-- update from josh
-- ensure stream normalizations get proper header iff needed
-- fixed stream_reassemble.direction
+-- initial integration of hosts into binder
127
-- REG_TEST out logging tcp options for rebuilt packets to match snort bug
* LuaJIT from http://luajit.org for configuration and scripting.
-* pcap from http://www.tcpdump.org for tcpdump logging.
+* pcap from http://www.tcpdump.org for tcpdump style logging.
* pcre from http://www.pcre.org for regular expression pattern matching.
* Optionally built features are listed in the reference section.
-* You should build Snort++ with --prefix $install_dir where install_dir is
- something you can easily delete.
+* You should build Snort++ with an install prefix so that you can easily
+ delete older versions.
* To build with autotools, the usual ./configure, make, make install from
- the top level directory will suffice.
+ the top level directory will suffice. If you don't have ./configure,
+ then autoreconf -isvf must be done first.
* To build with Cmake and make, first create a separate directory for the
build and cd into that directory. Then:
=== Using Lua
-* Snort++ needs a lua conf. use $install_dir/conf/snort.lua, like -c
- $install_dir/conf/snort.lua.
+* Snort++ needs a lua conf. You can use $install_dir/conf/snort.lua, like
+ -c $install_dir/conf/snort.lua.
* lua/snort.lua is always the latest working example configuration.
#include "detection_util.h"
#include "managers/inspector_manager.h"
#include "managers/event_manager.h"
-#include "target_based/sftarget_protocol_reference.h"
#include "detection_defines.h"
#include "protocols/ip.h"
#include "sfip/sf_ipvar.h"
if (!(mode & (CHECK_SRC_PORT | CHECK_DST_PORT)))
{
- DEBUG_WRAP(
- DebugMessage(DEBUG_ATTRIBUTE, "detect.c: CheckAddrPort..."
- "target-based-protocol=%d,ignoring ports\n",
- GetProtocolReference(p)););
return 1;
}
- else
- {
- DEBUG_WRAP(
- DebugMessage(DEBUG_ATTRIBUTE, "detect.c: CheckAddrPort..."
- "target-based-protocol=%d,not ignoring ports\n",
- GetProtocolReference(p)););
- }
/* check the packet port against the rule port */
if( !PortObjectHasPort(po,pkt_port) )
/* Check if attributes provided match earlier */
if (check_ports == 0)
{
- DEBUG_WRAP(
- DebugMessage(DEBUG_ATTRIBUTE, "detect.c: CheckSrcPortEq..."
- "target-based-protocol=%d,ignoring ports\n",
- GetProtocolReference(p)););
return fp_list->next->RuleHeadFunc(p, rtn_idx, fp_list->next, check_ports);
}
- else
- {
- DEBUG_WRAP(
- DebugMessage(DEBUG_ATTRIBUTE, "detect.c: CheckSrcPortEq..."
- "target-based-protocol=%d,not ignoring ports\n",
- GetProtocolReference(p)););
- }
if( PortObjectHasPort(rtn_idx->src_portobject,p->ptrs.sp) )
{
DEBUG_WRAP(DebugMessage(DEBUG_DETECT, " SP match!\n"););
/* Check if attributes provided match earlier */
if (check_ports == 0)
{
- DEBUG_WRAP(
- DebugMessage(DEBUG_ATTRIBUTE, "detect.c: CheckSrcPortNotEq..."
- "target-based-protocol=%d,ignoring ports\n",
- GetProtocolReference(p)););
return fp_list->next->RuleHeadFunc(p, rtn_idx, fp_list->next, check_ports);
}
- else
- {
- DEBUG_WRAP(
- DebugMessage(DEBUG_ATTRIBUTE, "detect.c: CheckSrcPortNotEq..."
- "target-based-protocol=%d,not ignoring ports\n",
- GetProtocolReference(p)););
- }
if( !PortObjectHasPort(rtn_idx->src_portobject,p->ptrs.sp) )
{
DEBUG_WRAP(DebugMessage(DEBUG_DETECT, " !SP match!\n"););
/* Check if attributes provided match earlier */
if (check_ports == 0)
{
- DEBUG_WRAP(
- DebugMessage(DEBUG_ATTRIBUTE, "detect.c: CheckDstPortEq..."
- "target-based-protocol=%d,ignoring ports\n",
- GetProtocolReference(p)););
return fp_list->next->RuleHeadFunc(p, rtn_idx, fp_list->next, check_ports);
}
- else
- {
- DEBUG_WRAP(
- DebugMessage(DEBUG_ATTRIBUTE, "detect.c: CheckDstPortEq..."
- "target-based-protocol=%d,not ignoring ports\n",
- GetProtocolReference(p)););
- }
if( PortObjectHasPort(rtn_idx->dst_portobject,p->ptrs.dp) )
{
DEBUG_WRAP(DebugMessage(DEBUG_DETECT, " DP match!\n"););
/* Check if attributes provided match earlier */
if (check_ports == 0)
{
- DEBUG_WRAP(
- DebugMessage(DEBUG_ATTRIBUTE, "detect.c: CheckDstPortNotEq..."
- "target-based-protocol=%d,ignoring ports\n",
- GetProtocolReference(p)););
return fp_list->next->RuleHeadFunc(p, rtn_idx, fp_list->next, check_ports);
}
- else
- {
- DEBUG_WRAP(
- DebugMessage(DEBUG_ATTRIBUTE, "detect.c: CheckDstPortNotEq..."
- "target-based-protocol=%d,not ignoring ports\n",
- GetProtocolReference(p)););
- }
if( !PortObjectHasPort(rtn_idx->dst_portobject,p->ptrs.dp) )
{
DEBUG_WRAP(DebugMessage(DEBUG_DETECT, " !DP match!\n"););
#include "utils/stats.h"
#include "treenodes.h"
#include "parser.h"
-#include "target_based/sftarget_reader.h"
#include "framework/mpse.h"
#include "framework/ips_option.h"
#include "managers/mpse_manager.h"
#define LOCAL_DEBUG
*/
-#include "target_based/sftarget_protocol_reference.h"
-
static sopg_table_t * ServicePortGroupTableNew(void)
{
return (sopg_table_t *)SnortAlloc(sizeof(sopg_table_t));
if (fpDetectGetDebugPrintRuleGroupBuildDetails(fp))
LogMessage("Rule Maps Done....\n");
- if (IsAdaptiveConfigured()
- || fpDetectGetDebugPrintFastPatterns(fp))
{
if (fpDetectGetDebugPrintRuleGroupBuildDetails(fp))
LogMessage("Creating Service Based Rule Maps....\n");
#include "hash/sfghash.h"
#include "pcrm.h"
+#include "target_based/sftarget_protocol_reference.h"
struct SnortConfig;
-/*
- * Max Number of Protocols Supported by Rules in fpcreate.c
- * for tcp,udp,icmp,ip ... this is an array dimesnion used to
- * map protocol-ordinals to port_groups ...
- */
-/* This is now defined in sftarget_protocol_refererence.h"
- * #define MAX_PROTOCOL_ORDINAL 8192 */
-#include "target_based/sftarget_protocol_reference.h"
-
/*
* This controls how many fast pattern match contents may be
* used/retrieved per rule in fpcreate.c.
#include "packet_io/active.h"
#include "ips_options/ips_content.h"
#include "stream/stream_api.h"
-#include "target_based/sftarget_protocol_reference.h"
-#include "target_based/sftarget_reader.h"
#include "utils/sflsq.h"
#include "ppm.h"
#include "detection_util.h"
{
PORT_GROUP *src = NULL, *dst = NULL, *gen = NULL;
- if (IsAdaptiveConfigured())
{
/* Check for a service/protocol ordinal for this packet */
- int16_t proto_ordinal = GetProtocolReference(p);
+ int16_t proto_ordinal = p->flow->s5_state.application_protocol;
DEBUG_WRAP( DebugMessage(DEBUG_ATTRIBUTE,"proto_ordinal=%d\n",proto_ordinal););
{
PORT_GROUP *src = NULL, *dst = NULL, *gen = NULL;
- if (IsAdaptiveConfigured())
{
- int16_t proto_ordinal = GetProtocolReference(p);
+ int16_t proto_ordinal = p->flow->s5_state.application_protocol;
DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, "proto_ordinal=%d\n", proto_ordinal););
#include "snort.h"
#include "parser.h"
-#include "target_based/sftarget_protocol_reference.h"
-#include "parser.h"
-
/* for eval and free functions */
#include "ips_options/ips_content.h"
#include "detection_util.h"
#include "service_inspectors/http_inspect/hi_main.h" // FIXIT-M bad dependency; use inspector::get_buf()
-#include "target_based/sftarget_protocol_reference.h"
-#include "target_based/sftarget_reader.h"
-
static bool file_type_id_enabled = false; // STATIC
static bool file_signature_enabled = false;
static bool file_processing_initiated = false;
}
LogMessage(" %12s: " FMTu64("-10") " \n", "Total",verdicts_total);
- if (IsAdaptiveConfigured())
{
LogMessage("\nFiles processed by protocol IDs:\n");
for (i = 0; i < MAX_PROTOCOL_ORDINAL; i++)
uint16_t client_port;
uint16_t server_port;
+ uint16_t ssn_policy;
uint16_t session_state;
- uint8_t handler[SE_MAX];
+ uint8_t handler[SE_MAX];
uint8_t response_count;
+
uint8_t inner_client_ttl, inner_server_ttl;
uint8_t outer_client_ttl, outer_server_ttl;
};
/****************************************************************************
*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+ * Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
* Copyright (C) 2013-2013 Sourcefire, Inc.
*
* This program is free software; you can redistribute it and/or modify
// FIXIT-L these are cloned from ip_module.cc and tcp_module.cc
#define ip_policies \
- "first | linux | bsd | bsd_right |last | windows | solaris"
+ "unknown | first | linux | bsd | bsd_right |last | windows | solaris"
#define tcp_policies \
- "first | last | bsd | linux | old-linux | windows | win-2003 | vista " \
- "solaris | hpux | hpux10 | irix | macos"
+ "unknown | first | last | bsd | linux | old-linux | windows | win-2003 | " \
+ "vista | solaris | hpux | hpux10 | irix | macos"
static const Parameter service_params[] =
{
else if ( v.is("frag_policy") )
{
- strncpy(host->hostInfo.fragPolicyName, v.get_string(),
- sizeof(host->hostInfo.fragPolicyName));
- host->hostInfo.fragPolicy = v.get_long() + 1;
+ host->hostInfo.fragPolicy = v.get_long();
}
else if ( v.is("tcp_policy") )
{
- strncpy(host->hostInfo.streamPolicyName, v.get_string(),
- sizeof(host->hostInfo.streamPolicyName));
- host->hostInfo.streamPolicy = v.get_long() + 1;
+ host->hostInfo.streamPolicy = v.get_long();
}
else if ( v.is("name") )
app->protocol = AddProtocolReference(v.get_string());
#include "time/periodic.h"
#include "parser/config_file.h"
#include "parser/cmd_line.h"
-#include "target_based/sftarget_reader.h"
#include "stream/stream_api.h"
#include "stream/stream.h"
#include "actions/act_replace.h"
#include "filters/detection_filter.h"
+#include "target_based/sftarget_reader.h"
#ifdef INTEL_SOFT_CPM
#include "search/intel_soft_cpm.h"
pi->framework_policy = nullptr;
}
+// FIXIT-L allowing lookup by name or type or key is kinda hinky
+// would be helpful to have specific lookups
static PHInstance* get_instance(
FrameworkPolicy* fp, const char* keyword, bool dflt_only = false)
{
#include "binding.h"
#include "bind_module.h"
#include "flow/flow.h"
+#include "flow/session.h"
#include "framework/inspector.h"
#include "framework/plug_data.h"
#include "stream/stream_splitter.h"
#include "main/snort.h"
#include "main/policy.h"
#include "parser/parser.h"
+#include "target_based/sftarget_data.h"
+#include "target_based/sftarget_protocol_reference.h"
+#include "target_based/sftarget_reader.h"
THREAD_LOCAL ProfileStats bindPerfStats;
if ( !check_vlan(flow) )
return false;
- // FIXIT-H need to check role and addr/ports relative to it
+ // FIXIT-M need to check role and addr/ports relative to it
if ( !check_addr(flow) )
return false;
if ( pin )
{
+ // FIXIT-M need to set ssn client and server independently
flow->set_client(pin);
flow->set_server(pin);
flow->clouseau = nullptr;
flow->clouseau = nullptr;
}
+static Inspector* get_gadget(Flow* flow, const HostAttributeEntry* host)
+{
+ stream.set_application_protocol_id_from_host_entry(flow, host, SSN_DIR_SERVER);
+
+ if ( !flow->s5_state.application_protocol )
+ return nullptr;
+
+ const char* s = get_protocol_name(flow->s5_state.application_protocol);
+
+ return InspectorManager::get_inspector(s);
+}
+
//-------------------------------------------------------------------------
// stuff stuff
//-------------------------------------------------------------------------
bool update(Binding*);
- void apply_action(Flow*);
- void apply_session(Flow*);
- void apply_service(Flow*);
+ bool apply_action(Flow*);
+ void apply_session(Flow*, const HostAttributeEntry*);
+ void apply_service(Flow*, const HostAttributeEntry*);
};
bool Stuff::update(Binding* pb)
return false;
}
-void Stuff::apply_action(Flow* flow)
+bool Stuff::apply_action(Flow* flow)
{
switch ( action )
{
case BA_BLOCK:
stream.drop_traffic(flow, SSN_DIR_BOTH);
flow->set_state(Flow::BLOCK);
- return;
+ return false;
case BA_ALLOW:
flow->set_state(Flow::ALLOW);
- return;
+ return false;
- case BA_INSPECT:
- flow->set_state(Flow::INSPECT);
+ default:
break;
}
+ flow->set_state(Flow::INSPECT);
+ return true;
}
-void Stuff::apply_session(Flow* flow)
+void Stuff::apply_session(Flow* flow, const HostAttributeEntry* host)
{
if ( server )
{
return;
}
+
switch ( flow->protocol )
{
case PktType::IP:
set_session(flow, INS_IP);
+ flow->ssn_policy = host ? host->hostInfo.fragPolicy : 0;
break;
case PktType::ICMP:
case PktType::TCP:
set_session(flow, INS_TCP);
+ flow->ssn_policy = host ? host->hostInfo.streamPolicy : 0;
break;
case PktType::UDP:
}
}
-void Stuff::apply_service(Flow* flow)
+void Stuff::apply_service(Flow* flow, const HostAttributeEntry* host)
{
if ( data )
flow->set_data(data);
+ if ( host && !gadget )
+ gadget = get_gadget(flow, host);
+
if ( gadget )
flow->set_gadget(gadget);
void Binder::apply(Flow* flow, Stuff& stuff)
{
// setup action
- stuff.apply_action(flow);
+ if ( !stuff.apply_action(flow) )
+ return;
+
+ const HostAttributeEntry* host = SFAT_LookupHostEntryByIP(&flow->server_ip);
// setup session
- stuff.apply_session(flow);
+ stuff.apply_session(flow, host);
// setup service
- stuff.apply_service(flow);
+ stuff.apply_service(flow, host);
}
//-------------------------------------------------------------------------
#include "ips_options/ips_flowbits.h"
#include "file_api/file_service_config.h"
#include "packet_io/sfdaq.h"
-#include "target_based/sftarget_reader.h"
#include "managers/event_manager.h"
#include "detection/detect.h"
#include "sfip/sf_ip.h"
#include "managers/so_manager.h"
#include "config_file.h"
#include "keywords.h"
-#include "target_based/sftarget_reader.h"
#define SRC 0
#define DST 1
#include "parse_rule.h"
#include "parse_stream.h"
#include "vars.h"
-#include "target_based/sftarget_reader.h"
static unsigned parse_errors = 0;
static unsigned parse_warnings = 0;
#include "framework/ips_option.h"
#include "config_file.h"
#include "keywords.h"
-#include "target_based/sftarget_reader.h"
//-------------------------------------------------------------------------
// var node stuff
#undef inet_ntoa
#endif
-SO_PUBLIC char *sfip_to_str(const sfip_t *ip);
+SO_PUBLIC char *sfip_to_str(const sfip_t*);
#define sfip_ntoa(x) sfip_to_str(x)
#define inet_ntoa sfip_ntoa
return 1;
}
-int FragGetPolicy(Packet *p, FragEngine *engine)
-{
- int frag_policy;
- /* Not caching this host_entry in the frag tracker so we can
- * swap the table out after processing this packet if we need
- * to. */
- HostAttributeEntry *host_entry;
-
- if (!IsAdaptiveConfigured())
- return engine->frag_policy;
-
- host_entry = SFAT_LookupHostEntryByDst(p);
-
- if (host_entry && (isFragPolicySet(host_entry) == POLICY_SET))
- {
- frag_policy = getFragPolicy(host_entry);
-
- if (frag_policy != SFAT_UNKNOWN_FRAG_POLICY)
- {
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
- "FragGetPolicy: Policy Map Entry: %d(%s)\n",
- frag_policy, frag_policy_names[frag_policy]););
-
- return frag_policy;
- }
- }
-
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
- "FragGetPolicy: Using configured default %d(%s)\n",
- engine->frag_policy, frag_policy_names[engine->frag_policy]););
-
- return engine->frag_policy;
-}
-
/** checks for tiny fragments and raises appropriate alarm
*
* @param p Current packet to insert
t_stats.trackers_released++;
}
-int fragGetApplicationProtocolId(Packet *p)
-{
- FragTracker *ft;
- /* Not caching this host_entry in the frag tracker so we can
- * swap the table out after processing this packet if we need
- * to. */
- HostAttributeEntry *host_entry = NULL;
- uint16_t src_port = 0;
- uint16_t dst_port = 0;
-
- if ( !p->flow || p->flow->protocol != PktType::IP )
- {
- return 0;
- }
-
- /* Must be a rebuilt frag... */
- if (!(p->packet_flags & PKT_REBUILT_FRAG))
- {
- return 0;
- }
-
- ft = &((IpSession*)p->flow->session)->tracker;
-
- if (ft->application_protocol != 0)
- {
- return ft->application_protocol;
- }
-
- switch (p->type())
- {
- case PktType::TCP:
- ft->ipprotocol = protocolReferenceTCP;
- src_port = p->ptrs.sp;
- dst_port = p->ptrs.dp;
- break;
- case PktType::UDP:
- ft->ipprotocol = protocolReferenceUDP;
- src_port = p->ptrs.sp;
- dst_port = p->ptrs.dp;
- break;
- case PktType::ICMP:
- ft->ipprotocol = protocolReferenceICMP;
- break;
- default:
- break;
- }
-
- host_entry = SFAT_LookupHostEntryBySrc(p);
- if (host_entry)
- {
- ft->application_protocol = getApplicationProtocolId(host_entry,
- ft->ipprotocol,
- src_port,
- SFAT_SERVICE);
- if (ft->application_protocol != 0)
- {
- return ft->application_protocol;
- }
- }
-
- host_entry = SFAT_LookupHostEntryByDst(p);
- if (host_entry)
- {
- ft->application_protocol = getApplicationProtocolId(host_entry,
- ft->ipprotocol,
- dst_port,
- SFAT_SERVICE);
- if (ft->application_protocol != 0)
- {
- return ft->application_protocol;
- }
- }
-
- return ft->application_protocol;
-}
-
//-------------------------------------------------------------------------
// Defrag methods
//-------------------------------------------------------------------------
ft->ip_options_data = NULL;
ft->copied_ip_options_len = 0;
ft->ordinal = 0;
- ft->frag_policy = FragGetPolicy(p, &engine);
+ ft->frag_policy = p->flow->ssn_policy ? p->flow->ssn_policy : engine.frag_policy;
ft->engine = &engine;
/*
public:
IpSession(Flow*);
- bool setup (Packet*) override;
+ bool setup(Packet*) override;
int process(Packet*) override;
void clear() override;
/****************************************************************************
*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+ * Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
* Copyright (C) 2005-2013 Sourcefire, Inc.
*
* This program is free software; you can redistribute it and/or modify
#include <sys/types.h>
#include <netinet/in.h>
-#include "target_based/sftarget_protocol_reference.h"
#include "framework/counts.h"
#include "utils/bitop_funcs.h"
#include "framework/inspector.h"
-
#include "snort_types.h"
#include "snort.h"
#include "detect.h"
#include "stream/stream_api.h"
-
-#include "target_based/sftarget_hostentry.h"
+#include "target_based/sftarget_protocol_reference.h"
//#define DEBUG_STREAM5 DEBUG
};
#if 0
-FIXIT-1 delete?
+FIXIT-M delete?
typedef struct {
PegCount filtered;
PegCount inspected;
#include "target_based/sftarget_protocol_reference.h"
#include "target_based/sftarget_hostentry.h"
-
Stream stream; // FIXIT-L global for SnortContext
Stream::Stream()
}
void Stream::set_application_protocol_id_from_host_entry(
- Flow* flow, HostAttributeEntry *host_entry, int direction)
+ Flow* flow, const HostAttributeEntry *host_entry, int direction)
{
int16_t application_protocol;
{
application_protocol = getApplicationProtocolId(
host_entry, flow->s5_state.ipprotocol,
- ntohs(flow->server_port), SFAT_SERVICE);
+ flow->server_port, SFAT_SERVICE);
}
else
{
application_protocol = getApplicationProtocolId(
host_entry, flow->s5_state.ipprotocol,
- ntohs(flow->client_port), SFAT_SERVICE);
+ flow->client_port, SFAT_SERVICE);
if ( application_protocol &&
(flow->s5_state.session_flags & SSNFLAG_MIDSTREAM) )
if (flow->s5_state.application_protocol != 0)
return flow->s5_state.application_protocol;
- if (!IsAdaptiveConfigured())
- return flow->s5_state.application_protocol;
-
if (flow->s5_state.ipprotocol == 0)
{
set_ip_protocol(flow);
if (!flow)
return 0;
- if (!IsAdaptiveConfigured())
- return 0;
-
if (flow->s5_state.application_protocol != id)
{
flow->s5_state.application_protocol = id;
set_ip_protocol(flow);
SFAT_UpdateApplicationProtocol(
- &flow->server_ip, ntohs(flow->server_port),
+ &flow->server_ip, flow->server_port,
flow->s5_state.ipprotocol, id);
return id;
void update_direction(Flow*, char dir, const sfip_t *ip, uint16_t port);
static void set_application_protocol_id_from_host_entry(
- Flow *lwssn, struct _HostAttributeEntry *host_entry, int direction);
+ Flow*, const struct HostAttributeEntry*, int direction);
static uint32_t set_session_flags(Flow*, uint32_t flags);
static uint32_t get_session_flags(Flow*);
#include "snort.h"
#include "stream/stream.h"
#include "stream/stream_api.h"
-#include "target_based/sftarget_protocol_reference.h"
//--------------------------------------------------------------------
// private state
#include "flow/flow.h"
#include "stream/stream_api.h"
#include "protocols/packet.h"
-#include "target_based/sftarget_protocol_reference.h"
#include "framework/bits.h"
struct StreamTcpConfig
return flushed;
}
-void TcpSession::restart(Packet* p)
-{
- StreamTracker* talker, * listener;
- TcpSession* tcpssn = (TcpSession*)p->flow->session;
-
- if ( p->packet_flags & PKT_FROM_SERVER )
- {
- talker = &tcpssn->server;
- listener = &tcpssn->client;
- }
- else
- {
- talker = &tcpssn->client;
- listener = &tcpssn->server;
- }
-
- // FIXTHIS-H on data / on ack must be based on flush policy
- if ( p->dsize > 0 )
- CheckFlushPolicyOnData(this, talker, listener, p);
-
- if ( p->ptrs.tcph->is_ack() )
- CheckFlushPolicyOnAck(this, talker, listener, p);
-}
-
int Stream5FlushTalker(Packet *p, Flow *lwssn)
{
StreamTracker *talker = NULL;
return S5_UNALIGNED;
}
-uint16_t StreamGetPolicy(
- Flow *lwssn, StreamTcpConfig *config, int direction)
-{
- uint16_t policy_id;
- /* Not caching this host_entry in the frag tracker so we can
- * swap the table out after processing this packet if we need
- * to. */
- HostAttributeEntry *host_entry = NULL;
- int ssn_dir;
-
- if (!IsAdaptiveConfigured())
- return config->policy;
-
- if (direction == FROM_CLIENT)
- {
- host_entry = SFAT_LookupHostEntryByIP(&lwssn->server_ip);
- ssn_dir = SSN_DIR_SERVER;
- }
- else
- {
- host_entry = SFAT_LookupHostEntryByIP(&lwssn->client_ip);
- ssn_dir = SSN_DIR_CLIENT;
- }
- if (host_entry && (isStreamPolicySet(host_entry) == POLICY_SET))
- {
- policy_id = getStreamPolicy(host_entry);
-
- if (policy_id != SFAT_UNKNOWN_STREAM_POLICY)
- {
- STREAM5_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "StreamGetPolicy: Policy Map Entry: %d(%s)\n",
- policy_id, reassembly_policy_names[policy_id]););
-
- /* Since we've already done the lookup, try to get the
- * application protocol id with that host_entry. */
- stream.set_application_protocol_id_from_host_entry(lwssn, host_entry, ssn_dir);
- return policy_id;
- }
- }
-
- STREAM5_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "StreamGetPolicy: Using configured default %d(%s)\n",
- config->policy, reassembly_policy_names[config->policy]););
-
- return config->policy;
-}
-
void SetTcpReassemblyPolicy(StreamTracker *st)
{
st->reassembly_policy = GetTcpReassemblyPolicy(st->os_policy);
}
-static void SetOSPolicy(TcpSession *tcpssn)
+static void SetOSPolicy(Flow* flow, TcpSession *tcpssn)
{
- if (tcpssn->client.os_policy == 0)
+ if ( !tcpssn->client.os_policy )
{
- tcpssn->client.os_policy = StreamGetPolicy(tcpssn->flow, tcpssn->client.config, FROM_SERVER);
+ tcpssn->client.os_policy = flow->ssn_policy ? flow->ssn_policy :
+ tcpssn->client.config->policy;
SetTcpReassemblyPolicy(&tcpssn->client);
}
- if (tcpssn->server.os_policy == 0)
+ if ( !tcpssn->server.os_policy )
{
- tcpssn->server.os_policy = StreamGetPolicy(tcpssn->flow, tcpssn->server.config, FROM_CLIENT);
+ tcpssn->server.os_policy = flow->ssn_policy ? flow->ssn_policy :
+ tcpssn->server.config->policy;
SetTcpReassemblyPolicy(&tcpssn->server);
}
}
if (lwssn->s5_state.session_flags & SSNFLAG_RESET)
lwssn->s5_state.session_flags &= ~SSNFLAG_RESET;
- SetOSPolicy(tmp);
+ SetOSPolicy(lwssn, tmp);
if ( (lwssn->s5_state.session_flags & SSNFLAG_CLIENT_SWAP) &&
!(lwssn->s5_state.session_flags & SSNFLAG_CLIENT_SWAPPED) )
if ((p->dsize) && p->ptrs.tcph->is_syn())
{
/* MacOS accepts data on SYN, so don't alert if policy is MACOS */
- if (StreamGetPolicy(lwssn, config, FROM_CLIENT) !=
- STREAM_POLICY_MACOS)
+ if ( talker->os_policy != STREAM_POLICY_MACOS)
{
if ( Normalize_IsEnabled(NORM_TCP_TRIM) )
{
TcpSessionClear(flow, this, 1);
}
+void TcpSession::restart(Packet* p)
+{
+ StreamTracker* talker, * listener;
+ TcpSession* tcpssn = (TcpSession*)p->flow->session;
+
+ if ( p->packet_flags & PKT_FROM_SERVER )
+ {
+ talker = &tcpssn->server;
+ listener = &tcpssn->client;
+ }
+ else
+ {
+ talker = &tcpssn->client;
+ listener = &tcpssn->server;
+ }
+
+ // FIXTHIS-H on data / on ack must be based on flush policy
+ if ( p->dsize > 0 )
+ CheckFlushPolicyOnData(this, talker, listener, p);
+
+ if ( p->ptrs.tcph->is_ack() )
+ CheckFlushPolicyOnAck(this, talker, listener, p);
+}
+
void TcpSession::update_direction(
char dir, const sfip_t *ip, uint16_t port)
{
#define HOST_INFO_VERSION 3
#define HOST_INFO_FRAG_POLICY 4
#define HOST_INFO_STREAM_POLICY 5
-#define POLICY_SET 1
-#define POLICY_NOT_SET 0
-typedef struct _HostInfo
-{
- char streamPolicyName[16];
- char fragPolicyName[16];
-
- uint16_t streamPolicy;
- uint16_t fragPolicy;
- char streamPolicySet;
- char fragPolicySet;
-} HostInfo;
+struct HostInfo
+{
+ uint8_t streamPolicy;
+ uint8_t fragPolicy;
+};
#define SFAT_SERVICE 1
#define SFAT_CLIENT 2
-typedef struct _HostAttributeEntry
+
+struct HostAttributeEntry
{
sfip_t ipAddr;
-
HostInfo hostInfo;
ApplicationList *services;
ApplicationList *clients;
-} HostAttributeEntry;
+};
int SFAT_AddHost(HostAttributeEntry*);
int SFAT_AddService(HostAttributeEntry*, ApplicationEntry*);
#include "sftarget_hostentry.h"
-int hasService(HostAttributeEntry *host_entry,
+int hasService(const HostAttributeEntry *host_entry,
int ipprotocol,
int protocol,
int application)
return SFTARGET_NOMATCH;
}
-int hasClient(HostAttributeEntry *host_entry,
+int hasClient(const HostAttributeEntry *host_entry,
int ipprotocol,
int protocol,
int application)
return SFTARGET_NOMATCH;
}
-int hasProtocol(HostAttributeEntry *host_entry,
+int hasProtocol(const HostAttributeEntry *host_entry,
int ipprotocol,
int protocol,
int application)
return ret;
}
-char isFragPolicySet(HostAttributeEntry *host_entry)
-{
- if (host_entry && host_entry->hostInfo.fragPolicySet)
- {
- return POLICY_SET;
- }
- return POLICY_NOT_SET;
-}
-
-char isStreamPolicySet(HostAttributeEntry *host_entry)
-{
- if (host_entry && host_entry->hostInfo.streamPolicySet)
- {
- return POLICY_SET;
- }
- return POLICY_NOT_SET;
-}
-
-uint16_t getFragPolicy(HostAttributeEntry *host_entry)
+uint16_t getFragPolicy(const HostAttributeEntry *host_entry)
{
if (!host_entry)
return SFAT_UNKNOWN_FRAG_POLICY;
- if (!host_entry->hostInfo.fragPolicySet)
- return SFAT_UNKNOWN_FRAG_POLICY;
-
return host_entry->hostInfo.fragPolicy;
}
-uint16_t getStreamPolicy(HostAttributeEntry *host_entry)
+uint16_t getStreamPolicy(const HostAttributeEntry *host_entry)
{
if (!host_entry)
return SFAT_UNKNOWN_STREAM_POLICY;
- if (!host_entry->hostInfo.streamPolicySet)
- return SFAT_UNKNOWN_STREAM_POLICY;
-
return host_entry->hostInfo.streamPolicy;
}
-int getApplicationProtocolId(HostAttributeEntry *host_entry,
+int getApplicationProtocolId(const HostAttributeEntry *host_entry,
int ipprotocol,
uint16_t port,
char direction)
/* API for HostAttributeEntry 'class' */
-int hasService(HostAttributeEntry *hostEntry,
+int hasService(const HostAttributeEntry *hostEntry,
int ipprotocol,
int protocol,
int application);
-int hasClient(HostAttributeEntry *hostEntry,
+int hasClient(const HostAttributeEntry *hostEntry,
int ipprotocol,
int protocol,
int application);
-int hasProtocol(HostAttributeEntry *hostEntry,
+int hasProtocol(const HostAttributeEntry *hostEntry,
int ipprotocol,
int protocol,
int application);
-int getProtocol(HostAttributeEntry *hostEntry,
+int getProtocol(const HostAttributeEntry *hostEntry,
int ipprotocol,
uint16_t port);
-int getApplicationProtocolId(HostAttributeEntry *host_entry,
+int getApplicationProtocolId(const HostAttributeEntry *host_entry,
int ipprotocol,
uint16_t port,
char direction);
#define SFAT_UNKNOWN_STREAM_POLICY 0
-uint16_t getStreamPolicy(HostAttributeEntry *host_entry);
-char isStreamPolicySet(HostAttributeEntry *host_entry);
+uint16_t getStreamPolicy(const HostAttributeEntry *host_entry);
#define SFAT_UNKNOWN_FRAG_POLICY 0
-uint16_t getFragPolicy(HostAttributeEntry *host_entry);
-char isFragPolicySet(HostAttributeEntry *host_entry);
+uint16_t getFragPolicy(const HostAttributeEntry *host_entry);
+
+#endif
-#endif /* SFTARGET_HOSTENTRY_H */
#include "sftarget_protocol_reference.h"
+#include <string>
+#include <vector>
+using namespace std;
+
#include "hash/sfghash.h"
#include "util.h"
#include "snort_debug.h"
static SFGHASH *proto_reference_table = NULL; // STATIC
static int16_t protocol_number = 1;
+static vector<string> id_map;
+
+const char* get_protocol_name(uint16_t id)
+{
+ if ( id >= id_map.size() )
+ id = 0;
+
+ return id_map[id].c_str();
+}
+
/* XXX XXX Probably need to do this during swap time since the
* proto_reference_table is accessed during runtime */
int16_t AddProtocolReference(const char *protocol)
return reference->ordinal;
}
+ if ( protocol_number == 1 )
+ id_map.push_back("unknown");
+
+ id_map.push_back(protocol);
+
reference = (SFTargetProtocolReference*)SnortAlloc(sizeof(SFTargetProtocolReference));
reference->ordinal = protocol_number++;
if (protocol_number > MAX_PROTOCOL_ORDINAL)
void InitializeProtocolReferenceTable(void);
void FreeProtoocolReferenceTable(void);
+const char* get_protocol_name(uint16_t id);
int16_t AddProtocolReference(const char *protocol);
SO_PUBLIC int16_t FindProtocolReference(const char *protocol);
if ((app->fields & required_fields) != required_fields)
{
- sfip_t host_addr;
- sfip_set_ip(&host_addr, &host->ipAddr);
- host_addr.ip32[0] = ntohl(host_addr.ip32[0]);
ParseError("Missing required field in Service attribute table for host %s",
- inet_ntoa(&host_addr));
+ inet_ntoa(&host->ipAddr));
}
AppendApplicationData(&host->services, app);
{
ApplicationEntry *app;
int i = 0;
- sfip_t host_addr;
if (!host)
return;
- sfip_set_ip(&host_addr, &host->ipAddr);
- host_addr.ip32[0] = ntohl(host_addr.ip32[0]);
-
DebugMessage(DEBUG_ATTRIBUTE, "Host IP: %s/%d\n",
- inet_ntoa(&host_addr),
- host->ipAddr.bits
- );
- DebugMessage(DEBUG_ATTRIBUTE, "\tPolicy Information: frag:%s (%s %u) stream: %s (%s %u)\n",
- host->hostInfo.fragPolicyName, host->hostInfo.fragPolicySet ? "set":"unset", host->hostInfo.fragPolicy,
- host->hostInfo.streamPolicyName, host->hostInfo.streamPolicySet ? "set":"unset", host->hostInfo.streamPolicy);
+ inet_ntoa(&host->ipAddr),
+ host->ipAddr.bits);
+
+ DebugMessage(DEBUG_ATTRIBUTE,
+ "\tPolicy Information: frag:%s (%u) stream: %s (%u)\n",
+ "look-me-up", host->hostInfo.fragPolicy,
+ "look-me-up", host->hostInfo.streamPolicy);
+
DebugMessage(DEBUG_ATTRIBUTE, "\tServices:\n");
+
for (i=0, app = host->services; app; app = app->next,i++)
{
DebugMessage(DEBUG_ATTRIBUTE, "\tService #%d:\n", i);
HostAttributeEntry *SFAT_LookupHostEntryByIP(const sfip_t *ipAddr)
{
HostAttributeEntry *host = NULL;
- sfip_t local_ipAddr;
if ( !curr_cfg )
return NULL;
- sfip_set_ip(&local_ipAddr, ipAddr);
- if (local_ipAddr.family == AF_INET)
- {
- local_ipAddr.ip32[0] = ntohl(local_ipAddr.ip32[0]);
- }
-
- host = (HostAttributeEntry*)sfrt_lookup(&local_ipAddr, curr_cfg->lookupTable);
-
- if (host)
- {
- /* Set the policy values for Frag & Stream if not already set */
- //TODO: SetTargetBasedPolicy(host);
- }
+ host = (HostAttributeEntry*)sfrt_lookup((void*)ipAddr, curr_cfg->lookupTable);
return host;
}
return curr_cfg;
}
-int IsAdaptiveConfigured()
-{
- if ( curr_cfg || next_cfg )
- return 1;
-
- return 0;
-}
-
void SFAT_UpdateApplicationProtocol(sfip_t *ipAddr, uint16_t port, uint16_t protocol, uint16_t id)
{
HostAttributeEntry *host_entry;
ApplicationEntry *service;
- sfip_t local_ipAddr;
unsigned service_count = 0;
int rval;
- sfip_set_ip(&local_ipAddr, ipAddr);
- if (local_ipAddr.family == AF_INET)
- local_ipAddr.ip32[0] = ntohl(local_ipAddr.ip32[0]);
-
- host_entry = (HostAttributeEntry*)sfrt_lookup(&local_ipAddr, curr_cfg->lookupTable);
+ host_entry = (HostAttributeEntry*)sfrt_lookup(ipAddr, curr_cfg->lookupTable);
if (!host_entry)
{
return;
host_entry = (HostAttributeEntry*)SnortAlloc(sizeof(*host_entry));
- sfip_set_ip(&host_entry->ipAddr, &local_ipAddr);
- if ((rval = sfrt_insert(&local_ipAddr, (unsigned char)local_ipAddr.bits, host_entry,
- RT_FAVOR_SPECIFIC, curr_cfg->lookupTable)) != RT_SUCCESS)
+ sfip_set_ip(&host_entry->ipAddr, ipAddr);
+
+ if ((rval = sfrt_insert(ipAddr, (unsigned char)ipAddr->bits, host_entry,
+ RT_FAVOR_SPECIFIC, curr_cfg->lookupTable)) != RT_SUCCESS)
{
FreeHostEntry(host_entry);
return;
void SFAT_SetConfig(tTargetBasedConfig*);
void SFAT_Free(tTargetBasedConfig*);
-/* Returns whether this has been configured */
-int IsAdaptiveConfigured();
-
-#endif /* SFTARGET_READER_H */
+#endif
#include "ppm.h"
#include "packet_io/active.h"
#include "packet_time.h"
-#include "target_based/sftarget_reader.h"
#include "stream/stream.h"
#ifdef PATH_MAX
projects / thirdparty / snort3.git / commitdiff
