Merge pull request #803 in SNORT/snort3 from rna_config_ifdef to master

Squashed commit of the following:

commit a93cbfe4df5a29411d790c873862a8e2df997c60
Author: Michael Altizer <mialtize@cisco.com>
Date:   Mon Feb 6 13:30:54 2017 -0500

    appid: Complete the removal of RNA config and network lists for now

diff --git a/src/network_inspectors/appid/appid_config.cc b/src/network_inspectors/appid/appid_config.cc
index c0997038018994d096321f7f99290388b2f0ced4..edb2ba240bb5d220269a52aacc01e374e69bea93 100644 (file)
--- a/src/network_inspectors/appid/appid_config.cc
+++ b/src/network_inspectors/appid/appid_config.cc
@@ -33,7 +33,9 @@
 
 #include "app_info_table.h"
 #include "appid_utils/appid_utils.h"
+#ifdef USE_RNA_CONFIG
 #include "appid_utils/network_set.h"
+#endif
 #include "service_plugins/service_base.h"
 
 #define ODP_PORT_DETECTORS "odp/port/*"
@@ -71,8 +73,10 @@ AppIdModuleConfig::~AppIdModuleConfig()
 AppIdConfig::AppIdConfig( AppIdModuleConfig* config )
      : mod_config( config ), app_info_mgr(AppInfoManager::get_instance())
 {
+#ifdef USE_RNA_CONFIG
     for( unsigned i = 0; i < MAX_ZONES; i++ )
         net_list_by_zone[ i ] = nullptr;
+#endif
 
     for( unsigned i = 0; i < 65535; i++ )
     {
@@ -755,12 +759,14 @@ void AppIdConfig::cleanup()
 
     app_info_mgr.cleanup_appid_info_table();
 
+#ifdef USE_RNA_CONFIG
     NetworkSet* net_list;          ///< list of network sets
     while ((net_list = net_list_list))
     {
         net_list_list = net_list->next;
         NetworkSetManager::destroy(net_list);
     }
+#endif
 
     free_port_exclusion_list(tcp_port_exclusions_src);
     free_port_exclusion_list(tcp_port_exclusions_dst);
@@ -795,75 +801,75 @@ static void display_port_exclusion_list(SF_LIST* pe_list, uint16_t port)
 void AppIdConfig::show()
 {
     unsigned i;
-    int j;
+
+    if (mod_config->thirdparty_appid_dir)
+        LogMessage("    3rd Party Dir: %s\n", mod_config->thirdparty_appid_dir);
+
+#ifdef USE_RNA_CONFIG
     struct in_addr ia;
+    NSIPv6Addr six;
     char inet_buffer[INET6_ADDRSTRLEN];
     char inet_buffer2[INET6_ADDRSTRLEN];
-    NSIPv6Addr six;
     const char* p;
     const char* p2;
-    NetworkSet* my_net_list;
 
-    if (mod_config->thirdparty_appid_dir)
-        LogMessage("    3rd Party Dir: %s\n", mod_config->thirdparty_appid_dir);
-
-    my_net_list = net_list;
     LogMessage("    Monitoring Networks for any zone:\n");
-    for (i = 0; i < my_net_list->count; i++)
+    for (i = 0; i < net_list->count; i++)
     {
-        ia.s_addr = htonl(my_net_list->pnetwork[i]->range_min);
+        ia.s_addr = htonl(net_list->pnetwork[i]->range_min);
         p = inet_ntop(AF_INET, &ia, inet_buffer, sizeof(inet_buffer));
-        ia.s_addr = htonl(my_net_list->pnetwork[i]->range_max);
+        ia.s_addr = htonl(net_list->pnetwork[i]->range_max);
         p2 = inet_ntop(AF_INET, &ia, inet_buffer2, sizeof(inet_buffer2));
-        LogMessage("        %s%s-%s %04X\n", (my_net_list->pnetwork[i]->info.ip_not) ? "!" : "",
+        LogMessage("        %s%s-%s %04X\n", (net_list->pnetwork[i]->info.ip_not) ? "!" : "",
             p ?
             p : "ERROR",
-            p2 ? p2 : "ERROR", my_net_list->pnetwork[i]->info.type);
+            p2 ? p2 : "ERROR", net_list->pnetwork[i]->info.type);
     }
-    for (i = 0; i < my_net_list->count6; i++)
+    for (i = 0; i < net_list->count6; i++)
     {
-        six = my_net_list->pnetwork6[i]->range_min;
+        six = net_list->pnetwork6[i]->range_min;
         NetworkSetManager::ntoh_ipv6(&six);
         p = inet_ntop(AF_INET6, (struct in6_addr*)&six, inet_buffer, sizeof(inet_buffer));
-        six = my_net_list->pnetwork6[i]->range_max;
+        six = net_list->pnetwork6[i]->range_max;
         NetworkSetManager::ntoh_ipv6(&six);
         p2 = inet_ntop(AF_INET6, (struct in6_addr*)&six, inet_buffer2, sizeof(inet_buffer2));
-        LogMessage("        %s%s-%s %04X\n", (my_net_list->pnetwork6[i]->info.ip_not) ? "!" : "",
+        LogMessage("        %s%s-%s %04X\n", (net_list->pnetwork6[i]->info.ip_not) ? "!" : "",
             p ?
             p : "ERROR",
-            p2 ? p2 : "ERROR", my_net_list->pnetwork6[i]->info.type);
+            p2 ? p2 : "ERROR", net_list->pnetwork6[i]->info.type);
     }
 
-    for (j=0; j < MAX_ZONES; j++)
+    for (int j = 0; j < MAX_ZONES; j++)
     {
-        if (!(my_net_list = net_list_by_zone[j]))
+        if (!(net_list = net_list_by_zone[j]))
             continue;
         LogMessage("    Monitoring Networks for zone %d:\n", j);
-        for (i = 0; i < my_net_list->count; i++)
+        for (i = 0; i < net_list->count; i++)
         {
-            ia.s_addr = htonl(my_net_list->pnetwork[i]->range_min);
+            ia.s_addr = htonl(net_list->pnetwork[i]->range_min);
             p = inet_ntop(AF_INET, &ia, inet_buffer, sizeof(inet_buffer));
-            ia.s_addr = htonl(my_net_list->pnetwork[i]->range_max);
+            ia.s_addr = htonl(net_list->pnetwork[i]->range_max);
             p2 = inet_ntop(AF_INET, &ia, inet_buffer2, sizeof(inet_buffer2));
-            LogMessage("        %s%s-%s %04X\n", (my_net_list->pnetwork[i]->info.ip_not) ? "!" :
+            LogMessage("        %s%s-%s %04X\n", (net_list->pnetwork[i]->info.ip_not) ? "!" :
                 "",
                 p ? p : "ERROR",
-                p2 ? p2 : "ERROR", my_net_list->pnetwork[i]->info.type);
+                p2 ? p2 : "ERROR", net_list->pnetwork[i]->info.type);
         }
-        for (i = 0; i < my_net_list->count6; i++)
+        for (i = 0; i < net_list->count6; i++)
         {
-            six = my_net_list->pnetwork6[i]->range_min;
+            six = net_list->pnetwork6[i]->range_min;
             NetworkSetManager::ntoh_ipv6(&six);
             p = inet_ntop(AF_INET6, (struct in6_addr*)&six, inet_buffer, sizeof(inet_buffer));
-            six = my_net_list->pnetwork6[i]->range_max;
+            six = net_list->pnetwork6[i]->range_max;
             NetworkSetManager::ntoh_ipv6(&six);
             p2 = inet_ntop(AF_INET6, (struct in6_addr*)&six, inet_buffer2, sizeof(inet_buffer2));
-            LogMessage("        %s%s-%s %04X\n", (my_net_list->pnetwork6[i]->info.ip_not) ? "!" :
+            LogMessage("        %s%s-%s %04X\n", (net_list->pnetwork6[i]->info.ip_not) ? "!" :
                 "",
                 p ? p : "ERROR",
-                p2 ? p2 : "ERROR", my_net_list->pnetwork6[i]->info.type);
+                p2 ? p2 : "ERROR", net_list->pnetwork6[i]->info.type);
         }
     }
+#endif
 
     LogMessage("    Excluded TCP Ports for Src:\n");
     for (i = 0; i < APP_ID_PORT_ARRAY_SIZE; i++)

diff --git a/src/network_inspectors/appid/appid_config.h b/src/network_inspectors/appid/appid_config.h
index 3c6335315b35b50cf6019a9af339bdef2bf438df..75ec4f51aecf6b05781cafe75ad8a44c710f95d3 100644 (file)
--- a/src/network_inspectors/appid/appid_config.h
+++ b/src/network_inspectors/appid/appid_config.h
@@ -143,10 +143,12 @@ public:
     void set_safe_search_enforcement(int enabled);
 
     unsigned max_service_info = 0;
+#ifdef USE_RNA_CONFIG
     unsigned net_list_count = 0;
     NetworkSet* net_list_list = nullptr;
     NetworkSet* net_list = nullptr;
     std::array<NetworkSet*, MAX_ZONES> net_list_by_zone;
+#endif
     std::array<AppId, APP_ID_PORT_ARRAY_SIZE> tcp_port_only;     ///< Service IDs for port-only TCP services
     std::array<AppId, APP_ID_PORT_ARRAY_SIZE> udp_port_only;     ///< Service IDs for port-only UDP services
     std::array<AppId, 255> ip_protocol;         ///< Service IDs for non-TCP / UDP protocol services

diff --git a/src/network_inspectors/appid/appid_session.cc b/src/network_inspectors/appid/appid_session.cc
index bae549ff5021fb49d648c1092d84fbdcdbb1ff07..59c8e576c3aaa24be39d01c77986a4164680cda7 100644 (file)
--- a/src/network_inspectors/appid/appid_session.cc
+++ b/src/network_inspectors/appid/appid_session.cc
@@ -1942,11 +1942,13 @@ static inline int check_port_exclusion(const Packet* pkt, bool reversed)
 static inline unsigned get_ipfuncs_flags(const Packet* p, bool dst)
 {
     const SfIp* sf_ip;
-    NetworkSet* net_list;
     unsigned flags;
     int32_t zone;
+#ifdef USE_RNA_CONFIG
     NSIPv6Addr ip6;
     AppIdConfig* config = AppIdConfig::get_appid_config();
+    NetworkSet* net_list;
+#endif
 
     if (!dst)
     {
@@ -1962,6 +1964,7 @@ static inline unsigned get_ipfuncs_flags(const Packet* p, bool dst)
         sf_ip = p->ptrs.ip_api.get_dst();
     }
 
+#ifdef USE_RNA_CONFIG
     if (zone >= 0 && zone < MAX_ZONES && config->net_list_by_zone[zone])
         net_list = config->net_list_by_zone[zone];
     else
@@ -1979,6 +1982,12 @@ static inline unsigned get_ipfuncs_flags(const Packet* p, bool dst)
         NetworkSetManager::ntoh_ipv6(&ip6);
         NetworkSetManager::contains6_ex(net_list, &ip6, &flags);
     }
+#else
+    if (sf_ip->is_ip4() && sf_ip->get_ip4_value() == 0xFFFFFFFF)
+        return IPFUNCS_CHECKED;
+    // FIXIT-M Defaulting to checking everything everywhere until RNA config is reimplemented
+    flags = IPFUNCS_HOSTS_IP | IPFUNCS_USER_IP | IPFUNCS_APPLICATION;
+#endif
 
     return flags | IPFUNCS_CHECKED;
 }

diff --git a/src/network_inspectors/appid/appid_utils/ip_funcs.cc b/src/network_inspectors/appid/appid_utils/ip_funcs.cc
index f086f3b870386a7cc91f9bf886f2f8ee96684e35..5502d9f06be544e2c19d8a0a2c1be40feb1614b5 100644 (file)
--- a/src/network_inspectors/appid/appid_utils/ip_funcs.cc
+++ b/src/network_inspectors/appid/appid_utils/ip_funcs.cc
@@ -25,6 +25,8 @@
 
 #include "ip_funcs.h"
 
+#ifdef USE_RNA_CONFIG
+
 #include <netinet/in.h>
 
 #include "log/messages.h"
@@ -212,3 +214,5 @@ RNAIpv6AddrSet* ParseIpv6Cidr(char* ipstring)
     return ias;
 }
 
+#endif
+

diff --git a/src/network_inspectors/appid/appid_utils/ip_funcs.h b/src/network_inspectors/appid/appid_utils/ip_funcs.h
index e593e95661b1ef2f6156bb7764044e923af1a046..7a24ebf37f52f33a9f4f8451a4f435908af4d8b7 100644 (file)
--- a/src/network_inspectors/appid/appid_utils/ip_funcs.h
+++ b/src/network_inspectors/appid/appid_utils/ip_funcs.h
@@ -31,12 +31,12 @@
 
 #define IPFUNCS_EXCEPT_IP                0x01
 #define IPFUNCS_SECONDARY_IP             0x02
-#define IPFUNCS_APPID_SESSION_EXCLUDE_IP 0x04
-#define IPFUNCS_USER_IP                  0x08
-#define IPFUNCS_HOSTS_IP                 0x10
-#define IPFUNCS_APPLICATION              0x20
+#define IPFUNCS_USER_IP                  0x04
+#define IPFUNCS_HOSTS_IP                 0x08
+#define IPFUNCS_APPLICATION              0x10
 #define IPFUNCS_CHECKED                  0x80000000
 
+#ifdef USE_RNA_CONFIG
 struct RNAIpAddrSet
 {
     uint32_t range_min;
@@ -78,6 +78,7 @@ inline int cmpSnortIpToHostKey(const ip::snort_in6_addr* keyIp, const SfIp* snor
 {
     return memcmp(keyIp, snortIp->get_ip6_ptr(), sizeof(*keyIp));
 }
+#endif
 
 #endif
 

diff --git a/src/network_inspectors/appid/appid_utils/network_set.cc b/src/network_inspectors/appid/appid_utils/network_set.cc
index 9ceeff5ba7aaf8ed0448292cd8cebf733406c292..68db0d663076c12f522fc6b512fe061240dc833e 100644 (file)
--- a/src/network_inspectors/appid/appid_utils/network_set.cc
+++ b/src/network_inspectors/appid/appid_utils/network_set.cc
@@ -25,6 +25,8 @@
 
 #include "network_set.h"
 
+#ifdef USE_RNA_CONFIG
+
 #include <sys/socket.h>
 
 #include "log/messages.h"
@@ -1157,3 +1159,5 @@ int NetworkSetManager::add_set(NetworkSet* dest_set, NetworkSet* src_set)
     return 0;
 }
 
+#endif
+

diff --git a/src/network_inspectors/appid/appid_utils/network_set.h b/src/network_inspectors/appid/appid_utils/network_set.h
index e970700a39bde16ae43f24762c4ab1f525ab61a3..58e6403b832a5dde8ab935b296e82f7793e380b1 100644 (file)
--- a/src/network_inspectors/appid/appid_utils/network_set.h
+++ b/src/network_inspectors/appid/appid_utils/network_set.h
@@ -22,6 +22,8 @@
 #ifndef NETWORK_SET_H
 #define NETWORK_SET_H
 
+#ifdef USE_RNA_CONFIG
+
 #include <cstdio>
 
 #include "hash/sfxhash.h"
@@ -359,3 +361,5 @@ private:
     static int reduce_network_set6(SF_LIST* networks);
 };
 #endif
+
+#endif

diff --git a/src/network_inspectors/appid/service_plugins/service_base.cc b/src/network_inspectors/appid/service_plugins/service_base.cc
index 9efae62cf207cd208cd94e338e9d8abc9d2fdb13..90e2a2802aa346085e33bd8f341cdd256a5cda90 100644 (file)
--- a/src/network_inspectors/appid/service_plugins/service_base.cc
+++ b/src/network_inspectors/appid/service_plugins/service_base.cc
@@ -1011,6 +1011,7 @@ void AppIdFreeDhcpInfo(DHCPInfo* dd)
     }
 }
 
+#ifdef USE_RNA_CONFIG
 static unsigned isIPv4HostMonitored(uint32_t ip4, int32_t zone)
 {
     NetworkSet* net_list;
@@ -1025,6 +1026,13 @@ static unsigned isIPv4HostMonitored(uint32_t ip4, int32_t zone)
     NetworkSetManager::contains_ex(net_list, ip4, &flags);
     return flags;
 }
+#else
+static unsigned isIPv4HostMonitored(uint32_t, int32_t)
+{
+    // FIXIT-M Defaulting to checking everything everywhere until RNA config is reimplemented
+    return IPFUNCS_HOSTS_IP | IPFUNCS_USER_IP | IPFUNCS_APPLICATION;
+}
+#endif
 
 static void add_host_ip_info(AppIdSession* asd, const uint8_t* mac, uint32_t ip, int32_t zone,
     uint32_t subnetmask, uint32_t leaseSecs, uint32_t router)