; };
 
 private:
     void analyze();

diff --git a/src/main/snort.cc b/src/main/snort.cc
index e1087ec9be8f2112adc8c4353dbc6c0548e0bf4b..12274bbc460cc70f65eb94294dfe3f6023fbb9cb 100644 (file)
--- a/src/main/snort.cc
+++ b/src/main/snort.cc
@@ -343,18 +343,19 @@ static void SnortInit(int argc, char **argv)
      */
     SetRuleStates(snort_conf);
 
-    /* Need to do this after dynamic detection stuff is initialized, too */
-    IpsManager::verify(snort_conf);
-
     if (snort_conf->file_mask != 0)
         umask(snort_conf->file_mask);
     else
         umask(077);    /* set default to be sane */
 
+    /* Need to do this after dynamic detection stuff is initialized, too */
+    IpsManager::verify(snort_conf);
     IpsManager::global_init(snort_conf);
+    ModuleManager::load_commands(snort_conf);
 
     fpCreateFastPacketDetection(snort_conf);
     MpseManager::activate_search_engine(snort_conf);
+
     CodecManager::instantiate();
     SFAT_Start();
 
@@ -604,6 +605,7 @@ static SnortConfig * get_reload_config(void)
 
     /* Need to do this after dynamic detection stuff is initialized, too */
     IpsManager::verify(sc);
+    ModuleManager::load_commands(snort_conf);
 
     if ((sc->file_mask != 0) && (sc->file_mask != snort_conf->file_mask))
         umask(sc->file_mask);
@@ -896,6 +898,9 @@ DAQ_Verdict packet_callback(
     if ( snort_conf->pkt_cnt && pc.total_from_daq >= snort_conf->pkt_cnt )
         DAQ_BreakLoop(-1);
 
+    if ( break_time() )
+        DAQ_BreakLoop(0);
+
     MODULE_PROFILE_END(totalPerfStats);
     return verdict;
 }

diff --git a/src/main/thread.cc b/src/main/thread.cc
index 72737c9d5eb75014769bfadc7657028121570bad..dfce671f1a33446f58a33d98f381efade981bf99 100644 (file)
--- a/src/main/thread.cc
+++ b/src/main/thread.cc
@@ -56,6 +56,25 @@ unsigned get_instance_max()
     return instance_max;
 }
 
+//-------------------------------------------------------------------------
+// union rules
+//-------------------------------------------------------------------------
+
+static unsigned g_breaks = 0;
+static THREAD_LOCAL unsigned t_breaks = 0;
+
+void take_break()
+{ g_breaks++; }
+
+bool break_time()
+{
+    if ( t_breaks == g_breaks )
+        return false;
+
+    t_breaks = g_breaks;
+    return true;
+}
+
 //-------------------------------------------------------------------------
 // format is:
 //     <logdir>/[<run_prefix>][<id#>][<X>]<name>

diff --git a/src/main/thread.h b/src/main/thread.h
index ebfa1aac94fc312539ff59678042bacedac4932d..87d4100ebedaa7268a44e351a52e35c4204c3129 100644 (file)
--- a/src/main/thread.h
+++ b/src/main/thread.h
@@ -43,5 +43,8 @@ SO_PUBLIC unsigned get_instance_max();
 
 SO_PUBLIC const char* get_instance_file(std::string&, const char* name);
 
+void take_break();
+bool break_time();
+
 #endif
 

diff --git a/src/managers/action_manager.cc b/src/managers/action_manager.cc
index cb67d2ae506f1ecc9ff29f6d19f7a6d03bbd6e10..a5fd001b759c217c1bc3b83aa2ce2ef828023214 100644 (file)
--- a/src/managers/action_manager.cc
+++ b/src/managers/action_manager.cc
@@ -37,7 +37,7 @@ using namespace std;
 struct Actor
 {
     const ActionApi* api;
-    IpsAction* act;
+    IpsAction* act;  // FIXIT-H must move to SnortConfig for reload?
 
     Actor(const ActionApi* p)
     { api = p; act = nullptr; };
@@ -80,7 +80,7 @@ static void store(const ActionApi* api, IpsAction* act)
     for ( auto& p : s_actors )
         if ( p.api == api )
         {
-            assert(!p.act);
+            //assert(!p.act);  FIXIT-H memory leak on reload
             p.act = act;
             break;
         }

diff --git a/src/managers/data_manager.cc b/src/managers/data_manager.cc
index 3170996b9e9fc29f367db04408f302239c37525f..2de9c5b4208f46ab59dcf7eb355df7700d0bef16 100644 (file)
--- a/src/managers/data_manager.cc
+++ b/src/managers/data_manager.cc
@@ -31,6 +31,8 @@ using namespace std;
 struct DataBlock
 {
     const DataApi* api;
+
+    // FIXIT-H move data to snort config for reload
     PlugData* data;
 
     DataBlock(const DataApi* p)
@@ -120,7 +122,11 @@ PlugData* DataManager::acquire(const char* key, SnortConfig* sc)
 void DataManager::release(PlugData* p)
 {
     DataBlock* b = get_data(p);
-    assert(b && b->data);
+
+    // FIXIT-H this implementation can't reload
+    //assert(b && b->data);
+    if ( !b )
+        return;
 
     b->data->rem_ref();
 

diff --git a/src/managers/module_manager.cc b/src/managers/module_manager.cc
index deab6b13b66465edd4e639d7bd286692b9dc4562..84022138d072c6a48597a65148bc3fd9d1a4096e 100644 (file)
--- a/src/managers/module_manager.cc
+++ b/src/managers/module_manager.cc
@@ -438,12 +438,6 @@ void ModuleManager::add_module(Module* m, const BaseApi* b)
     ModHook* mh = new ModHook(m, b);
     s_modules.push_back(mh);
 
-    if ( mh->reg )
-    {
-        SnortConfig* sc = snort_conf;
-        sc->policy_map->get_shell()->install(m->get_name(), mh->reg);
-    }
-
 #ifdef PERF_PROFILING
     RegisterProfile(m);
 #endif
@@ -712,6 +706,19 @@ void ModuleManager::show_rules(const char* pfx)
     }    
 }
 
+void ModuleManager::load_commands(SnortConfig* sc)
+{
+    // FIXIT-L ideally only install commands from configured modules
+    // FIXIT-L install commands into working shell
+    Shell* sh = sc->policy_map->get_shell();
+
+    for ( auto p : s_modules )
+    {
+        if ( p->reg )
+            sh->install(p->mod->get_name(), p->reg);
+    }
+}
+
 // FIXIT-L currently no way to know whether a module was activated or not
 // so modules with common rules will cause duplicate sid warnings
 // eg http_inspect and nhttp_inspect both have 119:1-34

diff --git a/src/managers/module_manager.h b/src/managers/module_manager.h
index 67a38a4f2a32b6e2b5f99ec1deacc9fe550e07f7..9e6b39a970fb403d373ce570077c690180992479 100644 (file)
--- a/src/managers/module_manager.h
+++ b/src/managers/module_manager.h
@@ -47,6 +47,7 @@ public:
     static void show_rules(const char* = nullptr);
     static void dump_rules(const char* = nullptr);
 
+    static void load_commands(SnortConfig*);
     static void load_rules(SnortConfig*);
     static void set_config(SnortConfig*);
     static unsigned get_errors();

diff --git a/src/network_inspectors/arp_spoof/arp_module.cc b/src/network_inspectors/arp_spoof/arp_module.cc
index f5c4bc6ab0a83e32d108faa3b36fccf28369be4c..ed09532fd3d4be98527533239ca57c2cabf79184 100644 (file)
--- a/src/network_inspectors/arp_spoof/arp_module.cc
+++ b/src/network_inspectors/arp_spoof/arp_module.cc
@@ -79,8 +79,7 @@ static const RuleMap s_rules[] =
 ArpSpoofModule::ArpSpoofModule() : 
     Module(MOD_NAME, MOD_HELP, s_params)
 {
-    config = new ArpSpoofConfig;
-    config->check_overwrite = false;
+    config = nullptr;
 }
 
 ArpSpoofModule::~ArpSpoofModule()
@@ -109,8 +108,20 @@ bool ArpSpoofModule::set(const char*, Value& v, SnortConfig*)
     return true;
 }
 
+ArpSpoofConfig* ArpSpoofModule::get_config()
+{
+    ArpSpoofConfig* temp = config;
+    config = nullptr;
+    return temp;
+}
+
 bool ArpSpoofModule::begin(const char*, int, SnortConfig*)
 {
+    if ( !config )
+    {
+        config = new ArpSpoofConfig;
+        config->check_overwrite = false;
+    }
     memset(&host, 0, sizeof(host));
     return true;
 }

diff --git a/src/network_inspectors/arp_spoof/arp_module.h b/src/network_inspectors/arp_spoof/arp_module.h
index f060ce88c364495574e53063b8ec578e6f51712f..df1e94608201c37bc8d89ced6e026caae788ea55 100644 (file)
--- a/src/network_inspectors/arp_spoof/arp_module.h
+++ b/src/network_inspectors/arp_spoof/arp_module.h
@@ -65,12 +65,7 @@ public:
     bool begin(const char*, int, SnortConfig*);
     bool end(const char*, int, SnortConfig*);
 
-    ArpSpoofConfig* get_config()
-    {
-        ArpSpoofConfig* temp = config;
-        config = nullptr;
-        return temp;
-    };
+    ArpSpoofConfig* get_config();
 
     const char** get_pegs() const;
     PegCount* get_counts() const;

diff --git a/src/packet_io/sfdaq.cc b/src/packet_io/sfdaq.cc
index b6812862948e48b056754639969b75db605b9d3b..7ac9065cb96446f835592a341b42116b064cae82 100644 (file)
--- a/src/packet_io/sfdaq.cc
+++ b/src/packet_io/sfdaq.cc
@@ -1,6 +1,6 @@
 /****************************************************************************
  *
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+ * Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
  * Copyright (C) 2005-2013 Sourcefire, Inc.
  *
  * This program is free software; you can redistribute it and/or modify

diff --git a/src/target_based/sftarget_reader.cc b/src/target_based/sftarget_reader.cc
index 23153133c09779e9107ca5762ca90ba3dc0244af..291a9fd602d87f7bb0327ce694f4ca6394d6844e 100644 (file)
--- a/src/target_based/sftarget_reader.cc
+++ b/src/target_based/sftarget_reader.cc
@@ -381,10 +381,10 @@ tTargetBasedConfig* SFAT_Swap()
 
 int IsAdaptiveConfigured()
 {
-    if ( !curr_cfg )
-        return 0;
+    if ( curr_cfg || next_cfg )
+        return 1;
 
-    return 1;
+    return 0;
 }
 
 void SFAT_UpdateApplicationProtocol(sfip_t *ipAddr, uint16_t port, uint16_t protocol, uint16_t id)