see changelog

diff --git a/ChangeLog b/ChangeLog
index a5da3916296fe3c0a4416c2a9d7092f759d6ff34..5762a59fd93d5851057d15f2ef877dc4761149c6 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -45,6 +45,8 @@
 -- fixed segfaults due to unitialized cleanup_pkt and unset stream_tcp
 -- matched up stream_tcp.policy enum with defines
 -- tweaked S5_TRACE output
+-- streamlined session restart handling
+-- changed #begin & #end to have to start beginning of line
 
 125
 -- discovered can't catch exceptions thrown from Lua to C++; need to

diff --git a/src/flow/session.h b/src/flow/session.h
index 8c7da4427754ff1ea4f31446332621c3cb7623a2..6ecaff27eeb3813e9b3ed596d2265e74a0dd0719 100644 (file)
--- a/src/flow/session.h
+++ b/src/flow/session.h
@@ -36,6 +36,7 @@ public:
     virtual bool setup(Packet*) { return true; };
     virtual void update_direction(char /*dir*/, const sfip_t*, uint16_t /*port*/) { };
     virtual int process(Packet*) { return 0; };
+    virtual void restart(Packet*) { };
     virtual void clear() = 0;
     virtual void cleanup() { clear(); };
 

diff --git a/src/managers/inspector_manager.cc b/src/managers/inspector_manager.cc
index c11ff6ed4456b54fbb3eced92e9f44e018983f71..817df2422362334c2da2e449b417f8cb3349fbd1 100644 (file)
--- a/src/managers/inspector_manager.cc
+++ b/src/managers/inspector_manager.cc
@@ -27,6 +27,7 @@
 
 #include "module_manager.h"
 #include "flow/flow.h"
+#include "flow/session.h"
 #include "framework/inspector.h"
 #include "detection/detection_util.h"
 #include "obfuscation.h"
@@ -630,10 +631,8 @@ void InspectorManager::bumble(Packet* p)
     if ( !flow->gadget || flow->protocol != PktType::TCP )
         return;
 
-    ins = get_inspector("stream_tcp");
-
-    if ( ins )
-        ins->exec(0, p);
+    if ( flow->session )
+        flow->session->restart(p);
 }
 
 void InspectorManager::execute (Packet* p)
@@ -645,27 +644,24 @@ void InspectorManager::execute (Packet* p)
     // called on reassembled packets
     ::execute(p, fp->packet.vec, fp->packet.num);
     ::execute(p, fp->session.vec, fp->session.num);
-    ::execute(p, fp->network.vec, fp->network.num);
 
     Flow* flow = p->flow;
 
-    if ( flow && flow->clouseau && flow->service )
+    if ( !flow || !flow->service )
+        ::execute(p, fp->network.vec, fp->network.num);
+
+    else if ( flow->clouseau )
         bumble(p);
 
-    if ( p->dsize )
-    {
-        if ( !flow )
-            return;
+    if ( !p->dsize )
+        DisableDetect(p);
 
-        // FIXIT-M need more than one service inspector?
-        // (should be daisy chained since inspector1 will generate PDUs for
-        // inspector2)
-        //::execute(p, fp->service.vec, fp->service.num);
-        if ( flow->gadget && ((unsigned)p->type() & flow->gadget->get_api()->proto_bits) )
+    // FIXIT-M need more than one service inspector?
+    else if ( flow && flow->gadget )
+    {
+        if ( ((unsigned)p->type() & flow->gadget->get_api()->proto_bits) )
             flow->gadget->eval(p);
     }
-    else
-        DisableDetect(p);
 
     ::execute(p, fp->probe.vec, fp->probe.num);
 }

diff --git a/src/parser/parse_stream.cc b/src/parser/parse_stream.cc
index b546f131840a671125d0d3925767541ba56291bc..d6099bd92679833b2c749fd39cd95a4de5c15b97 100644 (file)
--- a/src/parser/parse_stream.cc
+++ b/src/parser/parse_stream.cc
@@ -63,6 +63,7 @@ static TokenType get_token(
     int c, list = 0, state = 0;
     s.clear();
     bool inc = true;
+    static int pos = 1;
 
     if ( prev != EOF )
     {
@@ -83,11 +84,15 @@ static TokenType get_token(
         if ( c == '\n' )
         {
             lines++;
+            pos = 0;
+
             if ( inc )
                 inc_parse_position();
             else
                 inc = true;
         }
+        else
+            pos++;
 
         switch ( state )
         {
@@ -141,7 +146,7 @@ static TokenType get_token(
             else if ( s.size() < 6 )
             {
                 s += c;
-                if ( s == "#begin" )
+                if ( pos == 6 && !strcasecmp(s.c_str(), "#begin") )
                     state = 8;
             }
             break;
@@ -214,7 +219,7 @@ static TokenType get_token(
             else if ( s.size() < 4 )
             {
                 s += c;
-                if ( s == "#end" )
+                if ( !strcasecmp(s.c_str(), "#end") )
                     state = 1;
             }
             break;

diff --git a/src/stream/tcp/stream_tcp.cc b/src/stream/tcp/stream_tcp.cc
index f8ba3e69d291ccf3ff12ca61a13531645255888d..f72adf720348ec5fbfa53a829d3e98c41349aac7 100644 (file)
--- a/src/stream/tcp/stream_tcp.cc
+++ b/src/stream/tcp/stream_tcp.cc
@@ -48,7 +48,6 @@ public:
     void tterm() override;
 
     void eval(Packet*) override;
-    int exec(int, void*) override;
 
 public:
     StreamTcpConfig* config;
@@ -86,18 +85,6 @@ void StreamTcp::eval(Packet*)
     assert(false);
 }
 
-int StreamTcp::exec(int, void* v)
-{
-    Packet* p = (Packet*)v;
-    assert(p && p->flow);
-
-    TcpSession* ssn = (TcpSession*)p->flow->session;
-    assert(ssn);
-
-    ssn->restart_paf(p);
-    return 0;
-}
-
 StreamTcpConfig* get_tcp_cfg(Inspector* ins)
 {
     assert(ins);

diff --git a/src/stream/tcp/tcp_session.cc b/src/stream/tcp/tcp_session.cc
index 7c8b177c921ec72766ae608c4592bee7b88a3c0c..ac9a800ba818ad1131e3b3fc2cf78a883c687d1c 100644 (file)
--- a/src/stream/tcp/tcp_session.cc
+++ b/src/stream/tcp/tcp_session.cc
@@ -2416,7 +2416,7 @@ int Stream5FlushListener(Packet *p, Flow *lwssn)
     return flushed;
 }
 
-void TcpSession::restart_paf(Packet* p)
+void TcpSession::restart(Packet* p)
 {
     StreamTracker* talker, * listener;
     TcpSession* tcpssn = (TcpSession*)p->flow->session;

diff --git a/src/stream/tcp/tcp_session.h b/src/stream/tcp/tcp_session.h
index f8a85cf44029874e4eceb7680c24b8e3c4811a93..f44627105e5982a8f93bb1ea317e95845e82e982 100644 (file)
--- a/src/stream/tcp/tcp_session.h
+++ b/src/stream/tcp/tcp_session.h
@@ -204,7 +204,7 @@ public:
     void cleanup() override;
 
     void reset();
-    void restart_paf(Packet*);
+    void restart(Packet*) override;
 
 public:
     StreamTracker client;