--- /dev/null
+AUTOMAKE_OPTIONS=foreign no-dependencies
+
+SUBDIRS = \
+src
+
+AM_CXXFLAGS = @AM_CXXFLAGS@
--- /dev/null
+# Process this file with autoconf to produce a configure script.
+
+AC_INIT([snort_examples], [1.0], [snort-team@sourcefire.com])
+AC_PREREQ(2.69)
+
+AC_CONFIG_SRCDIR([config.h.in])
+AC_CONFIG_MACRO_DIR([m4])
+AC_CONFIG_HEADERS([config.h])
+
+AM_INIT_AUTOMAKE
+
+# Checks for programs.
+AC_PROG_CXX
+AC_PROG_LIBTOOL
+
+# Use the same defines Snort used
+# (absolutely critical to ensure struct definitions match)
+CXXFLAGS=`pkg-config --cflags snort`
+
+AM_CXXFLAGS="-std=c++11"
+AX_CXX_COMPILE_STDCXX_11
+
+# not sure why this is borked
+#AC_ENABLE_VISIBILITY()
+#
+# so we do like snort:
+# modified from gnulib/m4/visibility.m4
+AC_DEFUN([CC_VISIBILITY],
+[
+ AC_REQUIRE([AC_PROG_CC])
+ AC_MSG_CHECKING([for visibility support])
+ AC_CACHE_VAL(gl_cv_cc_visibility, [
+ gl_save_CFLAGS="$CFLAGS"
+ # Add -Werror flag since some compilers, e.g. icc 7.1, don't support it,
+ # but only warn about it instead of compilation failing
+ CFLAGS="$CFLAGS -Werror -fvisibility=hidden"
+ AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
+ extern __attribute__((__visibility__("hidden"))) int hiddenvar;
+ extern __attribute__((__visibility__("default"))) int exportedvar;
+ extern __attribute__((__visibility__("hidden"))) int hiddenfunc (void);
+ extern __attribute__((__visibility__("default"))) int exportedfunc (void);]],
+ [[]])],
+ [gl_cv_cc_visibility="yes"],
+ [gl_cv_cc_visibility="no"])
+ ])
+ AC_MSG_RESULT([$gl_cv_cc_visibility])
+ CFLAGS="$gl_save_CFLAGS"
+ if test "x$gl_cv_cc_visibility" = "xyes"; then
+ AM_CXXFLAGS="$AM_CXXFLAGS -fvisibility=default"
+ AC_DEFINE([HAVE_VISIBILITY],[1],
+ [Define if the compiler supports visibility declarations.])
+ fi
+])
+CC_VISIBILITY()
+
+# Checks for libraries.
+AC_ARG_WITH(snort-includes,
+ [ --with-snort-includes=DIR snort include directory],
+ [with_snort_includes="$withval"], [with_snort_includes="no"])
+
+if test "x$with_snort_includes" != "xno"; then
+ AM_CPPFLAGS="${AM_CPPFLAGS} -I${with_snort_includes}"
+fi
+
+AC_SUBST(AM_CXXFLAGS)
+AC_SUBST(AM_CPPFLAGS)
+
+AC_CONFIG_FILES([ \
+ Makefile \
+ src/Makefile \
+ src/inspectors/Makefile \
+ src/ips_options/Makefile \
+ src/loggers/Makefile \
+ src/search_engines/Makefile \
+ src/so_rules/Makefile \
+])
+
+AC_OUTPUT
+
--- /dev/null
+libalert_ex_la-alert_ex.lo: alert_ex.cc ../config.h /usr/include/ctype.h \
+ /usr/include/runetype.h /usr/include/_types.h /usr/include/sys/_types.h \
+ /usr/include/sys/cdefs.h /usr/include/sys/_symbol_aliasing.h \
+ /usr/include/sys/_posix_availability.h /usr/include/machine/_types.h \
+ /usr/include/i386/_types.h /usr/include/string.h \
+ /usr/include/Availability.h /usr/include/AvailabilityInternal.h \
+ /usr/include/strings.h /opt/local/include/gcc49/c++/algorithm \
+ /opt/local/include/gcc49/c++/utility \
+ /opt/local/include/gcc49/c++/x86_64-apple-darwin12/bits/c++config.h \
+ /opt/local/include/gcc49/c++/x86_64-apple-darwin12/bits/os_defines.h \
+ /opt/local/include/gcc49/c++/x86_64-apple-darwin12/bits/cpu_defines.h \
+ /opt/local/include/gcc49/c++/bits/stl_relops.h \
+ /opt/local/include/gcc49/c++/bits/stl_pair.h \
+ /opt/local/include/gcc49/c++/bits/move.h \
+ /opt/local/include/gcc49/c++/bits/concept_check.h \
+ /opt/local/include/gcc49/c++/type_traits \
+ /opt/local/include/gcc49/c++/initializer_list \
+ /opt/local/include/gcc49/c++/bits/stl_algobase.h \
+ /opt/local/include/gcc49/c++/bits/functexcept.h \
+ /opt/local/include/gcc49/c++/bits/exception_defines.h \
+ /opt/local/include/gcc49/c++/bits/cpp_type_traits.h \
+ /opt/local/include/gcc49/c++/ext/type_traits.h \
+ /opt/local/include/gcc49/c++/ext/numeric_traits.h \
+ /opt/local/include/gcc49/c++/bits/stl_iterator_base_types.h \
+ /opt/local/include/gcc49/c++/bits/stl_iterator_base_funcs.h \
+ /opt/local/include/gcc49/c++/debug/debug.h \
+ /opt/local/include/gcc49/c++/bits/stl_iterator.h \
+ /opt/local/include/gcc49/c++/bits/ptr_traits.h \
+ /opt/local/include/gcc49/c++/bits/predefined_ops.h \
+ /opt/local/include/gcc49/c++/bits/stl_algo.h \
+ /opt/local/include/gcc49/c++/cstdlib /usr/include/stdlib.h \
+ /usr/include/sys/wait.h /usr/include/sys/signal.h \
+ /usr/include/sys/appleapiopts.h /usr/include/machine/signal.h \
+ /usr/include/i386/signal.h /usr/include/i386/_structs.h \
+ /usr/include/sys/_structs.h /usr/include/machine/_structs.h \
+ /usr/include/mach/i386/_structs.h /usr/include/sys/resource.h \
+ /usr/include/machine/endian.h /usr/include/i386/endian.h \
+ /usr/include/sys/_endian.h /usr/include/libkern/_OSByteOrder.h \
+ /usr/include/libkern/i386/_OSByteOrder.h /usr/include/alloca.h \
+ /usr/include/machine/types.h /usr/include/i386/types.h \
+ /opt/local/include/gcc49/c++/bits/algorithmfwd.h \
+ /opt/local/include/gcc49/c++/bits/stl_heap.h \
+ /opt/local/include/gcc49/c++/bits/stl_tempbuf.h \
+ /opt/local/include/gcc49/c++/bits/stl_construct.h \
+ /opt/local/include/gcc49/c++/new /opt/local/include/gcc49/c++/exception \
+ /opt/local/include/gcc49/c++/bits/atomic_lockfree_defines.h \
+ /opt/local/include/gcc49/c++/bits/exception_ptr.h \
+ /opt/local/include/gcc49/c++/bits/nested_exception.h \
+ /opt/local/include/gcc49/c++/ext/alloc_traits.h \
+ /opt/local/include/gcc49/c++/bits/alloc_traits.h \
+ /opt/local/include/gcc49/c++/bits/memoryfwd.h \
+ /opt/local/include/gcc49/c++/random /opt/local/include/gcc49/c++/cmath \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include-fixed/math.h \
+ /opt/local/include/gcc49/c++/string \
+ /opt/local/include/gcc49/c++/bits/stringfwd.h \
+ /opt/local/include/gcc49/c++/bits/char_traits.h \
+ /opt/local/include/gcc49/c++/bits/postypes.h \
+ /opt/local/include/gcc49/c++/cwchar /usr/include/wchar.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/stdarg.h \
+ /usr/include/stdio.h /usr/include/time.h /usr/include/_structs.h \
+ /usr/include/_wctype.h /opt/local/include/gcc49/c++/cstdint \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/stdint.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include-fixed/stdint.h \
+ /opt/local/include/gcc49/c++/bits/allocator.h \
+ /opt/local/include/gcc49/c++/x86_64-apple-darwin12/bits/c++allocator.h \
+ /opt/local/include/gcc49/c++/ext/new_allocator.h \
+ /opt/local/include/gcc49/c++/bits/localefwd.h \
+ /opt/local/include/gcc49/c++/x86_64-apple-darwin12/bits/c++locale.h \
+ /opt/local/include/gcc49/c++/clocale /usr/include/locale.h \
+ /usr/include/_locale.h /opt/local/include/gcc49/c++/iosfwd \
+ /opt/local/include/gcc49/c++/cctype \
+ /opt/local/include/gcc49/c++/bits/ostream_insert.h \
+ /opt/local/include/gcc49/c++/bits/cxxabi_forced.h \
+ /opt/local/include/gcc49/c++/bits/stl_function.h \
+ /opt/local/include/gcc49/c++/backward/binders.h \
+ /opt/local/include/gcc49/c++/bits/range_access.h \
+ /opt/local/include/gcc49/c++/bits/basic_string.h \
+ /opt/local/include/gcc49/c++/ext/atomicity.h \
+ /opt/local/include/gcc49/c++/x86_64-apple-darwin12/bits/gthr.h \
+ /opt/local/include/gcc49/c++/x86_64-apple-darwin12/bits/gthr-default.h \
+ /usr/include/pthread.h /usr/include/pthread_impl.h /usr/include/sched.h \
+ /opt/local/include/gcc49/c++/x86_64-apple-darwin12/bits/atomic_word.h \
+ /opt/local/include/gcc49/c++/ext/string_conversions.h \
+ /opt/local/include/gcc49/c++/cstdio /opt/local/include/gcc49/c++/cerrno \
+ /usr/include/errno.h /usr/include/sys/errno.h \
+ /opt/local/include/gcc49/c++/bits/functional_hash.h \
+ /opt/local/include/gcc49/c++/bits/hash_bytes.h \
+ /opt/local/include/gcc49/c++/bits/basic_string.tcc \
+ /opt/local/include/gcc49/c++/limits \
+ /opt/local/include/gcc49/c++/bits/random.h \
+ /opt/local/include/gcc49/c++/vector \
+ /opt/local/include/gcc49/c++/bits/stl_uninitialized.h \
+ /opt/local/include/gcc49/c++/bits/stl_vector.h \
+ /opt/local/include/gcc49/c++/bits/stl_bvector.h \
+ /opt/local/include/gcc49/c++/bits/vector.tcc \
+ /opt/local/include/gcc49/c++/x86_64-apple-darwin12/bits/opt_random.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/x86intrin.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/ia32intrin.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/mmintrin.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/xmmintrin.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/mm_malloc.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/emmintrin.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/pmmintrin.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/tmmintrin.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/ammintrin.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/smmintrin.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/popcntintrin.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/wmmintrin.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/immintrin.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/avxintrin.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/avx2intrin.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/avx512fintrin.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/avx512erintrin.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/avx512pfintrin.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/avx512cdintrin.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/shaintrin.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/lzcntintrin.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/bmiintrin.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/bmi2intrin.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/fmaintrin.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/f16cintrin.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/rtmintrin.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/xtestintrin.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/mm3dnow.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/prfchwintrin.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/fma4intrin.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/xopintrin.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/lwpintrin.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/tbmintrin.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/rdseedintrin.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/fxsrintrin.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/xsaveintrin.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/xsaveoptintrin.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/adxintrin.h \
+ /opt/local/include/gcc49/c++/bits/random.tcc \
+ /opt/local/include/gcc49/c++/numeric \
+ /opt/local/include/gcc49/c++/bits/stl_numeric.h \
+ /opt/local/include/gcc49/c++/iostream \
+ /opt/local/include/gcc49/c++/ostream /opt/local/include/gcc49/c++/ios \
+ /opt/local/include/gcc49/c++/bits/ios_base.h \
+ /opt/local/include/gcc49/c++/bits/locale_classes.h \
+ /opt/local/include/gcc49/c++/bits/locale_classes.tcc \
+ /opt/local/include/gcc49/c++/streambuf \
+ /opt/local/include/gcc49/c++/bits/streambuf.tcc \
+ /opt/local/include/gcc49/c++/bits/basic_ios.h \
+ /opt/local/include/gcc49/c++/bits/locale_facets.h \
+ /opt/local/include/gcc49/c++/cwctype /usr/include/wctype.h \
+ /opt/local/include/gcc49/c++/x86_64-apple-darwin12/bits/ctype_base.h \
+ /opt/local/include/gcc49/c++/bits/streambuf_iterator.h \
+ /opt/local/include/gcc49/c++/x86_64-apple-darwin12/bits/ctype_inline.h \
+ /opt/local/include/gcc49/c++/bits/locale_facets.tcc \
+ /opt/local/include/gcc49/c++/bits/basic_ios.tcc \
+ /opt/local/include/gcc49/c++/bits/ostream.tcc \
+ /opt/local/include/gcc49/c++/istream \
+ /opt/local/include/gcc49/c++/bits/istream.tcc \
+ /Users/rucombs/install/include/snort/snort_types.h \
+ /usr/include/sys/types.h /usr/include/inttypes.h \
+ /Users/rucombs/install/include/snort/framework/event_handler.h \
+ /Users/rucombs/install/include/snort/events/event.h \
+ /Users/rucombs/install/include/snort/thread.h \
+ /Users/rucombs/install/include/snort/framework/api_base.h \
+ /Users/rucombs/install/include/snort/protocols/packet.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/stddef.h \
+ /usr/include/sys/socket.h /usr/include/machine/_param.h \
+ /usr/include/i386/_param.h /usr/include/netinet/in.h \
+ /usr/include/netinet6/in6.h /usr/include/net/if.h \
+ /usr/include/net/if_var.h /usr/include/sys/time.h \
+ /usr/include/sys/_select.h /usr/include/sys/queue.h \
+ /usr/local/include/daq.h /usr/local/include/daq_common.h \
+ /usr/include/unistd.h /usr/include/sys/unistd.h \
+ /usr/include/sys/select.h /usr/local/include/sfbpf_dlt.h \
+ /Users/rucombs/install/include/snort/protocols/sf_protocols.h \
+ /Users/rucombs/install/include/snort/sfip/ipv6_port.h \
+ /Users/rucombs/install/include/snort/sfip/sf_ip.h \
+ /usr/include/arpa/inet.h \
+ /Users/rucombs/install/include/snort/sfip/sfip_t.h \
+ /Users/rucombs/install/include/snort/snort_debug.h \
+ /Users/rucombs/install/include/snort/snort_types.h \
+ /Users/rucombs/install/include/snort/sfip/sf_ipvar.h \
+ /Users/rucombs/install/include/snort/sfip/sf_iph.h \
+ /Users/rucombs/install/include/snort/detection/signature.h \
+ /Users/rucombs/install/include/snort/hash/sfghash.h \
+ /Users/rucombs/install/include/snort/hash/sfhashfcn.h
+
+../config.h:
+
+/usr/include/ctype.h:
+
+/usr/include/runetype.h:
+
+/usr/include/_types.h:
+
+/usr/include/sys/_types.h:
+
+/usr/include/sys/cdefs.h:
+
+/usr/include/sys/_symbol_aliasing.h:
+
+/usr/include/sys/_posix_availability.h:
+
+/usr/include/machine/_types.h:
+
+/usr/include/i386/_types.h:
+
+/usr/include/string.h:
+
+/usr/include/Availability.h:
+
+/usr/include/AvailabilityInternal.h:
+
+/usr/include/strings.h:
+
+/opt/local/include/gcc49/c++/algorithm:
+
+/opt/local/include/gcc49/c++/utility:
+
+/opt/local/include/gcc49/c++/x86_64-apple-darwin12/bits/c++config.h:
+
+/opt/local/include/gcc49/c++/x86_64-apple-darwin12/bits/os_defines.h:
+
+/opt/local/include/gcc49/c++/x86_64-apple-darwin12/bits/cpu_defines.h:
+
+/opt/local/include/gcc49/c++/bits/stl_relops.h:
+
+/opt/local/include/gcc49/c++/bits/stl_pair.h:
+
+/opt/local/include/gcc49/c++/bits/move.h:
+
+/opt/local/include/gcc49/c++/bits/concept_check.h:
+
+/opt/local/include/gcc49/c++/type_traits:
+
+/opt/local/include/gcc49/c++/initializer_list:
+
+/opt/local/include/gcc49/c++/bits/stl_algobase.h:
+
+/opt/local/include/gcc49/c++/bits/functexcept.h:
+
+/opt/local/include/gcc49/c++/bits/exception_defines.h:
+
+/opt/local/include/gcc49/c++/bits/cpp_type_traits.h:
+
+/opt/local/include/gcc49/c++/ext/type_traits.h:
+
+/opt/local/include/gcc49/c++/ext/numeric_traits.h:
+
+/opt/local/include/gcc49/c++/bits/stl_iterator_base_types.h:
+
+/opt/local/include/gcc49/c++/bits/stl_iterator_base_funcs.h:
+
+/opt/local/include/gcc49/c++/debug/debug.h:
+
+/opt/local/include/gcc49/c++/bits/stl_iterator.h:
+
+/opt/local/include/gcc49/c++/bits/ptr_traits.h:
+
+/opt/local/include/gcc49/c++/bits/predefined_ops.h:
+
+/opt/local/include/gcc49/c++/bits/stl_algo.h:
+
+/opt/local/include/gcc49/c++/cstdlib:
+
+/usr/include/stdlib.h:
+
+/usr/include/sys/wait.h:
+
+/usr/include/sys/signal.h:
+
+/usr/include/sys/appleapiopts.h:
+
+/usr/include/machine/signal.h:
+
+/usr/include/i386/signal.h:
+
+/usr/include/i386/_structs.h:
+
+/usr/include/sys/_structs.h:
+
+/usr/include/machine/_structs.h:
+
+/usr/include/mach/i386/_structs.h:
+
+/usr/include/sys/resource.h:
+
+/usr/include/machine/endian.h:
+
+/usr/include/i386/endian.h:
+
+/usr/include/sys/_endian.h:
+
+/usr/include/libkern/_OSByteOrder.h:
+
+/usr/include/libkern/i386/_OSByteOrder.h:
+
+/usr/include/alloca.h:
+
+/usr/include/machine/types.h:
+
+/usr/include/i386/types.h:
+
+/opt/local/include/gcc49/c++/bits/algorithmfwd.h:
+
+/opt/local/include/gcc49/c++/bits/stl_heap.h:
+
+/opt/local/include/gcc49/c++/bits/stl_tempbuf.h:
+
+/opt/local/include/gcc49/c++/bits/stl_construct.h:
+
+/opt/local/include/gcc49/c++/new:
+
+/opt/local/include/gcc49/c++/exception:
+
+/opt/local/include/gcc49/c++/bits/atomic_lockfree_defines.h:
+
+/opt/local/include/gcc49/c++/bits/exception_ptr.h:
+
+/opt/local/include/gcc49/c++/bits/nested_exception.h:
+
+/opt/local/include/gcc49/c++/ext/alloc_traits.h:
+
+/opt/local/include/gcc49/c++/bits/alloc_traits.h:
+
+/opt/local/include/gcc49/c++/bits/memoryfwd.h:
+
+/opt/local/include/gcc49/c++/random:
+
+/opt/local/include/gcc49/c++/cmath:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include-fixed/math.h:
+
+/opt/local/include/gcc49/c++/string:
+
+/opt/local/include/gcc49/c++/bits/stringfwd.h:
+
+/opt/local/include/gcc49/c++/bits/char_traits.h:
+
+/opt/local/include/gcc49/c++/bits/postypes.h:
+
+/opt/local/include/gcc49/c++/cwchar:
+
+/usr/include/wchar.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/stdarg.h:
+
+/usr/include/stdio.h:
+
+/usr/include/time.h:
+
+/usr/include/_structs.h:
+
+/usr/include/_wctype.h:
+
+/opt/local/include/gcc49/c++/cstdint:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/stdint.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include-fixed/stdint.h:
+
+/opt/local/include/gcc49/c++/bits/allocator.h:
+
+/opt/local/include/gcc49/c++/x86_64-apple-darwin12/bits/c++allocator.h:
+
+/opt/local/include/gcc49/c++/ext/new_allocator.h:
+
+/opt/local/include/gcc49/c++/bits/localefwd.h:
+
+/opt/local/include/gcc49/c++/x86_64-apple-darwin12/bits/c++locale.h:
+
+/opt/local/include/gcc49/c++/clocale:
+
+/usr/include/locale.h:
+
+/usr/include/_locale.h:
+
+/opt/local/include/gcc49/c++/iosfwd:
+
+/opt/local/include/gcc49/c++/cctype:
+
+/opt/local/include/gcc49/c++/bits/ostream_insert.h:
+
+/opt/local/include/gcc49/c++/bits/cxxabi_forced.h:
+
+/opt/local/include/gcc49/c++/bits/stl_function.h:
+
+/opt/local/include/gcc49/c++/backward/binders.h:
+
+/opt/local/include/gcc49/c++/bits/range_access.h:
+
+/opt/local/include/gcc49/c++/bits/basic_string.h:
+
+/opt/local/include/gcc49/c++/ext/atomicity.h:
+
+/opt/local/include/gcc49/c++/x86_64-apple-darwin12/bits/gthr.h:
+
+/opt/local/include/gcc49/c++/x86_64-apple-darwin12/bits/gthr-default.h:
+
+/usr/include/pthread.h:
+
+/usr/include/pthread_impl.h:
+
+/usr/include/sched.h:
+
+/opt/local/include/gcc49/c++/x86_64-apple-darwin12/bits/atomic_word.h:
+
+/opt/local/include/gcc49/c++/ext/string_conversions.h:
+
+/opt/local/include/gcc49/c++/cstdio:
+
+/opt/local/include/gcc49/c++/cerrno:
+
+/usr/include/errno.h:
+
+/usr/include/sys/errno.h:
+
+/opt/local/include/gcc49/c++/bits/functional_hash.h:
+
+/opt/local/include/gcc49/c++/bits/hash_bytes.h:
+
+/opt/local/include/gcc49/c++/bits/basic_string.tcc:
+
+/opt/local/include/gcc49/c++/limits:
+
+/opt/local/include/gcc49/c++/bits/random.h:
+
+/opt/local/include/gcc49/c++/vector:
+
+/opt/local/include/gcc49/c++/bits/stl_uninitialized.h:
+
+/opt/local/include/gcc49/c++/bits/stl_vector.h:
+
+/opt/local/include/gcc49/c++/bits/stl_bvector.h:
+
+/opt/local/include/gcc49/c++/bits/vector.tcc:
+
+/opt/local/include/gcc49/c++/x86_64-apple-darwin12/bits/opt_random.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/x86intrin.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/ia32intrin.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/mmintrin.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/xmmintrin.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/mm_malloc.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/emmintrin.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/pmmintrin.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/tmmintrin.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/ammintrin.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/smmintrin.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/popcntintrin.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/wmmintrin.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/immintrin.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/avxintrin.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/avx2intrin.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/avx512fintrin.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/avx512erintrin.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/avx512pfintrin.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/avx512cdintrin.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/shaintrin.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/lzcntintrin.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/bmiintrin.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/bmi2intrin.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/fmaintrin.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/f16cintrin.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/rtmintrin.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/xtestintrin.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/mm3dnow.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/prfchwintrin.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/fma4intrin.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/xopintrin.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/lwpintrin.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/tbmintrin.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/rdseedintrin.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/fxsrintrin.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/xsaveintrin.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/xsaveoptintrin.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/adxintrin.h:
+
+/opt/local/include/gcc49/c++/bits/random.tcc:
+
+/opt/local/include/gcc49/c++/numeric:
+
+/opt/local/include/gcc49/c++/bits/stl_numeric.h:
+
+/opt/local/include/gcc49/c++/iostream:
+
+/opt/local/include/gcc49/c++/ostream:
+
+/opt/local/include/gcc49/c++/ios:
+
+/opt/local/include/gcc49/c++/bits/ios_base.h:
+
+/opt/local/include/gcc49/c++/bits/locale_classes.h:
+
+/opt/local/include/gcc49/c++/bits/locale_classes.tcc:
+
+/opt/local/include/gcc49/c++/streambuf:
+
+/opt/local/include/gcc49/c++/bits/streambuf.tcc:
+
+/opt/local/include/gcc49/c++/bits/basic_ios.h:
+
+/opt/local/include/gcc49/c++/bits/locale_facets.h:
+
+/opt/local/include/gcc49/c++/cwctype:
+
+/usr/include/wctype.h:
+
+/opt/local/include/gcc49/c++/x86_64-apple-darwin12/bits/ctype_base.h:
+
+/opt/local/include/gcc49/c++/bits/streambuf_iterator.h:
+
+/opt/local/include/gcc49/c++/x86_64-apple-darwin12/bits/ctype_inline.h:
+
+/opt/local/include/gcc49/c++/bits/locale_facets.tcc:
+
+/opt/local/include/gcc49/c++/bits/basic_ios.tcc:
+
+/opt/local/include/gcc49/c++/bits/ostream.tcc:
+
+/opt/local/include/gcc49/c++/istream:
+
+/opt/local/include/gcc49/c++/bits/istream.tcc:
+
+/Users/rucombs/install/include/snort/snort_types.h:
+
+/usr/include/sys/types.h:
+
+/usr/include/inttypes.h:
+
+/Users/rucombs/install/include/snort/framework/event_handler.h:
+
+/Users/rucombs/install/include/snort/events/event.h:
+
+/Users/rucombs/install/include/snort/thread.h:
+
+/Users/rucombs/install/include/snort/framework/api_base.h:
+
+/Users/rucombs/install/include/snort/protocols/packet.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/stddef.h:
+
+/usr/include/sys/socket.h:
+
+/usr/include/machine/_param.h:
+
+/usr/include/i386/_param.h:
+
+/usr/include/netinet/in.h:
+
+/usr/include/netinet6/in6.h:
+
+/usr/include/net/if.h:
+
+/usr/include/net/if_var.h:
+
+/usr/include/sys/time.h:
+
+/usr/include/sys/_select.h:
+
+/usr/include/sys/queue.h:
+
+/usr/local/include/daq.h:
+
+/usr/local/include/daq_common.h:
+
+/usr/include/unistd.h:
+
+/usr/include/sys/unistd.h:
+
+/usr/include/sys/select.h:
+
+/usr/local/include/sfbpf_dlt.h:
+
+/Users/rucombs/install/include/snort/protocols/sf_protocols.h:
+
+/Users/rucombs/install/include/snort/sfip/ipv6_port.h:
+
+/Users/rucombs/install/include/snort/sfip/sf_ip.h:
+
+/usr/include/arpa/inet.h:
+
+/Users/rucombs/install/include/snort/sfip/sfip_t.h:
+
+/Users/rucombs/install/include/snort/snort_debug.h:
+
+/Users/rucombs/install/include/snort/snort_types.h:
+
+/Users/rucombs/install/include/snort/sfip/sf_ipvar.h:
+
+/Users/rucombs/install/include/snort/sfip/sf_iph.h:
+
+/Users/rucombs/install/include/snort/detection/signature.h:
+
+/Users/rucombs/install/include/snort/hash/sfghash.h:
+
+/Users/rucombs/install/include/snort/hash/sfhashfcn.h:
--- /dev/null
+libdpx_la-dpx.lo: dpx.cc /usr/include/assert.h /usr/include/sys/cdefs.h \
+ /usr/include/sys/_symbol_aliasing.h \
+ /usr/include/sys/_posix_availability.h /usr/include/stdlib.h \
+ /usr/include/Availability.h /usr/include/AvailabilityInternal.h \
+ /usr/include/_types.h /usr/include/sys/_types.h \
+ /usr/include/machine/_types.h /usr/include/i386/_types.h \
+ /usr/include/sys/wait.h /usr/include/sys/signal.h \
+ /usr/include/sys/appleapiopts.h /usr/include/machine/signal.h \
+ /usr/include/i386/signal.h /usr/include/i386/_structs.h \
+ /usr/include/sys/_structs.h /usr/include/machine/_structs.h \
+ /usr/include/mach/i386/_structs.h /usr/include/sys/resource.h \
+ /usr/include/machine/endian.h /usr/include/i386/endian.h \
+ /usr/include/sys/_endian.h /usr/include/libkern/_OSByteOrder.h \
+ /usr/include/libkern/i386/_OSByteOrder.h /usr/include/alloca.h \
+ /usr/include/machine/types.h /usr/include/i386/types.h \
+ /usr/include/sys/types.h /usr/include/ctype.h /usr/include/runetype.h \
+ /usr/include/string.h /usr/include/strings.h ../config.h \
+ /Users/rucombs/install/include/snort/snort_debug.h /usr/include/wchar.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/stdarg.h \
+ /usr/include/stdio.h /usr/include/time.h /usr/include/_structs.h \
+ /usr/include/_wctype.h \
+ /Users/rucombs/install/include/snort/snort_types.h \
+ /usr/include/inttypes.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/stdint.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include-fixed/stdint.h \
+ /Users/rucombs/install/include/snort/snort_types.h \
+ /Users/rucombs/install/include/snort/events/event_queue.h \
+ /Users/rucombs/install/include/snort/framework/packet_handler.h \
+ /Users/rucombs/install/include/snort/thread.h \
+ /Users/rucombs/install/include/snort/framework/api_base.h \
+ /Users/rucombs/install/include/snort/log/messages.h \
+ /Users/rucombs/install/include/snort/sfip/sf_ipvar.h \
+ /Users/rucombs/install/include/snort/sfip/sf_ip.h \
+ /usr/include/netinet/in.h /usr/include/sys/socket.h \
+ /usr/include/machine/_param.h /usr/include/i386/_param.h \
+ /usr/include/netinet6/in6.h /usr/include/arpa/inet.h \
+ /Users/rucombs/install/include/snort/sfip/sfip_t.h \
+ /Users/rucombs/install/include/snort/sfip/ipv6_port.h \
+ /Users/rucombs/install/include/snort/protocols/packet.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/stddef.h \
+ /usr/include/net/if.h /usr/include/net/if_var.h /usr/include/sys/time.h \
+ /usr/include/sys/_select.h /usr/include/sys/queue.h \
+ /usr/local/include/daq.h /usr/local/include/daq_common.h \
+ /usr/include/unistd.h /usr/include/sys/unistd.h \
+ /usr/include/sys/select.h /usr/local/include/sfbpf_dlt.h \
+ /Users/rucombs/install/include/snort/protocols/sf_protocols.h \
+ /Users/rucombs/install/include/snort/sfip/sf_iph.h \
+ /Users/rucombs/install/include/snort/time/profiler.h \
+ /Users/rucombs/install/include/snort/time/cpuclock.h \
+ /Users/rucombs/install/include/snort/utils/stats.h /usr/include/errno.h \
+ /usr/include/sys/errno.h /usr/include/strings.h \
+ /Users/rucombs/install/include/snort/utils/sflsq.h
+
+/usr/include/assert.h:
+
+/usr/include/sys/cdefs.h:
+
+/usr/include/sys/_symbol_aliasing.h:
+
+/usr/include/sys/_posix_availability.h:
+
+/usr/include/stdlib.h:
+
+/usr/include/Availability.h:
+
+/usr/include/AvailabilityInternal.h:
+
+/usr/include/_types.h:
+
+/usr/include/sys/_types.h:
+
+/usr/include/machine/_types.h:
+
+/usr/include/i386/_types.h:
+
+/usr/include/sys/wait.h:
+
+/usr/include/sys/signal.h:
+
+/usr/include/sys/appleapiopts.h:
+
+/usr/include/machine/signal.h:
+
+/usr/include/i386/signal.h:
+
+/usr/include/i386/_structs.h:
+
+/usr/include/sys/_structs.h:
+
+/usr/include/machine/_structs.h:
+
+/usr/include/mach/i386/_structs.h:
+
+/usr/include/sys/resource.h:
+
+/usr/include/machine/endian.h:
+
+/usr/include/i386/endian.h:
+
+/usr/include/sys/_endian.h:
+
+/usr/include/libkern/_OSByteOrder.h:
+
+/usr/include/libkern/i386/_OSByteOrder.h:
+
+/usr/include/alloca.h:
+
+/usr/include/machine/types.h:
+
+/usr/include/i386/types.h:
+
+/usr/include/sys/types.h:
+
+/usr/include/ctype.h:
+
+/usr/include/runetype.h:
+
+/usr/include/string.h:
+
+/usr/include/strings.h:
+
+../config.h:
+
+/Users/rucombs/install/include/snort/snort_debug.h:
+
+/usr/include/wchar.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/stdarg.h:
+
+/usr/include/stdio.h:
+
+/usr/include/time.h:
+
+/usr/include/_structs.h:
+
+/usr/include/_wctype.h:
+
+/Users/rucombs/install/include/snort/snort_types.h:
+
+/usr/include/inttypes.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/stdint.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include-fixed/stdint.h:
+
+/Users/rucombs/install/include/snort/snort_types.h:
+
+/Users/rucombs/install/include/snort/events/event_queue.h:
+
+/Users/rucombs/install/include/snort/framework/packet_handler.h:
+
+/Users/rucombs/install/include/snort/thread.h:
+
+/Users/rucombs/install/include/snort/framework/api_base.h:
+
+/Users/rucombs/install/include/snort/log/messages.h:
+
+/Users/rucombs/install/include/snort/sfip/sf_ipvar.h:
+
+/Users/rucombs/install/include/snort/sfip/sf_ip.h:
+
+/usr/include/netinet/in.h:
+
+/usr/include/sys/socket.h:
+
+/usr/include/machine/_param.h:
+
+/usr/include/i386/_param.h:
+
+/usr/include/netinet6/in6.h:
+
+/usr/include/arpa/inet.h:
+
+/Users/rucombs/install/include/snort/sfip/sfip_t.h:
+
+/Users/rucombs/install/include/snort/sfip/ipv6_port.h:
+
+/Users/rucombs/install/include/snort/protocols/packet.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/stddef.h:
+
+/usr/include/net/if.h:
+
+/usr/include/net/if_var.h:
+
+/usr/include/sys/time.h:
+
+/usr/include/sys/_select.h:
+
+/usr/include/sys/queue.h:
+
+/usr/local/include/daq.h:
+
+/usr/local/include/daq_common.h:
+
+/usr/include/unistd.h:
+
+/usr/include/sys/unistd.h:
+
+/usr/include/sys/select.h:
+
+/usr/local/include/sfbpf_dlt.h:
+
+/Users/rucombs/install/include/snort/protocols/sf_protocols.h:
+
+/Users/rucombs/install/include/snort/sfip/sf_iph.h:
+
+/Users/rucombs/install/include/snort/time/profiler.h:
+
+/Users/rucombs/install/include/snort/time/cpuclock.h:
+
+/Users/rucombs/install/include/snort/utils/stats.h:
+
+/usr/include/errno.h:
+
+/usr/include/sys/errno.h:
+
+/usr/include/strings.h:
+
+/Users/rucombs/install/include/snort/utils/sflsq.h:
--- /dev/null
+libips_urg_la-ips_urg.lo: ips_urg.cc ../config.h /usr/include/sys/types.h \
+ /usr/include/sys/appleapiopts.h /usr/include/sys/cdefs.h \
+ /usr/include/sys/_symbol_aliasing.h \
+ /usr/include/sys/_posix_availability.h /usr/include/machine/types.h \
+ /usr/include/i386/types.h /usr/include/i386/_types.h \
+ /usr/include/sys/_types.h /usr/include/machine/_types.h \
+ /usr/include/machine/endian.h /usr/include/i386/endian.h \
+ /usr/include/sys/_endian.h /usr/include/libkern/_OSByteOrder.h \
+ /usr/include/libkern/i386/_OSByteOrder.h /usr/include/sys/_structs.h \
+ /usr/include/stdlib.h /usr/include/Availability.h \
+ /usr/include/AvailabilityInternal.h /usr/include/_types.h \
+ /usr/include/sys/wait.h /usr/include/sys/signal.h \
+ /usr/include/machine/signal.h /usr/include/i386/signal.h \
+ /usr/include/i386/_structs.h /usr/include/machine/_structs.h \
+ /usr/include/mach/i386/_structs.h /usr/include/sys/resource.h \
+ /usr/include/alloca.h /usr/include/ctype.h /usr/include/runetype.h \
+ /Users/rucombs/install/include/snort/snort_types.h \
+ /usr/include/inttypes.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/stdint.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include-fixed/stdint.h \
+ /Users/rucombs/install/include/snort/thread.h \
+ /Users/rucombs/install/include/snort/detection/detection_defines.h \
+ /Users/rucombs/install/include/snort/detection/treenodes.h \
+ /Users/rucombs/install/include/snort/sfip/ipv6_port.h \
+ /Users/rucombs/install/include/snort/sfip/sf_ip.h \
+ /usr/include/netinet/in.h /usr/include/sys/socket.h \
+ /usr/include/machine/_param.h /usr/include/i386/_param.h \
+ /usr/include/netinet6/in6.h /usr/include/arpa/inet.h \
+ /Users/rucombs/install/include/snort/sfip/sfip_t.h \
+ /Users/rucombs/install/include/snort/snort_debug.h /usr/include/wchar.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/stdarg.h \
+ /usr/include/stdio.h /usr/include/time.h /usr/include/_structs.h \
+ /usr/include/_wctype.h \
+ /Users/rucombs/install/include/snort/snort_types.h \
+ /Users/rucombs/install/include/snort/sfip/sf_ipvar.h \
+ /Users/rucombs/install/include/snort/detection/rule_option_types.h \
+ /Users/rucombs/install/include/snort/detection/rules.h \
+ /Users/rucombs/install/include/snort/detection/signature.h \
+ /Users/rucombs/install/include/snort/hash/sfghash.h \
+ /usr/include/string.h /usr/include/strings.h \
+ /Users/rucombs/install/include/snort/hash/sfhashfcn.h \
+ /Users/rucombs/install/include/snort/utils/sfportobject.h \
+ /Users/rucombs/install/include/snort/utils/bitop_funcs.h \
+ /Users/rucombs/install/include/snort/utils/bitop.h \
+ /Users/rucombs/install/include/snort/utils/sflsq.h \
+ /Users/rucombs/install/include/snort/framework/ips_option.h \
+ /Users/rucombs/install/include/snort/framework/api_base.h \
+ /Users/rucombs/install/include/snort/protocols/packet.h \
+ /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/stddef.h \
+ /usr/include/net/if.h /usr/include/net/if_var.h /usr/include/sys/time.h \
+ /usr/include/sys/_select.h /usr/include/sys/queue.h \
+ /usr/local/include/daq.h /usr/local/include/daq_common.h \
+ /usr/include/unistd.h /usr/include/sys/unistd.h \
+ /usr/include/sys/select.h /usr/local/include/sfbpf_dlt.h \
+ /Users/rucombs/install/include/snort/protocols/sf_protocols.h \
+ /Users/rucombs/install/include/snort/sfip/sf_iph.h
+
+../config.h:
+
+/usr/include/sys/types.h:
+
+/usr/include/sys/appleapiopts.h:
+
+/usr/include/sys/cdefs.h:
+
+/usr/include/sys/_symbol_aliasing.h:
+
+/usr/include/sys/_posix_availability.h:
+
+/usr/include/machine/types.h:
+
+/usr/include/i386/types.h:
+
+/usr/include/i386/_types.h:
+
+/usr/include/sys/_types.h:
+
+/usr/include/machine/_types.h:
+
+/usr/include/machine/endian.h:
+
+/usr/include/i386/endian.h:
+
+/usr/include/sys/_endian.h:
+
+/usr/include/libkern/_OSByteOrder.h:
+
+/usr/include/libkern/i386/_OSByteOrder.h:
+
+/usr/include/sys/_structs.h:
+
+/usr/include/stdlib.h:
+
+/usr/include/Availability.h:
+
+/usr/include/AvailabilityInternal.h:
+
+/usr/include/_types.h:
+
+/usr/include/sys/wait.h:
+
+/usr/include/sys/signal.h:
+
+/usr/include/machine/signal.h:
+
+/usr/include/i386/signal.h:
+
+/usr/include/i386/_structs.h:
+
+/usr/include/machine/_structs.h:
+
+/usr/include/mach/i386/_structs.h:
+
+/usr/include/sys/resource.h:
+
+/usr/include/alloca.h:
+
+/usr/include/ctype.h:
+
+/usr/include/runetype.h:
+
+/Users/rucombs/install/include/snort/snort_types.h:
+
+/usr/include/inttypes.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/stdint.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include-fixed/stdint.h:
+
+/Users/rucombs/install/include/snort/thread.h:
+
+/Users/rucombs/install/include/snort/detection/detection_defines.h:
+
+/Users/rucombs/install/include/snort/detection/treenodes.h:
+
+/Users/rucombs/install/include/snort/sfip/ipv6_port.h:
+
+/Users/rucombs/install/include/snort/sfip/sf_ip.h:
+
+/usr/include/netinet/in.h:
+
+/usr/include/sys/socket.h:
+
+/usr/include/machine/_param.h:
+
+/usr/include/i386/_param.h:
+
+/usr/include/netinet6/in6.h:
+
+/usr/include/arpa/inet.h:
+
+/Users/rucombs/install/include/snort/sfip/sfip_t.h:
+
+/Users/rucombs/install/include/snort/snort_debug.h:
+
+/usr/include/wchar.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/stdarg.h:
+
+/usr/include/stdio.h:
+
+/usr/include/time.h:
+
+/usr/include/_structs.h:
+
+/usr/include/_wctype.h:
+
+/Users/rucombs/install/include/snort/snort_types.h:
+
+/Users/rucombs/install/include/snort/sfip/sf_ipvar.h:
+
+/Users/rucombs/install/include/snort/detection/rule_option_types.h:
+
+/Users/rucombs/install/include/snort/detection/rules.h:
+
+/Users/rucombs/install/include/snort/detection/signature.h:
+
+/Users/rucombs/install/include/snort/hash/sfghash.h:
+
+/usr/include/string.h:
+
+/usr/include/strings.h:
+
+/Users/rucombs/install/include/snort/hash/sfhashfcn.h:
+
+/Users/rucombs/install/include/snort/utils/sfportobject.h:
+
+/Users/rucombs/install/include/snort/utils/bitop_funcs.h:
+
+/Users/rucombs/install/include/snort/utils/bitop.h:
+
+/Users/rucombs/install/include/snort/utils/sflsq.h:
+
+/Users/rucombs/install/include/snort/framework/ips_option.h:
+
+/Users/rucombs/install/include/snort/framework/api_base.h:
+
+/Users/rucombs/install/include/snort/protocols/packet.h:
+
+/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/stddef.h:
+
+/usr/include/net/if.h:
+
+/usr/include/net/if_var.h:
+
+/usr/include/sys/time.h:
+
+/usr/include/sys/_select.h:
+
+/usr/include/sys/queue.h:
+
+/usr/local/include/daq.h:
+
+/usr/local/include/daq_common.h:
+
+/usr/include/unistd.h:
+
+/usr/include/sys/unistd.h:
+
+/usr/include/sys/select.h:
+
+/usr/local/include/sfbpf_dlt.h:
+
+/Users/rucombs/install/include/snort/protocols/sf_protocols.h:
+
+/Users/rucombs/install/include/snort/sfip/sf_iph.h:
--- /dev/null
+AUTOMAKE_OPTIONS=foreign
+
+SUBDIRS = \
+inspectors \
+ips_options \
+loggers \
+search_engines \
+so_rules
+
+AM_CXXFLAGS = @AM_CXXFLAGS@
+
--- /dev/null
+AUTOMAKE_OPTIONS=foreign
+
+dpxlibdir = $(pkglibdir)/inspectors
+dpxlib_LTLIBRARIES = libdpx.la
+libdpx_la_CXXFLAGS = $(AM_CXXFLAGS)
+libdpx_la_LDFLAGS = -export-dynamic -shared
+libdpx_la_SOURCES = dpx.cc
+
+AM_CXXFLAGS = @AM_CXXFLAGS@
+
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+** Copyright (C) 2013-2013 Sourcefire, Inc.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// dpx.cc author Russ Combs <rcombs@sourcefire.com>
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <assert.h>
+#include <sys/types.h>
+#include <stdlib.h>
+#include <ctype.h>
+#include <string.h>
+
+#include "main/snort_debug.h"
+#include "main/snort_types.h"
+#include "events/event_queue.h"
+#include "framework/inspector.h"
+#include "log/messages.h"
+#include "protocols/packet.h"
+#include "time/profiler.h"
+#include "utils/stats.h"
+
+#define DPX_GID 256
+#define DPX_SID 1
+#define DPX_REV 1
+#define DPX_PRI 1
+#define DPX_MSG "too much data sent to port"
+
+#if 0
+#define PP_DPX 10000
+
+#ifdef DEBUG
+#define DEBUG_DPX DEBUG_PP_EXP
+#endif
+#endif
+
+static const char* s_name = "dpx";
+
+#ifdef PERF_PROFILING
+static THREAD_LOCAL PreprocStats dpxPerfStats;
+
+static PreprocStats* dpx_get_profile(const char* key)
+{
+ if ( !strcmp(key, s_name) )
+ return &dpxPerfStats;
+
+ return nullptr;
+}
+#endif
+
+static THREAD_LOCAL SimpleStats dpxstats;
+static SimpleStats gdpxstats;
+
+//-------------------------------------------------------------------------
+// class stuff
+//-------------------------------------------------------------------------
+
+class DpxPH : public Inspector {
+public:
+ DpxPH();
+
+ void show(SnortConfig*);
+ void eval(Packet*);
+
+private:
+ uint16_t port;
+ uint16_t max;
+};
+
+DpxPH::DpxPH()
+{
+ port = 68;
+ max = 300;
+}
+
+void DpxPH::show(SnortConfig*)
+{
+ LogMessage("%s config:\n", s_name);
+ LogMessage(" port = %d\n", port);
+ LogMessage(" max = %d\n", max);
+}
+
+void DpxPH::eval(Packet* p)
+{
+ // precondition - what we registered for
+ assert(IsUDP(p));
+
+ if ( p->dp == port && p->dsize > max )
+ SnortEventqAdd(DPX_GID, DPX_SID);
+
+ ++dpxstats.total_packets;
+}
+
+//-------------------------------------------------------------------------
+// api stuff
+//-------------------------------------------------------------------------
+
+void dpx_init()
+{
+#ifdef PERF_PROFILING
+ RegisterPreprocessorProfile(
+ s_name, &dpxPerfStats, 0, &totalPerfStats, dpx_get_profile);
+#endif
+}
+
+static Inspector* dpx_ctor(Module*)
+{
+ return new DpxPH;
+}
+
+static void dpx_dtor(Inspector* p)
+{
+ delete p;
+}
+
+static void dpx_sum()
+{
+ sum_stats(&gdpxstats, &dpxstats);
+}
+
+static void dpx_stats()
+{
+ show_stats(&gdpxstats, s_name);
+}
+
+static void dpx_reset()
+{
+ memset(&gdpxstats, 0, sizeof(gdpxstats));
+}
+
+static const InspectApi dpx_api
+{
+ {
+ PT_INSPECTOR,
+ s_name,
+ INSAPI_PLUGIN_V0,
+ 0,
+ nullptr,
+ nullptr
+ },
+ IT_PROTOCOL,
+ PROTO_BIT__UDP,
+ nullptr, // service
+ nullptr, // contents
+ dpx_init,
+ nullptr, // term
+ dpx_ctor,
+ dpx_dtor,
+ nullptr, // pinit
+ nullptr, // pterm
+ nullptr, // ssn
+ dpx_sum,
+ dpx_stats,
+ dpx_reset,
+ nullptr // getbuf
+};
+
+SO_PUBLIC const BaseApi* snort_plugins[] =
+{
+ &dpx_api.base,
+ nullptr
+};
+
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// udp_module.cc author Russ Combs <rucombs@cisco.com>
+
+#include "udp_module.h"
+
+#include <string>
+using namespace std;
+
+#include "stream_udp.h"
+#include "main/snort_config.h"
+
+//-------------------------------------------------------------------------
+// stream_udp module
+//-------------------------------------------------------------------------
+
+static const Parameter stream_udp_params[] =
+{
+ { "session_timeout", Parameter::PT_INT, "1:86400", "30",
+ "session tracking timeout" },
+
+ { "ignore_any_rules", Parameter::PT_BOOL, nullptr, "false",
+ "process udp content rules w/o ports only if rules with ports are present" },
+
+ { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
+};
+
+static const RuleMap stream_udp_rules[] =
+{
+ { 0, nullptr }
+};
+
+StreamUdpModule::StreamUdpModule() :
+ Module(MOD_NAME, stream_udp_params, stream_udp_rules) { }
+
+StreamUdpConfig* StreamUdpModule::get_data()
+{
+ StreamUdpConfig* temp = config;
+ config = nullptr;
+ return temp;
+}
+
+bool StreamUdpModule::set(const char*, Value& v, SnortConfig*)
+{
+ if ( v.is("session_timeout") )
+ config->session_timeout = v.get_long();
+
+ else if ( v.is("ignore_any_rules") )
+ config->ignore_any = v.get_bool();
+
+ else
+ return false;
+
+ return true;
+}
+
+bool StreamUdpModule::begin(const char*, int, SnortConfig*)
+{
+ if ( !config )
+ config = new StreamUdpConfig;
+
+ return true;
+}
+
+bool StreamUdpModule::end(const char*, int, SnortConfig*)
+{
+ return true;
+}
+
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// udp_module.h author Russ Combs <rucombs@cisco.com>
+
+#ifndef UDP_MODULE_H
+#define UDP_MODULE_H
+
+#include <string>
+#include <vector>
+
+#include "main/snort_types.h"
+#include "framework/module.h"
+
+struct SnortConfig;
+
+//-------------------------------------------------------------------------
+// dpx module
+//-------------------------------------------------------------------------
+
+#define MOD_NAME "dpx"
+
+class DpxModule : public Module
+{
+public:
+ DpxModule();
+ bool set(const char*, Value&, SnortConfig*);
+ bool begin(const char*, int, SnortConfig*);
+ bool end(const char*, int, SnortConfig*);
+
+ StreamUdpConfig* get_data();
+
+private:
+ StreamUdpConfig* config;
+};
+
+#endif
+
--- /dev/null
+AUTOMAKE_OPTIONS=foreign
+
+optlibdir = $(pkglibdir)/ips_options
+optlib_LTLIBRARIES = libips_urg.la
+libips_urg_la_CXXFLAGS = $(AM_CXXFLAGS)
+libips_urg_la_LDFLAGS = -export-dynamic -shared
+libips_urg_la_SOURCES = ips_urg.cc
+
+dist_optlib_SCRIPTS = find.lua
+
+AM_CXXFLAGS = @AM_CXXFLAGS@
+
--- /dev/null
+-- ----------------------------------------------------------
+-- ips_option example:
+--
+-- define keyword find
+--
+-- configure snort with
+--
+-- ./configure --prefix my/prefix
+--
+-- then set up the path as follows:
+--
+-- export LUA_PATH=my/prefix/include/snort/lua/?.lua\;\;
+--
+-- write a rule as follows:
+--
+-- alert tcp any any -> any 80 ( \
+-- msg:"luajit example"; sid:1; \
+-- content:"GET /"; \
+-- find:buf='payload', pat='GET .+ HTTP/1.1'; )
+--
+-- the arg string is (in general) optional
+-- if present, it will be put in a table named args, eg:
+--
+-- args { buf='payload', pat='GET .+ HTTP/1.1' }
+--
+-- this table is defined before init is called
+-- ----------------------------------------------------------
+
+-- this pulls in snort bindings with ffi
+require("snort_plugin")
+
+-- init() is optional
+-- if present, called once when script is loaded
+-- here we return bool indicating args ok
+function init ()
+ args.bt = get_buffer_type(args.buf)
+
+ if ( args.bt < 0 ) then
+ return 'bad buf'
+ end
+
+ if ( args.pat == nil ) then
+ return 'missing pat'
+ end
+
+ if ( type(args.pat) ~= 'string' ) then
+ return 'pat must be string'
+ end
+
+ return true
+end
+
+-- eval() is required
+-- eval must return a bool (match == true)
+function eval ()
+ -- you can access a snort buffer as follows
+ -- see snort.lua for available buffers
+
+ -- buf is a luajit cdata
+ local buf = ffi.C.get_buffer(args.bt)
+
+ -- str is a lua string
+ local str = ffi.string(buf.data, buf.len)
+
+ local i,j = string.find(str, args.pat)
+
+ return (i and (i > 0))
+end
+
+-- plugin table is required
+plugin =
+{
+ type = "ips_option", -- only available type currently
+ name = "find", -- rule option keyword
+ version = 0 -- optional, defaults to zero
+}
+
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+** Copyright (C) 2002-2013 Sourcefire, Inc.
+** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// ips_urg.cc author Russ Combs <rucombs@cisco.com>
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <sys/types.h>
+#include <stdlib.h>
+#include <ctype.h>
+
+#include "main/snort_types.h"
+#include "main/thread.h"
+#include "detection/detection_defines.h"
+#include "detection/treenodes.h"
+#include "framework/ips_option.h"
+#include "hash/sfhashfcn.h"
+#include "protocols/packet.h"
+#include "time/profiler.h"
+
+static const char* s_name = "urg";
+
+// FIXIT profiling is desirable but must be refactored to
+// avoid dependence on snort_config.h which snowballs
+#undef PERF_PROFILING
+
+#ifdef PERF_PROFILING
+static THREAD_LOCAL PreprocStats tcpUrgPerfStats;
+
+static PreprocStats* urg_get_profile(const char* key)
+{
+ if ( !strcmp(key, s_name) )
+ return &tcpUrgPerfStats;
+
+ return nullptr;
+}
+#endif
+
+class TcpUrgOption : public IpsOption
+{
+public:
+ TcpUrgOption(uint16_t up) : IpsOption(s_name)
+ { urg_ptr = htons(up); };
+
+ uint32_t hash() const;
+ bool operator==(const IpsOption&) const;
+
+ int eval(Packet*);
+
+private:
+ uint16_t urg_ptr;
+};
+
+//-------------------------------------------------------------------------
+// option methods
+//-------------------------------------------------------------------------
+
+uint32_t TcpUrgOption::hash() const
+{
+ uint32_t a = urg_ptr, b = 0, c = 0;
+ mix_str(a,b,c,get_name());
+ final(a,b,c);
+ return c;
+}
+
+bool TcpUrgOption::operator==(const IpsOption& ips) const
+{
+ if ( strcmp(s_name, ips.get_name()) )
+ return false;
+
+ TcpUrgOption& rhs = (TcpUrgOption&)ips;
+
+ if ( urg_ptr == rhs.urg_ptr)
+ {
+ return true;
+ }
+
+ return false;
+}
+
+int TcpUrgOption::eval(Packet *p)
+{
+ //PROFILE_VARS;
+ //PREPROC_PROFILE_START(tcpUrgPerfStats);
+ int result = DETECTION_OPTION_NO_MATCH;
+
+ if ( !p->tcph )
+ return result;
+
+ if ( (p->tcph->th_flags & 0x20) &&
+ (urg_ptr == p->tcph->th_urp) )
+ {
+ result = DETECTION_OPTION_MATCH;
+ }
+
+ //PREPROC_PROFILE_END(tcpUrgPerfStats);
+ return result;
+}
+
+//-------------------------------------------------------------------------
+// api methods
+//-------------------------------------------------------------------------
+
+static IpsOption* urg_ctor(
+ SnortConfig*, char* arg, OptTreeNode*)
+{
+ char* end;
+ long up = strtol(arg, &end, 0);
+
+ if ( !*arg || *end || up < 0 || up > 0xFFFF )
+ up = 0;
+
+ return new TcpUrgOption((uint16_t)up);
+}
+
+static void urg_dtor(IpsOption* p)
+{
+ delete p;
+}
+
+static void urg_ginit(SnortConfig*)
+{
+#ifdef PERF_PROFILING
+ RegisterPreprocessorProfile(
+ s_name, &tcpUrgPerfStats, 3, &ruleOTNEvalPerfStats, urg_get_profile);
+#endif
+}
+
+static const IpsApi urg_api =
+{
+ {
+ PT_IPS_OPTION,
+ s_name,
+ IPSAPI_PLUGIN_V0,
+ 0,
+ nullptr,
+ nullptr
+ },
+ OPT_TYPE_DETECTION,
+ 1, PROTO_BIT__TCP,
+ urg_ginit,
+ nullptr,
+ nullptr,
+ nullptr,
+ urg_ctor,
+ urg_dtor,
+ nullptr
+};
+
+SO_PUBLIC const BaseApi* snort_plugins[] =
+{
+ &urg_api.base,
+ nullptr
+};
+
--- /dev/null
+AUTOMAKE_OPTIONS=foreign
+
+ehlibdir = $(pkglibdir)/loggers
+ehlib_LTLIBRARIES = libalert_ex.la
+libalert_ex_la_CXXFLAGS = $(AM_CXXFLAGS)
+libalert_ex_la_LDFLAGS = -export-dynamic -shared
+libalert_ex_la_SOURCES = alert_ex.cc
+
+AM_CXXFLAGS = @AM_CXXFLAGS@
+
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+** Copyright (C) 2013-2013 Sourcefire, Inc.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// alert_ex.cc author Russ Combs <rucombs@cisco.com>
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <ctype.h>
+#include <string.h>
+
+#include <algorithm>
+#include <iostream>
+using namespace std;
+
+#include "main/snort_types.h"
+#include "framework/logger.h"
+#include "framework/module.h"
+#include "protocols/packet.h"
+#include "detection/signature.h"
+
+//-------------------------------------------------------------------------
+// module stuff
+//-------------------------------------------------------------------------
+
+static const Parameter ex_params[] =
+{
+ { "upper", Parameter::PT_BOOL, nullptr, "false",
+ "true/false -> convert to upper/lower case" },
+
+ { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
+};
+
+class ExModule : public Module
+{
+public:
+ ExModule() : Module("alert_ex", ex_params) { };
+ bool set(const char*, Value&, SnortConfig*);
+ bool begin(const char*, int, SnortConfig*);
+
+public:
+ bool upper;
+};
+
+bool ExModule::set(const char*, Value& v, SnortConfig*)
+{
+ if ( v.is("packet") )
+ upper = v.get_bool();
+
+ else
+ return false;
+
+ return true;
+}
+
+bool ExModule::begin(const char*, int, SnortConfig*)
+{
+ upper = true;
+ return true;
+}
+
+//-------------------------------------------------------------------------
+// logger stuff
+//-------------------------------------------------------------------------
+
+class ExLogger : public Logger {
+public:
+ ExLogger(ExModule* m)
+ { upper = m->upper; };
+
+ void alert(Packet*, const char* msg, Event*);
+
+private:
+ bool upper;
+};
+
+void ExLogger::alert(Packet*, const char* msg, Event* e)
+{
+ string s = msg;
+
+ if ( upper )
+ transform(s.begin(), s.end(), s.begin(), ::toupper);
+ else
+ transform(s.begin(), s.end(), s.begin(), ::tolower);
+
+ cout << e->sig_info->generator << ":";
+ cout << e->sig_info->id << ":";
+ cout << e->sig_info->rev << " ";
+ cout << s << endl;
+}
+
+//-------------------------------------------------------------------------
+// api stuff
+//-------------------------------------------------------------------------
+
+static Module* mod_ctor()
+{ return new ExModule; }
+
+static void mod_dtor(Module* m)
+{ delete m; }
+
+static Logger* ex_ctor(SnortConfig*, Module* mod)
+{
+ return new ExLogger((ExModule*)mod);
+}
+
+static void ex_dtor(Logger* p)
+{ delete p; }
+
+static const LogApi ex_api =
+{
+ {
+ PT_LOGGER,
+ "alert_ex",
+ LOGAPI_PLUGIN_V0,
+ 0,
+ mod_ctor,
+ mod_dtor
+ },
+ OUTPUT_TYPE_FLAG__ALERT,
+ ex_ctor,
+ ex_dtor
+};
+
+SO_PUBLIC const BaseApi* snort_plugins[] =
+{
+ &ex_api.base,
+ nullptr
+};
+
--- /dev/null
+AUTOMAKE_OPTIONS=foreign
+
+selibdir = $(pkglibdir)/search_engines
+selib_LTLIBRARIES = liblowmem.la
+liblowmem_la_CXXFLAGS = $(AM_CXXFLAGS)
+liblowmem_la_LDFLAGS = -export-dynamic -shared
+
+liblowmem_la_SOURCES = \
+lowmem.cc \
+lowmem_q.cc \
+pat_stats.cc \
+sfksearch.cc \
+sfksearch.h \
+trie_api.cc
+
+AM_CXXFLAGS = @AM_CXXFLAGS@
+
--- /dev/null
+/*
+* An abstracted interface to the Multi-Pattern Matching routines,
+* thats why we're passing 'void *' objects around.
+*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+* Copyright (C) 2002-2013 Sourcefire, Inc.
+* Marc A Norton <mnorton@sourcefire.com>
+*
+* Updates:
+* 3/06 - Added AC_BNFA search
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+**
+*/
+
+// lowmem.cc author Russ Combs <rucombs@cisco.com>
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include "sfksearch.h"
+#include "main/snort_debug.h"
+#include "main/snort_types.h"
+#include "log/messages.h"
+#include "framework/mpse.h"
+#include "time/profiler.h"
+
+//-------------------------------------------------------------------------
+// "lowmem"
+//-------------------------------------------------------------------------
+
+class LowmemMpse : public Mpse
+{
+private:
+ KTRIE_STRUCT* obj;
+
+public:
+ LowmemMpse(
+ SnortConfig*,
+ bool use_gc,
+ void (*user_free)(void*),
+ void (*tree_free)(void**),
+ void (*list_free)(void**))
+ : Mpse("lowmem", use_gc)
+ { obj = KTrieNew(0,user_free, tree_free, list_free); };
+
+ ~LowmemMpse()
+ { KTrieDelete(obj); };
+
+ int add_pattern(
+ SnortConfig*, void* P, int m,
+ unsigned noCase, unsigned, unsigned,
+ unsigned negative, void* ID, int)
+ {
+ return KTrieAddPattern(
+ obj, (unsigned char *)P, m, noCase, negative, ID );
+ };
+
+ int prep_patterns(
+ SnortConfig* sc, mpse_build_f build_tree, mpse_negate_f neg_list)
+ {
+ return KTrieCompileWithSnortConf(sc, obj, build_tree, neg_list );
+ };
+
+ int _search(
+ const unsigned char* T, int n, mpse_action_f action,
+ void* data, int* current_state )
+ {
+ *current_state = 0;
+ return KTrieSearch(obj, (unsigned char *)T, n, action, data);
+ };
+
+ int get_pattern_count()
+ { return KTriePatternCount(obj); };
+};
+
+//-------------------------------------------------------------------------
+// api
+//-------------------------------------------------------------------------
+
+static Mpse* lm_ctor(
+ SnortConfig* sc,
+ class Module*,
+ bool use_gc,
+ void (*user_free)(void*),
+ void (*tree_free)(void**),
+ void (*list_free)(void**))
+{
+ return new LowmemMpse(sc, use_gc, user_free, tree_free, list_free);
+}
+
+static void lm_dtor(Mpse* p)
+{
+ delete p;
+}
+
+static void lm_init()
+{
+ KTrie_init_xlatcase();
+ KTrieInitMemUsed();
+}
+
+static void lm_print()
+{
+ if ( !KTrieMemUsed() )
+ return;
+
+ double x = (double) KTrieMemUsed();
+
+ LogMessage("[ LowMem Search-Method Memory Used : %g %s ]\n",
+ (x > 1.e+6) ? x/1.e+6 : x/1.e+3,
+ (x > 1.e+6) ? "MBytes" : "KBytes" );
+}
+
+static const MpseApi lm_api =
+{
+ {
+ PT_SEARCH_ENGINE,
+ "lowmem",
+ SEAPI_PLUGIN_V0,
+ 0,
+ nullptr,
+ nullptr
+ },
+ false,
+ nullptr,
+ nullptr,
+ nullptr,
+ nullptr,
+ lm_ctor,
+ lm_dtor,
+ lm_init,
+ lm_print,
+};
+
+const BaseApi* se_lowmem = &lm_api.base;
+
--- /dev/null
+/*
+* An abstracted interface to the Multi-Pattern Matching routines,
+* thats why we're passing 'void *' objects around.
+*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+* Copyright (C) 2002-2013 Sourcefire, Inc.
+* Marc A Norton <mnorton@sourcefire.com>
+*
+* Updates:
+* 3/06 - Added AC_BNFA search
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+**
+*/
+
+// lowmem_q.cc author Russ Combs <rucombs@cisco.com>
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <string>
+
+#include "sfksearch.h"
+#include "main/snort_debug.h"
+#include "main/snort_types.h"
+#include "framework/mpse.h"
+#include "framework/module.h"
+#include "log/messages.h"
+#include "time/profiler.h"
+
+using namespace std;
+
+static string s_var;
+
+//-------------------------------------------------------------------------
+// module stuff
+//-------------------------------------------------------------------------
+
+static const Parameter lowmem_q_params[] =
+{
+ { "var", Parameter::PT_STRING, nullptr, nullptr,
+ "additional print text" },
+
+ { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
+};
+
+class LowmemQModule : public Module
+{
+public:
+ LowmemQModule() : Module("lowmem_q", lowmem_q_params) { };
+ bool set(const char*, Value&, SnortConfig*);
+ bool begin(const char*, int, SnortConfig*);
+
+public:
+ string var;
+};
+
+bool LowmemQModule::set(const char*, Value& v, SnortConfig*)
+{
+ if ( v.is("var") )
+ var = v.get_string();
+
+ else
+ return false;
+
+ return true;
+}
+
+bool LowmemQModule::begin(const char*, int, SnortConfig*)
+{
+ var.clear();
+ return true;
+}
+
+//-------------------------------------------------------------------------
+// "lowmem_q"
+//-------------------------------------------------------------------------
+
+class LowmemQMpse : public Mpse
+{
+private:
+ KTRIE_STRUCT* obj;
+
+public:
+ LowmemQMpse(
+ bool use_gc,
+ void (*user_free)(void*),
+ void (*tree_free)(void**),
+ void (*list_free)(void**))
+ : Mpse("lowmem_q", use_gc)
+ {
+ obj = KTrieNew(1, user_free, tree_free, list_free);
+ };
+ ~LowmemQMpse()
+ {
+ if (obj)
+ KTrieDelete(obj);
+ };
+
+ int add_pattern(
+ SnortConfig*, void* P, int m,
+ unsigned noCase, unsigned, unsigned,
+ unsigned negative, void* ID, int)
+ {
+ return KTrieAddPattern(
+ obj, (unsigned char *)P, m,
+ noCase, negative, ID );
+ };
+
+ int prep_patterns(
+ SnortConfig* sc, mpse_build_f build_tree, mpse_negate_f neg_list)
+ {
+ return KTrieCompileWithSnortConf(sc, obj, build_tree, neg_list);
+ };
+
+ int _search(
+ const unsigned char* T, int n, mpse_action_f action,
+ void* data, int* current_state )
+ {
+ *current_state = 0;
+ return KTrieSearchQ(obj, (unsigned char *)T, n, action, data);
+ };
+
+ int get_pattern_count()
+ {
+ return KTriePatternCount(obj);
+ };
+};
+
+//-------------------------------------------------------------------------
+// api
+//-------------------------------------------------------------------------
+
+static Module* mod_ctor()
+{ return new LowmemQModule; }
+
+static void mod_dtor(Module* m)
+{ delete m; }
+
+static Mpse* lmq_ctor(
+ SnortConfig*,
+ class Module* mod,
+ bool use_gc,
+ void (*user_free)(void*),
+ void (*tree_free)(void**),
+ void (*list_free)(void**))
+{
+ LowmemQModule* lmqm = (LowmemQModule*)mod;
+ s_var = lmqm->var;
+ return new LowmemQMpse(use_gc, user_free, tree_free, list_free);
+}
+
+static void lmq_dtor(Mpse* p)
+{
+ delete p;
+}
+
+static void lmq_init()
+{
+ KTrie_init_xlatcase();
+ KTrieInitMemUsed();
+}
+
+static void lmq_print()
+{
+ if ( !KTrieMemUsed() )
+ return;
+
+ if ( !s_var.empty() )
+ LogMessage("lowmemq.var = %s\n", s_var.c_str());
+
+ double x = (double) KTrieMemUsed();
+
+ LogMessage("[ LowMem Search-Method Memory Used : %g %s ]\n",
+ (x > 1.e+6) ? x/1.e+6 : x/1.e+3,
+ (x > 1.e+6) ? "MBytes" : "KBytes" );
+}
+
+static const MpseApi lmq_api =
+{
+ {
+ PT_SEARCH_ENGINE,
+ "lowmem_q",
+ SEAPI_PLUGIN_V0,
+ 0,
+ mod_ctor,
+ mod_dtor
+ },
+ false,
+ nullptr,
+ nullptr,
+ nullptr,
+ nullptr,
+ lmq_ctor,
+ lmq_dtor,
+ lmq_init,
+ lmq_print,
+};
+
+const BaseApi* se_lowmem_q = &lmq_api.base;
+
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+** Copyright (C) 2013-2013 Sourcefire, Inc.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+// pat_stats.cc author Russ Combs <rucombs@cisco.com>
+
+#include "search_engines/pat_stats.h"
+#include "log/messages.h"
+
+THREAD_LOCAL PatMatQStat pmqs;
+
+void print_pat_stats(const char* type, unsigned max)
+{
+ if ( !pmqs.max_inq )
+ return;
+
+ LogMessage("%s: queue max = " STDu64 "\n", type, pmqs.max_inq);
+ LogMessage("%s: queue limit = " STDu64 "\n", type, (PegCount)max);
+ LogMessage("%s: queue flushes = " STDu64 "\n", type, pmqs.tot_inq_flush);
+ LogMessage("%s: queue inserts = " STDu64 "\n", type, pmqs.tot_inq_inserts);
+ LogMessage("%s: queue uinserts = " STDu64 "\n", type, pmqs.tot_inq_uinserts);
+}
+
--- /dev/null
+/*
+* ksearch.c
+*
+* Basic Keyword Search Trie - uses linked lists to build the finite automata
+*
+* Keyword-Match: Performs the equivalent of a multi-string strcmp()
+* - use for token testing after parsing the language tokens using lex or the like.
+*
+* Keyword-Search: searches the input text for one of multiple keywords,
+* and supports case sensitivite and case insensitive patterns.
+*
+*
+** Copyright (C) 2001 Marc Norton
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+** Copyright (C) 2003-2013 Sourcefire, Inc.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*
+*
+*/
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/types.h>
+#include <ctype.h>
+
+#include "main/snort_types.h"
+#include "main/snort_debug.h"
+#include "utils/snort_bounds.h"
+#include "sfksearch.h"
+#include "search_engines/pat_stats.h"
+
+#define SFKSEARCH_TRACK_Q
+
+#ifdef SFKSEARCH_TRACK_Q
+//# include "snort.h"
+//# include "util.h"
+#endif
+
+static void KTrieFree(KTRIENODE *n);
+
+static unsigned int mtot = 0; // FIXIT 1 / process
+
+unsigned int KTrieMemUsed(void)
+{
+ return mtot;
+}
+
+void KTrieInitMemUsed(void)
+{
+ mtot = 0;
+}
+
+/*
+* Allocate Memory
+*/
+static void * KTRIE_MALLOC(int n)
+{
+ void *p;
+
+ if (n < 1)
+ return NULL;
+
+ p = calloc(1, n);
+
+ if (p)
+ mtot += n;
+
+ return p;
+}
+
+/*
+* Free Memory
+*/
+static void KTRIE_FREE(void *p)
+{
+ if (p == NULL)
+ return;
+
+ free(p);
+}
+
+/*
+* Local/Tmp nocase array
+*/
+static THREAD_LOCAL unsigned char Tnocase[65*1024];
+
+/*
+** Case Translation Table
+*/
+static unsigned char xlatcase[256];
+
+/*
+*
+*/
+void KTrie_init_xlatcase(void)
+{
+ for(int i=0; i<256; i++) {
+ xlatcase[ i ] = (unsigned char)tolower(i);
+ }
+}
+
+/*
+*
+*/
+static inline void ConvertCaseEx( unsigned char * d, unsigned char *s, int m )
+{
+ int i;
+ for( i=0; i < m; i++ ) {
+ d[i] = xlatcase[ s[i] ];
+ }
+}
+
+
+/*
+*
+*/
+KTRIE_STRUCT * KTrieNew(
+ int method, void (*userfree)(void *p),
+ void (*optiontreefree)(void **p),
+ void (*neg_list_free)(void **p))
+{
+ KTRIE_STRUCT * ts = (KTRIE_STRUCT*) KTRIE_MALLOC( sizeof(KTRIE_STRUCT) );
+
+ if( !ts ) return 0;
+
+ memset(ts, 0, sizeof(KTRIE_STRUCT));
+
+ ts->memory = sizeof(KTRIE_STRUCT);
+ ts->nchars = 0;
+ ts->npats = 0;
+ ts->end_states = 0;
+ ts->method = method; /* - old method, 1 = queue */
+ ts->userfree = userfree;
+ ts->optiontreefree = optiontreefree;
+ ts->neg_list_free = neg_list_free;
+
+ return ts;
+}
+
+int KTriePatternCount(KTRIE_STRUCT *k)
+{
+ return k->npats;
+}
+
+/*
+ * Deletes memory that was used in creating trie
+ * and nodes
+ */
+void KTrieDelete(KTRIE_STRUCT *k)
+{
+ KTRIEPATTERN *p = NULL;
+ KTRIEPATTERN *pnext = NULL;
+ int i;
+
+ if (k == NULL)
+ return;
+
+ p = k->patrn;
+
+ while (p != NULL) {
+ pnext = p->next;
+
+ if (k->userfree && p->id)
+ k->userfree(p->id);
+
+ if (k->optiontreefree) {
+ if (p && p->rule_option_tree)
+ k->optiontreefree(&p->rule_option_tree);
+ }
+
+ if (k->neg_list_free) {
+ if (p && p->neg_list)
+ k->neg_list_free(&p->neg_list);
+ }
+
+ KTRIE_FREE(p->P);
+ KTRIE_FREE(p->Pcase);
+ KTRIE_FREE(p);
+
+ p = pnext;
+ }
+
+ for (i = 0; i < KTRIE_ROOT_NODES; i++)
+ KTrieFree(k->root[i]);
+
+ KTRIE_FREE(k);
+}
+
+/*
+ * Recursively delete all nodes in trie
+ */
+static void KTrieFree(KTRIENODE *n)
+{
+ if (n == NULL)
+ return;
+
+ KTrieFree(n->child);
+ KTrieFree(n->sibling);
+
+ KTRIE_FREE(n);
+}
+
+/*
+*
+*/
+static KTRIEPATTERN * KTrieNewPattern(unsigned char * P, int n)
+{
+ KTRIEPATTERN *p;
+ int ret;
+
+ if (n < 1)
+ return NULL;
+
+ p = (KTRIEPATTERN*) KTRIE_MALLOC( sizeof(KTRIEPATTERN) );
+
+ if (p == NULL)
+ return NULL;
+
+ /* Save as a nocase string */
+ p->P = (unsigned char*) KTRIE_MALLOC( n );
+ if( !p->P ) {
+ KTRIE_FREE(p);
+ return NULL;
+ }
+
+ ConvertCaseEx( p->P, P, n );
+
+ /* Save Case specific version */
+ p->Pcase = (unsigned char*) KTRIE_MALLOC( n );
+ if( !p->Pcase ) {
+ KTRIE_FREE(p->P);
+ KTRIE_FREE(p);
+ return NULL;
+ }
+
+ ret = SafeMemcpy(p->Pcase, P, n, p->Pcase, p->Pcase + n);
+ if (ret != SAFEMEM_SUCCESS) {
+ KTRIE_FREE(p->Pcase);
+ KTRIE_FREE(p->P);
+ KTRIE_FREE(p);
+ return NULL;
+ }
+
+ p->n = n;
+ p->next = NULL;
+
+ return p;
+}
+
+/*
+* Add Pattern info to the list of patterns
+*/
+int KTrieAddPattern( KTRIE_STRUCT * ts, unsigned char * P, int n,
+ int nocase, int negative, void * id )
+{
+ KTRIEPATTERN *pnew;
+
+ if( !ts->patrn ) {
+ pnew = ts->patrn = KTrieNewPattern( P, n );
+
+ if( !pnew ) return -1;
+ } else {
+ pnew = KTrieNewPattern(P, n );
+
+ if( !pnew ) return -1;
+
+ pnew->next = ts->patrn; /* insert at head of list */
+
+ ts->patrn = pnew;
+ }
+
+ pnew->nocase = nocase;
+ pnew->negative = negative;
+ pnew->id = id;
+ pnew->mnext = NULL;
+
+ ts->npats++;
+ ts->memory += sizeof(KTRIEPATTERN) + 2 * n ; /* Case and nocase */
+
+ return 0;
+}
+
+
+/*
+*
+*/
+static KTRIENODE * KTrieCreateNode(KTRIE_STRUCT * ts)
+{
+ KTRIENODE * t=(KTRIENODE*)KTRIE_MALLOC( sizeof(KTRIENODE) );
+
+ if(!t)
+ return 0;
+
+ memset(t,0,sizeof(KTRIENODE));
+
+ ts->memory += sizeof(KTRIENODE);
+
+ return t;
+}
+
+
+
+/*
+* Insert a Pattern in the Trie
+*/
+static int KTrieInsert( KTRIE_STRUCT *ts, KTRIEPATTERN * px )
+{
+ int type = 0;
+ int n = px->n;
+ unsigned char *P = px->P;
+ KTRIENODE *root;
+
+ /* Make sure we at least have a root character for the tree */
+ if( !ts->root[*P] ) {
+ ts->root[*P] = root = KTrieCreateNode(ts);
+ if( !root ) return -1;
+ root->edge = *P;
+
+ } else {
+
+ root = ts->root[*P];
+ }
+
+ /* Walk existing Patterns */
+ while( n ) {
+ if( root->edge == *P ) {
+ P++;
+ n--;
+
+ if( n && root->child ) {
+ root=root->child;
+ } else { /* cannot continue */
+ type = 0; /* Expand the tree via the child */
+ break;
+ }
+ } else {
+ if( root->sibling ) {
+ root=root->sibling;
+ } else { /* cannot continue */
+ type = 1; /* Expand the tree via the sibling */
+ break;
+ }
+ }
+ }
+
+ /*
+ * Add the next char of the Keyword, if any
+ */
+ if( n ) {
+ if( type == 0 ) {
+ /*
+ * Start with a new child to finish this Keyword
+ */
+ root->child= KTrieCreateNode( ts );
+ if( ! root->child ) return -1;
+ root=root->child;
+ root->edge = *P;
+ P++;
+ n--;
+ ts->nchars++;
+
+ } else {
+ /*
+ * Start a new sibling bracnch to finish this Keyword
+ */
+ root->sibling= KTrieCreateNode( ts );
+ if( ! root->sibling ) return -1;
+ root=root->sibling;
+ root->edge = *P;
+ P++;
+ n--;
+ ts->nchars++;
+ }
+ }
+
+ /*
+ * Finish the keyword as child nodes
+ */
+ while( n ) {
+ root->child = KTrieCreateNode(ts);
+ if( ! root->child ) return -1;
+ root=root->child;
+ root->edge = *P;
+ P++;
+ n--;
+ ts->nchars++;
+ }
+
+ if( root->pkeyword ) {
+ px->mnext = root->pkeyword; /* insert duplicates at front of list */
+ root->pkeyword = px;
+ ts->duplicates++;
+ } else {
+ root->pkeyword = px;
+ ts->end_states++;
+ }
+
+ return 0;
+}
+
+
+/*
+*
+*/
+static void Build_Bad_Character_Shifts( KTRIE_STRUCT * kt )
+{
+ int i,k;
+ KTRIEPATTERN *plist;
+
+ /* Calc the min pattern size */
+ kt->bcSize = 32000;
+
+ for( plist=kt->patrn; plist!=NULL; plist=plist->next ) {
+ if( plist->n < kt->bcSize ) {
+ kt->bcSize = plist->n; /* smallest pattern size */
+ }
+ }
+
+ /*
+ * Initialze the Bad Character shift table.
+ */
+ for (i = 0; i < KTRIE_ROOT_NODES; i++) {
+ kt->bcShift[i] = (unsigned short)kt->bcSize;
+ }
+
+ /*
+ * Finish the Bad character shift table
+ */
+ for( plist=kt->patrn; plist!=NULL; plist=plist->next ) {
+ int shift, cindex;
+
+ for( k=0; k<kt->bcSize; k++ ) {
+ shift = kt->bcSize - 1 - k;
+
+ cindex = plist->P[ k ];
+
+ if( shift < kt->bcShift[ cindex ] ) {
+ kt->bcShift[ cindex ] = (unsigned short)shift;
+ }
+ }
+ }
+}
+
+static int KTrieBuildMatchStateNode(
+ KTRIENODE *root,
+ int (*build_tree)(void * id, void **existing_tree),
+ int (*neg_list_func)(void *id, void **list))
+{
+ int cnt = 0;
+ KTRIEPATTERN *p;
+
+ if (!root)
+ return 0;
+
+ /* each and every prefix match at this root*/
+ if (root->pkeyword) {
+ for (p = root->pkeyword; p; p = p->mnext) {
+ if (p->id) {
+ if (p->negative) {
+ neg_list_func(p->id, &root->pkeyword->neg_list);
+ } else {
+ build_tree(p->id, &root->pkeyword->rule_option_tree);
+ }
+ }
+
+ cnt++;
+ }
+
+ /* Last call to finalize the tree for this root */
+ build_tree(NULL, &root->pkeyword->rule_option_tree);
+ }
+
+ /* for child of this root */
+ if (root->child) {
+ cnt += KTrieBuildMatchStateNode(root->child, build_tree, neg_list_func);
+ }
+
+ /* 1st sibling of this root -- other siblings will be processed from
+ * within the processing for root->sibling. */
+ if (root->sibling) {
+ cnt += KTrieBuildMatchStateNode(root->sibling, build_tree, neg_list_func);
+ }
+
+ return cnt;
+}
+
+static int KTrieBuildMatchStateNodeWithSnortConf(
+ SnortConfig *sc, KTRIENODE *root,
+ int (*build_tree)(SnortConfig *, void * id, void **existing_tree),
+ int (*neg_list_func)(void *id, void **list))
+{
+ int cnt = 0;
+ KTRIEPATTERN *p;
+
+ if (!root)
+ return 0;
+
+ /* each and every prefix match at this root*/
+ if (root->pkeyword) {
+ for (p = root->pkeyword; p; p = p->mnext) {
+ if (p->id) {
+ if (p->negative) {
+ neg_list_func(p->id, &root->pkeyword->neg_list);
+ } else {
+ build_tree(sc, p->id, &root->pkeyword->rule_option_tree);
+ }
+ }
+
+ cnt++;
+ }
+
+ /* Last call to finalize the tree for this root */
+ build_tree(sc, NULL, &root->pkeyword->rule_option_tree);
+ }
+
+ /* for child of this root */
+ if (root->child) {
+ cnt += KTrieBuildMatchStateNodeWithSnortConf(sc, root->child, build_tree, neg_list_func);
+ }
+
+ /* 1st sibling of this root -- other siblings will be processed from
+ * within the processing for root->sibling. */
+ if (root->sibling) {
+ cnt += KTrieBuildMatchStateNodeWithSnortConf(sc, root->sibling, build_tree, neg_list_func);
+ }
+
+ return cnt;
+}
+
+static int KTrieBuildMatchStateTrees(
+ KTRIE_STRUCT * ts,
+ int (*build_tree)(void * id, void **existing_tree),
+ int (*neg_list_func)(void *id, void **list))
+{
+ int i, cnt = 0;
+ KTRIENODE * root;
+
+ /* Find the states that have a MatchList */
+ for (i = 0; i < KTRIE_ROOT_NODES; i++) {
+ root = ts->root[i];
+ /* each and every prefix match at this root*/
+ if (root) {
+ cnt += KTrieBuildMatchStateNode(root, build_tree, neg_list_func);
+ }
+ }
+
+ return cnt;
+}
+
+static int KTrieBuildMatchStateTreesWithSnortConf(
+ SnortConfig *sc, KTRIE_STRUCT * ts,
+ int (*build_tree)(SnortConfig *, void * id, void **existing_tree),
+ int (*neg_list_func)(void *id, void **list))
+{
+ int i, cnt = 0;
+ KTRIENODE * root;
+
+ /* Find the states that have a MatchList */
+ for (i = 0; i < KTRIE_ROOT_NODES; i++) {
+ root = ts->root[i];
+ /* each and every prefix match at this root*/
+ if (root) {
+ cnt += KTrieBuildMatchStateNodeWithSnortConf(sc, root, build_tree, neg_list_func);
+ }
+ }
+
+ return cnt;
+}
+
+/*
+* Build the Keyword TRIE
+*
+*/
+static inline int _KTrieCompile(KTRIE_STRUCT * ts)
+{
+ KTRIEPATTERN * p;
+ /*
+ static int tmem=0; // unused
+ */
+
+ /*
+ * Build the Keyword TRIE
+ */
+ for( p=ts->patrn; p; p=p->next ) {
+ if( KTrieInsert( ts, p ) )
+ return -1;
+ }
+
+ /*
+ * Build A Setwise Bad Character Shift Table
+ */
+ Build_Bad_Character_Shifts( ts );
+
+ /*
+ tmem += ts->memory;
+ printf(" Compile stats: %d patterns, %d chars, %d duplicate patterns, %d bytes, %d total-bytes\n",ts->npats,ts->nchars,ts->duplicates,ts->memory,tmem);
+ */
+
+ return 0;
+}
+
+int KTrieCompile(
+ KTRIE_STRUCT * ts,
+ int (*build_tree)(void * id, void **existing_tree),
+ int (*neg_list_func)(void *id, void **list))
+{
+ int rval;
+
+ if ((rval = _KTrieCompile(ts)))
+ return rval;
+
+ if (build_tree && neg_list_func) {
+ KTrieBuildMatchStateTrees(ts, build_tree, neg_list_func);
+ }
+
+ return 0;
+}
+
+int KTrieCompileWithSnortConf(
+ SnortConfig *sc, KTRIE_STRUCT * ts,
+ int (*build_tree)(SnortConfig *, void * id, void **existing_tree),
+ int (*neg_list_func)(void *id, void **list))
+{
+ int rval;
+
+ if ((rval = _KTrieCompile(ts)))
+ return rval;
+
+ if (build_tree && neg_list_func) {
+ KTrieBuildMatchStateTreesWithSnortConf(sc, ts, build_tree, neg_list_func);
+ }
+
+ return 0;
+}
+
+void sfksearch_print_qinfo(void)
+{
+#ifdef SFKSEARCH_TRACK_Q
+ print_pat_stats("sfksearch", SFK_MAX_INQ);
+#endif
+}
+static inline void _init_queue( SFK_PMQ * b)
+{
+ b->inq=0;
+ b->inq_flush=0;
+}
+
+/* uniquely insert into q */
+static inline int _add_queue(SFK_PMQ * b, void * p )
+{
+ int i;
+
+#ifdef SFKSEARCH_TRACK_Q
+ pmqs.tot_inq_inserts++;
+#endif
+
+ for(i=(int)(b->inq)-1; i>=0; i--)
+ if( p == b->q[i] )
+ return 0;
+
+#ifdef SFKSEARCH_TRACK_Q
+ pmqs.tot_inq_uinserts++;
+#endif
+
+ if( b->inq < SFK_MAX_INQ ) {
+ b->q[ b->inq++ ] = p;
+ }
+
+ if( b->inq == SFK_MAX_INQ ) {
+#ifdef SFKSEARCH_TRACK_Q
+ b->inq_flush++;
+#endif
+ return 1;
+ }
+ return 0;
+}
+
+static inline unsigned _process_queue(
+ SFK_PMQ * q,
+ int(*match)(void * id, void *tree, int index, void *data, void *neg_list),
+ void *data )
+{
+ KTRIEPATTERN * pk;
+ unsigned int i;
+
+#ifdef SFKSEARCH_TRACK_Q
+ if( q->inq > pmqs.max_inq )
+ pmqs.max_inq = q->inq;
+ pmqs.tot_inq_flush += q->inq_flush;
+#endif
+
+ for( i=0; i<q->inq; i++ ) {
+ pk = (KTRIEPATTERN*)q->q[i];
+ if (pk) {
+ if (match (pk->id, pk->rule_option_tree, 0, data, pk->neg_list) > 0) {
+ q->inq=0;
+ return 1;
+ }
+ }
+ }
+ q->inq=0;
+ return 0;
+}
+
+static inline int KTriePrefixMatchQ(
+ KTRIE_STRUCT * kt, unsigned char * T, int n,
+ int(*match)(void * id, void *tree, int index, void *data, void *neg_list),
+ void * data )
+{
+ KTRIENODE * root;
+ //KTRIEPATTERN * pk;
+ //int index ;
+
+ root = kt->root[ xlatcase[*T] ];
+
+ if( !root )
+ return 0;
+
+ while( n ) {
+ if( root->edge == xlatcase[*T] ) {
+ T++;
+ n--;
+
+ if( root->pkeyword ) {
+ if( _add_queue( &kt->q, root->pkeyword ) ) {
+ if( _process_queue( &kt->q,match,data) ) {
+ return 1;
+ }
+ }
+ }
+
+ if( n && root->child ) {
+ root = root->child;
+ } else { /* cannot continue -- match is over */
+ break;
+ }
+ } else {
+ if( root->sibling ) {
+ root = root->sibling;
+ } else { /* cannot continue */
+ break;
+ }
+ }
+ }
+
+ return 0;
+}
+
+/*
+* Search - Algorithm
+*
+* This routine will log any substring of T that matches a keyword,
+* and processes all prefix matches. This is used for generic
+* pattern searching with a set of keywords and a body of text.
+*
+*
+*
+* kt- Trie Structure
+* T - nocase text
+* Tc- case specific text
+* n - text length
+*
+* returns:
+* # pattern matches
+*/
+static inline int KTriePrefixMatch(
+ KTRIE_STRUCT* kt, unsigned char* T, unsigned char*, unsigned char* bT, int n,
+ int(*match)(void* id, void* tree, int index, void* data, void* neg_list),
+ void * data )
+{
+ KTRIENODE * root = kt->root[ *T ];
+ int nfound = 0;
+ KTRIEPATTERN * pk;
+ int index ;
+
+ /* Check if any keywords start with this character */
+ if( !root ) return 0;
+
+ while( n ) {
+ if( root->edge == *T ) {
+ T++;
+ n--;
+
+ pk = root->pkeyword;
+ if (pk) {
+ index = (int)(T - bT - pk->n );
+ nfound++;
+ if (match (pk->id, pk->rule_option_tree, index, data, pk->neg_list) > 0) {
+ return nfound;
+ }
+ }
+
+ if( n && root->child ) {
+ root = root->child;
+ } else { /* cannot continue -- match is over */
+ break;
+ }
+ } else {
+ if( root->sibling ) {
+ root = root->sibling;
+ } else { /* cannot continue */
+ break;
+ }
+ }
+ }
+
+ return nfound;
+}
+
+int KTrieSearchQ(
+ KTRIE_STRUCT * ks, unsigned char * T, int n,
+ int(*match)(void * id, void *tree, int index, void *data, void *neg_list),
+ void * data )
+{
+ _init_queue(&ks->q);
+ while( n > 0 ) {
+ if( KTriePrefixMatchQ( ks, T++, n--, match, data ) )
+ return 0;
+ }
+ _process_queue(&ks->q,match,data);
+
+ return 0;
+}
+
+static inline int KTrieSearchQBC(
+ KTRIE_STRUCT * ks, unsigned char * T, int n,
+ int(*match)(void * id, void *tree, int index, void *data, void *neg_list),
+ void * data )
+{
+ int tshift;
+ unsigned char *Tend;
+ short *bcShift = (short*)ks->bcShift;
+ int bcSize = ks->bcSize;
+
+ _init_queue(&ks->q);
+
+ Tend = T + n - bcSize;
+
+ bcSize--;
+
+ for( ; T <= Tend; n--, T++ ) {
+ while( (tshift = bcShift[ T[bcSize] ]) > 0 ) {
+ T += tshift;
+ if( T > Tend )
+ return 0;
+ }
+
+ if( KTriePrefixMatchQ( ks, T, n, match, data ) )
+ return 0;
+ }
+
+ _process_queue(&ks->q,match,data);
+
+ return 0;
+}
+
+
+/*
+*
+*/
+static inline int KTrieSearchNoBC(
+ KTRIE_STRUCT * ks, unsigned char * Tx, int n,
+ int(*match)(void * id, void *tree, int index, void *data, void *neg_list),
+ void * data )
+{
+ int nfound = 0;
+ unsigned char *T, *bT;
+
+ ConvertCaseEx( Tnocase, Tx, n );
+
+ T = Tnocase;
+ bT = T;
+
+ for( ; n>0 ; n--, T++, Tx++ ) {
+ nfound += KTriePrefixMatch( ks, T, Tx, bT, n, match, data );
+ }
+
+ return nfound;
+}
+
+/*
+*
+*/
+static inline int KTrieSearchBC(
+ KTRIE_STRUCT * ks, unsigned char * Tx, int n,
+ int(*match)(void * id, void *tree, int index, void *data, void *neg_list),
+ void * data )
+{
+ int tshift;
+ unsigned char *Tend;
+ unsigned char *T, *bT;
+ int nfound = 0;
+ short *bcShift = (short*)ks->bcShift;
+ int bcSize = ks->bcSize;
+
+ ConvertCaseEx( Tnocase, Tx, n );
+
+ T = Tnocase;
+ bT = T;
+
+ Tend = T + n - bcSize;
+
+ bcSize--;
+
+ for( ; T <= Tend; n--, T++, Tx++ ) {
+ while( (tshift = bcShift[ *( T + bcSize ) ]) > 0 ) {
+ T += tshift;
+ Tx += tshift;
+ if( T > Tend ) return nfound;
+ }
+
+ nfound += KTriePrefixMatch( ks, T, Tx, bT, n, match, data );
+ }
+
+ return nfound;
+}
+
+int KTrieSearch(
+ KTRIE_STRUCT * ks, unsigned char * T, int n,
+ int(*match)(void * id, void *tree, int index, void *data, void *neg_list),
+ void * data )
+{
+ if ( ks->bcSize < 3 )
+ return KTrieSearchNoBC( ks, T, n, match, data );
+ else
+ return KTrieSearchBC( ks, T, n, match, data );
+}
+
+/*
+*
+* TEST DRIVER FOR KEYWORD TRIE
+*
+*/
+#ifdef KTRIE_MAIN
+
+char ** gargv;
+
+int trie_nmatches = 0;
+
+int match( unsigned id, int index, void * data )
+{
+ trie_nmatches++;
+ data = data;
+ printf("id=%d found at index=%d, %s\n",id,index,gargv[id]);
+ return 0;
+}
+
+/*
+*
+*/
+int main( int argc, char ** argv )
+{
+ int i;
+ KTRIE_STRUCT * ts;
+ int nocase=1; // don't care about case
+
+ gargv = argv;
+
+ ts = KTrieNew();
+
+ if( argc < 3 ) {
+ printf("%s text pat1 pat2 ... patn [-c(ase-sensitive)\n",argv[0]);
+ printf("search for keywords-default, or match keywords\n");
+ exit(0);
+ }
+
+ for(i=1; i<argc; i++) {
+ if( strcmp(argv[i],"-c")==0 ) nocase=0; /* ignore case */
+ }
+
+ printf("New TRIE created\n");
+
+ for(i=2; i<argc; i++) {
+ if( argv[i][0]=='-' )
+ continue;
+
+ KTrieAddPattern( ts, (unsigned char *)argv[i], strlen(argv[i]), nocase, i );
+ }
+
+ printf("Patterns added \n");
+
+ KTrieCompile( ts );
+
+ printf("Patterns compiled \n");
+ printf("--> %d characters, %d patterns, %d bytes allocated\n",ts->nchars,ts->npats,ts->memory);
+
+ printf("Searching...\n");
+
+ KTrieSearch( ts, (unsigned char*)argv[1], strlen(argv[1]), match, 0 );
+
+ printf("%d matches found\n",trie_nmatches);
+
+ printf("normal pgm finish.\n");
+
+ return 0;
+}
+
+#endif
--- /dev/null
+/*
+* ksearch.h
+*
+* Trie based multi-pattern matcher
+*
+*
+* Copyright (C) 2001 Marc Norton
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+** Copyright (C) 2003-2013 Sourcefire, Inc.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+
+#ifndef SFKSEARCH_H
+#define SFKSEARCH_H
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#define ALPHABET_SIZE 256
+
+#define KTRIEMETHOD_STD 0
+#define KTRIEMETHOD_QUEUE 1
+
+/*
+*
+*/
+typedef struct _ktriepattern {
+
+ struct _ktriepattern* next; /* global list of all patterns*/
+ struct _ktriepattern* mnext; /* matching list of duplicate keywords*/
+
+ unsigned char* P; /* no case*/
+ unsigned char* Pcase; /* case sensitive*/
+ int n;
+ int nocase;
+ int negative;
+ void * id;
+ void * rule_option_tree;
+ void * neg_list;
+
+} KTRIEPATTERN;
+
+
+/*
+*
+*/
+typedef struct _ktrienode {
+
+ int edge; /* character*/
+
+ struct _ktrienode* sibling;
+ struct _ktrienode* child;
+
+ KTRIEPATTERN*pkeyword;
+
+} KTRIENODE;
+
+
+#define KTRIE_ROOT_NODES 256
+
+#define SFK_MAX_INQ 32
+typedef struct
+{
+ unsigned inq;
+ unsigned inq_flush;
+ void* q[SFK_MAX_INQ];
+} SFK_PMQ;
+
+/*
+*
+*/
+typedef struct {
+
+ KTRIEPATTERN* patrn; /* List of patterns, built as they are added*/
+
+
+ KTRIENODE * root[KTRIE_ROOT_NODES]; /* KTrie nodes*/
+
+ int memory;
+ int nchars;
+ int npats;
+ int duplicates;
+ int method;
+ int end_states; /* should equal npats - duplicates*/
+
+ int bcSize;
+ unsigned short bcShift[KTRIE_ROOT_NODES];
+ void (*userfree)(void*p);
+ void (*optiontreefree)(void**p);
+ void (*neg_list_free)(void**p);
+ SFK_PMQ q;
+
+} KTRIE_STRUCT;
+
+void KTrie_init_xlatcase();
+
+KTRIE_STRUCT* KTrieNew(
+ int method, void (*userfree)(void*p),
+ void (*optiontreefree)(void**p),
+ void (*neg_list_free)(void**p));
+
+int KTrieAddPattern(
+ KTRIE_STRUCT*ts, unsigned char* P, int n,
+ int nocase, int negative, void* id );
+
+int KTrieCompile(
+ KTRIE_STRUCT* ts,
+ int (*build_tree)(void* id, void**existing_tree),
+ int (*neg_list_func)(void*id, void**list));
+
+struct SnortConfig;
+
+int KTrieCompileWithSnortConf(
+ SnortConfig*, KTRIE_STRUCT* ts,
+ int (*build_tree)(SnortConfig*, void* id, void**existing_tree),
+ int (*neg_list_func)(void*id, void**list));
+
+int KTrieSearch(
+ KTRIE_STRUCT* ts, unsigned char* T, int n,
+ int(*match)(void* id, void*tree, int index, void*data, void*neg_list),
+ void*data );
+
+int KTrieSearchQ(
+ KTRIE_STRUCT* ts, unsigned char* T, int n,
+ int(*match)(void* id, void*tree, int index, void*data, void*neg_list),
+ void*data );
+
+unsigned int KTrieMemUsed(void);
+void KTrieInitMemUsed(void);
+void KTrieDelete(KTRIE_STRUCT*k);
+int KTriePatternCount(KTRIE_STRUCT*k);
+
+void sfksearch_print_qinfo(void);
+
+#endif
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+** Copyright (C) 2013-2013 Sourcefire, Inc.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+// trie_api.cc author Russ Combs <rucombs@cisco.com>
+
+#include "framework/mpse.h"
+
+extern const BaseApi* se_lowmem;
+extern const BaseApi* se_lowmem_q;
+
+SO_PUBLIC const BaseApi* snort_plugins[] =
+{
+ se_lowmem,
+ se_lowmem_q,
+ nullptr
+};
+
--- /dev/null
+AUTOMAKE_OPTIONS=foreign
+
+optlibdir = $(pkglibdir)/so_rules
+optlib_LTLIBRARIES = lib18758.la
+lib18758_la_CXXFLAGS = $(AM_CXXFLAGS)
+lib18758_la_LDFLAGS = -export-dynamic -shared
+lib18758_la_SOURCES = sid_18758.cc sid_18758.h
+
+BUILT_SOURCES = \
+sid_18758.h
+
+%.gz : %.txt
+ gzip --best --no-name --stdout $< > $@
+
+%.h : %.gz
+ xxd -i $< > $@
+
+AM_CXXFLAGS = @AM_CXXFLAGS@
+
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+** Copyright (C) 2002-2013 Sourcefire, Inc.
+** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+// sid_18758.cc author Russ Combs <rucombs@cisco.com>
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <assert.h>
+#include <string.h>
+
+#include "main/snort_types.h"
+#include "framework/so_rule.h"
+#include "detection/detection_defines.h"
+#include "sid_18758.h"
+
+static constexpr unsigned crash_test_dummy = 18758;
+
+static int eval(void* v, Packet* p)
+{
+ unsigned u = *((unsigned*)v);
+ assert(u == crash_test_dummy);
+ return p ? DETECTION_OPTION_MATCH : DETECTION_OPTION_NO_MATCH;
+}
+
+static SoEvalFunc ctor(const char* so, void** pv)
+{
+ assert(!strcmp(so, "eval"));
+ *pv = new unsigned(crash_test_dummy);
+ return eval;
+}
+
+static void dtor(void* v)
+{
+ unsigned* u = (unsigned*)v;
+ assert(*u == crash_test_dummy);
+ delete u;
+}
+
+static const SoApi so_api =
+{
+ {
+ PT_SO_RULE,
+ "3|18758",
+ IPSAPI_PLUGIN_V0,
+ 8,
+ nullptr,
+ nullptr
+ },
+ sid_18758_gz,
+ sid_18758_gz_len,
+ nullptr,
+ nullptr,
+ nullptr,
+ nullptr,
+ ctor,
+ dtor,
+};
+
+SO_PUBLIC const BaseApi* snort_plugins[] =
+{
+ &so_api.base,
+ nullptr
+};
+
--- /dev/null
+unsigned char sid_18758_gz[] = {
+ 0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x03, 0x2d, 0x8e,
+ 0x5f, 0x4b, 0xc3, 0x40, 0x10, 0xc4, 0xdf, 0xfd, 0x14, 0x4b, 0xc8, 0x43,
+ 0x0b, 0xfd, 0x83, 0x8a, 0x58, 0x2e, 0xa0, 0x28, 0x46, 0x5a, 0xa8, 0xb5,
+ 0xd4, 0x58, 0x15, 0x2b, 0xe1, 0x7a, 0xd9, 0xb4, 0x8b, 0xd7, 0xbb, 0x78,
+ 0xbb, 0x4d, 0x5b, 0xe8, 0x87, 0x37, 0x15, 0x9f, 0x96, 0xf9, 0xed, 0x30,
+ 0x33, 0xda, 0x62, 0x10, 0x10, 0x53, 0x41, 0x3c, 0x7c, 0x7e, 0x4a, 0xf3,
+ 0x49, 0x9a, 0x81, 0x76, 0x07, 0xe8, 0xde, 0x40, 0x9c, 0xbe, 0x67, 0xe9,
+ 0x6c, 0x72, 0x37, 0xfe, 0x83, 0xf1, 0x30, 0xcb, 0xa6, 0xf9, 0xf4, 0x79,
+ 0x96, 0xbd, 0x40, 0x6b, 0xc3, 0x2b, 0x15, 0x3d, 0x8e, 0xc6, 0x69, 0x77,
+ 0xf4, 0x90, 0x4e, 0xb2, 0xd1, 0xe3, 0x07, 0x3c, 0x91, 0x09, 0x9e, 0x7d,
+ 0x29, 0xf0, 0x46, 0xae, 0xf0, 0x3b, 0x86, 0x39, 0xf1, 0x56, 0x5b, 0xb8,
+ 0xd7, 0x4c, 0x06, 0xd8, 0x04, 0xaa, 0x04, 0x4a, 0xb2, 0x08, 0xcd, 0xd7,
+ 0x59, 0xaf, 0x0b, 0x08, 0xf8, 0xb3, 0x45, 0x96, 0x28, 0x81, 0x0d, 0x8a,
+ 0x2e, 0xb4, 0x68, 0xc5, 0x18, 0x6a, 0x32, 0x08, 0x6b, 0x91, 0x2a, 0x69,
+ 0x0c, 0x25, 0x06, 0x74, 0x06, 0xd5, 0x36, 0xd8, 0x0e, 0xba, 0xde, 0x8e,
+ 0xbe, 0xa9, 0xc2, 0x82, 0x74, 0xcf, 0x87, 0x55, 0xff, 0xa4, 0xfa, 0xf3,
+ 0x25, 0x27, 0x60, 0xac, 0x66, 0x96, 0x43, 0x85, 0x6a, 0x43, 0x6c, 0xba,
+ 0xda, 0x08, 0xd5, 0x24, 0x87, 0x04, 0x98, 0x0a, 0x75, 0x3e, 0xb8, 0xbe,
+ 0x1a, 0x9c, 0xc2, 0x6a, 0xd5, 0x1c, 0xf6, 0x0d, 0xba, 0x3c, 0xfe, 0xc3,
+ 0xd2, 0xfa, 0x9d, 0x12, 0x9f, 0x9f, 0x7a, 0x31, 0x74, 0x9a, 0x35, 0x7a,
+ 0x69, 0x89, 0xd7, 0x58, 0x34, 0xa1, 0xde, 0x09, 0x3a, 0x51, 0x51, 0xaf,
+ 0x5e, 0x72, 0xd4, 0x81, 0x52, 0xb3, 0xe4, 0x95, 0x16, 0xc1, 0xe0, 0x94,
+ 0x77, 0xf6, 0xd0, 0xf9, 0x9b, 0x99, 0x6f, 0x03, 0x25, 0x50, 0x99, 0x80,
+ 0x2a, 0xea, 0x2f, 0xf6, 0x17, 0xd8, 0xb8, 0x5b, 0x9f, 0x8b, 0xdb, 0xc5,
+ 0xfe, 0xca, 0x34, 0xb2, 0xfc, 0x3a, 0xc6, 0xed, 0x3e, 0x6f, 0xe8, 0x35,
+ 0x3a, 0x95, 0x2b, 0xac, 0xb5, 0x4d, 0xa0, 0x7d, 0xf6, 0x0b, 0xe0, 0x25,
+ 0xec, 0x5e, 0x7a, 0x01, 0x00, 0x00
+};
+unsigned int sid_18758_gz_len = 318;
--- /dev/null
+alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"FILE-IDENTIFY Microsoft Windows Visual Basic script file download request"; metadata:service http; reference:url,en.wikipedia.org/wiki/Vbs; classtype:misc-activity; sid:18758; rev:8; soid:3|18758; flow:to_server,established; content:".vbs", fast_pattern:only, http_uri; pcre:"/\x2evbs([\?\x5c\x2f]|$)/smiU"; so:eval; )
--- /dev/null
+alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"FILE-IDENTIFY Microsoft Windows Visual Basic script file download request"; metadata:service http; reference:url,en.wikipedia.org/wiki/Vbs; classtype:misc-activity; sid:18758; rev:8; soid:3|18758;)
projects / thirdparty / snort3.git / commitdiff
