* With cmake, make install will rebuild the docs even though when already
built.
-* IPS option hash and inspectors pop, imap, smtp, and ssl fail to build
- dynamically due to missing symbols in hash/ and protocols/ despite them
- being declared SO_PUBLIC.
-
* Enabling large pcap may erroneously affect the number of packets processed
from pcaps
int PktNumOption::eval(Cursor&, Packet*)
{
- PROFILE_VARS;
- MODULE_PROFILE_START(pkt_num_perf_stats);
+ PERF_PROFILE(pkt_num_perf_stats);
int rval;
else
rval = DETECTION_OPTION_NO_MATCH;
- MODULE_PROFILE_END(pkt_num_perf_stats);
return rval;
}
int TcpUrgOption::eval(Cursor&, Packet* p)
{
- PROFILE_VARS;
- MODULE_PROFILE_START(tcpUrgPerfStats);
+ PERF_PROFILE(tcpUrgPerfStats);
int rval = DETECTION_OPTION_NO_MATCH;
rval = DETECTION_OPTION_MATCH;
}
- MODULE_PROFILE_END(tcpUrgPerfStats);
return rval;
}
back_orifice
dns
ftp_telnet
- imap
nhttp_inspect
- pop
rpc_decode
sip
- smtp
ssh
- ssl
wizard
)
endif()
file_api
mime
http_inspect
+ imap
+ pop
+ smtp
+ ssl
${PIGLET_LIBRARIES}
ips_options
search_engines
service_inspectors/dns/libdns.a \
service_inspectors/ftp_telnet/libftp_telnet.a \
service_inspectors/gtp/libgtp_inspect.a \
-service_inspectors/imap/libimap.a \
service_inspectors/modbus/libmodbus.a \
service_inspectors/nhttp_inspect/libnhttp_inspect.a \
-service_inspectors/pop/libpop.a \
service_inspectors/rpc_decode/librpc_decode.a \
service_inspectors/sip/libsip.a \
-service_inspectors/smtp/libsmtp.a \
service_inspectors/ssh/libssh.a \
-service_inspectors/ssl/libssl.a \
service_inspectors/wizard/libwizard.a
endif
network_inspectors/perf_monitor/libperf_monitor.a \
service_inspectors/libservice_inspectors.a \
$(lib_list) \
+service_inspectors/imap/libimap.a \
+service_inspectors/pop/libpop.a \
+service_inspectors/smtp/libsmtp.a \
+service_inspectors/ssl/libssl.a \
network_inspectors/port_scan/libport_scan.a \
stream/libstream.a \
stream/base/libstream_base.a \
${IPS_ACTION_SOURCES}
)
- add_shared_library(act_react actions act_react.cc)
- add_shared_library(act_reject actions act_reject.cc)
+ add_shared_library(act_react ips_actions act_react.cc)
+ add_shared_library(act_reject ips_actions act_reject.cc)
endif (STATIC_IPS_ACTIONS)
return ((position == SNORT_FILE_END) || (position == SNORT_FILE_FULL));
}
-uint64_t get_file_processed_size(Flow* flow);
+SO_PUBLIC uint64_t get_file_processed_size(Flow* flow);
FilePosition get_file_position(Packet* pkt);
-#endif /* FILE_API_H */
+#endif
class FileContext;
-class FileFlows:public FlowData
+class SO_PUBLIC FileFlows : public FlowData
{
public:
// This provides a wrapper to start/stop file service
#include <sys/types.h>
+#include "main/snort_types.h"
-class FileService
+class SO_PUBLIC FileService
{
public:
// This must be called when snort restarts
};
// this struct is organized by member size for compactness
-class Flow
+class SO_PUBLIC Flow
{
public:
enum FlowState
ips_fragbits.cc
ips_fragoffset.cc
ips_gid.cc
- ips_hash.cc
ips_http.cc
ips_http_header.cc
ips_icmp_id.cc
ips_flow.h
ips_flowbits.cc
ips_flowbits.h
+ ips_hash.cc
ips_luajit.cc
ips_metadata.cc
ips_options.cc
add_shared_library(ips_fragbits ips_options ips_fragbits.cc)
add_shared_library(ips_fragoffset ips_options ips_fragoffset.cc)
add_shared_library(ips_gid ips_options ips_gid.cc)
- add_shared_library(ips_hash ips_options ips_hash.cc)
add_shared_library(ips_http ips_options ips_http.cc)
add_shared_library(ips_http_header ips_options ips_http_header.cc)
add_shared_library(ips_icode ips_options ips_icode.cc)
ips_fragbits.cc \
ips_fragoffset.cc \
ips_gid.cc \
-ips_hash.cc \
ips_http.cc \
ips_http_header.cc \
ips_icmp_id.cc \
ips_file_data.cc \
ips_flow.cc ips_flow.h \
ips_flowbits.cc ips_flowbits.h \
+ips_hash.cc \
ips_luajit.cc \
ips_metadata.cc \
ips_options.cc ips_options.h \
libips_gid_la_LDFLAGS = -export-dynamic -shared
libips_gid_la_SOURCES = ips_gid.cc
-optlib_LTLIBRARIES += libips_hash.la
-libips_hash_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
-libips_hash_la_LDFLAGS = -export-dynamic -shared
-libips_hash_la_SOURCES = ips_hash.cc
+# can't be linked dynamically yet
+#optlib_LTLIBRARIES += libips_hash.la
+#libips_hash_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
+#libips_hash_la_LDFLAGS = -export-dynamic -shared
+#libips_hash_la_SOURCES = ips_hash.cc
optlib_LTLIBRARIES += libips_http.la
libips_http_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
// plugins
//-------------------------------------------------------------------------
-#ifdef BUILDING_SO
-SO_PUBLIC const BaseApi* snort_plugins[] =
-{
- &md5_api.base,
- &sha256_api.base,
- &sha512_api.base,
- nullptr
-};
-#else
+// can't be linked dynamically yet
+//#ifdef BUILDING_SO
+//SO_PUBLIC const BaseApi* snort_plugins[] =
+//{
+// &md5_api.base,
+// &sha256_api.base,
+// &sha512_api.base,
+// nullptr
+//};
+//#else
const BaseApi* ips_md5 = &md5_api.base;
const BaseApi* ips_sha256 = &sha256_api.base;
const BaseApi* ips_sha512 = &sha512_api.base;
-#endif
+//#endif
typedef ip::IP4Hdr IP4Hdr;
-void LogPriorityData(TextLog*, const Event*, bool doNewLine);
-void LogXrefs(TextLog*, const Event*, bool doNewLine);
+SO_PUBLIC void LogPriorityData(TextLog*, const Event*, bool doNewLine);
+SO_PUBLIC void LogXrefs(TextLog*, const Event*, bool doNewLine);
-void LogIPPkt(TextLog*, Packet*);
-void LogPayload(TextLog*, Packet*);
-void LogNetData(TextLog*, const uint8_t* data, const int len, Packet*);
+SO_PUBLIC void LogIPPkt(TextLog*, Packet*);
+SO_PUBLIC void LogPayload(TextLog*, Packet*);
+SO_PUBLIC void LogNetData(TextLog*, const uint8_t* data, const int len, Packet*);
-void LogDiv(TextLog*);
-void LogTimeStamp(TextLog*, Packet*);
+SO_PUBLIC void LogDiv(TextLog*);
+SO_PUBLIC void LogTimeStamp(TextLog*, Packet*);
-void LogTrHeader(TextLog*, Packet*);
-void Log2ndHeader(TextLog*, Packet*);
-void LogIpAddrs(TextLog*, Packet*);
+SO_PUBLIC void LogTrHeader(TextLog*, Packet*);
+SO_PUBLIC void Log2ndHeader(TextLog*, Packet*);
-void LogIPHeader(TextLog*, Packet*);
-void LogTCPHeader(TextLog*, Packet*);
-void LogUDPHeader(TextLog*, Packet*);
-void LogICMPHeader(TextLog*, Packet*);
+SO_PUBLIC void LogTCPHeader(TextLog*, Packet*);
+SO_PUBLIC void LogUDPHeader(TextLog*, Packet*);
+SO_PUBLIC void LogICMPHeader(TextLog*, Packet*);
+
+SO_PUBLIC void LogIpAddrs(TextLog*, Packet*);
+SO_PUBLIC void LogIPHeader(TextLog*, Packet*);
SO_PUBLIC void LogIpOptions(TextLog*, const IP4Hdr*, uint16_t valid_ip4_len);
SO_PUBLIC void LogTcpOptions(TextLog*, const tcp::TCPHdr*, uint16_t valid_tcp_len);
extern "C" {
#include <daq.h>
}
+#include "main/snort_types.h"
#include "protocols/packet.h"
/*******************************************************************************
} ObfuscationApi;
/* For access when including header */
-extern ObfuscationApi* obApi;
+SO_PUBLIC extern ObfuscationApi* obApi;
#endif
#include "sfip/sf_ip.h"
THREAD_LOCAL SnortConfig* snort_conf = nullptr;
+uint32_t SnortConfig::warning_flags = 0;
//-------------------------------------------------------------------------
// private implementation
void merge(SnortConfig*);
public:
+ //------------------------------------------------------
+ // non-reloadable stuff (single instance)
+ // FIXIT-L non-reloadable stuff should be made static
+ static uint32_t warning_flags;
+
//------------------------------------------------------
// alert module stuff
bool default_rule_state = true;
// output module stuff
uint32_t output_flags = 0;
uint32_t logging_flags = 0;
- uint32_t warning_flags = 0;
uint8_t log_ipv6_extra = 0;
uint16_t event_trace_max = 0;
return false;
}
-void reset_mime_paf_state(MimeDataPafInfo *data_info);
+SO_PUBLIC void reset_mime_paf_state(MimeDataPafInfo *data_info);
/* Process data boundary and flush each file based on boundary*/
-bool process_mime_paf_data(MimeDataPafInfo *data_info, uint8_t val);
-bool check_data_end(void *end_state, uint8_t val);
+SO_PUBLIC bool process_mime_paf_data(MimeDataPafInfo *data_info, uint8_t val);
+SO_PUBLIC bool check_data_end(void *end_state, uint8_t val);
#endif
// Provides list of MIME processing functions. Encoded file data will be decoded
// and file name will be extracted from MIME header
+#include "main/snort_types.h"
#include "file_api/file_api.h"
#include "file_mime_config.h"
#include "file_mime_paf.h"
/* Maximum length of header chars before colon, based on Exim 4.32 exploit */
#define MAX_HEADER_NAME_LEN 64
-class MimeSession
+class SO_PUBLIC MimeSession
{
public:
MimeSession(DecodeConfig*, MailLogConfig*);
)
else (STATIC_INSPECTORS)
- add_shared_library(arpspoof inspectors ${FILE_LIST})
+ add_shared_library(arp_spoof inspectors ${FILE_LIST})
endif (STATIC_INSPECTORS)
SnortConfig* sc = new SnortConfig;
sc->logging_flags = boot_conf->logging_flags;
- sc->warning_flags = boot_conf->warning_flags;
VarNode* tmp = boot_conf->var_list;
if ( !fname )
PegCount tot_inq_uinserts;
};
-extern THREAD_LOCAL PatMatQStat pmqs;
+SO_PUBLIC extern THREAD_LOCAL PatMatQStat pmqs;
SO_PUBLIC void print_pat_stats(const char*, unsigned max);
back_orifice
dns
ftp_telnet
- gtp
+ gtp_inspect
imap
modbus
nhttp_inspect
)
if (STATIC_INSPECTORS)
- add_library(gtp STATIC ${FILE_LIST})
+ add_library(gtp_inspect STATIC ${FILE_LIST})
else (STATIC_INSPECTORS)
- add_shared_library(gtp inspectors ${FILE_LIST})
+ add_shared_library(gtp_inspect inspectors ${FILE_LIST})
endif (STATIC_INSPECTORS)
hi_util.h
)
-# Can'be be dynamic yet
+# can't be be linked dynamically yet
#if (STATIC_INSPECTORS)
add_library(http_inspect STATIC ${FILE_LIST})
hi_ui_iis_unicode_map.cc hi_ui_iis_unicode_map.h \
hi_util.h
-# can't be built dynamically yet
+# can't be linked dynamically yet
#if STATIC_INSPECTORS
noinst_LIBRARIES = libhttp_inspect.a
libhttp_inspect_a_SOURCES = $(file_list)
nullptr // reset
};
-// can't be built dynamically yet
+// can't be linked dynamically yet
//#ifdef BUILDING_SO
//SO_PUBLIC const BaseApi* snort_plugins[] =
//{
imap_module.h
)
-if (STATIC_INSPECTORS)
+# can't be be linked dynamically yet
+#if (STATIC_INSPECTORS)
add_library( imap STATIC ${FILE_LIST})
-else (STATIC_INSPECTORS)
- add_shared_library(imap inspectors ${FILE_LIST})
+#else (STATIC_INSPECTORS)
+ #add_shared_library(imap inspectors ${FILE_LIST})
+
+#endif (STATIC_INSPECTORS)
-endif (STATIC_INSPECTORS)
imap_module.cc \
imap_module.h
-if STATIC_INSPECTORS
+# can't be linked dynamically yet
+#if STATIC_INSPECTORS
noinst_LIBRARIES = libimap.a
libimap_a_SOURCES = $(file_list)
-else
-shlibdir = $(pkglibdir)/inspectors
-shlib_LTLIBRARIES = libimap.la
-libimap_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
-libimap_la_LDFLAGS = -export-dynamic -shared
-libimap_la_SOURCES = $(file_list)
-endif
+#else
+#shlibdir = $(pkglibdir)/inspectors
+#shlib_LTLIBRARIES = libimap.la
+#libimap_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
+#libimap_la_LDFLAGS = -export-dynamic -shared
+#libimap_la_SOURCES = $(file_list)
+#endif
AM_CXXFLAGS = @AM_CXXFLAGS@
nullptr // reset
};
-#ifdef BUILDING_SO
-SO_PUBLIC const BaseApi* snort_plugins[] =
-{
- &imap_api.base,
- nullptr
-};
-#else
+// can't be linked dynamically yet
+//#ifdef BUILDING_SO
+//SO_PUBLIC const BaseApi* snort_plugins[] =
+//{
+// &imap_api.base,
+// nullptr
+//};
+//#else
const BaseApi* sin_imap = &imap_api.base;
-#endif
+//#endif
#ifdef BUILDING_SO
extern const BaseApi* ips_modbus_data;
extern const BaseApi* ips_modbus_func;
-extern const BaseApi* ips_modbus_func;
+extern const BaseApi* ips_modbus_unit;
SO_PUBLIC const BaseApi* snort_plugins[] =
{
pop_module.h
)
-if (STATIC_INSPECTORS)
+# can't be be linked dynamically yet
+#if (STATIC_INSPECTORS)
add_library( pop STATIC ${FILE_LIST})
-else (STATIC_INSPECTORS)
- add_shared_library(pop inspectors ${FILE_LIST})
+#else (STATIC_INSPECTORS)
+ #add_shared_library(pop inspectors ${FILE_LIST})
+
+#endif (STATIC_INSPECTORS)
-endif (STATIC_INSPECTORS)
pop_module.cc \
pop_module.h
-if STATIC_INSPECTORS
+# can't be linked dynamically yet
+#if STATIC_INSPECTORS
noinst_LIBRARIES = libpop.a
libpop_a_SOURCES = $(file_list)
-else
-shlibdir = $(pkglibdir)/inspectors
-shlib_LTLIBRARIES = libpop.la
-libpop_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
-libpop_la_LDFLAGS = -export-dynamic -shared
-libpop_la_SOURCES = $(file_list)
-endif
+#else
+#shlibdir = $(pkglibdir)/inspectors
+#shlib_LTLIBRARIES = libpop.la
+#libpop_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
+#libpop_la_LDFLAGS = -export-dynamic -shared
+#libpop_la_SOURCES = $(file_list)
+#endif
AM_CXXFLAGS = @AM_CXXFLAGS@
nullptr // reset
};
-#ifdef BUILDING_SO
-SO_PUBLIC const BaseApi* snort_plugins[] =
-{
- &pop_api.base,
- nullptr
-};
-#else
+// can't be linked dynamically yet
+//#ifdef BUILDING_SO
+//SO_PUBLIC const BaseApi* snort_plugins[] =
+//{
+// &pop_api.base,
+// nullptr
+//};
+//#else
const BaseApi* sin_pop = &pop_api.base;
-#endif
+//#endif
extern const BaseApi* sin_http_global;
extern const BaseApi* sin_http_inspect;
+extern const BaseApi* sin_imap;
+extern const BaseApi* sin_pop;
+extern const BaseApi* sin_smtp;
+extern const BaseApi* sin_ssl;
#ifdef STATIC_INSPECTORS
extern const BaseApi* ips_gtp_info;
extern const BaseApi* sin_ftp_server;
extern const BaseApi* sin_ftp_data;
extern const BaseApi* sin_gtp;
-extern const BaseApi* sin_imap;
extern const BaseApi* sin_modbus;
extern const BaseApi* sin_nhttp;
-extern const BaseApi* sin_pop;
extern const BaseApi* sin_rpc_decode;
extern const BaseApi* sin_sip;
-extern const BaseApi* sin_smtp;
extern const BaseApi* sin_ssh;
-extern const BaseApi* sin_ssl;
extern const BaseApi* sin_telnet;
extern const BaseApi* sin_wizard;
#endif
{
sin_http_global,
sin_http_inspect,
+ sin_imap,
+ sin_pop,
+ sin_smtp,
+ sin_ssl,
#ifdef STATIC_INSPECTORS
ips_gtp_info,
sin_ftp_server,
sin_ftp_data,
sin_gtp,
- sin_imap,
sin_modbus,
sin_nhttp,
- sin_pop,
sin_rpc_decode,
sin_sip,
- sin_smtp,
sin_ssh,
- sin_ssl,
sin_telnet,
sin_wizard,
#endif
smtp_normalize.h
)
-if (STATIC_INSPECTORS)
+# can't be be linked dynamically yet
+#if (STATIC_INSPECTORS)
add_library( smtp STATIC ${FILE_LIST})
-else (STATIC_INSPECTORS)
- add_shared_library(smtp inspectors ${FILE_LIST})
+#else (STATIC_INSPECTORS)
+ #add_shared_library(smtp inspectors ${FILE_LIST})
+
+#endif (STATIC_INSPECTORS)
-endif (STATIC_INSPECTORS)
smtp_module.cc \
smtp_module.h
-if STATIC_INSPECTORS
+# can't be linked dynamically yet
+#if STATIC_INSPECTORS
noinst_LIBRARIES = libsmtp.a
libsmtp_a_SOURCES = $(file_list)
-else
-shlibdir = $(pkglibdir)/inspectors
-shlib_LTLIBRARIES = libsmtp.la
-libsmtp_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
-libsmtp_la_LDFLAGS = -export-dynamic -shared
-libsmtp_la_SOURCES = $(file_list)
-endif
+#else
+#shlibdir = $(pkglibdir)/inspectors
+#shlib_LTLIBRARIES = libsmtp.la
+#libsmtp_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
+#libsmtp_la_LDFLAGS = -export-dynamic -shared
+#libsmtp_la_SOURCES = $(file_list)
+#endif
AM_CXXFLAGS = @AM_CXXFLAGS@
nullptr // reset
};
-#ifdef BUILDING_SO
-SO_PUBLIC const BaseApi* snort_plugins[] =
-{
- &smtp_api.base,
- nullptr
-};
-#else
+// can't be linked dynamically yet
+//#ifdef BUILDING_SO
+//SO_PUBLIC const BaseApi* snort_plugins[] =
+//{
+// &smtp_api.base,
+// nullptr
+//};
+//#else
const BaseApi* sin_smtp = &smtp_api.base;
-#endif
+//#endif
ips_ssl_version.cc
)
-if (STATIC_INSPECTORS)
+# can't be be linked dynamically yet
+#if (STATIC_INSPECTORS)
add_library( ssl STATIC ${FILE_LIST})
-else (STATIC_INSPECTORS)
- add_shared_library(ssl inspectors ${FILE_LIST})
+#else (STATIC_INSPECTORS)
+ #add_shared_library(ssl inspectors ${FILE_LIST})
+
+#endif (STATIC_INSPECTORS)
-endif (STATIC_INSPECTORS)
ips_ssl_state.cc \
ips_ssl_version.cc
-if STATIC_INSPECTORS
+# can't be linked dynamically yet
+#if STATIC_INSPECTORS
noinst_LIBRARIES = libssl.a
libssl_a_SOURCES = $(file_list)
-else
-shlibdir = $(pkglibdir)/inspectors
-shlib_LTLIBRARIES = libssl.la
-libssl_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
-libssl_la_LDFLAGS = -export-dynamic -shared
-libssl_la_SOURCES = $(file_list)
-endif
+#else
+#shlibdir = $(pkglibdir)/inspectors
+#shlib_LTLIBRARIES = libssl.la
+#libssl_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
+#libssl_la_LDFLAGS = -export-dynamic -shared
+#libssl_la_SOURCES = $(file_list)
+#endif
AM_CXXFLAGS = @AM_CXXFLAGS@
nullptr // reset
};
-#ifdef BUILDING_SO
-SO_PUBLIC const BaseApi* snort_plugins[] =
-{
- &ssl_api.base,
- nullptr
-};
-#else
+// can't be linked dynamically yet
+//#ifdef BUILDING_SO
+//SO_PUBLIC const BaseApi* snort_plugins[] =
+//{
+// &ssl_api.base,
+// nullptr
+//};
+//#else
const BaseApi* sin_ssl = &ssl_api.base;
-#endif
+//#endif
/* Uses a static buffer to return a string representation of the IP */
SO_PUBLIC void sfip_raw_ntop(int family, const void* ip_raw, char* buf, int bufsize);
-void sfip_ntop(const sfip_t* ip, char* buf, int bufsize);
+SO_PUBLIC void sfip_ntop(const sfip_t* ip, char* buf, int bufsize);
-#endif // SF_IP_H
+#endif