asn1_detect.cc
asn1_detect.h
ips_base64.cc
+ ips_bufferlen.cc
ips_byte_test.cc
ips_byte_jump.cc
ips_classtype.cc
ips_tos.cc
ips_ttl.cc
ips_window.cc
- ips_bufferlen.cc
range.cc
range.h
)
add_shared_library(ips_ack ips_options ips_ack.cc range.cc range.h)
add_shared_library(ips_asn1 ips_options ips_asn1.cc asn1_detect.cc asn1_detect.h)
add_shared_library(ips_base64 ips_options ips_base64.cc)
+ add_shared_library(ips_bufferlen ips_options range.cc range.h)
add_shared_library(ips_byte_test ips_options ips_byte_test.cc)
add_shared_library(ips_byte_jump ips_options ips_byte_jump.cc)
add_shared_library(ips_cvs ips_options ips_cvs.cc)
add_shared_library(ips_tos ips_options ips_tos.cc range.cc range.h)
add_shared_library(ips_ttl ips_options ips_ttl.cc range.cc range.h)
add_shared_library(ips_window ips_options ips_window.cc range.cc range.h)
- add_shared_library(ips_bufferlen ips_options ips_bufferlen.cc)
endif (STATIC_IPS_OPTIONS)
libips_base64_la_LDFLAGS = -export-dynamic -shared
libips_base64_la_SOURCES = ips_base64.cc
+optlib_LTLIBRARIES += libips_bufferlen.la
+libips_bufferlen_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
+libips_bufferlen_la_LDFLAGS = -export-dynamic -shared
+libips_bufferlen_la_SOURCES = ips_bufferlen.cc range.cc range.h
+
optlib_LTLIBRARIES += libips_byte_test.la
libips_byte_test_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
libips_byte_test_la_LDFLAGS = -export-dynamic -shared
libips_window_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
libips_window_la_LDFLAGS = -export-dynamic -shared
libips_window_la_SOURCES = ips_window.cc range.cc range.h
-
-optlib_LTLIBRARIES += libips_bufferlen.la
-libips_bufferlen_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
-libips_bufferlen_la_LDFLAGS = -export-dynamic -shared
-libips_bufferlen_la_SOURCES = ips_bufferlen.cc ips_bufferlen.h
endif
AM_CXXFLAGS = @AM_CXXFLAGS@
/*
** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-** Copyright (C) 2002-2013 Sourcefire, Inc.
-** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
**
** This program is free software; you can redistribute it and/or modify
** it under the terms of the GNU General Public License Version 2 as
** along with this program; if not, write to the Free Software
** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
+// ips_ack.cc author Russ Combs <rucombs@cisco.com>
#include <sys/types.h>
/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
- ** Copyright (C) 2005-2013 Sourcefire, Inc.
+ ** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
**
** This program is free software; you can redistribute it and/or modify
** it under the terms of the GNU General Public License Version 2 as
** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
** USA
*/
+// ips_bufferlen.cc author Russ Combs <rucombs@cisco.com>
#ifdef HAVE_CONFIG_H
#include "config.h"
#include <ctype.h>
#include <stdlib.h>
-#include <string.h>
#include "snort_types.h"
-#include "treenodes.h"
-#include "protocols/packet.h"
#include "snort_debug.h"
-#include "parser.h"
-#include "util.h"
#include "sfhashfcn.h"
-#include "mstring.h"
#include "snort.h"
#include "profiler.h"
-#include "fpdetect.h"
#include "sfhashfcn.h"
#include "detection/detection_defines.h"
-#include "detection_util.h"
+#include "range.h"
#include "framework/ips_option.h"
#include "framework/inspector.h"
#include "framework/cursor.h"
#include "framework/module.h"
-#include "flow/flow.h"
static const char* s_name = "bufferlen";
static THREAD_LOCAL ProfileStats lenCheckPerfStats;
-#define LEN_CHECK_EQ 1
-#define LEN_CHECK_GT 2
-#define LEN_CHECK_LT 3
-#define LEN_CHECK_RG 4
-
-struct LenCheckData
-{
- uint16_t len;
- uint16_t len2;
- char oper;
-};
-
class LenOption : public IpsOption
{
public:
- LenOption(const LenCheckData& c) :
+ LenOption(const RangeCheck& c) :
IpsOption(s_name)
{ config = c; };
int eval(Cursor&, Packet*);
private:
- LenCheckData config;
+ RangeCheck config;
};
//-------------------------------------------------------------------------
uint32_t LenOption::hash() const
{
uint32_t a,b,c;
- const LenCheckData *data = &config;
- a = data->len;
- b = data->len2;
- c = data->oper;
+ a = config.op;
+ b = config.min;
+ c = config.max;
mix_str(a,b,c,get_name());
final(a,b,c);
return false;
LenOption& rhs = (LenOption&)ips;
- LenCheckData *left = (LenCheckData*)&config;
- LenCheckData *right = (LenCheckData*)&rhs.config;
-
- if ( (left->len == right->len)
- && (left->len2 == right->len2)
- && (left->oper == right->oper) )
- {
- return true;
- }
-
- return false;
+ return ( config == rhs.config );
}
int LenOption::eval(Cursor& c, Packet*)
{
- LenCheckData *udata = &config;
int rval = DETECTION_OPTION_NO_MATCH;
PROFILE_VARS;
MODULE_PROFILE_START(lenCheckPerfStats);
- switch (udata->oper)
- {
- case LEN_CHECK_EQ:
- if (udata->len == c.size())
- rval = DETECTION_OPTION_MATCH;
- break;
- case LEN_CHECK_GT:
- if (udata->len < c.size())
- rval = DETECTION_OPTION_MATCH;
- break;
- case LEN_CHECK_LT:
- if (udata->len > c.size())
- rval = DETECTION_OPTION_MATCH;
- break;
- case LEN_CHECK_RG:
- if ((udata->len <= c.size()) && (udata->len2 >= c.size()))
- rval = DETECTION_OPTION_MATCH;
- break;
- default:
- break;
- }
+ if ( config.eval(c.length()) )
+ rval = DETECTION_OPTION_MATCH;
MODULE_PROFILE_END(lenCheckPerfStats);
return rval;
}
//-------------------------------------------------------------------------
-// module methods
+// module
//-------------------------------------------------------------------------
-static void len_parse(const char* argp, LenCheckData* ds_ptr)
-{
- char* curp = NULL;
- char **toks;
- int num_toks;
-
- toks = mSplit(argp, ",", 2, &num_toks, '\\');
- if (!num_toks)
- {
- ParseError("'%s' requires arguments.", s_name);
- }
-
- curp = toks[0];
-
- /* Parse the string */
- if (isdigit((int)*curp) && strstr(curp, "<>"))
- {
- char **mtoks;
- int num_mtoks;
- char* endp = NULL;
- long int val;
-
- mtoks = mSplit(curp, "<>", 2, &num_mtoks, '\\');
- if (num_mtoks != 2)
- {
- ParseError("Invalid '%s' argument.", s_name);
- }
-
- val = strtol(mtoks[0], &endp, 0);
- if ((val < 0) || *endp || (val > UINT16_MAX))
- {
- ParseError("Invalid '%s' argument.", s_name);
- }
-
- ds_ptr->len = (uint16_t)val;
-
- val = strtol(mtoks[1], &endp, 0);
- if ((val < 0) || *endp || (val > UINT16_MAX))
- {
- ParseError("Invalid '%s' argument.", s_name);
- }
-
- ds_ptr->len2 = (uint16_t)val;
-
- if (ds_ptr->len2 < ds_ptr->len)
- {
- uint16_t tmp = ds_ptr->len;
- ds_ptr->len = ds_ptr->len2;
- ds_ptr->len2 = tmp;
- }
-
- ds_ptr->oper = LEN_CHECK_RG;
-
- mSplitFree(&mtoks, num_mtoks);
- }
- else
- {
- char* endp = NULL;
- long int val;
-
- if(*curp == '>')
- {
- curp++;
- ds_ptr->oper = LEN_CHECK_GT;
- }
- else if(*curp == '<')
- {
- curp++;
- ds_ptr->oper = LEN_CHECK_LT;
- }
- else
- {
- ds_ptr->oper = LEN_CHECK_EQ;
- }
-
- while(isspace((int)*curp)) curp++;
-
- if (!*curp)
- {
- ParseError("Invalid '%s' argument.", s_name);
- }
-
- val = strtol(curp, &endp, 0);
- if ((val < 0) || *endp || (val > UINT16_MAX))
- {
- ParseError("Invalid '%s' argument.", s_name);
- }
-
- if ((ds_ptr->oper == LEN_CHECK_LT) && (val == 0))
- {
- ParseError("Invalid '%s' argument.", s_name);
- }
-
- ds_ptr->len = (uint16_t)val;
- }
-
- if (num_toks > 1 || strchr(argp, ','))
- {
- ParseError("Invalid '%s' argument.", s_name);
- }
-
- mSplitFree(&toks, num_toks);
-}
-
static const Parameter len_params[] =
{
{ "~range", Parameter::PT_STRING, nullptr, nullptr,
ProfileStats* get_profile() const
{ return &lenCheckPerfStats; };
- LenCheckData data;
+ RangeCheck data;
};
bool LenModule::begin(const char*, int, SnortConfig*)
{
- memset(&data, 0, sizeof(data));
+ data.init();
return true;
}
if ( !v.is("~range") )
return false;
- len_parse(v.get_string(), &data);
- return true;
+ return data.parse(v.get_string());
}
//-------------------------------------------------------------------------
/*
** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-** Copyright (C) 2002-2013 Sourcefire, Inc.
-** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
**
** This program is free software; you can redistribute it and/or modify
** it under the terms of the GNU General Public License Version 2 as
/*
** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-** Copyright (C) 2002-2013 Sourcefire, Inc.
-** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
**
** This program is free software; you can redistribute it and/or modify
** it under the terms of the GNU General Public License Version 2 as
** along with this program; if not, write to the Free Software
** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
+// ips_dsize.cc author Russ Combs <rucombs@cisco.com>
#include <ctype.h>
/*
- * Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+ ** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
** Copyright (C) 1998-2013 Sourcefire, Inc.
**
** This program is free software; you can redistribute it and/or modify
** along with this program; if not, write to the Free Software
** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
+// ips_filedata.cc author Russ Combs <rucombs@cisco.com>
#ifdef HAVE_CONFIG_H
#include "config.h"
#include <errno.h>
#include "snort_types.h"
-#include "snort_bounds.h"
-#include "protocols/packet.h"
-#include "parser.h"
#include "snort_debug.h"
-#include "util.h"
-#include "mstring.h"
-#include "snort.h"
#include "profiler.h"
-#include "fpdetect.h"
#include "detection/detection_defines.h"
#include "detection/detection_util.h"
#include "framework/cursor.h"
/*
** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-** Copyright (C) 2002-2013 Sourcefire, Inc.
-** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
**
** This program is free software; you can redistribute it and/or modify
** it under the terms of the GNU General Public License Version 2 as
** along with this program; if not, write to the Free Software
** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
+// ips_fragoffset.cc author Russ Combs <rucombs@cisco.com>
#include <sys/types.h>
#include <stdlib.h>
#include <ctype.h>
-#include <string.h>
#include "snort_types.h"
-#include "detection/treenodes.h"
#include "protocols/packet.h"
-#include "parser.h"
#include "snort_debug.h"
-#include "util.h"
#include "snort.h"
#include "profiler.h"
-#include "detection/fpdetect.h"
#include "sfhashfcn.h"
#include "detection/detection_defines.h"
#include "framework/ips_option.h"
#include "framework/module.h"
#include "range.h"
-#define GREATER_THAN 1
-#define LESS_THAN 2
-
-#define FB_NORMAL 0
-#define FB_ALL 1
-#define FB_ANY 2
-#define FB_NOT 3
-
-#define FB_RB 0x8000
-#define FB_DF 0x4000
-#define FB_MF 0x2000
-
static const char* s_name = "fragoffset";
static THREAD_LOCAL ProfileStats fragOffsetPerfStats;
/*
** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-** Copyright (C) 2002-2013 Sourcefire, Inc.
-** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
**
** This program is free software; you can redistribute it and/or modify
** it under the terms of the GNU General Public License Version 2 as
#ifdef HAVE_CONFIG_H
#include "config.h"
#endif
-#include <stdlib.h>
-#include <ctype.h>
#include "snort_types.h"
#include "detection/treenodes.h"
#include "snort_debug.h"
-#include "util.h"
#include "snort.h"
#include "detection/detection_defines.h"
#include "framework/ips_option.h"
/*
** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-** Copyright (C) 2002-2013 Sourcefire, Inc.
-** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
**
** This program is free software; you can redistribute it and/or modify
** it under the terms of the GNU General Public License Version 2 as
#include "config.h"
#endif
-#include <sys/types.h>
-#include <stdlib.h>
-#include <string.h>
-#include <ctype.h>
-
#include "snort_types.h"
-#include "treenodes.h"
#include "protocols/packet.h"
-#include "parser.h"
-#include "util.h"
#include "snort_debug.h"
#include "snort.h"
#include "profiler.h"
/*
** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-** Copyright (C) 2002-2013 Sourcefire, Inc.
-** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
**
** This program is free software; you can redistribute it and/or modify
** it under the terms of the GNU General Public License Version 2 as
#include "config.h"
#endif
-#include <sys/types.h>
-#include <stdlib.h>
-#include <string.h>
-#include <ctype.h>
-
#include <string>
using namespace std;
#include "snort_types.h"
-#include "treenodes.h"
-#include "protocols/packet.h"
#include "parser.h"
-#include "util.h"
#include "snort_debug.h"
#include "snort.h"
#include "profiler.h"
/*
** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-** Copyright (C) 2002-2013 Sourcefire, Inc.
-** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
**
** This program is free software; you can redistribute it and/or modify
** it under the terms of the GNU General Public License Version 2 as
** along with this program; if not, write to the Free Software
** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
+// ips_icmp_id.cc author Russ Combs <rucombs@cisco.com>
/* sp_icmp_id
*
#ifdef HAVE_CONFIG_H
#include "config.h"
#endif
-#include <stdlib.h>
-#include <ctype.h>
#include "snort_types.h"
-#include "detection/treenodes.h"
#include "protocols/packet.h"
-#include "parser.h"
#include "snort_debug.h"
-#include "util.h"
#include "snort.h"
#include "profiler.h"
#include "sfhashfcn.h"
/*
** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-** Copyright (C) 2002-2013 Sourcefire, Inc.
-** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
**
** This program is free software; you can redistribute it and/or modify
** it under the terms of the GNU General Public License Version 2 as
** along with this program; if not, write to the Free Software
** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
+// ips_icmp_seq.cc author Russ Combs <rucombs@cisco.com>
/* sp_icmp_seq_check
*
#ifdef HAVE_CONFIG_H
#include "config.h"
#endif
-#include <ctype.h>
#include "snort_types.h"
-#include "detection/treenodes.h"
#include "protocols/packet.h"
-#include "parser.h"
#include "snort_debug.h"
-#include "util.h"
#include "snort.h"
#include "profiler.h"
#include "detection/fpdetect.h"
/*
** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-** Copyright (C) 2002-2013 Sourcefire, Inc.
-** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
**
** This program is free software; you can redistribute it and/or modify
** it under the terms of the GNU General Public License Version 2 as
** along with this program; if not, write to the Free Software
** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
+// ips_icode.cc author Russ Combs <rucombs@cisco.com>
#include <stdlib.h>
#include <ctype.h>
#include "snort_types.h"
-#include "treenodes.h"
#include "protocols/packet.h"
-#include "parser.h"
-#include "util.h"
#include "snort_debug.h"
#include "sfhashfcn.h"
#include "snort.h"
#include "profiler.h"
-#include "fpdetect.h"
#include "sfhashfcn.h"
#include "detection/detection_defines.h"
#include "framework/ips_option.h"
b = config.min;
c = config.max;
- mix(a,b,c);
mix_str(a,b,c,get_name());
final(a,b,c);
/*
** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-** Copyright (C) 2002-2013 Sourcefire, Inc.
-** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
**
** This program is free software; you can redistribute it and/or modify
** it under the terms of the GNU General Public License Version 2 as
** along with this program; if not, write to the Free Software
** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
+// ips_id.cc author Russ Combs <rucombs@cisco.com>
#include <sys/types.h>
#ifdef HAVE_CONFIG_H
#include "config.h"
#endif
-#include <stdlib.h>
-#include <ctype.h>
#include "snort_types.h"
-#include "treenodes.h"
#include "protocols/packet.h"
-#include "parser.h"
#include "snort_debug.h"
-#include "util.h"
#include "snort.h"
#include "profiler.h"
-#include "fpdetect.h"
#include "sfhashfcn.h"
#include "detection/detection_defines.h"
#include "framework/ips_option.h"
/*
** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-** Copyright (C) 2002-2013 Sourcefire, Inc.
-** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
**
** This program is free software; you can redistribute it and/or modify
** it under the terms of the GNU General Public License Version 2 as
** along with this program; if not, write to the Free Software
** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
-
-#include <stdlib.h>
-#include <string.h>
-#include <ctype.h>
+// ips_itype.cc author Russ Combs <rucombs@cisco.com>
#ifdef HAVE_CONFIG_H
#include "config.h"
#endif
#include "snort_types.h"
-#include "treenodes.h"
#include "protocols/packet.h"
-#include "parser.h"
#include "snort_debug.h"
-#include "util.h"
#include "sfhashfcn.h"
#include "snort.h"
#include "profiler.h"
-#include "fpdetect.h"
#include "sfhashfcn.h"
#include "detection/detection_defines.h"
#include "framework/ips_option.h"
/*
** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-** Copyright (C) 2013-2013 Sourcefire, Inc.
**
** This program is free software; you can redistribute it and/or modify
** it under the terms of the GNU General Public License Version 2 as
** along with this program; if not, write to the Free Software
** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
+// ips_luajit.cc author Russ Combs <rucombs@cisco.com>
#include "ips_luajit.h"
/*
** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-** Copyright (C) 2002-2013 Sourcefire, Inc.
-** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
**
** This program is free software; you can redistribute it and/or modify
** it under the terms of the GNU General Public License Version 2 as
*/
// ips_metadata.cc author Russ Combs <rucombs@cisco.com>
-#include <sys/types.h>
-
#ifdef HAVE_CONFIG_H
#include "config.h"
#endif
-#include <stdlib.h>
-#include <ctype.h>
#include <string>
#include <vector>
using namespace std;
#include "snort_types.h"
-#include "detection/treenodes.h"
#include "snort_debug.h"
-#include "util.h"
#include "snort.h"
#include "detection/detection_defines.h"
#include "framework/ips_option.h"
/*
** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-** Copyright (C) 2002-2013 Sourcefire, Inc.
-** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
**
** This program is free software; you can redistribute it and/or modify
** it under the terms of the GNU General Public License Version 2 as
#ifdef HAVE_CONFIG_H
#include "config.h"
#endif
-#include <stdlib.h>
-#include <ctype.h>
#include <string>
#include "snort_types.h"
#include "detection/treenodes.h"
#include "snort_debug.h"
-#include "util.h"
#include "snort.h"
#include "detection/detection_defines.h"
#include "framework/ips_option.h"
/*
** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-** Copyright (C) 2013-2013 Sourcefire, Inc.
**
** This program is free software; you can redistribute it and/or modify
** it under the terms of the GNU General Public License Version 2 as
** along with this program; if not, write to the Free Software
** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
+// ips_options.cc author Russ Combs <rucombs@cisco.com>
#include "ips_options.h"
/*
- * Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
- ** Copyright (C) 1998-2013 Sourcefire, Inc.
+ ** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
**
** This program is free software; you can redistribute it and/or modify
** it under the terms of the GNU General Public License Version 2 as
** along with this program; if not, write to the Free Software
** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
+// ips_options.cc author Russ Combs <rucombs@cisco.com>
#ifdef HAVE_CONFIG_H
#include "config.h"
#endif
-#include <sys/types.h>
-#include <stdlib.h>
-#include <ctype.h>
-#include <errno.h>
-
#include "snort_types.h"
#include "snort_bounds.h"
#include "protocols/packet.h"
-#include "parser.h"
#include "snort_debug.h"
-#include "util.h"
-#include "mstring.h"
#include "snort.h"
#include "profiler.h"
-#include "fpdetect.h"
#include "framework/cursor.h"
#include "framework/ips_option.h"
#include "framework/module.h"
/*
** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-** Copyright (C) 2002-2013 Sourcefire, Inc.
-** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
**
** This program is free software; you can redistribute it and/or modify
** it under the terms of the GNU General Public License Version 2 as
#ifdef HAVE_CONFIG_H
#include "config.h"
#endif
-#include <stdlib.h>
-#include <ctype.h>
#include "snort_types.h"
#include "detection/treenodes.h"
#include "snort_debug.h"
-#include "util.h"
#include "snort.h"
#include "detection/detection_defines.h"
#include "framework/ips_option.h"
/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
- ** Copyright (C) 1998-2013 Sourcefire, Inc.
+ ** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
**
** This program is free software; you can redistribute it and/or modify
** it under the terms of the GNU General Public License Version 2 as
** along with this program; if not, write to the Free Software
** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
+// ips_priority.cc author Russ Combs <rucombs@cisco.com>
#ifdef HAVE_CONFIG_H
#include "config.h"
#endif
-#include <sys/types.h>
-#include <stdlib.h>
-#include <ctype.h>
-#include <errno.h>
-
#include "snort_types.h"
-#include "snort_bounds.h"
#include "protocols/packet.h"
-#include "parser.h"
#include "snort_debug.h"
-#include "util.h"
-#include "mstring.h"
#include "snort.h"
#include "profiler.h"
-#include "fpdetect.h"
#include "detection/detection_defines.h"
#include "detection_util.h"
#include "framework/cursor.h"
/****************************************************************************
- *
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
- * Copyright (C) 2005-2013 Sourcefire, Inc.
+ * Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License Version 2 as
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*
****************************************************************************/
-
-// @file sp_react.c
-// @author Russ Combs <rcombs@sourcefire.com>
+// ips_react.cc author Russ Combs <rucombs@cisco.com>
/* The original Snort React Plugin was contributed by Maciej Szarpak, Warsaw
* University of Technology. The module has been entirely rewritten by
#include "protocols/packet.h"
#include "managers/packet_manager.h"
#include "detection/detection_defines.h"
-#include "parser.h"
+#include "parser/parser.h"
#include "profiler.h"
-#include "fpdetect.h"
#include "packet_io/active.h"
#include "sfhashfcn.h"
#include "snort.h"
/*
** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-** Copyright (C) 2002-2013 Sourcefire, Inc.
-** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
**
** This program is free software; you can redistribute it and/or modify
** it under the terms of the GNU General Public License Version 2 as
*/
// ips_reference.cc author Russ Combs <rucombs@cisco.com>
-#include <sys/types.h>
-
#ifdef HAVE_CONFIG_H
#include "config.h"
#endif
-#include <stdlib.h>
-#include <ctype.h>
#include <string>
#include "snort_types.h"
#include "detection/treenodes.h"
#include "snort_debug.h"
-#include "util.h"
#include "snort.h"
#include "detection/detection_defines.h"
#include "framework/ips_option.h"
/*
** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-** Copyright (C) 2002-2013 Sourcefire, Inc.
-** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
**
** This program is free software; you can redistribute it and/or modify
** it under the terms of the GNU General Public License Version 2 as
#ifdef HAVE_CONFIG_H
#include "config.h"
#endif
-#include <stdlib.h>
-#include <ctype.h>
#include "snort_types.h"
-#include "detection/treenodes.h"
#include "snort_debug.h"
-#include "util.h"
#include "snort.h"
#include "detection/detection_defines.h"
#include "framework/ips_option.h"
/****************************************************************************
*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+ * Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
* Copyright (C) 2005-2013 Sourcefire, Inc.
*
* This program is free software; you can redistribute it and/or modify it
* - if a resp3 rule is also a drop rule, the drop processing takes precedence.
*/
-// @file sp_respond3.c
-// @author Russ Combs <rcombs@sourcefire.com>
+// ips_resp.cc author Russ Combs <rucombs@cisco.com>
#ifdef HAVE_CONFIG_H
#include "config.h"
/*
** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-** Copyright (C) 2002-2013 Sourcefire, Inc.
-** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
**
** This program is free software; you can redistribute it and/or modify
** it under the terms of the GNU General Public License Version 2 as
*/
// ips_rev.cc author Russ Combs <rucombs@cisco.com>
-#include <sys/types.h>
-
#ifdef HAVE_CONFIG_H
#include "config.h"
#endif
-#include <stdlib.h>
-#include <ctype.h>
#include "snort_types.h"
#include "detection/treenodes.h"
#include "snort_debug.h"
-#include "util.h"
#include "snort.h"
#include "detection/detection_defines.h"
#include "framework/ips_option.h"
/*
** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-** Copyright (C) 2002-2013 Sourcefire, Inc.
-** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
**
** This program is free software; you can redistribute it and/or modify
** it under the terms of the GNU General Public License Version 2 as
** along with this program; if not, write to the Free Software
** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
+// ips_seq.cc author Russ Combs <rucombs@cisco.com>
#ifdef HAVE_CONFIG_H
#include "config.h"
#endif
-#include <sys/types.h>
-#include <stdlib.h>
-#include <ctype.h>
-
#include "snort_types.h"
-#include "treenodes.h"
#include "protocols/packet.h"
-#include "parser.h"
-#include "util.h"
#include "snort_debug.h"
#include "snort.h"
#include "profiler.h"
-#include "fpdetect.h"
#include "sfhashfcn.h"
#include "detection/detection_defines.h"
#include "framework/ips_option.h"
/*
** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-** Copyright (C) 2002-2013 Sourcefire, Inc.
-** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
**
** This program is free software; you can redistribute it and/or modify
** it under the terms of the GNU General Public License Version 2 as
*/
// ips_sid.cc author Russ Combs <rucombs@cisco.com>
-#include <sys/types.h>
-
#ifdef HAVE_CONFIG_H
#include "config.h"
#endif
-#include <stdlib.h>
-#include <ctype.h>
#include "snort_types.h"
#include "detection/treenodes.h"
#include "snort_debug.h"
-#include "util.h"
#include "snort.h"
#include "detection/detection_defines.h"
#include "framework/ips_option.h"
/*
** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-** Copyright (C) 2013-2013 Sourcefire, Inc.
**
** This program is free software; you can redistribute it and/or modify
** it under the terms of the GNU General Public License Version 2 as
** along with this program; if not, write to the Free Software
** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
+// ips_so.cc author Russ Combs <rucombs@cisco.com>
#include "framework/so_rule.h"
/*
** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-** Copyright (C) 2002-2013 Sourcefire, Inc.
-** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
**
** This program is free software; you can redistribute it and/or modify
** it under the terms of the GNU General Public License Version 2 as
#ifdef HAVE_CONFIG_H
#include "config.h"
#endif
-#include <stdlib.h>
-#include <ctype.h>
#include <string>
#include "snort_types.h"
#include "detection/treenodes.h"
#include "snort_debug.h"
-#include "util.h"
#include "snort.h"
+#include "packet.h"
#include "detection/detection_defines.h"
#include "framework/ips_option.h"
#include "framework/parameter.h"
/*
** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-** Copyright (C) 2002-2013 Sourcefire, Inc.
-** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
**
** This program is free software; you can redistribute it and/or modify
** it under the terms of the GNU General Public License Version 2 as
#ifdef HAVE_CONFIG_H
#include "config.h"
#endif
-#include <stdlib.h>
-#include <ctype.h>
#include "snort_types.h"
#include "detection/treenodes.h"
#include "snort_debug.h"
-#include "util.h"
#include "snort.h"
#include "detection/detection_defines.h"
#include "detection/tag.h"
/*
** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-** Copyright (C) 2002-2013 Sourcefire, Inc.
-** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
**
** This program is free software; you can redistribute it and/or modify
** it under the terms of the GNU General Public License Version 2 as
** along with this program; if not, write to the Free Software
** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
+// ips_tag.cc author Russ Combs <rucombs@cisco.com>
#ifdef HAVE_CONFIG_H
#include "config.h"
#endif
-#include <sys/types.h>
-#include <stdlib.h>
-#include <ctype.h>
-#include <string.h>
-
#include "protocols/packet.h"
-#include "parser.h"
#include "snort_debug.h"
-#include "util.h"
#include "snort.h"
#include "profiler.h"
-#include "fpdetect.h"
#include "sfhashfcn.h"
#include "detection/detection_defines.h"
#include "framework/ips_option.h"
/*
** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-** Copyright (C) 2002-2013 Sourcefire, Inc.
-** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
**
** This program is free software; you can redistribute it and/or modify
** it under the terms of the GNU General Public License Version 2 as
** along with this program; if not, write to the Free Software
** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
+// ips_tag.cc author Russ Combs <rucombs@cisco.com>
#ifdef HAVE_CONFIG_H
#include "config.h"
#endif
-#include <stdlib.h>
-#include <ctype.h>
-
#include "snort_types.h"
-#include "treenodes.h"
#include "protocols/packet.h"
#include "snort_debug.h"
-#include "parser.h"
-#include "util.h"
#include "sfhashfcn.h"
#include "snort.h"
#include "profiler.h"
-#include "fpdetect.h"
#include "sfhashfcn.h"
#include "detection/detection_defines.h"
#include "framework/ips_option.h"
/*
** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-** Copyright (C) 2002-2013 Sourcefire, Inc.
-** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
**
** This program is free software; you can redistribute it and/or modify
** it under the terms of the GNU General Public License Version 2 as
** along with this program; if not, write to the Free Software
** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
+// ips_tag.cc author Russ Combs <rucombs@cisco.com>
#ifdef HAVE_CONFIG_H
#include "config.h"
#endif
-#include <sys/types.h>
-#include <stdlib.h>
-#include <string.h>
-#include <ctype.h>
-
#include "snort_types.h"
-#include "treenodes.h"
#include "protocols/packet.h"
-#include "parser.h"
-#include "util.h"
#include "snort_debug.h"
#include "snort.h"
#include "profiler.h"
-#include "fpdetect.h"
#include "sfhashfcn.h"
#include "detection/detection_defines.h"
#include "framework/ips_option.h"
{
switch ( op )
{
- case EQ:
+ case EQ:
return ( min == c );
- case NOT:
+ case NOT:
return ( min != c );
- case LT:
+ case LT:
return ( min < c );
- case LE:
+ case LE:
return ( min <= c );
- case GT:
+ case GT:
return ( min > c );
- case GE:
+ case GE:
return ( min >= c );
- case LG:
+ case LG:
return ( min < c && c < max );
default:
projects / thirdparty / snort3.git / commitdiff
