"${CMAKE_CURRENT_BINARY_DIR}/snort_manual.html"
"${CMAKE_CURRENT_BINARY_DIR}/snort_manual.chunked"
)
+
+ add_custom_target (
+ snort_online.html
+ COMMAND ${CMAKE_SOURCE_DIR}/doc/online_manual.sh
+ DEPENDS all_built_sources
+ )
+
+ add_custom_target (
+ dev_guide.html
+ COMMAND ${CMAKE_SOURCE_DIR}/doc/dev_guide.sh ${CMAKE_SOURCE_DIR}
+ DEPENDS all_built_sources
+ )
+
endif ( MAKE_HTML_DOC )
if ( MAKE_TEXT_DOC )
uninstall-hook:
rm -rf $(DESTDIR)$(docdir)/snort_manual.chunked
+
+snort_online.html: $(all_sources)
+ $(srcdir)/online_manual.sh
+
+dev_guide.html: $(snort)
+ $(srcdir)/dev_guide.sh $(top_srcdir)
endif
delete_unbuilt = $(if $(and $(findstring $(builddir),$(srcdir)),$(findstring $(srcdir),$(builddir))), ,$(unbuilt_sources))
rm -f $(doc_DATA)
rm -f snort_manual.{fo,xml}
rm -rf snort_manual.chunked
- rm -f *.css *.tgz
+ rm -f *.css *.tgz *.html
# -- remove header guards? (outermost #ifndef, #define, #endif)
# -- use css source instead of the sed fixups?
+if [ "$1" ] ; then
+ pushd .
+ cd $1 || exit -1
+ echo "cd $1"
+fi
+
tmp=/tmp/dev_guide/
out=$tmp/dev_guide.txt
html=$tmp/dev_guide.html
sed -i.sed -f sed_cmds.txt $html
echo "clean up"
-mv dev_guide.* ../
-cd ..
+popd
+mv $html ./
rm -rf $tmp
-echo "done; see /tmp/dev_guide.html"
+echo "done; see ./dev_guide.html"
if (hlen < ip::IP4_HEADER_LEN)
{
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
- "Bogus IP header length of %i bytes\n", hlen); );
+ DebugFormat(DEBUG_DECODE,
+ "Bogus IP header length of %i bytes\n", hlen);
codec_event(codec, DECODE_IPV4_INVALID_HEADER_LEN);
return false;
if (ip_len > raw.len)
{
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
+ DebugFormat(DEBUG_DECODE,
"IP Len field is %d bytes bigger than captured length.\n"
" (ip.len: %lu, cap.len: %lu)\n",
- ip_len - raw.len, ip_len, raw.len); );
+ ip_len - raw.len, ip_len, raw.len);
codec_event(codec, DECODE_IPV4_DGRAM_GT_CAPLEN);
return false;
if (ip_len < hlen)
{
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
+ DebugFormat(DEBUG_DECODE,
"IP dgm len (%d bytes) < IP hdr "
- "len (%d bytes), packet discarded\n", ip_len, hlen); );
+ "len (%d bytes), packet discarded\n", ip_len, hlen);
codec_event(codec, DECODE_IPV4_DGRAM_LT_IPHDR);
return false;
static THREAD_LOCAL bool had_vj = false;
uint16_t protocol;
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "PPP Packet!\n"); );
+ DebugMessage(DEBUG_DECODE, "PPP Packet!\n");
#ifdef WORDS_MUSTALIGN
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Packet with PPP header. "
+ DebugMessage(DEBUG_DECODE, "Packet with PPP header. "
"PPP is only 1 or 2 bytes and will throw off "
"alignment on this architecture when decoding IP, "
- "causing a bus error - stop decoding packet.\n"); );
+ "causing a bus error - stop decoding packet.\n");
return true;
#endif /* WORDS_MUSTALIGN */
switch (ppp_type)
{
case PppoepktType::DISCOVERY:
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "(PPPOE Discovery) "); );
+ DebugMessage(DEBUG_DECODE, "(PPPOE Discovery) ");
break;
case PppoepktType::SESSION:
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "(PPPOE Session) "); );
+ DebugMessage(DEBUG_DECODE, "(PPPOE Session) ");
break;
}
if (ppp_type == PppoepktType::DISCOVERY)
{
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Returning early on PPPOE discovery packet\n"); );
+ DebugMessage(DEBUG_DECODE, "Returning early on PPPOE discovery packet\n");
return true;
}
switch (version)
{
case 0: /*GTP v0*/
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "GTP v0 packets.\n"); );
+ DebugMessage(DEBUG_DECODE, "GTP v0 packets.\n");
len = GTP_V0_HEADER_LEN;
if (raw.len < len)
if (raw.len != ((unsigned int)ntohs(hdr->length) + len))
{
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Calculated length %d != %d in header.\n",
- raw.len - len, ntohs(hdr->length)); );
+ DebugFormat(DEBUG_DECODE, "Calculated length %d != %d in header.\n",
+ raw.len - len, ntohs(hdr->length));
codec_event(codec, DECODE_GTP_BAD_LEN);
return false;
}
break;
case 1: /*GTP v1*/
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "GTP v1 packets.\n"); );
+ DebugMessage(DEBUG_DECODE, "GTP v1 packets.\n");
/*Check the length based on optional fields and extension header*/
if (hdr->flag & 0x07)
if (raw.len != ((unsigned int)ntohs(hdr->length) + GTP_MIN_LEN))
{
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Calculated length %d != %d in header.\n",
- raw.len - GTP_MIN_LEN, ntohs(hdr->length)); );
+ DebugFormat(DEBUG_DECODE, "Calculated length %d != %d in header.\n",
+ raw.len - GTP_MIN_LEN, ntohs(hdr->length));
codec_event(codec, DECODE_GTP_BAD_LEN);
return false;
}
break;
default:
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Unknown protocol version.\n"); );
+ DebugMessage(DEBUG_DECODE, "Unknown protocol version.\n");
return false;
}
pktcnt = PPM_INC_PKT_CNT();
PPM_GET_TIME();
PPM_INIT_PKT_TIMER();
+
#ifdef DEBUG_MSGS
- if ( DebugThis(DEBUG_PPM) )
+ if ( Debug::enabled(DEBUG_PPM) )
{
/* for debugging, info gathering, so don't worry about
* (unsigned) casting of pktcnt, were not likely to debug
// If the packet has errors, we won't analyze it.
if ( p->ptrs.decode_flags & DECODE_ERR_FLAGS )
{
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT,
+ DebugFormat(DEBUG_DETECT,
"Packet errors = 0x%x, ignoring traffic!\n",
- (p->ptrs.decode_flags & DECODE_ERR_FLAGS)); );
+ (p->ptrs.decode_flags & DECODE_ERR_FLAGS));
if ( SnortConfig::inline_mode() and
SnortConfig::checksum_drop(p->ptrs.decode_flags & DECODE_ERR_CKSUM_ALL) )
{
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
- "Dropping bad packet\n"); );
+ DebugMessage(DEBUG_DECODE, "Dropping bad packet\n");
Active::drop_packet(p);
}
}
PPM_GET_TIME();
PPM_TOTAL_PKT_TIME();
PPM_ACCUM_PKT_TIME();
+
#ifdef DEBUG_MSGS
- if ( DebugThis(DEBUG_PPM) )
+ if ( Debug::enabled(DEBUG_PPM) )
{
+ // FIXIT-L logs should be debugs
LogMessage("PPM: Pkt[%u] Used= ",(unsigned)pktcnt);
PPM_PRINT_PKT_TIME("%g usecs\n");
LogMessage("PPM: Process-EndPkt[%u]\n\n",(unsigned)pktcnt);
}
#endif
-
PPM_PKT_LOG(p);
}
if ( PPM_RULES_ENABLED() )
if (check_tags_flag == 1 && !(p->packet_flags & PKT_REBUILT_STREAM))
{
void* listhead = NULL;
- DEBUG_WRAP(DebugMessage(DEBUG_FLOW, "calling CheckTagList\n"); );
+ DebugMessage(DEBUG_FLOW, "calling CheckTagList\n");
if (CheckTagList(p, &event, &listhead))
{
- DEBUG_WRAP(DebugMessage(DEBUG_FLOW, "Matching tag node found, "
- "calling log functions\n"); );
+ DebugMessage(DEBUG_FLOW, "Matching tag node found, "
+ "calling log functions\n");
/* if we find a match, we want to send the packet to the
* logging mechanism
int except_port_flag = 0; /* port exception flag set */
int ip_match = 0; /* flag to indicate addr match made */
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT, "CheckAddrPort: "); );
+ DebugMessage(DEBUG_DETECT, "CheckAddrPort: ");
/* set up the packet particulars */
if (mode & CHECK_SRC_IP)
{
pkt_addr = p->ptrs.ip_api.get_src();
pkt_port = p->ptrs.sp;
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT,"SRC "); );
+ DebugMessage(DEBUG_DETECT,"SRC ");
if (mode & INVERSE)
{
pkt_addr = p->ptrs.ip_api.get_dst();
pkt_port = p->ptrs.dp;
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT, "DST "); );
+ DebugMessage(DEBUG_DETECT, "DST ");
if (mode & INVERSE)
{
}
}
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT, "addr %lx, port %d ", pkt_addr,
- pkt_port); );
+ DebugFormat(DEBUG_DETECT, "addr %lx, port %d ", pkt_addr, pkt_port);
if (!rule_addr)
goto bail;
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT, ", global exception flag set"); );
+ DebugMessage(DEBUG_DETECT, ", global exception flag set");
/* global exception flag is up, we can't match on *any*
* of the source addresses
*/
bail:
if (!ip_match)
{
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT, ", no address match, "
- "packet rejected\n"); );
+ DebugMessage(DEBUG_DETECT, ", no address match, "
+ "packet rejected\n");
return 0;
}
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT, ", addresses accepted"); );
+ DebugMessage(DEBUG_DETECT, ", addresses accepted");
/* if the any port flag is up, we're all done (success) */
if (any_port_flag)
{
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT, ", any port match, "
- "packet accepted\n"); );
+ DebugMessage(DEBUG_DETECT, ", any port match, "
+ "packet accepted\n");
return 1;
}
/* if the exception flag isn't up, fail */
if (!except_port_flag)
{
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT, ", port mismatch, "
- "packet rejected\n"); );
+ DebugMessage(DEBUG_DETECT, ", port mismatch, "
+ "packet rejected\n");
return 0;
}
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT, ", port mismatch exception"); );
+ DebugMessage(DEBUG_DETECT, ", port mismatch exception");
}
else
{
/* if the exception flag is up, fail */
if (except_port_flag)
{
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT,
- ", port match exception, packet rejected\n"); );
+ DebugMessage(DEBUG_DETECT,
+ ", port match exception, packet rejected\n");
return 0;
}
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT, ", ports match"); );
+ DebugMessage(DEBUG_DETECT, ", ports match");
}
/* ports and address match */
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT, ", packet accepted!\n"); );
+ DebugMessage(DEBUG_DETECT, ", packet accepted!\n");
return 1;
}
int CheckBidirectional(Packet* p, RuleTreeNode* rtn_idx,
RuleFpList*, int check_ports)
{
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT, "Checking bidirectional rule...\n"); );
+ DebugMessage(DEBUG_DETECT, "Checking bidirectional rule...\n");
if (CheckAddrPort(rtn_idx->sip, CHECK_ADDR_SRC_ARGS(rtn_idx), p,
rtn_idx->flags, CHECK_SRC_IP | (check_ports ? CHECK_SRC_PORT : 0)))
{
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT, " Src->Src check passed\n"); );
+ DebugMessage(DEBUG_DETECT, " Src->Src check passed\n");
if (!CheckAddrPort(rtn_idx->dip, CHECK_ADDR_DST_ARGS(rtn_idx), p,
rtn_idx->flags, CHECK_DST_IP | (check_ports ? CHECK_DST_PORT : 0)))
{
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT,
- " Dst->Dst check failed,"
- " checking inverse combination\n"); );
+ DebugMessage(DEBUG_DETECT,
+ " Dst->Dst check failed, checking inverse combination\n");
if (CheckAddrPort(rtn_idx->dip, CHECK_ADDR_DST_ARGS(rtn_idx), p,
rtn_idx->flags, (CHECK_SRC_IP | INVERSE | (check_ports ? CHECK_SRC_PORT : 0))))
{
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT,
- " Inverse Dst->Src check passed\n"); );
+ DebugMessage(DEBUG_DETECT,
+ " Inverse Dst->Src check passed\n");
if (!CheckAddrPort(rtn_idx->sip, CHECK_ADDR_SRC_ARGS(rtn_idx), p,
rtn_idx->flags, (CHECK_DST_IP | INVERSE | (check_ports ? CHECK_DST_PORT : 0))))
{
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT,
- " Inverse Src->Dst check failed\n"); );
+ DebugMessage(DEBUG_DETECT,
+ " Inverse Src->Dst check failed\n");
return 0;
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT, "Inverse addr/port match\n"); );
+ DebugMessage(DEBUG_DETECT, "Inverse addr/port match\n");
}
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT, " Inverse Dst->Src check failed,"
- " trying next rule\n"); );
+ DebugMessage(DEBUG_DETECT, " Inverse Dst->Src check failed,"
+ " trying next rule\n");
return 0;
}
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT, "dest IP/port match\n"); );
+ DebugMessage(DEBUG_DETECT, "dest IP/port match\n");
}
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT,
- " Src->Src check failed, trying inverse test\n"); );
+ DebugMessage(DEBUG_DETECT,
+ " Src->Src check failed, trying inverse test\n");
if (CheckAddrPort(rtn_idx->dip, CHECK_ADDR_DST_ARGS(rtn_idx), p,
rtn_idx->flags, CHECK_SRC_IP | INVERSE | (check_ports ? CHECK_SRC_PORT : 0)))
{
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT,
- " Dst->Src check passed\n"); );
+ DebugMessage(DEBUG_DETECT,
+ " Dst->Src check passed\n");
if (!CheckAddrPort(rtn_idx->sip, CHECK_ADDR_SRC_ARGS(rtn_idx), p,
rtn_idx->flags, CHECK_DST_IP | INVERSE | (check_ports ? CHECK_DST_PORT : 0)))
{
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT,
- " Src->Dst check failed\n"); );
+ DebugMessage(DEBUG_DETECT,
+ " Src->Dst check failed\n");
return 0;
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT,
- "Inverse addr/port match\n"); );
+ DebugMessage(DEBUG_DETECT,
+ "Inverse addr/port match\n");
}
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT," Inverse test failed, "
- "testing next rule...\n"); );
+ DebugMessage(DEBUG_DETECT," Inverse test failed, "
+ "testing next rule...\n");
return 0;
}
}
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT," Bidirectional success!\n"); );
+ DebugMessage(DEBUG_DETECT," Bidirectional success!\n");
return 1;
}
***************************************************************************/
int CheckSrcIP(Packet* p, RuleTreeNode* rtn_idx, RuleFpList* fp_list, int check_ports)
{
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT,"CheckSrcIPEqual: "); );
+ DebugMessage(DEBUG_DETECT,"CheckSrcIPEqual: ");
if (!(rtn_idx->flags & EXCEPT_SRC_IP))
{
/* global exception flag is up, we can't match on *any*
* of the source addresses
*/
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT," global exception flag, \n"); );
+ DebugMessage(DEBUG_DETECT," global exception flag, \n");
if ( sfvar_ip_in(rtn_idx->sip, p->ptrs.ip_api.get_src()) )
return 0;
return fp_list->next->RuleHeadFunc(p, rtn_idx, fp_list->next, check_ports);
}
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT," Mismatch on SIP\n"); );
+ DebugMessage(DEBUG_DETECT," Mismatch on SIP\n");
return 0;
***************************************************************************/
int CheckDstIP(Packet* p, RuleTreeNode* rtn_idx, RuleFpList* fp_list, int check_ports)
{
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT, "CheckDstIPEqual: "); )
+ DebugMessage(DEBUG_DETECT, "CheckDstIPEqual: ");
if (!(rtn_idx->flags & EXCEPT_DST_IP))
{
{
/* global exception flag is up, we can't match on *any*
* of the source addresses */
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT," global exception flag, \n"); );
+ DebugMessage(DEBUG_DETECT," global exception flag, \n");
if ( sfvar_ip_in(rtn_idx->dip, p->ptrs.ip_api.get_dst()) )
return 0;
int CheckSrcPortEqual(Packet* p, RuleTreeNode* rtn_idx,
RuleFpList* fp_list, int check_ports)
{
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT,"CheckSrcPortEqual: "); );
+ DebugMessage(DEBUG_DETECT,"CheckSrcPortEqual: ");
/* Check if attributes provided match earlier */
if (check_ports == 0)
}
if ( PortObjectHasPort(rtn_idx->src_portobject,p->ptrs.sp) )
{
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT, " SP match!\n"); );
+ DebugMessage(DEBUG_DETECT, " SP match!\n");
return fp_list->next->RuleHeadFunc(p, rtn_idx, fp_list->next, check_ports);
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT, " SP mismatch!\n"); );
+ DebugMessage(DEBUG_DETECT, " SP mismatch!\n");
}
return 0;
int CheckSrcPortNotEq(Packet* p, RuleTreeNode* rtn_idx,
RuleFpList* fp_list, int check_ports)
{
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT,"CheckSrcPortNotEq: "); );
+ DebugMessage(DEBUG_DETECT,"CheckSrcPortNotEq: ");
/* Check if attributes provided match earlier */
if (check_ports == 0)
}
if ( !PortObjectHasPort(rtn_idx->src_portobject,p->ptrs.sp) )
{
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT, " !SP match!\n"); );
+ DebugMessage(DEBUG_DETECT, " !SP match!\n");
return fp_list->next->RuleHeadFunc(p, rtn_idx, fp_list->next, check_ports);
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT, " !SP mismatch!\n"); );
+ DebugMessage(DEBUG_DETECT, " !SP mismatch!\n");
}
return 0;
int CheckDstPortEqual(Packet* p, RuleTreeNode* rtn_idx,
RuleFpList* fp_list, int check_ports)
{
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT,"CheckDstPortEqual: "); );
+ DebugMessage(DEBUG_DETECT,"CheckDstPortEqual: ");
/* Check if attributes provided match earlier */
if (check_ports == 0)
}
if ( PortObjectHasPort(rtn_idx->dst_portobject,p->ptrs.dp) )
{
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT, " DP match!\n"); );
+ DebugMessage(DEBUG_DETECT, " DP match!\n");
return fp_list->next->RuleHeadFunc(p, rtn_idx, fp_list->next, check_ports);
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT," DP mismatch!\n"); );
+ DebugMessage(DEBUG_DETECT," DP mismatch!\n");
}
return 0;
}
int CheckDstPortNotEq(Packet* p, RuleTreeNode* rtn_idx,
RuleFpList* fp_list, int check_ports)
{
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT,"CheckDstPortNotEq: "); );
+ DebugMessage(DEBUG_DETECT,"CheckDstPortNotEq: ");
/* Check if attributes provided match earlier */
if (check_ports == 0)
}
if ( !PortObjectHasPort(rtn_idx->dst_portobject,p->ptrs.dp) )
{
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT, " !DP match!\n"); );
+ DebugMessage(DEBUG_DETECT, " !DP match!\n");
return fp_list->next->RuleHeadFunc(p, rtn_idx, fp_list->next, check_ports);
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT," !DP mismatch!\n"); );
+ DebugMessage(DEBUG_DETECT," !DP mismatch!\n");
}
return 0;
offset++;
DEBUG_WRAP(
- DebugMessage(DEBUG_DETECT, "%d%*s%*d 0x%x\n",
- level, indent - offset, option_type_str[node->option_type],
- 54 - indent, node->num_children,
- node->option_data);
+ DebugFormat(DEBUG_DETECT, "%d%*s%*d 0x%x\n",
+ level, indent - offset, option_type_str[node->option_type],
+ 54 - indent, node->num_children, node->option_data);
+
for (i=0; i<node->num_children; i++)
print_option_tree(node->children[i], level+1);
);
if (otn->sigInfo.num_services && check_ports)
{
/* none of the services match */
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT,
+ DebugFormat(DEBUG_DETECT,
"[**] SID %d not matched because of service mismatch (%d!=%d [**]\n",
otn->sigInfo.id,
eval_data->p->application_protocol_ordinal,
- otn->sigInfo.services[0].service_ordinal); );
+ otn->sigInfo.services[0].service_ordinal);
break; /* out of case */
}
}
/* FIXIT: maybe add a port test here ... */
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT, "[*] Rule Head %p\n", rtn); )
+ DebugFormat(DEBUG_DETECT, "[*] Rule Head %p\n", rtn);
if (!rtn->rule_func->RuleHeadFunc(p, rtn, rtn->rule_func, check_ports))
{
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT,
- " => Header check failed, checking next node\n"); );
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT,
- " => returned from next node check\n"); );
+ DebugMessage(DEBUG_DETECT,
+ " => Header check failed, checking next node\n");
+ DebugMessage(DEBUG_DETECT,
+ " => returned from next node check\n");
MODULE_PROFILE_END(ruleRTNEvalPerfStats);
return 0;
}
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT,
- "^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n"); );
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT, " => RTN %p Matched!\n", rtn); );
- DEBUG_WRAP(DebugMessage(DEBUG_DETECT,
- "vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv\n"); );
+ DebugMessage(DEBUG_DETECT,
+ "^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n");
+ DebugFormat(DEBUG_DETECT, " => RTN %p Matched!\n", rtn);
+ DebugMessage(DEBUG_DETECT,
+ "vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv\n");
/*
** Return that there is a rule match and log the event outside
** of this routine.
if ( !prmFindRuleGroupTcp(snort_conf->prmTcpRTNX, p->ptrs.dp, p->ptrs.sp, &src, &dst, &any) )
return;
- DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE,
- "fpEvalHeaderTcp: sport=%d, "
- "dport=%d, src:%x, dst:%x, any:%x\n",p->ptrs.sp,p->ptrs.dp,src,dst,any); );
+ DebugFormat(DEBUG_ATTRIBUTE,
+ "fpEvalHeaderTcp: sport=%d, dport=%d, src:%x, dst:%x, any:%x\n",
+ p->ptrs.sp,p->ptrs.dp,src,dst,any);
if ( dst )
fpEvalHeaderSW(dst, p, 1, 0, 0, omd);
if ( !prmFindRuleGroupUdp(snort_conf->prmUdpRTNX, p->ptrs.dp, p->ptrs.sp, &src, &dst, &any) )
return;
- DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE,
- "fpEvalHeaderUdp: sport=%d, dport=%d, "
- "src:%x, dst:%x, any:%x\n",p->ptrs.sp,p->ptrs.dp,src,dst,any); );
+ DebugFormat(DEBUG_ATTRIBUTE,
+ "fpEvalHeaderUdp: sport=%d, dport=%d, src:%x, dst:%x, any:%x\n",
+ p->ptrs.sp,p->ptrs.dp,src,dst,any);
if ( dst )
fpEvalHeaderSW(dst, p, 1, 0, 0, omd) ;
int16_t proto_ordinal = p->flow ? p->flow->ssn_state.application_protocol : 0;
- DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, "proto_ordinal=%d\n", proto_ordinal); );
+ DebugFormat(DEBUG_ATTRIBUTE, "proto_ordinal=%d\n", proto_ordinal);
if (proto_ordinal > 0)
{
if (p->packet_flags & PKT_FROM_SERVER) /* to cli */
{
- DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, "pkt_from_server\n"); );
+ DebugMessage(DEBUG_ATTRIBUTE, "pkt_from_server\n");
svc = snort_conf->sopgTable->get_port_group(proto, false, proto_ordinal);
file = snort_conf->sopgTable->get_port_group(proto, false, SNORT_PROTO_FILE);
if (p->packet_flags & PKT_FROM_CLIENT) /* to srv */
{
- DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, "pkt_from_client\n"); );
+ DebugMessage(DEBUG_ATTRIBUTE, "pkt_from_client\n");
svc = snort_conf->sopgTable->get_port_group(proto, true, proto_ordinal);
file = snort_conf->sopgTable->get_port_group(proto, true, SNORT_PROTO_FILE);
}
- DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE,
+ DebugFormat(DEBUG_ATTRIBUTE,
"fpEvalHeaderSvc:targetbased-ordinal-lookup: "
"sport=%d, dport=%d, proto_ordinal=%d, proto=%d, src:%x, "
- "file:%x\n",p->ptrs.sp,p->ptrs.dp,proto_ordinal,proto,svc,file); );
+ "file:%x\n",p->ptrs.sp,p->ptrs.dp,proto_ordinal,proto,svc,file);
}
// FIXIT-P put alert service rules with file data fp in alert file group and
// verfiy ports and service during rule eval to avoid searching file data 2x.
static void TagSession(Packet* p, TagData* tag, uint32_t time, uint16_t event_id, void* log_list)
{
- DEBUG_WRAP(DebugMessage(DEBUG_FLOW, "TAGGING SESSION\n"); );
+ DebugMessage(DEBUG_FLOW, "TAGGING SESSION\n");
AddTagNode(p, tag, TAG_SESSION, time, event_id, log_list);
}
{
int mode;
- DEBUG_WRAP(DebugMessage(DEBUG_FLOW, "TAGGING HOST\n"); );
+ DebugMessage(DEBUG_FLOW, "TAGGING HOST\n");
switch (tag->tag_direction)
{
TagNode* returned;
SFXHASH* tag_cache_ptr = NULL;
- DEBUG_WRAP(DebugMessage(DEBUG_FLOW, "Adding new Tag Head\n"); );
+ DebugMessage(DEBUG_FLOW, "Adding new Tag Head\n");
if ( tag->tag_metric & TAG_METRIC_SESSION )
{
}
if (mode == TAG_SESSION)
{
- DEBUG_WRAP(DebugMessage(DEBUG_FLOW,"Session Tag!\n"); );
+ DebugMessage(DEBUG_FLOW,"Session Tag!\n");
tag_cache_ptr = ssn_tag_cache_ptr;
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_FLOW,"Host Tag!\n"); );
+ DebugMessage(DEBUG_FLOW,"Host Tag!\n");
tag_cache_ptr = host_tag_cache_ptr;
}
idx = TagAlloc(tag_cache_ptr);
if (returned == NULL)
{
- DEBUG_WRAP(DebugMessage(DEBUG_FLOW,"Looking the other way!!\n"); );
+ DebugMessage(DEBUG_FLOW,"Looking the other way!!\n");
SwapTag(idx);
returned = (TagNode*)sfxhash_find(tag_cache_ptr, idx);
SwapTag(idx);
if (returned == NULL)
{
- DEBUG_WRAP(DebugMessage(DEBUG_FLOW,"Inserting a New Tag!\n"); );
+ DebugMessage(DEBUG_FLOW,"Inserting a New Tag!\n");
/* if we're supposed to be tagging the other side, swap it
around -- Lawrence Reed */
if (sfxhash_add(tag_cache_ptr, idx, idx) != SFXHASH_OK)
{
- DEBUG_WRAP(DebugMessage(DEBUG_FLOW,
+ DebugMessage(DEBUG_FLOW,
"sfxhash_add failed, that's going to "
- "make life difficult\n"); );
+ "make life difficult\n");
TagFree(tag_cache_ptr, idx);
return;
}
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_FLOW,"Existing Tag found!\n"); );
+ DebugMessage(DEBUG_FLOW,"Existing Tag found!\n");
if (idx->metric & TAG_METRIC_SECONDS)
returned->seconds = idx->seconds;
if(p == NULL || !p->ptrs.ip_api.is_ip())
{
- DEBUG_WRAP(DebugMessage(DEBUG_FLOW, "bailing from CheckTagList, p->iph == NULL\n"); );
+ DebugMessage(DEBUG_FLOW, "bailing from CheckTagList, p->iph == NULL\n");
return 0;
}
- DEBUG_WRAP(DebugMessage(DEBUG_FLOW,"Host Tags Active: %d Session Tags Active: %d\n",
- sfxhash_count(host_tag_cache_ptr), sfxhash_count(ssn_tag_cache_ptr)); );
+ DebugFormat(DEBUG_FLOW,"Host Tags Active: %d Session Tags Active: %d\n",
+ sfxhash_count(host_tag_cache_ptr), sfxhash_count(ssn_tag_cache_ptr));
- DEBUG_WRAP(DebugMessage(DEBUG_FLOW, "[*] Checking session tag list (forward)...\n"); );
+ DebugMessage(DEBUG_FLOW, "[*] Checking session tag list (forward)...\n");
sfip_copy(idx.key.sip, p->ptrs.ip_api.get_src());
sfip_copy(idx.key.dip, p->ptrs.ip_api.get_dst());
idx.key.dp = p->ptrs.sp;
idx.key.sp = p->ptrs.dp;
- DEBUG_WRAP(DebugMessage(DEBUG_FLOW, " Checking session tag list (reverse)...\n"); );
+ DebugMessage(DEBUG_FLOW, " Checking session tag list (reverse)...\n");
returned = (TagNode*)sfxhash_find(ssn_tag_cache_ptr, &idx);
if (returned == NULL)
{
- DEBUG_WRAP(DebugMessage(DEBUG_FLOW, " Checking host tag list "
- "(forward)...\n"); );
+ DebugMessage(DEBUG_FLOW, " Checking host tag list "
+ "(forward)...\n");
returned = (TagNode*)sfxhash_find(host_tag_cache_ptr, &idx);
if (returned != NULL)
{
- DEBUG_WRAP(DebugMessage(DEBUG_FLOW," [*!*] Found host node\n"); );
+ DebugMessage(DEBUG_FLOW," [*!*] Found host node\n");
taglist = host_tag_cache_ptr;
}
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_FLOW," [*!*] Found session node\n"); );
+ DebugMessage(DEBUG_FLOW," [*!*] Found session node\n");
taglist = ssn_tag_cache_ptr;
}
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_FLOW," [*!*] Found session node\n"); );
+ DebugMessage(DEBUG_FLOW," [*!*] Found session node\n");
taglist = ssn_tag_cache_ptr;
}
if (returned != NULL)
{
- DEBUG_WRAP(DebugMessage(DEBUG_FLOW, " ! Found tag node !\n"); );
+ DebugMessage(DEBUG_FLOW, " ! Found tag node !\n");
returned->last_access = p->pkth->ts.tv_sec;
returned->pkt_count++;
if ( !returned->metric )
{
- DEBUG_WRAP(DebugMessage(DEBUG_FLOW,
- " Prune condition met for tag, removing from list\n"); );
+ DebugMessage(DEBUG_FLOW,
+ " Prune condition met for tag, removing from list\n");
if (sfxhash_remove(taglist, returned) != SFXHASH_OK)
{
if ( (u_int)(p->pkth->ts.tv_sec) > last_prune_time + TAG_PRUNE_QUANTUM )
{
- DEBUG_WRAP(DebugMessage(DEBUG_FLOW,
- "Exceeded Prune Quantum, pruning tag trees\n"); );
+ DebugMessage(DEBUG_FLOW,
+ "Exceeded Prune Quantum, pruning tag trees\n");
PruneTagCache(p->pkth->ts.tv_sec, 0);
last_prune_time = p->pkth->ts.tv_sec;
}
void SetTags(Packet* p, OptTreeNode* otn, uint16_t event_id)
{
- DEBUG_WRAP(DebugMessage(DEBUG_FLOW, "Setting tags\n"); );
+ DebugMessage(DEBUG_FLOW, "Setting tags\n");
if (otn != NULL && otn->tag != NULL)
{
switch (otn->tag->tag_type)
{
case TAG_SESSION:
- DEBUG_WRAP(DebugMessage(DEBUG_FLOW,"Setting session tag:\n");
- DebugMessage(DEBUG_FLOW,"SIP: %s SP: %d ",
+ DebugMessage(DEBUG_FLOW,"Setting session tag:\n");
+ DebugFormat(DEBUG_FLOW,"SIP: %s SP: %d ",
sfip_ntoa(p->ptrs.ip_api.get_src()), p->ptrs.sp);
- DebugMessage(DEBUG_FLOW,"DIP: %s DP: %d\n",
- sfip_ntoa(p->ptrs.ip_api.get_dst()),p->ptrs.dp); );
+ DebugFormat(DEBUG_FLOW,"DIP: %s DP: %d\n",
+ sfip_ntoa(p->ptrs.ip_api.get_dst()),p->ptrs.dp);
TagSession(p, otn->tag, p->pkth->ts.tv_sec, event_id, log_list);
break;
case TAG_HOST:
- DEBUG_WRAP(DebugMessage(DEBUG_FLOW,"Setting host tag:\n");
- DebugMessage(DEBUG_FLOW,"SIP: %s SP: %d ",
+ DebugMessage(DEBUG_FLOW,"Setting host tag:\n");
+ DebugFormat(DEBUG_FLOW,"SIP: %s SP: %d ",
sfip_ntoa(p->ptrs.ip_api.get_src()),p->ptrs.sp);
- DebugMessage(DEBUG_FLOW, "DIP: %s DP: %d\n",
- sfip_ntoa(p->ptrs.ip_api.get_dst()),p->ptrs.dp); );
+ DebugFormat(DEBUG_FLOW, "DIP: %s DP: %d\n",
+ sfip_ntoa(p->ptrs.ip_api.get_dst()),p->ptrs.dp);
TagHost(p, otn->tag, p->pkth->ts.tv_sec, event_id, log_list);
break;
{
OptFpList* ofp = (OptFpList*)SnortAlloc(sizeof(OptFpList));
- DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"Adding new rule to list\n"); );
+ DebugMessage(DEBUG_CONFIGRULES,"Adding new rule to list\n");
/* if there are no nodes on the function list... */
if (otn->opt_func == NULL)
tmp->next = ofp;
}
- DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"Set OptTestFunc to %p\n", ro_eval_func); );
+ DebugFormat(DEBUG_CONFIGRULES,"Set OptTestFunc to %p\n", ro_eval_func);
ofp->OptTestFunc = ro_eval_func;
FileMemPool* file_mempool = NULL;
File_Capture_Stats file_capture_stats;
-/*
- * Verify file capture information and file context information matched
- * This is used for debug purpose
- */
+#ifdef DEBUG_MSGS
+// verify file capture information and file context information matched
-#ifdef DEBUG
-static void verify_file_capture_info(FileContext* context,
- FileCaptureInfo* fileInfo)
+static void verify_file_capture_info(
+ FileContext* context, FileCaptureInfo* fileInfo)
{
/* file capture length should be one of two possible values */
if (context->processed_bytes)
}
}
-static void verifiy_file_capture(FileContext* context,
- FileCaptureInfo* fileInfo)
+static void verifiy_file_capture(
+ FileContext* context, FileCaptureInfo* fileInfo)
{
SHA256CONTEXT sha_ctx;
uint8_t* buff;
}
}
}
-
#endif
/*
fileInfo->file_size += data_size;
- DEBUG_WRAP(verify_file_capture_info(context, fileInfo); )
+ DEBUG_WRAP(verify_file_capture_info(context, fileInfo); );
return 0;
}
#define FREE_MAGIC 0x2525252525252525
typedef uint64_t MagicType;
-#ifdef DEBUG
+#ifdef DEBUG_MSGS
static inline void file_mempool_verify(FileMemPool* mempool)
{
uint64_t free_size;
__FILE__, __LINE__);
}
}
-
#endif
static inline void file_mempool_free_pools(FileMemPool* mempool)
#ifdef DEBUG_MSGS
if (mime_ssn->data_state == STATE_DATA_HEADER)
{
- DEBUG_WRAP(DebugMessage(DEBUG_FILE, "DATA HEADER STATE ~~~~~~~~~~~~~~~~~~~~~~\n"); );
+ DebugMessage(DEBUG_FILE, "DATA HEADER STATE ~~~~~~~~~~~~~~~~~~~~~~\n");
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_FILE, "DATA UNKNOWN STATE ~~~~~~~~~~~~~~~~~~~~~\n"); );
+ DebugMessage(DEBUG_FILE, "DATA UNKNOWN STATE ~~~~~~~~~~~~~~~~~~~~~\n");
}
#endif
switch (mime_ssn->data_state)
{
case STATE_MIME_HEADER:
- DEBUG_WRAP(DebugMessage(DEBUG_FILE, "MIME HEADER STATE ~~~~~~~~~~~~~~~~~~~~~~\n"); );
+ DebugMessage(DEBUG_FILE, "MIME HEADER STATE ~~~~~~~~~~~~~~~~~~~~~~\n");
start = process_mime_header(start, end, mime_ssn);
break;
case STATE_DATA_BODY:
- DEBUG_WRAP(DebugMessage(DEBUG_FILE, "DATA BODY STATE ~~~~~~~~~~~~~~~~~~~~~~~~\n"); );
+ DebugMessage(DEBUG_FILE, "DATA BODY STATE ~~~~~~~~~~~~~~~~~~~~~~~~\n");
start = process_mime_body(start, end, mime_ssn, isFileEnd(position) );
break;
}
if (store_boundary(data_info, data))
{
/* End of boundary, move to MIME_PAF_FOUND_BOUNDARY_STATE*/
- DEBUG_WRAP(DebugMessage(DEBUG_FILE, "Create boudary string: %s\n",
- data_info->boundary); );
+ DebugFormat(DEBUG_FILE, "Create boudary string: %s\n",
+ data_info->boundary);
data_info->data_state = MIME_PAF_FOUND_BOUNDARY_STATE;
}
if (check_boundary(data_info, data))
{
/* End of boundary, move to MIME_PAF_FOUND_BOUNDARY_STATE*/
- DEBUG_WRAP(DebugMessage(DEBUG_FILE, "Found Boudary string: %s\n",
- data_info->boundary); );
+ DebugFormat(DEBUG_FILE, "Found Boudary string: %s\n",
+ data_info->boundary);
return 1;
}
break;
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_FILE, "Adding file node\n"); );
+ DebugMessage(DEBUG_FILE, "Adding file node\n");
updateFileNode(&new_node, verdict, file_type_id, signature);
* for key. This means bigger problems, but fail
* gracefully.
*/
- DEBUG_WRAP(DebugMessage(DEBUG_FILE,
- "Failed to add file node to hash table\n"); );
+ DebugMessage(DEBUG_FILE,
+ "Failed to add file node to hash table\n");
return -1;
}
}
/* No hash table, or its empty? Get out of dodge. */
if ((!fileHash) || (!sfxhash_count(fileHash)))
{
- DEBUG_WRAP(DebugMessage(DEBUG_FILE, "No expected sessions\n"); );
+ DebugMessage(DEBUG_FILE, "No expected sessions\n");
return verdict;
}
srcIP = p->ptrs.ip_api.get_src();
if (node)
{
- DEBUG_WRAP(DebugMessage(DEBUG_FILE, "Found resumed file\n"); );
+ DebugMessage(DEBUG_FILE, "Found resumed file\n");
if (node->expires && p->pkth->ts.tv_sec > node->expires)
{
- DEBUG_WRAP(DebugMessage(DEBUG_FILE, "File expired\n"); );
+ DebugMessage(DEBUG_FILE, "File expired\n");
sfxhash_free_node(fileHash, hash_node);
return verdict;
}
uint32_t flags = stream.get_session_flags((Flow*)ssn);
if (flags & SSNFLAG_MIDSTREAM)
{
- DEBUG_WRAP(DebugMessage(DEBUG_FILE,
- "Aborting PAF because of midstream pickup.\n"));
+ DebugMessage(DEBUG_FILE,
+ "Aborting PAF because of midstream pickup.\n");
return true;
}
else if (!(flags & SSNFLAG_ESTABLISHED))
{
- DEBUG_WRAP(DebugMessage(DEBUG_FILE,
- "Aborting PAF because of unestablished session.\n"));
+ DebugMessage(DEBUG_FILE,
+ "Aborting PAF because of unestablished session.\n");
return true;
}
return false;
extern FileStats file_stats;
-#define FILE_DEBUG_MSGS(msg) DEBUG_WRAP(DebugMessage(DEBUG_FILE, msg); )
+#define FILE_DEBUG_MSGS(msg) DebugMessage(DEBUG_FILE, msg)
void printFileContext(FileContext* context);
else if ((flow->last_data_seen + config.pruning_timeout) < thetime)
{
- DEBUG_WRAP(DebugMessage(DEBUG_STREAM, "pruning stale flow\n"); );
+ DebugMessage(DEBUG_STREAM, "pruning stale flow\n");
flow->ssn_state.session_flags |= SSNFLAG_TIMEDOUT;
release(flow, "stale/timeout");
pruned++;
flowExaminedCount++;
- DEBUG_WRAP(DebugMessage(DEBUG_STREAM, "retiring stale flow\n"); );
+ DebugMessage(DEBUG_STREAM, "retiring stale flow\n");
flow->ssn_state.session_flags |= SSNFLAG_TIMEDOUT;
release(flow, "stale/timeout");
if ( ignore )
{
- DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ DebugFormat(DEBUG_STREAM_STATE,
"Stream: Ignoring packet from %d. Marking flow marked as ignore.\n",
- p->packet_flags & PKT_FROM_CLIENT ? "sender" : "responder"); );
+ p->packet_flags & PKT_FROM_CLIENT ? "sender" : "responder");
flow->ssn_state.ignore_direction = ignore;
DisableInspection(p);
/*
* FILE: sha2.c
* AUTHOR: Aaron D. Gifford - http://www.aarongifford.com/
- *
+ *
* Copyright (c) 2000-2001, Aaron D. Gifford
* All rights reserved.
*
* 3. Neither the name of the copyright holder nor the names of contributors
* may be used to endorse or promote products derived from this software
* without specific prior written permission.
- *
+ *
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTOR(S) ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
*
* And for little-endian machines, add:
*
- * #define BYTE_ORDER LITTLE_ENDIAN
+ * #define BYTE_ORDER LITTLE_ENDIAN
*
* Or for big-endian machines:
*
s1 = sigma1_256(s1);
/* Apply the SHA-256 compression function to update a..h */
- T1 = h + Sigma1_256(e) + Ch(e, f, g) + K256[j] +
+ T1 = h + Sigma1_256(e) + Ch(e, f, g) + K256[j] +
(W256[j&0x0f] += s1 + W256[(j+9)&0x0f] + s0);
T2 = Sigma0_256(a) + Maj(a, b, c);
h = g;
case REL_OFFSET:
if (!rel_ptr)
{
- DEBUG_WRAP(DebugMessage(DEBUG_ASN1, "[*] No rel_ptr for "
- "relative offset, so we are bailing.\n"); );
+ DebugMessage(DEBUG_ASN1, "[*] No rel_ptr for "
+ "relative offset, so we are bailing.\n");
return 0;
}
*/
if (!inBounds(start, end + 1, rel_ptr))
{
- DEBUG_WRAP(DebugMessage(DEBUG_ASN1, "[*] ASN.1 bounds "
- "check failed for rel_ptr.\n"); );
+ DebugMessage(DEBUG_ASN1, "[*] ASN.1 bounds "
+ "check failed for rel_ptr.\n");
return 0;
}
if (!inBounds(start, end, offset))
{
- DEBUG_WRAP(DebugMessage(DEBUG_ASN1, "[*] ASN.1 bounds "
- "check failed rel_ptr+offset.\n"); );
+ DebugMessage(DEBUG_ASN1, "[*] ASN.1 bounds "
+ "check failed rel_ptr+offset.\n");
return 0;
}
if (!inBounds(start, end, offset))
{
- DEBUG_WRAP(DebugMessage(DEBUG_ASN1, "[*] ASN.1 bounds "
- "check failed.\n"); );
+ DebugMessage(DEBUG_ASN1, "[*] ASN.1 bounds "
+ "check failed.\n");
return 0;
}
iRet = asn1_decode(offset, size, &asn1);
if (iRet && !asn1)
{
- DEBUG_WRAP(DebugMessage(DEBUG_ASN1, "[*] ASN.1 decode failed "
- "miserably.\n"); );
+ DebugMessage(DEBUG_ASN1, "[*] ASN.1 decode failed "
+ "miserably.\n");
return 0;
}
if ( payload_bytes_grabbed < 0 )
{
- DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH,
- "String Extraction Failed\n"); );
+ DebugMessage(DEBUG_PATTERN_MATCH,
+ "String Extraction Failed\n");
MODULE_PROFILE_END(byteTestPerfStats);
return rval;
}
}
- DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH,
+ DebugFormat(DEBUG_PATTERN_MATCH,
"Grabbed %d bytes at offset %d, value = 0x%08X(%u)\n",
- payload_bytes_grabbed, btd->offset, value, value); );
+ payload_bytes_grabbed, btd->offset, value, value);
switch (btd->opcode)
{
if (btd->not_flag)
{
- DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH,
- "checking for not success...flag\n"); );
+ DebugMessage(DEBUG_PATTERN_MATCH,
+ "checking for not success...flag\n");
if (!success)
{
rval = DETECTION_OPTION_MATCH;
PROFILE_VARS;
MODULE_PROFILE_START(contentPerfStats);
- DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH, "CheckPatternANDMatch: "); );
+ DebugMessage(DEBUG_PATTERN_MATCH, "CheckPatternANDMatch: ");
found = uniSearchReal(idx, c);
if ( found )
{
rval = DETECTION_OPTION_MATCH;
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "Pattern match found\n"); );
+ DebugMessage(DEBUG_PATTERN_MATCH, "Pattern match found\n");
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "Pattern match failed\n"); );
+ DebugMessage(DEBUG_PATTERN_MATCH, "Pattern match failed\n");
}
MODULE_PROFILE_END(contentPerfStats);
}
}
- DEBUG_WRAP(DebugMessage(DEBUG_PARSER, "Pattern offset = %d\n",
- pmd->offset); );
+ DebugFormat(DEBUG_PARSER, "Pattern offset = %d\n", pmd->offset);
}
static void parse_depth(PatternMatchData* pmd, const char* data)
}
}
- DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH, "Pattern depth = %d\n",
- pmd->depth); );
+ DebugFormat(DEBUG_PATTERN_MATCH, "Pattern depth = %d\n", pmd->depth);
}
static void parse_distance(PatternMatchData* pmd, const char* data)
}
}
- DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH, "Pattern within = %d\n",
- pmd->depth); );
+ DebugFormat(DEBUG_PATTERN_MATCH, "Pattern within = %d\n", pmd->depth);
pmd->relative = 1;
}
return rval;
}
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "CVS begin detection\n"); );
+ DebugMessage(DEBUG_IPS_OPTION, "CVS begin detection\n");
int ret = CvsDecode(p->data, p->dsize, cvs_rule_option);
if (command.cmd_str == NULL)
return CVS_NO_ALERT;
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "CVS command\n"
+ DebugFormat(DEBUG_IPS_OPTION, "CVS command\n"
" comand: %.*s\n"
"argument: %.*s\n",
command.cmd_str_len, (char*)command.cmd_str,
command.cmd_arg == NULL ? 4 : command.cmd_arg_len,
- command.cmd_arg == NULL ? "none" : (char*)command.cmd_arg); );
+ command.cmd_arg == NULL ? "none" : (char*)command.cmd_arg);
switch (cvs_rule_option->type)
{
tcp_flags = p->ptrs.tcph->th_flags & (0xFF ^ flagptr->tcp_mask);
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, " <!!> CheckTcpFlags: "); );
+ DebugMessage(DEBUG_IPS_OPTION, " <!!> CheckTcpFlags: ");
switch ((flagptr->mode))
{
case M_NORMAL:
if (flagptr->tcp_flags == tcp_flags) /* only these set */
{
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"Got TCP [default] flag match!\n"); );
+ DebugMessage(DEBUG_IPS_OPTION,"Got TCP [default] flag match!\n");
rval = DETECTION_OPTION_MATCH;
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"No match\n"); );
+ DebugMessage(DEBUG_IPS_OPTION,"No match\n");
}
break;
/* all set */
if ((flagptr->tcp_flags & tcp_flags) == flagptr->tcp_flags)
{
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "Got TCP [ALL] flag match!\n"); );
+ DebugMessage(DEBUG_IPS_OPTION, "Got TCP [ALL] flag match!\n");
rval = DETECTION_OPTION_MATCH;
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"No match\n"); );
+ DebugMessage(DEBUG_IPS_OPTION,"No match\n");
}
break;
case M_NOT:
if ((flagptr->tcp_flags & tcp_flags) == 0) /* none set */
{
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"Got TCP [NOT] flag match!\n"); );
+ DebugMessage(DEBUG_IPS_OPTION,"Got TCP [NOT] flag match!\n");
rval = DETECTION_OPTION_MATCH;
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "No match\n"); );
+ DebugMessage(DEBUG_IPS_OPTION, "No match\n");
}
break;
case M_ANY:
if ((flagptr->tcp_flags & tcp_flags) != 0) /* something set */
{
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"Got TCP [ANY] flag match!\n"); );
+ DebugMessage(DEBUG_IPS_OPTION,"Got TCP [ANY] flag match!\n");
rval = DETECTION_OPTION_MATCH;
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"No match\n"); );
+ DebugMessage(DEBUG_IPS_OPTION,"No match\n");
}
break;
default: /* Should never see this */
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "TCP flag check went to default case"
- " for some silly reason\n"); );
+ DebugMessage(DEBUG_IPS_OPTION, "TCP flag check went to default case"
+ " for some silly reason\n");
break;
}
bitop = stream.get_flow_bitop(p);
if (!bitop)
{
- DEBUG_WRAP(DebugMessage(DEBUG_FLOWBITS, "No FLOWBITS_DATA"); );
+ DebugMessage(DEBUG_FLOWBITS, "No FLOWBITS_DATA");
return rval;
}
return;
}
- DEBUG_WRAP(DebugMessage(DEBUG_FLOWBITS, "flowbits tag id parsing %s\n",flowbits_names); );
+ DebugFormat(DEBUG_FLOWBITS, "flowbits tag id parsing %s\n",flowbits_names);
flowbits_name = SnortStrdup(flowbits_names);
{
int i;
- DebugMessage(DEBUG_FLOWBITS,"flowbits: type = %d\n",flowbits->type);
- DebugMessage(DEBUG_FLOWBITS,"flowbits: name = %s\n",flowbits->name);
- DebugMessage(DEBUG_FLOWBITS,"flowbits: eval = %d\n",flowbits->eval);
- DebugMessage(DEBUG_FLOWBITS,"flowbits: num_ids = %d\n",flowbits->num_ids);
- DebugMessage(DEBUG_FLOWBITS,"flowbits: grp_id = %d\n",flowbits->group_id);
- DebugMessage(DEBUG_FLOWBITS,"flowbits: group_name = %s\n",flowbits->group);
+ DebugFormat(DEBUG_FLOWBITS,"flowbits: type = %d\n",flowbits->type);
+ DebugFormat(DEBUG_FLOWBITS,"flowbits: name = %s\n",flowbits->name);
+ DebugFormat(DEBUG_FLOWBITS,"flowbits: eval = %d\n",flowbits->eval);
+ DebugFormat(DEBUG_FLOWBITS,"flowbits: num_ids = %d\n",flowbits->num_ids);
+ DebugFormat(DEBUG_FLOWBITS,"flowbits: grp_id = %d\n",flowbits->group_id);
+ DebugFormat(DEBUG_FLOWBITS,"flowbits: group_name = %s\n",flowbits->group);
for (i = 0; i < flowbits->num_ids; i++)
{
- DebugMessage(DEBUG_FLOWBITS,"flowbits: value = %d\n",flowbits->ids[i]);
+ DebugFormat(DEBUG_FLOWBITS,"flowbits: value = %d\n",flowbits->ids[i]);
}
}
const uint16_t frag_offset = p->ptrs.ip_api.off_w_flags();
MODULE_PROFILE_START(fragBitsPerfStats);
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, " <!!> CheckFragBits: ");
- DebugMessage(DEBUG_PLUGIN, "[rule: 0x%X:%d pkt: 0x%X] ",
- fb->frag_bits, fb->mode, frag_offset & bitmask); );
+ DebugMessage(DEBUG_IPS_OPTION, " <!!> CheckFragBits: ");
+ DebugFormat(DEBUG_IPS_OPTION, "[rule: 0x%X:%d pkt: 0x%X] ",
+ fb->frag_bits, fb->mode, frag_offset & bitmask);
switch (fb->mode)
{
/* check if the rule bits match the bits in the packet */
if (fb->frag_bits == (frag_offset & bitmask))
{
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"Got Normal bits match\n"); );
+ DebugMessage(DEBUG_IPS_OPTION,"Got Normal bits match\n");
rval = DETECTION_OPTION_MATCH;
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"Normal test failed\n"); );
+ DebugMessage(DEBUG_IPS_OPTION,"Normal test failed\n");
}
break;
/* check if the rule bits don't match the bits in the packet */
if ((fb->frag_bits & (frag_offset & bitmask)) == 0)
{
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"Got NOT bits match\n"); );
+ DebugMessage(DEBUG_IPS_OPTION,"Got NOT bits match\n");
rval = DETECTION_OPTION_MATCH;
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"NOT test failed\n"); );
+ DebugMessage(DEBUG_IPS_OPTION,"NOT test failed\n");
}
break;
/* check if the rule bits are present in the packet */
if ((fb->frag_bits & (frag_offset & bitmask)) == fb->frag_bits)
{
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"Got ALL bits match\n"); );
+ DebugMessage(DEBUG_IPS_OPTION,"Got ALL bits match\n");
rval = DETECTION_OPTION_MATCH;
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"ALL test failed\n"); );
+ DebugMessage(DEBUG_IPS_OPTION,"ALL test failed\n");
}
break;
/* check if any of the rule bits match the bits in the packet */
if ((fb->frag_bits & (frag_offset & bitmask)) != 0)
{
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"Got ANY bits match\n"); );
+ DebugMessage(DEBUG_IPS_OPTION,"Got ANY bits match\n");
rval = DETECTION_OPTION_MATCH;
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"ANY test failed\n"); );
+ DebugMessage(DEBUG_IPS_OPTION,"ANY test failed\n");
}
break;
default:
if (!p->has_ip())
{
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"Not IP\n"); );
+ DebugMessage(DEBUG_IPS_OPTION,"Not IP\n");
return rval;
}
int rval = DETECTION_OPTION_NO_MATCH;
PROFILE_VARS;
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "CheckIpOptions:"); );
+ DebugMessage(DEBUG_IPS_OPTION, "CheckIpOptions:");
if (!p->ptrs.ip_api.is_ip4())
return rval; /* if error occured while ip header
* was processed, return 0 automatically. */
if ((ipOptionData->any_flag == 1) && (option_len > 0))
{
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "Matched any ip options!\n"); );
+ DebugMessage(DEBUG_IPS_OPTION, "Matched any ip options!\n");
rval = DETECTION_OPTION_MATCH;
MODULE_PROFILE_END(ipOptionPerfStats);
return rval;
ip::IpOptionIterator iter(ip4h, p);
for ( const ip::IpOptions& opt : iter)
{
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "testing pkt(%d):rule(%d)\n",
+ DebugFormat(DEBUG_IPS_OPTION, "testing pkt(%d):rule(%d)\n",
ipOptionData->ip_option,
- static_cast<int>(opt.code)); );
+ static_cast<int>(opt.code));
if (ipOptionData->ip_option == opt.code)
{
if (inBounds(c.buffer(), c.endo(), start_ptr))
{
- DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH,
- "[*] IsDataAt succeeded! there is data...\n"); );
+ DebugMessage(DEBUG_PATTERN_MATCH,
+ "[*] IsDataAt succeeded! there is data...\n");
rval = DETECTION_OPTION_MATCH;
}
}
/* now compile the re */
- DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH, "pcre: compiling %s\n", re); );
+ DebugFormat(DEBUG_PATTERN_MATCH, "pcre: compiling %s\n", re);
pcre_data->re = pcre_compile(re, compile_flags, &error, &erroffset, NULL);
if (pcre_data->re == NULL)
|| len <= 0
|| found_offset == NULL)
{
- DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH,
- "Returning 0 because we didn't have the required parameters!\n"); );
+ DebugMessage(DEBUG_PATTERN_MATCH,
+ "Returning 0 because we didn't have the required parameters!\n");
return false;
}
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH, "pcre_exec error : %d \n", result); );
+ DebugFormat(DEBUG_PATTERN_MATCH, "pcre_exec error : %d \n", result);
return false;
}
/* Fail if the packet is too short to match */
if (p->dsize<28)
{
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "RPC packet too small"); );
+ DebugMessage(DEBUG_IPS_OPTION, "RPC packet too small");
MODULE_PROFILE_END(rpcCheckPerfStats);
return rval;
}
Fail if the packet is too short to match */
if (p->dsize<24)
{
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "RPC packet too small"); );
+ DebugMessage(DEBUG_IPS_OPTION, "RPC packet too small");
MODULE_PROFILE_END(rpcCheckPerfStats);
return rval;
}
}
#ifdef DEBUG_MSGS
- DebugMessage(DEBUG_PLUGIN,"<---xid---> <---dir---> <---rpc--->"
+ DebugMessage(DEBUG_IPS_OPTION,"<---xid---> <---dir---> <---rpc--->"
" <---prog--> <---vers--> <---proc-->\n");
for (i=0; i<24; i++)
{
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "%02X ",c[i]); );
+ DebugFormat(DEBUG_IPS_OPTION, "%02X ",c[i]);
}
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"\n"); );
+ DebugMessage(DEBUG_IPS_OPTION,"\n");
#endif
/* Read xid */
/* We only look at calls */
if (direction != CALL)
{
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "RPC packet not a call"); );
+ DebugMessage(DEBUG_IPS_OPTION, "RPC packet not a call");
MODULE_PROFILE_END(rpcCheckPerfStats);
return rval;
}
/* Fail if it is not right */
if (rpcvers != RPC_MSG_VERSION)
{
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"RPC msg version invalid"); );
+ DebugMessage(DEBUG_IPS_OPTION,"RPC msg version invalid");
MODULE_PROFILE_END(rpcCheckPerfStats);
return rval;
}
vers = IXDR_GET_LONG (c);
proc = IXDR_GET_LONG (c);
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"RPC decoded to: %lu %lu %lu\n",
- prog,vers,proc); );
+ DebugFormat(DEBUG_IPS_OPTION,"RPC decoded to: %lu %lu %lu\n",
+ prog,vers,proc);
- DEBUG_WRAP(
- DebugMessage(DEBUG_PLUGIN, "RPC matching on: %d %d %d\n",
+ DebugFormat(DEBUG_IPS_OPTION, "RPC matching on: %d %d %d\n",
ds_ptr->flags & RPC_CHECK_PROG,ds_ptr->flags & RPC_CHECK_VERS,
- ds_ptr->flags & RPC_CHECK_PROC); );
+ ds_ptr->flags & RPC_CHECK_PROC);
+
if (!(ds_ptr->flags & RPC_CHECK_PROG) ||
ds_ptr->program == prog)
{
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"RPC program matches"); );
+ DebugMessage(DEBUG_IPS_OPTION,"RPC program matches");
if (!(ds_ptr->flags & RPC_CHECK_VERS) ||
ds_ptr->vers == vers)
{
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"RPC version matches"); );
+ DebugMessage(DEBUG_IPS_OPTION,"RPC version matches");
if (!(ds_ptr->flags & RPC_CHECK_PROC) ||
ds_ptr->proc == proc)
{
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"RPC proc matches"); );
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "Yippee! Found one!"); );
+ DebugMessage(DEBUG_IPS_OPTION,"RPC proc matches");
+ DebugMessage(DEBUG_IPS_OPTION, "Yippee! Found one!");
rval = DETECTION_OPTION_MATCH;
}
}
else
{
/* you can put debug comments here or not */
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"RPC not equal\n"); );
+ DebugMessage(DEBUG_IPS_OPTION,"RPC not equal\n");
}
/* if the test isn't successful, return 0 */
std::string name;
const char* filename = get_instance_file(name, filearg);
- DEBUG_WRAP(DebugMessage(DEBUG_INIT,"Opening alert file: %s\n", filename); );
+ DebugFormat(DEBUG_INIT,"Opening alert file: %s\n", filename);
if ((file = fopen(filename, "a")) == NULL)
{
SnortSnprintf(newname, sizeof(newname)-1, "%s.%lu", oldname, (unsigned long)now);
- DEBUG_WRAP(DebugMessage(DEBUG_INIT,"Rolling alert file: %s\n", newname); );
+ DebugFormat(DEBUG_INIT,"Rolling alert file: %s\n", newname);
if ( rename(oldname, newname) )
{
return;
throttleInfo->count++;
- DEBUG_WRAP(DebugMessage(DEBUG_INIT,
+ DebugFormat(DEBUG_INIT,
"current_time: %d, throttle (%p): count " STDu64 ", last update: %d\n",
- (int)current_time, throttleInfo, throttleInfo->count, (int)throttleInfo->lastUpdate); )
+ (int)current_time, throttleInfo, throttleInfo->count, (int)throttleInfo->lastUpdate);
/*Note: we only output the first error message,
* and the statistics after at least duration_to_log seconds
* when the same type of error message is printed out again */
LogPriorityData(full_log, event, true);
}
- DEBUG_WRAP(DebugMessage(DEBUG_LOG, "Logging Alert data!\n"); );
+ DebugMessage(DEBUG_LOG, "Logging Alert data!\n");
LogTimeStamp(full_log, p);
TextLog_Putc(full_log, ' ');
static void get_alert_pkt(
Packet* p, const char* msg, Event* event)
{
- DEBUG_WRAP(DebugMessage(DEBUG_LOG, "Logging Alert data!\n"); );
+ DebugMessage(DEBUG_LOG, "Logging Alert data!\n");
// FIXIT-L ugh ...
memset((char*)&us.alert,0,sizeof(us.alert));
logheader.event_id = htonl(event->event_reference);
logheader.event_second = htonl(event->ref_time.tv_sec);
- DEBUG_WRAP(DebugMessage(DEBUG_LOG, "------------\n"));
+ DebugMessage(DEBUG_LOG, "------------\n");
}
else
{
{
if ( (p->packet_flags & PKT_REBUILT_STREAM) and !p->is_data() )
{
- DEBUG_WRAP(DebugMessage(DEBUG_LOG,
- "[*] Reassembled packet, dumping stream packets\n"); );
+ DebugMessage(DEBUG_LOG,
+ "[*] Reassembled packet, dumping stream packets\n");
// FIXIT-L replace with reassembled stream data and
// optionally the first captured packet
//_Unified2LogStreamAlert(p, msg, &config, event);
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_LOG, "[*] Logging unified 2 packets...\n"); );
+ DebugMessage(DEBUG_LOG, "[*] Logging unified 2 packets...\n");
_Unified2LogPacketAlert(p, msg, &config, event);
}
}
{ luaL_checktype(L, n, type); }
// Types
- inline bool is_type(int n, int type)
+ inline bool is_type(int n, int type)
{ return lua_type(L, n) == type; }
inline bool is_number(int n)
#endif
#include <stdio.h>
-#ifndef __USE_ISOC95
-# define __USE_ISOC95
-# include <wchar.h>
-# undef __USE_ISOC95
-#else
-# include <wchar.h>
-#endif
#include <stdarg.h>
#include <syslog.h>
#include <stdlib.h>
#include "snort_config.h"
#ifdef DEBUG_MSGS
-const char* DebugMessageFile = NULL; // FIXIT-M use access methods
-int DebugMessageLine = 0; // FIXIT-M use access methods
-
-int DebugThis(uint64_t level)
-{
- if (!(level & GetDebugLevel()))
- return 0;
- return 1;
-}
+bool Debug::init = false;
+uint64_t Debug::mask = 0;
-uint64_t GetDebugLevel(void)
+bool Debug::enabled(uint64_t flag)
{
- static int debug_init = 0;
- static uint64_t debug_level = 0;
-
- const char* key;
-
- if ( debug_init )
- return debug_level;
-
- key = getenv(DEBUG_PP_VAR);
-
- if ( key )
- debug_level = strtoul(key, NULL, 0);
-
- debug_level <<= 32;
-
- key = getenv(DEBUG_VARIABLE);
+ if ( !init )
+ {
+ const char* b = getenv(DEBUG_BUILTIN);
+ const char* p = getenv(DEBUG_PLUGIN);
- if ( key )
- debug_level |= strtoul(key, NULL, 0);
+ mask = p ? (strtoul(p, nullptr, 0) << 32) : 0;
+ mask |= (b ? strtoul(b, NULL, 0) : 0);
- debug_init = 1;
+ init = true;
+ }
- return debug_level;
+ return (mask & flag) != 0;
}
-void DebugMessageFunc(uint64_t level, const char* fmt, ...)
+void Debug::print(
+ const char* file, int line, uint64_t dbg, const char* fmt, ...)
{
- va_list ap;
-
- if (!(level & GetDebugLevel()))
+ if ( !enabled(dbg) )
return;
+ va_list ap;
va_start(ap, fmt);
- if ((snort_conf != NULL) && SnortConfig::daemon_mode())
+ if ( snort_conf and SnortConfig::daemon_mode())
{
char buf[STD_BUF];
int buf_len = sizeof(buf);
buf[buf_len - 1] = '\0';
/* filename and line number information */
- if (DebugMessageFile != NULL)
+ if ( file )
{
- snprintf(buf, buf_len - 1, "%s:%d: ",
- DebugMessageFile, DebugMessageLine);
+ snprintf(buf, buf_len - 1, "%s:%d: ", file, line);
buf_ptr += strlen(buf);
buf_len -= strlen(buf);
}
}
else
{
- if (DebugMessageFile != NULL)
- printf("%s:%d: ", DebugMessageFile, DebugMessageLine);
+ if ( file )
+ printf("%s:%d: ", file, line);
vprintf(fmt, ap);
}
va_end(ap);
}
-#ifdef SF_WCHAR
-void DebugWideMessageFunc(uint64_t level, const wchar_t* fmt, ...)
-{
- va_list ap;
- wchar_t buf[STD_BUF+1];
-
- if (!(level & GetDebugLevel()))
- {
- return;
- }
- buf[STD_BUF]= (wchar_t)0;
-
- /* filename and line number information */
- if (DebugMessageFile != NULL)
- printf("%s:%d: ", DebugMessageFile, DebugMessageLine);
-
- va_start(ap, fmt);
-
- if (SnortConfig::daemon_mode())
- {
-#ifdef HAVE_VSWPRINTF
- vswprintf(buf, STD_BUF, fmt, ap);
-#endif
- //syslog(LOG_DAEMON | LOG_DEBUG, "%s", buf);
- }
- else
- {
-#ifdef HAVE_WPRINTF
- vwprintf(fmt, ap);
-#endif
- }
-
- va_end(ap);
-}
-
-#endif
-#else /* DEBUG_MSGS */
-void DebugMessageFunc(uint64_t /*level*/, const char* /*fmt*/, ...)
-{
-}
-
-#ifdef SF_WCHAR
-void DebugWideMessageFunc(uint64_t /*level*/, const wchar_t* /*fmt*/, ...)
-{
-}
-
-#endif
#endif /* DEBUG_MSGS */
#include <stdint.h>
#include <ctype.h>
-#ifdef SF_WCHAR
-/* ISOC99 is defined to get required prototypes */
-#ifndef __USE_ISOC99
-#define __USE_ISOC99
-#endif
-#include <wchar.h>
-#endif
-
#include "main/snort_types.h"
// this env var uses the lower 32 bits of the flags:
-#define DEBUG_VARIABLE "SNORT_DEBUG"
+#define DEBUG_BUILTIN "SNORT_DEBUG"
#define DEBUG_INIT 0x0000000000000001LL
#define DEBUG_PARSER 0x0000000000000002LL
-#define DEBUG_MSTRING 0x0000000000000004LL
-#define DEBUG_PORTLISTS 0x0000000000000008LL
-#define DEBUG_ATTRIBUTE 0x0000000000000010LL
-#define DEBUG_PLUGIN 0x0000000000000020LL
-#define DEBUG_PLUGBASE 0x0000000000000040LL
-#define DEBUG_DECODE 0x0000000000000080LL
-#define DEBUG_DATALINK 0x0000000000000100LL
-#define DEBUG_CONFIGRULES 0x0000000000000200LL
-#define DEBUG_RULES 0x0000000000000400LL
-#define DEBUG_DETECT 0x0000000000000800LL
-#define DEBUG_PATTERN_MATCH 0x0000000000001000LL
-#define DEBUG_FLOW 0x0000000000002000LL
-#define DEBUG_LOG 0x0000000000004000LL
-#define DEBUG_FLOWBITS 0x0000000000008000LL
-#define DEBUG_FILE 0x0000000000010000LL
-#define DEBUG_CONTROL 0x0000000000020000LL
-#define DEBUG_PPM 0x0000000000040000LL
-#define DEBUG_EXP 0x0000000080000000LL
+#define DEBUG_PORTLISTS 0x0000000000000004LL
+#define DEBUG_ATTRIBUTE 0x0000000000000008LL
+#define DEBUG_DECODE 0x0000000000000010LL
+#define DEBUG_CONFIGRULES 0x0000000000000020LL
+#define DEBUG_DETECT 0x0000000000000040LL
+#define DEBUG_PATTERN_MATCH 0x0000000000000080LL
+#define DEBUG_FLOW 0x0000000000000100LL
+#define DEBUG_LOG 0x0000000000000200LL
+#define DEBUG_FLOWBITS 0x0000000000000400LL
+#define DEBUG_FILE 0x0000000000000800LL
+#define DEBUG_PPM 0x0000000000001000LL
// this env var uses the upper 32 bits of the flags:
-#define DEBUG_PP_VAR "SNORT_PP_DEBUG"
+#define DEBUG_PLUGIN "SNORT_PP_DEBUG"
#define DEBUG_FRAG 0x0000000100000000LL
#define DEBUG_STREAM 0x0000000200000000LL
#define DEBUG_STREAM_STATE 0x0000000400000000LL
#define DEBUG_STREAM_PAF 0x0000000800000000LL
-#define DEBUG_HTTP_DECODE 0x0000001000000000LL
-#define DEBUG_HTTPINSPECT 0x0000002000000000LL
-#define DEBUG_ASN1 0x0000004000000000LL
-#define DEBUG_DNS 0x0000008000000000LL
-#define DEBUG_FTPTELNET 0x0000010000000000LL
-#define DEBUG_GTP 0x0000020000000000LL
-#define DEBUG_IMAP 0x0000040000000000LL
-#define DEBUG_POP 0x0000080000000000LL
-#define DEBUG_RPC 0x0000100000000000LL
-#define DEBUG_SIP 0x0000200000000000LL
-#define DEBUG_SKYPE 0x0000400000000000LL
-#define DEBUG_SSL 0x0000800000000000LL
-#define DEBUG_SMTP 0x0001000000000000LL
-#define DEBUG_PP_EXP 0x8000000000000000LL
-
-#if 0
-// FIXIT delete duplicate declarations
-SO_PUBLIC void DebugMessageFunc(uint64_t dbg, const char* fmt, ...);
-#ifdef SF_WCHAR
-void DebugWideMessageFunc(uint64_t dbg, const wchar_t* fmt, ...);
-#endif
+#define DEBUG_HTTPINSPECT 0x0000001000000000LL
+#define DEBUG_ASN1 0x0000002000000000LL
+#define DEBUG_DNS 0x0000004000000000LL
+#define DEBUG_FTPTELNET 0x0000008000000000LL
+#define DEBUG_GTP 0x0000010000000000LL
+#define DEBUG_IMAP 0x0000020000000000LL
+#define DEBUG_POP 0x0000040000000000LL
+#define DEBUG_RPC 0x0000080000000000LL
+#define DEBUG_SIP 0x0000100000000000LL
+#define DEBUG_SSL 0x0000200000000000LL
+#define DEBUG_SMTP 0x0000400000000000LL
+
+#define DEBUG_CODEC 0x0001000000000000LL
+#define DEBUG_INSPECTOR 0x0002000000000000LL
+#define DEBUG_IPS_ACTION 0x0004000000000000LL
+#define DEBUG_IPS_OPTION 0x0008000000000000LL
+#define DEBUG_MPSE 0x0010000000000000LL
+#define DEBUG_SO_RULE 0x0020000000000000LL
+#define DEBUG_LOGGER 0x0040000000000000LL
+
+#ifdef PIGLET
+#define DEBUG_PIGLET 0x0080000000000000LL
#endif
#ifdef DEBUG_MSGS
-SO_PUBLIC extern const char* DebugMessageFile;
-SO_PUBLIC extern int DebugMessageLine;
-#define DebugMessage DebugMessageFile = __FILE__; DebugMessageLine = __LINE__; DebugMessageFunc
-#define DebugWideMessage \
- DebugMessageFile = __FILE__; DebugMessageLine = __LINE__; \
- DebugWideMessageFunc
+class SO_PUBLIC Debug
+{
+public:
+ static bool enabled(uint64_t flag);
-uint64_t GetDebugLevel(void);
-int DebugThis(uint64_t level);
-#endif
+ static void print(
+ const char* file, int line, uint64_t dbg, const char* fmt, ...);
+
+private:
+ static bool init;
+ static uint64_t mask;
+};
+
+#define DebugFormat(dbg, fmt, ...) \
+ Debug::print(__FILE__, __LINE__, dbg, fmt, __VA_ARGS__)
+
+#define DebugMessage(dbg, msg) DebugFormat(dbg, "%s", msg)
-#ifdef DEBUG_MSGS
#define DEBUG_WRAP(code) code
-SO_PUBLIC void DebugMessageFunc(uint64_t dbg, const char* fmt, ...);
-#ifdef SF_WCHAR
-SO_PUBLIC void DebugWideMessageFunc(uint64_t dbg, const wchar_t* fmt, ...);
-#endif
+
#else
+#define DebugFormat(dbg, fmt, ...)
+#define DebugMessage(dbg, msg)
#define DEBUG_WRAP(code)
-/* I would use DebugMessage(dbt,fmt...) but that only works with GCC */
#endif
#endif
PlugMap::iterator it;
for ( it = plug_map.begin(); it != plug_map.end(); ++it )
- {
+ {
Plugin& p = it->second;
cout << Markup::item();
SnortEventqAdd(GID_ARP_SPOOF,
ARPSPOOF_UNICAST_ARP_REQUEST);
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,
- "MODNAME: Unicast request\n"); );
+ DebugMessage(DEBUG_INSPECTOR,
+ "MODNAME: Unicast request\n");
}
else if (memcmp((u_char*)eh->ether_src,
(u_char*)ah->arp_sha, 6) != 0)
SnortEventqAdd(GID_ARP_SPOOF,
ARPSPOOF_ETHERFRAME_ARP_MISMATCH_SRC);
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,
- "MODNAME: Ethernet/ARP mismatch request\n"); );
+ DebugMessage(DEBUG_INSPECTOR,
+ "MODNAME: Ethernet/ARP mismatch request\n");
}
break;
case ARPOP_REPLY:
SnortEventqAdd(GID_ARP_SPOOF,
ARPSPOOF_ETHERFRAME_ARP_MISMATCH_SRC);
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,
- "MODNAME: Ethernet/ARP mismatch reply src\n"); );
+ DebugMessage(DEBUG_INSPECTOR,
+ "MODNAME: Ethernet/ARP mismatch reply src\n");
}
else if (memcmp((u_char*)eh->ether_dst,
(u_char*)ah->arp_tha, 6) != 0)
SnortEventqAdd(GID_ARP_SPOOF,
ARPSPOOF_ETHERFRAME_ARP_MISMATCH_DST);
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,
- "MODNAME: Ethernet/ARP mismatch reply dst\n"); );
+ DebugMessage(DEBUG_INSPECTOR,
+ "MODNAME: Ethernet/ARP mismatch reply dst\n");
}
break;
}
if ((ipme = LookupIPMacEntryByIP(config->ipmel,
ah->arp_spa32)) == NULL)
{
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,
- "MODNAME: LookupIPMacEntryByIp returned NULL\n"); );
+ DebugMessage(DEBUG_INSPECTOR,
+ "MODNAME: LookupIPMacEntryByIp returned NULL\n");
return;
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,
- "MODNAME: LookupIPMacEntryByIP returned %p\n", ipme); );
+ DebugFormat(DEBUG_INSPECTOR,
+ "MODNAME: LookupIPMacEntryByIP returned %p\n", ipme);
/* If the Ethernet source address or the ARP source hardware address
* in p doesn't match the MAC address in ipme, then generate an alert
SnortEventqAdd(GID_ARP_SPOOF,
ARPSPOOF_ARP_CACHE_OVERWRITE_ATTACK);
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,
- "MODNAME: Attempted ARP cache overwrite attack\n"); );
+ DebugMessage(DEBUG_INSPECTOR,
+ "MODNAME: Attempted ARP cache overwrite attack\n");
return;
}
node = sfxhash_get_node(sfFlow->ipMap, &key);
if (!node)
{
- DEBUG_WRAP(DebugMessage(DEBUG_STREAM,
+ DebugMessage(DEBUG_STREAM,
"Key/Value pair didn't exist in the flow stats table and we couldn't add it!\n");
- );
return NULL;
}
memset(node->data, 0, sizeof(sfSFSValue));
char* iface = NULL;
char errorbuf[PCAP_ERRBUF_SIZE];
- DEBUG_WRAP(DebugMessage(
- DEBUG_INIT, "interface is NULL, looking up interface...."); );
+ DebugMessage(
+ DEBUG_INIT, "interface is NULL, looking up interface....");
/* look up the device and get the handle */
iface = pcap_lookupdev(errorbuf);
"Please specify one with -i switch\n", errorbuf);
}
- DEBUG_WRAP(DebugMessage(DEBUG_INIT, "found interface %s\n",
- PRINT_INTERFACE(iface)); );
+ DebugFormat(DEBUG_INIT, "found interface %s\n", PRINT_INTERFACE(iface));
iface = SnortStrdup(iface);
return iface;
void ConfigDaemon(SnortConfig* sc, const char*)
{
- DEBUG_WRAP(DebugMessage(DEBUG_INIT, "Daemon mode flag set\n"); );
+ DebugMessage(DEBUG_INIT, "Daemon mode flag set\n");
sc->run_flags |= RUN_FLAG__DAEMON;
sc->logging_flags |= LOGGING_FLAG__QUIET;
}
void ConfigDecodeDataLink(SnortConfig* sc, const char*)
{
- DEBUG_WRAP(DebugMessage(DEBUG_INIT, "Decode DLL set\n"); );
+ DebugMessage(DEBUG_INIT, "Decode DLL set\n");
sc->output_flags |= OUTPUT_FLAG__SHOW_DATA_LINK;
}
void ConfigDumpCharsOnly(SnortConfig* sc, const char*)
{
/* dump the application layer as text only */
- DEBUG_WRAP(DebugMessage(DEBUG_INIT, "Character payload dump set\n"); );
+ DebugMessage(DEBUG_INIT, "Character payload dump set\n");
sc->output_flags |= OUTPUT_FLAG__CHAR_DATA;
}
void ConfigDumpPayload(SnortConfig* sc, const char*)
{
/* dump the application layer */
- DEBUG_WRAP(DebugMessage(DEBUG_INIT, "Payload dump set\n"); );
+ DebugMessage(DEBUG_INIT, "Payload dump set\n");
sc->output_flags |= OUTPUT_FLAG__APP_DATA;
}
void ConfigDumpPayloadVerbose(SnortConfig* sc, const char*)
{
- DEBUG_WRAP(DebugMessage(DEBUG_INIT, "Verbose packet bytecode dumps enabled\n"); );
+ DebugMessage(DEBUG_INIT, "Verbose packet bytecode dumps enabled\n");
sc->output_flags |= OUTPUT_FLAG__VERBOSE_DUMP;
}
if ( !args )
return;
- DEBUG_WRAP(DebugMessage(DEBUG_INIT, "Got obfus data: %s\n", args); );
+ DebugFormat(DEBUG_INIT, "Got obfus data: %s\n", args);
sc->output_flags |= OUTPUT_FLAG__OBFUSCATE;
}
}
- DEBUG_WRAP(DebugMessage(DEBUG_INIT, "UserID: %d GroupID: %d.\n",
- sc->user_id, sc->group_id); );
+ DebugFormat(DEBUG_INIT, "UserID: %d GroupID: %d.\n",
+ sc->user_id, sc->group_id);
}
void ConfigShowYear(SnortConfig* sc, const char*)
{
sc->output_flags |= OUTPUT_FLAG__INCLUDE_YEAR;
- DEBUG_WRAP(DebugMessage(DEBUG_INIT, "Enabled year in timestamp\n"); );
+ DebugMessage(DEBUG_INIT, "Enabled year in timestamp\n");
}
void ConfigTreatDropAsAlert(SnortConfig* sc, const char*)
void ConfigVerbose(SnortConfig* sc, const char*)
{
sc->logging_flags |= LOGGING_FLAG__VERBOSE;
- DEBUG_WRAP(DebugMessage(DEBUG_INIT, "Verbose Flag active\n"); );
+ DebugMessage(DEBUG_INIT, "Verbose Flag active\n");
}
void ConfigTunnelVerdicts(SnortConfig* sc, const char* args)
/* shift=make_shift(find,sizeof(find)-1);
skip=make_skip(find,sizeof(find)-1); */
- DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH,"%d\n",
+ DebugFormat(DEBUG_PATTERN_MATCH,"%d\n",
mSearch(test, sizeof(test) - 1, find,
- sizeof(find) - 1, shift, skip)); );
+ sizeof(find) - 1, shift, skip));
return 0;
}
{
if (m_cnt == (p_len - 1))
{
- DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH,
- "\n%ld compares for match\n", loopcnt); );
+ DebugFormat(DEBUG_PATTERN_MATCH,
+ "\n%ld compares for match\n", loopcnt);
return 1;
}
m_cnt++;
ip_vartable = get_ips_policy()->ip_vartable;
- DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"Got address string: %s\n",
- addr); );
+ DebugFormat(DEBUG_CONFIGRULES,"Got address string: %s\n", addr);
ret = (sfip_var_t*)SnortAlloc(sizeof(sfip_var_t));
pop->slen--;
pop->s++;
pop->pos++;
- DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,"GetChar: %c, %d bytes left\n",c, pop->slen); );
+ DebugFormat(DEBUG_PORTLISTS,"GetChar: %c, %d bytes left\n",c, pop->slen);
return c;
}
return 0;
}
}
- DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,">>> POParserName : %s\n",pop->token); );
+ DebugFormat(DEBUG_PORTLISTS,">>> POParserName : %s\n",pop->token);
return strdup(pop->token);
}
return 0;
}
- DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,"GetUNumber: %d\n",c); );
+ DebugFormat(DEBUG_PORTLISTS,"GetUNumber: %d\n",c);
return c;
}
{
PortObject* po, * potmp;
- DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,"PortObjectParseString: %s\n",s); );
+ DebugFormat(DEBUG_PORTLISTS,"PortObjectParseString: %s\n",s);
POParserInit(pop, s, pvTable);
/* Count rules with both src and dst specific ports */
if (!(rtn->flags & ANY_DST_PORT) && !(rtn->flags & ANY_SRC_PORT))
{
- DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,
+ DebugFormat(DEBUG_PORTLISTS,
"***\n***Info: src & dst ports are both specific"
" >> gid=%u sid=%u\n***\n",
- otn->sigInfo.generator, otn->sigInfo.id));
+ otn->sigInfo.generator, otn->sigInfo.id);
prc->both++;
}
* to those protocols. All IP rules should have any-any port descriptors
* and fall into this test. IP rules that are not tcp/udp/icmp go only into the
* IP table */
- DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,
+ DebugFormat(DEBUG_PORTLISTS,
"Finishing IP any-any rule %u:%u\n",
- otn->sigInfo.generator,otn->sigInfo.id); );
+ otn->sigInfo.generator,otn->sigInfo.id);
switch ( otn->proto )
{
prc->dst++;
- DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,
- "Finishing rule: dst port rule\n"); );
+ DebugMessage(DEBUG_PORTLISTS,
+ "Finishing rule: dst port rule\n");
/* find the proper port object */
pox = PortTableFindInputPortObjectPorts(dstTable, rtn->dst_portobject);
/*||isalpha(port_str[0])*/ /*TODO: interferes with protocol names for ports*/
const char* name = port_str + 1;
- DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,"PortVarTableFind: finding '%s'\n", port_str); );
+ DebugFormat(DEBUG_PORTLISTS,"PortVarTableFind: finding '%s'\n", port_str);
/* look it up in the port var table */
portobject = PortVarTableFind(pvt, name);
if (portobject == NULL)
ParseAbort("***PortVar Lookup failed on '%s'.", port_str);
- DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,"PortVarTableFind: '%s' found!\n", port_str); );
+ DebugFormat(DEBUG_PORTLISTS,"PortVarTableFind: '%s' found!\n", port_str);
}
/* 3rd - and finally process a raw port list */
else
/* port list = [p,p,p:p,p,...] or p or p:p , no embedded spaces due to tokenizer */
PortObject* pox;
- DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,
- "parser.c->PortObjectParseString: parsing '%s'\n",port_str); );
+ DebugFormat(DEBUG_PORTLISTS,
+ "parser.c->PortObjectParseString: parsing '%s'\n",port_str);
portobject = PortObjectParseString(pvt, &poparser, 0, port_str, 0);
- DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,
- "parser.c->PortObjectParseString: '%s' done.\n",port_str); );
+ DebugFormat(DEBUG_PORTLISTS,
+ "parser.c->PortObjectParseString: '%s' done.\n",port_str);
if ( !portobject )
{
pox = PortTableFindInputPortObjectPorts(noname, portobject);
if ( pox )
{
- DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,
+ DebugFormat(DEBUG_PORTLISTS,
"parser.c: already have '%s' as a PortObject - "
- "calling PortObjectFree(portbject) line=%d\n",port_str,__LINE__); );
+ "calling PortObjectFree(portbject) line=%d\n",port_str,__LINE__);
PortObjectFree(portobject);
portobject = pox;
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,
- "parser.c: adding '%s' as a PortObject line=%d\n",port_str,__LINE__); );
+ DebugFormat(DEBUG_PORTLISTS,
+ "parser.c: adding '%s' as a PortObject line=%d\n",port_str,__LINE__);
/* Add to the un-named port var table */
if (PortTableAddObject(noname, portobject))
{
}
}
- DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,"Rule-PortVar Parsed: %s \n",port_str); );
+ DebugFormat(DEBUG_PORTLISTS,"Rule-PortVar Parsed: %s \n",port_str);
/* !ports - port lists can be mixed 80:90,!82,
* so the old NOT flag is depracated for port lists
{
RuleFpList* idx;
- DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"Adding new rule to list\n"); );
+ DebugMessage(DEBUG_CONFIGRULES,"Adding new rule to list\n");
idx = rtn->rule_func;
if (idx == NULL)
case SRC:
if ((rtn->flags & ANY_SRC_IP) == 0)
{
- DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"CheckSrcIP -> "); );
+ DebugMessage(DEBUG_CONFIGRULES,"CheckSrcIP -> ");
AddRuleFuncToList(CheckSrcIP, rtn);
}
case DST:
if ((rtn->flags & ANY_DST_IP) == 0)
{
- DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"CheckDstIP -> "); );
+ DebugMessage(DEBUG_CONFIGRULES,"CheckDstIP -> ");
AddRuleFuncToList(CheckDstIP, rtn);
}
switch (mode)
{
case SRC:
- DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"CheckSrcPortNotEq -> "); );
+ DebugMessage(DEBUG_CONFIGRULES,"CheckSrcPortNotEq -> ");
AddRuleFuncToList(CheckSrcPortNotEq, rtn);
break;
case DST:
- DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"CheckDstPortNotEq -> "); );
+ DebugMessage(DEBUG_CONFIGRULES,"CheckDstPortNotEq -> ");
AddRuleFuncToList(CheckDstPortNotEq, rtn);
break;
}
switch (mode)
{
case SRC:
- DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"CheckSrcPortEqual -> "); );
+ DebugMessage(DEBUG_CONFIGRULES,"CheckSrcPortEqual -> ");
AddRuleFuncToList(CheckSrcPortEqual, rtn);
break;
case DST:
- DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"CheckDstPortEqual -> "); );
+ DebugMessage(DEBUG_CONFIGRULES,"CheckDstPortEqual -> ");
AddRuleFuncToList(CheckDstPortEqual, rtn);
break;
}
***************************************************************************/
static void SetupRTNFuncList(RuleTreeNode* rtn)
{
- DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"Initializing RTN function list!\n"); );
- DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"Functions: "); );
+ DebugMessage(DEBUG_CONFIGRULES,"Initializing RTN function list!\n");
+ DebugMessage(DEBUG_CONFIGRULES,"Functions: ");
if (rtn->flags & BIDIRECTIONAL)
{
- DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"CheckBidirectional->\n"); );
+ DebugMessage(DEBUG_CONFIGRULES,"CheckBidirectional->\n");
AddRuleFuncToList(CheckBidirectional, rtn);
}
else
AddrToFunc(rtn, DST);
}
- DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"RuleListEnd\n"); );
+ DebugMessage(DEBUG_CONFIGRULES,"RuleListEnd\n");
/* tack the end (success) function to the list */
AddRuleFuncToList(RuleListEnd, rtn);
* stick it at the end of the list */
if (rtn == NULL)
{
- DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"Building New Chain head node\n"); );
+ DebugMessage(DEBUG_CONFIGRULES,"Building New Chain head node\n");
head_count++;
rtn = (RuleTreeNode*)SnortAlloc(sizeof(RuleTreeNode));
/* add link to parent listhead */
rtn->listhead = list;
- DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,
- "New Chain head flags = 0x%X\n", rtn->flags); );
+ DebugFormat(DEBUG_CONFIGRULES,
+ "New Chain head flags = 0x%X\n", rtn->flags);
}
else
{
while (ofl_idx != NULL)
{
opt_func_count++;
- //DEBUG_WRAP(DebugMessage(DEBUG_DETECT, "%p->",ofl_idx->OptTestFunc););
+ //DebugFormat(DEBUG_DETECT, "%p->",ofl_idx->OptTestFunc);
ofl_idx = ofl_idx->next;
}
{
ParseError("zero Length OTN List");
}
- //DEBUG_WRAP(DebugMessage(DEBUG_DETECT,"\n"););
+ //DebugMessage(DEBUG_DETECT,"\n");
}
}
}
- //DEBUG_WRAP(DebugMessage(DEBUG_DETECT, "OK\n"););
+ //DebugMessage(DEBUG_DETECT, "OK\n");
}
static void parse_file(SnortConfig* sc, Shell* sh)
}
}
- DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,
- "VarDefine: name=%s value=%s\n",name,value); );
+ DebugFormat(DEBUG_PORTLISTS,
+ "VarDefine: name=%s value=%s\n",name,value);
/* Check to see if this variable is just being aliased */
if (var_table != NULL)
ParseAbort("could not expand var('%s').", name);
}
- DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,
- "VarDefine: name=%s value=%s (expanded)\n",name,value); );
+ DebugFormat(DEBUG_PORTLISTS,
+ "VarDefine: name=%s value=%s (expanded)\n",name,value);
DisallowCrossTableDuplicateVars(sc, name, VAR_TYPE__DEFAULT);
i = j = 0;
l_string = strlen(string);
- DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES, "ExpandVars, Before: %s\n", string); );
+ DebugFormat(DEBUG_CONFIGRULES, "ExpandVars, Before: %s\n", string);
while (i < l_string && j < (int)sizeof(estring) - 1)
{
}
}
- DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES, "ExpandVars, After: %s\n", estring); );
+ DebugFormat(DEBUG_CONFIGRULES, "ExpandVars, After: %s\n", estring);
return estring;
}
//TODO: snort.cfg and rules should use PortVar instead ...this allows compatability for now.
if (strstr(name, "_PORT") || strstr(name, "PORT_"))
{
- DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"PortVar\n"); );
+ DebugMessage(DEBUG_CONFIGRULES,"PortVar\n");
PortVarDefine(sc, name, value);
}
else
namespace Piglet
{
-int main();
+int main();
bool piglet_mode();
}
{ delete p; }
static const struct Piglet::Api piglet_api =
-{
+{
{
PT_PIGLET,
sizeof(Piglet::Api),
static std::vector<uint16_t> protocol_ids;
static const ip::IpApi ip_api {};
-
+
struct TextLogWrapper
{
TextLog* text_log;
{
Lua::ManageStack ms(L);
Lua::Table si_table(L, lua_gettop(L));
-
+
si_table.get_field("generator", si->generator);
si_table.get_field("id", si->id);
si_table.get_field("rev", si->rev);
{
auto& self = FlowIface.get(L);
lua_pushfstring(L, "%s@%p", FlowIface.name, &self);
-
+
return 1;
}
},
{
auto& p = PacketIface.get(L);
auto& self = InspectorIface.get(L);
-
+
self.clear(&p);
return 0;
auto& self = RawBufferIface.get(L, 1);
size_t new_size = arg.check_size(2);
-
+
self.resize(new_size, '\0');
return 0;
class TestPiglet : public Piglet::BasePlugin
{
public:
- TestPiglet(Lua::State& state, std::string target) :
+ TestPiglet(Lua::State& state, std::string target) :
BasePlugin(state, target) { }
virtual bool setup() override;
PortObject* po = (PortObject*)pvoid;
DEBUG_WRAP(static int pof_cnt = 0; pof_cnt++; );
- DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,"PortObjectFree-Cnt: %d ptr=%p\n",pof_cnt,pvoid); );
+ DebugFormat(DEBUG_PORTLISTS,"PortObjectFree-Cnt: %d ptr=%p\n",pof_cnt,pvoid);
if ( !po )
return;
PortObject2* po = (PortObject2*)pvoid;
DEBUG_WRAP(static int pof2_cnt = 0; pof2_cnt++; );
- DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,"PortObjectFree2-Cnt: %d ptr=%p\n",pof2_cnt,pvoid); );
+ DebugFormat(DEBUG_PORTLISTS,"PortObjectFree2-Cnt: %d ptr=%p\n",pof2_cnt,pvoid);
if ( !po )
return;
{
DEBUG_WRAP(
int i;
- DebugMessage(DEBUG_PORTLISTS, "plx-n=%d\n", p->n);
+ DebugFormat(DEBUG_PORTLISTS, "plx-n=%d\n", p->n);
for (i=0; i<p->n; i++)
- DebugMessage(DEBUG_PORTLISTS, "plx[%d]=%lu\n", i, p->p[i]);
+ DebugFormat(DEBUG_PORTLISTS, "plx[%d]=%lu\n", i, p->p[i]);
);
}
/*
* Check for the merged port object in the plx table
*/
- DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,
- "++++n=%d sfghash_find-mhashx\n",pol_cnt); );
+ DebugFormat(DEBUG_PORTLISTS,
+ "++++n=%d sfghash_find-mhashx\n",pol_cnt);
ponew = (PortObject2*)sfghash_find(mhashx, &plx);
if ( ponew )
{
- DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,
- "n=%d ponew found in mhashx\n",pol_cnt); );
+ DebugFormat(DEBUG_PORTLISTS,
+ "n=%d ponew found in mhashx\n",pol_cnt);
return ponew;
}
- DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,
- "n=%d posnew not found in mhashx\n",pol_cnt); );
+ DebugFormat(DEBUG_PORTLISTS,
+ "n=%d posnew not found in mhashx\n",pol_cnt);
/*
* Merge the port objects together - ports and rules
{
for (i=1; i<pol_cnt; i++)
{
- DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,"*** %d rules in object %d\n",
- ((PortObject*)pol[i])->rule_list->count,i); );
+ DebugFormat(DEBUG_PORTLISTS,"*** %d rules in object %d\n",
+ ((PortObject*)pol[i])->rule_list->count,i);
PortObjectAppendEx2(ponew, (PortObject*)pol[i]);
- DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,
+ DebugFormat(DEBUG_PORTLISTS,
"*** merged port-object[%d], %d rules\n",
- i,ponew->rule_hash->count); );
+ i,ponew->rule_hash->count);
}
PortObjectNormalize( (PortObject*)ponew);
}
- DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,
+ DebugFormat(DEBUG_PORTLISTS,
"*** merged %d port objects, %d rules\n",
- pol_cnt,ponew->rule_hash->count); );
- DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,"*** merged ponew - follows: \n"); );
+ pol_cnt,ponew->rule_hash->count);
+ DebugMessage(DEBUG_PORTLISTS,"*** merged ponew - follows: \n");
// PortObjectPrint2(ponew);
/*
* Add the Merged PortObject2 to the PortObject2 hash table
* keyed by ports.
*/
- DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,"n=%d sfghash_add-mhash\n",pol_cnt); );
+ DebugFormat(DEBUG_PORTLISTS,"n=%d sfghash_add-mhash\n",pol_cnt);
stat =sfghash_add(mhash, &ponew, ponew);
if ( stat != SFGHASH_OK )
{
/* This is possible since PLX hash on a different key */
if ( stat == SFGHASH_INTABLE )
{
- DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,"n=%d sfghash_add-mhash ponew in table\n",
- pol_cnt); );
- DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,"n=%d sfghash_find-mhash ponew\n",pol_cnt); );
+ DebugFormat(DEBUG_PORTLISTS,"n=%d sfghash_add-mhash ponew in table\n",
+ pol_cnt);
+ DebugFormat(DEBUG_PORTLISTS,"n=%d sfghash_find-mhash ponew\n",pol_cnt);
pox = (PortObject2*)sfghash_find(mhash,&ponew);
if ( pox )
{
PortObject2AppendPortObject2(pox,ponew);
- DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,
- "sfportobject.c: merge_N_pol() line=%d SFGHASH_INTABLE\n",__LINE__); );
+ DebugFormat(DEBUG_PORTLISTS,
+ "sfportobject.c: merge_N_pol() line=%d SFGHASH_INTABLE\n",__LINE__);
PortObject2Free(ponew);
ponew = pox;
- DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,
- "n=%d sfghash_find-mhash ponew found, new rules merged\n",pol_cnt); );
+ DebugFormat(DEBUG_PORTLISTS,
+ "n=%d sfghash_find-mhash ponew found, new rules merged\n",pol_cnt);
}
else
{
}
}
- DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,"***%d ports merged object added to mhash table\n",
- pol_cnt); );
+ DebugFormat(DEBUG_PORTLISTS,"***%d ports merged object added to mhash table\n",
+ pol_cnt);
/*
* Create a plx node and add it to plx table
/*
* Add the plx node to the PLX hash table
*/
- DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,"n=%d sfghash_add-mhashx\n",pol_cnt); );
+ DebugFormat(DEBUG_PORTLISTS,"n=%d sfghash_add-mhashx\n",pol_cnt);
stat = sfghash_add(mhashx, &plx_tmp, ponew);
if ( stat != SFGHASH_OK )
{
}
}
- DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,"Added-%d Merged Rule Groups to PLX HASH\n",pol_cnt);
- );
+ DebugFormat(DEBUG_PORTLISTS,"Added-%d Merged Rule Groups to PLX HASH\n",pol_cnt);
/*
* Validate hash table entry
}
}
- DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,"*** %d small rule groups, %d large rule groups\n",
- nsmall,nlarge); );
+ DebugFormat(DEBUG_PORTLISTS,"*** %d small rule groups, %d large rule groups\n",
+ nsmall,nlarge);
/*
* Sort the pointers to the input port objects so
DEBUG_WRAP(
for (i=0; i<nsmall; i++)
- DebugMessage(DEBUG_PORTLISTS, "posmall[%d]=%lu\n",i,posmall[i]);
+ DebugFormat(DEBUG_PORTLISTS, "posmall[%d]=%lu\n",i,posmall[i]);
for (i=0; i<nlarge; i++)
- DebugMessage(DEBUG_PORTLISTS, "polarge[%d]=%lu\n",i,polarge[i]);
+ DebugFormat(DEBUG_PORTLISTS, "polarge[%d]=%lu\n",i,polarge[i]);
);
/*
*/
if ( nlarge )
{
- DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,"***nlarge=%d \n",nlarge); );
+ DebugFormat(DEBUG_PORTLISTS,"***nlarge=%d \n",nlarge);
ponew = _merge_N_pol(mhash, mhashx, plx_list, polarge, nlarge, &plx_large);
}
*/
if ( nsmall )
{
- DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,"***nsmall=%d \n",nsmall); );
+ DebugFormat(DEBUG_PORTLISTS,"***nsmall=%d \n",nsmall);
posnew = _merge_N_pol(mhash, mhashx, plx_list, posmall, nsmall, &plx_small);
}
/*
*/
if ( nlarge && nsmall )
{
- DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,
- "*** appending small rules to larger rule group\n"); );
+ DebugMessage(DEBUG_PORTLISTS,
+ "*** appending small rules to larger rule group\n");
if (ponew != posnew)
{
/* Append small port object, just the rules */
PortObjectRemovePorts( (PortObject*)posnew, (PortObject*)ponew);
}
- DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,"*** final - using small+large rule group \n"); );
+ DebugMessage(DEBUG_PORTLISTS,"*** final - using small+large rule group \n");
}
else if ( nsmall )
{
/* Only a small port object */
ponew = posnew;
- DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,"*** final - using small rule group only \n"); );
+ DebugMessage(DEBUG_PORTLISTS,"*** final - using small rule group only \n");
}
else if ( nlarge )
{
SFGHASH* mhashx;
SF_LIST* plx_list;
- DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,"***\n***Merging PortObjects->PortObjects2\n***\n"); );
+ DebugMessage(DEBUG_PORTLISTS,"***\n***Merging PortObjects->PortObjects2\n***\n");
std::unique_ptr<PortObject*[]> upA(new PortObject*[SFPO_MAX_LPORTS]);
PortObject** pol = upA.get();
p->pt_mpxo_hash = mhashx;
- DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,
- "***\n*** PortList-Merging, Large Rule groups must have %d rules\n",p->pt_lrc); );
+ DebugFormat(DEBUG_PORTLISTS,
+ "***\n*** PortList-Merging, Large Rule groups must have %d rules\n",p->pt_lrc);
plx_list = sflist_new();
sflist_init(plx_list);
continue;
}
- DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,"*** merging list for port[%d] \n",i); fflush(
+ DEBUG_WRAP(DebugFormat(DEBUG_PORTLISTS,"*** merging list for port[%d] \n",i); fflush(
stdout); );
/* merge the rules into an optimal port object */
/* set the new list - this is a list of port items for this port object */
po->item_list = plist;
- DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,"port-object id = %d, port cnt = %d\n",po->id,
- po->port_cnt); );
+ DebugFormat(DEBUG_PORTLISTS,"port-object id = %d, port cnt = %d\n",po->id,
+ po->port_cnt);
}
return 0;
}
}
- DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,
- "***\n***Port Table Compiler Consistency Check Phase-I Passed !\n"); );
+ DebugMessage(DEBUG_PORTLISTS,
+ "***\n***Port Table Compiler Consistency Check Phase-I Passed !\n");
/*
* This phase checks the Input port object rules/ports against
}
}
- DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,
- "***\n***Port Table Compiler Consistency Check Phase-II Passed !!! - Good to go Houston\n****\n");
- );
+ DebugMessage(DEBUG_PORTLISTS,
+ "***\n***Port Table Compiler Consistency Check Phase-II Passed !!!"
+ " - Good to go Houston\n****\n");
return 0;
}
return 0;
}
- DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,"#PortTableCompile: Compiling Port Array Lists\n"); );
+ DebugMessage(DEBUG_PORTLISTS,"#PortTableCompile: Compiling Port Array Lists\n");
if ( PortTableCompileMergePortObjects(p) )
{
// loop until the protocol id is no longer valid
while (CodecManager::s_protocols[mapped_prot]->decode(raw, codec_data, p->ptrs))
{
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Codec %s (protocol_id: %u:"
+ DebugFormat(DEBUG_DECODE, "Codec %s (protocol_id: %u:"
"ip header starts at: %p, length is %lu\n",
CodecManager::s_protocols[mapped_prot]->get_name(),
- codec_data.next_prot_id, pkt, codec_data.lyr_len); );
+ codec_data.next_prot_id, pkt, codec_data.lyr_len);
/*
* We only want the layer immediately following SAVE_LAYER to have the
codec_data.proto_bits = 0;
}
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Codec %s (protocol_id: %hu: ip header"
+ DebugFormat(DEBUG_DECODE, "Codec %s (protocol_id: %hu: ip header"
" starts at: %p, length is %lu\n",
CodecManager::s_protocols[mapped_prot]->get_name(),
- prev_prot_id, pkt, (unsigned long)codec_data.lyr_len); );
+ prev_prot_id, pkt, (unsigned long)codec_data.lyr_len);
s_stats[mapped_prot + stat_offset]++;
pkt_data++;
}
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "Data length = %lu\n", len); );
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "ID = %lu\n", id); );
+ DebugFormat(DEBUG_INSPECTOR, "Data length = %lu\n", len);
+ DebugFormat(DEBUG_INSPECTOR, "ID = %lu\n", id);
/* Do more len checking */
if ( type & 0x80 )
{
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "Partial packet\n"); );
+ DebugMessage(DEBUG_INSPECTOR, "Partial packet\n");
}
if ( type & 0x40 )
{
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "Continued packet\n"); );
+ DebugMessage(DEBUG_INSPECTOR, "Continued packet\n");
}
/* Extract type of BO packet */
type = type & 0x3F;
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "Type = 0x%x\n", type); );
+ DebugFormat(DEBUG_INSPECTOR, "Type = 0x%x\n", type);
/* Only examine data if this is a ping request or response */
if ( type == BO_TYPE_PING )
if (*magic_data != plaintext)
{
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,
+ DebugFormat(DEBUG_INSPECTOR,
"Failed check one on 0x%X : 0x%X\n",
- *magic_data, plaintext); );
+ *magic_data, plaintext);
MODULE_PROFILE_END(boPerfStats);
return;
}
}
/* if we fall thru there's a detect */
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,
+ DebugMessage(DEBUG_INSPECTOR,
"Detected Back Orifice Data!\n");
- DebugMessage(DEBUG_PLUGIN, "hash value: %d\n", key); );
+ DebugFormat(DEBUG_INSPECTOR, "hash value: %d\n", key);
bo_direction = BoGetDirection(p, pkt_data);
if ( bo_direction == BO_FROM_CLIENT )
{
SnortEventqAdd(GID_BO, BO_CLIENT_TRAFFIC_DETECT);
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "Client packet\n"); );
+ DebugMessage(DEBUG_INSPECTOR, "Client packet\n");
}
else if ( bo_direction == BO_FROM_SERVER )
{
SnortEventqAdd(GID_BO, BO_SERVER_TRAFFIC_DETECT);
- DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "Server packet\n"); );
+ DebugMessage(DEBUG_INSPECTOR, "Server packet\n");
}
else
{
if ((dnsSessionData->curr_rec_state == DNS_RESP_STATE_Q_NAME) &&
(dnsSessionData->curr_rec == 0))
{
- DEBUG_WRAP(
- DebugMessage(DEBUG_DNS,
+ DebugFormat(DEBUG_DNS,
"DNS Header: length %d, id 0x%x, flags 0x%x, "
"questions %d, answers %d, authorities %d, additionals %d\n",
dnsSessionData->length, dnsSessionData->hdr.id,
dnsSessionData->hdr.answers,
dnsSessionData->hdr.authorities,
dnsSessionData->hdr.additionals);
- );
}
if (!(dnsSessionData->hdr.flags & DNS_HDR_FLAG_RESPONSE))
if (dnsSessionData->curr_rec_state == DNS_RESP_STATE_Q_COMPLETE)
{
- DEBUG_WRAP(
- DebugMessage(DEBUG_DNS,
+ DebugFormat(DEBUG_DNS,
"DNS Question %d: type %d, class %d\n",
i, dnsSessionData->curr_q.type,
dnsSessionData->curr_q.dns_class);
- );
+
dnsSessionData->curr_rec_state = DNS_RESP_STATE_Q_NAME;
dnsSessionData->curr_rec++;
}
switch (dnsSessionData->curr_rec_state)
{
case DNS_RESP_STATE_RR_RDATA_START:
- DEBUG_WRAP(
- DebugMessage(DEBUG_DNS,
+ DebugFormat(DEBUG_DNS,
"DNS ANSWER RR %d: type %d, class %d, "
"ttl %d rdlength %d\n", i,
dnsSessionData->curr_rr.type,
dnsSessionData->curr_rr.dns_class,
dnsSessionData->curr_rr.ttl,
dnsSessionData->curr_rr.length);
- );
dnsSessionData->bytes_seen_curr_rec = 0;
dnsSessionData->curr_rec_state = DNS_RESP_STATE_RR_RDATA_MID;
switch (dnsSessionData->curr_rec_state)
{
case DNS_RESP_STATE_RR_RDATA_START:
- DEBUG_WRAP(
- DebugMessage(DEBUG_DNS,
+ DebugFormat(DEBUG_DNS,
"DNS AUTH RR %d: type %d, class %d, "
"ttl %d rdlength %d\n", i,
dnsSessionData->curr_rr.type,
dnsSessionData->curr_rr.dns_class,
dnsSessionData->curr_rr.ttl,
dnsSessionData->curr_rr.length);
- );
dnsSessionData->bytes_seen_curr_rec = 0;
dnsSessionData->curr_rec_state = DNS_RESP_STATE_RR_RDATA_MID;
switch (dnsSessionData->curr_rec_state)
{
case DNS_RESP_STATE_RR_RDATA_START:
- DEBUG_WRAP(
- DebugMessage(DEBUG_DNS,
+ DebugFormat(DEBUG_DNS,
"DNS ADDITONAL RR %d: type %d, class %d, "
"ttl %d rdlength %d\n", i,
dnsSessionData->curr_rr.type,
dnsSessionData->curr_rr.dns_class,
dnsSessionData->curr_rr.ttl,
dnsSessionData->curr_rr.length);
- );
dnsSessionData->bytes_seen_curr_rec = 0;
dnsSessionData->curr_rec_state = DNS_RESP_STATE_RR_RDATA_MID;
if (iInspectMode == FTPP_SI_SERVER_MODE)
{
- DEBUG_WRAP(DebugMessage(DEBUG_FTPTELNET,
- "Server packet: %.*s\n", p->dsize, p->data));
+ DebugFormat(DEBUG_FTPTELNET,
+ "Server packet: %.*s\n", p->dsize, p->data);
// FIXIT-L breaks target-based non-standard ports
//if ( !ScPafEnabled() )
{
if ( !InspectClientPacket(p) )
{
- DEBUG_WRAP(DebugMessage(DEBUG_FTPTELNET,
- "Client packet will be reassembled\n"));
+ DebugMessage(DEBUG_FTPTELNET,
+ "Client packet will be reassembled\n");
MODULE_PROFILE_END(ftpPerfStats);
return FTPP_SUCCESS;
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_FTPTELNET,
+ DebugFormat(DEBUG_FTPTELNET,
"Client packet: rebuilt %s: %.*s\n",
(p->packet_flags & PKT_REBUILT_STREAM) ? "yes" : "no",
- p->dsize, p->data));
+ p->dsize, p->data);
}
}
if (!PROTO_IS_FTP(ftp_ssn))
{
- DEBUG_WRAP(DebugMessage(DEBUG_FTPTELNET,
- "FTP-DATA Invalid FTP_SESSION retrieved durring lookup\n"); );
+ DebugMessage(DEBUG_FTPTELNET,
+ "FTP-DATA Invalid FTP_SESSION retrieved durring lookup\n");
if (data_ssn->data_chan)
stream.set_ignore_direction(p->flow, SSN_DIR_BOTH);
/* Could check that response msg includes "TLS" */
session->encr_state = AUTH_TLS_ENCRYPTED;
SnortEventqAdd(GID_FTP, FTP_ENCRYPTED);
- DEBUG_WRAP(DebugMessage(DEBUG_FTPTELNET,
- "FTP stream is now TLS encrypted\n"); );
+ DebugMessage(DEBUG_FTPTELNET,
+ "FTP stream is now TLS encrypted\n");
}
break;
case AUTH_SSL_CMD_ISSUED:
/* Could check that response msg includes "SSL" */
session->encr_state = AUTH_SSL_ENCRYPTED;
SnortEventqAdd(GID_FTP, FTP_ENCRYPTED);
- DEBUG_WRAP(DebugMessage(DEBUG_FTPTELNET,
- "FTP stream is now SSL encrypted\n"); );
+ DebugMessage(DEBUG_FTPTELNET,
+ "FTP stream is now SSL encrypted\n");
}
break;
case AUTH_UNKNOWN_CMD_ISSUED:
{
session->encr_state = AUTH_UNKNOWN_ENCRYPTED;
SnortEventqAdd(GID_FTP, FTP_ENCRYPTED);
- DEBUG_WRAP(DebugMessage(DEBUG_FTPTELNET,
- "FTP stream is now encrypted\n"); );
+ DebugMessage(DEBUG_FTPTELNET,
+ "FTP stream is now encrypted\n");
}
break;
}
/* Mark this session & packet as one to ignore */
stream.stop_inspection(p->flow, p, SSN_DIR_BOTH, -1, 0);
}
- DEBUG_WRAP(DebugMessage(DEBUG_FTPTELNET,
- "FTP client stream is now encrypted\n"); );
+ DebugMessage(DEBUG_FTPTELNET,
+ "FTP client stream is now encrypted\n");
}
break;
}
/* Mark this session & packet as one to ignore */
stream.stop_inspection(p->flow, p, SSN_DIR_BOTH, -1, 0);
}
- DEBUG_WRAP(DebugMessage(DEBUG_FTPTELNET,
- "FTP server stream is now encrypted\n"); );
+ DebugMessage(DEBUG_FTPTELNET,
+ "FTP server stream is now encrypted\n");
}
break;
}
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_FTPTELNET,
- "invalid FTP response code."); );
+ DebugMessage(DEBUG_FTPTELNET,
+ "invalid FTP response code.");
ftpssn->server.response.state = FTP_RESPONSE_INV;
}
}
}
else if (!space && ftpssn->server.response.state == 0)
{
- DEBUG_WRAP(DebugMessage(DEBUG_FTPTELNET,
- "Missing LF from end of FTP command\n"); );
+ DebugMessage(DEBUG_FTPTELNET,
+ "Missing LF from end of FTP command\n");
}
else
{
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_FTPTELNET,
- "Missing LF from end of FTP command with params\n"); );
+ DebugMessage(DEBUG_FTPTELNET,
+ "Missing LF from end of FTP command with params\n");
}
}
}
/* Nothing left --> no parameters/message. Not even an LF */
req->param_begin = NULL;
req->param_end = NULL;
- DEBUG_WRAP(DebugMessage(DEBUG_FTPTELNET,
- "Missing LF from end of FTP command sans params\n"); );
+ DebugMessage(DEBUG_FTPTELNET,
+ "Missing LF from end of FTP command sans params\n");
}
/* Set the pointer for the next request/response
switch (state)
{
case FTP_CMD_INV:
- DEBUG_WRAP(DebugMessage(DEBUG_FTPTELNET,
+ DebugFormat(DEBUG_FTPTELNET,
"Illegal FTP command found: %.*s\n",
- req->cmd_size, req->cmd_begin));
+ req->cmd_size, req->cmd_begin);
iRet = FTPP_ALERT;
break;
case FTP_RESPONSE: /* Response */
- DEBUG_WRAP(DebugMessage(DEBUG_FTPTELNET,
+ DebugFormat(DEBUG_FTPTELNET,
"FTP response: code: %.*s : M len %d : M %.*s\n",
req->cmd_size, req->cmd_begin, req->param_size,
- req->param_size, req->param_begin));
+ req->param_size, req->param_begin);
if ((ftpssn->client_conf->max_resp_len > 0) &&
(req->param_size > ftpssn->client_conf->max_resp_len))
{
}
break;
case FTP_RESPONSE_CONT: /* Response continued */
- DEBUG_WRAP(DebugMessage(DEBUG_FTPTELNET,
+ DebugFormat(DEBUG_FTPTELNET,
"FTP response: continuation of code: %d : M len %d : M %.*s\n",
ftpssn->server.response.state, req->param_size,
- req->param_size, req->param_begin));
+ req->param_size, req->param_begin);
if ((ftpssn->client_conf->max_resp_len > 0) &&
(req->param_size > ftpssn->client_conf->max_resp_len))
{
}
break;
case FTP_RESPONSE_ENDCONT: /* Continued response end */
- DEBUG_WRAP(DebugMessage(DEBUG_FTPTELNET,
+ DebugFormat(DEBUG_FTPTELNET,
"FTP response: final continue of code: %.*s : M len %d : "
"M %.*s\n", req->cmd_size, req->cmd_begin,
- req->param_size, req->param_size, req->param_begin));
+ req->param_size, req->param_size, req->param_begin);
if ((ftpssn->client_conf->max_resp_len > 0) &&
(req->param_size > ftpssn->client_conf->max_resp_len))
{
}
break;
default:
- DEBUG_WRAP(DebugMessage(DEBUG_FTPTELNET, "FTP command: CMD: %.*s : "
+ DebugFormat(DEBUG_FTPTELNET, "FTP command: CMD: %.*s : "
"P len %d : P %.*s\n", req->cmd_size, req->cmd_begin,
- req->param_size, req->param_size, req->param_begin));
+ req->param_size, req->param_size, req->param_begin);
if (CmdConf)
{
unsigned max = CmdConf->max_param_len;
{
/* Alert on param length overrun */
SnortEventqAdd(GID_FTP, FTP_PARAMETER_LENGTH_OVERFLOW);
- DEBUG_WRAP(DebugMessage(DEBUG_FTPTELNET, "FTP command: %.*s"
+ DebugFormat(DEBUG_FTPTELNET, "FTP command: %.*s"
"parameter length overrun %d > %d \n",
- req->cmd_size, req->cmd_begin, req->param_size, max));
+ req->cmd_size, req->cmd_begin, req->param_size, max);
iRet = FTPP_ALERT;
}
if (!normalization_required)
{
- DEBUG_WRAP(DebugMessage(DEBUG_FTPTELNET, "Nothing to process!\n"); );
+ DebugMessage(DEBUG_FTPTELNET, "Nothing to process!\n");
if (tnssn && iMode == FTPP_SI_CLIENT_MODE)
tnssn->consec_ayt = 0;
return FTPP_SUCCESS;
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_FTPTELNET,
+ DebugFormat(DEBUG_FTPTELNET,
"overwriting %2X(%c) with %2X(%c)\n",
(unsigned char)(*write_ptr&0xFF), *write_ptr,
- (unsigned char)(*read_ptr & 0xFF), *read_ptr); );
+ (unsigned char)(*read_ptr & 0xFF), *read_ptr);
/* overwrite the negotiation bytes with the follow-on bytes */
switch (*((unsigned char*)(read_ptr)))
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_HTTPINSPECT,
+ DebugFormat(DEBUG_HTTPINSPECT,
"HttpInspect: no leading header: %d to %d\n",
- this_header_end - this_header_start, this_header_len); );
+ this_header_end - this_header_start, this_header_len);
}
/* Trim the cookie and only copy what we can store in the buf */
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_HTTPINSPECT, "HttpInspect: trimming cookie: %d to %d\n",
- cookie->cookie_end - cookie->cookie, this_cookie_len); );
+ DebugFormat(DEBUG_HTTPINSPECT, "HttpInspect: trimming cookie: %d to %d\n",
+ cookie->cookie_end - cookie->cookie, this_cookie_len);
}
/* update for the next one */
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_HTTPINSPECT,
+ DebugFormat(DEBUG_HTTPINSPECT,
"HttpInspect: no leading header: %d to %d\n",
- this_header_end - this_header_start, this_header_len); );
+ this_header_end - this_header_start, this_header_len);
}
}
hi_fsm = (State*)malloc(hi_fsm_size*sizeof(*hi_fsm));
if ( hi_fsm == NULL )
{
- DEBUG_WRAP(DebugMessage(DEBUG_STREAM_PAF, "Unable to allocate memory for hi_fsm."); );
+ DebugMessage(DEBUG_STREAM_PAF, "Unable to allocate memory for hi_fsm.");
return false;
}
next = max;
break;
case ACT_LNB:
s->flags |= HIF_LEN;
- DEBUG_WRAP(DebugMessage(DEBUG_STREAM_PAF,
- "%s: lnb=%u\n", __FUNCTION__, s->len); )
+ DebugFormat(DEBUG_STREAM_PAF,
+ "%s: lnb=%u\n", __FUNCTION__, s->len);
break;
case ACT_LNC:
s->flags |= HIF_LEN;
- DEBUG_WRAP(DebugMessage(DEBUG_STREAM_PAF,
- "%s: lnc=%u\n", __FUNCTION__, s->len); )
+ DebugFormat(DEBUG_STREAM_PAF,
+ "%s: lnc=%u\n", __FUNCTION__, s->len);
if ( s->len )
return StreamSplitter::SKIP;
s->flags &= ~HIF_NOF;
uint32_t nreq = s_req->pipe & 0xFF;
uint32_t pipe = s_req->pipe >> 8;
- DEBUG_WRAP(DebugMessage(DEBUG_STREAM_PAF,
- "%s: nreq=%d, pipe=0x%X\n", __FUNCTION__, nreq, pipe); )
+ DebugFormat(DEBUG_STREAM_PAF,
+ "%s: nreq=%d, pipe=0x%X\n", __FUNCTION__, nreq, pipe);
if ( nreq == MAX_PIPELINE )
{
uint32_t nreq = s_req->pipe & 0xFF;
uint32_t pipe = s_req->pipe >> 8;
- DEBUG_WRAP(DebugMessage(DEBUG_STREAM_PAF,
- "%s: nreq=%d, pipe=0x%X\n", __FUNCTION__, nreq, pipe); )
+ DebugFormat(DEBUG_STREAM_PAF,
+ "%s: nreq=%d, pipe=0x%X\n", __FUNCTION__, nreq, pipe);
// FIXIT-L valgrind: Conditional jump or move depends on uninitialised value(s)
if ( nreq == 0 || nreq == PIPELINE_RUPTURED )
#ifdef HI_TRACE
get_state(prev, before, sizeof(before));
get_state(s->fsm, after, sizeof(after));
- DEBUG_WRAP(DebugMessage(DEBUG_STREAM_PAF,
+ DebugFormat(DEBUG_STREAM_PAF,
"%s: %s(%u)[0x%2X, '%c'] -> %d,%s(%u)\n",
__FUNCTION__, before, prev, c, isgraph(c) ? c : '.',
- cell->action, after, s->fsm); )
+ cell->action, after, s->fsm);
#endif
status = hi_exec(s, (Action)cell->action, c);
static StreamSplitter::Status hi_eoh(Hi5State* s, Flow* ssn)
{
- DEBUG_WRAP(DebugMessage(DEBUG_STREAM_PAF,
- "%s: flags=0x%X, len=%u\n", __FUNCTION__, s->flags, s->len); )
+ DebugFormat(DEBUG_STREAM_PAF,
+ "%s: flags=0x%X, len=%u\n", __FUNCTION__, s->flags, s->len);
if ( (s->flags & HIF_REQ) )
hi_pipe_push(s, ssn);
Hi5State* s, int c, uint32_t* fp, Flow* ssn)
{
StreamSplitter::Status paf = StreamSplitter::SEARCH;
- DEBUG_WRAP(DebugMessage(DEBUG_STREAM_PAF,
- "%s[%d]: 0x%2X, '%c'\n", __FUNCTION__, s->msg, c, isgraph(c) ? c : '.'); )
+ DebugFormat(DEBUG_STREAM_PAF,
+ "%s[%d]: 0x%2X, '%c'\n", __FUNCTION__, s->msg, c, isgraph(c) ? c : '.');
if ( c == '\r' )
{
}
s->flags = 0;
- DEBUG_WRAP(DebugMessage(DEBUG_STREAM_PAF,
- "%s: fsm=%u, flags=0x%X\n", __FUNCTION__, s->fsm, s->flags); )
+ DebugFormat(DEBUG_STREAM_PAF,
+ "%s: fsm=%u, flags=0x%X\n", __FUNCTION__, s->fsm, s->flags);
}
//--------------------------------------------------------------------
uint32_t n = 0;
*fp = 0;
- DEBUG_WRAP(DebugMessage(DEBUG_STREAM_PAF,
- "%s: len=%u\n", __FUNCTION__, len); )
+ DebugFormat(DEBUG_STREAM_PAF, "%s: len=%u\n", __FUNCTION__, len);
if ( hip->flags & HIF_ERR )
{
break;
}
}
- DEBUG_WRAP(DebugMessage(DEBUG_STREAM_PAF,
- "%s: paf=%d, rfp=%u\n", __FUNCTION__, paf, *fp); )
+ DebugFormat(DEBUG_STREAM_PAF,
+ "%s: paf=%d, rfp=%u\n", __FUNCTION__, paf, *fp);
hi_paf_calls++;
hi_paf_bytes += n;
bool hi_paf_init(uint32_t cap)
{
- DEBUG_WRAP(DebugMessage(DEBUG_STREAM_PAF,
- "%s: cap=%u\n", __FUNCTION__, cap); )
+ DebugFormat(DEBUG_STREAM_PAF,
+ "%s: cap=%u\n", __FUNCTION__, cap);
hi_cap = cap;
void hi_paf_term(void)
{
free(hi_fsm);
- DEBUG_WRAP(DebugMessage(DEBUG_STREAM_PAF,
+ DebugFormat(DEBUG_STREAM_PAF,
"%s: calls=%u, bytes=%u\n", __FUNCTION__,
- hi_paf_calls, hi_paf_bytes); )
+ hi_paf_calls, hi_paf_bytes);
hi_fsm = NULL;
hi_fsm_size = 0;
if (p->packet_flags & SSNFLAG_MIDSTREAM)
{
- DEBUG_WRAP(DebugMessage(DEBUG_IMAP, "Got midstream packet - "
- "setting state to unknown\n"); );
+ DebugMessage(DEBUG_IMAP, "Got midstream packet - "
+ "setting state to unknown\n");
imap_ssn->state = STATE_UNKNOWN;
}
if (ssn->session_flags & IMAP_FLAG_NEXT_STATE_UNKNOWN)
{
- DEBUG_WRAP(DebugMessage(DEBUG_IMAP, "Found gap in previous reassembly buffer - "
- "set state to unknown\n"); );
+ DebugMessage(DEBUG_IMAP, "Found gap in previous reassembly buffer - "
+ "set state to unknown\n");
ssn->state = STATE_UNKNOWN;
ssn->session_flags &= ~IMAP_FLAG_NEXT_STATE_UNKNOWN;
}
if (missing_in_rebuilt == SSN_MISSING_BEFORE)
{
- DEBUG_WRAP(DebugMessage(DEBUG_IMAP, "Found missing packets before "
- "in reassembly buffer - set state to unknown\n"); );
+ DebugMessage(DEBUG_IMAP, "Found missing packets before "
+ "in reassembly buffer - set state to unknown\n");
ssn->state = STATE_UNKNOWN;
}
}
{
if (imap_ssn->state == STATE_UNKNOWN)
{
- DEBUG_WRAP(DebugMessage(DEBUG_IMAP, "Command not found, but state is "
- "unknown - checking for SSL\n"); );
+ DebugMessage(DEBUG_IMAP, "Command not found, but state is "
+ "unknown - checking for SSL\n");
/* check for encrypted */
if ((imap_ssn->session_flags & IMAP_FLAG_CHECK_SSL) &&
(IsSSL(ptr, end - ptr, p->packet_flags)))
{
- DEBUG_WRAP(DebugMessage(DEBUG_IMAP, "Packet is SSL encrypted\n"); );
+ DebugMessage(DEBUG_IMAP, "Packet is SSL encrypted\n");
imap_ssn->state = STATE_TLS_DATA;
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_IMAP, "Not SSL - try data state\n"); );
+ DebugMessage(DEBUG_IMAP, "Not SSL - try data state\n");
/* don't check for ssl again in this packet */
if (imap_ssn->session_flags & IMAP_FLAG_CHECK_SSL)
imap_ssn->session_flags &= ~IMAP_FLAG_CHECK_SSL;
else
{
SnortEventqAdd(GID_IMAP, IMAP_UNKNOWN_CMD);
- DEBUG_WRAP(DebugMessage(DEBUG_IMAP, "No known command found\n"); );
+ DebugMessage(DEBUG_IMAP, "No known command found\n");
return eol;
}
}
{
if (imap_ssn->state == STATE_DATA)
{
- DEBUG_WRAP(DebugMessage(DEBUG_IMAP, "DATA STATE ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n"); );
+ DebugMessage(DEBUG_IMAP, "DATA STATE ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n");
if ( imap_ssn->body_len > imap_ssn->body_read)
{
uint32_t len = imap_ssn->body_len - imap_ssn->body_read;
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_IMAP,
- "Server response not found - see if it's SSL data\n"); );
+ DebugMessage(DEBUG_IMAP,
+ "Server response not found - see if it's SSL data\n");
if ((imap_ssn->session_flags & IMAP_FLAG_CHECK_SSL) &&
(IsSSL(ptr, end - ptr, p->packet_flags)))
{
- DEBUG_WRAP(DebugMessage(DEBUG_IMAP, "Server response is an SSL packet\n"); );
+ DebugMessage(DEBUG_IMAP, "Server response is an SSL packet\n");
imap_ssn->state = STATE_TLS_DATA;
if ( (*ptr != '*') && (*ptr !='+') && (*ptr != '\r') && (*ptr != '\n') )
{
SnortEventqAdd(GID_IMAP, IMAP_UNKNOWN_RESP);
- DEBUG_WRAP(DebugMessage(DEBUG_IMAP, "Server response not found\n"); );
+ DebugMessage(DEBUG_IMAP, "Server response not found\n");
}
}
{
if (IsTlsClientHello(p->data, p->data + p->dsize))
{
- DEBUG_WRAP(DebugMessage(DEBUG_IMAP,
- "TLS DATA STATE ~~~~~~~~~~~~~~~~~~~~~~~~~\n"); );
+ DebugMessage(DEBUG_IMAP,
+ "TLS DATA STATE ~~~~~~~~~~~~~~~~~~~~~~~~~\n");
imap_ssn->state = STATE_TLS_SERVER_PEND;
return;
return;
}
IMAP_ProcessClientPacket(p, imap_ssn);
- DEBUG_WRAP(DebugMessage(DEBUG_IMAP, "IMAP client packet\n"); );
+ DebugMessage(DEBUG_IMAP, "IMAP client packet\n");
}
else
{
if ( !InspectPacket(p))
{
/* Packet will be rebuilt, so wait for it */
- DEBUG_WRAP(DebugMessage(DEBUG_IMAP, "Client packet will be reassembled\n"));
+ DebugMessage(DEBUG_IMAP, "Client packet will be reassembled\n");
return;
}
else if (!(p->packet_flags & PKT_REBUILT_STREAM))
* that were not rebuilt, state is going to be messed up
* so set state to unknown. It's likely this was the
* beginning of the conversation so reset state */
- DEBUG_WRAP(DebugMessage(DEBUG_IMAP, "Got non-rebuilt packets before "
- "this rebuilt packet\n"); );
+ DebugMessage(DEBUG_IMAP, "Got non-rebuilt packets before "
+ "this rebuilt packet\n");
imap_ssn->state = STATE_UNKNOWN;
imap_ssn->session_flags &= ~IMAP_FLAG_GOT_NON_REBUILT;
if (literal_complete(pfdata)
&& check_imap_data_end(&(pfdata->data_end_state), ch))
{
- DEBUG_WRAP(DebugMessage(DEBUG_IMAP, "IMAP PAF: End of Data!\n"); );
+ DebugMessage(DEBUG_IMAP, "IMAP PAF: End of Data!\n");
reset_data_states(pfdata);
return true;
}
// check for mime flush point
if (file_api->process_mime_paf_data(&(pfdata->mime_info), ch))
{
- DEBUG_WRAP(DebugMessage(DEBUG_IMAP, "IMAP PAF: Mime Boundary found."
- " Flushing data!\n"); );
+ DebugMessage(DEBUG_IMAP, "IMAP PAF: Mime Boundary found."
+ " Flushing data!\n");
return true;
}
if (flush_len)
{
- DEBUG_WRAP(DebugMessage(DEBUG_IMAP, "IMAP PAF: flushing data!\n"); );
+ DebugMessage(DEBUG_IMAP, "IMAP PAF: flushing data!\n");
// flush at the final termination sequence
*fp = flush_len;
if (pch != NULL)
{
- DEBUG_WRAP(DebugMessage(DEBUG_IMAP, "IMAP PAF: Flushing client"
- " data!\n"); );
+ DebugMessage(DEBUG_IMAP, "IMAP PAF: Flushing client"
+ " data!\n");
*fp = (uint32_t)(pch - (const char*)data) + 1;
return StreamSplitter::FLUSH;
}
if (flags & PKT_FROM_SERVER)
{
- DEBUG_WRAP(DebugMessage(DEBUG_IMAP, "PAF: From server.\n"); );
+ DebugMessage(DEBUG_IMAP, "PAF: From server.\n");
return imap_paf_server(pfdata, data, len, fp);
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_IMAP, "PAF: From client.\n"); );
+ DebugMessage(DEBUG_IMAP, "PAF: From client.\n");
return imap_paf_client(data, len, fp);
}
}
if (p->packet_flags & SSNFLAG_MIDSTREAM)
{
- DEBUG_WRAP(DebugMessage(DEBUG_POP, "Got midstream packet - "
- "setting state to unknown\n"); );
+ DebugMessage(DEBUG_POP, "Got midstream packet - "
+ "setting state to unknown\n");
pop_ssn->state = STATE_UNKNOWN;
}
if (ssn->session_flags & POP_FLAG_NEXT_STATE_UNKNOWN)
{
- DEBUG_WRAP(DebugMessage(DEBUG_POP, "Found gap in previous reassembly buffer - "
- "set state to unknown\n"); );
+ DebugMessage(DEBUG_POP, "Found gap in previous reassembly buffer - "
+ "set state to unknown\n");
ssn->state = STATE_UNKNOWN;
ssn->session_flags &= ~POP_FLAG_NEXT_STATE_UNKNOWN;
}
if (missing_in_rebuilt == SSN_MISSING_BEFORE)
{
- DEBUG_WRAP(DebugMessage(DEBUG_POP, "Found missing packets before "
- "in reassembly buffer - set state to unknown\n"); );
+ DebugMessage(DEBUG_POP, "Found missing packets before "
+ "in reassembly buffer - set state to unknown\n");
ssn->state = STATE_UNKNOWN;
}
}
{
if (pop_ssn->state == STATE_UNKNOWN)
{
- DEBUG_WRAP(DebugMessage(DEBUG_POP, "Command not found, but state is "
- "unknown - checking for SSL\n"); );
+ DebugMessage(DEBUG_POP, "Command not found, but state is "
+ "unknown - checking for SSL\n");
/* check for encrypted */
if ((pop_ssn->session_flags & POP_FLAG_CHECK_SSL) &&
(IsSSL(ptr, end - ptr, p->packet_flags)))
{
- DEBUG_WRAP(DebugMessage(DEBUG_POP, "Packet is SSL encrypted\n"); );
+ DebugMessage(DEBUG_POP, "Packet is SSL encrypted\n");
pop_ssn->state = STATE_TLS_DATA;
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_POP, "Not SSL - try data state\n"); );
+ DebugMessage(DEBUG_POP, "Not SSL - try data state\n");
/* don't check for ssl again in this packet */
if (pop_ssn->session_flags & POP_FLAG_CHECK_SSL)
pop_ssn->session_flags &= ~POP_FLAG_CHECK_SSL;
else
{
SnortEventqAdd(GID_POP, POP_UNKNOWN_CMD);
- DEBUG_WRAP(DebugMessage(DEBUG_POP, "No known command found\n"); );
+ DebugMessage(DEBUG_POP, "No known command found\n");
return eol;
}
}
{
if (pop_ssn->state == STATE_DATA)
{
- DEBUG_WRAP(DebugMessage(DEBUG_POP, "DATA STATE ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n"); );
+ DebugMessage(DEBUG_POP, "DATA STATE ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n");
//ptr = POP_HandleData(p, ptr, end);
FilePosition position = file_api->get_file_position(p);
ptr = file_api->process_mime_data(p->flow, ptr, end, &(pop_ssn->mime_ssn), 0,
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_POP,
- "Server response not found - see if it's SSL data\n"); );
+ DebugMessage(DEBUG_POP,
+ "Server response not found - see if it's SSL data\n");
if ((pop_ssn->session_flags & POP_FLAG_CHECK_SSL) &&
(IsSSL(ptr, end - ptr, p->packet_flags)))
{
- DEBUG_WRAP(DebugMessage(DEBUG_POP, "Server response is an SSL packet\n"); );
+ DebugMessage(DEBUG_POP, "Server response is an SSL packet\n");
pop_ssn->state = STATE_TLS_DATA;
else if (*ptr == '+')
{
SnortEventqAdd(GID_POP, POP_UNKNOWN_RESP);
- DEBUG_WRAP(DebugMessage(DEBUG_POP, "Server response not found\n"); );
+ DebugMessage(DEBUG_POP, "Server response not found\n");
}
}
{
if (IsTlsClientHello(p->data, p->data + p->dsize))
{
- DEBUG_WRAP(DebugMessage(DEBUG_POP,
- "TLS DATA STATE ~~~~~~~~~~~~~~~~~~~~~~~~~\n"); );
+ DebugMessage(DEBUG_POP,
+ "TLS DATA STATE ~~~~~~~~~~~~~~~~~~~~~~~~~\n");
pop_ssn->state = STATE_TLS_SERVER_PEND;
return;
return;
}
POP_ProcessClientPacket(p, pop_ssn);
- DEBUG_WRAP(DebugMessage(DEBUG_POP, "POP client packet\n"); );
+ DebugMessage(DEBUG_POP, "POP client packet\n");
}
else
{
if ( !InspectPacket(p))
{
/* Packet will be rebuilt, so wait for it */
- DEBUG_WRAP(DebugMessage(DEBUG_POP, "Client packet will be reassembled\n"));
+ DebugMessage(DEBUG_POP, "Client packet will be reassembled\n");
return;
}
else if (!(p->packet_flags & PKT_REBUILT_STREAM))
* that were not rebuilt, state is going to be messed up
* so set state to unknown. It's likely this was the
* beginning of the conversation so reset state */
- DEBUG_WRAP(DebugMessage(DEBUG_POP, "Got non-rebuilt packets before "
- "this rebuilt packet\n"); );
+ DebugMessage(DEBUG_POP, "Got non-rebuilt packets before "
+ "this rebuilt packet\n");
pop_ssn->state = STATE_UNKNOWN;
pop_ssn->session_flags &= ~POP_FLAG_GOT_NON_REBUILT;
if (file_api->check_data_end(&(pfdata->end_state), ch))
{
- DEBUG_WRAP(DebugMessage(DEBUG_POP, "End of Multi-line response found\n"); );
+ DebugMessage(DEBUG_POP, "End of Multi-line response found\n");
pfdata->end_of_data = true;
pfdata->pop_state = POP_PAF_SINGLE_LINE_STATE;
reset_data_states(pfdata);
{
if (file_api->process_mime_paf_data(&(pfdata->data_info), ch))
{
- DEBUG_WRAP(DebugMessage(DEBUG_POP, "Mime Boundary found. Flushing data!\n"); );
+ DebugMessage(DEBUG_POP, "Mime Boundary found. Flushing data!\n");
pfdata->cmd_continued = true;
return true;
}
else
reset_data_states(pfdata);
- DEBUG_WRAP(DebugMessage(DEBUG_POP, "End of single-line response "
- "found. Flushing data!\n"); );
+ DebugMessage(DEBUG_POP, "End of single-line response "
+ "found. Flushing data!\n");
return true;
}
if (flags & PKT_FROM_SERVER)
{
- DEBUG_WRAP(DebugMessage(DEBUG_POP, "PAF: From server.\n"); );
+ DebugMessage(DEBUG_POP, "PAF: From server.\n");
return pop_paf_server(pfdata, data, len, fp);
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_POP, "PAF: From client.\n"); );
+ DebugMessage(DEBUG_POP, "PAF: From client.\n");
return pop_paf_client(ssn, pfdata, data, len, fp);
}
}
int need;
RpcStatus status;
- DEBUG_WRAP(DebugMessage(DEBUG_RPC,
- "STATEFUL: Start *******************************\n"); );
- DEBUG_WRAP(DebugMessage(DEBUG_RPC,
- "STATEFUL: Ssn: %p\n", rsdata); );
+ DebugMessage(DEBUG_RPC,
+ "STATEFUL: Start *******************************\n");
+ DebugFormat(DEBUG_RPC,
+ "STATEFUL: Ssn: %p\n", rsdata);
if ((rsdata->nseq != seq) && (rsdata->nseq != 0))
{
if (rsdata->nseq < seq)
{
/* Missed packets - stop tracking */
- DEBUG_WRAP(DebugMessage(DEBUG_RPC,
- "STATEFUL: Missed data\n"); );
+ DebugMessage(DEBUG_RPC,
+ "STATEFUL: Missed data\n");
return RPC_STATUS__ERROR;
}
overlap = rsdata->nseq - seq;
if (dsize <= overlap)
{
- DEBUG_WRAP(DebugMessage(DEBUG_RPC,
- "STATEFUL: All data overlapped\n"); );
+ DebugMessage(DEBUG_RPC,
+ "STATEFUL: All data overlapped\n");
return RPC_STATUS__SUCCESS;
}
{
if (dsize < rsdata->ignore)
{
- DEBUG_WRAP(DebugMessage(DEBUG_RPC,
- "STATEFUL: Ignoring %u bytes\n", dsize); );
+ DebugFormat(DEBUG_RPC,
+ "STATEFUL: Ignoring %u bytes\n", dsize);
rsdata->ignore -= dsize;
- DEBUG_WRAP(DebugMessage(DEBUG_RPC,
- "STATEFUL: Bytes left to ignore: %u \n", rsdata->ignore); );
+ DebugFormat(DEBUG_RPC,
+ "STATEFUL: Bytes left to ignore: %u \n", rsdata->ignore);
return RPC_STATUS__SUCCESS;
}
- DEBUG_WRAP(DebugMessage(DEBUG_RPC,
- "STATEFUL: Ignoring %u bytes\n", rsdata->ignore); );
+ DebugFormat(DEBUG_RPC,
+ "STATEFUL: Ignoring %u bytes\n", rsdata->ignore);
dsize -= (uint16_t)rsdata->ignore;
data += rsdata->ignore;
{
if (dsize < RPC_FRAG_HDR_SIZE)
{
- DEBUG_WRAP(DebugMessage(DEBUG_RPC,
+ DebugFormat(DEBUG_RPC,
"STATEFUL: Not enough data for frag header: %u\n",
- dsize); );
+ dsize);
RpcPreprocEvent(rconfig, rsdata, RPC_INCOMPLETE_SEGMENT);
rsdata->frag_len = RPC_FRAG_LEN(data);
- DEBUG_WRAP(DebugMessage(DEBUG_RPC,
- "STATEFUL: Fragment length: %u\n", rsdata->frag_len); );
+ DebugFormat(DEBUG_RPC,
+ "STATEFUL: Fragment length: %u\n", rsdata->frag_len);
if (dsize < (RPC_FRAG_HDR_SIZE + rsdata->frag_len))
{
- DEBUG_WRAP(DebugMessage(DEBUG_RPC,
+ DebugFormat(DEBUG_RPC,
"STATEFUL: Not enough data for fragment: %u\n",
- dsize); );
+ dsize);
RpcPreprocEvent(rconfig, rsdata, RPC_INCOMPLETE_SEGMENT);
if (status == RPC_STATUS__DEFRAG)
{
- DEBUG_WRAP(DebugMessage(DEBUG_RPC,
- "STATEFUL: Last frag - calling detect\n"); );
+ DebugMessage(DEBUG_RPC,
+ "STATEFUL: Last frag - calling detect\n");
if ((dsize != 0) || (data != p->data))
{
need = RPC_FRAG_HDR_SIZE - RpcBufLen(&rsdata->seg);
if (dsize < need)
{
- DEBUG_WRAP(DebugMessage(DEBUG_RPC,
+ DebugFormat(DEBUG_RPC,
"STATEFUL: Not enough data for frag header "
- "(%u): %u\n", need, dsize); );
+ "(%u): %u\n", need, dsize);
RpcPreprocEvent(rconfig, rsdata, RPC_INCOMPLETE_SEGMENT);
rsdata->frag_len = RPC_FRAG_LEN(RpcBufData(&rsdata->seg));
- DEBUG_WRAP(DebugMessage(DEBUG_RPC,
- "STATEFUL: Fragment length: %u\n", rsdata->frag_len); );
+ DebugFormat(DEBUG_RPC,
+ "STATEFUL: Fragment length: %u\n", rsdata->frag_len);
}
need = rsdata->frag_len - (RpcBufLen(&rsdata->seg) - RPC_FRAG_HDR_SIZE);
if (dsize < need)
{
- DEBUG_WRAP(DebugMessage(DEBUG_RPC,
+ DebugFormat(DEBUG_RPC,
"STATEFUL: Not enough data for fragment (%u): %u\n",
- need, dsize); );
+ need, dsize);
RpcPreprocEvent(rconfig, rsdata, RPC_INCOMPLETE_SEGMENT);
return RPC_STATUS__ERROR;
}
- DEBUG_WRAP(DebugMessage(DEBUG_RPC,
- "STATEFUL: Last frag - calling detect\n"); );
+ DebugMessage(DEBUG_RPC,
+ "STATEFUL: Last frag - calling detect\n");
if ( (dsize > 0) )
RpcPreprocEvent(rconfig, rsdata, RPC_MULTIPLE_RECORD);
if (RpcBufLen(&rsdata->frag) != 0)
{
- DEBUG_WRAP(DebugMessage(DEBUG_RPC,
+ DebugFormat(DEBUG_RPC,
"STATEFUL: Prepping Frag data: %u\n",
- RpcBufLen(&rsdata->frag)); );
+ RpcBufLen(&rsdata->frag));
if (RpcPrepFrag(rsdata, p) != RPC_STATUS__SUCCESS)
return RPC_STATUS__ERROR;
}
else if (RpcBufLen(&rsdata->seg) != 0)
{
- DEBUG_WRAP(DebugMessage(DEBUG_RPC,
+ DebugFormat(DEBUG_RPC,
"STATEFUL: Prepping Seg data: %u\n",
- RpcBufLen(&rsdata->seg)); );
+ RpcBufLen(&rsdata->seg));
if (RpcPrepSeg(rsdata, p) != RPC_STATUS__SUCCESS)
return RPC_STATUS__ERROR;
}
- DEBUG_WRAP(DebugMessage(DEBUG_RPC,
- "STATEFUL: Success *****************************\n"); );
+ DebugMessage(DEBUG_RPC,
+ "STATEFUL: Success *****************************\n");
return RPC_STATUS__SUCCESS;
}
if (status != SAFEMEM_SUCCESS)
{
- DEBUG_WRAP(DebugMessage(DEBUG_RPC,
- "STATEFUL: Failed to copy raw data to alt buffer\n"); );
+ DebugMessage(DEBUG_RPC,
+ "STATEFUL: Failed to copy raw data to alt buffer\n");
return RPC_STATUS__ERROR;
}
if (status != SAFEMEM_SUCCESS)
{
- DEBUG_WRAP(DebugMessage(DEBUG_RPC,
- "STATEFUL: Failed to copy frag data to alt buffer\n"); );
+ DebugMessage(DEBUG_RPC,
+ "STATEFUL: Failed to copy frag data to alt buffer\n");
RpcBufClean(&rsdata->frag);
return RPC_STATUS__ERROR;
}
if (status != SAFEMEM_SUCCESS)
{
- DEBUG_WRAP(DebugMessage(DEBUG_RPC,
- "STATEFUL: Failed to copy seg data to alt buffer\n"); );
+ DebugMessage(DEBUG_RPC,
+ "STATEFUL: Failed to copy seg data to alt buffer\n");
RpcBufClean(&rsdata->seg);
return RPC_STATUS__ERROR;
}
if (RpcBufLen(&rsdata->seg) > RPC_MAX_BUF_SIZE)
{
rsdata->ignore = (sizeof(uint32_t) + rsdata->frag_len) - RpcBufLen(&rsdata->seg);
- DEBUG_WRAP(DebugMessage(DEBUG_RPC,
- "STATEFUL: Ignoring %u bytes\n", rsdata->ignore); );
+ DebugFormat(DEBUG_RPC,
+ "STATEFUL: Ignoring %u bytes\n", rsdata->ignore);
RpcBufClean(&rsdata->seg);
}
if ((RpcBufLen(&rsdata->frag) == 0) && last_frag)
return RPC_STATUS__DEFRAG;
- DEBUG_WRAP(DebugMessage(DEBUG_RPC,
- "STATEFUL: Adding %u bytes to frag buffer\n", frag_len); );
+ DebugFormat(DEBUG_RPC,
+ "STATEFUL: Adding %u bytes to frag buffer\n", frag_len);
if (RpcBufAdd(&rsdata->frag,
fragment + sizeof(uint32_t), frag_len) != RPC_STATUS__SUCCESS)
buf->data = (uint8_t*)RpcAlloc(alloc_size);
if (buf->data == NULL)
{
- DEBUG_WRAP(DebugMessage(DEBUG_RPC,
- "STATEFUL: Failed to allocate buffer data\n"); );
+ DebugMessage(DEBUG_RPC,
+ "STATEFUL: Failed to allocate buffer data\n");
return RPC_STATUS__ERROR;
}
if (tmp == NULL)
{
- DEBUG_WRAP(DebugMessage(DEBUG_RPC,
- "STATEFUL: Failed to reallocate buffer data\n"); );
+ DebugMessage(DEBUG_RPC,
+ "STATEFUL: Failed to reallocate buffer data\n");
RpcBufClean(buf);
return RPC_STATUS__ERROR;
}
if (status != SAFEMEM_SUCCESS)
{
- DEBUG_WRAP(DebugMessage(DEBUG_RPC,
- "STATEFUL: Failed to move buffer data\n"); );
+ DebugMessage(DEBUG_RPC,
+ "STATEFUL: Failed to move buffer data\n");
RpcBufClean(buf);
return RPC_STATUS__ERROR;
}
buf->data + buf->len, buf->data + buf->size);
if (status != SAFEMEM_SUCCESS)
{
- DEBUG_WRAP(DebugMessage(DEBUG_RPC,
- "STATEFUL: Failed to copy data to buffer\n"); );
+ DebugMessage(DEBUG_RPC,
+ "STATEFUL: Failed to copy data to buffer\n");
RpcBufClean(buf);
return RPC_STATUS__ERROR;
}
{
if ((rpc_memory + size) > rpc_memcap)
{
- DEBUG_WRAP(DebugMessage(DEBUG_RPC, "STATEFUL: Memcap exceeded\n"); );
+ DebugMessage(DEBUG_RPC, "STATEFUL: Memcap exceeded\n");
return NULL;
}
if (rsdata == NULL)
return;
- DEBUG_WRAP(DebugMessage(DEBUG_RPC, "STATEFUL: Deactivating session: %p\n",
- rsdata); );
+ DebugFormat(DEBUG_RPC, "STATEFUL: Deactivating session: %p\n",
+ rsdata);
RpcSsnClean(rsdata);
}
p->flow->set_application_data(fd);
- DEBUG_WRAP(DebugMessage(DEBUG_RPC, "STATEFUL: Created new session: " "%p\n", rsdata); );
+ DebugFormat(DEBUG_RPC, "STATEFUL: Created new session: " "%p\n", rsdata);
return rsdata;
}
if (psize < MIN_CALL_BODY_SZ)
{
- DEBUG_WRAP(DebugMessage(DEBUG_RPC, "Not enough data to decode: %u\n",
- psize); );
+ DebugFormat(DEBUG_RPC, "Not enough data to decode: %u\n",
+ psize);
return 0;
}
/* on match, normalize the data */
- DEBUG_WRAP(DebugMessage(DEBUG_RPC, "Got RPC traffic (%u bytes)!\n", psize); );
+ DebugFormat(DEBUG_RPC, "Got RPC traffic (%u bytes)!\n", psize);
/* cheesy alignment safe fraghdr = *(uint32_t *) data*/
*((uint8_t*)&fraghdr) = data[0];
if (fraghdr & MSB)
{
/* on match, normalize the data */
- DEBUG_WRAP(DebugMessage(DEBUG_RPC, "Found Last Fragment: %u!\n", length); );
+ DebugFormat(DEBUG_RPC, "Found Last Fragment: %u!\n", length);
if ((length + 4 != psize) && !(p->packet_flags & PKT_REBUILT_STREAM))
{
- DEBUG_WRAP(DebugMessage(DEBUG_RPC, "It's not the only thing in this buffer!"
- " length: %d psize: %d!\n", length, psize); );
+ DebugFormat(DEBUG_RPC, "It's not the only thing in this buffer!"
+ " length: %d psize: %d!\n", length, psize);
return RPC_MULTIPLE_RECORD;
}
else if ( length == 0 )
{
- DEBUG_WRAP(DebugMessage(DEBUG_RPC, "Zero-length RPC fragment detected."
- " length: %d psize: %d.\n", length, psize); );
+ DebugFormat(DEBUG_RPC, "Zero-length RPC fragment detected."
+ " length: %d psize: %d.\n", length, psize);
return RPC_ZERO_LENGTH_FRAGMENT;
}
return 0;
if (fraghdr & MSB)
{
- DEBUG_WRAP(DebugMessage(DEBUG_RPC, "Last Fragment detected\n"); );
+ DebugMessage(DEBUG_RPC, "Last Fragment detected\n");
last_fragment = 1;
}
* caught by length > psize but who knows when weird
* psize's might be allowed */
- DEBUG_WRAP(DebugMessage(DEBUG_RPC, "Integer Overflow"
+ DebugFormat(DEBUG_RPC, "Integer Overflow"
" field(%d) exceeds packet size(%d)\n",
- length, psize); );
+ length, psize);
return RPC_LARGE_FRAGSIZE;
}
if (length > psize)
{
- DEBUG_WRAP(DebugMessage(DEBUG_RPC, "Length of"
+ DebugFormat(DEBUG_RPC, "Length of"
" field(%d) exceeds packet size(%d)\n",
- length, psize); );
+ length, psize);
return RPC_INCOMPLETE_SEGMENT;
}
else if (decoded_len > psize)
/* The entire request is larger than our current packet
* size
*/
- DEBUG_WRAP(DebugMessage(DEBUG_RPC, " Decoded Length (%d)"
+ DebugFormat(DEBUG_RPC, " Decoded Length (%d)"
"exceeds packet size(%d)\n",
- decoded_len, psize); );
+ decoded_len, psize);
return RPC_LARGE_FRAGSIZE;
}
else if ((data_index + length) > data_end)
{
- DEBUG_WRAP(DebugMessage(DEBUG_RPC,
+ DebugMessage(DEBUG_RPC,
"returning LARGE_FRAGSIZE"
- "since we'd read past our end\n"); );
+ "since we'd read past our end\n");
return RPC_LARGE_FRAGSIZE;
}
else
{
fragcount++;
- DEBUG_WRAP(DebugMessage(DEBUG_RPC,
+ DebugFormat(DEBUG_RPC,
"length: %d size: %d decoded_len: %d\n",
- length, psize, decoded_len); );
+ length, psize, decoded_len);
ret = SafeMemcpy(norm_index, data_index, length, decode_buf_start, decode_buf_end);
if (ret != SAFEMEM_SUCCESS)
*/
if (decoded_len + ((fragcount - 1) * 4) != psize)
{
- DEBUG_WRAP(DebugMessage(DEBUG_RPC, "decoded len does not compute: %d\n",
- decoded_len); );
+ DebugFormat(DEBUG_RPC, "decoded len does not compute: %d\n",
+ decoded_len);
return RPC_MULTIPLE_RECORD;
}
- DEBUG_WRAP(DebugMessage(DEBUG_RPC, "New size: %d\n", decoded_len);
+ DebugFormat(DEBUG_RPC, "New size: %d\n", decoded_len);
DebugMessage(DEBUG_RPC, "converted data:\n");
- //LogNetData(data, decoded_len, p);
- );
+ //LogNetData(data, decoded_len, p);
return 0;
}
RpcSsnSetInactive(rsdata, p);
}
- DEBUG_WRAP(DebugMessage(DEBUG_RPC,"Stateless inspection\n"); );
+ DebugMessage(DEBUG_RPC,"Stateless inspection\n");
RpcPreprocEvent(&config, rsdata, ConvertRPC(&config, rsdata, p));
pRopts->body_data = sipMsg.body_data;
pRopts->status_code = sipMsg.status_code;
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "SIP message header length: %d\n",
- sipMsg.headerLen));
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Parsed method: %.*s, Flag: 0x%x\n",
- sipMsg.methodLen, sipMsg.method, sipMsg.methodFlag));
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Parsed status code: %d\n",
- sipMsg.status_code));
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Parsed header address: %p.\n",
- sipMsg.header));
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Parsed body address: %p.\n",
- sipMsg.body_data));
+ DebugFormat(DEBUG_SIP, "SIP message header length: %d\n",
+ sipMsg.headerLen);
+ DebugFormat(DEBUG_SIP, "Parsed method: %.*s, Flag: 0x%x\n",
+ sipMsg.methodLen, sipMsg.method, sipMsg.methodFlag);
+ DebugFormat(DEBUG_SIP, "Parsed status code: %d\n",
+ sipMsg.status_code);
+ DebugFormat(DEBUG_SIP, "Parsed header address: %p.\n",
+ sipMsg.header);
+ DebugFormat(DEBUG_SIP, "Parsed body address: %p.\n",
+ sipMsg.body_data);
sip_freeMsg(&sipMsg);
return status;
/* If the user specified methods, remove default methods for now since
* it now needs to be set explicitly. */
*methodsConfig = SIP_METHOD_NULL;
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Method token: %s\n",cur_tokenp); );
+ DebugFormat(DEBUG_SIP, "Method token: %s\n",cur_tokenp);
// Check whether this is a standard method
i_method = SIP_findMethod(cur_tokenp, StandardMethods);
static int SIP_processInvite(SIPMsg* sipMsg, SIP_DialogData* dialog, SIP_DialogList* dList)
{
int ret = true;
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Processing invite, dialog state %d \n", dialog->state); );
+ DebugFormat(DEBUG_SIP, "Processing invite, dialog state %d \n", dialog->state);
if (NULL == dialog)
return false;
// check whether this invite has authorization information
if ((SIP_DLG_AUTHENCATING != dialog->state) && (NULL != sipMsg->authorization))
{
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Dialog state code: %u\n",
- dialog->status_code));
+ DebugFormat(DEBUG_SIP, "Dialog state code: %u\n",
+ dialog->status_code);
SnortEventqAdd(GID_SIP, SIP_EVENT_AUTH_INVITE_REPLAY_ATTACK);
return false;
if (NULL == dialog)
return false;
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Processing response, dialog state %d \n", dialog->state);
- );
+ DebugFormat(DEBUG_SIP, "Processing response, dialog state %d \n", dialog->state);
if (sipMsg->status_code > 0)
dialog->status_code = sipMsg->status_code;
if (NULL == medias)
{
// Can't find the media session by ID, SDP has been changed.
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Can't find the media data, ID: %u\n",
- sipMsg->mediaSession->sessionID); );
+ DebugFormat(DEBUG_SIP, "Can't find the media data, ID: %u\n",
+ sipMsg->mediaSession->sessionID);
return false;
}
if (0 != SIP_compareMedias(medias->medias, sipMsg->mediaSession->medias))
{
// Can't find the media session by ID, SDP has been changed.
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "The media data is different!\n"); );
+ DebugMessage(DEBUG_SIP, "The media data is different!\n");
return false;
}
return true;
if (0 == config->ignoreChannel)
return false;
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Ignoring the media data in Dialog: %u\n",
- dialog->dlgID.callIdHash); );
+ DebugFormat(DEBUG_SIP, "Ignoring the media data in Dialog: %u\n",
+ dialog->dlgID.callIdHash);
// check the first media session
if (NULL == dialog->mediaSessions)
return false;
if (NULL == dialog->mediaSessions->nextS)
return false;
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Ignoring the media sessions ID: %u and %u\n",
- dialog->mediaSessions->sessionID, dialog->mediaSessions->nextS->sessionID); );
+ DebugFormat(DEBUG_SIP, "Ignoring the media sessions ID: %u and %u\n",
+ dialog->mediaSessions->sessionID, dialog->mediaSessions->nextS->sessionID);
mdataA = dialog->mediaSessions->medias;
mdataB = dialog->mediaSessions->nextS->medias;
sip_stats.ignoreSessions++;
while ((NULL != mdataA)&&(NULL != mdataB))
{
//void *ssn;
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Ignoring channels Source IP: %s Port: %u\n",
- sfip_to_str(&mdataA->maddress), mdataA->mport); );
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Ignoring channels Destine IP: %s Port: %u\n",
- sfip_to_str(&mdataB->maddress), mdataB->mport); );
+ DebugFormat(DEBUG_SIP, "Ignoring channels Source IP: %s Port: %u\n",
+ sfip_to_str(&mdataA->maddress), mdataA->mport);
+ DebugFormat(DEBUG_SIP, "Ignoring channels Destine IP: %s Port: %u\n",
+ sfip_to_str(&mdataB->maddress), mdataB->mport);
/* Call into Streams to mark data channel as something to ignore. */
#ifdef HAVE_DAQ_ADDRESS_SPACE_ID
SIP_MediaData* mdataA,* mdataB;
mdataA = mlistA;
mdataB = mlistB;
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Compare the media data \n"); );
+ DebugMessage(DEBUG_SIP, "Compare the media data \n");
while ((NULL != mdataA) && (NULL != mdataB))
{
if (sfip_compare(&mdataA->maddress, &mdataB->maddress) != SFIP_EQUAL)
if (NULL == mSession)
return;
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Updating session id: %u\n",
- mSession->sessionID));
+ DebugFormat(DEBUG_SIP, "Updating session id: %u\n",
+ mSession->sessionID);
mSession->savedFlag = SIP_SESSION_SAVED;
// Find out the media session based on session id
currSession = *dList;
while (NULL != currSession)
{
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Session id: %u\n",
- currSession->sessionID));
+ DebugFormat(DEBUG_SIP, "Session id: %u\n",
+ currSession->sessionID);
if (currSession->sessionID == mSession->sessionID)
{
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Found Session id: %u\n",
- currSession->sessionID));
+ DebugFormat(DEBUG_SIP, "Found Session id: %u\n",
+ currSession->sessionID);
break;
}
preSession = currSession;
{
mSession->nextS = *dList;
*dList = mSession;
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Add Session id: %u\n",
- mSession->sessionID));
+ DebugFormat(DEBUG_SIP, "Add Session id: %u\n",
+ mSession->sessionID);
// Display the final media session
#ifdef DEBUG_MSGS
SIP_displayMedias(dList);
return;
}
// if this session needs to be updated
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Insert Session id: %u\n",
- mSession->sessionID));
+ DebugFormat(DEBUG_SIP, "Insert Session id: %u\n",
+ mSession->sessionID);
mSession->nextS = currSession->nextS;
// if this is the header, update the new header
if (NULL == preSession)
void SIP_displayMedias(SIP_MediaList* dList)
{
SIP_MediaSession* currSession;
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Updated Session information------------\n"));
+ DebugMessage(DEBUG_SIP, "Updated Session information------------\n");
currSession = *dList;
while (NULL != currSession)
{
SIP_MediaData* mdata;
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Session id: %u\n", currSession->sessionID));
+ DebugFormat(DEBUG_SIP, "Session id: %u\n", currSession->sessionID);
mdata = currSession->medias;
while (NULL != mdata)
{
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Media IP: %s, port: %u, number of ports %u\n",
- sfip_to_str(&mdata->maddress), mdata->mport, mdata->numPort));
+ DebugFormat(DEBUG_SIP, "Media IP: %s, port: %u, number of ports %u\n",
+ sfip_to_str(&mdata->maddress), mdata->mport, mdata->numPort);
mdata = mdata->nextM;
}
currSession = currSession->nextS;
}
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "End of Session information------------\n"));
+ DebugMessage(DEBUG_SIP, "End of Session information------------\n");
}
#endif
{
SIP_DialogData* dialog;
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Add Dialog id: %u, From: %u, To: %u, status code: %u\n",
+ DebugFormat(DEBUG_SIP, "Add Dialog id: %u, From: %u, To: %u, status code: %u\n",
sipMsg->dlgID.callIdHash,sipMsg->dlgID.fromTagHash,sipMsg->dlgID.toTagHash,
- sipMsg->status_code));
+ sipMsg->status_code);
sip_stats.dialogs++;
if ((NULL == currDialog)||(NULL == dList))
return false;
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Delete Dialog id: %u, From: %u, To: %u \n",
- currDialog->dlgID.callIdHash,currDialog->dlgID.fromTagHash,currDialog->dlgID.toTagHash));
+ DebugFormat(DEBUG_SIP, "Delete Dialog id: %u, From: %u, To: %u \n",
+ currDialog->dlgID.callIdHash,currDialog->dlgID.fromTagHash,currDialog->dlgID.toTagHash);
// If this is the header
if (NULL == currDialog->prevD)
{
if ((NULL == sipMsg)||(0 == sipMsg->dlgID.callIdHash))
return false;
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Updating Dialog id: %u, From: %u, To: %u\n",
- sipMsg->dlgID.callIdHash,sipMsg->dlgID.fromTagHash,sipMsg->dlgID.toTagHash));
+ DebugFormat(DEBUG_SIP, "Updating Dialog id: %u, From: %u, To: %u\n",
+ sipMsg->dlgID.callIdHash,sipMsg->dlgID.fromTagHash,sipMsg->dlgID.toTagHash);
dialog = dList->head;
while (NULL != dialog)
{
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Dialog id: %u, From: %u, To: %u\n",
- dialog->dlgID.callIdHash,dialog->dlgID.fromTagHash,dialog->dlgID.toTagHash));
+ DebugFormat(DEBUG_SIP, "Dialog id: %u, From: %u, To: %u\n",
+ dialog->dlgID.callIdHash,dialog->dlgID.fromTagHash,dialog->dlgID.toTagHash);
if (sipMsg->dlgID.callIdHash == dialog->dlgID.callIdHash)
{
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Found Dialog id: %u, From: %u, To: %u\n",
- dialog->dlgID.callIdHash,dialog->dlgID.fromTagHash,dialog->dlgID.toTagHash));
+ DebugFormat(DEBUG_SIP, "Found Dialog id: %u, From: %u, To: %u\n",
+ dialog->dlgID.callIdHash,dialog->dlgID.fromTagHash,dialog->dlgID.toTagHash);
break;
}
oldDialog = dialog;
while (NULL != curNode)
{
- DEBUG_WRAP(DebugMessage(DEBUG_SIP,
+ DebugFormat(DEBUG_SIP,
"*Clean Dialog creator: 0x%x, id: %u, From: %u, To: %u, State: %d\n",
curNode->creator, curNode->dlgID.callIdHash,curNode->dlgID.fromTagHash,
- curNode->dlgID.toTagHash,curNode->state));
+ curNode->dlgID.toTagHash,curNode->state);
nextNode = curNode->nextD;
sip_freeMediaList(curNode->mediaSessions);
free(curNode);
int length = end -start;
char* colonIndex;
char* newStart, * newEnd, newLength;
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "process line: %.*s\n", length, start));
+ DebugFormat(DEBUG_SIP, "process line: %.*s\n", length, start);
// If this is folding
if ((' ' == start[0]) || ('\t' == start[0]))
if (numOfLineBreaks < 1)
{
/*No CRLF */
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "No CRLF, check failed\n"));
+ DebugMessage(DEBUG_SIP, "No CRLF, check failed\n");
return false;
}
/*Exclude CRLF from start line*/
length = next - start - numOfLineBreaks;
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Start line: %.*s \n", length, start));
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "End of Start line \n"));
+ DebugFormat(DEBUG_SIP, "Start line: %.*s \n", length, start);
+ DebugMessage(DEBUG_SIP, "End of Start line \n");
/*Should at least have SIP/2.0 */
if (length < SIP_MIN_MSG_LEN)
{
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Message too short, check failed\n"));
+ DebugMessage(DEBUG_SIP, "Message too short, check failed\n");
return false;
}
}
else
msg->status_code = (uint16_t)statusCode;
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Status code: %d \n", msg->status_code));
+ DebugFormat(DEBUG_SIP, "Status code: %d \n", msg->status_code);
}
else /* This might be a request*/
{
length = space - buff;
msg->method = (char*)buff;
msg->methodLen = length;
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "method: %.*s\n", msg->methodLen, msg->method));
+ DebugFormat(DEBUG_SIP, "method: %.*s\n", msg->methodLen, msg->method);
method = SIP_FindMethod (config->methods, msg->method, msg->methodLen);
if (method)
{
msg->methodFlag = method->methodFlag;
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Found the method: %s, Flag: 0x%x\n",
- method->methodName, method->methodFlag));
+ DebugFormat(DEBUG_SIP, "Found the method: %s, Flag: 0x%x\n",
+ method->methodName, method->methodFlag);
}
// parse the uri
if (space == NULL)
return false;
msg->uriLen = space - msg->uri;
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "uri: %.*s, length: %u\n", msg->uriLen, msg->uri,
- msg->uriLen));
+ DebugFormat(DEBUG_SIP, "uri: %.*s, length: %u\n", msg->uriLen, msg->uri,
+ msg->uriLen);
if (0 == msg->uriLen)
SnortEventqAdd(GID_SIP, SIP_EVENT_EMPTY_REQUEST_URI);
else if (config->maxUriLen && (msg->uriLen > config->maxUriLen))
/*Processing this line*/
length = next - start - numOfLineBreaks;
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Header line: %.*s\n", length, start));
+ DebugFormat(DEBUG_SIP, "Header line: %.*s\n", length, start);
/*Process headers*/
sip_process_headField(msg, start, start + length, &lastFieldIndex, config);
#ifdef DEBUG_MSGS
length = end - buff;
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Body length: %d\n", length); );
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Body line: %.*s\n", length, buff); );
+ DebugFormat(DEBUG_SIP, "Body length: %d\n", length);
+ DebugFormat(DEBUG_SIP, "Body line: %.*s\n", length, buff);
#endif
// Initialize it
/*Processing this line*/
length = next - start - numOfLineBreaks;
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Body line: %.*s\n", length, start));
+ DebugFormat(DEBUG_SIP, "Body line: %.*s\n", length, start);
/*Process body fields*/
sip_process_bodyField(msg, start, start + length);
ret = false;
}
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Method flag: %d\n", msg->methodFlag));
+ DebugFormat(DEBUG_SIP, "Method flag: %d\n", msg->methodFlag);
// Contact is required for invite message
if ((0 == msg->contactLen)&&(msg->methodFlag == SIP_METHOD_INVITE)&&(0 == msg->status_code))
static int sip_parse_via(SIPMsg* msg, const char* start, const char* end, SIP_PROTO_CONF*)
{
int length = end -start;
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Via value: %.*s\n", length, start); );
+ DebugFormat(DEBUG_SIP, "Via value: %.*s\n", length, start);
msg->viaLen = msg->viaLen + length;
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Via length: %d\n", msg->viaLen); );
+ DebugFormat(DEBUG_SIP, "Via length: %d\n", msg->viaLen);
return SIP_PARSE_SUCCESS;
}
char* userEnd;
char* userStart;
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "From value: %.*s\n", length, start); );
+ DebugFormat(DEBUG_SIP, "From value: %.*s\n", length, start);
msg->from = (char*)start;
msg->fromLen = end - start;
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "From length: %d , content: %.*s\n",
- msg->fromLen, msg->fromLen, msg->from); );
+ DebugFormat(DEBUG_SIP, "From length: %d , content: %.*s\n",
+ msg->fromLen, msg->fromLen, msg->from);
/*Get the from tag*/
msg->fromTagLen = 0;
msg->userNameLen = 0;
}
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "From tag length: %d , hash: %u, content: %.*s\n",
- msg->fromTagLen, msg->dlgID.fromTagHash, msg->fromTagLen, msg->from_tag); );
+ DebugFormat(DEBUG_SIP, "From tag length: %d , hash: %u, content: %.*s\n",
+ msg->fromTagLen, msg->dlgID.fromTagHash, msg->fromTagLen, msg->from_tag);
return SIP_PARSE_SUCCESS;
}
{
DEBUG_WRAP(int length = end -start; )
char* buff;
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "To value: %.*s\n", length, start); );
+ DebugFormat(DEBUG_SIP, "To value: %.*s\n", length, start);
msg->to = (char*)start;
msg->toLen = end - start;
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "To length: %d , content: %.*s\n",
- msg->toLen, msg->toLen, msg->to); );
+ DebugFormat(DEBUG_SIP, "To length: %d , content: %.*s\n",
+ msg->toLen, msg->toLen, msg->to);
/*Processing tag information*/
msg->toTagLen = 0;
buff = (char*)memchr(buff + 1, ';', msg->toLen);
}
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "To tag length: %d , Hash: %u, content: %.*s\n",
- msg->toTagLen, msg->dlgID.toTagHash, msg->toTagLen, msg->to_tag); );
+ DebugFormat(DEBUG_SIP, "To tag length: %d , Hash: %u, content: %.*s\n",
+ msg->toTagLen, msg->dlgID.toTagHash, msg->toTagLen, msg->to_tag);
return SIP_PARSE_SUCCESS;
}
static int sip_parse_call_id(SIPMsg* msg, const char* start, const char* end, SIP_PROTO_CONF*)
{
DEBUG_WRAP(int length = end -start; )
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Call-Id value: %.*s\n", length, start); );
+ DebugFormat(DEBUG_SIP, "Call-Id value: %.*s\n", length, start);
msg->call_id = (char*)start;
msg->callIdLen = end - start;
msg->dlgID.callIdHash = strToHash(msg->call_id, msg->callIdLen);
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Call-Id length: %d, Hash: %u\n",
- msg->callIdLen, msg->dlgID.callIdHash); );
+ DebugFormat(DEBUG_SIP, "Call-Id length: %d, Hash: %u\n",
+ msg->callIdLen, msg->dlgID.callIdHash);
return SIP_PARSE_SUCCESS;
}
static int sip_parse_user_agent(SIPMsg* msg, const char* start, const char* end, SIP_PROTO_CONF*)
{
DEBUG_WRAP(int length = end -start; )
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "User-Agent value: %.*s\n", length, start); );
+ DebugFormat(DEBUG_SIP, "User-Agent value: %.*s\n", length, start);
msg->userAgent = (char*)start;
msg->userAgentLen = end - start;
static int sip_parse_server(SIPMsg* msg, const char* start, const char* end, SIP_PROTO_CONF*)
{
DEBUG_WRAP(int length = end -start; )
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Server value: %.*s\n", length, start); );
+ DebugFormat(DEBUG_SIP, "Server value: %.*s\n", length, start);
msg->server = (char*)start;
msg->serverLen = end - start;
DEBUG_WRAP(int length = end -start; )
SIPMethodNode* method = NULL;
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "CSeq value: %.*s\n", length, start); );
+ DebugFormat(DEBUG_SIP, "CSeq value: %.*s\n", length, start);
msg->cseqnum = SnortStrtoul(start, &next, 10);
if ((NULL != next )&&(next < end))
{
msg->cseqNameLen = end - msg->cseqName;
method = SIP_FindMethod (config->methods, msg->cseqName, msg->cseqNameLen);
}
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "CSeq number: %d, CSeqName: %.*s\n",
- msg->cseqnum, msg->cseqNameLen, msg->cseqName); );
+ DebugFormat(DEBUG_SIP, "CSeq number: %d, CSeqName: %.*s\n",
+ msg->cseqnum, msg->cseqNameLen, msg->cseqName);
if (NULL == method)
{
{
SnortEventqAdd(GID_SIP, SIP_EVENT_MISMATCH_METHOD);
}
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Found the method: %s, Flag: 0x%x\n",
- method->methodName, method->methodFlag));
+ DebugFormat(DEBUG_SIP, "Found the method: %s, Flag: 0x%x\n",
+ method->methodName, method->methodFlag);
}
return SIP_PARSE_SUCCESS;
static int sip_parse_contact(SIPMsg* msg, const char* start, const char* end, SIP_PROTO_CONF*)
{
int length = end -start;
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Contact value: %.*s\n", length, start); );
+ DebugFormat(DEBUG_SIP, "Contact value: %.*s\n", length, start);
msg->contact = (char*)start;
msg->contactLen = msg->contactLen + length;
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Contact length: %d\n", msg->contactLen); );
+ DebugFormat(DEBUG_SIP, "Contact length: %d\n", msg->contactLen);
return SIP_PARSE_SUCCESS;
}
{
#ifdef DEBUG_MSGS
DEBUG_WRAP(int length = end -start; )
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Authorization value: %.*s\n", length, start); );
+ DebugFormat(DEBUG_SIP, "Authorization value: %.*s\n", length, start);
#else
UNUSED(end);
#endif
static int sip_parse_content_type(SIPMsg* msg, const char* start, const char* end, SIP_PROTO_CONF*)
{
DEBUG_WRAP(int length = end -start; )
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Content type value: %.*s\n", length, start); );
+ DebugFormat(DEBUG_SIP, "Content type value: %.*s\n", length, start);
msg->contentTypeLen = end - start;
msg->content_type = (char*)start;
return SIP_PARSE_SUCCESS;
SnortEventqAdd(GID_SIP, SIP_EVENT_BAD_CONTENT_LEN);
return SIP_PARSE_ERROR;
}
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Content length: %u\n", msg->content_len); );
+ DebugFormat(DEBUG_SIP, "Content length: %u\n", msg->content_len);
return SIP_PARSE_SUCCESS;
}
{
#ifdef DEBUG_MSGS
DEBUG_WRAP(int length = end -start; )
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Content encode value: %.*s\n", length, start); );
+ DebugFormat(DEBUG_SIP, "Content encode value: %.*s\n", length, start);
#else
UNUSED(end);
#endif
if (NULL == msg->mediaSession)
return SIP_PARSE_ERROR;
length = end - start;
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Origination information: %.*s\n", length, start); );
+ DebugFormat(DEBUG_SIP, "Origination information: %.*s\n", length, start);
// Get username and session ID information (before second space)
spaceIndex = (char*)memchr(start, ' ', length); // first space
if ((NULL == spaceIndex)||(spaceIndex == end))
if (NULL == spaceIndex2)
return SIP_PARSE_ERROR;
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Session information: %.*s\n", spaceIndex - start, start);
- );
+ DebugFormat(DEBUG_SIP, "Session information: %.*s\n", spaceIndex - start, start);
+
//sessionId uses all elements from o: line except sessionId version
msg->mediaSession->sessionID = strToHash(start, spaceIndex - start);
msg->mediaSession->sessionID += strToHash(spaceIndex2+1, end - (spaceIndex2+1));
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Session ID: %u\n", msg->mediaSession->sessionID); );
+ DebugFormat(DEBUG_SIP, "Session ID: %u\n", msg->mediaSession->sessionID);
return SIP_PARSE_SUCCESS;
}
if (NULL == msg->mediaSession)
return SIP_PARSE_ERROR;
length = end - start;
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Connection data: %.*s\n", length, start); );
+ DebugFormat(DEBUG_SIP, "Connection data: %.*s\n", length, start);
/*Get the IP address*/
spaceIndex = (char*)memchr(start, ' ', length); // first space
}
strncpy(ipStr, spaceIndex, length);
ipStr[length] = '\0';
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "IP data: %s\n", ipStr); );
+ DebugFormat(DEBUG_SIP, "IP data: %s\n", ipStr);
// If no default session connect information, add it
if (NULL == msg->mediaSession->medias)
}
if ( (sfip_pton(ipStr, ip)) != SFIP_SUCCESS)
{
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Parsed error! \n"); );
+ DebugMessage(DEBUG_SIP, "Parsed error! \n");
return SIP_PARSE_ERROR;
}
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Parsed Connection data: %s\n", sfip_to_str (ip)); );
+ DebugFormat(DEBUG_SIP, "Parsed Connection data: %s\n", sfip_to_str (ip));
return SIP_PARSE_SUCCESS;
}
if (NULL == msg->mediaSession)
return SIP_PARSE_ERROR;
length = end - start;
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Media information: %.*s\n", length, start); );
+ DebugFormat(DEBUG_SIP, "Media information: %.*s\n", length, start);
spaceIndex = (char*)memchr(start, ' ', length); // first space
if ((NULL == spaceIndex)||(spaceIndex == end))
mdata->nextM = msg->mediaSession->medias;
mdata->maddress = msg->mediaSession->maddress_default;
msg->mediaSession->medias = mdata;
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Media IP: %s, Media port %u, number of media: %d\n",
- sfip_to_str(&mdata->maddress), mdata->mport, mdata->numPort); );
+ DebugFormat(DEBUG_SIP, "Media IP: %s, Media port %u, number of media: %d\n",
+ sfip_to_str(&mdata->maddress), mdata->mport, mdata->numPort);
return SIP_PARSE_SUCCESS;
}
/*Parse the start line*/
start = (char*)buff;
nextIndex = NULL;
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Start parsing...\n"));
+ DebugMessage(DEBUG_SIP, "Start parsing...\n");
msg->header = (uint8_t*)buff;
status = sip_startline_parse(msg, start, end, &nextIndex, config);
if (false == status )
{
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Start line parsing failed...\n"));
+ DebugMessage(DEBUG_SIP, "Start line parsing failed...\n");
return status;
}
if (false == status )
{
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Header parsing failed...\n"));
+ DebugMessage(DEBUG_SIP, "Header parsing failed...\n");
}
status = sip_check_headers(msg, config);
if (false == status )
{
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Headers validation failed...\n"));
+ DebugMessage(DEBUG_SIP, "Headers validation failed...\n");
}
/*Parse the body*/
if (false == status )
{
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Headers validation failed...\n"));
+ DebugMessage(DEBUG_SIP, "Headers validation failed...\n");
}
// Find out whether multiple SIP messages in this packet
while (NULL != curNode)
{
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Clear media ip: %s, port: %d, number of port: %d\n",
- sfip_to_str(&curNode->maddress), curNode->mport, curNode->numPort));
+ DebugFormat(DEBUG_SIP, "Clear media ip: %s, port: %d, number of port: %d\n",
+ sfip_to_str(&curNode->maddress), curNode->mport, curNode->numPort);
nextNode = curNode->nextM;
free(curNode);
curNode = nextNode;
while (NULL != curNode)
{
- DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Clean Media session default IP: %s, session ID: %u\n",
- sfip_to_str(&curNode->maddress_default), curNode->sessionID));
+ DebugFormat(DEBUG_SIP, "Clean Media session default IP: %s, session ID: %u\n",
+ sfip_to_str(&curNode->maddress_default), curNode->sessionID);
nextNode = curNode->nextS;
sip_freeMediaSession(curNode);
curNode = nextNode;
if(stream.is_midstream(p->flow))
{
- DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "Got midstream packet - "
- "setting state to unknown\n"); );
+ DebugMessage(DEBUG_SMTP, "Got midstream packet - "
+ "setting state to unknown\n");
smtp_ssn->state = STATE_UNKNOWN;
}
if (ssn->session_flags & SMTP_FLAG_NEXT_STATE_UNKNOWN)
{
- DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "Found gap in previous reassembly buffer - "
- "set state to unknown\n"); );
+ DebugMessage(DEBUG_SMTP, "Found gap in previous reassembly buffer - "
+ "set state to unknown\n");
ssn->state = STATE_UNKNOWN;
ssn->session_flags &= ~SMTP_FLAG_NEXT_STATE_UNKNOWN;
}
if (missing_in_rebuilt == SSN_MISSING_BEFORE)
{
- DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "Found missing packets before "
- "in reassembly buffer - set state to unknown\n"); );
+ DebugMessage(DEBUG_SMTP, "Found missing packets before "
+ "in reassembly buffer - set state to unknown\n");
ssn->state = STATE_UNKNOWN;
}
}
* state. Check to see if we're encrypted */
if (smtp_ssn->state == STATE_UNKNOWN)
{
- DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "Command not found, but state is "
- "unknown - checking for SSL\n"); );
+ DebugMessage(DEBUG_SMTP, "Command not found, but state is "
+ "unknown - checking for SSL\n");
/* check for encrypted */
if ((smtp_ssn->session_flags & SMTP_FLAG_CHECK_SSL) &&
(IsSSL(ptr, end - ptr, p->packet_flags)))
{
- DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "Packet is SSL encrypted\n"); );
+ DebugMessage(DEBUG_SMTP, "Packet is SSL encrypted\n");
smtp_ssn->state = STATE_TLS_DATA;
/* Ignore data */
if (config->ignore_tls_data)
{
- DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "Ignoring encrypted data\n"); );
+ DebugMessage(DEBUG_SMTP, "Ignoring encrypted data\n");
}
return end;
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "Not SSL - try data state\n"); );
+ DebugMessage(DEBUG_SMTP, "Not SSL - try data state\n");
/* don't check for ssl again in this packet */
if (smtp_ssn->session_flags & SMTP_FLAG_CHECK_SSL)
smtp_ssn->session_flags &= ~SMTP_FLAG_CHECK_SSL;
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "No known command found\n"); );
+ DebugMessage(DEBUG_SMTP, "No known command found\n");
if (smtp_ssn->state != STATE_AUTH)
{
if ((smtp_ssn->state_flags & SMTP_FLAG_GOT_RCPT_CMD) ||
smtp_ssn->state == STATE_UNKNOWN)
{
- DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "Set to data state.\n"); );
+ DebugMessage(DEBUG_SMTP, "Set to data state.\n");
smtp_ssn->state = STATE_DATA;
smtp_ssn->state_flags &= ~(SMTP_FLAG_GOT_MAIL_CMD | SMTP_FLAG_GOT_RCPT_CMD);
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "Didn't get MAIL -> RCPT command sequence - "
- "stay in command state.\n"); );
+ DebugMessage(DEBUG_SMTP, "Didn't get MAIL -> RCPT command sequence - "
+ "stay in command state.\n");
}
break;
switch (smtp_ssn->state)
{
case STATE_COMMAND:
- DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "COMMAND STATE ~~~~~~~~~~~~~~~~~~~~~~~~~~\n"); );
+ DebugMessage(DEBUG_SMTP, "COMMAND STATE ~~~~~~~~~~~~~~~~~~~~~~~~~~\n");
ptr = SMTP_HandleCommand(config, p, smtp_ssn, ptr, end);
break;
case STATE_DATA:
case STATE_BDATA:
- DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "DATA STATE ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n"); );
+ DebugMessage(DEBUG_SMTP, "DATA STATE ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n");
position = file_api->get_file_position(p);
ptr = file_api->process_mime_data(p->flow, ptr, end, &(smtp_ssn->mime_ssn), 1,
position);
ptr = SMTP_HandleCommand(config, p, smtp_ssn, ptr, end);
break;
case STATE_UNKNOWN:
- DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "UNKNOWN STATE ~~~~~~~~~~~~~~~~~~~~~~~~~~\n"); );
+ DebugMessage(DEBUG_SMTP, "UNKNOWN STATE ~~~~~~~~~~~~~~~~~~~~~~~~~~\n");
/* If state is unknown try command state to see if we can
* regain our bearings */
ptr = SMTP_HandleCommand(config, p, smtp_ssn, ptr, end);
break;
default:
- DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "Bad SMTP state\n"); );
+ DebugMessage(DEBUG_SMTP, "Bad SMTP state\n");
return;
}
}
#ifdef DEBUG_MSGS
if (smtp_normalizing)
{
- DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "Normalized data\n%s\n", SMTP_PrintBuffer(p)); );
+ DebugFormat(DEBUG_SMTP, "Normalized data\n%s\n", SMTP_PrintBuffer(p));
}
#endif
}
/* only add response if not a dash after response code */
if ((dash == eolm) || ((dash < eolm) && (*dash != '-')))
{
- DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "Server sent %s response\n",
- smtp_resps[smtp_search_info.id].name); );
+ DebugFormat(DEBUG_SMTP, "Server sent %s response\n",
+ smtp_resps[smtp_search_info.id].name);
}
#endif
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_SMTP,
- "Server response not found - see if it's SSL data\n"); );
+ DebugMessage(DEBUG_SMTP,
+ "Server response not found - see if it's SSL data\n");
if ((smtp_ssn->session_flags & SMTP_FLAG_CHECK_SSL) &&
(IsSSL(ptr, end - ptr, p->packet_flags)))
{
- DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "Server response is an SSL packet\n"); );
+ DebugMessage(DEBUG_SMTP, "Server response is an SSL packet\n");
smtp_ssn->state = STATE_TLS_DATA;
/* Ignore data */
if (config->ignore_tls_data)
{
- DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "Ignoring Server TLS encrypted data\n"); );
+ DebugMessage(DEBUG_SMTP, "Ignoring Server TLS encrypted data\n");
}
return;
{
int next_state = 0;
- DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "SMTP server packet\n"); );
+ DebugMessage(DEBUG_SMTP, "SMTP server packet\n");
/* Process as a server packet */
SMTP_ProcessServerPacket(config, p, smtp_ssn, &next_state);
#ifdef DEBUG_MSGS
if (pkt_dir == SMTP_PKT_FROM_CLIENT)
{
- DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "SMTP client packet\n"); );
+ DebugMessage(DEBUG_SMTP, "SMTP client packet\n");
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "SMTP packet NOT from client or server! "
- "Processing as a client packet\n"); );
+ DebugMessage(DEBUG_SMTP, "SMTP packet NOT from client or server! "
+ "Processing as a client packet\n");
}
#endif
{
if (IsTlsClientHello(p->data, p->data + p->dsize))
{
- DEBUG_WRAP(DebugMessage(DEBUG_SMTP,
- "TLS DATA STATE ~~~~~~~~~~~~~~~~~~~~~~~~~\n"); );
+ DebugMessage(DEBUG_SMTP,
+ "TLS DATA STATE ~~~~~~~~~~~~~~~~~~~~~~~~~\n");
smtp_ssn->state = STATE_TLS_SERVER_PEND;
}
if ( !InspectPacket(p))
{
/* Packet will be rebuilt, so wait for it */
- DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "Client packet will be reassembled\n"));
+ DebugMessage(DEBUG_SMTP, "Client packet will be reassembled\n");
return;
}
else if (!(p->packet_flags & PKT_REBUILT_STREAM))
* that were not rebuilt, state is going to be messed up
* so set state to unknown. It's likely this was the
* beginning of the conversation so reset state */
- DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "Got non-rebuilt packets before "
- "this rebuilt packet\n"); );
+ DebugMessage(DEBUG_SMTP, "Got non-rebuilt packets before "
+ "this rebuilt packet\n");
smtp_ssn->state = STATE_UNKNOWN;
smtp_ssn->session_flags &= ~SMTP_FLAG_GOT_NON_REBUILT;
#ifdef DEBUG_MSGS
/* Interesting to see how often packets are rebuilt */
- DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "Payload: %s\n%s\n",
+ DebugFormat(DEBUG_SMTP, "Payload: %s\n%s\n",
(p->packet_flags & PKT_REBUILT_STREAM) ?
"reassembled" : "not reassembled",
- SMTP_PrintBuffer(p)); );
+ SMTP_PrintBuffer(p));
#endif
SMTP_ProcessClientPacket(config, p, smtp_ssn);
if (pch != NULL)
{
- DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "Find end of line!\n"); );
+ DebugMessage(DEBUG_SMTP, "Find end of line!\n");
*fp = (uint32_t)(pch - (const char*)data) + 1;
return StreamSplitter::FLUSH;
}
/* Continue finding the data length ...*/
if (get_length(val, &pfdata->length) != SMTP_PAF_LENGTH_CONTINUE)
{
- DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "Find data length: %d\n",
- pfdata->length); );
+ DebugFormat(DEBUG_SMTP, "Find data length: %d\n",
+ pfdata->length);
pfdata->cmd_info.cmd_state = SMTP_PAF_CMD_DATA_END_STATE;
}
break;
{
if (flush_based_length(pfdata)|| file_api->check_data_end(&(pfdata->data_end_state), data))
{
- DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "End of data\n"); );
+ DebugMessage(DEBUG_SMTP, "End of data\n");
/*Clean up states*/
pfdata->smtp_state = SMTP_PAF_CMD_STATE;
pfdata->end_of_data = true;
uint32_t i;
uint32_t boundary_start = 0;
- DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "From client: %s \n", data); );
+ DebugFormat(DEBUG_SMTP, "From client: %s \n", data);
for (i = 0; i < len; i++)
{
uint8_t ch = data[i];
case SMTP_PAF_CMD_STATE:
if (process_command(pfdata, ch))
{
- DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "Flush command: %s \n", data); );
+ DebugFormat(DEBUG_SMTP, "Flush command: %s \n", data);
*fp = i + 1;
return StreamSplitter::FLUSH;
}
case SMTP_PAF_DATA_STATE:
if (process_data(pfdata, ch))
{
- DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "Flush data!\n"); );
+ DebugMessage(DEBUG_SMTP, "Flush data!\n");
*fp = i + 1;
return StreamSplitter::FLUSH;
}
if (flags & PKT_FROM_SERVER)
{
- DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "PAF: From server.\n"); );
+ DebugMessage(DEBUG_SMTP, "PAF: From server.\n");
return smtp_paf_server(pfdata, data, len, fp);
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "PAF: From client.\n"); );
+ DebugMessage(DEBUG_SMTP, "PAF: From client.\n");
return smtp_paf_client(pfdata, data, len, fp);
}
}
static inline uint32_t SSLPP_process_alert(
SSL_PROTO_CONF*, uint32_t ssn_flags, uint32_t new_flags, Packet* packet)
{
- DEBUG_WRAP(DebugMessage(DEBUG_SSL, "Process Alert\n"); );
+ DebugMessage(DEBUG_SSL, "Process Alert\n");
ssn_flags |= new_flags;
!(new_flags & SSL_CHANGE_CIPHER_FLAG) &&
!(new_flags & SSL_HEARTBEAT_SEEN))
{
- DEBUG_WRAP(DebugMessage(DEBUG_SSL, "Disabling detect\n"); );
+ DebugMessage(DEBUG_SSL, "Disabling detect\n");
DisableDetect(packet);
}
static inline uint32_t SSLPP_process_hs(uint32_t ssl_flags, uint32_t new_flags)
{
- DEBUG_WRAP(DebugMessage(DEBUG_SSL, "Process Handshake\n"); );
+ DebugMessage(DEBUG_SSL, "Process Handshake\n");
if (!SSL_BAD_HS(new_flags))
{
static inline uint32_t SSLPP_process_app(SSL_PROTO_CONF* config, uint32_t ssn_flags, uint32_t
new_flags, Packet* packet)
{
- DEBUG_WRAP(DebugMessage(DEBUG_SSL, "Process Application\n"); );
+ DebugMessage(DEBUG_SSL, "Process Application\n");
if (SSLPP_is_encrypted(config, ssn_flags | new_flags, packet) )
{
// Heartbleed check is disabled. Stop inspection on this session.
if (!config->max_heartbeat_len)
{
- DEBUG_WRAP(DebugMessage(DEBUG_SSL, "STOPPING INSPECTION (process_app)\n"); );
+ DebugMessage(DEBUG_SSL, "STOPPING INSPECTION (process_app)\n");
stream.stop_inspection(packet->flow,
packet, SSN_DIR_BOTH, -1, 0);
counts.stopped++;
if (!config->max_heartbeat_len)
{
- DEBUG_WRAP(DebugMessage(DEBUG_SSL, "STOPPING INSPECTION (process_other)\n"); );
+ DebugMessage(DEBUG_SSL, "STOPPING INSPECTION (process_other)\n");
stream.stop_inspection(packet->flow,
packet, SSN_DIR_BOTH, -1, 0);
}
if (ssn)
{
/* Mark this session as dead. */
- DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Marking session as dead, per ICMP Unreachable!\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "Marking session as dead, per ICMP Unreachable!\n");
ssn->ssn_state.session_flags |= SSNFLAG_DROP_CLIENT;
ssn->ssn_state.session_flags |= SSNFLAG_DROP_SERVER;
ssn->session_state |= STREAM_STATE_UNREACH;
{
ft->frag_flags |= FRAG_GOT_FIRST;
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG, "Got first frag\n"); );
+ DebugMessage(DEBUG_FRAG, "Got first frag\n");
}
else if ((!(p->ptrs.decode_flags & DECODE_MF)) && (frag_offset > 0)) /* set for last frag too
*/
if (ft->frag_flags & FRAG_GOT_LAST)
{
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG, "Got last frag again!\n"); );
+ DebugMessage(DEBUG_FRAG, "Got last frag again!\n");
switch (ft->frag_policy)
{
case FRAG_POLICY_BSD:
{
ft->calculated_size = endOfThisFrag;
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG, "Got last frag, Bytes: %d, "
+ DebugFormat(DEBUG_FRAG, "Got last frag, Bytes: %d, "
"Calculated size: %d\n",
ft->frag_bytes,
- ft->calculated_size); );
+ ft->calculated_size);
}
}
ft->frag_flags |= FRAG_NO_BSD_VULN;
}
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG, "Frag Status: %s:%s\n",
+ DebugFormat(DEBUG_FRAG, "Frag Status: %s:%s\n",
ft->frag_flags&FRAG_GOT_FIRST ? "FIRST" : "No FIRST",
- ft->frag_flags&FRAG_GOT_LAST ? "LAST" : "No LAST"); );
+ ft->frag_flags&FRAG_GOT_LAST ? "LAST" : "No LAST");
return retVal;
}
{
if (p->dsize <= engine->min_fragment_length)
{
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
+ DebugFormat(DEBUG_FRAG,
"Frag: Received fragment size(%d) is not more than configured min_fragment_length (%d)\n",
- p->dsize, engine->min_fragment_length); );
+ p->dsize, engine->min_fragment_length);
EventTinyFragments(engine);
return 1;
}
///detect tiny fragments after processing overlaps.
if (trimmedLength <= engine->min_fragment_length)
{
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
+ DebugFormat(DEBUG_FRAG,
"Frag: # of New octets in Received fragment(%d) is not more than configured min_fragment_length (%d)\n",
- trimmedLength, engine->min_fragment_length); );
+ trimmedLength, engine->min_fragment_length);
EventTinyFragments(engine);
return 1;
}
//drop this and all following fragments
if (ft && !(ft->frag_flags & FRAG_DROP_FRAGMENTS))
{
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
- "Frag: Will drop all fragments on this packet\n"); );
+ DebugMessage(DEBUG_FRAG,
+ "Frag: Will drop all fragments on this packet\n");
ft->frag_flags |= FRAG_DROP_FRAGMENTS;
}
*/
static inline int FragIsComplete(FragTracker* ft)
{
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
- "[$] Checking completion criteria\n"); );
+ DebugMessage(DEBUG_FRAG,
+ "[$] Checking completion criteria\n");
/*
* check to see if the first and last frags have arrived
if ((ft->frag_flags & FRAG_GOT_FIRST) &&
(ft->frag_flags & FRAG_GOT_LAST))
{
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
- " Got First and Last frags\n"); );
+ DebugMessage(DEBUG_FRAG,
+ " Got First and Last frags\n");
/*
* if we've accumulated enough data to match the calculated size
*/
if (ft->frag_bytes == ft->calculated_size)
{
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
- " [!] frag_bytes = calculated_size!\n"); );
+ DebugMessage(DEBUG_FRAG,
+ " [!] frag_bytes = calculated_size!\n");
sfBase.iFragCompletes++;
if (ft->frag_bytes > ft->calculated_size)
{
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
- " [!] frag_bytes > calculated_size!\n"); );
+ DebugMessage(DEBUG_FRAG,
+ " [!] frag_bytes > calculated_size!\n");
sfBase.iFragCompletes++;
return 1;
}
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
+ DebugFormat(DEBUG_FRAG,
" Calc size (%d) != frag bytes (%d)\n",
- ft->calculated_size, ft->frag_bytes); );
+ ft->calculated_size, ft->frag_bytes);
/*
* no dice
return 0;
}
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
+ DebugFormat(DEBUG_FRAG,
" Missing First or Last frags (frag_flags: 0x%X)\n",
- ft->frag_flags); );
+ ft->frag_flags);
return 0;
}
/* Adjust the IP header size in pseudo packet for the new length */
uint8_t new_ip_hlen = ip::IP4_HEADER_LEN + ft->ip_options_len;
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
+ DebugFormat(DEBUG_FRAG,
"Adjusting IP Header to %d bytes\n",
- new_ip_hlen); );
+ new_ip_hlen);
iph->set_hlen(new_ip_hlen >> 2);
ret = SafeMemcpy(rebuild_ptr, ft->ip_options_data,
iph->ip_off = 0x0000;
dpkt->ptrs.decode_flags &= ~DECODE_FRAG;
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
- "[^^] Walking fraglist:\n"); );
+ DebugMessage(DEBUG_FRAG,
+ "[^^] Walking fraglist:\n");
}
/*
*/
for (frag = ft->fraglist; frag; frag = frag->next)
{
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
+ DebugFormat(DEBUG_FRAG,
" frag: %p\n"
" frag->data: %p\n"
" frag->offset: %d\n"
" frag->prev: %p\n"
" frag->next: %p\n",
frag, frag->data, frag->offset,
- frag->size, frag->prev, frag->next); );
+ frag->size, frag->prev, frag->next);
/*
* We somehow got a frag that had data beyond the calculated
/*
* process the packet through the detection engine
*/
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
- "Processing rebuilt packet:\n"); );
+ DebugMessage(DEBUG_FRAG,
+ "Processing rebuilt packet:\n");
ip_stats.reassembles++;
* Note, that this won't print out the IP Options or any other
* data that is established when the packet is decoded.
*/
- if (DEBUG_FRAG & GetDebugLevel())
+ if ( Debug::enabled(DEBUG_FRAG) )
LogIPPkt(dpkt);
-
#endif
encap_frag_cnt++;
SnortEventqPop();
encap_frag_cnt--;
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
- "Done with rebuilt packet, marking rebuilt...\n"); );
+ DebugMessage(DEBUG_FRAG,
+ "Done with rebuilt packet, marking rebuilt...\n");
ft->frag_flags = ft->frag_flags | FRAG_REBUILT;
}
*/
static inline void delete_node(FragTracker* ft, Fragment* node)
{
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG, "Deleting list node %p (p %p n %p)\n",
- node, node->prev, node->next); );
+ DebugFormat(DEBUG_FRAG, "Deleting list node %p (p %p n %p)\n",
+ node, node->prev, node->next);
if (node->prev)
{
Fragment* idx = ft->fraglist; /* pointer to the fraglist to delete */
Fragment* dump_me = NULL; /* ptr to the Fragment element to drop */
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
- "delete_tracker %d nodes to dump\n", ft->fraglist_count); );
+ DebugFormat(DEBUG_FRAG,
+ "delete_tracker %d nodes to dump\n", ft->fraglist_count);
/*
* delete all the nodes in a fraglist
#ifdef DEBUG
if ( p->is_ip4() )
{
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
+ DebugFormat(DEBUG_FRAG,
"[FRAG] Fragment discarded due to low TTL "
"[0x%X->0x%X], TTL: %d " "Offset: %d Length: %d\n",
ntohl(p->ptrs.ip_api.get_ip4h()->get_src()),
ntohl(p->ptrs.ip_api.get_ip4h()->get_dst()),
p->ptrs.ip_api.ttl(), frag_offset,
- p->dsize); );
+ p->dsize);
}
#endif
#ifdef DEBUG
if ( p->is_ip4() )
{
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
+ DebugFormat(DEBUG_FRAG,
"[FRAG] Fragment discarded due to large TTL Delta "
"[0x%X->0x%X], TTL: %d orig TTL: %d "
"Offset: %d Length: %d\n",
ntohl(p->ptrs.ip_api.get_ip4h()->get_src()),
ntohl(p->ptrs.ip_api.get_ip4h()->get_dst()),
p->ptrs.ip_api.ttl(), ft->ttl, frag_offset,
- p->dsize); );
+ p->dsize);
}
#endif
ip_stats.discards++;
*/
if (FragIsComplete(ft))
{
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
- "[*] Fragment is complete, rebuilding!\n"); );
+ DebugMessage(DEBUG_FRAG,
+ "[*] Fragment is complete, rebuilding!\n");
/*
* if the frag completes but it's bad we're just going to drop it
/*
* bonk/boink/jolt/etc attack...
*/
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
- "[..] Short frag (Bonk, etc) attack!\n"); );
+ DebugMessage(DEBUG_FRAG,
+ "[..] Short frag (Bonk, etc) attack!\n");
EventAnomShortFrag(fe);
if (ft->frag_flags & FRAG_GOT_LAST)
{
/* oversize frag attack */
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
- "[..] Oversize frag pkt!\n"); );
+ DebugMessage(DEBUG_FRAG,
+ "[..] Oversize frag pkt!\n");
EventAnomOversize(fe);
/*
* zero size frag...
*/
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
- "[..] Zero size frag!\n"); );
+ DebugMessage(DEBUG_FRAG,
+ "[..] Zero size frag!\n");
EventAnomZeroFrag(fe);
/*
* oversize pkt...
*/
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
- "[..] Oversize frag!\n"); );
+ DebugMessage(DEBUG_FRAG,
+ "[..] Oversize frag!\n");
EventAnomBadsizeLg(fe);
ft->frag_pkts++;
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
+ DebugFormat(DEBUG_FRAG,
"Walking frag list (%d nodes), new frag %d@%d\n",
- ft->fraglist_count, fragLength, frag_offset); );
+ ft->fraglist_count, fragLength, frag_offset);
/*
* Need to figure out where in the frag list this frag should go
i++;
right = idx;
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
+ DebugFormat(DEBUG_FRAG,
"%d right o %d s %d ptr %p prv %p nxt %p\n",
i, right->offset, right->size, right,
- right->prev, right->next); );
+ right->prev, right->next);
if (right->offset >= frag_offset)
{
*/
if (left)
{
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
+ DebugFormat(DEBUG_FRAG,
"Dealing with previous (left) frag %d@%d\n",
- left->size, left->offset); );
+ left->size, left->offset);
/*
* generate the overlap of the current packet fragment
/*
* teardrop attack...
*/
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
- "[..] Teardrop attack!\n"); );
+ DebugMessage(DEBUG_FRAG,
+ "[..] Teardrop attack!\n");
EventAttackTeardrop(fe);
frag_offset += (int16_t)overlap;
slide = (int16_t)overlap;
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
+ DebugFormat(DEBUG_FRAG,
"left overlap, new frag moves: %d bytes, "
- "slide: %d\n", overlap, slide); );
+ "slide: %d\n", overlap, slide);
if (frag_end <= frag_offset)
{
/*
* zero size frag
*/
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
- "zero size frag\n"); );
+ DebugMessage(DEBUG_FRAG,
+ "zero size frag\n");
EventAnomZeroFrag(fe);
return FRAG_INSERT_ANOMALY;
}
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG, "left overlap, "
- "truncating new pkt (slide: %d)\n", slide); );
+ DebugFormat(DEBUG_FRAG, "left overlap, "
+ "truncating new pkt (slide: %d)\n", slide);
break;
}
left_overlap_last:
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG, "[!!] left overlap, "
+ DebugFormat(DEBUG_FRAG, "[!!] left overlap, "
"truncating old pkt (offset: %d overlap: %d)\n",
- left->offset, overlap); );
+ left->offset, overlap);
if (left->size <= 0)
{
dump_me = left;
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG, "retrans, "
+ DebugFormat(DEBUG_FRAG, "retrans, "
"dumping old frag (offset: %d overlap: %d)\n",
- dump_me->offset, overlap); );
+ dump_me->offset, overlap);
left = left->prev;
*/
if (frag_end < frag_offset)
{
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
- "frag_end < frag_offset!"); );
+ DebugMessage(DEBUG_FRAG,
+ "frag_end < frag_offset!");
EventAnomBadsizeSm(fe);
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG, "No left overlap!\n"); );
+ DebugMessage(DEBUG_FRAG, "No left overlap!\n");
}
}
if ((uint16_t)fragLength > pkt_snaplen)
{
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
+ DebugFormat(DEBUG_FRAG,
"Overly large fragment %d 0x%x 0x%x %d\n",
fragLength, p->ptrs.ip_api.dgram_len(), p->ptrs.ip_api.off(),
- net_frag_offset); );
+ net_frag_offset);
MODULE_PROFILE_END(fragInsertPerfStats);
return FRAG_INSERT_FAILED;
}
*/
while (right && (right->offset < frag_end) && !done)
{
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
+ DebugFormat(DEBUG_FRAG,
"Next (right)fragment %d@%d\n",
- right->size, right->offset); );
+ right->size, right->offset);
trunc = 0;
overlap = frag_end - right->offset;
/*
* teardrop attack...
*/
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
- "[..] Teardrop attack!\n"); );
+ DebugMessage(DEBUG_FRAG,
+ "[..] Teardrop attack!\n");
EventAttackTeardrop(fe);
ip_stats.overlaps++;
ft->overlap_count++;
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
- "Right-side overlap %d bytes\n", overlap); );
+ DebugFormat(DEBUG_FRAG,
+ "Right-side overlap %d bytes\n", overlap);
/*
* once again, engine-based policy processing
right->size -= (int16_t)overlap;
ft->frag_bytes -= (int16_t)overlap;
}
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG, "[!!] right overlap, "
+ DebugFormat(DEBUG_FRAG, "[!!] right overlap, "
"truncating old frag (offset: %d, "
"overlap: %d)\n", right->offset, overlap);
DebugMessage(DEBUG_FRAG,
- "Exiting right overlap loop...\n"); );
+ "Exiting right overlap loop...\n");
if (right->size <= 0)
{
dump_me = right;
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG, "retrans, "
+ DebugFormat(DEBUG_FRAG, "retrans, "
"dumping old frag (offset: %d overlap: %d)\n",
- dump_me->offset, overlap); );
+ dump_me->offset, overlap);
right = right->next;
case FRAG_POLICY_SOLARIS:
case FRAG_POLICY_BSD_RIGHT:
trunc = (int16_t)overlap;
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG, "[!!] right overlap, "
+ DebugFormat(DEBUG_FRAG, "[!!] right overlap, "
"truncating new frag (offset: %d "
"overlap: %d)\n",
right->offset, overlap);
DebugMessage(DEBUG_FRAG,
- "Exiting right overlap loop...\n"); );
+ "Exiting right overlap loop...\n");
break;
}
dump_me = right;
ft->frag_bytes -= right->size;
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG, "retrans, "
+ DebugFormat(DEBUG_FRAG, "retrans, "
"dumping old frag (offset: %d overlap: %d)\n",
- dump_me->offset, overlap); );
+ dump_me->offset, overlap);
right = right->next;
trunc = (int16_t)overlap;
}
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG, "right overlap, "
+ DebugFormat(DEBUG_FRAG, "right overlap, "
"rejecting new overlap data (overlap: %d, "
- "trunc: %d)\n", overlap, trunc); );
+ "trunc: %d)\n", overlap, trunc);
if (frag_end - trunc <= frag_offset)
{
/*
* zero size frag
*/
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
+ DebugFormat(DEBUG_FRAG,
"zero size frag (len: %d overlap: %d)\n",
- fragLength, overlap); );
+ fragLength, overlap);
ip_stats.discards++;
dump_me = right;
ft->frag_bytes -= right->size;
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG, "retrans, "
+ DebugFormat(DEBUG_FRAG, "retrans, "
"dumping old frag (offset: %d overlap: %d)\n",
- dump_me->offset, overlap); );
+ dump_me->offset, overlap);
right = right->next;
(ft->overlap_count >= fe->max_overlaps))
{
// overlap limit exceeded. Raise event on all subsequent fragments
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG, "Reached overlap limit.\n"); );
+ DebugMessage(DEBUG_FRAG, "Reached overlap limit.\n");
EventExcessiveOverlap(fe);
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
- "Fully truncated right overlap\n"); );
+ DebugMessage(DEBUG_FRAG,
+ "Fully truncated right overlap\n");
}
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
- "insert(): returning normally\n"); );
+ DebugMessage(DEBUG_FRAG,
+ "insert(): returning normally\n");
MODULE_PROFILE_END(fragInsertPerfStats);
return ret;
/* Just to double check */
if (fragLength > pkt_snaplen)
{
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
+ DebugFormat(DEBUG_FRAG,
"Overly large fragment length:%d(0x%x) off:0x%x(%d)\n",
fragLength, p->ptrs.ip_api.dgram_len(), p->ptrs.ip_api.off(),
- p->ptrs.ip_api.off()); );
+ p->ptrs.ip_api.off());
/* Ah, crap. Return that tracker. */
return 0;
/*
* bonk/boink/jolt/etc attack...
*/
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
- "[..] Short frag (Bonk, etc) attack!\n"); );
+ DebugMessage(DEBUG_FRAG,
+ "[..] Short frag (Bonk, etc) attack!\n");
EventAnomShortFrag(&engine);
/*
* zero size frag
*/
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
+ DebugFormat(DEBUG_FRAG,
"zero size frag after left & right trimming "
"(len: %d slide: %d trunc: %d)\n",
- len, slide, trunc); );
+ len, slide, trunc);
ip_stats.discards++;
newfrag = ft->fraglist;
while (newfrag)
{
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
+ DebugFormat(DEBUG_FRAG,
"Size: %d, offset: %d, len %d, "
"Prev: 0x%x, Next: 0x%x, This: 0x%x, Ord: %d, %s\n",
newfrag->size, newfrag->offset,
newfrag->flen, newfrag->prev,
newfrag->next, newfrag, newfrag->ord,
- newfrag->last ? "Last" : ""); );
+ newfrag->last ? "Last" : "");
newfrag = newfrag->next;
}
#endif
newfrag->offset = frag_offset;
newfrag->last = lastfrag;
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
+ DebugFormat(DEBUG_FRAG,
"[+] Adding new frag, offset %d, size %d\n"
" nf->data = nf->fptr(%p) + slide (%d)\n"
" nf->size = len(%d) - slide(%d) - trunc(%d)\n",
newfrag->offset, newfrag->size, newfrag->fptr,
- slide, fragLength, slide, trunc); );
+ slide, fragLength, slide, trunc);
/*
* insert the new frag into the list
*/
add_node(ft, left, newfrag);
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
+ DebugFormat(DEBUG_FRAG,
"[*] Inserted new frag %d@%d ptr %p data %p prv %p nxt %p\n",
newfrag->size, newfrag->offset, newfrag, newfrag->data,
- newfrag->prev, newfrag->next); );
+ newfrag->prev, newfrag->next);
/*
* record the current size of the data in the fraglist
*/
ft->frag_bytes += newfrag->size;
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
+ DebugFormat(DEBUG_FRAG,
"[#] accumulated bytes on FragTracker %d, count"
- " %d\n", ft->frag_bytes, ft->fraglist_count); );
+ " %d\n", ft->frag_bytes, ft->fraglist_count);
*retFrag = newfrag;
return FRAG_INSERT_OK;
*/
add_node(ft, left, newfrag);
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
+ DebugFormat(DEBUG_FRAG,
"[*] Inserted new frag %d@%d ptr %p data %p prv %p nxt %p\n",
newfrag->size, newfrag->offset, newfrag, newfrag->data,
- newfrag->prev, newfrag->next); );
+ newfrag->prev, newfrag->next);
/*
* record the current size of the data in the fraglist
*/
ft->frag_bytes += newfrag->size;
- DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
+ DebugFormat(DEBUG_FRAG,
"[#] accumulated bytes on FragTracker %d, count"
- " %d\n", ft->frag_bytes, ft->fraglist_count); );
+ " %d\n", ft->frag_bytes, ft->fraglist_count);
*retFrag = newfrag;
return FRAG_INSERT_OK;
{
if ( p->packet_flags & PKT_FROM_CLIENT )
{
- DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Stream: Updating on packet from client\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "Stream: Updating on packet from client\n");
lws->ssn_state.session_flags |= SSNFLAG_SEEN_CLIENT;
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Stream: Updating on packet from server\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "Stream: Updating on packet from server\n");
lws->ssn_state.session_flags |= SSNFLAG_SEEN_SERVER;
}
if ( (lws->ssn_state.session_flags & SSNFLAG_SEEN_CLIENT) &&
(lws->ssn_state.session_flags & SSNFLAG_SEEN_SERVER) )
{
- DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Stream: session established!\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "Stream: session established!\n");
lws->ssn_state.session_flags |= SSNFLAG_ESTABLISHED;
bool IpSession::setup(Packet*)
{
- DEBUG_WRAP(DebugMessage(DEBUG_STREAM,
- "Stream IP session created!\n"); );
+ DebugMessage(DEBUG_STREAM,
+ "Stream IP session created!\n");
memset(&tracker, 0, sizeof(tracker));
// FIXIT count ip session creates here
uint32_t at = 0;
*flags &= ~(PKT_PDU_HEAD | PKT_PDU_TAIL);
- DEBUG_WRAP(DebugMessage(DEBUG_STREAM_PAF,
+ DebugFormat(DEBUG_STREAM_PAF,
"%s: type=%d, fpt=%u, len=%u, tot=%u\n",
- __FUNCTION__, ft, ps->fpt, s5_len, ps->tot); )
+ __FUNCTION__, ft, ps->fpt, s5_len, ps->tot);
switch ( ft )
{
StreamSplitter* ss, PAF_State* ps, Flow* ssn,
uint32_t flags, const uint8_t* data, uint32_t len, FlushType* ft)
{
- DEBUG_WRAP(DebugMessage(DEBUG_STREAM_PAF,
+ DebugFormat(DEBUG_STREAM_PAF,
"%s: paf=%d, idx=%u, len=%u, fpt=%u\n",
- __FUNCTION__, ps->paf, s5_idx, s5_len, ps->fpt); )
+ __FUNCTION__, ps->paf, s5_idx, s5_len, ps->fpt);
uint16_t fuzz = 0; // FIXIT-L PAF add a little zippedy-do-dah
const uint8_t* data, uint32_t len, uint32_t total,
uint32_t seq, uint32_t* flags)
{
- DEBUG_WRAP(DebugMessage(DEBUG_STREAM_PAF,
+ DebugFormat(DEBUG_STREAM_PAF,
"%s: len=%u, amt=%u, seq=%u, cur=%u, pos=%u, fpt=%u, tot=%u, paf=%d\n",
- __FUNCTION__, len, total, seq, ps->seq, ps->pos, ps->fpt, ps->tot, ps->paf); )
+ __FUNCTION__, len, total, seq, ps->seq, ps->pos, ps->fpt, ps->tot, ps->paf);
if ( !paf_initialized(ps) )
{
#include "stream/stream_api.h"
#include "network_inspectors/normalize/norm.h"
-//#define DEBUG_STREAM DEBUG
-
#define STREAM_DEFAULT_SSN_TIMEOUT 30 /* seconds to timeout a session */
#define STREAM_MAX_SSN_TIMEOUT 3600*24 /* max timeout (approx 1 day) */
#define STREAM_MIN_SSN_TIMEOUT 1 /* min timeout (1 second) */
((p->packet_flags & PKT_FROM_CLIENT) &&
(flow->ssn_state.session_flags & SSNFLAG_DROP_CLIENT)) )
{
- DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ DebugFormat(DEBUG_STREAM_STATE,
"Blocking %s packet as session was blocked\n",
- p->packet_flags & PKT_FROM_SERVER ? "server" : "client"); );
+ p->packet_flags & PKT_FROM_SERVER ? "server" : "client");
DisableDetect(p);
Active::drop_packet(p);
((p->packet_flags & PKT_FROM_CLIENT) &&
(flow->ssn_state.ignore_direction & SSN_DIR_FROM_SERVER)) )
{
- DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ DebugFormat(DEBUG_STREAM_STATE,
"Stream Ignoring packet from %d. Session marked as ignore\n",
- p->packet_flags & PKT_FROM_CLIENT ? "sender" : "responder"); );
+ p->packet_flags & PKT_FROM_CLIENT ? "sender" : "responder");
DisableInspection(p);
return true;
if ( (flow->session_state & STREAM_STATE_TIMEDOUT)
|| StreamExpire(p, flow) )
{
- DEBUG_WRAP(DebugMessage(DEBUG_STREAM, "Stream IP session timeout!\n"); );
+ DebugMessage(DEBUG_STREAM, "Stream IP session timeout!\n");
flow->ssn_state.session_flags |= SSNFLAG_TIMEDOUT;
return true;
}
#define SLAM_MAX 4
-//#define DEBUG_STREAM_EX
-#ifdef DEBUG_STREAM_EX
-#define STREAM_DEBUG_WRAP(x) DEBUG_WRAP(x)
-#else
-#define STREAM_DEBUG_WRAP(x)
-#endif
-
#define SL_BUF_FLUSHED 1
struct TcpDataBlock
"proxy"
};
-#ifdef DEBUG_STREAM_EX
+#ifdef DEBUG_MSGS
static const char* const state_names[] =
{
"none",
LogMessage(" win: %d\n", tdb->win);
LogMessage(" end: 0x%08X\n", tdb->end_seq);
}
-
-static void PrintFlushMgr(FlushMgr* fm)
-{
- if (fm == NULL)
- return;
-
- switch (fm->flush_policy)
- {
- case STREAM_FLPOLICY_IGNORE:
- STREAM_DEBUG_WRAP(DebugMessage(
- DEBUG_STREAM_STATE, " IGNORE\n"); );
- break;
-
- case STREAM_FLPOLICY_ON_ACK:
- STREAM_DEBUG_WRAP(DebugMessage(
- DEBUG_STREAM_STATE, " PROTOCOL\n"); );
- break;
-
- case STREAM_FLPOLICY_ON_DATA:
- STREAM_DEBUG_WRAP(DebugMessage(
- DEBUG_STREAM_STATE, " PROTOCOL_IPS\n"); );
- break;
- }
-}
-
-#endif // DEBUG_STREAM_EX
+#endif
static inline void Discard()
{
tcpStats.internalEvents++;
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Stream raised internal event %d\n", eventSid); );
+ DebugFormat(DEBUG_STREAM_STATE,
+ "Stream raised internal event %d\n", eventSid);
SnortEventqAdd(GENERATOR_INTERNAL, eventSid);
}
static inline int IsBetween(uint32_t low, uint32_t high, uint32_t cur)
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "(%X, %X, %X) = (low, high, cur)\n", low,high,cur); );
+ DebugFormat(DEBUG_STREAM_STATE,
+ "(%X, %X, %X) = (low, high, cur)\n", low,high,cur);
/* If we haven't seen anything, ie, low & high are 0, return true */
if ((low == 0) && (low == high))
static inline int ValidRst(
Flow* lwssn, TcpTracker *st, TcpDataBlock *tdb)
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ DebugFormat(DEBUG_STREAM_STATE,
"Checking end_seq (%X) > r_win_base (%X) && "
"seq (%X) < r_nxt_ack(%X)\n",
tdb->end_seq, st->r_win_base, tdb->seq,
- st->r_nxt_ack+StreamGetWindow(lwssn, st, tdb)); );
+ st->r_nxt_ack+StreamGetWindow(lwssn, st, tdb));
switch (st->os_policy)
{
case STREAM_POLICY_HPUX11:
if (SEQ_GEQ(tdb->seq, st->r_nxt_ack))
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "rst is valid seq (>= next seq)!\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "rst is valid seq (>= next seq)!\n");
return 1;
}
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "rst is not valid seq (>= next seq)!\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "rst is not valid seq (>= next seq)!\n");
return 0;
break;
case STREAM_POLICY_FIRST:
case STREAM_POLICY_IRIX:
if (SEQ_EQ(tdb->seq, st->r_nxt_ack))
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "rst is valid seq (next seq)!\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "rst is valid seq (next seq)!\n");
return 1;
}
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "rst is not valid seq (next seq)!\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "rst is not valid seq (next seq)!\n");
return 0;
break;
case STREAM_POLICY_BSD:
// reset must be admitted when window closed
if ( SEQ_LEQ(tdb->seq, st->r_win_base+StreamGetWindow(lwssn, st, tdb)) )
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "rst is valid seq (within window)!\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "rst is valid seq (within window)!\n");
return 1;
}
}
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "rst is not valid seq (within window)!\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "rst is not valid seq (within window)!\n");
return 0;
break;
}
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "rst is not valid!\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "rst is not valid!\n");
return 0;
}
if ((talker->flags & TF_TSTAMP) && (listener->flags & TF_TSTAMP))
{
char validate_timestamp = 1;
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Checking timestamps for PAWS\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "Checking timestamps for PAWS\n");
*got_ts = StreamGetTcpTimestamp(p, &tdb->ts, 0);
if (result < 0)
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Packet outside PAWS window, dropping\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "Packet outside PAWS window, dropping\n");
/* bail, we've got a packet outside the PAWS window! */
//Discard();
*eventcode |= EVENT_BAD_TIMESTAMP;
((uint32_t)p->pkth->ts.tv_sec > talker->ts_last_pkt+PAWS_24DAYS))
{
/* this packet is from way too far into the future */
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ DebugFormat(DEBUG_STREAM_STATE,
"packet PAWS timestamp way too far ahead of"
"last packet %d %d...\n", p->pkth->ts.tv_sec,
- talker->ts_last_pkt); );
+ talker->ts_last_pkt);
//Discard();
*eventcode |= EVENT_BAD_TIMESTAMP;
NormalDropPacketIf(p, NORM_TCP_OPT);
}
else
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "packet PAWS ok...\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "packet PAWS ok...\n");
}
}
}
* but continue to process the packet
*/
*eventcode |= EVENT_NO_TIMESTAMP;
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "packet no timestamp, had one earlier from this side...ok for now...\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "packet no timestamp, had one earlier from this side...ok for now...\n");
if (listener->config->policy == STREAM_POLICY_SOLARIS)
{
// (nop) the timestamp option. this includes the cases where
// we disable timestamp handling.
int strip = ( SetupOK(talker) && SetupOK(listener) );
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "listener not doing timestamps...\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "listener not doing timestamps...\n");
*got_ts = StreamGetTcpTimestamp(p, &tdb->ts, strip);
if (*got_ts)
/* Old Linux & Windows allows a 0 timestamp value. */
break;
default:
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Packet with 0 timestamp, dropping\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "Packet with 0 timestamp, dropping\n");
//Discard();
/* bail */
*eventcode |= EVENT_BAD_TIMESTAMP;
int right_ok;
uint32_t left_seq;
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ DebugFormat(DEBUG_STREAM_STATE,
"Checking end_seq (%X) > r_win_base (%X) && "
"seq (%X) < r_nxt_ack(%X)\n",
tdb->end_seq, st->r_win_base, tdb->seq,
- st->r_nxt_ack+StreamGetWindow(lwssn, st, tdb)); );
+ st->r_nxt_ack+StreamGetWindow(lwssn, st, tdb));
if ( SEQ_LT(st->r_nxt_ack, st->r_win_base) )
left_seq = st->r_nxt_ack;
if ( SEQ_LEQ(tdb->seq, st->r_win_base+win) )
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "seq is within window!\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "seq is within window!\n");
return 1;
}
else
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "seq is past the end of the window!\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "seq is past the end of the window!\n");
}
}
else
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "end_seq is before win_base\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "end_seq is before win_base\n");
}
return 0;
}
TcpSegment *dump_me;
int i = 0;
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "In DeleteSeglist\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "In DeleteSeglist\n");
while (idx)
{
i++;
TcpSegment::term(dump_me);
}
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Dropped %d segments\n", i); );
+ DebugFormat(DEBUG_STREAM_STATE,
+ "Dropped %d segments\n", i);
}
static inline int purge_alerts(
{
if ( SEQ_LT(st->seglist_base_seq, flush_seq) )
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "setting st->seglist_base_seq to 0x%X\n", flush_seq); );
+ DebugFormat(DEBUG_STREAM_STATE,
+ "setting st->seglist_base_seq to 0x%X\n", flush_seq);
st->seglist_base_seq = flush_seq;
}
return 0;
ss = st->seglist;
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ DebugFormat(DEBUG_STREAM_STATE,
"In purge_to_seq, start seq = 0x%X end seq = 0x%X delta %d\n",
- ss->seq, flush_seq, flush_seq-ss->seq); );
+ ss->seq, flush_seq, flush_seq-ss->seq);
while (ss)
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "s: %X sz: %d\n", ss->seq, ss->size); );
+ DebugFormat(DEBUG_STREAM_STATE,
+ "s: %X sz: %d\n", ss->seq, ss->size);
dump_me = ss;
ss = ss->next;
if ( SEQ_LT(st->seglist_base_seq, flush_seq) )
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "setting st->seglist_base_seq to 0x%X\n", flush_seq); );
+ DebugFormat(DEBUG_STREAM_STATE,
+ "setting st->seglist_base_seq to 0x%X\n", flush_seq);
st->seglist_base_seq = flush_seq;
}
if ( SEQ_LT(st->r_nxt_ack, flush_seq) )
const uint8_t *flushbuf_end)
{
uint16_t bytes_flushed = 0;
- STREAM_DEBUG_WRAP(uint32_t bytes_queued = st->seg_bytes_logical; );
+ DEBUG_WRAP(uint32_t bytes_queued = st->seg_bytes_logical; );
uint32_t segs = 0;
uint32_t flags = PKT_PDU_HEAD;
PROFILE_VARS;
unsigned bytes_copied = 0;
assert(bytes_to_copy);
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Flushing %u bytes from %X\n", bytes_to_copy, ss->seq));
+ DebugFormat(DEBUG_STREAM_STATE,
+ "Flushing %u bytes from %X\n", bytes_to_copy, ss->seq);
if (
!ss->next || (bytes_to_copy < ss->size) ||
break;
}
- STREAM_DEBUG_WRAP(bytes_queued -= bytes_flushed; );
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ DEBUG_WRAP(bytes_queued -= bytes_flushed; );
+ DebugFormat(DEBUG_STREAM_STATE,
"flushed %d bytes / %d segs on stream, "
"%d still queued\n",
- bytes_flushed, segs, bytes_queued); );
+ bytes_flushed, segs, bytes_queued);
MODULE_PROFILE_END(s5TcpBuildPacketPerfStats);
return bytes_flushed;
if (footprint == 0)
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ DebugFormat(DEBUG_STREAM_STATE,
"Negative footprint, bailing %d (0x%X - 0x%X)\n",
- footprint, stop_seq, st->seglist_base_seq); );
+ footprint, stop_seq, st->seglist_base_seq);
MODULE_PROFILE_END(s5TcpFlushPerfStats);
return bytes_processed;
}
-#ifdef DEBUG_STREAM_EX
if (footprint < st->seg_bytes_logical)
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ DebugFormat(DEBUG_STREAM_STATE,
"Footprint less than queued bytes, "
"win_base: 0x%X base_seq: 0x%X\n",
- stop_seq, st->seglist_base_seq); );
+ stop_seq, st->seglist_base_seq);
}
-#endif
if (footprint > s5_pkt->max_dsize)
{
stop_seq = st->seglist_base_seq + footprint;
}
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Attempting to flush %lu bytes\n", footprint); );
+ DebugFormat(DEBUG_STREAM_STATE,
+ "Attempting to flush %lu bytes\n", footprint);
((DAQ_PktHdr_t*)s5_pkt->pkth)->ts.tv_sec = st->seglist_next->tv.tv_sec;
((DAQ_PktHdr_t*)s5_pkt->pkth)->ts.tv_usec = st->seglist_next->tv.tv_usec;
st->seglist_base_seq += flushed_bytes;
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "setting st->seglist_base_seq to 0x%X\n", st->seglist_base_seq); );
+ DebugFormat(DEBUG_STREAM_STATE,
+ "setting st->seglist_base_seq to 0x%X\n", st->seglist_base_seq);
if ( st->splitter )
st->splitter->update();
static inline int flush_to_seq(
TcpSession *tcpssn, TcpTracker *st, uint32_t bytes, Packet *p, uint32_t pkt_flags)
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "In flush_to_seq()\n"); );
+ DebugMessage(DEBUG_STREAM_STATE, "In flush_to_seq()\n");
if ( !bytes )
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "bailing, no data\n"); );
+ DebugMessage(DEBUG_STREAM_STATE, "bailing, no data\n");
return 0;
}
if ( !st->seglist_next )
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "bailing, bad seglist ptr\n"); );
+ DebugMessage(DEBUG_STREAM_STATE, "bailing, bad seglist ptr\n");
return 0;
}
if (!DataToFlush(st) && !(st->flags & TF_FORCE_FLUSH))
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "only 1 packet in seglist no need to flush\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "only 1 packet in seglist no need to flush\n");
return 0;
}
static void TcpSessionClear (Flow* lwssn, TcpSession* tcpssn, int freeApplicationData)
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "In TcpSessionClear, %lu bytes in use\n", tcp_memcap->used()); );
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "client has %d segs queued\n", tcpssn->client.seg_count); );
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "server has %d segs queued\n", tcpssn->server.seg_count); );
+ DebugFormat(DEBUG_STREAM_STATE,
+ "In TcpSessionClear, %lu bytes in use\n", tcp_memcap->used());
+ DebugFormat(DEBUG_STREAM_STATE,
+ "client has %d segs queued\n", tcpssn->client.seg_count);
+ DebugFormat(DEBUG_STREAM_STATE,
+ "server has %d segs queued\n", tcpssn->server.seg_count);
// update stats
if ( tcpssn->tcp_init )
// generate event for rate filtering
EventInternal(INTERNAL_EVENT_SESSION_DEL);
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "After cleaning, %lu bytes in use\n", tcp_memcap->used()); );
+ DebugFormat(DEBUG_STREAM_STATE,
+ "After cleaning, %lu bytes in use\n", tcp_memcap->used());
tcpssn->lws_init = tcpssn->tcp_init = false;
}
static uint32_t StreamGetTcpTimestamp(Packet* p, uint32_t* ts, int strip)
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Getting timestamp...\n"); );
+ DebugMessage(DEBUG_STREAM_STATE, "Getting timestamp...\n");
const NormMode mode = Normalize_GetMode(NORM_TCP_OPT);
TcpOptIterator iter(p->ptrs.tcph, p);
else if ( !strip || !NormalStripTimeStamp(p, &opt, mode) )
{
*ts = EXTRACT_32BITS(opt.data);
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Found timestamp %lu\n", *ts); );
-
+ DebugFormat(DEBUG_STREAM_STATE, "Found timestamp %lu\n", *ts);
return TF_TSTAMP;
}
}
}
*ts = 0;
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "No timestamp...\n"); );
+ DebugMessage(DEBUG_STREAM_STATE, "No timestamp...\n");
return TF_NONE;
}
static uint32_t StreamGetMss(Packet* p, uint16_t* value)
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Getting MSS...\n"); );
+ DebugMessage(DEBUG_STREAM_STATE, "Getting MSS...\n");
TcpOptIterator iter(p->ptrs.tcph, p);
for (const TcpOption& opt : iter)
if (opt.code == TcpOptCode::MAXSEG)
{
*value = EXTRACT_16BITS(opt.data);
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Found MSS %u\n", *value); );
+ DebugFormat(DEBUG_STREAM_STATE, "Found MSS %u\n", *value);
return TF_MSS;
}
}
*value = 0;
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "No MSS...\n"); );
+ DebugMessage(DEBUG_STREAM_STATE, "No MSS...\n");
return TF_NONE;
}
static uint32_t StreamGetWscale(Packet* p, uint16_t* value)
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Getting wscale...\n"); );
+ DebugMessage(DEBUG_STREAM_STATE, "Getting wscale...\n");
TcpOptIterator iter(p->ptrs.tcph, p);
if (opt.code == TcpOptCode::WSCALE)
{
*value = (uint16_t)opt.data[0];
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Found wscale %d\n", *value); );
+ DebugFormat(DEBUG_STREAM_STATE, "Found wscale %d\n", *value);
/* If scale specified in option is larger than 14,
* use 14 because of limitation in the math of
}
*value = 0;
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "No wscale...\n"); );
+ DebugMessage(DEBUG_STREAM_STATE, "No wscale...\n");
return TF_NONE;
}
{
uint16_t wscale;
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Checking for wscale...\n"); );
+ DebugMessage(DEBUG_STREAM_STATE, "Checking for wscale...\n");
return StreamGetWscale(p, &wscale);
}
if ( p->ptrs.tcph->th_flags & TH_FIN )
server->l_nxt_seq--;
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "seglist_base_seq = %X\n", client->seglist_base_seq); );
+ DebugFormat(DEBUG_STREAM_STATE,
+ "seglist_base_seq = %X\n", client->seglist_base_seq);
if (!(ssn->flow->session_state & STREAM_STATE_MIDSTREAM))
{
static inline int SegmentFastTrack(TcpSegment *tail, TcpDataBlock *tdb)
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ DebugFormat(DEBUG_STREAM_STATE,
"Checking seq for fast track: %X > %X\n", tdb->seq,
- tail->seq + tail->size); );
+ tail->seq + tail->size);
if (SEQ_EQ(tdb->seq, tail->seq + tail->size))
return 1;
* zero size data because of trimming. Don't
* insert it
*/
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ DebugFormat(DEBUG_STREAM_STATE,
"zero size TCP data after left & right trimming "
"(len: %d slide: %d trunc: %d)\n",
- len, slide, trunc); );
+ len, slide, trunc);
Discard();
NormalTrimPayloadIfWin(p, 0, tdb);
{
TcpSegment *idx = st->seglist;
unsigned long i = 0;
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Dumping seglist, %d segments\n", st->seg_count); );
+ DebugFormat(DEBUG_STREAM_STATE,
+ "Dumping seglist, %d segments\n", st->seg_count);
while (idx)
{
i++;
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ DebugFormat(DEBUG_STREAM_STATE,
"%d ptr: %p seq: 0x%X size: %d nxt: %p prv: %p\n",
- i, idx, idx->seq, idx->size, idx->next, idx->prev); );
+ i, idx, idx->seq, idx->size, idx->next, idx->prev);
if (st->seg_count < i)
FatalError("Circular list\n");
p->packet_flags |= PKT_STREAM_INSERT;
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ DebugFormat(DEBUG_STREAM_STATE,
"added %d bytes on segment list @ seq: 0x%X, total %lu, "
"%d segments queued\n", ss->size, ss->seq,
- st->seg_bytes_logical, SegsToFlush(st, 0)); );
+ st->seg_bytes_logical, SegsToFlush(st, 0));
#ifdef SEG_TEST
CheckSegments(st);
StreamSeglistAddNode(st, left, ss);
//st->total_bytes_queued += ss->size;
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ DebugFormat(DEBUG_STREAM_STATE,
"added %d bytes on segment list @ seq: 0x%X, total %lu, "
"%d segments queued\n", ss->size, ss->seq,
- st->seg_bytes_logical, SegsToFlush(st, 0)); );
+ st->seg_bytes_logical, SegsToFlush(st, 0));
*retSeg = ss;
return STREAM_INSERT_OK;
PROFILE_VARS;
MODULE_PROFILE_START(s5TcpInsertPerfStats);
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, "In NewQueue\n"); );
+ DebugMessage(DEBUG_STREAM_STATE, "In NewQueue\n");
uint32_t overlap = 0;
uint32_t seq = tdb->seq;
/* new packet seq is below the last ack... */
if ( SEQ_GT(st->r_win_base, seq) )
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "segment overlaps ack'd data...\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "segment overlaps ack'd data...\n");
overlap = st->r_win_base - tdb->seq;
if (overlap >= p->dsize)
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "full overlap on ack'd data, dropping segment\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "full overlap on ack'd data, dropping segment\n");
MODULE_PROFILE_END(s5TcpInsertPerfStats);
return;
}
// BLOCK add new block to seglist containing data
AddStreamNode(st, p, tdb, p->dsize, overlap, 0, tdb->seq+overlap, NULL);
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ DebugFormat(DEBUG_STREAM_STATE,
"Attached new queue to seglist, %d bytes queued, "
"base_seq 0x%X\n",
- p->dsize-overlap, st->seglist_base_seq); );
+ p->dsize-overlap, st->seglist_base_seq);
MODULE_PROFILE_END(s5TcpInsertPerfStats);
}
uint16_t rsize = p->dsize;
uint32_t rseq = tdb->seq;
PROFILE_VARS;
- STREAM_DEBUG_WRAP(
+ DEBUG_WRAP(
TcpSegment *lastptr = NULL;
uint32_t base_seq = st->seglist_base_seq;
int last = 0;
else
reassembly_policy = st->reassembly_policy;
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ DebugFormat(DEBUG_STREAM_STATE,
"Queuing %d bytes on stream!\n"
"base_seq: %X seq: %X seq_end: %X\n",
- seq_end - seq, base_seq, seq, seq_end); );
+ seq_end - seq, base_seq, seq, seq_end);
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "%d segments on seglist\n", SegsToFlush(st, 0)); );
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+\n"); );
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+\n"); );
+ DebugFormat(DEBUG_STREAM_STATE,
+ "%d segments on seglist\n", SegsToFlush(st, 0));
+ DebugMessage(DEBUG_STREAM_STATE,
+ "!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+\n");
+ DebugMessage(DEBUG_STREAM_STATE,
+ "!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+\n");
MODULE_PROFILE_START(s5TcpInsertPerfStats);
left = st->seglist_tail;
right = NULL;
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ DebugFormat(DEBUG_STREAM_STATE,
"Fast tracking segment! (tail_seq %X size %d)\n",
- st->seglist_tail->seq, st->seglist_tail->size); );
+ st->seglist_tail->seq, st->seglist_tail->size);
// BLOCK add to existing block and/or allocate new block
ret = AddStreamNode(st, p, tdb, len,
/* Start iterating at the head (left) */
for (ss = st->seglist; ss; ss = ss->next)
{
- STREAM_DEBUG_WRAP(
- DebugMessage(DEBUG_STREAM_STATE,
- "ss: %p seq: 0x%X size: %lu delta: %d\n",
- ss, ss->seq, ss->size, (ss->seq-base_seq) - last);
+ DEBUG_WRAP(
+ DebugFormat(DEBUG_STREAM_STATE,
+ "ss: %p seq: 0x%X size: %lu delta: %d\n",
+ ss, ss->seq, ss->size, (ss->seq-base_seq) - last);
+
last = ss->seq-base_seq;
lastptr = ss;
- DebugMessage(DEBUG_STREAM_STATE,
- " lastptr: %p ss->next: %p ss->prev: %p\n",
- lastptr, ss->next, ss->prev);
- );
+ DebugFormat(DEBUG_STREAM_STATE,
+ " lastptr: %p ss->next: %p ss->prev: %p\n",
+ lastptr, ss->next, ss->prev);
+ );
right = ss;
/* Start iterating at the tail (right) */
for (ss = st->seglist_tail; ss; ss = ss->prev)
{
- STREAM_DEBUG_WRAP(
- DebugMessage(DEBUG_STREAM_STATE,
- "ss: %p seq: 0x%X size: %lu delta: %d\n",
- ss, ss->seq, ss->size, (ss->seq-base_seq) - last);
+ DEBUG_WRAP(
+ DebugFormat(DEBUG_STREAM_STATE,
+ "ss: %p seq: 0x%X size: %lu delta: %d\n",
+ ss, ss->seq, ss->size, (ss->seq-base_seq) - last);
+
last = ss->seq-base_seq;
lastptr = ss;
- DebugMessage(DEBUG_STREAM_STATE,
- " lastptr: %p ss->next: %p ss->prev: %p\n",
- lastptr, ss->next, ss->prev);
- );
+ DebugFormat(DEBUG_STREAM_STATE,
+ " lastptr: %p ss->next: %p ss->prev: %p\n",
+ lastptr, ss->next, ss->prev);
+ );
left = ss;
left = NULL;
}
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+\n"); );
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+\n");
+ DebugMessage(DEBUG_STREAM_STATE,
+ "!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+\n");
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ DebugFormat(DEBUG_STREAM_STATE,
"left: %p:0x%X right: %p:0x%X\n", left,
- left ? left->seq : 0, right, right ? right->seq : 0); );
+ left ? left->seq : 0, right, right ? right->seq : 0);
/*
* handle left overlaps
*/
/* check if the new segment overlaps on the left side */
overlap = left->seq + left->size - seq;
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "left overlap %d\n", overlap); );
+ DebugFormat(DEBUG_STREAM_STATE,
+ "left overlap %d\n", overlap);
if (overlap > 0)
{
case REASSEMBLY_POLICY_IRIX:
case REASSEMBLY_POLICY_OLD_LINUX:
case REASSEMBLY_POLICY_MACOS:
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "left overlap, honoring old data\n"); );
+ DebugMessage(DEBUG_STREAM_STATE, "left overlap, honoring old data\n");
if (SEQ_LT(left->seq,tdb->seq) && SEQ_GT(left->seq + left->size, tdb->seq +
p->dsize))
{
/* New packet is entirely overlapped by an
* existing packet on both sides. Drop the
* new data. */
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "left overlap, honoring old data\n"); );
+ DebugMessage(DEBUG_STREAM_STATE, "left overlap, honoring old data\n");
seq += overlap;
//slide = overlap;
if (SEQ_LEQ(seq_end, seq))
/* Otherwise, trim the old data accordingly */
left->size -= (int16_t)overlap;
st->seg_bytes_logical -= overlap;
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "left overlap, honoring new data\n"); );
+ DebugMessage(DEBUG_STREAM_STATE, "left overlap, honoring new data\n");
break;
case REASSEMBLY_POLICY_LAST:
/* True "Last" policy" */
st->seg_bytes_logical -= overlap;
}
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "left overlap, honoring new data\n"); );
+ DebugMessage(DEBUG_STREAM_STATE, "left overlap, honoring new data\n");
break;
}
if (SEQ_LEQ(seq_end, seq))
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "seq_end < seq"); );
+ DebugMessage(DEBUG_STREAM_STATE, "seq_end < seq");
/*
* houston, we have a problem
*/
}
else
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "No left overlap\n"); );
+ DebugMessage(DEBUG_STREAM_STATE, "No left overlap\n");
}
}
//overlap = right->size - (right->seq - seq);
//right->seq + right->size - seq_end;
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ DebugFormat(DEBUG_STREAM_STATE,
"right overlap(%d): len: %d right->seq: 0x%X seq: 0x%X\n",
- overlap, len, right->seq, seq); );
+ overlap, len, right->seq, seq);
/* Treat sequence number overlap as a retransmission
* Only check right side since left side happens rarely
*/
tcpStats.overlaps++;
st->overlap_count++;
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Got partial right overlap\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "Got partial right overlap\n");
switch (reassembly_policy)
{
continue;
}
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Got full right overlap\n"); );
+ DebugMessage(DEBUG_STREAM_STATE, "Got full right overlap\n");
tcpStats.overlaps++;
st->overlap_count++;
{
dump_me = right;
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ DebugFormat(DEBUG_STREAM_STATE,
"retrans, dropping old data at seq %d, size %d\n",
- right->seq, right->size); );
+ right->seq, right->size);
right = right->next;
StreamSeglistDeleteNode(st, dump_me);
break;
/* Fall through */
case REASSEMBLY_POLICY_FIRST:
case REASSEMBLY_POLICY_VISTA:
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Got full right overlap, truncating new\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "Got full right overlap, truncating new\n");
if ( ips_data == NORM_MODE_ON )
{
unsigned offset = right->seq - tdb->seq;
/* Adjusted seq is fully overlapped */
if (SEQ_EQ(seq, seq_end))
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ DebugFormat(DEBUG_STREAM_STATE,
"StreamQueue got full right overlap with "
"resulting seq too high, bad segment "
"(seq: %X seq_end: %X overlap: %lu\n",
- seq, seq_end, overlap); );
+ seq, seq_end, overlap);
EventBadSegment();
Discard();
MODULE_PROFILE_END(s5TcpInsertPerfStats);
trunc += overlap;
if (SEQ_LEQ((int)(seq_end - trunc), seq))
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ DebugFormat(DEBUG_STREAM_STATE,
"StreamQueue got full right overlap with "
"resulting seq too high, bad segment "
"(seq: %X seq_end: %X overlap: %lu\n",
- seq, seq_end, overlap); );
+ seq, seq_end, overlap);
EventBadSegment();
Discard();
MODULE_PROFILE_END(s5TcpInsertPerfStats);
case REASSEMBLY_POLICY_OLD_LINUX:
case REASSEMBLY_POLICY_LAST:
right_overlap_last:
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Got full right overlap of old, dropping old\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "Got full right overlap of old, dropping old\n");
dump_me = right;
right = right->next;
StreamSeglistDeleteNode(st, dump_me);
}
else
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Fully truncated right overlap\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "Fully truncated right overlap\n");
}
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "StreamQueue returning normally\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "StreamQueue returning normally\n");
MODULE_PROFILE_END(s5TcpInsertPerfStats);
return ret;
Packet *p, TcpDataBlock *tdb,
StreamTcpConfig* config)
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "In ProcessTcpStream(), %d bytes to queue\n", p->dsize); );
+ DebugFormat(DEBUG_STREAM_STATE,
+ "In ProcessTcpStream(), %d bytes to queue\n", p->dsize);
if ( p->packet_flags & PKT_IGNORE )
return;
if (rcv->flush_policy == STREAM_FLPOLICY_IGNORE)
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Ignoring segment due to IGNORE flush_policy\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "Ignoring segment due to IGNORE flush_policy\n");
return;
}
return;
}
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "queuing segment\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "queuing segment\n");
if ( !rcv->seg_count )
{
else
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Bailing, data on SYN, not MAC Policy!\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "Bailing, data on SYN, not MAC Policy!\n");
NormalTrimPayloadIfSyn(p, 0, tdb);
MODULE_PROFILE_END(s5TcpDataPerfStats);
return STREAM_UNALIGNED;
if ( listener->config->policy != STREAM_POLICY_PROXY and
StreamGetWindow(tcpssn->flow, listener, tdb) == 0 )
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Bailing, we're out of the window!\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "Bailing, we're out of the window!\n");
NormalTrimPayloadIfWin(p, 0, tdb);
MODULE_PROFILE_END(s5TcpDataPerfStats);
return STREAM_UNALIGNED;
* See HP, Solaris, et al. for those that favor
* duplicate data over the original in some cases.
*/
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ DebugFormat(DEBUG_STREAM_STATE,
"out of order segment (tdb->seq: 0x%X "
- "l->r_nxt_ack: 0x%X!\n", tdb->seq, listener->r_nxt_ack); );
+ "l->r_nxt_ack: 0x%X!\n", tdb->seq, listener->r_nxt_ack);
if (listener->s_mgr.state_queue == TCP_STATE_NONE)
{
if ( listener->config->policy != STREAM_POLICY_PROXY and
StreamGetWindow(tcpssn->flow, listener, tdb) == 0 )
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Bailing, we're out of the window!\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "Bailing, we're out of the window!\n");
NormalTrimPayloadIfWin(p, 0, tdb);
MODULE_PROFILE_END(s5TcpDataPerfStats);
return STREAM_UNALIGNED;
}
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "adding TcpSession to lightweight session\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "adding TcpSession to lightweight session\n");
lwssn->protocol = p->type();
tmp->flow = lwssn;
* start new sessions on proper SYN packets
*****************************************************************/
tmp = (TcpSession*)lwssn->session;
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Creating new session tracker on SYN!\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "Creating new session tracker on SYN!\n");
lwssn->ssn_state.session_flags |= SSNFLAG_SEEN_CLIENT;
tmp->server.r_nxt_ack = tmp->client.l_unackd;
tmp->server.r_win_base = tdb->seq+1;
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "seglist_base_seq = %X\n", tmp->server.seglist_base_seq); );
+ DebugFormat(DEBUG_STREAM_STATE,
+ "seglist_base_seq = %X\n", tmp->server.seglist_base_seq);
tmp->server.s_mgr.state = TCP_STATE_LISTEN;
tmp->client.flags |= StreamGetTcpTimestamp(p, &tmp->client.ts_last, 0);
TcpSession* tmp;
{
tmp = (TcpSession*)lwssn->session;
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Creating new session tracker on SYN_ACK!\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "Creating new session tracker on SYN_ACK!\n");
lwssn->ssn_state.session_flags |= SSNFLAG_SEEN_SERVER;
tmp->client.l_nxt_seq = tdb->ack;
tmp->client.isn = tdb->ack-1;
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "seglist_base_seq = %X\n", tmp->client.seglist_base_seq); );
+ DebugFormat(DEBUG_STREAM_STATE,
+ "seglist_base_seq = %X\n", tmp->client.seglist_base_seq);
tmp->client.s_mgr.state = TCP_STATE_SYN_SENT;
tmp->server.flags |= StreamGetTcpTimestamp(p, &tmp->server.ts_last, 0);
* start new sessions on completion of 3-way (ACK only, no data)
*****************************************************************/
tmp = (TcpSession*)lwssn->session;
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Creating new session tracker on ACK!\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "Creating new session tracker on ACK!\n");
lwssn->ssn_state.session_flags |= SSNFLAG_SEEN_CLIENT;
tmp->server.r_nxt_ack = tmp->client.l_unackd;
tmp->server.r_win_base = tdb->seq+1;
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "seglist_base_seq = %X\n", tmp->server.seglist_base_seq); );
+ DebugFormat(DEBUG_STREAM_STATE,
+ "seglist_base_seq = %X\n", tmp->server.seglist_base_seq);
tmp->server.s_mgr.state = TCP_STATE_ESTABLISHED;
tmp->client.flags |= StreamGetTcpTimestamp(p, &tmp->client.ts_last, 0);
TcpSession* tmp;
{
tmp = (TcpSession*)lwssn->session;
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Creating new session tracker on data packet (ACK|PSH)!\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "Creating new session tracker on data packet (ACK|PSH)!\n");
if (lwssn->ssn_state.direction == FROM_CLIENT)
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Session direction is FROM_CLIENT\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "Session direction is FROM_CLIENT\n");
/* Sender is client (src port is higher) */
lwssn->ssn_state.session_flags |= SSNFLAG_SEEN_CLIENT;
//tmp->server.l_nxt_seq = tdb->ack + 1;
tmp->server.l_unackd = tdb->ack - 1;
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "seglist_base_seq = %X\n", tmp->server.seglist_base_seq); );
+ DebugFormat(DEBUG_STREAM_STATE,
+ "seglist_base_seq = %X\n", tmp->server.seglist_base_seq);
tmp->server.s_mgr.state = TCP_STATE_ESTABLISHED;
tmp->client.flags |= StreamGetTcpTimestamp(p, &tmp->client.ts_last, 0);
}
else
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Session direction is FROM_SERVER\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "Session direction is FROM_SERVER\n");
/* Sender is server (src port is lower) */
lwssn->ssn_state.session_flags |= SSNFLAG_SEEN_SERVER;
tmp->client.l_window = 0; /* reset later */
tmp->client.isn = tdb->ack-1;
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "seglist_base_seq = %X\n", tmp->client.seglist_base_seq); );
+ DebugFormat(DEBUG_STREAM_STATE,
+ "seglist_base_seq = %X\n", tmp->client.seglist_base_seq);
tmp->client.s_mgr.state = TCP_STATE_ESTABLISHED;
tmp->server.flags |= StreamGetTcpTimestamp(p, &tmp->server.ts_last, 0);
*/
if (SEQ_EQ(tdb->seq, listener->r_nxt_ack))
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ DebugMessage(DEBUG_STREAM_STATE,
"Got syn on established windows ssn, which causes Reset,"
- "bailing\n"); );
+ "bailing\n");
tcpssn->flow->ssn_state.session_flags |= SSNFLAG_RESET;
talker->s_mgr.state = TCP_STATE_CLOSED;
return ACTION_RST;
}
else
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ DebugMessage(DEBUG_STREAM_STATE,
"Got syn on established windows ssn, not causing Reset,"
- "bailing\n"); );
+ "bailing\n");
Discard();
return ACTION_NOTHING;
}
break;
case STREAM_POLICY_MACOS:
/* MACOS ignores a 2nd SYN, regardless of the sequence number. */
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ DebugMessage(DEBUG_STREAM_STATE,
"Got syn on established macos ssn, not causing Reset,"
- "bailing\n"); );
+ "bailing\n");
Discard();
return ACTION_NOTHING;
break;
/* If its not a retransmission of the actual SYN... RESET */
if (!SEQ_EQ(tdb->seq,talker->isn))
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Got syn on established ssn, which causes Reset, bailing\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "Got syn on established ssn, which causes Reset, bailing\n");
tcpssn->flow->ssn_state.session_flags |= SSNFLAG_RESET;
talker->s_mgr.state = TCP_STATE_CLOSED;
return ACTION_RST;
}
else
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ DebugMessage(DEBUG_STREAM_STATE,
"Got syn on established ssn, not causing Reset,"
- "bailing\n"); );
+ "bailing\n");
Discard();
return ACTION_NOTHING;
}
TcpSession *tcpssn = NULL;
TcpTracker *talker = NULL;
TcpTracker *listener = NULL;
- STREAM_DEBUG_WRAP(char *t = NULL; char *l = NULL;)
+ DEBUG_WRAP(const char *t = NULL; const char *l = NULL;)
PROFILE_VARS;
if (lwssn->protocol != PktType::TCP)
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Lightweight session not TCP on TCP packet\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "Lightweight session not TCP on TCP packet\n");
return retcode;
}
if ( p->ptrs.tcph->is_syn_only() )
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ DebugMessage(DEBUG_STREAM_STATE,
"Stream SYN PACKET, establishing lightweight"
- "session direction.\n"); );
+ "session direction.\n");
/* SYN packet from client */
lwssn->ssn_state.direction = FROM_CLIENT;
lwssn->session_state |= STREAM_STATE_SYN;
if ((lwssn->session_state == STREAM_STATE_NONE) ||
(lwssn->ssn_state.session_flags & SSNFLAG_RESET))
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ DebugMessage(DEBUG_STREAM_STATE,
"Stream SYN|ACK PACKET, establishing lightweight"
- "session direction.\n"); );
+ "session direction.\n");
lwssn->ssn_state.direction = FROM_SERVER;
}
lwssn->session_state |= STREAM_STATE_SYN_ACK;
if (p->packet_flags & PKT_FROM_SERVER)
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Stream: Updating on packet from server\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "Stream: Updating on packet from server\n");
lwssn->ssn_state.session_flags |= SSNFLAG_SEEN_SERVER;
if (tcpssn->tcp_init)
listener = &tcpssn->client;
}
- STREAM_DEBUG_WRAP(
+ DEBUG_WRAP(
t = "Server";
l = "Client");
}
else
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Stream: Updating on packet from client\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "Stream: Updating on packet from client\n");
/* if we got here we had to see the SYN already... */
lwssn->ssn_state.session_flags |= SSNFLAG_SEEN_CLIENT;
if (tcpssn->tcp_init)
listener = &tcpssn->server;
}
- STREAM_DEBUG_WRAP(
+ DEBUG_WRAP(
t = "Client";
l = "Server"; );
lwssn->ssn_state.session_flags = SSNFLAG_SEEN_SERVER;
}
}
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Got SYN pkt on reset ssn, re-SYN-ing\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "Got SYN pkt on reset ssn, re-SYN-ing\n");
}
// FIXIT-L why flush here instead of just purge?
if ( Normalize_GetMode(NORM_TCP_TRIM_SYN) == NORM_MODE_OFF )
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Got data on SYN packet, not processing it\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "Got data on SYN packet, not processing it\n");
//EventDataOnSyn(config);
eventcode |= EVENT_DATA_ON_SYN;
retcode |= ACTION_BAD_PKT;
return retcode;
}
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ DebugFormat(DEBUG_STREAM_STATE,
" %s [talker] state: %s\n", t,
- state_names[talker->s_mgr.state]); );
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ state_names[talker->s_mgr.state]);
+ DebugFormat(DEBUG_STREAM_STATE,
" %s state: %s(%d)\n", l,
state_names[listener->s_mgr.state],
- listener->s_mgr.state); );
+ listener->s_mgr.state);
// may find better placement to eliminate redundant flag checks
if (p->ptrs.tcph->th_flags & TH_SYN)
*/
if (!IsBetween(listener->l_unackd, listener->l_nxt_seq, tdb->ack))
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Pkt ack is out of bounds, bailing!\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "Pkt ack is out of bounds, bailing!\n");
Discard();
NormalTrimPayloadIfWin(p, 0, tdb);
LogTcpEvents(eventcode);
*/
if (p->ptrs.tcph->th_flags & TH_RST)
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "got RST\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "got RST\n");
NormalTrimPayloadIfRst(p, 0, tdb);
*/
if (ValidRstSynSent(listener, tdb))
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "got RST, closing talker\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "got RST, closing talker\n");
/* Reset is valid */
/* Mark session as reset... Leave it around so that any
* additional data sent from one side or the other isn't
return retcode | ACTION_RST;
}
/* Reset not valid. */
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "bad sequence number, bailing\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "bad sequence number, bailing\n");
Discard();
eventcode |= EVENT_BAD_RST;
NormalDropPacketIf(p, NORM_TCP_BLOCK);
talker->ts_last_pkt = p->pkth->ts.tv_sec;
talker->ts_last = tdb->ts;
}
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Finish server init got called!\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "Finish server init got called!\n");
}
else
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Finish server init didn't get called!\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "Finish server init didn't get called!\n");
}
if ((p->ptrs.tcph->th_flags & TH_ECE) &&
* explicitly set the state
*/
listener->s_mgr.state = TCP_STATE_SYN_SENT;
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Accepted SYN ACK\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "Accepted SYN ACK\n");
LogTcpEvents(eventcode);
MODULE_PROFILE_END(s5TcpStatePerfStats);
return retcode;
if (ValidRst(lwssn, listener, tdb))
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Got RST, bailing\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "Got RST, bailing\n");
if (
listener->s_mgr.state == TCP_STATE_FIN_WAIT_1 ||
return retcode | ACTION_RST;
}
/* Reset not valid. */
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "bad sequence number, bailing\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "bad sequence number, bailing\n");
Discard();
eventcode |= EVENT_BAD_RST;
NormalDropPacketIf(p, NORM_TCP_BLOCK);
(listener->s_mgr.state >= TCP_STATE_ESTABLISHED) and
!ValidSeq(p, lwssn, listener, tdb) )
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "bad sequence number, bailing\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "bad sequence number, bailing\n");
Discard();
NormalTrimPayloadIfWin(p, 0, tdb);
LogTcpEvents(eventcode);
if (ts_action != ACTION_NOTHING)
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "bad timestamp, bailing\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "bad timestamp, bailing\n");
Discard();
// this packet was normalized elsewhere
LogTcpEvents(eventcode);
/*
* update PAWS timestamps
*/
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ DebugFormat(DEBUG_STREAM_STATE,
"PAWS update tdb->seq %lu > listener->r_win_base %lu\n",
- tdb->seq, listener->r_win_base); );
+ tdb->seq, listener->r_win_base);
if (got_ts && SEQ_EQ(listener->r_win_base, tdb->seq))
{
if ((int32_t)(tdb->ts - talker->ts_last) >= 0 ||
(uint32_t)p->pkth->ts.tv_sec >= talker->ts_last_pkt+PAWS_24DAYS)
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "updating timestamps...\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "updating timestamps...\n");
talker->ts_last = tdb->ts;
talker->ts_last_pkt = p->pkth->ts.tv_sec;
}
}
else
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "not updating timestamps...\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "not updating timestamps...\n");
}
/*
{
if (listener->config->max_window && (tdb->win > listener->config->max_window))
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Got window that was beyond the allowed policy value, bailing\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "Got window that was beyond the allowed policy value, bailing\n");
/* got a window too large, alert! */
eventcode |= EVENT_WINDOW_TOO_LARGE;
Discard();
&& !(p->ptrs.tcph->th_flags & (TH_FIN|TH_RST))
&& !(lwssn->ssn_state.session_flags & SSNFLAG_MIDSTREAM))
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Window slammed shut!\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "Window slammed shut!\n");
/* got a window slam alert! */
eventcode |= EVENT_WINDOW_SLAM;
Discard();
if (talker->s_mgr.state_queue != TCP_STATE_NONE)
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ DebugFormat(DEBUG_STREAM_STATE,
"Found queued state transition on ack 0x%X, "
"current 0x%X!\n", talker->s_mgr.transition_seq,
- tdb->ack); );
+ tdb->ack);
if (tdb->ack == talker->s_mgr.transition_seq)
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "accepting transition!\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "accepting transition!\n");
talker->s_mgr.state = talker->s_mgr.state_queue;
talker->s_mgr.state_queue = TCP_STATE_NONE;
}
*/
if ( p->ptrs.tcph->th_flags & TH_ACK )
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Got an ACK...\n"); );
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ DebugMessage(DEBUG_STREAM_STATE,
+ "Got an ACK...\n");
+ DebugFormat(DEBUG_STREAM_STATE,
" %s [listener] state: %s\n", l,
- state_names[listener->s_mgr.state]); );
+ state_names[listener->s_mgr.state]);
switch (listener->s_mgr.state)
{
case TCP_STATE_SYN_SENT:
break;
case TCP_STATE_SYN_RCVD:
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "listener state is SYN_SENT...\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "listener state is SYN_SENT...\n");
if ( IsBetween(listener->l_unackd, listener->l_nxt_seq, tdb->ack) )
{
UpdateSsn(p, listener, talker, tdb);
case TCP_STATE_FIN_WAIT_1:
UpdateSsn(p, listener, talker, tdb);
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ DebugFormat(DEBUG_STREAM_STATE,
"tdb->ack %X >= talker->r_nxt_ack %X\n",
- tdb->ack, talker->r_nxt_ack); );
+ tdb->ack, talker->r_nxt_ack);
if ( SEQ_EQ(tdb->ack, listener->l_nxt_seq) )
{
if ( (p->ptrs.tcph->th_flags & TH_FIN) )
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "seq ok, setting state!\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "seq ok, setting state!\n");
if (talker->s_mgr.state_queue == TCP_STATE_NONE)
{
}
else
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "bad ack!\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "bad ack!\n");
}
break;
*/
if (p->dsize)
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ DebugFormat(DEBUG_STREAM_STATE,
" %s state: %s(%d) getting data\n", l,
state_names[listener->s_mgr.state],
- listener->s_mgr.state); );
+ listener->s_mgr.state);
// FIN means only that sender is done talking,
// other side may continue yapping.
}
else
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ DebugFormat(DEBUG_STREAM_STATE,
"Queuing data on listener, t %s, l %s...\n",
flush_policy_names[talker->flush_policy],
- flush_policy_names[listener->flush_policy]); );
+ flush_policy_names[listener->flush_policy]);
if ( config->policy != STREAM_POLICY_PROXY )
{
if (p->ptrs.tcph->th_flags & TH_FIN)
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Got a FIN...\n"); );
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ DebugMessage(DEBUG_STREAM_STATE,
+ "Got a FIN...\n");
+ DebugFormat(DEBUG_STREAM_STATE,
" %s state: %s(%d)\n", l,
state_names[talker->s_mgr.state],
- talker->s_mgr.state); );
+ talker->s_mgr.state);
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ DebugFormat(DEBUG_STREAM_STATE,
"checking ack (0x%X) vs nxt_ack (0x%X)\n",
- tdb->end_seq, listener->r_win_base); );
+ tdb->end_seq, listener->r_win_base);
if (SEQ_LT(tdb->end_seq,listener->r_win_base))
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "FIN inside r_win_base, bailing\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "FIN inside r_win_base, bailing\n");
goto dupfin;
}
else
if ( (listener->s_mgr.expected_flags == TH_ACK) &&
SEQ_GEQ(end_seq, listener->s_mgr.transition_seq) )
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "FIN beyond previous, ignoring\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "FIN beyond previous, ignoring\n");
eventcode |= EVENT_BAD_FIN;
LogTcpEvents(eventcode);
NormalDropPacketIf(p, NORM_TCP_BLOCK);
dupfin:
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ DebugFormat(DEBUG_STREAM_STATE,
" %s [talker] state: %s\n", t,
- state_names[talker->s_mgr.state]); );
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ state_names[talker->s_mgr.state]);
+ DebugFormat(DEBUG_STREAM_STATE,
" %s state: %s(%d)\n", l,
state_names[listener->s_mgr.state],
- listener->s_mgr.state); );
+ listener->s_mgr.state);
/*
* handle TIME_WAIT timer stuff
{
uint32_t flushed = 0;
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "In CheckFlushPolicyOnData\n"); );
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ DebugMessage(DEBUG_STREAM_STATE,
+ "In CheckFlushPolicyOnData\n");
+ DebugFormat(DEBUG_STREAM_STATE,
"Talker flush policy: %s\n",
- flush_policy_names[talker->flush_policy]); );
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ flush_policy_names[talker->flush_policy]);
+ DebugFormat(DEBUG_STREAM_STATE,
"Listener flush policy: %s\n",
- flush_policy_names[listener->flush_policy]); );
+ flush_policy_names[listener->flush_policy]);
switch (listener->flush_policy)
{
case STREAM_FLPOLICY_IGNORE:
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "STREAM_FLPOLICY_IGNORE\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "STREAM_FLPOLICY_IGNORE\n");
return 0;
case STREAM_FLPOLICY_ON_ACK:
{
uint32_t flushed = 0;
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "In CheckFlushPolicyOnAck\n"); );
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ DebugMessage(DEBUG_STREAM_STATE,
+ "In CheckFlushPolicyOnAck\n");
+ DebugFormat(DEBUG_STREAM_STATE,
"Talker flush policy: %s\n",
- flush_policy_names[talker->flush_policy]); );
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ flush_policy_names[talker->flush_policy]);
+ DebugFormat(DEBUG_STREAM_STATE,
"Listener flush policy: %s\n",
- flush_policy_names[listener->flush_policy]); );
+ flush_policy_names[listener->flush_policy]);
switch (talker->flush_policy)
{
case STREAM_FLPOLICY_IGNORE:
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "STREAM_FLPOLICY_IGNORE\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "STREAM_FLPOLICY_IGNORE\n");
return 0;
case STREAM_FLPOLICY_ON_ACK:
int ret;
assert(st && seg);
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ DebugFormat(DEBUG_STREAM_STATE,
"Dropping segment at seq %X, len %d\n",
- seg->seq, seg->size); );
+ seg->seq, seg->size);
if (seg->prev)
seg->prev->next = seg->next;
if ( delta < seg->size )
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ DebugFormat(DEBUG_STREAM_STATE,
"Left-Trimming segment at seq %X, len %d, delta %u\n",
- seg->seq, seg->size, delta); );
+ seg->seq, seg->size, delta);
seg->seq = flush_seq;
seg->size -= (uint16_t)delta;
* looked at it, so the packet_flags are already set. */
if(p->packet_flags & PKT_FROM_SERVER)
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Flushing listener on packet from server\n"););
+ DebugMessage(DEBUG_STREAM_STATE, "Flushing listener on packet from server\n");
listener = &client;
/* dir of flush is the data from the opposite side */
dir = PKT_FROM_SERVER;
}
else if (p->packet_flags & PKT_FROM_CLIENT)
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Flushing listener on packet from client\n"););
+ DebugMessage(DEBUG_STREAM_STATE, "Flushing listener on packet from client\n");
listener = &server;
/* dir of flush is the data from the opposite side */
dir = PKT_FROM_CLIENT;
* looked at it, so the packet_flags are already set. */
if(p->packet_flags & PKT_FROM_SERVER)
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Flushing talker on packet from server\n"););
+ DebugMessage(DEBUG_STREAM_STATE, "Flushing talker on packet from server\n");
talker = &server;
/* dir of flush is the data from the opposite side */
dir = PKT_FROM_CLIENT;
}
else if (p->packet_flags & PKT_FROM_CLIENT)
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Flushing talker on packet from client\n"););
+ DebugMessage(DEBUG_STREAM_STATE, "Flushing talker on packet from client\n");
talker = &client;
/* dir of flush is the data from the opposite side */
dir = PKT_FROM_SERVER;
int status;
PROFILE_VARS;
- STREAM_DEBUG_WRAP(
+ DEBUG_WRAP(
char flagbuf[9];
CreateTCPFlagString(p->ptrs.tcph, flagbuf);
- DebugMessage((DEBUG_STREAM|DEBUG_STREAM_STATE),
- "Got TCP Packet 0x%X:%d -> 0x%X:%d %s\nseq: 0x%X ack:0x%X dsize: %u\n",
- p->ptrs.ip_api.get_src(), p->ptrs.sp, p->ptrs.ip_api.get_dst(), p->ptrs.dp, flagbuf,
- ntohl(p->ptrs.tcph->th_seq), ntohl(p->ptrs.tcph->th_ack), p->dsize); );
+ DebugFormat((DEBUG_STREAM|DEBUG_STREAM_STATE),
+ "Got TCP Packet 0x%X:%d -> 0x%X:%d %s\nseq: 0x%X ack:0x%X dsize: %u\n",
+ p->ptrs.ip_api.get_src(), p->ptrs.sp, p->ptrs.ip_api.get_dst(), p->ptrs.dp, flagbuf,
+ ntohl(p->ptrs.tcph->th_seq), ntohl(p->ptrs.tcph->th_ack), p->dsize);
+ );
MODULE_PROFILE_START(s5TcpPerfStats);
// Do nothing with this packet since we require a 3-way ;)
DEBUG_WRAP(
DebugMessage(DEBUG_STREAM_STATE, "Stream: Requiring 3-way "
- "Handshake, but failed to retrieve session object "
- "for non SYN packet.\n"); );
+ "Handshake, but failed to retrieve session object "
+ "for non SYN packet.\n"); );
if ( !p->ptrs.tcph->is_rst() && !(event_mask & EVENT_NO_3WHS) )
{
}
else
{
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Stream TCP session timedout!\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "Stream TCP session timedout!\n");
/* Not reset, simply time'd out. Clean it up */
TcpSessionCleanup(flow, 1);
}
status = ProcessTcp(flow, p, &tdb, config);
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ DebugMessage(DEBUG_STREAM_STATE,
"Finished Stream TCP cleanly!\n"
- "---------------------------------------------------\n"); );
+ "---------------------------------------------------\n");
if ( !(status & ACTION_LWSSN_CLOSED) )
{
{
DisableInspection(p);
- STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
+ DebugFormat(DEBUG_STREAM_STATE,
"Stream Ignoring packet from %d. Session marked as ignore\n",
- p->packet_flags & PKT_FROM_SERVER ? "server" : "client"); );
+ p->packet_flags & PKT_FROM_SERVER ? "server" : "client");
}
MODULE_PROFILE_END(s5TcpPerfStats);
/* if both seen, mark established */
if (p->packet_flags & PKT_FROM_SERVER)
{
- DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Stream: Updating on packet from responder\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "Stream: Updating on packet from responder\n");
lwssn->ssn_state.session_flags |= SSNFLAG_SEEN_RESPONDER;
lwssn->set_ttl(p, false);
}
else
{
- DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
- "Stream: Updating on packet from client\n"); );
+ DebugMessage(DEBUG_STREAM_STATE,
+ "Stream: Updating on packet from client\n");
lwssn->ssn_state.session_flags |= SSNFLAG_SEEN_SENDER;
lwssn->set_ttl(p, true);
}
void FreeApplicationEntry(ApplicationEntry* app)
{
- DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, "Freeing ApplicationEntry: 0x%x\n",
- app); );
+ DebugFormat(DEBUG_ATTRIBUTE, "Freeing ApplicationEntry: 0x%x\n", app);
free(app);
}
if (!host)
return;
- DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, "Freeing HostEntry: 0x%x\n",
- host); );
+ DebugFormat(DEBUG_ATTRIBUTE, "Freeing HostEntry: 0x%x\n", host);
/* Free the service list */
if (host->services)
if (!host)
return;
- DebugMessage(DEBUG_ATTRIBUTE, "Host IP: %s/%d\n",
+ DebugFormat(DEBUG_ATTRIBUTE, "Host IP: %s/%d\n",
inet_ntoa(&host->ipAddr),
host->ipAddr.bits);
- DebugMessage(DEBUG_ATTRIBUTE,
+ DebugFormat(DEBUG_ATTRIBUTE,
"\tPolicy Information: frag:%s (%u) stream: %s (%u)\n",
"look-me-up", host->hostInfo.fragPolicy,
"look-me-up", host->hostInfo.streamPolicy);
for (i=0, app = host->services; app; app = app->next,i++)
{
- DebugMessage(DEBUG_ATTRIBUTE, "\tService #%d:\n", i);
- DebugMessage(DEBUG_ATTRIBUTE, "\t\tIPProtocol: %s\tPort: %s\tProtocol %s\n",
+ DebugFormat(DEBUG_ATTRIBUTE, "\tService #%d:\n", i);
+ DebugFormat(DEBUG_ATTRIBUTE, "\t\tIPProtocol: %s\tPort: %s\tProtocol %s\n",
app->ipproto, app->port, app->protocol);
}
if (i==0)
DebugMessage(DEBUG_ATTRIBUTE, "\tClients:\n");
for (i=0, app = host->clients; app; app = app->next,i++)
{
- DebugMessage(DEBUG_ATTRIBUTE, "\tClient #%d:\n", i);
- DebugMessage(DEBUG_ATTRIBUTE, "\t\tIPProtocol: %s\tProtocol %s\n",
+ DebugFormat(DEBUG_ATTRIBUTE, "\tClient #%d:\n", i);
+ DebugFormat(DEBUG_ATTRIBUTE, "\t\tIPProtocol: %s\tProtocol %s\n",
app->ipproto, app->protocol);
if (app->fields & APPLICATION_ENTRY_PORT)
{
- DebugMessage(DEBUG_ATTRIBUTE, "\t\tPort: %s\n", app->port);
+ DebugFormat(DEBUG_ATTRIBUTE, "\t\tPort: %s\n", app->port);
}
}
if (i==0)
reference = (SFTargetProtocolReference*)sfghash_find(proto_reference_table, (void*)protocol);
if (reference)
{
- DEBUG_WRAP(
- DebugMessage(DEBUG_ATTRIBUTE,
+ DebugFormat(DEBUG_ATTRIBUTE,
"Protocol Reference for %s exists as %d\n",
- protocol, reference->ordinal); );
+ protocol, reference->ordinal);
+
return reference->ordinal;
}
sfghash_add(proto_reference_table, reference->name, reference);
- DEBUG_WRAP(
- DebugMessage(DEBUG_ATTRIBUTE,
+ DebugFormat(DEBUG_ATTRIBUTE,
"Added Protocol Reference for %s as %d\n",
- protocol, reference->ordinal); );
+ protocol, reference->ordinal);
return reference->ordinal;
}
/* shift=make_shift(find,sizeof(find)-1);
skip=make_skip(find,sizeof(find)-1); */
- DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH,"%d\n",
+ DebugFormat(DEBUG_PATTERN_MATCH,"%d\n",
mSearch(test, sizeof(test) - 1, find,
- sizeof(find) - 1, shift, skip)); );
+ sizeof(find) - 1, shift, skip));
return 0;
}
int mSearch(
const char* buf, int blen, const char* ptrn, int plen, int* skip, int* shift)
{
- DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH,"buf: %p blen: %d ptrn: %p "
- "plen: %d\n", buf, blen, ptrn, plen); );
+ DebugFormat(DEBUG_PATTERN_MATCH,"buf: %p blen: %d ptrn: %p "
+ "plen: %d\n", buf, blen, ptrn, plen);
if (plen == 0)
return -1;
int cmpcnt = 0;
#endif /* DEBUG_MSGS */
- DEBUG_WRAP(
- DebugMessage(DEBUG_PATTERN_MATCH, "buf: %p blen: %d ptrn: %p "
+ DebugFormat(DEBUG_PATTERN_MATCH, "buf: %p blen: %d ptrn: %p "
" plen: %d b_idx: %d\n", buf, blen, ptrn, plen, b_idx);
- DebugMessage(DEBUG_PATTERN_MATCH, "packet data: \"%s\"\n", buf);
- DebugMessage(DEBUG_PATTERN_MATCH, "matching for \"%s\"\n", ptrn);
- );
+ DebugFormat(DEBUG_PATTERN_MATCH, "packet data: \"%s\"\n", buf);
+ DebugFormat(DEBUG_PATTERN_MATCH, "matching for \"%s\"\n", ptrn);
if (plen == 0)
return 1;
{
int p_idx = plen, skip_stride, shift_stride;
- DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH, "Looping... "
+ DebugFormat(DEBUG_PATTERN_MATCH, "Looping... "
"([%d]0x%X (%c) -> [%d]0x%X(%c))\n",
b_idx, buf[b_idx-1],
buf[b_idx-1],
- p_idx, ptrn[p_idx-1], ptrn[p_idx-1]); );
+ p_idx, ptrn[p_idx-1], ptrn[p_idx-1]);
while (buf[--b_idx] == ptrn[--p_idx]
|| (ptrn[p_idx] == '?' && !literal)
|| (ptrn[p_idx] == '*' && !literal)
|| (ptrn[p_idx] == '\\' && !literal))
{
- DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH, "comparing: b:%c -> p:%c\n",
- buf[b_idx], ptrn[p_idx]); );
+ DebugFormat(DEBUG_PATTERN_MATCH, "comparing: b:%c -> p:%c\n",
+ buf[b_idx], ptrn[p_idx]);
#ifdef DEBUG_MSGS
cmpcnt++;
#endif
literal = 1;
if (ptrn[p_idx] == '*')
{
- DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH,"Checking wildcard matching...\n"); );
+ DebugMessage(DEBUG_PATTERN_MATCH,"Checking wildcard matching...\n");
while (p_idx != 0 && ptrn[--p_idx] == '*')
; /* fool-proof */
while (buf[--b_idx] != ptrn[p_idx])
{
- DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH,
+ DebugFormat(DEBUG_PATTERN_MATCH,
"comparing: b[%d]:%c -> p[%d]:%c\n",
- b_idx, buf[b_idx], p_idx, ptrn[p_idx]); );
+ b_idx, buf[b_idx], p_idx, ptrn[p_idx]);
regexcomp++;
if (b_idx == 0)
{
- DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH,
- "b_idx went to 0, returning 0\n"); )
+ DebugMessage(DEBUG_PATTERN_MATCH,
+ "b_idx went to 0, returning 0\n");
return 0;
}
}
- DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH,
+ DebugFormat(DEBUG_PATTERN_MATCH,
"got wildcard final char match! (b[%d]: %c -> p[%d]: %c\n",
- b_idx, buf[b_idx], p_idx, ptrn[p_idx]); );
+ b_idx, buf[b_idx], p_idx, ptrn[p_idx]);
}
if (p_idx == 0)
{
- DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH, "match: compares = %d.\n",
- cmpcnt); );
+ DebugFormat(DEBUG_PATTERN_MATCH, "match: compares = %d.\n",
+ cmpcnt);
return 1;
}
break;
}
- DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH, "skip-shifting...\n"); );
+ DebugMessage(DEBUG_PATTERN_MATCH, "skip-shifting...\n");
skip_stride = skip[(unsigned char)buf[b_idx]];
shift_stride = shift[p_idx];
b_idx += (skip_stride > shift_stride) ? skip_stride : shift_stride;
- DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH, "b_idx skip-shifted to %d\n", b_idx); );
+ DebugFormat(DEBUG_PATTERN_MATCH, "b_idx skip-shifted to %d\n", b_idx);
b_idx += regexcomp;
- DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH,
- "b_idx regex compensated %d steps, to %d\n", regexcomp, b_idx); );
+ DebugFormat(DEBUG_PATTERN_MATCH,
+ "b_idx regex compensated %d steps, to %d\n", regexcomp, b_idx);
regexcomp = 0;
}
- DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH, "no match: compares = %d, b_idx = %d, "
- "blen = %d\n", cmpcnt, b_idx, blen); );
+ DebugFormat(DEBUG_PATTERN_MATCH, "no match: compares = %d, b_idx = %d, "
+ "blen = %d\n", cmpcnt, b_idx, blen);
return 0;
}
return;
}
- DEBUG_WRAP(DebugMessage(DEBUG_INIT,"SetChroot: %s\n",
- CurrentWorkingDir()); );
+ DebugFormat(DEBUG_INIT,"SetChroot: %s\n", CurrentWorkingDir());
const char* logdir = GetAbsolutePath(logstore.c_str());
- DEBUG_WRAP(DebugMessage(DEBUG_INIT, "SetChroot: %s\n",
- CurrentWorkingDir()));
+ DebugFormat(DEBUG_INIT, "SetChroot: %s\n", CurrentWorkingDir());
/* change to the directory */
if (chdir(directory.c_str()) != 0)
abslen = strlen(absdir);
- DEBUG_WRAP(DebugMessage(DEBUG_INIT, "ABS: %s %d\n", absdir, abslen); );
+ DebugFormat(DEBUG_INIT, "ABS: %s %d\n", absdir, abslen);
/* make the chroot call */
if (chroot(absdir) < 0)
return;
}
- DEBUG_WRAP(DebugMessage(DEBUG_INIT,"chroot success (%s ->", absdir); );
- DEBUG_WRAP(DebugMessage(DEBUG_INIT,"%s)\n ", CurrentWorkingDir()); );
+ DebugFormat(DEBUG_INIT,"chroot success (%s ->", absdir);
+ DebugFormat(DEBUG_INIT,"%s)\n ", CurrentWorkingDir());
/* change to "/" in the new directory */
if (chdir("/") < 0)
return;
}
- DEBUG_WRAP(DebugMessage(DEBUG_INIT,"chdir success (%s)\n",
- CurrentWorkingDir()); );
+ DebugFormat(DEBUG_INIT,"chdir success (%s)\n", CurrentWorkingDir());
if (strncmp(absdir, logdir, strlen(absdir)))
{
logstore = logdir + abslen;
}
- DEBUG_WRAP(DebugMessage(DEBUG_INIT,"new logdir from %s to %s\n",
- logdir, logstore.c_str()));
+ DebugFormat(DEBUG_INIT,"new logdir from %s to %s\n",
+ logdir, logstore.c_str());
LogMessage("Chroot directory = %s\n", directory.c_str());
}
projects / thirdparty / snort3.git / commitdiff
