+80
+-- deleted port monitor foo; will be obviated by binder
+-- removed ttl norm checks from codecs; made no sense; drop iff rule is drop
+-- moved stream_* bindings to binder
+
79
-- pulled in latest codecs
# initialization
#--------------------------------------------------------------------------
-AC_INIT([snort], [2.10.079])
+AC_INIT([snort], [2.10.080])
AC_PREREQ([2.68])
AC_CONFIG_SRCDIR([src/main.h])
ErrorMessage("%d:%d\n", GID_DECODE, sid);
SnortEventqAdd(GID_DECODE, sid);
-
- if ( ScNormalDrop(NORM_IP6_TTL) )
- {
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
- "Dropping bad packet (IP6 hop limit)\n"););
- p->error_flags |= PKT_ERR_BAD_TTL;
- Active_DropPacket();
-// dc.bad_ttl++;
- }
}
void codec_events::exec_ttl_drop (Packet *p, int sid)
ErrorMessage("%d:%d\n", GID_DECODE, sid);
SnortEventqAdd(GID_DECODE, sid);
-
- if ( ScNormalDrop(NORM_IP4_TTL) )
- {
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
- "Dropping bad packet (IP4 TTL)\n"););
- p->error_flags |= PKT_ERR_BAD_TTL;
- Active_DropPacket();
-// dc.bad_ttl++;
- }
}
void codec_events::exec_icmp_chksm_drop (Packet*)
p->greh = NULL;
}
-int codec_events::ScNormalDrop (NormFlags nf)
-{
- return !Normalize_IsEnabled(snort_conf, nf);
-}
-
-
void decoder_alert_encapsulated(
Packet *p, int sid, const uint8_t *pkt, uint32_t len);
- int ScNormalDrop (NormFlags nf);
-
} //namespace codec_events
}
#endif /* WORDS_MUSTALIGN && !__GNUC__ */
-
-
static inline void CheckIPv4_MinTTL(Packet *p, uint8_t ttl)
{
-
// this sequence of tests is best for the "normal" case where
// the packet ttl is >= the configured min (the default is 1)
if( ttl < ScMinTTL() )
}
}
-
-
static inline void CheckIPv6_MinTTL(Packet *p, uint8_t hop_limit)
{
// this sequence of tests is best for the "normal" case where
}
}
-
-
/* Decoding of ttl/hop_limit is based on the policy min_ttl */
void DecodePolicySpecific(Packet *p)
{
#include "packet_io/sfdaq.h"
#include "sf_iph.h"
#include "snort.h"
+#include "stream/stream.h"
#include "stream/stream_api.h"
#include "encode.h"
#include "sf_protocols.h"
#include "protocols/eth.h"
#include "protocols/gtp.h"
#include "codecs/checksum.h"
-
-
#define GET_IP_HDR_LEN(h) (((h)->ip_verhl & 0x0f) << 2)
#define GET_TCP_HDR_LEN(h) (((h)->th_offx2 & 0xf0) >> 2)
fp->search_opt = flag;
}
-// config detect: search-method <method>
int fpSetDetectSearchMethod(FastPatternConfig* fp, const char* method)
{
fp->search_api = MpseManager::get_search_api(method);
#include "sfip/ipv6_port.h"
#include "flow/flow_key.h"
#include "framework/inspector.h"
+#include "normalize/normalize.h"
#define SSNFLAG_SEEN_CLIENT 0x00000001
#define SSNFLAG_SEEN_SENDER 0x00000001
void markup_packet_flags(Packet*);
void set_direction(Packet*);
+ void set_normalizations(uint32_t m)
+ { normal_mask = m; };
+
+ bool norm_is_enabled(uint32_t b)
+ { return Normalize_IsEnabled(normal_mask, (NormFlags)b); };
+
void set_expire(Packet*, uint32_t timeout);
int get_expire(Packet*);
bool expired(Packet*);
snort_ip server_ip; // or uint8_t to reduce sizeof from 24 to 20
uint64_t expire_time;
+ uint32_t normal_mask;
uint16_t client_port;
uint16_t server_port;
#include "flow/session.h"
#include "packet_io/active.h"
#include "packet_io/sfdaq.h"
+#include "main/binder.h"
FlowControl::FlowControl()
{
return (flow->s5_state.session_flags & bidir) == bidir;
}
-void FlowControl::process(FlowCache* cache, Inspector* ins, Packet* p)
+void FlowControl::process(FlowCache* cache, Packet* p)
{
FlowKey key;
set_key(&key, p);
if ( flow->init )
{
-#if 0
- // FIXIT BIND this is where bindings are used to set
- // inspectors on session:
- if ( bindings )
- {
- // -- must set client and server session inspectors
- // -- must set all bound service inspectors
- // (service inspectors also set later by auto id)
- }
- else
-#endif
- {
- // default case
- flow->client = ins;
- flow->server = ins;
- }
- // -- all inspectors must be ref counted when set
- flow->client->add_ref();
- flow->server->add_ref();
+ Binder::init_flow(flow);
if ( !flow->session->setup(p) )
return;
}
}
-void FlowControl::process_tcp(Inspector* user, Packet* p)
+void FlowControl::process_tcp(Packet* p)
{
if( !p->tcph || !tcp_cache )
return;
- process(tcp_cache, user, p);
+ process(tcp_cache, p);
}
//-------------------------------------------------------------------------
}
}
-void FlowControl::process_udp(Inspector* user, Packet* p)
+void FlowControl::process_udp(Packet* p)
{
if( !p->udph || !udp_cache )
return;
- process(udp_cache, user, p);
+ process(udp_cache, p);
}
//-------------------------------------------------------------------------
}
}
-void FlowControl::process_icmp(Inspector* user, Packet* p)
+void FlowControl::process_icmp(Packet* p)
{
if ( !p->icmph )
return;
if ( icmp_cache )
- process(icmp_cache, user, p);
+ process(icmp_cache, p);
else
- process_ip(user, p);
+ process_ip(p);
}
//-------------------------------------------------------------------------
}
}
-void FlowControl::process_ip(Inspector* user, Packet* p)
+void FlowControl::process_ip(Packet* p)
{
if ( !p->iph || !ip_cache )
return;
- process(ip_cache, user, p);
+ process(ip_cache, p);
}
//-------------------------------------------------------------------------
~FlowControl();
public:
- // FIXIT BIND supply default inspectors until bindings are in place
- void process_ip(Inspector*, Packet*);
- void process_icmp(Inspector*, Packet*);
- void process_tcp(Inspector*, Packet*);
- void process_udp(Inspector*, Packet*);
+ void process_ip(Packet*);
+ void process_icmp(Packet*);
+ void process_tcp(Packet*);
+ void process_udp(Packet*);
Flow* find_flow(const FlowKey*);
Flow* new_flow(const FlowKey*);
class FlowCache* get_cache(int proto);
void set_key(FlowKey*, const Packet*);
- void process(FlowCache*, Inspector*, Packet*);
+ void process(FlowCache*, Packet*);
private:
FlowCache* tcp_cache;
#include "binder.h"
+#include "flow/flow.h"
+#include "managers/inspector_manager.h"
+
+class Inspector;
+
+// FIXIT these will move into bindings lookup structures
+// these are for defaults but lookups will support default
+// and non-defaults
+static Inspector* tcp_hand;
+static Inspector* udp_hand;
+static Inspector* icmp_hand;
+static Inspector* ip_hand;
+
+void Binder::init()
+{
+ // FIXIT this is backwards; InspectorManager must call
+ // binder to set the various default inspectors since
+ // binder doesn't know what inspectors are available
+ tcp_hand = InspectorManager::get_inspector("stream_tcp");
+ udp_hand = InspectorManager::get_inspector("stream_udp");
+ ip_hand = InspectorManager::get_inspector("stream_ip");
+ icmp_hand = InspectorManager::get_inspector("stream_icmp");
+
+ if ( !icmp_hand )
+ icmp_hand = ip_hand;
+
+ assert(tcp_hand);
+ assert(udp_hand);
+ assert(ip_hand);
+ assert(icmp_hand);
+}
+
+void Binder::init_flow(Flow* flow)
+{
+ switch ( flow->protocol )
+ {
+ case IPPROTO_TCP:
+ flow->client = tcp_hand;
+ flow->server = tcp_hand;
+ break;
+
+ case IPPROTO_UDP:
+ flow->client = udp_hand;
+ flow->server = udp_hand;
+ break;
+
+ case IPPROTO_ICMP:
+ flow->client = icmp_hand;
+ flow->server = icmp_hand;
+ break;
+
+ case IPPROTO_IP:
+ flow->client = ip_hand;
+ flow->server = ip_hand;
+ break;
+ }
+ if ( flow->client )
+ flow->client->add_ref();
+
+ if ( flow->server )
+ flow->server->add_ref();
+}
+
{ role = BR_EITHER; action = BA_INSPECT; };
};
+class Binder
+{
+public:
+ static void init();
+ static void init_flow(class Flow*);
+};
+
#endif
InspectionPolicy::InspectionPolicy()
{
framework_policy = nullptr;
- normal_mask = 0;
- scanned_proto_mask = 0;
InspectorManager::new_policy(this);
}
public:
struct FrameworkPolicy* framework_policy;
-
- uint32_t normal_mask;
- int scanned_proto_mask;
};
//-------------------------------------------------------------------------
#include "file_api/file_service.h"
#include "flow/flow_control.h"
#include "main/analyzer.h"
+#include "main/binder.h"
#include "log/sf_textlog.h"
#include "log/log_text.h"
#include "time/periodic.h"
//-------------------------------------------------------------------------
-THREAD_LOCAL SnortConfig* snort_conf = NULL;
-static SnortConfig* snort_cmd_line_conf = NULL;
+THREAD_LOCAL SnortConfig* snort_conf = nullptr;
+static SnortConfig* snort_cmd_line_conf = nullptr;
static bool snort_initializing = true;
static int snort_exiting = 0;
/* Need to do this after dynamic detection stuff is initialized, too */
IpsManager::verify();
+ Binder::init();
if (snort_conf->file_mask != 0)
umask(snort_conf->file_mask);
return snort_conf->logging_flags & LOGGING_FLAG__QUIET;
}
-//-------------------------------------------------------------------------
-// FIXIT should be calling InspectionPolicy methods
-static inline void ScSetScannedProtocols(SnortConfig* sc, int mask)
-{
- sc->get_inspection_policy()->scanned_proto_mask = mask;
-}
-
-static inline int ScGetScannedProtocols(SnortConfig* sc)
-{
- return sc->get_inspection_policy()->scanned_proto_mask;
-}
-
//-------------------------------------------------------------------------
// FIXIT should be calling NetworkPolicy methods
return NULL;
}
-/**check whether a flow bit is set for an option node.
- *
- * @param otn Option Tree Node
- * @returns 0 - no flow bit is set, 1 otherwise
- */
-#if 0
-static int OtnHasFlowOrFlowbit(OptTreeNode *otn)
-{
- if (otn_has_plugin(otn, RULE_OPTION_TYPE_FLOW) ||
- otn_has_plugin(otn, RULE_OPTION_TYPE_FLOWBIT))
- {
- return 1;
- }
- return 0;
-}
-
-static void addRuleToIgnoreList(IgnoredRuleList **ppIgnoredRuleList, OptTreeNode *otn)
-{
- IgnoredRuleList *ignored_rule;
-
- ignored_rule = (IgnoredRuleList*)SnortAlloc(sizeof(*ignored_rule));
- ignored_rule->otn = otn;
- ignored_rule->next = *ppIgnoredRuleList;
- *ppIgnoredRuleList = ignored_rule;
-}
-
-static void printIgnoredRules(
- IgnoredRuleList *pIgnoredRuleList,
- int any_any_flow
- )
-{
- char six_sids = 0;
- int sids_ignored = 0;
- char buf[STD_BUF];
- IgnoredRuleList *ignored_rule;
- IgnoredRuleList *next_ignored_rule;
-
- buf[0] = '\0';
-
- for (ignored_rule = pIgnoredRuleList; ignored_rule != NULL; )
- {
- if (any_any_flow == 0)
- {
- if (six_sids == 1)
- {
- SnortSnprintfAppend(buf, STD_BUF-1, "\n");
- LogMessage("%s", buf);
- six_sids = 0;
- }
-
- if (sids_ignored == 0)
- {
- SnortSnprintf(buf, STD_BUF-1, " %d:%d",
- ignored_rule->otn->sigInfo.generator,
- ignored_rule->otn->sigInfo.id);
- }
- else
- {
- SnortSnprintfAppend(buf, STD_BUF-1, ", %d:%d",
- ignored_rule->otn->sigInfo.generator,
- ignored_rule->otn->sigInfo.id);
- }
- sids_ignored++;
- if (sids_ignored %6 == 0)
- {
- /* Have it print next time through */
- six_sids = 1;
- sids_ignored = 0;
- }
- }
- next_ignored_rule = ignored_rule->next;
- free(ignored_rule);
- ignored_rule = next_ignored_rule;
- }
-
- if (sids_ignored || six_sids)
- {
- SnortSnprintfAppend(buf, STD_BUF-1, "\n");
- LogMessage("%s", buf);
- }
-}
-
-/**Determines whether any_any_flow should be ignored or not.
- *
- * Dont ignore any_any_flows if flow bit is set on an any_any_flow,
- * or ignoreAnyAnyRules is not set.
- * @param portList port list
- * @param rtn Rule tree node
- * @param any_any_flow - set if any_any_flow is ignored,0 otherwise
- * @param ppIgnoredRuleList
- * @param ignoreAnyAnyRules
- * @returns
- */
-static int AnyAnyFlow(
- uint16_t *portList,
- OptTreeNode *otn,
- RuleTreeNode*,
- int any_any_flow,
- IgnoredRuleList **ppIgnoredRuleList,
- int ignoreAnyAnyRules)
-{
- /**if any_any_flow is set then following code has no effect.*/
- if (any_any_flow)
- {
- return any_any_flow;
- }
-
- /* Look for an OTN with flow or flowbits keyword */
- if (OtnHasFlowOrFlowbit(otn))
- {
- int i;
-
- for (i=1;i<=MAX_PORTS;i++)
- {
- /* track sessions for ALL ports becuase
- * of any -> any with flow/flowbits */
- portList[i] |= PORT_MONITOR_SESSION;
- }
- return 1;
- }
-
- if (ignoreAnyAnyRules)
- {
-
- /* if not, then ignore the content/pcre/etc */
- if (otn_has_plugin(otn, RULE_OPTION_TYPE_CONTENT) ||
- otn_has_plugin(otn, RULE_OPTION_TYPE_CONTENT_URI) ||
- otn_has_plugin(otn, RULE_OPTION_TYPE_BYTE_TEST) ||
- otn_has_plugin(otn, RULE_OPTION_TYPE_PCRE))
- {
- /* Ignoring this rule.... */
- addRuleToIgnoreList(ppIgnoredRuleList, otn);
- }
- }
-
- return 0;
-}
-
-/**initialize given port list from the given ruleset, for a given policy
- * @param portList pointer to array of MAX_PORTS+1 uint8_t. This array content
- * is changed by walking through the rulesets.
- * @param protocol - protocol type
- */
-static void setPortFilterList(
- SnortConfig* sc,uint16_t *portList,
- int protocol,
- int ignoreAnyAnyRules,
- PolicyId policyId
- )
-{
- char *port_array = NULL;
- int num_ports = 0;
- int i;
- RuleTreeNode *rtn;
- OptTreeNode *otn;
- int inspectSrc, inspectDst;
- char any_any_flow = 0;
- IgnoredRuleList *pIgnoredRuleList = NULL; ///list of ignored rules
- SFGHASH_NODE *hashNode;
- int flowBitIsSet = 0;
-
- if ((protocol == IPPROTO_TCP) && (ignoreAnyAnyRules == 0))
- {
- int j;
- for (j=0; j<MAX_PORTS; j++)
- {
- portList[j] |= PORT_MONITOR_SESSION | PORT_MONITOR_INSPECT;
- }
- return;
- }
-
- /* Post-process TCP rules to establish TCP ports to inspect. */
- for (hashNode = sfghash_findfirst(sc->otn_map);
- hashNode;
- hashNode = sfghash_findnext(sc->otn_map))
- {
- otn = (OptTreeNode *)hashNode->data;
- flowBitIsSet = OtnHasFlowOrFlowbit(otn);
-
- rtn = getRtnFromOtn(otn, policyId);
-
- if (!rtn)
- {
- continue;
- }
-
- if (rtn->proto == protocol)
- {
- //do operation
- inspectSrc = inspectDst = 0;
- if (PortObjectHasAny(rtn->src_portobject))
- {
- inspectSrc = -1;
- }
- else
- {
- port_array = PortObjectCharPortArray(port_array, rtn->src_portobject, &num_ports);
- if (port_array && num_ports != 0)
- {
- inspectSrc = 1;
- for (i=0;i<SFPO_MAX_PORTS;i++)
- {
- if (port_array[i])
- {
- portList[i] |= PORT_MONITOR_INSPECT;
- /* port specific rule */
- /* Look for an OTN with flow or flowbits keyword */
- if (flowBitIsSet)
- {
- portList[i] |= PORT_MONITOR_SESSION;
- }
- }
- }
- }
- if ( port_array )
- {
- free(port_array);
- port_array = NULL;
- }
- }
- if (PortObjectHasAny(rtn->dst_portobject))
- {
- inspectDst = -1;
- }
- else
- {
- port_array = PortObjectCharPortArray(port_array, rtn->dst_portobject, &num_ports);
- if (port_array && num_ports != 0)
- {
- inspectDst = 1;
- for (i=0;i<SFPO_MAX_PORTS;i++)
- {
- if (port_array[i])
- {
- portList[i] |= PORT_MONITOR_INSPECT;
- /* port specific rule */
- if (flowBitIsSet)
- {
- portList[i] |= PORT_MONITOR_SESSION;
- }
- }
- }
- }
- if ( port_array )
- {
- free(port_array);
- port_array = NULL;
- }
- }
- if ((inspectSrc == -1) && (inspectDst == -1))
- {
- /* any -> any rule */
- if (any_any_flow == 0)
- {
- any_any_flow = AnyAnyFlow(portList, otn, rtn, any_any_flow,
- &pIgnoredRuleList, ignoreAnyAnyRules);
- }
- }
- }
- }
-
- // If portscan is tracking TCP/UDP, need to create sessions for all ports
- if (((protocol == IPPROTO_UDP) && (ScGetScannedProtocols(sc) & PS_PROTO_UDP))
- || ((protocol == IPPROTO_TCP) && (ScGetScannedProtocols(sc) & PS_PROTO_TCP)))
- {
- int j;
- for (j=0; j<MAX_PORTS; j++)
- {
- portList[j] |= PORT_MONITOR_SESSION;
- }
- }
-
- if (any_any_flow == 1)
- {
- const char* protocolName = getProtocolName(protocol);
-
- LogMessage("WARNING: 'ignore_any_rules' option for Stream5 %s "
- "disabled because of %s rule with flow or flowbits option.\n",
- protocolName, protocolName);
- }
-
- else if (pIgnoredRuleList)
- {
- const char* protocolName = getProtocolName(protocol);
-
- LogMessage("WARNING: Rules (GID:SID) effectively ignored because of "
- "'ignore_any_rules' option for Stream5 %s.\n", protocolName);
- }
- // free list; print iff any_any_flow
- printIgnoredRules(pIgnoredRuleList, any_any_flow);
-
-}
-#endif
-
//-------------------------------------------------------------------------
// public methods
//-------------------------------------------------------------------------
// this distinction should be more precise when policy foo is ripped out of
// the instances.
-struct PHGlobal {
+struct PHGlobal
+{
const InspectApi& api;
bool init;
{ return ( a->api.type < b->api.type ); };
};
-struct PHClass {
+struct PHClass
+{
const InspectApi& api;
PHClass(const InspectApi& p) : api(p) { };
{ return ( a->api.type < b->api.type ); };
};
-struct PHInstance {
+struct PHInstance
+{
PHClass& pp_class;
Inspector* handler;
s_handlers.push_back(g);
}
+static const InspectApi* get_plugin(const char* keyword)
+{
+ for ( auto* p : s_handlers )
+ if ( !strcasecmp(p->api.base.name, keyword) )
+ return &p->api;
+
+ return nullptr;
+}
+
void InspectorManager::dump_plugins()
{
Dumper d("Inspectors");
p->handler->meta(type, data);
}
-Inspector* InspectorManager::get_inspector(
- const char* key, InspectSsnFunc& f)
+Inspector* InspectorManager::get_inspector(const char* key)
{
InspectionPolicy* pi = get_inspection_policy();
if ( !p )
return nullptr;
- f = p->pp_class.api.ssn;
return p->handler;
}
+InspectSsnFunc InspectorManager::get_session(const char* key)
+{
+ const InspectApi* api = get_plugin(key);
+ return api ? api->ssn : nullptr;
+}
+
//-------------------------------------------------------------------------
// config stuff
//-------------------------------------------------------------------------
static void reset_stats(SnortConfig*);
static void instantiate(const InspectApi*, Module*, SnortConfig*);
- static Inspector* get_inspector(const char* key, InspectSsnFunc&);
+ static Inspector* get_inspector(const char* key);
+ static InspectSsnFunc get_session(const char* key);
static bool configure(SnortConfig*);
static void print_config(SnortConfig*);
}
Mpse* MpseManager::get_search_engine(
- SnortConfig* sc,const MpseApi* api,
+ SnortConfig* sc,
+ const MpseApi* api,
bool use_gc,
void (*user_free)(void*),
void (*tree_free)(void**),
return true;
}
- InspectionPolicy* ips = get_inspection_policy();
- ips->normal_mask = config.normalizer_flags;
-
NetworkPolicy* nap = get_network_policy();
if ( nap->new_ttl && nap->new_ttl < nap->min_ttl )
static const char* name = "normalize";
-int Normalize_IsEnabled (SnortConfig*, NormFlags nf)
-{
- uint32_t mask = get_inspection_policy()->normal_mask;
- return ( (mask & nf) != 0 );
-}
-
static void no_init()
{
#ifdef PERF_PROFILING
NORM_ALL = 0x0003FFFF // all normalizations on
} NormFlags;
-int Normalize_IsEnabled(struct SnortConfig*, NormFlags);
+static inline int Normalize_IsEnabled(uint32_t mask, NormFlags nf)
+{
+ return ( (mask & nf) != 0 );
+}
#endif
Share::release(global);
}
-bool PortScan::configure(SnortConfig* sc)
+bool PortScan::configure(SnortConfig*)
{
// FIXIT use fixed base file name
config->logfile = SnortStrdup("portscan.log");
global = (PsData*)Share::acquire(PS_GLOBAL);
config->common = global->data;
-
- ScSetScannedProtocols(sc, config->detect_scans);
return true;
}
SnortConfig * ParseSnortConf(VarNode* tmp)
{
SnortConfig *sc = SnortConfNew();
+ snort_conf = sc;
const char* fname = get_snort_conf();
prune_log_max = 1048576;
}
-//-------------------------------------------------------------------------
-// class stuff
-//-------------------------------------------------------------------------
-
-// FIXIT BIND replace these with binder
-static Inspector* ip_hand = nullptr;
-static Inspector* icmp_hand = nullptr;
-static Inspector* tcp_hand = nullptr;
-static Inspector* udp_hand = nullptr;
-
//-------------------------------------------------------------------------
// inspector stuff
//-------------------------------------------------------------------------
if ( config->tcp_cfg.max_sessions )
{
- tcp_hand = InspectorManager::get_inspector("stream_tcp", f);
+ f = InspectorManager::get_session("stream_tcp");
flow_con->init_tcp(config->tcp_cfg, f);
}
if ( config->udp_cfg.max_sessions )
{
- udp_hand = InspectorManager::get_inspector("stream_udp", f);
+ f = InspectorManager::get_session("stream_udp");
flow_con->init_udp(config->udp_cfg, f);
}
if ( config->ip_cfg.max_sessions )
{
- ip_hand = InspectorManager::get_inspector("stream_ip", f);
+ f = InspectorManager::get_session("stream_ip");
flow_con->init_ip(config->ip_cfg, f);
}
if ( config->icmp_cfg.max_sessions )
{
- icmp_hand = InspectorManager::get_inspector("stream_icmp", f);
+ f = InspectorManager::get_session("stream_icmp");
flow_con->init_icmp(config->icmp_cfg, f);
}
if ( config->tcp_cfg.max_sessions || config->udp_cfg.max_sessions )
switch ( GET_IPH_PROTO(p) )
{
case IPPROTO_TCP:
- flow_con->process_tcp(tcp_hand, p);
+ flow_con->process_tcp(p);
t_stats.tcp++;
break;
case IPPROTO_UDP:
- flow_con->process_udp(udp_hand, p);
+ flow_con->process_udp(p);
t_stats.udp++;
break;
case IPPROTO_ICMP:
- flow_con->process_icmp(icmp_hand, p);
+ flow_con->process_icmp(p);
t_stats.icmp++;
break;
case IPPROTO_IP:
- flow_con->process_ip(ip_hand, p);
+ flow_con->process_ip(p);
t_stats.ip++;
break;
return flow->flowdata;
}
-uint16_t Stream::get_preprocessor_status_bit(void)
-{
- static uint16_t preproc_filter_status_bit = PORT_MONITOR_SESSION; // FIXIT bad joojoo
-
- preproc_filter_status_bit <<= 1;
-
- return preproc_filter_status_bit;
-}
-
void Stream::init_active_response(Packet* p, Flow* flow)
{
if ( !flow ) return;
*/
static int16_t set_application_protocol_id(Flow*, int16_t appId);
- /* Get an independent bit to allow an entity to enable and
- * disable port session tracking and syn session creation
- * without affecting the status of set by other entities.
- * Returns a bitmask (with the bit range 3-15) or 0, if no bits
- * are available.
- */
- static uint16_t get_preprocessor_status_bit(void);
-
// initialize response count and expiration time
static void init_active_response(Packet*, Flow*);
static bool is_paf_active(Flow*, bool toServer);
static bool activate_paf(Flow*, bool toServer);
- /* Set flag to force sessions to be created on SYN packets.
- * This function can only be used with independent bits
- * acquired from get_preprocessor_status_bit. If this is called
- * during parsing a preprocessor configuration, make sure to
- * set the parsing argument to 1.
- */
- static void set_tcp_syn_session_status(SnortConfig* sc, uint16_t status);
- /* Unset flag that forces sessions to be created on SYN
- * packets. This function can only be used with independent
- * bits acquired from get_preprocessor_status_bit. If this is
- * called during parsing a preprocessor configuration, make
- * sure to set the parsing argument to 1.
- */
- static void unset_tcp_syn_session_status(SnortConfig* sc, uint16_t status);
/* Turn off inspection for potential session.
* Adds session identifiers to a hash table.
* TCP only.
uint8_t s5_cb_idx;
};
-/**Port Inspection States. Port can be either ignored,
- * or inspected or session tracked. The values are bitmasks.
- */
-typedef enum {
- /**Dont monitor the port. */
- PORT_MONITOR_NONE = 0x00,
-
- /**Inspect the port. */
- PORT_MONITOR_INSPECT = 0x01,
-
- /**perform session tracking on the port. */
- PORT_MONITOR_SESSION = 0x02
-
-} PortMonitorStates;
-
extern Stream stream;
-#define PORT_MONITOR_SESSION_BITS 0xFFFE
-
#endif
mgr->auto_disable = auto_disable;
UpdateFlushMgr(mgr, flush_point_list, 0, paf_max);
+}
+
+static inline void pInitFlushMgr(
+ Flow* flow, FlushMgr *mgr, FlushPointList *flush_point_list,
+ uint8_t policy, uint8_t auto_disable, unsigned paf_max)
+{
+ InitFlushMgr(mgr, flush_point_list, policy, auto_disable, paf_max);
- if ( Normalize_IsEnabled(snort_conf, NORM_TCP_IPS) )
+ if ( Normalize_IsEnabled(flow->normal_mask, NORM_TCP_IPS) )
{
if ( policy == STREAM_FLPOLICY_FOOTPRINT )
mgr->flush_policy = STREAM_FLPOLICY_FOOTPRINT_IPS;
}
static inline void InitFlushMgrByService (
- StreamTracker* pst, int16_t service, bool c2s, uint8_t flush_policy)
+ Flow* flow, StreamTracker* pst, int16_t service, bool c2s, uint8_t flush_policy)
{
uint8_t registration, auto_disable = 0;
bool flush = (flush_policy != STREAM_FLPOLICY_IGNORE);
s5_paf_setup(&pst->paf_state, registration);
auto_disable = !flush;
}
- InitFlushMgr(&pst->flush_mgr, &pst->config->flush_point_list,
+ pInitFlushMgr(flow, &pst->flush_mgr, &pst->config->flush_point_list,
flush_policy, auto_disable, pst->config->paf_max);
}
switch ( fm->flush_policy)
{
case STREAM_FLPOLICY_IGNORE:
- InitFlushMgr(fm, &trk->config->flush_point_list,
+ pInitFlushMgr(lwssn, fm, &trk->config->flush_point_list,
STREAM_FLPOLICY_PROTOCOL, 0, trk->config->paf_max);
break;
Active_DropPacket();
}
+static inline bool Normalize_IsEnabled(Packet* p, NormFlags f)
+{
+ return p->flow->norm_is_enabled(f);
+}
+
static inline int NormalDropPacketIf (Packet* p, NormFlags f)
{
- if ( Normalize_IsEnabled(snort_conf, f) )
+ if ( Normalize_IsEnabled(p, f) )
{
NormalDropPacket(p);
normStats[PC_TCP_BLOCK]++;
Packet* p, NormFlags f, uint16_t max, TcpDataBlock* tdb
) {
if (
- Normalize_IsEnabled(snort_conf, f) &&
+ Normalize_IsEnabled(p, f) &&
p->dsize > max )
{
NormalTrimPayload(p, max, tdb);
#if 0
if ( p->tcph->th_flags & TH_ACK &&
- Normalize_IsEnabled(snort_conf, NORM_TCP_OPT) )
+ Normalize_IsEnabled(p, NORM_TCP_OPT) )
{
// FIXTHIS validate tsecr here (check that it was previously sent)
// checking for the most recent ts is easy enough must check if
// forces seq-- on ACK of FIN. :(
rcv->s_mgr.state == TCP_STATE_ESTABLISHED &&
rcv->s_mgr.state_queue == TCP_STATE_NONE &&
- Normalize_IsEnabled(snort_conf, NORM_TCP_IPS) )
+ Normalize_IsEnabled(p, NORM_TCP_IPS) )
{
// walk the seglist until a gap or tdb->ack whichever is first
// if a gap exists prior to ack, move ack back to start of gap
TcpSession *tcpssn, StreamTracker *st, Packet *p,
snort_ip_p sip, snort_ip_p dip, uint16_t sp, uint16_t dp, uint32_t dir)
{
- if ( Normalize_IsEnabled(snort_conf, NORM_TCP_IPS) )
+ if ( Normalize_IsEnabled(p, NORM_TCP_IPS) )
{
uint32_t bytes = get_q_sequenced(st);
return flush_to_seq(tcpssn, st, bytes, p, sip, dip, sp, dp, dir);
{
if(p->tcp_options[i].code == TCPOPT_TIMESTAMP)
{
- if ( strip && Normalize_IsEnabled(snort_conf, NORM_TCP_OPT) )
+ if ( strip && Normalize_IsEnabled(p, NORM_TCP_OPT) )
{
NormalStripTimeStamp(p, i);
}
int last = 0;
);
- ips_data = Normalize_IsEnabled(snort_conf, NORM_TCP_IPS);
+ ips_data = Normalize_IsEnabled(p, NORM_TCP_IPS);
if ( ips_data )
reassembly_policy = REASSEMBLY_POLICY_FIRST;
else
* the server port and we're reassembling the client side.
* That should make this almost as clear as opaque mud!
*/
+ // FIXIT these used to fall back to port configs which were deleted
+ // need to ensure that we can track a session w/o doing reassembly
+ // is else init flush to ignore needed?
if (tmp->server.config->flush_config_protocol[lwssn->s5_state.application_protocol].configured == 1)
{
StreamTracker* pst = &tmp->server;
uint8_t flush_policy =
pst->config->flush_config_protocol[lwssn->s5_state.application_protocol].client.flush_policy;
- InitFlushMgrByService(pst, lwssn->s5_state.application_protocol, true, flush_policy);
+ InitFlushMgrByService(
+ lwssn, pst, lwssn->s5_state.application_protocol, true, flush_policy);
}
if (tmp->client.config->flush_config_protocol[lwssn->s5_state.application_protocol].configured == 1)
StreamTracker* pst = &tmp->client;
uint8_t flush_policy =
pst->config->flush_config_protocol[lwssn->s5_state.application_protocol].server.flush_policy;
- InitFlushMgrByService(pst, lwssn->s5_state.application_protocol, false, flush_policy);
+ InitFlushMgrByService(
+ lwssn, pst, lwssn->s5_state.application_protocol, false, flush_policy);
}
#ifdef DEBUG_STREAM5
if (StreamGetPolicy(lwssn, config, FROM_CLIENT) !=
STREAM_POLICY_MACOS)
{
- if ( Normalize_IsEnabled(snort_conf, NORM_TCP_TRIM) )
+ if ( Normalize_IsEnabled(p, NORM_TCP_TRIM) )
{
NormalTrimPayload(p, 0, tdb); // remove data on SYN
}
talker->s_mgr.sub_state |= SUB_RST_SENT;
Stream5UpdatePerfBaseState(&sfBase, lwssn, TCP_STATE_CLOSING);
- if ( Normalize_IsEnabled(snort_conf, NORM_TCP_IPS) )
+ if ( Normalize_IsEnabled(p, NORM_TCP_IPS) )
listener->s_mgr.state = TCP_STATE_CLOSED;
/* else for ids:
leave listener open, data may be in transit */
// window is zero in one direction until we've seen both sides.
if ( !(lwssn->s5_state.session_flags & SSNFLAG_MIDSTREAM) )
{
- if ( Normalize_IsEnabled(snort_conf, NORM_TCP_TRIM) )
+ if ( Normalize_IsEnabled(p, NORM_TCP_TRIM) )
{
// sender of syn w/mss limits payloads from peer
// since we store mss on sender side, use listener mss
NormalTrimPayload(p, max, tdb);
}
- if ( Normalize_IsEnabled(snort_conf, NORM_TCP_ECN_STR) )
+ if ( Normalize_IsEnabled(p, NORM_TCP_ECN_STR) )
NormalCheckECN(tcpssn, p);
}
/*
if ((listener->flush_mgr.flush_policy != STREAM_FLPOLICY_PROTOCOL) &&
(listener->flush_mgr.flush_policy != STREAM_FLPOLICY_PROTOCOL_IPS) &&
- Normalize_IsEnabled(snort_conf, NORM_TCP_IPS))
+ Normalize_IsEnabled(p, NORM_TCP_IPS))
{
p->packet_flags |= PKT_PDU_TAIL;
}
}
else
{
- InitFlushMgr(&tcpssn->client.flush_mgr,
+ pInitFlushMgr(lwssn, &tcpssn->client.flush_mgr,
&tcpssn->client.config->flush_point_list,
flush_policy, 0, tcpssn->client.config->paf_max);
}
}
else
{
- InitFlushMgr(&tcpssn->server.flush_mgr,
+ pInitFlushMgr(lwssn, &tcpssn->server.flush_mgr,
&tcpssn->server.config->flush_point_list,
flush_policy, 0, tcpssn->server.config->paf_max);
}
{
if (dir & SSN_DIR_CLIENT)
{
- InitFlushMgr(&tcpssn->client.flush_mgr,
+ pInitFlushMgr(lwssn, &tcpssn->client.flush_mgr,
&tcpssn->client.config->flush_point_list,
flush_policy, 0, tcpssn->client.config->paf_max);
}
if (dir & SSN_DIR_SERVER)
{
- InitFlushMgr(&tcpssn->server.flush_mgr,
+ pInitFlushMgr(lwssn, &tcpssn->server.flush_mgr,
&tcpssn->server.config->flush_point_list,
flush_policy, 0, tcpssn->server.config->paf_max);
}
projects / thirdparty / snort3.git / commitdiff
