documentation for cmake and plugins

diff --git a/doc/Makefile.am b/doc/Makefile.am
index 9c571e7bd3ae7c9be6e346989265e0cee0d90a27..49b665344902b1f23092ea372646eb2227bed3f2 100644 (file)
--- a/doc/Makefile.am
+++ b/doc/Makefile.am
@@ -13,6 +13,7 @@ version.txt
 unbuilt_sources = \
 snort_manual.txt \
 differences.txt \
+plugins.txt \
 style.txt \
 tips.txt \
 images/snort.png

diff --git a/doc/plugins.txt b/doc/plugins.txt
new file mode 100644 (file)
index 0000000..fe5bb2a
--- /dev/null
+++ b/doc/plugins.txt
@@ -0,0 +1,61 @@
+Snort++ uses a variety of plugins to accomplish much of its processing
+objectives, including:
+
+* Codec - to decode and encode packets
+* Inspector - like the prior preprocessors, for normalization, etc.
+* IpsOption - for detection in Snort++ rules
+* Logger - for handling events
+* Mpse - for fast pattern matching
+* So - for dynamic rules
+
+Additional plugins, like rule actions, are planned.
+
+Plugins have an associated API defined for each type, all of which share a
+common 'header', called the BaseApi.  A dynamic library makes its plugins
+available by exporting the snort_plugins symbol, which is a null terminated
+array of BaseApi pointers.
+
+The BaseApi includes type, name, API version, plugin version, and function
+pointers for constructing and destructing a Module.  The specific API add
+various other data and functions for their given roles.
+
+The Module is pervasive in Snort\+\+.  It is how everything, including
+plugins, are configured.  It also provides access to builtin rules.  And as
+the glue that binds functionality to Snort++, the capabilities of a Module
+are expected to grow to include statistics support, etc.
+
+Module configuration is handled by a list of Parameters.  Most parameters
+can be validated by the framework, which means that conversion from string
+to number is done in exactly one place.  Providing the builtin rules allows
+the documenation to include them automatically and it allows for
+autogenerating the rules at startup.
+
+If we are defining a new Inspector called gadget, it might be configured in
+snort.lua like this:
+
+gadget =
+{
+    brain = true,
+    claw = 3
+}
+
+When the gadget table is processed, Snort++ will look for a module called
+gadget.  If that Module has an associated API, it will be used to configure
+a new instance of the plugin.  In this case, a GadgetModule would be
+instantiated, brain and claw would be set, and the Module instance would be
+passed to the GadgetInspector constructor.
+
+The user may have configured gadget like this:
+
+gadget = { }
+
+among other ways.  The Module::begin() and ::end() methods are used to
+allocate required data structures and properly initialize defaults and to
+do integrity checks of related parameters.  The working paradigm is that
+Module hands the configured data to the plugin instance which takes
+ownership.
+
+Note that there is at most one instance of a given Module, even if multiple
+plugin instances are created which use that Module.  (Multiple instances
+require Snort++ binding configurations not yet implemented.)
+

diff --git a/doc/snort_manual.txt b/doc/snort_manual.txt
index 7eeb000bea5b5d14a81da61e2b7880f115f07859..2811aa639d43f95971dfde23ec64b38c36f173eb 100644 (file)
--- a/doc/snort_manual.txt
+++ b/doc/snort_manual.txt
@@ -38,6 +38,10 @@ include::builtin.txt[]
 
 include::commands.txt[]
 
+== Plugins
+
+include::plugins.txt[]
+
 == Coding Style
 
 include::style.txt[]

diff --git a/doc/tips.txt b/doc/tips.txt
index dffec14189702918063712afbc96c80dd6b1cc58..8bb9f3d79dce24677aeff77257a4a4f35069bd35 100644 (file)
--- a/doc/tips.txt
+++ b/doc/tips.txt
@@ -27,6 +27,23 @@ The following pointers will help you get started:
 * if you want to build the documentation, you will need to install
   asciidoc.  you will also need dblatex to build the pdf manual.
 
+* to build with cmake and make, first create a separate directory for the
+  build and cd into that directory.  then:
+
+    cd Snort++
+    mkdir Cbuild
+    cd Cbuild
+    ccmake
+    cmake ..
+
+* build with Xcode, do this:
+
+    cd Snort++
+    mkdir Xcode
+    cd Xcode
+    cmake .. -G Xcode -DCMAKE_INSTALL_PREFIX=/path/to/install
+    open snort.xcodeproj
+
 === Using Lua
 
 * Snort++ needs a lua conf.  use $install_dir/conf/snort.lua, like -c

diff --git a/src/managers/ips_manager.cc b/src/managers/ips_manager.cc
index cd8970b387ab27521fd61caa99e7fc10213f24f9..74daa1e86e76c4cbfb0910062680d92e91ca8781 100644 (file)
--- a/src/managers/ips_manager.cc
+++ b/src/managers/ips_manager.cc
@@ -282,12 +282,12 @@ const char* IpsManager::get_so_options(const char* soid)
     if ( !rule )
         return nullptr;
 
-    // FIXIT this approach won't tolerate spaces and might get fooled by
-    // matching content (should it precede this)
-    // FIXIT need to deobfuscate here
+    // FIXIT this approach won't tolerate spaces and might get
+    // fooled by matching content (should it precede this)
     char opt[32];
     snprintf(opt, sizeof(opt), "; soid:%s", soid);
     const char* s = strstr(rule, opt);
+
     return s ? s + strlen(opt) : nullptr;
 }