#define CD_EAPOL_NAME "eapol"
#define CD_EAPOL_HELP "support for extensible authentication protocol over LAN"
+using namespace snort;
+
namespace
{
static const RuleMap eapol_rules[] =
#define CD_LINUX_SLL_HELP_STR "support for Linux SLL"
#define CD_LINUX_SLL_HELP ADD_DLT(CD_LINUX_SLL_HELP_STR, DLT_LINUX_SLL)
+using namespace snort;
+
namespace
{
class LinuxSllCodec : public Codec
#define CD_NULL_HELP_STR "support for null encapsulation"
#define CD_NULL_HELP ADD_DLT(CD_NULL_HELP_STR, DLT_NULL)
+using namespace snort;
+
namespace
{
class NullCodec : public Codec
#include "main/snort_config.h"
#include "protocols/packet_manager.h"
+using namespace snort;
+
#define CD_PBB_NAME "pbb"
#define CD_PBB_HELP "support for 802.1ah protocol"
#include "framework/codec.h"
+using namespace snort;
+
#define PFLOG_NAME "pflog"
#define PFLOG_HELP_STR "support for OpenBSD PF log"
#include "framework/codec.h"
+using namespace snort;
+
#define PPP_NAME "ppp"
#define PPP_HELP_STR "support for point-to-point encapsulation"
#define PPP_HELP ADD_DLT(PPP_HELP_STR, DLT_PPP)
#include "framework/codec.h"
+using namespace snort;
+
#define CD_RAW4_NAME "raw4"
#define CD_RAW4_HELP_STR "support for unencapsulated IPv4"
#define CD_RAW4_HELP ADD_DLT(ADD_DLT(CD_RAW4_HELP_STR, DLT_RAW), DLT_IPV4)
#include "framework/codec.h"
+using namespace snort;
+
#define CD_RAW6_NAME "raw6"
#define CD_RAW6_HELP_STR "support for unencapsulated IPv6"
#define CD_RAW6_HELP ADD_DLT(CD_RAW6_HELP_STR, DLT_IPV6)
#include "framework/codec.h"
+using namespace snort;
+
#define CD_SLIP_NAME "slip"
#define CD_SLIP_HELP_STR "support for slip protocol"
#define CD_SLIP_HELP ADD_DLT(CD_SLIP_HELP_STR, DLT_SLIP)
#include "framework/codec.h"
#include "protocols/token_ring.h"
+using namespace snort;
+
namespace
{
#define TR_NAME "token_ring"
#include "log/text_log.h"
#include "protocols/wlan.h"
+using namespace snort;
+
#define CD_WLAN_NAME "wlan"
#define CD_WLAN_HELP_STR "support for wireless local area network protocol"
#define CD_WLAN_HELP ADD_DLT(CD_WLAN_HELP_STR, DLT_IEEE802_11)
#include "pub_sub/http_events.h"
#include "time/packet_time.h"
+using namespace snort;
+
static const char* s_name = "data_log";
static const char* s_help = "log selected published data to data.log";
#include "profiler/profiler.h"
#include "protocols/packet.h"
+using namespace snort;
+
#define DPX_GID 256
#define DPX_SID 1
#include "time/packet_time.h"
#include "utils/util_cstring.h"
+using namespace snort;
+
static const char* s_name = "reg_test";
static const char* s_help = "The regression test inspector (rti) is used when special packet handling is required for a reg test";
#include "protocols/tcp.h"
#include "protocols/tcp_options.h"
+using namespace snort;
+
static const char* s_name = "mss";
static const char* s_help = "detection for TCP maximum segment size";
#include "hash/hashfcn.h"
#include "profiler/profiler.h"
+using namespace snort;
+
static const char* s_name = "pkt_num";
static const char* s_help = "alert on raw packet number";
#include "protocols/packet.h"
#include "protocols/tcp.h"
+using namespace snort;
+
static const char* s_name = "urg";
static const char* s_help = "detection for TCP urgent pointer";
#include "protocols/tcp.h"
#include "protocols/tcp_options.h"
+using namespace snort;
+
static const char* s_name = "wscale";
static const char* s_help = "detection for TCP window scale";
#include "framework/logger.h"
#include "framework/module.h"
+using namespace snort;
using namespace std;
static const char* s_name = "alert_ex";
#include "protocols/vlan.h"
#include "utils/stats.h"
+using namespace snort;
using namespace std;
#define LOG_BUFFER (4*K_BYTES)
#include "protocols/packet.h"
#include "utils/util.h"
+using namespace snort;
+
#define UNSOCK_FILE "snort_alert"
/* this is equivalent to the 32-bit pcap pkthdr struct
#include "framework/logger.h"
#include "framework/module.h"
+using namespace snort;
+
#define s_name "log_null"
#define s_help "disable logging of packets"
#include "sfksearch.h"
+using namespace snort;
+
//-------------------------------------------------------------------------
// "lowmem"
//-------------------------------------------------------------------------
}
static int KTrieBuildMatchStateNode(
- SnortConfig* sc, KTRIENODE* root, KTRIE_STRUCT* ts)
+ snort::SnortConfig* sc, KTRIENODE* root, KTRIE_STRUCT* ts)
{
int cnt = 0;
KTRIEPATTERN* p;
return cnt;
}
-static int KTrieBuildMatchStateTrees(SnortConfig* sc, KTRIE_STRUCT* ts)
+static int KTrieBuildMatchStateTrees(snort::SnortConfig* sc, KTRIE_STRUCT* ts)
{
int cnt = 0;
return 0;
}
-int KTrieCompile(SnortConfig* sc, KTRIE_STRUCT* ts)
+int KTrieCompile(snort::SnortConfig* sc, KTRIE_STRUCT* ts)
{
int rval;
#include <cstdint>
#include "search_engines/search_common.h"
+namespace snort
+{
+struct SnortConfig;
+}
+
struct KTRIEPATTERN
{
KTRIEPATTERN* next; /* global list of all patterns*/
KTRIE_STRUCT*, const uint8_t* P, unsigned n,
bool nocase, bool negative, void* id);
-int KTrieCompile(struct SnortConfig*, KTRIE_STRUCT*);
+int KTrieCompile(snort::SnortConfig*, KTRIE_STRUCT*);
int KTrieSearch(KTRIE_STRUCT*, const uint8_t* T, int n, MpseMatch, void* context);
#include "framework/base_api.h"
#include "main/snort_types.h"
-extern const BaseApi* se_lowmem;
+extern const snort::BaseApi* se_lowmem;
-SO_PUBLIC const BaseApi* snort_plugins[] =
+SO_PUBLIC const snort::BaseApi* snort_plugins[] =
{
se_lowmem,
nullptr
#include "framework/so_rule.h"
+using namespace snort;
+
static IpsOption::EvalStatus eval(void*, Cursor&, Packet*)
{
return IpsOption::MATCH;
#include "utils/util.h"
#include "utils/util_cstring.h"
+using namespace snort;
+
#define s_name "react"
#define s_help \
#include "packet_io/active.h"
#include "profiler/profiler.h"
+using namespace snort;
+
#define REJ_RST_SRC 0x01
#define REJ_RST_DST 0x02
#define REJ_UNR_NET 0x04
Active::send_reset(p, ENC_FLAG_FWD);
if ( flags & REJ_UNR_NET )
- Active::send_unreach(p, UnreachResponse::NET);
+ Active::send_unreach(p, snort::UnreachResponse::NET);
if ( flags & REJ_UNR_HOST )
- Active::send_unreach(p, UnreachResponse::HOST);
+ Active::send_unreach(p, snort::UnreachResponse::HOST);
if ( flags & REJ_UNR_PORT )
- Active::send_unreach(p, UnreachResponse::PORT);
+ Active::send_unreach(p, snort::UnreachResponse::PORT);
}
//-------------------------------------------------------------------------
#include "packet_io/active.h"
#include "protocols/packet.h"
+using namespace snort;
+
#define s_name "rewrite"
#define s_help \
#include <string>
-struct Packet;
-
// FIXIT-M these prevent dynamic ips replace option and action
void Replace_ResetQueue();
void Replace_QueueChange(const std::string&, unsigned);
#include "parser/parser.h"
#include "utils/stats.h"
+using namespace snort;
+
static void pass()
{
pc.pass_pkts++;
#include "main/snort_types.h"
-struct Packet;
struct OptTreeNode;
+namespace snort
+{
+struct Packet;
+
class SO_PUBLIC Actions
{
public:
static inline bool is_pass(Type a)
{ return ( a == PASS ); }
};
+}
#endif
#include "managers/plugin_manager.h"
#ifdef STATIC_IPS_ACTIONS
-extern const BaseApi* act_react[];
-extern const BaseApi* act_reject[];
+extern const snort::BaseApi* act_react[];
+extern const snort::BaseApi* act_reject[];
#endif
-extern const BaseApi* act_replace[];
+extern const snort::BaseApi* act_replace[];
void load_actions()
{
#include "main/snort_types.h"
+namespace snort
+{
class TestCaseInstaller
{
public:
*/
#define MAKE_SNORT_TEST_CASE(fun, ...) \
static void fun(); \
- static TestCaseInstaller INTERNAL_CATCH_UNIQUE_NAME(test_case_installer)(fun, __VA_ARGS__); \
+ static snort::TestCaseInstaller INTERNAL_CATCH_UNIQUE_NAME(test_case_installer)(fun, __VA_ARGS__); \
static void fun()
#undef TEST_CASE
#define TEST_CASE(...) MAKE_SNORT_TEST_CASE(INTERNAL_CATCH_UNIQUE_NAME(snort_test), __VA_ARGS__)
+}
#endif
#define CATCH_CONFIG_RUNNER
#include "snort_catch.h"
+using namespace snort;
+
static bool s_catch = false;
static std::vector<std::string> test_tags;
#include "framework/codec.h"
#include "managers/plugin_manager.h"
+using namespace snort;
+
extern const BaseApi* cd_ipv4[]; // static due to dependence on fpdetect
extern const BaseApi* cd_hopopts[]; // static to ensure the symbols CheckIPV6HopOptions
// and CheckIPv6ExtensionOrder the final executable.
#include "codecs/codec_module.h"
+using namespace snort;
+
#define codec_module_help \
"general decoder rules"
#include "framework/module.h"
#include "main/snort_types.h"
+namespace snort
+{
constexpr int GID_DECODE = 116;
//-----------------------------------------------------
Usage get_usage() const override
{ return CONTEXT; }
};
-
+}
#endif
#include "framework/codec.h"
#include "main/snort_config.h"
+using namespace snort;
+
#define CD_AUTH_NAME "auth"
#define CD_AUTH_HELP "support for IP authentication header"
#include "codecs/codec_module.h"
#include "framework/codec.h"
+using namespace snort;
+
#define CD_BAD_PROTO_NAME "bad_proto"
#define CD_BAD_PROTO_HELP "bad protocol id"
#include "framework/codec.h"
#include "main/snort_config.h"
+using namespace snort;
+
#define CD_DSTOPTS_NAME "ipv6_dst_opts"
#define CD_DSTOPTS_HELP "support for ipv6 destination options"
#include "framework/codec.h"
#include "main/snort_config.h"
+using namespace snort;
+
#define CD_ESP_NAME "esp"
#define CD_ESP_HELP "support for encapsulating security payload"
#include "log/text_log.h"
#include "main/snort_config.h"
+using namespace snort;
+
#define CD_IPV6_FRAG_NAME "ipv6_frag"
#define CD_IPV6_FRAG_HELP "support for IPv6 fragment decoding"
#include "packet_io/active.h"
#include "protocols/gre.h"
+using namespace snort;
+
#define CD_GRE_NAME "gre"
#define CD_GRE_HELP "support for generic routing encapsulation"
#include "framework/codec.h"
#include "main/snort_config.h"
+using namespace snort;
+
#define CD_HOPOPTS_NAME "ipv6_hop_opts"
#define CD_HOPOPTS_HELP "support for IPv6 hop options"
#include "checksum.h"
+using namespace snort;
+
#define CD_ICMP4_NAME "icmp4"
#define CD_ICMP4_HELP "support for Internet control message protocol v4"
#include "checksum.h"
+using namespace snort;
+
#define CD_ICMP6_NAME "icmp6"
#define CD_ICMP6_HELP "support for Internet control message protocol v6"
#include "framework/codec.h"
#include "codecs/codec_module.h"
+using namespace snort;
+
#define CD_IGMP_NAME "igmp"
#define CD_IGMP_HELP "support for Internet group management protocol"
#include "checksum.h"
+using namespace snort;
+
#define CD_IPV4_NAME "ipv4"
#define CD_IPV4_HELP "support for Internet protocol v4"
void format(bool reverse, uint8_t* raw_pkt, DecodeData& snort) override;
private:
- void IP4AddrTests(const IP4Hdr*, const CodecData&, DecodeData&);
- void IPMiscTests(const IP4Hdr* const ip4h, const CodecData& codec, uint16_t len);
+ void IP4AddrTests(const ip::IP4Hdr*, const CodecData&, DecodeData&);
+ void IPMiscTests(const ip::IP4Hdr* const ip4h, const CodecData& codec, uint16_t len);
void DecodeIPOptions(const uint8_t* start, uint8_t& o_len, CodecData& data);
};
return false;
}
- if ( SnortConfig::get_conf()->hit_ip_maxlayers(codec.ip_layer_cnt) )
+ if ( snort::SnortConfig::get_conf()->hit_ip_maxlayers(codec.ip_layer_cnt) )
{
codec_event(codec, DECODE_IP_MULTIPLE_ENCAPSULATION);
return false;
++codec.ip_layer_cnt;
/* lay the IP struct over the raw data */
- const IP4Hdr* const iph = reinterpret_cast<const IP4Hdr*>(raw.data);
+ const ip::IP4Hdr* const iph = reinterpret_cast<const ip::IP4Hdr*>(raw.data);
/*
* with datalink DLT_RAW it's impossible to differ ARP datagrams from IP.
/* If the previous layer was not IP-in-IP, this is not a 4-in-6 tunnel */
if ( codec.codec_flags & CODEC_NON_IP_TUNNEL )
codec.codec_flags &= ~CODEC_NON_IP_TUNNEL;
- else if ( SnortConfig::tunnel_bypass_enabled(TUNNEL_4IN6) )
+ else if ( snort::SnortConfig::tunnel_bypass_enabled(TUNNEL_4IN6) )
Active::set_tunnel_bypass();
}
else if (snort.ip_api.is_ip4())
/* If the previous layer was not IP-in-IP, this is not a 4-in-4 tunnel */
if ( codec.codec_flags & CODEC_NON_IP_TUNNEL )
codec.codec_flags &= ~CODEC_NON_IP_TUNNEL;
- else if (SnortConfig::tunnel_bypass_enabled(TUNNEL_4IN4))
+ else if (snort::SnortConfig::tunnel_bypass_enabled(TUNNEL_4IN4))
Active::set_tunnel_bypass();
}
*/
IP4AddrTests(iph, codec, snort);
- if (SnortConfig::ip_checksums())
+ if (snort::SnortConfig::ip_checksums())
{
/* routers drop packets with bad IP checksums, we don't really
* need to check them (should make this a command line/config
}
void Ipv4Codec::IP4AddrTests(
- const IP4Hdr* iph, const CodecData& codec, DecodeData& snort)
+ const ip::IP4Hdr* iph, const CodecData& codec, DecodeData& snort)
{
uint8_t msb_src, msb_dst;
}
/* IPv4-layer decoder rules */
-void Ipv4Codec::IPMiscTests(const IP4Hdr* const ip4h, const CodecData& codec, uint16_t len)
+void Ipv4Codec::IPMiscTests(const ip::IP4Hdr* const ip4h, const CodecData& codec, uint16_t len)
{
/* Yes, it's an ICMP-related vuln in IP options. */
int cnt = 0;
void Ipv4Codec::log(TextLog* const text_log, const uint8_t* raw_pkt,
const uint16_t lyr_len)
{
- const IP4Hdr* const ip4h = reinterpret_cast<const IP4Hdr*>(raw_pkt);
+ const ip::IP4Hdr* const ip4h = reinterpret_cast<const ip::IP4Hdr*>(raw_pkt);
// FIXIT-H this does NOT obfuscate correctly
- if (SnortConfig::obfuscate())
+ if (snort::SnortConfig::obfuscate())
{
TextLog_Print(text_log, "xxx.xxx.xxx.xxx -> xxx.xxx.xxx.xxx");
}
if (!buf.allocate(ip::IP4_HEADER_LEN))
return false;
- const ip::IP4Hdr* const ip4h_in = reinterpret_cast<const IP4Hdr*>(raw_in);
- ip::IP4Hdr* const ip4h_out = reinterpret_cast<IP4Hdr*>(buf.data());
+ const ip::IP4Hdr* const ip4h_in = reinterpret_cast<const ip::IP4Hdr*>(raw_in);
+ ip::IP4Hdr* const ip4h_out = reinterpret_cast<ip::IP4Hdr*>(buf.data());
/* IPv4 encoded header is hardcoded 20 bytes */
ip4h_out->ip_verhl = 0x45;
void Ipv4Codec::update(const ip::IpApi&, const EncodeFlags flags,
uint8_t* raw_pkt, uint16_t /*lyr_len*/, uint32_t& updated_len)
{
- IP4Hdr* h = reinterpret_cast<IP4Hdr*>(raw_pkt);
+ ip::IP4Hdr* h = reinterpret_cast<ip::IP4Hdr*>(raw_pkt);
uint16_t hlen = h->hlen();
updated_len += hlen;
void Ipv4Codec::format(bool reverse, uint8_t* raw_pkt, DecodeData& snort)
{
- IP4Hdr* ip4h = reinterpret_cast<IP4Hdr*>(raw_pkt);
+ ip::IP4Hdr* ip4h = reinterpret_cast<ip::IP4Hdr*>(raw_pkt);
if ( reverse )
{
#include "main/snort_config.h"
#include "packet_io/active.h"
+using namespace snort;
+
#define CD_IPV6_NAME "ipv6"
#define CD_IPV6_HELP "support for Internet protocol v6"
#include "framework/codec.h"
#include "main/snort_config.h"
+using namespace snort;
+
// yes, macros are necessary. The API and class constructor require different strings.
#define CD_MOBILE_NAME "ipv6_mobility"
#define CD_MOBILE_HELP "support for mobility"
#include "framework/codec.h"
#include "main/snort_config.h"
+using namespace snort;
+
namespace
{
#define CD_NO_NEXT_NAME "ipv6_no_next"
#include "checksum.h"
+using namespace snort;
+
namespace
{
#define CD_PGM_NAME "pgm"
#include "framework/codec.h"
#include "main/snort_config.h"
+using namespace snort;
+
#define CD_IPV6_ROUTING_NAME "ipv6_routing"
#define CD_IPV6_ROUTING_HELP "support for IPv6 routing extension"
#include "checksum.h"
+using namespace snort;
+
#define CD_TCP_NAME "tcp"
#define CD_TCP_HELP "support for transmission control protocol"
checksum::Pseudoheader ps;
int len = buf.size();
- const IP4Hdr* const ip4h = ip_api.get_ip4h();
+ const ip::IP4Hdr* const ip4h = ip_api.get_ip4h();
ps.sip = ip4h->get_src();
ps.dip = ip4h->get_dst();
ps.zero = 0;
#include "checksum.h"
+using namespace snort;
+
#define CD_UDP_NAME "udp"
#define CD_UDP_HELP "support for user datagram protocol"
UDPMiscTests(snort, codec, uhlen - udp::UDP_HEADER_LEN);
if (SnortConfig::gtp_decoding() &&
- (SnortConfig::is_gtp_port(src_port)||SnortConfig::is_gtp_port(dst_port)))
+ (SnortConfig::is_gtp_port(src_port) || SnortConfig::is_gtp_port(dst_port)))
{
if ( !(snort.decode_flags & DECODE_FRAG) )
codec.next_prot_id = ProtocolId::GTP;
if (ip_api.is_ip4())
{
checksum::Pseudoheader ps;
- const IP4Hdr* const ip4h = ip_api.get_ip4h();
+ const ip::IP4Hdr* const ip4h = ip_api.get_ip4h();
ps.sip = ip4h->get_src();
ps.dip = ip4h->get_dst();
ps.zero = 0;
#include "framework/codec.h"
#include "protocols/arp.h"
+using namespace snort;
+
#define CD_ARP_NAME "arp"
#define CD_ARP_HELP "support for address resolution protocol"
#include "codecs/codec_module.h"
#include "framework/codec.h"
+using namespace snort;
+
#define CD_CISCOMETADATA_NAME "ciscometadata"
#define CD_CISCOMETADATA_HELP "support for cisco metadata"
#include "codecs/codec_module.h"
#include "framework/codec.h"
+using namespace snort;
+
#define CD_ERSPAN2_NAME "erspan2"
#define CD_ERSPAN2_HELP "support for encapsulated remote switched port analyzer - type 2"
#include "codecs/codec_module.h"
#include "framework/codec.h"
+using namespace snort;
+
#define CD_ERSPAN3_NAME "erspan3"
#define CD_ERSPAN3_HELP "support for encapsulated remote switched port analyzer - type 3"
#include "codecs/codec_module.h"
#include "framework/codec.h"
+using namespace snort;
+
#define CD_FABRICPATH_NAME "fabricpath"
#define CD_FABRICPATH_HELP "support for fabricpath"
#include "packet_io/active.h"
#include "utils/safec.h"
+using namespace snort;
+
#define CD_MPLS_NAME "mpls"
#define CD_MPLS_HELP "support for multiprotocol label switching"
#include "framework/codec.h"
#include "main/snort_debug.h"
+using namespace snort;
+
#define CD_PPPENCAP_NAME "ppp_encap"
#define CD_PPPENCAP_HELP "support for point-to-point encapsulation"
}
// FIXIT-M X This is broken - it should not modify the packet data (which should be const).
- ((IP4Hdr*)(raw.data + codec.lyr_len))->set_proto(IpProtocol::TCP);
+ ((ip::IP4Hdr*)(raw.data + codec.lyr_len))->set_proto(IpProtocol::TCP);
/* fall through */
case PPP_IP:
#include "codecs/codec_module.h"
#include "framework/codec.h"
+using namespace snort;
+
namespace
{
enum class PppoepktType
#include "framework/codec.h"
#include "protocols/eth.h"
+using namespace snort;
+
namespace
{
#define CD_TRANSBRIDGE_NAME "trans_bridge"
#include "log/text_log.h"
#include "protocols/vlan.h"
+using namespace snort;
+
#define CD_VLAN_NAME "vlan"
#define CD_VLAN_HELP "support for local area network"
#include "framework/codec.h"
+using namespace snort;
+
#define CD_DEFAULT_NAME "unknown"
#define CD_DEFAULT_HELP "support for unknown protocols"
#include "main/snort_config.h"
#include "packet_io/active.h"
+using namespace snort;
+
#define CD_GTP_NAME "gtp"
#define CD_GTP_HELP "support for general-packet-radio-service tunneling protocol"
#include "protocols/tcp.h"
#include "protocols/udp.h"
+using namespace snort;
+
namespace
{
#define ICMP4_IP_NAME "icmp4_ip"
}
/* lay the IP struct over the raw data */
- const IP4Hdr* const ip4h = reinterpret_cast<const IP4Hdr*>(raw.data);
+ const ip::IP4Hdr* const ip4h = reinterpret_cast<const ip::IP4Hdr*>(raw.data);
/*
* with datalink DLT_RAW it's impossible to differ ARP datagrams from IP.
void Icmp4IpCodec::log(TextLog* const text_log, const uint8_t* raw_pkt,
const uint16_t /*lyr_len*/)
{
- const IP4Hdr* const ip4h = reinterpret_cast<const IP4Hdr*>(raw_pkt);
+ const ip::IP4Hdr* const ip4h = reinterpret_cast<const ip::IP4Hdr*>(raw_pkt);
TextLog_Puts(text_log, "\n\t**** ORIGINAL DATAGRAM DUMP: ****");
TextLog_NewLine(text_log);
TextLog_Puts(text_log, "\tIPv4\n\t\t");
#include "codecs/codec_module.h"
#include "framework/codec.h"
+using namespace snort;
+
// yes, macros are necessary. The API and class constructor require different strings.
//
// this macros is defined in the module to ensure identical names. However,
#include "framework/codec.h"
#include "log/text_log.h"
+using namespace snort;
+
#define LLC_NAME "llc"
#define LLC_HELP "support for logical link control"
#include "packet_io/active.h"
#include "protocols/teredo.h"
+using namespace snort;
+
#define CD_TEREDO_NAME "teredo"
#define CD_TEREDO_HELP "support for teredo"
#include "framework/codec.h"
#include "packet_io/sfdaq.h"
+using namespace snort;
+
#define CD_NAME "user"
#define CD_HELP_STR "support for user sessions"
#define CD_HELP ADD_DLT(CD_HELP_STR, DLT_USER)
#include "protocols/eth.h"
#include "protocols/packet_manager.h"
+using namespace snort;
+
#define CD_ETH_NAME "eth"
#define CD_ETH_HELP_STR "support for ethernet protocol"
#define CD_ETH_HELP ADD_DLT(ADD_DLT(CD_ETH_HELP_STR, DLT_EN10MB), DLT_PPP_ETHER)
#include "framework/connector.h"
#include "managers/plugin_manager.h"
-extern const BaseApi* file_connector[];
-extern const BaseApi* tcp_connector[];
+extern const snort::BaseApi* file_connector[];
+extern const snort::BaseApi* tcp_connector[];
void load_connectors()
{
#include "file_connector_module.h"
+using namespace snort;
+
/* Globals ****************************************************************/
THREAD_LOCAL SimpleStats file_connector_stats;
uint32_t connector_msg_length;
};
-class FileConnectorMsgHandle : public ConnectorMsgHandle
+class FileConnectorMsgHandle : public snort::ConnectorMsgHandle
{
public:
FileConnectorMsgHandle(const uint32_t length);
~FileConnectorMsgHandle();
- ConnectorMsg connector_msg;
+ snort::ConnectorMsg connector_msg;
};
-class FileConnectorCommon : public ConnectorCommon
+class FileConnectorCommon : public snort::ConnectorCommon
{
public:
FileConnectorCommon(FileConnectorConfig::FileConnectorConfigSet*);
~FileConnectorCommon();
};
-class FileConnector : public Connector
+class FileConnector : public snort::Connector
{
public:
FileConnector(FileConnectorConfig*);
~FileConnector() override;
- ConnectorMsgHandle* alloc_message(const uint32_t, const uint8_t**) override;
- void discard_message(ConnectorMsgHandle*) override;
- bool transmit_message(ConnectorMsgHandle*) override;
- ConnectorMsgHandle* receive_message(bool) override;
+ snort::ConnectorMsgHandle* alloc_message(const uint32_t, const uint8_t**) override;
+ void discard_message(snort::ConnectorMsgHandle*) override;
+ bool transmit_message(snort::ConnectorMsgHandle*) override;
+ snort::ConnectorMsgHandle* receive_message(bool) override;
- ConnectorMsg* get_connector_msg(ConnectorMsgHandle* handle) override
+ snort::ConnectorMsg* get_connector_msg(snort::ConnectorMsgHandle* handle) override
{ return( &((FileConnectorMsgHandle*)handle)->connector_msg ); }
Direction get_connector_direction() override
{ return( ((const FileConnectorConfig*)config)->direction ); }
std::fstream file;
private:
- ConnectorMsgHandle* receive_message_binary();
- ConnectorMsgHandle* receive_message_text();
+ snort::ConnectorMsgHandle* receive_message_binary();
+ snort::ConnectorMsgHandle* receive_message_text();
};
#endif
#include "framework/connector.h"
-class FileConnectorConfig : public ConnectorConfig
+class FileConnectorConfig : public snort::ConnectorConfig
{
public:
FileConnectorConfig()
- { direction = Connector::CONN_UNDEFINED; text_format = false; }
+ { direction = snort::Connector::CONN_UNDEFINED; text_format = false; }
bool text_format;
std::string name;
#include "main/snort_debug.h"
+using namespace snort;
+
static const Parameter file_connector_params[] =
{
{ "connector", Parameter::PT_STRING, nullptr, nullptr,
#define FILE_CONNECTOR_NAME "file_connector"
#define FILE_CONNECTOR_HELP "implement the file based connector"
-class FileConnectorModule : public Module
+class FileConnectorModule : public snort::Module
{
public:
FileConnectorModule();
~FileConnectorModule() override;
- bool set(const char*, Value&, SnortConfig*) override;
- bool begin(const char*, int, SnortConfig*) override;
- bool end(const char*, int, SnortConfig*) override;
+ bool set(const char*, snort::Value&, snort::SnortConfig*) override;
+ bool begin(const char*, int, snort::SnortConfig*) override;
+ bool end(const char*, int, snort::SnortConfig*) override;
FileConnectorConfig::FileConnectorConfigSet* get_and_clear_config();
const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
- ProfileStats* get_profile() const override;
+ snort::ProfileStats* get_profile() const override;
Usage get_usage() const override
{ return GLOBAL; }
#include <CppUTest/CommandLineTestRunner.h>
#include <CppUTest/TestHarness.h>
+using namespace snort;
+
THREAD_LOCAL SimpleStats file_connector_stats;
THREAD_LOCAL ProfileStats file_connector_perfstats;
#include <CppUTest/CommandLineTestRunner.h>
#include <CppUTest/TestHarness.h>
+using namespace snort;
+
extern const BaseApi* file_connector;
ConnectorApi* fc_api = nullptr;
#include "tcp_connector_module.h"
+using namespace snort;
+
/* Globals ****************************************************************/
THREAD_LOCAL SimpleStats tcp_connector_stats;
uint16_t connector_msg_length;
};
-class TcpConnectorMsgHandle : public ConnectorMsgHandle
+class TcpConnectorMsgHandle : public snort::ConnectorMsgHandle
{
public:
TcpConnectorMsgHandle(const uint32_t length);
~TcpConnectorMsgHandle();
- ConnectorMsg connector_msg;
+ snort::ConnectorMsg connector_msg;
};
-class TcpConnectorCommon : public ConnectorCommon
+class TcpConnectorCommon : public snort::ConnectorCommon
{
public:
TcpConnectorCommon(TcpConnectorConfig::TcpConnectorConfigSet*);
~TcpConnectorCommon();
};
-class TcpConnector : public Connector
+class TcpConnector : public snort::Connector
{
public:
typedef Ring<TcpConnectorMsgHandle*> ReceiveRing;
TcpConnector(TcpConnectorConfig*, int sock_fd);
~TcpConnector() override;
- ConnectorMsgHandle* alloc_message(const uint32_t, const uint8_t**) override;
- void discard_message(ConnectorMsgHandle*) override;
- bool transmit_message(ConnectorMsgHandle*) override;
- ConnectorMsgHandle* receive_message(bool) override;
+ snort::ConnectorMsgHandle* alloc_message(const uint32_t, const uint8_t**) override;
+ void discard_message(snort::ConnectorMsgHandle*) override;
+ bool transmit_message(snort::ConnectorMsgHandle*) override;
+ snort::ConnectorMsgHandle* receive_message(bool) override;
- ConnectorMsg* get_connector_msg(ConnectorMsgHandle* handle) override
+ snort::ConnectorMsg* get_connector_msg(snort::ConnectorMsgHandle* handle) override
{ return( &((TcpConnectorMsgHandle*)handle)->connector_msg ); }
Direction get_connector_direction() override
{ return Connector::CONN_DUPLEX; }
#include "framework/connector.h"
-class TcpConnectorConfig : public ConnectorConfig
+class TcpConnectorConfig : public snort::ConnectorConfig
{
public:
enum Setup { CALL, ANSWER };
TcpConnectorConfig()
- { direction = Connector::CONN_DUPLEX; async_receive = true; }
+ { direction = snort::Connector::CONN_DUPLEX; async_receive = true; }
uint16_t base_port;
std::string address;
#include "main/snort_debug.h"
+using namespace snort;
+
static const Parameter tcp_connector_params[] =
{
{ "connector", Parameter::PT_STRING, nullptr, nullptr,
#define TCP_CONNECTOR_NAME "tcp_connector"
#define TCP_CONNECTOR_HELP "implement the tcp stream connector"
-class TcpConnectorModule : public Module
+class TcpConnectorModule : public snort::Module
{
public:
TcpConnectorModule();
~TcpConnectorModule() override;
- bool set(const char*, Value&, SnortConfig*) override;
- bool begin(const char*, int, SnortConfig*) override;
- bool end(const char*, int, SnortConfig*) override;
+ bool set(const char*, snort::Value&, snort::SnortConfig*) override;
+ bool begin(const char*, int, snort::SnortConfig*) override;
+ bool end(const char*, int, snort::SnortConfig*) override;
TcpConnectorConfig::TcpConnectorConfigSet* get_and_clear_config();
const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
- ProfileStats* get_profile() const override;
+ snort::ProfileStats* get_profile() const override;
Usage get_usage() const override
{ return GLOBAL; }
#include <CppUTest/CommandLineTestRunner.h>
#include <CppUTest/TestHarness.h>
+using namespace snort;
+
THREAD_LOCAL SimpleStats tcp_connector_stats;
THREAD_LOCAL ProfileStats tcp_connector_perfstats;
#include <CppUTest/CommandLineTestRunner.h>
#include <CppUTest/TestHarness.h>
+using namespace snort;
+
#if defined(__APPLE__)
#define __THROW
#define __SOCKADDR_ARG struct sockaddr*
#include "catch/snort_catch.h"
#endif
+using namespace snort;
+
//--------------------------------------------------------------------------
// context switcher methods
//--------------------------------------------------------------------------
#include <vector>
+namespace snort
+{
+class Flow;
class IpsContext;
class IpsContextData;
+}
class ContextSwitcher
{
ContextSwitcher(unsigned max);
~ContextSwitcher();
- void push(IpsContext*);
- IpsContext* pop();
+ void push(snort::IpsContext*);
+ snort::IpsContext* pop();
void start();
void stop();
void abort();
- IpsContext* interrupt();
- IpsContext* complete();
+ snort::IpsContext* interrupt();
+ snort::IpsContext* complete();
unsigned suspend();
void resume(unsigned suspended);
- IpsContext* get_context() const;
- IpsContext* get_context(unsigned) const;
- IpsContext* get_next() const;
+ snort::IpsContext* get_context() const;
+ snort::IpsContext* get_context(unsigned) const;
+ snort::IpsContext* get_next() const;
- IpsContextData* get_context_data(unsigned id) const;
- void set_context_data(unsigned id, IpsContextData*) const;
+ snort::IpsContextData* get_context_data(unsigned id) const;
+ void set_context_data(unsigned id, snort::IpsContextData*) const;
unsigned idle_count() const;
unsigned busy_count() const;
bool can_hold() const
{ return idle_count() > 5; } // FIXIT-H define appropriate const
- bool on_hold(class Flow*);
+ bool on_hold(snort::Flow*);
private:
- std::vector<IpsContext*> idle;
- std::vector<IpsContext*> busy;
- std::vector<IpsContext*> hold;
+ std::vector<snort::IpsContext*> idle;
+ std::vector<snort::IpsContext*> busy;
+ std::vector<snort::IpsContext*> hold;
};
#endif
#include "tag.h"
#include "treenodes.h"
+using namespace snort;
+
THREAD_LOCAL ProfileStats detectPerfStats;
THREAD_LOCAL ProfileStats eventqPerfStats;
THREAD_LOCAL ProfileStats rebuiltPacketPerfStats;
#include "main/snort_types.h"
#include "main/thread.h"
-struct Event;
+namespace snort
+{
+struct Packet;
struct ProfileStats;
+}
+struct Event;
struct RuleFpList;
struct RuleTreeNode;
-extern THREAD_LOCAL ProfileStats eventqPerfStats;
-extern THREAD_LOCAL ProfileStats detectPerfStats;
-extern THREAD_LOCAL ProfileStats rebuiltPacketPerfStats;
+extern THREAD_LOCAL snort::ProfileStats eventqPerfStats;
+extern THREAD_LOCAL snort::ProfileStats detectPerfStats;
+extern THREAD_LOCAL snort::ProfileStats rebuiltPacketPerfStats;
// main loop hooks
-void snort_ignore(Packet*);
-void snort_log(Packet*);
+void snort_ignore(snort::Packet*);
+void snort_log(snort::Packet*);
// alerts
-void CallLogFuncs(Packet*, ListHead*, Event*, const char*);
-void CallLogFuncs(Packet*, const OptTreeNode*, ListHead*);
-void CallAlertFuncs(Packet*, const OptTreeNode*, ListHead*);
+void CallLogFuncs(snort::Packet*, ListHead*, Event*, const char*);
+void CallLogFuncs(snort::Packet*, const OptTreeNode*, ListHead*);
+void CallAlertFuncs(snort::Packet*, const OptTreeNode*, ListHead*);
void enable_tags();
-void check_tags(Packet*);
+void check_tags(snort::Packet*);
#endif
#include "fp_create.h"
#include "pattern_match_data.h"
+using namespace snort;
using namespace std;
Trace TRACE_NAME(detection);
#include "framework/cursor.h"
#include "main/snort_types.h"
+namespace snort
+{
+ struct Packet;
+}
+
struct detection_option_tree_node_t;
struct PatternMatchData;
};
void clear_trace_cursor_info();
-void print_pkt_info(Packet* p);
+void print_pkt_info(snort::Packet* p);
void print_pattern(const PatternMatchData* pmd);
void dump_buffer(const uint8_t* buff, unsigned len);
void node_eval_trace(const detection_option_tree_node_t* node, const Cursor& cursor);
static THREAD_LOCAL RegexOffload* offloader = nullptr;
static THREAD_LOCAL uint64_t context_num = 0;
+using namespace snort;
+
//--------------------------------------------------------------------------
// basic de
//--------------------------------------------------------------------------
#include "main/snort_types.h"
struct DataPointer;
-struct Packet;
+namespace snort
+{
+struct Packet;
class Flow;
class IpsContext;
class IpsContextData;
}
static inline void clear_file_data()
-{ set_file_data(nullptr, 0); }
+{
+ set_file_data(nullptr, 0);
+}
+} // namespace snort
#endif
#include "rules.h"
#include "treenodes.h"
+using namespace snort;
+
#define HASH_RULE_OPTIONS 16384
#define HASH_RULE_TREE 8192
#include "detection/rule_option_types.h"
#include "time/clock_defs.h"
+namespace snort
+{
struct Packet;
+struct SnortConfig;
+}
struct RuleLatencyState;
struct XHash;
-typedef int (* eval_func_t)(void* option_data, class Cursor&, Packet*);
+typedef int (* eval_func_t)(void* option_data, class Cursor&, snort::Packet*);
// this is per packet thread
struct dot_node_state_t
{
void* pomd;
void* pmd;
- Packet* p;
+ snort::Packet* p;
char flowbit_failed;
char flowbit_noalert;
};
// return existing data or add given and return nullptr
-void* add_detection_option(struct SnortConfig*, option_type_t, void*);
-void* add_detection_option_tree(struct SnortConfig*, detection_option_tree_node_t*);
+void* add_detection_option(struct snort::SnortConfig*, option_type_t, void*);
+void* add_detection_option_tree(struct snort::SnortConfig*, detection_option_tree_node_t*);
int detection_option_node_evaluate(
detection_option_tree_node_t*, detection_option_eval_data_t*, class Cursor&);
#include "treenodes.h"
+using namespace snort;
+
#define LOG_CHARS 16
static THREAD_LOCAL TextLog* tlog = nullptr;
void EventTrace_Init();
void EventTrace_Term();
-void EventTrace_Log(const Packet*, const OptTreeNode*, int action);
+void EventTrace_Log(const snort::Packet*, const OptTreeNode*, int action);
inline int EventTrace_IsEnabled()
{
- return ( SnortConfig::get_conf()->event_trace_max > 0 );
+ return ( snort::SnortConfig::get_conf()->event_trace_max > 0 );
}
#endif
#include "log/messages.h"
#include "managers/mpse_manager.h"
+using namespace snort;
+
FastPatternConfig::FastPatternConfig()
{
search_api = MpseManager::get_search_api("ac_bnfa");
#ifndef FP_CONFIG_H
#define FP_CONFIG_H
+namespace snort
+{
+ struct MpseApi;
+}
+
// this is a basically a factory for creating MPSE
#define PL_BLEEDOVER_WARNINGS_ENABLED 0x01
void set_max_pattern_len(unsigned);
- const struct MpseApi* get_search_api()
+ const snort::MpseApi* get_search_api()
{ return search_api; }
bool get_trim()
{ return max_pattern_len; }
private:
- const struct MpseApi* search_api;
+ const snort::MpseApi* search_api;
bool inspect_stream_insert = true;
bool trim;
#include "service_map.h"
#include "treenodes.h"
+using namespace snort;
using namespace std;
static unsigned mpse_count = 0;
#include <string>
#include "ports/port_group.h"
+namespace snort
+{
struct SnortConfig;
+}
struct PMX
{
** engine. It reads in the snort list of RTNs and OTNs and
** assigns them to PORT_MAPS.
*/
-int fpCreateFastPacketDetection(SnortConfig*);
-void fpDeleteFastPacketDetection(SnortConfig*);
+int fpCreateFastPacketDetection(snort::SnortConfig*);
+void fpDeleteFastPacketDetection(snort::SnortConfig*);
void get_pattern_info(const PatternMatchData* pmd,
const char* pattern, int pattern_length, std::string& hex, std::string& txt,
std::string& opts);
#include "tag.h"
#include "treenodes.h"
+using namespace snort;
+
THREAD_LOCAL ProfileStats rulePerfStats;
THREAD_LOCAL ProfileStats ruleRTNEvalPerfStats;
THREAD_LOCAL ProfileStats ruleOTNEvalPerfStats;
#define REBUILD_FLAGS (PKT_REBUILT_FRAG | PKT_REBUILT_STREAM)
+namespace snort
+{
+class IpsContext;
struct Packet;
-struct PortGroup;
struct ProfileStats;
+}
+struct PortGroup;
struct OptTreeNode;
-extern THREAD_LOCAL ProfileStats rulePerfStats;
-extern THREAD_LOCAL ProfileStats ruleRTNEvalPerfStats;
-extern THREAD_LOCAL ProfileStats ruleOTNEvalPerfStats;
-extern THREAD_LOCAL ProfileStats ruleNFPEvalPerfStats;
+extern THREAD_LOCAL snort::ProfileStats rulePerfStats;
+extern THREAD_LOCAL snort::ProfileStats ruleRTNEvalPerfStats;
+extern THREAD_LOCAL snort::ProfileStats ruleOTNEvalPerfStats;
+extern THREAD_LOCAL snort::ProfileStats ruleNFPEvalPerfStats;
struct RuleTreeNode;
-int fpLogEvent(const RuleTreeNode*, const OptTreeNode*, Packet*);
-int fpEvalRTN(RuleTreeNode*, Packet*, int check_ports);
+int fpLogEvent(const RuleTreeNode*, const OptTreeNode*, snort::Packet*);
+int fpEvalRTN(RuleTreeNode*, snort::Packet*, int check_ports);
/*
** This define is for the number of unique events
struct OtnxMatchData
{
PortGroup* pg;
- Packet* p;
+ snort::Packet* p;
const uint8_t* data;
unsigned size;
int fpAddMatch(OtnxMatchData*, int pLen, const OptTreeNode*);
-class IpsContext;
-void fp_set_context(IpsContext&);
-void fp_clear_context(IpsContext&);
+void fp_set_context(snort::IpsContext&);
+void fp_clear_context(snort::IpsContext&);
-void fp_local(Packet*);
-void fp_offload(Packet*);
-void fp_onload(Packet*);
+void fp_local(snort::Packet*);
+void fp_offload(snort::Packet*);
+void fp_onload(snort::Packet*);
#endif
#include "pattern_match_data.h"
#include "treenodes.h"
+using namespace snort;
+
//--------------------------------------------------------------------------
// private utilities
//--------------------------------------------------------------------------
struct OptFpList;
struct OptTreeNode;
-struct PatternMatchData* get_pmd(OptFpList*, int proto, RuleDirection);
+struct PatternMatchData* get_pmd(OptFpList*, int proto, snort::RuleDirection);
bool is_fast_pattern_only(OptFpList*);
void validate_fast_pattern(OptTreeNode*);
#include "catch/snort_catch.h"
#endif
+using namespace snort;
+
//--------------------------------------------------------------------------
// context data
//--------------------------------------------------------------------------
#include "detection/detection_util.h"
+class MpseStash;
+struct OtnxMatchData;
+struct SF_EVENTQ;
+
+namespace snort
+{
+struct SnortConfig;
+
class SO_PUBLIC IpsContextData
{
public:
DAQ_PktHdr_t* pkth;
uint8_t* buf;
- struct SnortConfig* conf;
- class MpseStash* stash;
- struct OtnxMatchData* otnx;
- struct SF_EVENTQ* equeue;
+ SnortConfig* conf;
+ MpseStash* stash;
+ OtnxMatchData* otnx;
+ SF_EVENTQ* equeue;
DataPointer file_data;
DataBuffer alt_data;
std::vector<IpsContextData*> data;
unsigned slot;
};
-
+}
#endif
assert(src and dst and gen);
*src = *dst = *gen = nullptr;
- if ( (dport != ANYPORT) and (dport < MAX_PORTS) )
+ if ( (dport != ANYPORT) and (dport < snort::MAX_PORTS) )
*dst = p->prmDstPort[dport];
- if ( (sport != ANYPORT) and (sport < MAX_PORTS) )
+ if ( (sport != ANYPORT) and (sport < snort::MAX_PORTS) )
*src = p->prmSrcPort[sport];
/* If no Src/Dst rules - use the generic set, if any exist */
if ( p->prmGeneric and (p->prmGeneric->rule_count > 0) )
{
- if ( SnortConfig::get_conf()->fast_pattern_config->get_split_any_any() or (!*src and !*dst) )
+ if ( snort::SnortConfig::get_conf()->fast_pattern_config->get_split_any_any() or (!*src and !*dst) )
{
*gen = p->prmGeneric;
}
int prmNumDstGroups;
int prmNumSrcGroups;
- PortGroup* prmSrcPort[MAX_PORTS];
- PortGroup* prmDstPort[MAX_PORTS];
+ PortGroup* prmSrcPort[snort::MAX_PORTS];
+ PortGroup* prmDstPort[snort::MAX_PORTS];
PortGroup* prmGeneric;
};
struct RegexRequest
{
- Packet* packet = nullptr;
+ snort::Packet* packet = nullptr;
std::thread* thread;
std::mutex mutex;
assert(req->packet);
assert(req->packet->flow->is_offloaded());
- SnortConfig::set_conf(req->packet->context->conf); // FIXIT-H reload issue
+ snort::SnortConfig::set_conf(req->packet->context->conf); // FIXIT-H reload issue
fp_offload(req->packet);
req->offload = false;
}
}
-void RegexOffload::put(unsigned id, Packet* p)
+void RegexOffload::put(unsigned id, snort::Packet* p)
{
assert(p);
assert(!idle.empty());
return true;
}
-bool RegexOffload::on_hold(Flow* f)
+bool RegexOffload::on_hold(snort::Flow* f)
{
for ( auto* req : busy )
{
#include <mutex>
#include <thread>
+namespace snort
+{
+class Flow;
struct Packet;
+}
struct RegexRequest;
class RegexOffload
unsigned count()
{ return busy.size(); }
- void put(unsigned id, Packet*);
+ void put(unsigned id, snort::Packet*);
bool get(unsigned& id);
- bool on_hold(class Flow*);
+ bool on_hold(snort::Flow*);
private:
static void worker(RegexRequest*);
#include "rules.h"
#include "treenodes.h"
+using namespace snort;
+
#define CHECK_SRC_IP 0x01
#define CHECK_DST_IP 0x02
#define INVERSE 0x04
#define CHECK_SRC_PORT 0x08
#define CHECK_DST_PORT 0x10
-static int CheckAddrPort(
- sfip_var_t* rule_addr,
- PortObject* po,
- Packet* p,
+static int CheckAddrPort(sfip_var_t* rule_addr, PortObject* po, Packet* p,
uint32_t flags, int mode)
{
const SfIp* pkt_addr; /* packet IP address */
#ifndef RTN_CHECKS_H
#define RTN_CHECKS_H
-struct Packet;
+namespace snort
+{
+ struct Packet;
+}
struct RuleFpList;
struct RuleTreeNode;
// parsing
-int RuleListEnd(Packet*, RuleTreeNode*, RuleFpList*, int);
-int OptListEnd(void* option_data, class Cursor&, Packet*);
+int RuleListEnd(snort::Packet*, RuleTreeNode*, RuleFpList*, int);
+int OptListEnd(void* option_data, class Cursor&, snort::Packet*);
// detection
-int CheckBidirectional(Packet*, RuleTreeNode*, RuleFpList*, int);
-int CheckSrcIP(Packet*, RuleTreeNode*, RuleFpList*, int);
-int CheckDstIP(Packet*, RuleTreeNode*, RuleFpList*, int);
-int CheckSrcPortEqual(Packet*, RuleTreeNode*, RuleFpList*, int);
-int CheckDstPortEqual(Packet*, RuleTreeNode*, RuleFpList*, int);
-int CheckSrcPortNotEq(Packet*, RuleTreeNode*, RuleFpList*, int);
-int CheckDstPortNotEq(Packet*, RuleTreeNode*, RuleFpList*, int);
+int CheckBidirectional(snort::Packet*, RuleTreeNode*, RuleFpList*, int);
+int CheckSrcIP(snort::Packet*, RuleTreeNode*, RuleFpList*, int);
+int CheckDstIP(snort::Packet*, RuleTreeNode*, RuleFpList*, int);
+int CheckSrcPortEqual(snort::Packet*, RuleTreeNode*, RuleFpList*, int);
+int CheckDstPortEqual(snort::Packet*, RuleTreeNode*, RuleFpList*, int);
+int CheckSrcPortNotEq(snort::Packet*, RuleTreeNode*, RuleFpList*, int);
+int CheckDstPortNotEq(snort::Packet*, RuleTreeNode*, RuleFpList*, int);
#endif
#define EventIsInternal(gid) ((gid) == GENERATOR_INTERNAL)
+namespace snort
+{
+ class IpsAction;
+}
struct OutputSet;
struct ListHead
{
OutputSet* LogList;
OutputSet* AlertList;
- class IpsAction* action;
+ snort::IpsAction* action;
struct RuleListNode* ruleListNode;
};
struct RuleListNode
{
ListHead* RuleList; /* The rule list associated with this node */
- Actions::Type mode; /* the rule mode */
+ snort::Actions::Type mode; /* the rule mode */
int evalIndex; /* eval index for this rule set */
char* name; /* name of this rule list */
RuleListNode* next; /* the next RuleListNode */
#include "fp_create.h"
#include "treenodes.h"
+using namespace snort;
+
//-------------------------------------------------------------------------
// service map stuff
//-------------------------------------------------------------------------
#include "target_based/snort_protocols.h"
+namespace snort
+{
+struct SnortConfig;
+}
struct PortGroup;
struct GHash;
-struct SnortConfig;
// Service Rule Map Master Table
struct srmm_table_t
srmm_table_t* ServicePortGroupMapNew();
void ServicePortGroupMapFree(srmm_table_t*);
-void fpPrintServicePortGroupSummary(SnortConfig*, srmm_table_t*);
-int fpCreateServiceMaps(SnortConfig*);
+void fpPrintServicePortGroupSummary(snort::SnortConfig*, srmm_table_t*);
+int fpCreateServiceMaps(snort::SnortConfig*);
// Service/Protocol Ordinal To PortGroup table
typedef std::vector<PortGroup*> PortGroupVector;
#include "treenodes.h"
+using namespace snort;
+
/********************** Reference System Implementation ***********************/
ReferenceSystemNode* ReferenceSystemAdd(
#include <cstdint>
#include <cstdio>
+namespace snort
+{
struct SnortConfig;
+}
+
struct OptTreeNode;
struct GHash;
ReferenceSystemNode* next;
};
-ReferenceSystemNode* ReferenceSystemAdd(SnortConfig*, const char*, const char* = nullptr);
+ReferenceSystemNode* ReferenceSystemAdd(snort::SnortConfig*, const char*, const char* = nullptr);
/* XXX: update to point to the ReferenceURLNode in the referenceURL list */
struct ReferenceNode
ReferenceNode* next;
};
-void AddReference(SnortConfig*, ReferenceNode**, const char*, const char*);
+void AddReference(snort::SnortConfig*, ReferenceNode**, const char*, const char*);
/* struct for rule classification */
struct ClassType
};
/* NOTE: These methods can only be used during parse time */
-void AddClassification(SnortConfig*, const char* type, const char* name, int priority);
+void AddClassification(snort::SnortConfig*, const char* type, const char* name, int priority);
-ClassType* ClassTypeLookupByType(SnortConfig*, const char*);
+ClassType* ClassTypeLookupByType(snort::SnortConfig*, const char*);
struct SignatureServiceInfo
{
#include "treenodes.h"
+using namespace snort;
+
/* D E F I N E S **************************************************/
#define MAX_TAG_NODES 256
#include <cstdint>
+namespace snort
+{
struct Packet;
+}
+
struct OptTreeNode;
struct Event;
void InitTag();
void CleanupTag();
-int CheckTagList(Packet*, Event&, void**);
-void SetTags(Packet*, const OptTreeNode*, uint16_t);
+int CheckTagList(snort::Packet*, Event&, void**);
+void SetTags(snort::Packet*, const OptTreeNode*, uint16_t);
#endif
return ofp;
}
-bool otn_set_agent(OptTreeNode* otn, IpsOption* opt)
+bool otn_set_agent(OptTreeNode* otn, snort::IpsOption* opt)
{
if ( otn->agent )
return false;
return true;
}
-void otn_trigger_actions(const OptTreeNode* otn, Packet* p)
+void otn_trigger_actions(const OptTreeNode* otn, snort::Packet* p)
{
if ( otn->agent )
otn->agent->action(p);
#include "main/snort_types.h"
#include "time/clock_defs.h"
+namespace snort
+{
class IpsOption;
struct Packet;
+}
struct RuleTreeNode;
struct PortObject;
struct OutputSet;
/* same as the rule header FP list */
struct OptFpList
{
- IpsOption* ips_opt;
+ snort::IpsOption* ips_opt;
- int (* OptTestFunc)(void* option_data, class Cursor&, Packet*);
+ int (* OptTestFunc)(void* option_data, class Cursor&, snort::Packet*);
OptFpList* next;
/* plugin/detection functions go here */
OptFpList* opt_func;
OutputSet* outputFuncs; /* per sid enabled output functions */
- IpsOption* agent;
+ snort::IpsOption* agent;
/* metadata about signature */
SigInfo sigInfo;
void* context;
/* rule check function pointer */
- int (* RuleHeadFunc)(Packet*, RuleTreeNode*, RuleFpList*, int);
+ int (* RuleHeadFunc)(snort::Packet*, RuleTreeNode*, RuleFpList*, int);
/* pointer to the next rule function node */
RuleFpList* next;
uint32_t flags; /* control flags */
- Actions::Type type;
+ snort::Actions::Type type;
// reference count from otn.
// Multiple OTNs can reference this RTN with the same policy.
unsigned int otnRefCount;
};
-typedef int (* RuleOptEvalFunc)(void*, Cursor&, Packet*);
+typedef int (* RuleOptEvalFunc)(void*, Cursor&, snort::Packet*);
OptFpList* AddOptFuncToList(RuleOptEvalFunc, OptTreeNode*);
void* get_rule_type_data(OptTreeNode*, const char* name);
inline void otn_set_plugin(OptTreeNode* otn, int id)
{ otn->plugins |= (0x1 << id); }
-bool otn_set_agent(OptTreeNode*, IpsOption*);
+bool otn_set_agent(OptTreeNode*, snort::IpsOption*);
-void otn_trigger_actions(const OptTreeNode*, Packet*);
+void otn_trigger_actions(const OptTreeNode*, snort::Packet*);
#endif
event.sig_info->priority = priority;
/* this one gets set automatically */
- event.event_id = ++event_id | SnortConfig::get_event_log_id();
+ event.event_id = ++event_id | snort::SnortConfig::get_event_log_id();
if (event_ref)
event.event_reference = event_ref;
{
const struct OptTreeNode* otn;
const struct RuleTreeNode* rtn;
- Actions::Type type;
+ snort::Actions::Type type;
};
EventQueueConfig* EventQueueConfigNew();
FileSigState sig_state;
};
-class FileContext;
struct FileCaptureInfo;
-class Flow;
+
+namespace snort
+{
+class FileContext;
class FileInfo;
+class Flow;
+struct Packet;
class SO_PUBLIC FilePolicyBase
{
return encoding;
}
-SO_PUBLIC uint64_t get_file_processed_size(class Flow* flow);
-FilePosition get_file_position(struct Packet* pkt);
-
+SO_PUBLIC uint64_t get_file_processed_size(Flow* flow);
+FilePosition get_file_position(Packet* pkt);
+}
#endif
#include "file_stats.h"
+using namespace snort;
+
static int file_cache_free_func(void*, void* data)
{
FileCache::FileNode* node = (FileCache::FileNode*)data;
PADDING_GUARD_BEGIN
struct FileHashKey
{
- SfIp sip;
- SfIp dip;
+ snort::SfIp sip;
+ snort::SfIp dip;
uint32_t padding;
uint64_t file_sig;
};
struct FileNode
{
time_t expires;
- FileContext* file;
+ snort::FileContext* file;
};
FileCache();
~FileCache();
- FileContext* add(const FileHashKey&);
- FileContext* find(const FileHashKey&);
+ snort::FileContext* add(const FileHashKey&);
+ snort::FileContext* find(const FileHashKey&);
private:
/* The hash table of expected files */
#include "file_mempool.h"
#include "file_stats.h"
+using namespace snort;
+
FileMemPool* FileCapture::file_mempool = nullptr;
int64_t FileCapture::capture_block_size = 0;
#include "file_api.h"
+namespace snort
+{
class FileInfo;
+}
class FileMemPool;
struct FileCaptureBlock
FilePosition pos);
// Preserve the file in memory until it is released
- FileCaptureState reserve_file(const FileInfo*);
+ FileCaptureState reserve_file(const snort::FileInfo*);
// Get the file that is reserved in memory, this should be called repeatedly
// until nullptr is returned to get the full file
static int64_t get_block_size() { return capture_block_size; }
- FileInfo* get_file_info() { return file_info; }
+ snort::FileInfo* get_file_info() { return file_info; }
private:
const uint8_t* current_data; /*current file data*/
uint32_t current_data_len;
FileCaptureState capture_state;
- FileInfo* file_info = nullptr;
+ snort::FileInfo* file_info = nullptr;
int64_t capture_min_size;
int64_t capture_max_size;
};
FileConfig* get_file_config ()
{
- FileInspect* fi = (FileInspect*)InspectorManager::get_inspector(FILE_ID_NAME, true);
+ snort::FileInspect* fi = (snort::FileInspect*)snort::InspectorManager::get_inspector(FILE_ID_NAME, true);
if (fi)
return (fi->config);
#include "file_service.h"
+using namespace snort;
+
static int file_node_free_func(void*, void* data)
{
FileEnforcer::FileNode* node = (FileEnforcer::FileNode*)data;
*(node->file) = *file;
}
-FileVerdict FileEnforcer::check_verdict(Flow* flow, FileNode* node,
+FileVerdict FileEnforcer::check_verdict(snort::Flow* flow, FileNode* node,
XHashNode* hash_node, FilePolicyBase* policy)
{
assert(node->file);
return verdict;
}
-int FileEnforcer::store_verdict(Flow* flow, FileInfo* file)
+int FileEnforcer::store_verdict(snort::Flow* flow, FileInfo* file)
{
assert(file);
uint64_t file_sig = file->get_file_id();
else if (verdict == FILE_VERDICT_BLOCK)
{
// can't block session inside a session
- Active::set_delayed_action(Active::ACT_BLOCK, true);
+ snort::Active::set_delayed_action(Active::ACT_BLOCK, true);
store_verdict(flow, file);
if (resume)
policy->log_file_action(flow, file, FILE_RESUME_BLOCK);
else if (verdict == FILE_VERDICT_REJECT)
{
// can't reset session inside a session
- Active::set_delayed_action(Active::ACT_RESET, true);
+ snort::Active::set_delayed_action(Active::ACT_RESET, true);
store_verdict(flow, file);
if (resume)
policy->log_file_action(flow, file, FILE_RESUME_BLOCK);
else if (verdict == FILE_VERDICT_PENDING)
{
/*Take the cached verdict*/
- Active::set_delayed_action(Active::ACT_DROP, true);
+ snort::Active::set_delayed_action(Active::ACT_DROP, true);
if (resume)
policy->log_file_action(flow, file, FILE_RESUME_BLOCK);
return true;
return false;
}
-FileVerdict FileEnforcer::cached_verdict_lookup(Flow* flow, FileInfo* file,
+FileVerdict FileEnforcer::cached_verdict_lookup(snort::Flow* flow, FileInfo* file,
FilePolicyBase* policy)
{
FileVerdict verdict = FILE_VERDICT_UNKNOWN;
#include "file_config.h"
#include "file_policy.h"
+namespace snort
+{
class FileInfo;
+class FilePolicyBase;
+class Flow;
+}
#define MAX_FILES_TRACKED 16384
#define MAX_MEMORY_USED (10*1024*1024) // 10M
struct FileNode
{
time_t expires;
- FileInfo* file;
+ snort::FileInfo* file;
};
FileEnforcer();
~FileEnforcer();
- FileVerdict cached_verdict_lookup(Flow*, FileInfo*, FilePolicyBase*);
- bool apply_verdict(Flow*, FileInfo*, FileVerdict, bool resume, FilePolicyBase*);
+ FileVerdict cached_verdict_lookup(snort::Flow*, snort::FileInfo*, snort::FilePolicyBase*);
+ bool apply_verdict(snort::Flow*, snort::FileInfo*, FileVerdict, bool resume, snort::FilePolicyBase*);
private:
// FIXIT-L Merge definition with duplicate in file_cache.h?
PADDING_GUARD_BEGIN
struct FileHashKey
{
- SfIp sip;
- SfIp dip;
+ snort::SfIp sip;
+ snort::SfIp dip;
uint32_t padding;
uint64_t file_sig;
};
PADDING_GUARD_END
- void update_file_node(FileNode*, FileInfo*);
- FileVerdict check_verdict(Flow*, FileNode*, XHashNode*, FilePolicyBase*);
- int store_verdict(Flow*, FileInfo*);
+ void update_file_node(FileNode*, snort::FileInfo*);
+ FileVerdict check_verdict(snort::Flow*, FileNode*, XHashNode*, snort::FilePolicyBase*);
+ int store_verdict(snort::Flow*, snort::FileInfo*);
/* The hash table of expected files */
XHash* fileHash = nullptr;
#include "file_lib.h"
#include "file_service.h"
+using namespace snort;
+
unsigned FileFlows::file_flow_data_id = 0;
static THREAD_LOCAL uint32_t max_file_id = 0;
}
}
+namespace snort
+{
FilePosition get_file_position(Packet* pkt)
{
FilePosition position = SNORT_FILE_POSITION_UNKNOWN;
return position;
}
-
+}
FileInspect::FileInspect(FileIdModule* fm)
{
fm->load_config(config);
#include "file_module.h"
#include "file_policy.h"
+
+namespace snort
+{
class FileContext;
class Flow;
Flow* flow = nullptr;
FilePolicyBase* file_policy = nullptr;
};
-
+}
#endif
#include "file_segment.h"
#include "file_stats.h"
+using namespace snort;
+
// Convert UTF16-LE file name to UTF-8.
// Returns allocated name. Caller responsible for freeing the buffer.
char* FileContext::get_UTF8_fname(size_t* converted_len)
class FileCapture;
class FileConfig;
class FileSegments;
-class Flow;
+
+namespace snort
+{
class FileInspect;
+class Flow;
class SO_PUBLIC FileInfo
{
inline void finalize_file_type();
inline void finish_signature_lookup(Flow*, bool, FilePolicyBase*);
};
-
+}
#endif
#include "file_flows.h"
#include "file_lib.h"
+using namespace snort;
+
static const char* s_name = "file_log";
static const char* f_name = "file.log";
static const char* s_help = "log file event to file.log";
#include "file_stats.h"
+using namespace snort;
+
static const Parameter file_magic_params[] =
{
{ "content", Parameter::PT_STRING, nullptr, nullptr,
// file_id module
//-------------------------------------------------------------------------
-class FileIdModule : public Module
+class FileIdModule : public snort::Module
{
public:
FileIdModule();
~FileIdModule() override;
- bool set(const char*, Value&, SnortConfig*) override;
- bool begin(const char*, int, SnortConfig*) override;
- bool end(const char*, int, SnortConfig*) override;
+ bool set(const char*, snort::Value&, snort::SnortConfig*) override;
+ bool begin(const char*, int, snort::SnortConfig*) override;
+ bool end(const char*, int, snort::SnortConfig*) override;
const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
#include "file_enforcer.h"
#include "file_service.h"
+using namespace snort;
+
static FileRule emptyRule;
void FileRule::clear()
}
// Enable file type for all other features
- FileService::enable_file_type();
+ snort::FileService::enable_file_type();
type_enabled = true;
if (rule.use.signature_enabled)
- FileService::enable_file_signature();
+ snort::FileService::enable_file_signature();
if (rule.use.capture_enabled)
- FileService::enable_file_capture();
+ snort::FileService::enable_file_capture();
}
void FilePolicy::load()
{
if (type_enabled)
- FileService::enable_file_type();
+ snort::FileService::enable_file_type();
if (signature_enabled)
- FileService::enable_file_signature();
+ snort::FileService::enable_file_signature();
if (capture_enabled)
- FileService::enable_file_capture();
+ snort::FileService::enable_file_capture();
// Use default global setting
emptyRule.use.type_enabled = type_enabled;
#include "file_api.h"
+namespace snort
+{
+class FileInfo;
+}
+
struct FileVerdictWhen
{
uint32_t type_id;
void clear();
};
-class FileInfo;
-
-class FilePolicy: public FilePolicyBase
+class FilePolicy: public snort::FilePolicyBase
{
public:
FilePolicy() = default;
~FilePolicy() override = default;
- void policy_check(Flow* flow, FileInfo* file) override;
+ void policy_check(snort::Flow*, snort::FileInfo*) override;
// This is called after file type is known
- FileVerdict type_lookup(Flow* flow, FileInfo* file) override;
+ FileVerdict type_lookup(snort::Flow*, snort::FileInfo*) override;
// This is called after file signature is complete
- FileVerdict signature_lookup(Flow* flow, FileInfo* file) override;
+ FileVerdict signature_lookup(snort::Flow*, snort::FileInfo*) override;
void insert_file_rule(FileRule&);
void set_file_type(bool enabled);
void set_verdict_delay(int64_t delay) { verdict_delay = delay; }
private:
- FileRule& match_file_rule(Flow*, FileInfo* file);
- FileVerdict match_file_signature(Flow*, FileInfo* file);
+ FileRule& match_file_rule(snort::Flow*, snort::FileInfo*);
+ FileVerdict match_file_signature(snort::Flow*, snort::FileInfo*);
std::vector<FileRule> file_rules;
std::map<std::string, FileVerdict> file_shas;
bool type_enabled = false;
delete data;
}
-FileSegments::FileSegments (FileContext* ctx)
+FileSegments::FileSegments (snort::FileContext* ctx)
{
head = nullptr;
current_offset = 0;
return SNORT_FILE_MIDDLE;
}
-int FileSegments::process_one(Flow* flow, const uint8_t* file_data, int data_size,
- FilePolicyBase* policy)
+int FileSegments::process_one(snort::Flow* flow, const uint8_t* file_data, int data_size,
+ snort::FilePolicyBase* policy)
{
FilePosition position = get_file_position(data_size, context->get_file_size());
return context->process(flow, file_data, data_size, position, policy);
}
-int FileSegments::process_all(Flow* flow, FilePolicyBase* policy)
+int FileSegments::process_all(snort::Flow* flow, snort::FilePolicyBase* policy)
{
int ret = 1;
* 1: continue processing/log/block this file
* 0: ignore this file
*/
-int FileSegments::process(Flow* flow, const uint8_t* file_data, uint64_t data_size,
- uint64_t offset, FilePolicyBase* policy)
+int FileSegments::process(snort::Flow* flow, const uint8_t* file_data, uint64_t data_size,
+ uint64_t offset, snort::FilePolicyBase* policy)
{
int ret = 0;
#include "file_api.h"
+namespace snort
+{
class Flow;
+}
class FileConfig;
class FileSegment
class FileSegments
{
public:
- FileSegments(FileContext*);
+ FileSegments(snort::FileContext*);
~FileSegments();
void clear();
// Process file segments with current_offset specified. If file segment is out of order,
// it will be put into the file segments queue.
- int process(Flow*, const uint8_t* file_data, uint64_t data_size, uint64_t offset,
- FilePolicyBase*);
+ int process(snort::Flow*, const uint8_t* file_data, uint64_t data_size, uint64_t offset,
+ snort::FilePolicyBase*);
private:
FileSegment* head = nullptr;
uint64_t current_offset;
- FileContext* context = nullptr;
+ snort::FileContext* context = nullptr;
void add(const uint8_t* file_data, uint64_t data_size, uint64_t offset);
FilePosition get_file_position(uint64_t data_size, uint64_t file_size);
- int process_one(Flow*, const uint8_t* file_data, int data_size, FilePolicyBase*);
- int process_all(Flow*, FilePolicyBase*);
+ int process_one(snort::Flow*, const uint8_t* file_data, int data_size, snort::FilePolicyBase*);
+ int process_all(snort::Flow*, snort::FilePolicyBase*);
};
#endif
#include "file_flows.h"
#include "file_stats.h"
+using namespace snort;
+
bool FileService::file_type_id_enabled = false;
bool FileService::file_signature_enabled = false;
bool FileService::file_capture_enabled = false;
}
}
+namespace snort
+{
uint64_t get_file_processed_size(Flow* flow)
{
FileFlows* file_flows = FileFlows::get_file_flows(flow);
return context->get_processed_bytes();
}
-
+}
class FileEnforcer;
class FileCache;
+namespace snort
+{
class SO_PUBLIC FileService
{
public:
static FileEnforcer* file_enforcer;
static FileCache* file_cache;
};
-
+} // namespace snort
#endif
void detection_filter_print_config(DetectionFilterConfig*)
{ }
-int detection_filter_test(
- void* pv,
- const SfIp* sip, const SfIp* dip,
- long curtime)
+int detection_filter_test(void* pv, const snort::SfIp* sip, const snort::SfIp* dip, long curtime)
{
if (pv == nullptr)
return 0;
// and thereby controls event generation. event_filter is evaluated after
// the event is queued, and thereby controls which events get logged.
+namespace snort
+{
struct SfIp;
+}
struct DetectionFilterConfig
{
void detection_filter_print_config(DetectionFilterConfig*);
-int detection_filter_test(void*, const SfIp* sip, const SfIp* dip, long curtime);
+int detection_filter_test(void*, const snort::SfIp* sip, const snort::SfIp* dip, long curtime);
struct THD_NODE* detection_filter_create(DetectionFilterConfig*, struct THDX_STRUCT*);
#endif
* Create and Add a Thresholding Event Object
*/
int RateFilter_Create(
- SnortConfig* sc, RateFilterConfig* rf_config, tSFRFConfigNode* thdx)
+ snort::SnortConfig* sc, RateFilterConfig* rf_config, tSFRFConfigNode* thdx)
{
int error;
returns 1 - rate threshold reached
0 - rate threshold not reached
*/
-int RateFilter_Test(
- const OptTreeNode* otn,
- Packet* p)
+int RateFilter_Test(const OptTreeNode* otn, snort::Packet* p)
{
unsigned gid = otn->sigInfo.gid;
unsigned sid = otn->sigInfo.sid;
- const SfIp* sip;
- const SfIp* dip;
- SfIp cleared;
+ const snort::SfIp* sip;
+ const snort::SfIp* dip;
+ snort::SfIp cleared;
if ( p->ptrs.ip_api.is_ip() )
{
dip = &cleared;
}
- if ((SnortConfig::get_conf() == nullptr) ||
- (SnortConfig::get_conf()->rate_filter_config == nullptr))
+ if ((snort::SnortConfig::get_conf() == nullptr) ||
+ (snort::SnortConfig::get_conf()->rate_filter_config == nullptr))
{
/* this should not happen, see the create fcn */
return -1;
// events and these require: src -> client, dst -> server.
if ( p->is_from_server() )
{
- return SFRF_TestThreshold(
- SnortConfig::get_conf()->rate_filter_config, gid, sid, dip, sip,
- p->pkth->ts.tv_sec, SFRF_COUNT_INCREMENT);
+ return SFRF_TestThreshold(snort::SnortConfig::get_conf()->rate_filter_config, gid, sid,
+ dip, sip, p->pkth->ts.tv_sec, SFRF_COUNT_INCREMENT);
}
}
- return SFRF_TestThreshold(
- SnortConfig::get_conf()->rate_filter_config, gid, sid, sip, dip,
- p->pkth->ts.tv_sec, SFRF_COUNT_INCREMENT);
+ return SFRF_TestThreshold(snort::SnortConfig::get_conf()->rate_filter_config, gid, sid,
+ sip, dip, p->pkth->ts.tv_sec, SFRF_COUNT_INCREMENT);
}
void RateFilter_PrintConfig(RateFilterConfig*)
#define RATE_FILTER_H
// rate filter interface for Snort
-
-struct RateFilterConfig;
+namespace snort
+{
+struct Packet;
struct SnortConfig;
+}
+struct RateFilterConfig;
struct tSFRFConfigNode;
-struct Packet;
struct OptTreeNode;
RateFilterConfig* RateFilter_ConfigNew();
void RateFilter_ConfigFree(RateFilterConfig*);
void RateFilter_Cleanup();
-struct SnortConfig;
-int RateFilter_Create(SnortConfig* sc, RateFilterConfig*, tSFRFConfigNode*);
+int RateFilter_Create(snort::SnortConfig* sc, RateFilterConfig*, tSFRFConfigNode*);
void RateFilter_PrintConfig(RateFilterConfig*);
-int RateFilter_Test(const OptTreeNode*, Packet*);
+int RateFilter_Test(const OptTreeNode*, snort::Packet*);
#endif
* whether dos threshold is tracking by source or destination IP address. For tracking
* by rule, it is cleared out (all 0s).
*/
- SfIp ip;
+ snort::SfIp ip;
uint16_t padding;
} tSFRFTrackingNodeKey;
PADDING_GUARD_END
);
static tSFRFTrackingNode* _getSFRFTrackingNode(
- const SfIp*,
+ const snort::SfIp*,
unsigned tid,
time_t curTime
);
RateFilterConfig* config,
unsigned gid,
unsigned sid,
- const SfIp* sip,
- const SfIp* dip,
+ const snort::SfIp* sip,
+ const snort::SfIp* dip,
time_t curTime
);
*
* @return @retval 0 successfully added the thresholding object, !0 otherwise
*/
-int SFRF_ConfigAdd(
- SnortConfig*, RateFilterConfig* rf_config, tSFRFConfigNode* cfgNode)
+int SFRF_ConfigAdd(snort::SnortConfig*, RateFilterConfig* rf_config, tSFRFConfigNode* cfgNode)
{
GHash* genHash;
tSFRFSidNode* pSidNode;
tSFRFConfigNode* pNewConfigNode;
tSFRFGenHashKey key = { 0,0 };
- PolicyId policy_id = get_network_policy()->policy_id;
+ PolicyId policy_id = snort::get_network_policy()->policy_id;
// Auto init - memcap must be set 1st, which is not really a problem
if ( rf_hash == nullptr )
*/
static int SFRF_TestObject(
tSFRFConfigNode* cfgNode,
- const SfIp* ip,
+ const snort::SfIp* ip,
time_t curTime,
SFRF_COUNT_OPERATION op
)
// if the count were not incremented in such cases, the
// threshold would never be exceeded.
if ( !cfgNode->seconds && dynNode->count > cfgNode->count )
- if ( cfgNode->newAction == Actions::DROP )
+ if ( cfgNode->newAction == snort::Actions::DROP )
dynNode->count--;
#ifdef SFRF_DEBUG
return retValue;
}
-static inline int SFRF_AppliesTo(tSFRFConfigNode* pCfg, const SfIp* ip)
+static inline int SFRF_AppliesTo(tSFRFConfigNode* pCfg, const snort::SfIp* ip)
{
return ( !pCfg->applyTo || sfvar_ip_in(pCfg->applyTo, ip) );
}
RateFilterConfig* config,
unsigned gid,
unsigned sid,
- const SfIp* sip,
- const SfIp* dip,
+ const snort::SfIp* sip,
+ const snort::SfIp* dip,
time_t curTime,
SFRF_COUNT_OPERATION op
)
int status = -1;
tSFRFGenHashKey key;
- PolicyId policy_id = get_network_policy()->policy_id;
+ PolicyId policy_id = snort::get_network_policy()->policy_id;
#ifdef SFRF_DEBUG
printf("--%d-%u-%u: %s() entering\n", 0, gid, sid, __func__);
case SFRF_TRACK_BY_RULE:
{
- SfIp cleared;
+ snort::SfIp cleared;
cleared.clear();
newStatus = SFRF_TestObject(cfgNode, &cleared, curTime, op);
}
fflush(stdout);
#endif
- return Actions::MAX + cfgNode->newAction;
+ return snort::Actions::MAX + cfgNode->newAction;
}
static void _updateDependentThresholds(
RateFilterConfig* config,
unsigned gid,
unsigned sid,
- const SfIp* sip,
- const SfIp* dip,
+ const snort::SfIp* sip,
+ const snort::SfIp* dip,
time_t curTime
)
{
}
}
-static tSFRFTrackingNode* _getSFRFTrackingNode(
- const SfIp* ip,
- unsigned tid,
- time_t curTime
- )
+static tSFRFTrackingNode* _getSFRFTrackingNode(const snort::SfIp* ip, unsigned tid, time_t curTime)
{
tSFRFTrackingNode* dynNode = nullptr;
tSFRFTrackingNodeKey key;
/* Setup key */
key.ip = *(ip);
key.tid = tid;
- key.policyId = get_network_policy()->policy_id;
+ key.policyId = snort::get_network_policy()->policy_id;
key.padding = 0;
/*
#include "actions/actions.h"
#include "main/policy.h"
+namespace snort
+{
struct SfIp;
+struct SnortConfig;
+}
// define to use over rate threshold
#define SFRF_OVER_RATE
unsigned seconds;
// Action that replaces original rule action on reaching threshold
- Actions::Type newAction;
+ snort::Actions::Type newAction;
// Threshold action duration in seconds before reverting to original rule action
unsigned timeout;
*/
void SFRF_Delete();
void SFRF_Flush();
-int SFRF_ConfigAdd(struct SnortConfig*, RateFilterConfig*, tSFRFConfigNode*);
+int SFRF_ConfigAdd(snort::SnortConfig*, RateFilterConfig*, tSFRFConfigNode*);
int SFRF_TestThreshold(
RateFilterConfig *config,
unsigned gid,
unsigned sid,
- const SfIp *sip,
- const SfIp *dip,
+ const snort::SfIp *sip,
+ const snort::SfIp *dip,
time_t curTime,
SFRF_COUNT_OPERATION);
cfg.tracking = p->track;
cfg.count = p->count;
cfg.seconds = p->seconds;
- cfg.newAction = (Actions::Type)RULE_NEW;
+ cfg.newAction = (snort::Actions::Type)RULE_NEW;
cfg.timeout = p->timeout;
cfg.applyTo = p->ip ? sfip_var_from_string(p->ip) : nullptr;
// this is the only acceptable public value for op
SFRF_COUNT_OPERATION op = SFRF_COUNT_INCREMENT;
- SfIp sip, dip;
+ snort::SfIp sip, dip;
sip.set(p->sip);
dip.set(p->dip);
status = SFRF_TestThreshold(
rfc, p->gid, p->sid, &sip, &dip, curtime, op);
- if ( status >= Actions::MAX )
- status -= Actions::MAX;
+ if ( status >= snort::Actions::MAX )
+ status -= snort::Actions::MAX;
return status;
}
*/
static int sfthd_create_threshold_local(
- SnortConfig*, ThresholdObjects* thd_objs, THD_NODE* config)
+ snort::SnortConfig*, ThresholdObjects* thd_objs, THD_NODE* config)
{
GHash* sfthd_hash;
THD_ITEM* sfthd_item;
THD_NODE* sfthd_node;
tThdItemKey key;
- PolicyId policy_id = get_network_policy()->policy_id;
+ PolicyId policy_id = snort::get_network_policy()->policy_id;
if (thd_objs == nullptr )
return -1;
/*
*/
static int sfthd_create_threshold_global(
- SnortConfig*, ThresholdObjects* thd_objs, THD_NODE* config)
+ snort::SnortConfig*, ThresholdObjects* thd_objs, THD_NODE* config)
{
THD_NODE* sfthd_node;
- PolicyId policy_id = get_network_policy()->policy_id;
+ PolicyId policy_id = snort::get_network_policy()->policy_id;
if (thd_objs == nullptr)
return -1;
*/
int sfthd_create_threshold(
- SnortConfig* sc,
+ snort::SnortConfig* sc,
ThresholdObjects* thd_objs,
unsigned gen_id,
unsigned sig_id,
sfip_var_t* ip_address)
{
//allocate memory fpr sfthd_array if needed.
- PolicyId policyId = get_network_policy()->policy_id;
+ PolicyId policyId = snort::get_network_policy()->policy_id;
THD_NODE sfthd_node;
memset(&sfthd_node, 0, sizeof(sfthd_node));
#endif
int sfthd_test_rule(XHash* rule_hash, THD_NODE* sfthd_node,
- const SfIp* sip, const SfIp* dip, long curtime)
+ const snort::SfIp* sip, const snort::SfIp* dip, long curtime)
{
int status;
static inline int sfthd_test_suppress(
THD_NODE* sfthd_node,
- const SfIp* ip)
+ const snort::SfIp* ip)
{
if ( !sfthd_node->ip_address ||
sfvar_ip_in(sfthd_node->ip_address, ip) )
int sfthd_test_local(
XHash* local_hash,
THD_NODE* sfthd_node,
- const SfIp* sip,
- const SfIp* dip,
+ const snort::SfIp* sip,
+ const snort::SfIp* dip,
time_t curtime)
{
THD_IP_NODE_KEY key;
THD_IP_NODE data,* sfthd_ip_node;
int status=0;
- const SfIp* ip;
+ const snort::SfIp* ip;
- PolicyId policy_id = get_network_policy()->policy_id;
+ PolicyId policy_id = snort::get_network_policy()->policy_id;
#ifdef THD_DEBUG
char buf[24];
XHash* global_hash,
THD_NODE* sfthd_node,
unsigned sig_id, /* from current event */
- const SfIp* sip, /* " */
- const SfIp* dip, /* " */
+ const snort::SfIp* sip, /* " */
+ const snort::SfIp* dip, /* " */
time_t curtime)
{
THD_IP_GNODE_KEY key;
THD_IP_NODE data;
THD_IP_NODE* sfthd_ip_node;
int status=0;
- const SfIp* ip;
+ const snort::SfIp* ip;
- PolicyId policy_id = get_network_policy()->policy_id;
+ PolicyId policy_id = snort::get_network_policy()->policy_id;
#ifdef THD_DEBUG
char buf[24];
THD_STRUCT* thd,
unsigned gen_id,
unsigned sig_id,
- const SfIp* sip,
- const SfIp* dip,
+ const snort::SfIp* sip,
+ const snort::SfIp* dip,
long curtime)
{
tThdItemKey key;
#endif
int status=0;
- PolicyId policy_id = get_network_policy()->policy_id;
+ PolicyId policy_id = snort::get_network_policy()->policy_id;
if ((thd_objs == nullptr) || (thd == nullptr))
return 0;
#include "sfip/sf_ip.h"
#include "utils/cpp_macros.h"
+namespace snort
+{
+struct SnortConfig;
+}
struct GHash;
struct XHash;
typedef struct sf_list SF_LIST;
{
int thd_id;
PolicyId policyId;
- SfIp ip;
+ snort::SfIp ip;
uint16_t padding;
};
unsigned gen_id;
unsigned sig_id;
PolicyId policyId;
- SfIp ip;
+ snort::SfIp ip;
uint16_t padding;
};
PADDING_GUARD_END
void sfthd_objs_free(ThresholdObjects*);
int sfthd_test_rule(XHash* rule_hash, THD_NODE* sfthd_node,
- const SfIp* sip, const SfIp* dip, long curtime);
+ const snort::SfIp* sip, const snort::SfIp* dip, long curtime);
THD_NODE* sfthd_create_rule_threshold(
int id,
);
void sfthd_node_free(THD_NODE*);
-struct SnortConfig;
-int sfthd_create_threshold(
- SnortConfig*,
- ThresholdObjects*,
- unsigned gen_id,
- unsigned sig_id,
- int tracking,
- int type,
- int priority,
- int count,
- int seconds,
- sfip_var_t* ip_address
- );
+int sfthd_create_threshold(snort::SnortConfig*, ThresholdObjects*, unsigned gen_id,
+ unsigned sig_id, int tracking, int type, int priority, int count,
+ int seconds, sfip_var_t* ip_address);
// 1: don't log due to event_filter
// 0: log
// -1: don't log due to suppress
-int sfthd_test_threshold(
- ThresholdObjects*,
- THD_STRUCT*,
- unsigned gen_id,
- unsigned sig_id,
- const SfIp* sip,
- const SfIp* dip,
- long curtime);
+int sfthd_test_threshold(ThresholdObjects*, THD_STRUCT*, unsigned gen_id, unsigned sig_id,
+ const snort::SfIp* sip, const snort::SfIp* dip, long curtime);
XHash* sfthd_new_hash(unsigned, size_t, size_t);
-int sfthd_test_local(
- XHash* local_hash,
- THD_NODE* sfthd_node,
- const SfIp* sip,
- const SfIp* dip,
- time_t curtime);
+int sfthd_test_local(XHash* local_hash, THD_NODE* sfthd_node, const snort::SfIp* sip,
+ const snort::SfIp* dip, time_t curtime);
#ifdef THD_DEBUG
int sfthd_show_objects(THD_STRUCT* thd);
long curtime = (long)p->now;
int status;
- SfIp sip, dip;
+ snort::SfIp sip, dip;
sip.set(p->sip);
dip.set(p->dip);
*/
int sfthreshold_create(
- SnortConfig* sc, ThresholdConfig* thd_config, THDX_STRUCT* thdx)
+ snort::SnortConfig* sc, ThresholdConfig* thd_config, THDX_STRUCT* thdx)
{
if (thd_config == nullptr)
return -1;
returns 0 - log
!0 - don't log
*/
-int sfthreshold_test(
- unsigned gen_id, unsigned sig_id,
- const SfIp* sip, const SfIp* dip,
- long curtime)
+int sfthreshold_test(unsigned gen_id, unsigned sig_id, const snort::SfIp* sip,
+ const snort::SfIp* dip, long curtime)
{
- if ((SnortConfig::get_conf()->threshold_config == nullptr) ||
- !SnortConfig::get_conf()->threshold_config->enabled)
+ if ((snort::SnortConfig::get_conf()->threshold_config == nullptr) ||
+ !snort::SnortConfig::get_conf()->threshold_config->enabled)
{
return 0;
}
if (!thd_checked)
{
thd_checked = 1;
- thd_answer = sfthd_test_threshold(SnortConfig::get_conf()->threshold_config->thd_objs,
+ thd_answer = sfthd_test_threshold(snort::SnortConfig::get_conf()->threshold_config->thd_objs,
thd_runtime, gen_id, sig_id, sip, dip, curtime);
}
#ifndef SFTHRESHOLD_H
#define SFTHRESHOLD_H
+namespace snort
+{
struct SfIp;
+struct SnortConfig;
+}
struct THDX_STRUCT;
struct ThresholdObjects;
ThresholdConfig* ThresholdConfigNew();
void ThresholdConfigFree(ThresholdConfig*);
void sfthreshold_reset();
-int sfthreshold_create(struct SnortConfig*, ThresholdConfig*, THDX_STRUCT*);
-int sfthreshold_test(unsigned int, unsigned int, const SfIp*, const SfIp*, long curtime);
+int sfthreshold_create(snort::SnortConfig*, ThresholdConfig*, THDX_STRUCT*);
+int sfthreshold_test(unsigned int, unsigned int, const snort::SfIp*, const snort::SfIp*, long curtime);
void print_thresholding(ThresholdConfig*, unsigned shutdown);
void sfthreshold_free();
#include "stream/stream.h" // FIXIT-M bad dependency
#include "time/packet_time.h"
+using namespace snort;
+
/* Reasonably small, and prime */
// FIXIT-L size based on max_tcp + max_udp?
#define MAX_HASH 1021
* existing appId, new appId and associated data is not stored.
*
*/
-int ExpectCache::add_flow(const Packet *ctrlPkt,
- PktType type, IpProtocol ip_proto,
- const SfIp* cliIP, uint16_t cliPort,
- const SfIp* srvIP, uint16_t srvPort,
+int ExpectCache::add_flow(const Packet *ctrlPkt, PktType type, IpProtocol ip_proto,
+ const SfIp* cliIP, uint16_t cliPort, const SfIp* srvIP, uint16_t srvPort,
char direction, FlowData* fd, int16_t appId)
{
/* Just pull the VLAN ID, MPLS ID, and Address Space ID from the
#include <vector>
#include "flow/flow_key.h"
+struct ExpectNode;
+
+namespace snort
+{
class Flow;
class FlowData;
struct Packet;
-struct ExpectNode;
-struct ExpectFlow;
struct SO_PUBLIC ExpectFlow
{
struct ExpectFlow* next;
- FlowData* data;
+ snort::FlowData* data;
~ExpectFlow();
void clear();
- int add_flow_data(FlowData*);
- FlowData* get_flow_data(unsigned);
+ int add_flow_data(snort::FlowData*);
+ snort::FlowData* get_flow_data(unsigned);
static std::vector<ExpectFlow*>* get_expect_flows();
static void reset_expect_flows();
};
+}
class ExpectCache
{
ExpectCache(const ExpectCache&) = delete;
ExpectCache& operator=(const ExpectCache&) = delete;
- int add_flow(const Packet *ctrlPkt, PktType, IpProtocol,
- const SfIp* cliIP, uint16_t cliPort,
- const SfIp* srvIP, uint16_t srvPort,
- char direction, FlowData*, int16_t appId = 0);
+ int add_flow(const snort::Packet *ctrlPkt, PktType, IpProtocol,
+ const snort::SfIp* cliIP, uint16_t cliPort,
+ const snort::SfIp* srvIP, uint16_t srvPort,
+ char direction, snort::FlowData*, int16_t appId = 0);
- bool is_expected(Packet*);
- bool check(Packet*, Flow*);
+ bool is_expected(snort::Packet*);
+ bool check(snort::Packet*, snort::Flow*);
unsigned long get_expects() { return expects; }
unsigned long get_realized() { return realized; }
void prune();
ExpectNode* get_node(FlowKey&, bool&);
- ExpectFlow* get_flow(ExpectNode*, uint32_t, int16_t);
- bool set_data(ExpectNode*, ExpectFlow*&, FlowData*);
- ExpectNode* find_node_by_packet(Packet*, FlowKey&);
- bool process_expected(ExpectNode*, FlowKey&, Packet*, Flow*);
+ snort::ExpectFlow* get_flow(ExpectNode*, uint32_t, int16_t);
+ bool set_data(ExpectNode*, snort::ExpectFlow*&, snort::FlowData*);
+ ExpectNode* find_node_by_packet(snort::Packet*, FlowKey&);
+ bool process_expected(ExpectNode*, FlowKey&, snort::Packet*, snort::Flow*);
private:
class ZHash* hash_table;
ExpectNode* nodes;
- ExpectFlow* pool, * free_list;
+ snort::ExpectFlow* pool, * free_list;
unsigned long expects, realized;
unsigned long prunes, overflows;
#include "utils/stats.h"
#include "utils/util.h"
+using namespace snort;
+
unsigned FlowData::flow_data_id = 0;
FlowData::FlowData(unsigned u, Inspector* ph)
#define FLOW_IS_OFFLOADED 0x01
#define FLOW_WAS_OFFLOADED 0x02 // FIXIT-L debug only
+class BitOp;
+class FlowHAState;
struct FlowKey;
+class Session;
+
+namespace snort
+{
struct Packet;
typedef void (* StreamAppDataFree)(void*);
// these fields are const after initialization
const FlowKey* key;
- class Session* session;
- class BitOp* bitop;
- class FlowHAState* ha_state;
+ Session* session;
+ BitOp* bitop;
+ FlowHAState* ha_state;
uint8_t ip_proto; // FIXIT-M do we need both of these?
PktType pkt_type; // ^^
return !(ssn_state.session_flags & SSNFLAG_NO_DETECT_TO_CLIENT);
}
-
+}
#endif
#include "flow_key.h"
+using namespace snort;
+
#define SESSION_CACHE_FLAG_PURGING 0x01
//-------------------------------------------------------------------------
#include "flow_config.h"
#include "prune_stats.h"
+namespace snort
+{
class Flow;
+}
struct FlowKey;
class FlowCache
FlowCache(const FlowCache&) = delete;
FlowCache& operator=(const FlowCache&) = delete;
- void push(Flow*);
+ void push(snort::Flow*);
- Flow* find(const FlowKey*);
- Flow* get(const FlowKey*);
+ snort::Flow* find(const FlowKey*);
+ snort::Flow* get(const FlowKey*);
- int release(Flow*, PruneReason = PruneReason::NONE, bool do_cleanup = true);
+ int release(snort::Flow*, PruneReason = PruneReason::NONE, bool do_cleanup = true);
unsigned prune_unis();
- unsigned prune_stale(uint32_t thetime, const Flow* save_me);
- unsigned prune_excess(const Flow* save_me);
+ unsigned prune_stale(uint32_t thetime, const snort::Flow* save_me);
+ unsigned prune_excess(const snort::Flow* save_me);
bool prune_one(PruneReason, bool do_cleanup);
unsigned timeout(unsigned num_flows, time_t cur_time);
void reset_stats()
{ prune_stats = PruneStats(); }
- void unlink_uni(Flow*);
+ void unlink_uni(snort::Flow*);
private:
- void link_uni(Flow*);
- int remove(Flow*);
+ void link_uni(snort::Flow*);
+ int remove(snort::Flow*);
private:
static const unsigned cleanup_flows = 1;
uint32_t flags;
class ZHash* hash_table;
- Flow* uni_head, * uni_tail;
+ snort::Flow* uni_head, * uni_tail;
PruneStats prune_stats;
};
#include "flow_cache.h"
#include "session.h"
+using namespace snort;
+
FlowControl::FlowControl() = default;
FlowControl::~FlowControl()
#include "framework/decode_data.h"
#include "framework/inspector.h"
+namespace snort
+{
class Flow;
class FlowData;
-class FlowCache;
-struct FlowKey;
struct Packet;
struct SfIp;
+}
+class FlowCache;
+struct FlowKey;
enum class PruneReason : uint8_t;
~FlowControl();
public:
- void process_ip(Packet*);
- void process_icmp(Packet*);
- void process_tcp(Packet*);
- void process_udp(Packet*);
- void process_user(Packet*);
- void process_file(Packet*);
-
- Flow* find_flow(const FlowKey*);
- Flow* new_flow(const FlowKey*);
-
- void init_ip(const FlowConfig&, InspectSsnFunc);
- void init_icmp(const FlowConfig&, InspectSsnFunc);
- void init_tcp(const FlowConfig&, InspectSsnFunc);
- void init_udp(const FlowConfig&, InspectSsnFunc);
- void init_user(const FlowConfig&, InspectSsnFunc);
- void init_file(const FlowConfig&, InspectSsnFunc);
+ void process_ip(snort::Packet*);
+ void process_icmp(snort::Packet*);
+ void process_tcp(snort::Packet*);
+ void process_udp(snort::Packet*);
+ void process_user(snort::Packet*);
+ void process_file(snort::Packet*);
+
+ snort::Flow* find_flow(const FlowKey*);
+ snort::Flow* new_flow(const FlowKey*);
+
+ void init_ip(const FlowConfig&, snort::InspectSsnFunc);
+ void init_icmp(const FlowConfig&, snort::InspectSsnFunc);
+ void init_tcp(const FlowConfig&, snort::InspectSsnFunc);
+ void init_udp(const FlowConfig&, snort::InspectSsnFunc);
+ void init_user(const FlowConfig&, snort::InspectSsnFunc);
+ void init_file(const FlowConfig&, snort::InspectSsnFunc);
void init_exp(uint32_t max);
void delete_flow(const FlowKey*);
- void delete_flow(Flow*, PruneReason);
+ void delete_flow(snort::Flow*, PruneReason);
void purge_flows(PktType);
bool prune_one(PruneReason, bool do_cleanup);
void timeout_flows(time_t cur_time);
- bool expected_flow(Flow*, Packet*);
- bool is_expected(Packet*);
+ bool expected_flow(snort::Flow*, snort::Packet*);
+ bool is_expected(snort::Packet*);
int add_expected(
- const Packet* ctrlPkt, PktType, IpProtocol,
- const SfIp *srcIP, uint16_t srcPort,
- const SfIp *dstIP, uint16_t dstPort,
- char direction, FlowData*);
+ const snort::Packet* ctrlPkt, PktType, IpProtocol,
+ const snort::SfIp *srcIP, uint16_t srcPort,
+ const snort::SfIp *dstIP, uint16_t dstPort,
+ char direction, snort::FlowData*);
int add_expected(
- const Packet* ctrlPkt, PktType, IpProtocol,
- const SfIp *srcIP, uint16_t srcPort,
- const SfIp *dstIP, uint16_t dstPort,
- int16_t appId, FlowData*);
+ const snort::Packet* ctrlPkt, PktType, IpProtocol,
+ const snort::SfIp *srcIP, uint16_t srcPort,
+ const snort::SfIp *dstIP, uint16_t dstPort,
+ int16_t appId, snort::FlowData*);
PegCount get_flows(PktType);
PegCount get_total_prunes(PktType) const;
FlowCache* get_cache(PktType);
const FlowCache* get_cache(PktType) const;
- void set_key(FlowKey*, Packet*);
+ void set_key(FlowKey*, snort::Packet*);
- unsigned process(Flow*, Packet*);
+ unsigned process(snort::Flow*, snort::Packet*);
void preemptive_cleanup();
private:
FlowCache* file_cache = nullptr;
// preallocated arrays
- Flow* ip_mem = nullptr;
- Flow* icmp_mem = nullptr;
- Flow* tcp_mem = nullptr;
- Flow* udp_mem = nullptr;
- Flow* user_mem = nullptr;
- Flow* file_mem = nullptr;
-
- InspectSsnFunc get_ip = nullptr;
- InspectSsnFunc get_icmp = nullptr;
- InspectSsnFunc get_tcp = nullptr;
- InspectSsnFunc get_udp = nullptr;
- InspectSsnFunc get_user = nullptr;
- InspectSsnFunc get_file = nullptr;
+ snort::Flow* ip_mem = nullptr;
+ snort::Flow* icmp_mem = nullptr;
+ snort::Flow* tcp_mem = nullptr;
+ snort::Flow* udp_mem = nullptr;
+ snort::Flow* user_mem = nullptr;
+ snort::Flow* file_mem = nullptr;
+
+ snort::InspectSsnFunc get_ip = nullptr;
+ snort::InspectSsnFunc get_icmp = nullptr;
+ snort::InspectSsnFunc get_tcp = nullptr;
+ snort::InspectSsnFunc get_udp = nullptr;
+ snort::InspectSsnFunc get_user = nullptr;
+ snort::InspectSsnFunc get_file = nullptr;
class ExpectCache* exp_cache = nullptr;
PktType last_pkt_type = PktType::NONE;
#include "protocols/icmp6.h"
#include "utils/util.h"
+using namespace snort;
+
//-------------------------------------------------------------------------
// icmp foo
//-------------------------------------------------------------------------
#include "utils/cpp_macros.h"
struct HashFnc;
+
+namespace snort
+{
struct SfIp;
+}
PADDING_GUARD_BEGIN
struct FlowKey
addresses at this time. */
bool init(
PktType, IpProtocol,
- const SfIp *srcIP, uint16_t srcPort,
- const SfIp *dstIP, uint16_t dstPort,
+ const snort::SfIp *srcIP, uint16_t srcPort,
+ const snort::SfIp *dstIP, uint16_t dstPort,
uint16_t vlanId, uint32_t mplsId, uint16_t addrSpaceId);
bool init(
PktType, IpProtocol,
- const SfIp *srcIP, const SfIp *dstIP,
+ const snort::SfIp *srcIP, const snort::SfIp *dstIP,
uint32_t id, uint16_t vlanId,
uint32_t mplsId, uint16_t addrSpaceId);
private:
bool init4(
IpProtocol,
- const SfIp *srcIP, uint16_t srcPort,
- const SfIp *dstIP, uint16_t dstPort,
+ const snort::SfIp *srcIP, uint16_t srcPort,
+ const snort::SfIp *dstIP, uint16_t dstPort,
uint32_t mplsId, bool order = true);
bool init6(
IpProtocol,
- const SfIp *srcIP, uint16_t srcPort,
- const SfIp *dstIP, uint16_t dstPort,
+ const snort::SfIp *srcIP, uint16_t srcPort,
+ const snort::SfIp *dstIP, uint16_t dstPort,
uint32_t mplsId, bool order = true);
};
PADDING_GUARD_END
#include "flow.h"
#include "flow_key.h"
+using namespace snort;
+
static const uint8_t HA_MESSAGE_VERSION = 3;
// define message size and content constants.
//-------------------------------------------------------------------------
+namespace snort
+{
class Flow;
+}
struct FlowKey;
// The FlowHAHandle is the dynamically allocated index used uniquely identify
{
public:
virtual ~FlowHAClient() = default;
- virtual bool consume(Flow*&, FlowKey*, HAMessage*) { return false; }
- virtual bool produce(Flow*, HAMessage*) { return false; }
- virtual bool is_update_required(Flow*) { return false; }
- virtual bool is_delete_required(Flow*) { return false; }
+ virtual bool consume(snort::Flow*&, FlowKey*, HAMessage*) { return false; }
+ virtual bool produce(snort::Flow*, HAMessage*) { return false; }
+ virtual bool is_update_required(snort::Flow*) { return false; }
+ virtual bool is_delete_required(snort::Flow*) { return false; }
uint8_t get_message_size() { return header.length; }
bool fit(HAMessage*, uint8_t);
bool place(HAMessage*, uint8_t*, uint8_t);
HighAvailability(PortBitSet*,bool);
~HighAvailability();
- void process_update(Flow*, const DAQ_PktHdr_t*);
- void process_deletion(Flow*);
+ void process_update(snort::Flow*, const DAQ_PktHdr_t*);
+ void process_deletion(snort::Flow*);
void process_receive();
private:
static bool active();
// Within the packet callback, analyze the packet and flow for potential update messages
- static void process_update(Flow*, const DAQ_PktHdr_t*);
+ static void process_update(snort::Flow*, const DAQ_PktHdr_t*);
// Anytime a flow is deleted, potentially generate a deletion message
- static void process_deletion(Flow*);
+ static void process_deletion(snort::Flow*);
// Look for and dispatch receive messages.
static void process_receive();
- static void set_modified(Flow*);
- static bool in_standby(Flow*);
+ static void set_modified(snort::Flow*);
+ static bool in_standby(snort::Flow*);
private:
HighAvailabilityManager() = delete;
#include "ha.h"
+using namespace snort;
//-------------------------------------------------------------------------
// ha module
};
extern THREAD_LOCAL SimpleStats ha_stats;
-extern THREAD_LOCAL ProfileStats ha_perf_stats;
+extern THREAD_LOCAL snort::ProfileStats ha_perf_stats;
-class HighAvailabilityModule : public Module
+class HighAvailabilityModule : public snort::Module
{
public:
HighAvailabilityModule();
~HighAvailabilityModule() override;
- bool set(const char*, Value&, SnortConfig*) override;
- bool begin(const char*, int, SnortConfig*) override;
- bool end(const char*, int, SnortConfig*) override;
+ bool set(const char*, snort::Value&, snort::SnortConfig*) override;
+ bool begin(const char*, int, snort::SnortConfig*) override;
+ bool end(const char*, int, snort::SnortConfig*) override;
PegCount* get_counts() const override
{ return (PegCount*)&ha_stats; }
const PegInfo* get_pegs() const override
{ return simple_pegs; }
- ProfileStats* get_profile() const override;
+ snort::ProfileStats* get_profile() const override;
Usage get_usage() const override
{ return GLOBAL; }
#include "stream/stream.h"
+namespace snort
+{
+class Flow;
struct Packet;
struct SfIp;
-class Flow;
+class StreamSplitter;
+}
class Session
{
public:
virtual ~Session() = default;
- virtual bool setup(Packet*) { return true; }
- virtual void update_direction(char /*dir*/, const SfIp*, uint16_t /*port*/) { }
- virtual int process(Packet*) { return 0; }
+ virtual bool setup(snort::Packet*) { return true; }
+ virtual void update_direction(char /*dir*/, const snort::SfIp*, uint16_t /*port*/) { }
+ virtual int process(snort::Packet*) { return 0; }
- virtual void restart(Packet*) { }
- virtual void precheck(Packet*) { }
+ virtual void restart(snort::Packet*) { }
+ virtual void precheck(snort::Packet*) { }
virtual void clear() = 0;
- virtual void cleanup(Packet* = nullptr) { clear(); }
+ virtual void cleanup(snort::Packet* = nullptr) { clear(); }
- virtual bool add_alert(Packet*, uint32_t /*gid*/, uint32_t /*sid*/) { return false; }
- virtual bool check_alerted(Packet*, uint32_t /*gid*/, uint32_t /*sid*/) { return false; }
+ virtual bool add_alert(snort::Packet*, uint32_t /*gid*/, uint32_t /*sid*/) { return false; }
+ virtual bool check_alerted(snort::Packet*, uint32_t /*gid*/, uint32_t /*sid*/) { return false; }
virtual int update_alert(
- Packet*, uint32_t /*gid*/, uint32_t /*sid*/,
+ snort::Packet*, uint32_t /*gid*/, uint32_t /*sid*/,
uint32_t /*event_id*/, uint32_t /*event_second*/) { return 0; }
- virtual void flush_client(Packet*) { }
- virtual void flush_server(Packet*) { }
- virtual void flush_talker(Packet*, bool /*final_flush */ = false) { }
- virtual void flush_listener(Packet*, bool /*final_flush */ = false) { }
+ virtual void flush_client(snort::Packet*) { }
+ virtual void flush_server(snort::Packet*) { }
+ virtual void flush_talker(snort::Packet*, bool /*final_flush */ = false) { }
+ virtual void flush_listener(snort::Packet*, bool /*final_flush */ = false) { }
- virtual void set_splitter(bool /*c2s*/, StreamSplitter*) { }
- virtual StreamSplitter* get_splitter(bool /*c2s*/) { return nullptr; }
+ virtual void set_splitter(bool /*c2s*/, snort::StreamSplitter*) { }
+ virtual snort::StreamSplitter* get_splitter(bool /*c2s*/) { return nullptr; }
- virtual void set_extra_data(Packet*, uint32_t /*flag*/) { }
+ virtual void set_extra_data(snort::Packet*, uint32_t /*flag*/) { }
virtual bool is_sequenced(uint8_t /*dir*/) { return true; }
virtual bool are_packets_missing(uint8_t /*dir*/) { return true; }
virtual uint8_t missing_in_reassembled(uint8_t /*dir*/) { return SSN_MISSING_NONE; }
protected:
- Session(Flow* f) { flow = f; }
+ Session(snort::Flow* f) { flow = f; }
public:
- Flow* flow; // FIXIT-L use reference?
+ snort::Flow* flow; // FIXIT-L use reference?
};
/* These should be tracked by all Session subclasses. Add to top of peg list.
#include <CppUTest/CommandLineTestRunner.h>
#include <CppUTest/TestHarness.h>
+using namespace snort;
+
void LogMessage(const char*,...) { }
THREAD_LOCAL SimpleStats ha_stats;
#include <CppUTest/CommandLineTestRunner.h>
#include <CppUTest/TestHarness.h>
+using namespace snort;
+
#define MSG_SIZE 100
#define TEST_KEY 0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47
PT_MAX
};
+namespace snort
+{
class Module;
typedef Module* (* ModNewFunc)();
typedef void (* ModDelFunc)(Module*);
const char* options;
const char* name;
const char* help;
- ModNewFunc mod_ctor;
+ snort::ModNewFunc mod_ctor;
ModDelFunc mod_dtor;
};
-
+}
#endif
#include "detection/detection_engine.h"
#include "events/event_queue.h"
+using namespace snort;
+
EncState::EncState(const ip::IpApi& api, EncodeFlags f, IpProtocol pr,
uint8_t t, uint16_t data_size) :
ip_api(api),
struct TextLog;
struct _daq_pkthdr;
-struct Packet;
-struct Layer;
-class Flow;
+
+namespace snort
+{
enum CodecSid : uint32_t;
namespace ip
struct ICMPHdr;
}
+class Flow;
+struct Layer;
+struct Packet;
+
// Used by root codecs to add their DLT to their HELP string
#define ADD_DLT(help, x) help " (DLT " STRINGIFY_MX(x) ")"
CdNewFunc ctor; // get eval optional instance data
CdDelFunc dtor; // clean up instance data
};
-
+}
#endif /* FRAMEWORK_CODEC_H */
#include "framework/base_api.h"
#include "main/snort_types.h"
+namespace snort
+{
// this is the current version of the api
#define CONNECTOR_API_VERSION ((BASE_API_VERSION << 16) | 0)
ConnectorNewFunc ctor;
ConnectorDelFunc dtor;
};
-
+}
#endif
#include "detection/detection_util.h"
#include "protocols/packet.h"
+using namespace snort;
+
Cursor::Cursor(Packet* p)
{
reset(p);
#include <cstdint>
#include <cstring>
+namespace snort
+{
struct Packet;
+}
class Cursor
{
public:
- Cursor(Packet*);
+ Cursor(snort::Packet*);
Cursor(const Cursor&);
Cursor& operator=(const Cursor&) = default;
bool is(const char* s) const
{ return !strcmp(name, s); }
- void reset(Packet*);
+ void reset(snort::Packet*);
void set(const char* s, const uint8_t* b, unsigned n)
{ name = s; data = b; sz = n; pos = delta = 0; }
#include "main/snort_config.h"
#include "protocols/packet.h"
+using namespace snort;
+
static DataBus& get_data_bus()
-{ return get_inspection_policy()->dbus; }
+{ return snort::get_inspection_policy()->dbus; }
class BufferEvent : public DataEvent
{
// notify subscribers of event
void DataBus::publish(const char* key, DataEvent& e, Flow* f)
{
- InspectionPolicy* pi = get_inspection_policy();
+ InspectionPolicy* pi = snort::get_inspection_policy();
pi->dbus._publish(key, e, f);
// also publish to default policy to notify control subscribers such as appid
- InspectionPolicy* di = get_default_inspection_policy(SnortConfig::get_conf());
+ InspectionPolicy* di = snort::get_default_inspection_policy(SnortConfig::get_conf());
// of course, only when current is not default
if ( di != pi )
#include "main/snort_types.h"
-// FIXIT-P evaluate perf; focus is on correctness
-typedef std::vector<class DataHandler*> DataList;
-typedef std::map<std::string, DataList> DataMap;
-
+namespace snort
+{
class Flow;
struct Packet;
DataHandler() = default;
};
+// FIXIT-P evaluate perf; focus is on correctness
+typedef std::vector<DataHandler*> DataList;
+typedef std::map<std::string, DataList> DataMap;
+
class SO_PUBLIC DataBus
{
public:
int type;
const uint8_t* data;
};
+}
// common data events
#define PACKET_EVENT "detection.packet"
#include "protocols/ip.h"
#include "protocols/mpls.h"
+namespace snort
+{
namespace tcp
{
struct TCPHdr;
}
-
namespace udp
{
struct UDPHdr;
}
-
namespace icmp
{
struct ICMPHdr;
}
+}
/* NOTE: if A protocol is added, update DecodeFlags! */
enum class PktType : std::uint8_t
* these three pointers are each referenced literally
* dozens if not hundreds of times. NOTHING else should be added!!
*/
- const tcp::TCPHdr* tcph;
- const udp::UDPHdr* udph;
- const icmp::ICMPHdr* icmph;
+ const snort::tcp::TCPHdr* tcph;
+ const snort::udp::UDPHdr* udph;
+ const snort::icmp::ICMPHdr* icmph;
uint16_t sp; /* source port (TCP/UDP) */
uint16_t dp; /* dest port (TCP/UDP) */
uint16_t decode_flags;
PktType type;
- ip::IpApi ip_api;
- mpls::MplsHdr mplsHdr; // FIXIT-L need to zero this?
+ snort::ip::IpApi ip_api;
+ snort::mpls::MplsHdr mplsHdr; // FIXIT-L need to zero this?
inline void reset()
{
#include "protocols/packet.h"
#include "stream/stream_splitter.h"
+using namespace snort;
+
//-------------------------------------------------------------------------
// packet handler stuff
//-------------------------------------------------------------------------
#include "framework/base_api.h"
#include "main/thread.h"
-struct Packet;
+class Session;
+
+namespace snort
+{
struct SnortConfig;
+struct Packet;
typedef int16_t ServiceId;
unsigned len;
};
+
struct InspectApi;
//-------------------------------------------------------------------------
// api for class
//-------------------------------------------------------------------------
+
class SO_PUBLIC Inspector
{
public:
typedef Inspector* (* InspectNew)(Module*);
typedef void (* InspectDelFunc)(Inspector*);
typedef void (* InspectFunc)();
-typedef class Session* (* InspectSsnFunc)(class Flow*);
+typedef Session* (* InspectSsnFunc)(class Flow*);
struct InspectApi
{
inline const char* Inspector::get_name()
{ return api->base.name; }
-
+}
#endif
#include "framework/base_api.h"
#include "main/snort_types.h"
-struct Packet;
-
// this is the current version of the api
#define ACTAPI_VERSION ((BASE_API_VERSION << 16) | 0)
// api for class
//-------------------------------------------------------------------------
+namespace snort
+{
+struct Packet;
+struct SnortConfig;
+
enum ActionType
{
ACT_LOCAL,
ACT_MAX
};
-struct SnortConfig;
-
class SO_PUBLIC IpsAction
{
public:
ActNewFunc ctor;
ActDelFunc dtor;
};
-
+}
#endif
#include "hash/hashfcn.h"
+using namespace snort;
+
static const char* s_buffer = nullptr;
void IpsOption::set_buffer(const char* s)
#include "framework/base_api.h"
#include "main/snort_types.h"
-struct Packet;
-
-// this is the current version of the api
-#define IPSAPI_VERSION ((BASE_API_VERSION << 16) | 0)
-
//-------------------------------------------------------------------------
// api for class
// eval and action are packet thread specific
//-------------------------------------------------------------------------
-struct SnortConfig;
class Cursor;
+struct OptTreeNode;
+struct PatternMatchData;
+
+namespace snort
+{
+struct Packet;
+struct SnortConfig;
+class Module;
+
+// this is the current version of the api
+#define IPSAPI_VERSION ((BASE_API_VERSION << 16) | 0)
enum CursorActionType
{
{ return CAT_NONE; }
// for fast-pattern options like content
- virtual struct PatternMatchData* get_pattern(int /*proto*/, RuleDirection = RULE_WO_DIR)
+ virtual PatternMatchData* get_pattern(int /*proto*/, RuleDirection = RULE_WO_DIR)
{ return nullptr; }
virtual struct PatternMatchData* get_alternate_pattern()
IpsDelFunc dtor;
IpsOptFunc verify;
};
-
+}
#endif
#include "main/snort_types.h"
struct Event;
+namespace snort
+{
struct Packet;
// this is the current version of the api
LogNewFunc ctor;
LogDelFunc dtor;
};
-
+}
#endif
#include <string>
+namespace snort
+{
struct BaseApi;
+}
class LuaApi
{
public:
virtual ~LuaApi() = default;
- virtual const BaseApi* get_base() const = 0;
+ virtual const snort::BaseApi* get_base() const = 0;
std::string name;
std::string chunk;
#include "module.h"
+using namespace snort;
+
static const Parameter defaults[] =
{
{ "trace", Parameter::PT_INT, nullptr, nullptr,
#include "main/snort_types.h"
#include "utils/stats.h"
-using LuaCFunction = int(*)(struct lua_State*);
+struct lua_State;
+
+class ModuleManager;
+
+namespace snort
+{
+struct ProfileStats;
+struct SnortConfig;
+
+using LuaCFunction = int(*)(lua_State*);
struct Command
{
const char* msg;
};
-struct ProfileStats;
-struct SnortConfig;
-
class SO_PUBLIC Module
{
public:
bool is_list = false, Trace* = nullptr);
private:
- friend class ModuleManager;
+ friend ModuleManager;
void init(const char*, const char* = nullptr);
std::vector<PegCount> counts;
counts[index] += value;
}
};
-
+}
#endif
#include "profiler/profiler_defs.h"
#include "search_engines/pat_stats.h"
+
using namespace std;
+namespace snort
+{
THREAD_LOCAL ProfileStats mpsePerfStats;
//-------------------------------------------------------------------------
{
method = m;
verbose = 0;
+ api = nullptr;
}
int Mpse::search(
return _search(T, n, match, context, current_state);
}
+}
+
#include "main/thread.h"
#include "search_engines/search_common.h"
+namespace snort
+{
// this is the current version of the api
#define SEAPI_VERSION ((BASE_API_VERSION << 16) | 0)
MpseExeFunc init;
MpseExeFunc print;
};
-
+}
#endif
#include "value.h"
+using namespace snort;
using namespace std;
static bool valid_bool(Value& v, const char*)
#include <functional>
#include "main/snort_types.h"
+namespace snort
+{
+class Value;
+
struct SO_PUBLIC Parameter
{
using RangeQuery = std::function<const char*()>;
const char* get_type() const;
const char* get_range() const;
- bool validate(class Value&) const;
+ bool validate(Value&) const;
bool is_positional() const
{ return ( name && *name == '~' ); }
// 0-based; -1 if not found; list is | delimited
static int index(const char* list, const char* key);
};
-
+}
#endif
#include "framework/ips_option.h"
#include "main/snort_types.h"
+namespace snort
+{
struct Packet;
+}
// this is the current version of the api
#define SOAPI_VERSION ((BASE_API_VERSION << 16) | 0)
// ctor(<key>) returns eval func and optional data
// data is freed with dtor(data)
-typedef IpsOption::EvalStatus (* SoEvalFunc)(void*, class Cursor&, Packet*);
+typedef snort::IpsOption::EvalStatus (* SoEvalFunc)(void*, class Cursor&, snort::Packet*);
typedef SoEvalFunc (* SoNewFunc)(const char* key, void**);
typedef void (* SoDelFunc)(void*);
typedef void (* SoAuxFunc)();
struct SoApi
{
- BaseApi base;
+ snort::BaseApi base;
const uint8_t* rule;
unsigned length;
#include "catch/snort_catch.h"
#endif
+using namespace snort;
using namespace std;
Value::~Value()
#include "framework/parameter.h"
#include "main/snort_types.h"
+namespace snort
+{
struct SfCidr;
struct SfIp;
std::stringstream* ss;
const Parameter* param;
};
-
+}
#endif
p = (HashFnc*)snort_calloc(sizeof(*p));
- if ( SnortConfig::static_hash() )
+ if ( snort::SnortConfig::static_hash() )
{
p->seed = 3193;
p->scale = 719;
#include <CppUTest/CommandLineTestRunner.h>
#include <CppUTest/TestHarness.h>
+using namespace snort;
+
// Stubs whose sole purpose is to make the test code link
static SnortConfig my_config;
THREAD_LOCAL SnortConfig *snort_conf = &my_config;
static void dirty_handler(int signal)
{
- SnortConfig::get_conf()->dirty_pig = true;
+ snort::SnortConfig::get_conf()->dirty_pig = true;
exit_handler(signal);
}
{
// FIXIT-L what should we capture if this is the main thread?
if ( !is_main_thread )
- Snort::capture_packet();
+ snort::Snort::capture_packet();
add_signal(signal, SIG_DFL, false);
raise(signal);
if ( errno )
FatalError("failed to setsid - %s", get_error(errno));
- if ( SnortConfig::log_quiet() or SnortConfig::log_syslog() )
+ if ( snort::SnortConfig::log_quiet() or snort::SnortConfig::log_syslog() )
snuff_stdio();
pid_t ppid = getppid();
#include "host_cache.h"
+using namespace snort;
+
#define LRU_CACHE_INITIAL_SIZE 65535
LruCacheShared<HostIpKey, std::shared_ptr<HostTracker>, HashHostIpKey>
host_cache.insert((const uint8_t*) ht->get_ip_addr().get_ip6_ptr(), sptr);
}
+namespace snort
+{
bool host_cache_add_service(const SfIp& ipaddr, Protocol ipproto, Port port, const char* /*service*/)
{
HostIpKey ipkey((const uint8_t*) ipaddr.get_ip6_ptr());
return ht->add_service(app_entry);
}
-
+}
void host_cache_add_host_tracker(HostTracker*);
+namespace snort
+{
// Insert a new service into host cache if it doesn't already exist.
SO_PUBLIC bool host_cache_add_service(const SfIp&, Protocol, Port, const char* service);
-
+}
#endif
#include "host_cache.h"
+using namespace snort;
+
const Parameter HostCacheModule::host_cache_params[] =
{
{ "size", Parameter::PT_INT, nullptr, nullptr,
#define host_cache_help \
"configure hosts"
-class HostCacheModule : public Module
+class HostCacheModule : public snort::Module
{
public:
- HostCacheModule() : Module("host_cache", host_cache_help, host_cache_params, true)
+ HostCacheModule() : snort::Module("host_cache", host_cache_help, host_cache_params, true)
{
}
- bool begin(const char*, int, SnortConfig*) override;
- bool end(const char*, int, SnortConfig*) override;
- bool set(const char*, Value&, SnortConfig*) override;
+ bool begin(const char*, int, snort::SnortConfig*) override;
+ bool end(const char*, int, snort::SnortConfig*) override;
+ bool set(const char*, snort::Value&, snort::SnortConfig*) override;
const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
{ return GLOBAL; }
private:
- static const Parameter host_cache_params[];
- static const Parameter service_params[];
+ static const snort::Parameter host_cache_params[];
+ static const snort::Parameter service_params[];
uint32_t host_cache_size;
};
// shared object are safe.
// FIXIT-M do we need to use a host_id instead of SfIp as in sfrna?
- SfIp ip_addr;
+ snort::SfIp ip_addr;
// Policies to apply to this host.
Policy stream_policy = 0;
memset(&ip_addr, 0, sizeof(ip_addr));
}
- SfIp get_ip_addr()
+ snort::SfIp get_ip_addr()
{
std::lock_guard<std::mutex> lck(host_tracker_lock);
return ip_addr;
}
- void set_ip_addr(const SfIp& new_ip_addr)
+ void set_ip_addr(const snort::SfIp& new_ip_addr)
{
std::lock_guard<std::mutex> lck(host_tracker_lock);
std::memcpy(&ip_addr, &new_ip_addr, sizeof(ip_addr));
#include "host_cache.h"
+using namespace snort;
+
const PegInfo host_tracker_pegs[] =
{
{ CountType::SUM, "service_adds", "host service adds" },
#define host_tracker_help \
"configure hosts"
-class HostTrackerModule : public Module
+class HostTrackerModule : public snort::Module
{
public:
- HostTrackerModule() : Module("host_tracker", host_tracker_help, host_tracker_params, true)
+ HostTrackerModule() : snort::Module("host_tracker", host_tracker_help, host_tracker_params, true)
{ host = nullptr; }
~HostTrackerModule() override
const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
- bool set(const char*, Value&, SnortConfig*) override;
- bool begin(const char*, int, SnortConfig*) override;
- bool end(const char*, int, SnortConfig*) override;
+ bool set(const char*, snort::Value&, snort::SnortConfig*) override;
+ bool begin(const char*, int, snort::SnortConfig*) override;
+ bool end(const char*, int, snort::SnortConfig*) override;
Usage get_usage() const override
{ return GLOBAL; }
private:
- static const Parameter host_tracker_params[];
- static const Parameter service_params[];
+ static const snort::Parameter host_tracker_params[];
+ static const snort::Parameter service_params[];
HostApplicationEntry app;
HostTracker* host;
#include "sfip/sf_ip.h"
+using namespace snort;
+
// Fake AddProtocolReference to avoid bringing in a ton of dependencies.
int16_t AddProtocolReference(const char* protocol)
{
#include <CppUTest/CommandLineTestRunner.h>
#include <CppUTest/TestHarness.h>
+using namespace snort;
+
// Fake AddProtocolReference to avoid bringing in a ton of dependencies.
int16_t AddProtocolReference(const char* protocol)
{
#include <CppUTest/CommandLineTestRunner.h>
#include <CppUTest/TestHarness.h>
+using namespace snort;
+
// Fake to avoid bringing in a ton of dependencies.
int16_t ProtocolReference::add(const char* protocol)
{
#include <CppUTest/CommandLineTestRunner.h>
#include <CppUTest/TestHarness.h>
+using namespace snort;
+
// Fake snort_strdup() because sfutil dependencies suck
char* snort_strdup(const char* str)
{
** @retval ASN1_ERR_MEM_ALLOC memory allocation failed
** @retval ASN1_ERR_INVALID_ARG invalid argument
*/
-void asn1_init_mem(SnortConfig* sc)
+void asn1_init_mem(snort::SnortConfig* sc)
{
int num_nodes;
** @return none
**
*/
-void asn1_free_mem(SnortConfig*)
+void asn1_free_mem(snort::SnortConfig*)
{
if (asn1_config.mem != nullptr)
{
int num_nodes;
};
+namespace snort
+{
struct SnortConfig;
+}
/*
** Error Codes
#define ASN1_ERR_INVALID_ARG (-7)
#define ASN1_ERR_STACK (-8)
-void asn1_init_mem(SnortConfig*);
-void asn1_free_mem(SnortConfig*);
+void asn1_init_mem(snort::SnortConfig*);
+void asn1_free_mem(snort::SnortConfig*);
int asn1_decode(const unsigned char* data, unsigned int len, ASN1_TYPE** asn1_type);
int asn1_print_types(ASN1_TYPE* asn1_type, void* user);
int asn1_traverse(ASN1_TYPE* asn1, void* user,
#include "protocols/packet.h"
#include "protocols/tcp.h"
+using namespace snort;
+
#define s_name "ack"
#define s_help \
#include "asn1_detect.h"
#include "asn1_util.h"
+using namespace snort;
+
#define BITSTRING_OPT "bitstring_overflow"
#define DOUBLE_OPT "double_overflow"
#define PRINT_OPT "print"
#include "profiler/profiler.h"
#include "utils/util_unfold.h"
+using namespace snort;
+
static THREAD_LOCAL uint8_t base64_decode_buf[DECODE_BLEN];
static THREAD_LOCAL uint32_t base64_decode_size;
#include "hash/hashfcn.h"
#include "profiler/profiler.h"
+using namespace snort;
+
#define s_name "bufferlen"
#define s_help \
#include "extract.h"
+using namespace snort;
+
static THREAD_LOCAL ProfileStats byteExtractPerfStats;
#define s_name "byte_extract"
#include "extract.h"
+using namespace snort;
using namespace std;
static THREAD_LOCAL ProfileStats byteJumpPerfStats;
#include "extract.h"
+using namespace snort;
using namespace std;
#define s_name "byte_math"
#include "extract.h"
+using namespace snort;
using namespace std;
#define PARSELEN 10
#include "framework/ips_option.h"
#include "framework/module.h"
+using namespace snort;
+
#define s_name "classtype"
//-------------------------------------------------------------------------
#include "extract.h"
+using namespace snort;
+
#define MAX_PATTERN_SIZE 2048
#define s_name "content"
#include "profiler/profiler.h"
#include "protocols/packet.h"
+using namespace snort;
+
static THREAD_LOCAL ProfileStats cvsPerfStats;
#define s_name "cvs"
#include "framework/module.h"
#include "main/snort_config.h"
+using namespace snort;
+
#define s_name "detection_filter"
//-------------------------------------------------------------------------
#include "profiler/profiler.h"
#include "protocols/packet.h"
+using namespace snort;
+
#define s_name "dsize"
static THREAD_LOCAL ProfileStats dsizePerfStats;
#include "framework/module.h"
#include "profiler/profiler.h"
+using namespace snort;
+
#define s_name "file_data"
static THREAD_LOCAL ProfileStats fileDataPerfStats;
#include "profiler/profiler.h"
#include "protocols/packet.h"
+using namespace snort;
+
typedef std::bitset<FILE_ID_MAX> TypeBitSet;
#define s_name "file_type"
#include "protocols/packet.h"
#include "protocols/tcp.h"
+using namespace snort;
+
#define M_NORMAL 0
#define M_ALL 1
#define M_ANY 2
#include "protocols/packet.h"
#include "target_based/snort_protocols.h"
+using namespace snort;
+
#define s_name "flow"
static THREAD_LOCAL ProfileStats flowCheckPerfStats;
#include "utils/sflsq.h"
#include "utils/util.h"
+using namespace snort;
using namespace std;
#define s_name "flowbits"
#include "profiler/profiler.h"
#include "protocols/packet.h"
+using namespace snort;
+
static THREAD_LOCAL ProfileStats fragBitsPerfStats;
// this class holds the logic for setting up the fragment test
#include "profiler/profiler.h"
#include "protocols/packet.h"
+using namespace snort;
+
#define s_name "fragoffset"
static THREAD_LOCAL ProfileStats fragOffsetPerfStats;
#include "framework/ips_option.h"
#include "framework/module.h"
+using namespace snort;
+
#define s_name "gid"
//-------------------------------------------------------------------------
#include "extract.h"
+using namespace snort;
+
enum HashPsIdx
{
HPI_MD5, HPI_SHA256, HPI_SHA512, HPI_MAX
#include "protocols/icmp6.h"
#include "protocols/packet.h"
+using namespace snort;
+
#define s_name "icmp_id"
static THREAD_LOCAL ProfileStats icmpIdPerfStats;
#include "protocols/icmp6.h"
#include "protocols/packet.h"
+using namespace snort;
+
#define s_name "icmp_seq"
static THREAD_LOCAL ProfileStats icmpSeqPerfStats;
#include "protocols/icmp4.h"
#include "protocols/packet.h"
+using namespace snort;
+
#define s_name "icode"
static THREAD_LOCAL ProfileStats icmpCodePerfStats;
#include "profiler/profiler.h"
#include "protocols/packet.h"
+using namespace snort;
+
#define s_name "id"
static THREAD_LOCAL ProfileStats ipIdPerfStats;
#include "protocols/packet.h"
#include "utils/util_cstring.h"
+using namespace snort;
+
#define s_name "ip_proto"
static THREAD_LOCAL ProfileStats ipProtoPerfStats;
#include "protocols/ipv4_options.h"
#include "protocols/packet.h"
+using namespace snort;
+
#define s_name "ipopts"
static THREAD_LOCAL ProfileStats ipOptionPerfStats;
#include "extract.h"
+using namespace snort;
+
#define s_name "isdataat"
static THREAD_LOCAL ProfileStats isDataAtPerfStats;
#include "protocols/icmp4.h"
#include "protocols/packet.h"
+using namespace snort;
+
#define s_name "itype"
static THREAD_LOCAL ProfileStats icmpTypePerfStats;
#include "profiler/profiler.h"
#include "utils/util.h"
+using namespace snort;
+
static THREAD_LOCAL ProfileStats luaIpsPerfStats;
#define opt_eval "eval"
#include "framework/ips_option.h"
#include "framework/module.h"
+using namespace snort;
using namespace std;
#define s_name "metadata"
#include "framework/module.h"
#include "utils/util.h"
+using namespace snort;
+
#define s_name "msg"
//-------------------------------------------------------------------------
#include "managers/plugin_manager.h"
+using namespace snort;
+
extern const BaseApi* ips_classtype;
extern const BaseApi* ips_content;
extern const BaseApi* ips_detection_filter;
#include "profiler/profiler.h"
#include "utils/util.h"
+using namespace snort;
+
#ifndef PCRE_STUDY_JIT_COMPILE
#define PCRE_STUDY_JIT_COMPILE 0
#endif
#ifndef IPS_PCRE_H
#define IPS_PCRE_H
+namespace snort
+{
struct SnortConfig;
-void pcre_setup(SnortConfig*);
-void pcre_cleanup(SnortConfig*);
+}
+
+void pcre_setup(snort::SnortConfig*);
+void pcre_cleanup(snort::SnortConfig*);
#endif
#include "profiler/profiler.h"
#include "protocols/packet.h"
+using namespace snort;
+
#define s_name "pkt_data"
static THREAD_LOCAL ProfileStats pktDataPerfStats;
#include "framework/ips_option.h"
#include "framework/module.h"
+using namespace snort;
+
#define s_name "priority"
//-------------------------------------------------------------------------
#include "profiler/profiler.h"
#include "protocols/packet.h"
+using namespace snort;
+
#define s_name "raw_data"
static THREAD_LOCAL ProfileStats rawDataPerfStats;
#include "framework/module.h"
#include "main/snort_config.h"
+using namespace snort;
+
#define s_name "reference"
//-------------------------------------------------------------------------
#include "main/snort_config.h"
#include "profiler/profiler.h"
+using namespace snort;
+
#define s_name "regex"
#define s_help \
#ifndef IPS_REGEX_H
#define IPS_REGEX_H
+namespace snort
+{
struct SnortConfig;
-void regex_setup(SnortConfig*);
-void regex_cleanup(SnortConfig*);
+}
+
+void regex_setup(snort::SnortConfig*);
+void regex_cleanup(snort::SnortConfig*);
#endif
#include "framework/ips_option.h"
#include "framework/module.h"
+using namespace snort;
+
#define s_name "rem"
//-------------------------------------------------------------------------
#include "profiler/profiler.h"
#include "protocols/packet.h"
+using namespace snort;
using namespace std;
static void replace_parse(const char* args, string& s)
#include "framework/ips_option.h"
#include "framework/module.h"
+using namespace snort;
+
#define s_name "rev"
//-------------------------------------------------------------------------
#include "profiler/profiler.h"
#include "protocols/packet.h"
+using namespace snort;
+
#define s_name "rpc"
static THREAD_LOCAL ProfileStats rpcCheckPerfStats;
#include "sd_credit_card.h"
+using namespace snort;
+
#define s_name "sd_pattern"
#define s_help "rule option for detecting sensitive data"
#ifndef IPS_SD_PATTERN_H
#define IPS_SD_PATTERN_H
+namespace snort
+{
struct SnortConfig;
-void sdpattern_setup(SnortConfig*);
-void sdpattern_cleanup(SnortConfig*);
+}
+
+void sdpattern_setup(snort::SnortConfig*);
+void sdpattern_cleanup(snort::SnortConfig*);
#endif
#include "protocols/packet.h"
#include "protocols/tcp.h"
+using namespace snort;
+
#define s_name "seq"
static THREAD_LOCAL ProfileStats tcpSeqPerfStats;
#include "log/messages.h"
#include "parser/parse_conf.h"
+using namespace snort;
using namespace std;
#define s_name "service"
#include "utils/util.h"
#include "utils/util_cstring.h"
+using namespace snort;
+
#define s_name "session"
static THREAD_LOCAL ProfileStats sessionPerfStats;
#include "framework/ips_option.h"
#include "framework/module.h"
+using namespace snort;
+
#define s_name "sid"
//-------------------------------------------------------------------------
#include "managers/so_manager.h"
#include "profiler/profiler.h"
+using namespace snort;
using namespace std;
#define s_name "so"
#include "framework/module.h"
#include "utils/util.h"
+using namespace snort;
+
#define s_name "soid"
//-------------------------------------------------------------------------
#include "framework/module.h"
#include "utils/util.h"
+using namespace snort;
+
#define s_name "tag"
//-------------------------------------------------------------------------
#include "framework/ips_option.h"
#include "framework/module.h"
+using namespace snort;
+
#define s_name "target"
//-------------------------------------------------------------------------
#include "profiler/profiler.h"
#include "protocols/packet.h"
+using namespace snort;
+
#define s_name "tos"
static THREAD_LOCAL ProfileStats ipTosPerfStats;
#include "profiler/profiler.h"
#include "protocols/packet.h"
+using namespace snort;
+
#define s_name "ttl"
static THREAD_LOCAL ProfileStats ttlCheckPerfStats;
#include "protocols/packet.h"
#include "protocols/tcp.h"
+using namespace snort;
+
#define s_name "window"
static THREAD_LOCAL ProfileStats tcpWinPerfStats;
#include <CppUTest/CommandLineTestRunner.h>
#include <CppUTest/TestHarness.h>
+using namespace snort;
+
//-------------------------------------------------------------------------
// stubs, spies, etc.
//-------------------------------------------------------------------------
void mix_str(uint32_t& a, uint32_t&, uint32_t&, const char* s, unsigned)
{ a += strlen(s); }
-Packet::Packet(bool) { }
-Packet::~Packet() { }
-
-Cursor::Cursor(Packet* p)
-{ set("pkt_data", p->data, p->dsize); }
-
-static unsigned s_parse_errors = 0;
-
-void ParseError(const char*, ...)
-{ s_parse_errors++; }
-
+namespace snort
+{
SnortConfig s_conf;
THREAD_LOCAL SnortConfig* snort_conf = &s_conf;
SnortConfig* SnortConfig::get_conf()
{ return snort_conf; }
+Packet::Packet(bool) { }
+Packet::~Packet() { }
+}
+
+Cursor::Cursor(Packet* p)
+{ set("pkt_data", p->data, p->dsize); }
+
+static unsigned s_parse_errors = 0;
+
+void ParseError(const char*, ...)
+{ s_parse_errors++; }
+
+
unsigned get_instance_id()
{ return 0; }
#include "latency_rules.h"
#include "latency_stats.h"
+using namespace snort;
+
// -----------------------------------------------------------------------------
// latency attributes
// -----------------------------------------------------------------------------
#include "framework/module.h"
-class LatencyModule : public Module
+class LatencyModule : public snort::Module
{
public:
LatencyModule();
- bool set(const char*, Value&, SnortConfig*) override;
+ bool set(const char*, snort::Value&, snort::SnortConfig*) override;
- const RuleMap* get_rules() const override;
+ const snort::RuleMap* get_rules() const override;
unsigned get_gid() const override;
const PegInfo* get_pegs() const override;
#include "catch/snort_catch.h"
#endif
+using namespace snort;
+
static THREAD_LOCAL uint64_t elapsed = 0;
namespace packet_latency
#ifndef PACKET_LATENCY_H
#define PACKET_LATENCY_H
+namespace snort
+{
struct Packet;
+}
class PacketLatency
{
public:
static void push();
- static void pop(const Packet*);
+ static void pop(const snort::Packet*);
static bool fastpath();
static void tterm();
class Context
{
public:
- Context(const Packet* p) : p(p) { PacketLatency::push(); }
+ Context(const snort::Packet* p) : p(p) { PacketLatency::push(); }
~Context() { PacketLatency::pop(p); }
private:
- const Packet* p;
+ const snort::Packet* p;
};
};
#include "main/thread_config.h"
#endif
+using namespace snort;
+
namespace rule_latency
{
// -----------------------------------------------------------------------------
#define RULE_LATENCY_H
struct detection_option_tree_root_t;
+namespace snort
+{
struct Packet;
+}
class RuleLatency
{
public:
- static void push(detection_option_tree_root_t*, Packet*);
+ static void push(detection_option_tree_root_t*, snort::Packet*);
static void pop();
static bool suspended();
class Context
{
public:
- Context(detection_option_tree_root_t* root, Packet* p)
+ Context(detection_option_tree_root_t* root, snort::Packet* p)
{ RuleLatency::push(root, p); }
~Context()
#include "log_text.h"
#include "messages.h"
+using namespace snort;
+
#define DEFAULT_DAEMON_ALERT_FILE "alert"
-/* Input is packet and an nine-byte (including NULL) character array. Results
- * are put into the character array.
- */
+namespace snort
+{
+// Input is packet and an nine-byte (including NULL) character array. Results
+// are put into the character array.
void CreateTCPFlagString(const tcp::TCPHdr* const tcph, char* flagBuffer)
{
/* parse TCP flags */
*flagBuffer++ = (char)((tcph->th_flags & TH_FIN) ? 'F' : '*');
*flagBuffer = '\0';
}
+}
/****************************************************************************
*
#include "main/snort_types.h"
-struct Packet;
+namespace snort
+{
namespace tcp { struct TCPHdr; }
+struct Packet;
SO_PUBLIC void CreateTCPFlagString(const tcp::TCPHdr* const, char*);
+}
FILE* OpenAlertFile(const char*);
int RollAlertFile(const char*);
void OpenLogger();
void CloseLogger();
-void LogIPPkt(Packet*);
-void LogFlow(Packet*);
-void LogNetData(const uint8_t* data, const int len, Packet*);
+void LogIPPkt(snort::Packet*);
+void LogFlow(snort::Packet*);
+void LogNetData(const uint8_t* data, const int len, snort::Packet*);
#endif
#include "messages.h"
#include "obfuscator.h"
+namespace snort
+{
/*--------------------------------------------------------------------
* utility functions
*--------------------------------------------------------------------
TextLog_NewLine(log);
}
-void LogIpOptions(TextLog* log, const IP4Hdr* ip4h, uint16_t valid_ip4_len)
+void LogIpOptions(TextLog* log, const ip::IP4Hdr* ip4h, uint16_t valid_ip4_len)
{
const ip::IpOptionIterator options(ip4h, valid_ip4_len);
LogIpOptions(log, options);
}
-static void LogIpOptions(TextLog* log, const IP4Hdr* ip4h, const Packet* const p)
+static void LogIpOptions(TextLog* log, const ip::IP4Hdr* ip4h, const Packet* const p)
{
const ip::IpOptionIterator options(ip4h, p);
LogIpOptions(log, options);
LogNetData(log, p->pkt, p->pkth->caplen, p);
}
}
+} // namespace snort
#include "log/text_log.h"
-struct Packet;
struct Event;
+namespace snort
+{
+struct Packet;
namespace ip { struct IP4Hdr; }
namespace tcp { struct TCPHdr; }
-typedef ip::IP4Hdr IP4Hdr;
-
SO_PUBLIC void LogTimeStamp(TextLog*, Packet*);
SO_PUBLIC void LogPriorityData(TextLog*, const Event&);
SO_PUBLIC void LogXrefs(TextLog*, const Event&);
SO_PUBLIC void LogIpAddrs(TextLog*, Packet*);
SO_PUBLIC void LogIPHeader(TextLog*, Packet*);
-SO_PUBLIC void LogIpOptions(TextLog*, const IP4Hdr*, uint16_t valid_ip4_len);
+SO_PUBLIC void LogIpOptions(TextLog*, const ip::IP4Hdr*, uint16_t valid_ip4_len);
SO_PUBLIC void LogTcpOptions(TextLog*, const tcp::TCPHdr*, uint16_t valid_tcp_len);
+}
#endif
void ParseWarning(WarningGroup wg, const char* format, ...)
{
- if ( !(SnortConfig::get_conf()->warning_flags & (1 << wg)) )
+ if ( !(snort::SnortConfig::get_conf()->warning_flags & (1 << wg)) )
return;
char buf[STD_BUF+1];
static void WriteLogMessage(FILE* fh, bool prefer_fh, const char* format, va_list& ap)
{
- if ( SnortConfig::get_conf() && !prefer_fh )
+ if ( snort::SnortConfig::get_conf() && !prefer_fh )
{
- if ( SnortConfig::log_quiet() )
+ if ( snort::SnortConfig::log_quiet() )
return;
- if ( SnortConfig::log_syslog() )
+ if ( snort::SnortConfig::log_syslog() )
{
char buf[STD_BUF+1];
vsnprintf(buf, STD_BUF, format, ap);
{
va_list ap;
- if ( SnortConfig::get_conf() and SnortConfig::log_quiet() )
+ if ( snort::SnortConfig::get_conf() and snort::SnortConfig::log_quiet() )
return;
va_start(ap, format);
- if ( SnortConfig::get_conf() and SnortConfig::log_syslog() )
+ if ( snort::SnortConfig::get_conf() and snort::SnortConfig::log_syslog() )
{
char buf[STD_BUF+1];
vsnprintf(buf, STD_BUF, format, ap);
va_start(ap, format);
- if ( SnortConfig::get_conf() and SnortConfig::log_syslog() )
+ if ( snort::SnortConfig::get_conf() and snort::SnortConfig::log_syslog() )
{
char buf[STD_BUF+1];
vsnprintf(buf, STD_BUF, format, ap);
buf[STD_BUF] = '\0';
- if ( SnortConfig::get_conf() and SnortConfig::log_syslog() )
+ if ( snort::SnortConfig::get_conf() and snort::SnortConfig::log_syslog() )
{
syslog(LOG_CONS | LOG_DAEMON | LOG_ERR, "FATAL ERROR: %s", buf);
}
#include "catch/snort_catch.h"
#endif
+using namespace snort;
+
#define PACKET_TRACER_USER_ENABLED 0x00000001
#define PACKET_TRACER_DAQ_ENABLED 0x00000002
#include <daq_common.h>
-struct Packet;
+namespace snort
+{
+ struct Packet;
+}
class PacketTracer
{
static void log(const char* format, ...) __attribute__((format (printf, 1, 2)));
static void dump(char* output_buff, unsigned int len);
static void dump(const DAQ_PktHdr_t* pkthdr, DAQ_Verdict verdict);
- static void add_header_info(Packet* p);
+ static void add_header_info(snort::Packet* p);
static bool get_enable(const uint32_t mask=0);
static void enable_user_trace();
static void enable_daq_trace();
#include "protocols/protocol_ids.h"
#include "utils/util.h"
+using namespace snort;
+
static const uint8_t u2_ttl = 64;
//--------------------------------------------------------------------------
#include "main/snort_types.h"
+namespace snort
+{
struct Packet;
class SO_PUBLIC U2PseudoHeader
uint8_t buf[max_size];
} u;
};
-
+}
#endif
#include "protocols/vlan.h"
#include "utils/stats.h"
+using namespace snort;
using namespace std;
#define LOG_BUFFER (4*K_BYTES)
#include "packet_io/sfdaq.h"
#include "service_inspectors/http_inspect/http_enum.h"
+using namespace snort;
using namespace std;
/* full buf was chosen to allow printing max size packets
#include "packet_io/sfdaq.h"
#include "protocols/packet.h"
+using namespace snort;
using namespace std;
static THREAD_LOCAL TextLog* full_log = nullptr;
#include "profiler/profiler_defs.h"
#include "protocols/packet.h"
+using namespace snort;
+
static THREAD_LOCAL ProfileStats luaLogPerfStats;
static THREAD_LOCAL const Event* event;
#include "target_based/snort_protocols.h"
#include "utils/util.h"
+using namespace snort;
using namespace std;
struct SfSock
#include "utils/util_cstring.h"
#include "utils/util_net.h"
+using namespace snort;
using namespace std;
#ifndef LOG_AUTHPRIV
#include "main/snort_config.h"
#include "protocols/packet_manager.h"
+using namespace snort;
+
static THREAD_LOCAL TextLog* test_file = nullptr;
#define S_NAME "log_codecs"
#include "log/text_log.h"
#include "protocols/packet.h"
+using namespace snort;
using namespace std;
#define S_NAME "log_hext"
#include "packet_io/sfdaq.h"
#include "utils/util.h"
+using namespace snort;
using namespace std;
/*
#include "managers/plugin_manager.h"
+using namespace snort;
+
// to ensure PacketManager::log_protocols() is built into Snort++
extern const BaseApi* log_codecs[];
#include "utils/util.h"
#include "utils/util_cstring.h"
+using namespace snort;
using namespace std;
#define S_NAME "unified2"
//-------------------------------------------------------------------------
+using namespace snort;
+
static bool exit_requested = false;
static int main_exit_code = 0;
static bool paused = false;
// main commands
//-------------------------------------------------------------------------
-void main_broadcast_command(AnalyzerCommand* ac)
+void snort::main_broadcast_command(AnalyzerCommand* ac)
{
unsigned dispatched = 0;
#include "snort_debug.h"
#include "thread.h"
+using namespace snort;
using namespace std;
typedef DAQ_Verdict
#include <string>
class AnalyzerCommand;
-class SFDAQInstance;
class Swapper;
+namespace snort
+{
+class SFDAQInstance;
+}
+
class Analyzer
{
public:
bool exit_requested;
std::string source;
- SFDAQInstance* daq_instance;
+ snort::SFDAQInstance* daq_instance;
std::mutex pending_work_queue_mutex;
};
void ACRotate::execute(Analyzer&)
{
- Snort::thread_rotate();
+ snort::Snort::thread_rotate();
}
void ACGetStats::execute(Analyzer&)
// FIXIT-P This incurs locking on all threads to retrieve stats. It could be reimplemented to
// optimize for large thread counts by retrieving stats in the command and accumulating in the
// main thread.
- ModuleManager::accumulate(SnortConfig::get_conf());
+ ModuleManager::accumulate(snort::SnortConfig::get_conf());
}
ACGetStats::~ACGetStats()
~ACDAQSwap() override;
};
+namespace snort
+{
SO_PUBLIC void main_broadcast_command(AnalyzerCommand* ac); // From main.cc
+}
#endif
void configure() const;
int shell_execute(int& current_fd, Request*& current_request);
bool show_prompt() const;
+
private:
int fd;
bool blocked = false;
int ControlMgmt::setup_socket_family()
{
int family = AF_UNSPEC;
- if ( SnortConfig::get_conf()->remote_control_port )
+ if ( snort::SnortConfig::get_conf()->remote_control_port )
{
memset(&in_addr, 0, sizeof(in_addr));
in_addr.sin_family = AF_INET;
in_addr.sin_addr.s_addr = htonl(0x7F000001);
- in_addr.sin_port = htons(SnortConfig::get_conf()->remote_control_port);
+ in_addr.sin_port = htons(snort::SnortConfig::get_conf()->remote_control_port);
sock_addr = (struct sockaddr*)&in_addr;
sock_addr_size = sizeof(in_addr);
family = AF_INET;
}
- else if ( !SnortConfig::get_conf()->remote_control_socket.empty() )
+ else if ( !snort::SnortConfig::get_conf()->remote_control_socket.empty() )
{
std::string fullpath;
- const char* path_sep = strrchr(SnortConfig::get_conf()->remote_control_socket.c_str(), '/');
+ const char* path_sep = strrchr(snort::SnortConfig::get_conf()->remote_control_socket.c_str(), '/');
if (path_sep != nullptr)
- fullpath = SnortConfig::get_conf()->remote_control_socket;
+ fullpath = snort::SnortConfig::get_conf()->remote_control_socket;
else
- get_instance_file(fullpath, SnortConfig::get_conf()->remote_control_socket.c_str());
+ get_instance_file(fullpath, snort::SnortConfig::get_conf()->remote_control_socket.c_str());
memset(&unix_addr, 0, sizeof(unix_addr));
unix_addr.sun_family = AF_UNIX;
#include "snort_config.h"
#include "snort_module.h"
+using namespace snort;
using namespace std;
#define snort_help \
// utility methods that provide output modes other than the normal packet
// processing. these are called based on command line arguments.
+namespace snort
+{
struct SnortConfig;
+}
-void config_markup(SnortConfig*, const char*);
+void config_markup(snort::SnortConfig*, const char*);
void help_args(const char* pfx);
-[[noreturn]] void help_basic(SnortConfig*, const char*);
-[[noreturn]] void help_usage(SnortConfig*, const char*);
-[[noreturn]] void help_options(SnortConfig*, const char*);
-[[noreturn]] void help_signals(SnortConfig*, const char*);
-[[noreturn]] void help_config(SnortConfig* sc, const char*);
-[[noreturn]] void help_commands(SnortConfig* sc, const char*);
-[[noreturn]] void help_gids(SnortConfig* sc, const char*);
-[[noreturn]] void help_buffers(SnortConfig* sc, const char*);
-[[noreturn]] void help_builtin(SnortConfig* sc, const char*);
-[[noreturn]] void help_module(SnortConfig* sc, const char*);
-[[noreturn]] void help_modules(SnortConfig* sc, const char*);
-[[noreturn]] void help_plugins(SnortConfig* sc, const char*);
-[[noreturn]] void help_version(SnortConfig*);
-[[noreturn]] void help_counts(SnortConfig* sc, const char*);
-
-[[noreturn]] void list_modules(SnortConfig* sc, const char*);
-[[noreturn]] void list_plugins(SnortConfig* sc, const char*);
-[[noreturn]] void list_interfaces(SnortConfig*);
-[[noreturn]] void list_daqs(SnortConfig* sc);
-
-[[noreturn]] void dump_defaults(SnortConfig* sc, const char*);
-[[noreturn]] void dump_builtin_rules(SnortConfig* sc, const char*);
-[[noreturn]] void dump_dynamic_rules(SnortConfig* sc, const char*);
-[[noreturn]] void dump_msg_map(SnortConfig* sc, const char*);
-[[noreturn]] void dump_rule_hex(SnortConfig* sc, const char*);
-[[noreturn]] void dump_rule_text(SnortConfig* sc, const char*);
-[[noreturn]] void dump_version(SnortConfig* sc);
+[[noreturn]] void help_basic(snort::SnortConfig*, const char*);
+[[noreturn]] void help_usage(snort::SnortConfig*, const char*);
+[[noreturn]] void help_options(snort::SnortConfig*, const char*);
+[[noreturn]] void help_signals(snort::SnortConfig*, const char*);
+[[noreturn]] void help_config(snort::SnortConfig* sc, const char*);
+[[noreturn]] void help_commands(snort::SnortConfig* sc, const char*);
+[[noreturn]] void help_gids(snort::SnortConfig* sc, const char*);
+[[noreturn]] void help_buffers(snort::SnortConfig* sc, const char*);
+[[noreturn]] void help_builtin(snort::SnortConfig* sc, const char*);
+[[noreturn]] void help_module(snort::SnortConfig* sc, const char*);
+[[noreturn]] void help_modules(snort::SnortConfig* sc, const char*);
+[[noreturn]] void help_plugins(snort::SnortConfig* sc, const char*);
+[[noreturn]] void help_version(snort::SnortConfig*);
+[[noreturn]] void help_counts(snort::SnortConfig* sc, const char*);
+
+[[noreturn]] void list_modules(snort::SnortConfig* sc, const char*);
+[[noreturn]] void list_plugins(snort::SnortConfig* sc, const char*);
+[[noreturn]] void list_interfaces(snort::SnortConfig*);
+[[noreturn]] void list_daqs(snort::SnortConfig* sc);
+
+[[noreturn]] void dump_defaults(snort::SnortConfig* sc, const char*);
+[[noreturn]] void dump_builtin_rules(snort::SnortConfig* sc, const char*);
+[[noreturn]] void dump_dynamic_rules(snort::SnortConfig* sc, const char*);
+[[noreturn]] void dump_msg_map(snort::SnortConfig* sc, const char*);
+[[noreturn]] void dump_rule_hex(snort::SnortConfig* sc, const char*);
+[[noreturn]] void dump_rule_text(snort::SnortConfig* sc, const char*);
+[[noreturn]] void dump_version(snort::SnortConfig* sc);
#endif
#include "snort_module.h"
#include "thread_config.h"
+using namespace snort;
using namespace std;
//-------------------------------------------------------------------------
bool NetworkModule::set(const char*, Value& v, SnortConfig* sc)
{
- NetworkPolicy* p = get_network_policy();
+ NetworkPolicy* p = snort::get_network_policy();
if ( v.is("checksum_drop") )
ConfigChecksumDrop(v.get_string());
bool InspectionModule::set(const char*, Value& v, SnortConfig* sc)
{
- InspectionPolicy* p = get_inspection_policy();
+ InspectionPolicy* p = snort::get_inspection_policy();
if ( v.is("id") )
{
#define ips_help \
"configure IPS rule processing"
-THREAD_LOCAL IpsModuleStats ips_module_stats;
+THREAD_LOCAL IpsModuleStats snort::ips_module_stats;
const PegInfo ips_module_pegs[] =
{
{ return ips_module_pegs; }
PegCount* get_counts() const override
- { return (PegCount*) &ips_module_stats; }
+ { return (PegCount*) &snort::ips_module_stats; }
Usage get_usage() const override
{ return DETECT; }
bool IpsModule::set(const char*, Value& v, SnortConfig* sc)
{
- IpsPolicy* p = get_ips_policy();
+ IpsPolicy* p = snort::get_ips_policy();
if ( v.is("enable_builtin_rules") )
p->enable_builtin_rules = v.get_bool();
PegCount invalid_policy_ids;
};
+namespace snort
+{
SO_PUBLIC extern THREAD_LOCAL IpsModuleStats ips_module_stats;
+}
#endif
#include "shell.h"
#include "snort_config.h"
+using namespace snort;
+
//-------------------------------------------------------------------------
// traffic policy
//-------------------------------------------------------------------------
static THREAD_LOCAL InspectionPolicy* s_inspection_policy = nullptr;
static THREAD_LOCAL IpsPolicy* s_detection_policy = nullptr;
+namespace snort
+{
NetworkPolicy* get_network_policy()
{ return s_traffic_policy; }
InspectionPolicy* get_default_inspection_policy(SnortConfig* sc)
{ return sc->policy_map->get_inspection_policy(0); }
+void set_user_ips_policy(unsigned policy_id)
+{
+ IpsPolicy *p = SnortConfig::get_conf()->policy_map->get_user_ips(policy_id);
+ if(!p)
+ {
+ snort::ips_module_stats.invalid_policy_ids++;
+ return;
+ }
+
+ s_detection_policy = p;
+}
+} // namespace snort
+
void set_network_policy(NetworkPolicy* p)
{ s_traffic_policy = p; }
void set_ips_policy(IpsPolicy* p)
{ s_detection_policy = p; }
-void set_user_ips_policy(unsigned policy_id)
-{
- IpsPolicy *p = SnortConfig::get_conf()->policy_map->get_user_ips(policy_id);
- if(!p)
- {
- ips_module_stats.invalid_policy_ids++;
- return;
- }
-
- s_detection_policy = p;
-}
-
void set_ips_policy(SnortConfig* sc, unsigned i)
{
PolicyMap* pm = sc->policy_map;
uuid_t uuid{};
struct FrameworkPolicy* framework_policy;
- DataBus dbus;
+ snort::DataBus dbus;
bool cloned;
private:
// navigator stuff
//-------------------------------------------------------------------------
-struct SnortConfig;
// FIXIT-L may be inlined at some point; on lockdown for now
// FIXIT-L SO_PUBLIC required because SnortConfig::inline_mode(), etc. uses the function
+namespace snort
+{
+struct SnortConfig;
+
SO_PUBLIC NetworkPolicy* get_network_policy();
SO_PUBLIC InspectionPolicy* get_inspection_policy();
SO_PUBLIC IpsPolicy* get_ips_policy();
-
-SO_PUBLIC InspectionPolicy* get_default_inspection_policy(SnortConfig*);
+SO_PUBLIC InspectionPolicy* get_default_inspection_policy(snort::SnortConfig*);
+SO_PUBLIC void set_user_ips_policy(unsigned policy_id);
+}
void set_network_policy(NetworkPolicy*);
-void set_network_policy(SnortConfig*, unsigned = 0);
+void set_network_policy(snort::SnortConfig*, unsigned = 0);
void set_inspection_policy(InspectionPolicy*);
-void set_inspection_policy(SnortConfig*, unsigned = 0);
+void set_inspection_policy(snort::SnortConfig*, unsigned = 0);
void set_ips_policy(IpsPolicy*);
-SO_PUBLIC void set_user_ips_policy(unsigned policy_id);
-void set_ips_policy(SnortConfig*, unsigned = 0);
+void set_ips_policy(snort::SnortConfig*, unsigned = 0);
-void set_policies(SnortConfig*, Shell*);
+void set_policies(snort::SnortConfig*, Shell*);
void set_default_policy();
-void set_default_policy(SnortConfig*);
+void set_default_policy(snort::SnortConfig*);
bool only_inspection_policy();
bool only_ips_policy();
#include "managers/module_manager.h"
#include "parser/parser.h"
+using namespace snort;
using namespace std;
#define required "require('snort_config'); "
struct lua_State;
+namespace snort
+{
+struct SnortConfig;
+}
+
class Shell
{
public:
void set_overrides(const char*);
void set_overrides(Shell*);
- void configure(struct SnortConfig*);
+ void configure(snort::SnortConfig*);
void install(const char*, const struct luaL_Reg*);
void execute(const char*, std::string&);
#include "snort_config.h"
#include "thread_config.h"
+using namespace snort;
using namespace std;
//-------------------------------------------------------------------------
#include "main/snort_types.h"
+class ContextSwitcher;
+
+namespace snort
+{
class Flow;
struct Packet;
struct SnortConfig;
static void inspect(Packet*);
static void set_main_hook(MainHook_f);
- static class ContextSwitcher* get_switcher();
+ static ContextSwitcher* get_switcher();
SO_PUBLIC static Packet* get_packet();
static bool reloading;
static bool privileges_dropped;
};
+}
#endif
#include "snort.h"
#include "thread_config.h"
+using namespace snort;
+
#define LOG_NONE "none"
#define LOG_DUMP "dump"
#define LOG_CODECS "codecs"
output = val;
output_flags |= OUTPUT_FLAG__ALERTS;
- Snort::set_main_hook(DetectionEngine::inspect);
+ snort::Snort::set_main_hook(DetectionEngine::inspect);
}
void SnortConfig::set_log_mode(const char* val)
{
if (strcasecmp(val, LOG_NONE) == 0)
{
- Snort::set_main_hook(snort_ignore);
+ snort::Snort::set_main_hook(snort_ignore);
EventManager::enable_logs(false);
}
else
if ( !strcmp(val, LOG_DUMP) )
val = LOG_CODECS;
output = val;
- Snort::set_main_hook(snort_log);
+ snort::Snort::set_main_hook(snort_log);
}
}
TUNNEL_MPLS = 0x80
};
+struct ClassType;
struct srmm_table_t;
struct sopg_table_t;
-struct PORT_RULE_MAP;
+struct GHash;
struct XHash;
-struct ProfilerConfig;
struct MemoryConfig;
struct LatencyConfig;
+struct PORT_RULE_MAP;
+struct RuleListNode;
+struct RulePortTables;
+struct RuleState;
+struct DetectionFilterConfig;
+struct EventQueueConfig;
+class FastPatternConfig;
+struct FrameworkConfig;
+struct ThresholdConfig;
+struct RateFilterConfig;
struct SFDAQConfig;
class ThreadConfig;
+struct ReferenceSystemNode;
+class ProtocolReference;
+struct VarNode;
+struct _IntelPmHandles;
+
+namespace snort
+{
+struct ProfilerConfig;
// SnortState members are updated during runtime. an array in SnortConfig is
// used instead of thread_locals because these must get changed on reload
//------------------------------------------------------
// various modules
- class FastPatternConfig* fast_pattern_config = nullptr;
- struct EventQueueConfig* event_queue_config = nullptr;
+ FastPatternConfig* fast_pattern_config = nullptr;
+ EventQueueConfig* event_queue_config = nullptr;
/* XXX XXX policy specific? */
- struct ThresholdConfig* threshold_config = nullptr;
- struct RateFilterConfig* rate_filter_config = nullptr;
- struct DetectionFilterConfig* detection_filter_config = nullptr;
+ ThresholdConfig* threshold_config = nullptr;
+ RateFilterConfig* rate_filter_config = nullptr;
+ DetectionFilterConfig* detection_filter_config = nullptr;
//------------------------------------------------------
// FIXIT-L command line only stuff, add to conf / module
int thiszone = 0;
- struct RuleState* rule_state_list = nullptr;
- struct ClassType* classifications = nullptr;
- struct ReferenceSystemNode* references = nullptr;
- struct GHash* otn_map = nullptr;
+ RuleState* rule_state_list = nullptr;
+ ClassType* classifications = nullptr;
+ ReferenceSystemNode* references = nullptr;
+ GHash* otn_map = nullptr;
- class ProtocolReference* proto_ref = nullptr;
+ ProtocolReference* proto_ref = nullptr;
int num_rule_types = 0;
- struct RuleListNode* rule_lists = nullptr;
+ RuleListNode* rule_lists = nullptr;
int evalOrder[Actions::MAX + 1];
- struct FrameworkConfig* framework_config = nullptr;
+ FrameworkConfig* framework_config = nullptr;
/* master port list table */
- struct RulePortTables* port_tables = nullptr;
+ RulePortTables* port_tables = nullptr;
/* The port-rule-maps map the src-dst ports to rules for
* udp and tcp, for Ip we map the dst port as the protocol,
XHash* rtn_hash_table = nullptr;
PolicyMap* policy_map = nullptr;
- struct VarNode* var_list = nullptr;
+ VarNode* var_list = nullptr;
uint8_t tunnel_mask = 0;
ProfilerConfig* profiler = nullptr;
LatencyConfig* latency = nullptr;
- struct _IntelPmHandles* ipm_handles = nullptr;
+ _IntelPmHandles* ipm_handles = nullptr;
unsigned remote_control_port = 0;
std::string remote_control_socket;
{ return get_conf()->run_flags & RUN_FLAG__READ; }
static bool inline_mode()
- { return ::get_ips_policy()->policy_mode == POLICY_MODE__INLINE; }
+ { return snort::get_ips_policy()->policy_mode == POLICY_MODE__INLINE; }
static bool inline_test_mode()
- { return ::get_ips_policy()->policy_mode == POLICY_MODE__INLINE_TEST; }
+ { return snort::get_ips_policy()->policy_mode == POLICY_MODE__INLINE_TEST; }
static bool adaptor_inline_mode()
{ return get_conf()->run_flags & RUN_FLAG__INLINE; }
// checksum stuff
static bool checksum_drop(uint16_t codec_cksum_err_flag)
- { return ::get_network_policy()->checksum_drop & codec_cksum_err_flag; }
+ { return snort::get_network_policy()->checksum_drop & codec_cksum_err_flag; }
static bool ip_checksums()
- { return ::get_network_policy()->checksum_eval & CHECKSUM_FLAG__IP; }
+ { return snort::get_network_policy()->checksum_eval & CHECKSUM_FLAG__IP; }
static bool ip_checksum_drops()
- { return ::get_network_policy()->checksum_drop & CHECKSUM_FLAG__IP; }
+ { return snort::get_network_policy()->checksum_drop & CHECKSUM_FLAG__IP; }
static bool udp_checksums()
- { return ::get_network_policy()->checksum_eval & CHECKSUM_FLAG__UDP; }
+ { return snort::get_network_policy()->checksum_eval & CHECKSUM_FLAG__UDP; }
static bool udp_checksum_drops()
- { return ::get_network_policy()->checksum_drop & CHECKSUM_FLAG__UDP; }
+ { return snort::get_network_policy()->checksum_drop & CHECKSUM_FLAG__UDP; }
static bool tcp_checksums()
- { return ::get_network_policy()->checksum_eval & CHECKSUM_FLAG__TCP; }
+ { return snort::get_network_policy()->checksum_eval & CHECKSUM_FLAG__TCP; }
static bool tcp_checksum_drops()
- { return ::get_network_policy()->checksum_drop & CHECKSUM_FLAG__TCP; }
+ { return snort::get_network_policy()->checksum_drop & CHECKSUM_FLAG__TCP; }
static bool icmp_checksums()
- { return ::get_network_policy()->checksum_eval & CHECKSUM_FLAG__ICMP; }
+ { return snort::get_network_policy()->checksum_eval & CHECKSUM_FLAG__ICMP; }
static bool icmp_checksum_drops()
- { return ::get_network_policy()->checksum_drop & CHECKSUM_FLAG__ICMP; }
+ { return snort::get_network_policy()->checksum_drop & CHECKSUM_FLAG__ICMP; }
// output stuff
static bool output_include_year()
// other stuff
static uint8_t min_ttl()
- { return ::get_network_policy()->min_ttl; }
+ { return snort::get_network_policy()->min_ttl; }
static uint8_t new_ttl()
- { return ::get_network_policy()->new_ttl; }
+ { return snort::get_network_policy()->new_ttl; }
static long int get_pcre_match_limit()
{ return get_conf()->pcre_match_limit; }
// Use this to access current thread's conf from other units
static void set_conf(SnortConfig*);
+
SO_PUBLIC static SnortConfig* get_conf();
};
+}
#endif
va_list ap;
va_start(ap, fmt);
- if ( SnortConfig::get_conf() and SnortConfig::log_syslog() )
+ if ( snort::SnortConfig::get_conf() and snort::SnortConfig::log_syslog() )
{
char buf[STD_BUF];
int buf_len = sizeof(buf);
vsnprintf(buf_ptr, buf_len, fmt, ap);
- if ( SnortConfig::get_conf() and SnortConfig::log_syslog() )
+ if ( snort::SnortConfig::get_conf() and snort::SnortConfig::log_syslog() )
syslog(LOG_DAEMON | LOG_DEBUG, "%s", buf);
else
output(buf, stdout);
#include "snort_config.h"
#include "thread_config.h"
+using namespace snort;
using namespace std;
//-------------------------------------------------------------------------
// the snort module is for handling command line args,
// shell commands, and basic application stats
-class Module* get_snort_module();
+namespace snort
+{
+class Module;
+}
+
+snort::Module* get_snort_module();
#endif
#include "snort_config.h"
+using namespace snort;
+
bool Swapper::reload_in_progress = false;
Swapper::Swapper(SnortConfig* s, tTargetBasedConfig* t)
void Swapper::apply()
{
if ( new_conf )
- SnortConfig::set_conf(new_conf);
+ snort::SnortConfig::set_conf(new_conf);
if ( new_attribs )
SFAT_SetConfig(new_attribs);
// used to make thread local, pointer-based config swaps by packet threads
+namespace snort
+{
struct SnortConfig;
+}
+
struct tTargetBasedConfig;
class Swapper
{
public:
- Swapper(SnortConfig*, tTargetBasedConfig*);
- Swapper(SnortConfig*, SnortConfig*);
- Swapper(SnortConfig*, SnortConfig*, tTargetBasedConfig*, tTargetBasedConfig*);
+ Swapper(snort::SnortConfig*, tTargetBasedConfig*);
+ Swapper(snort::SnortConfig*, snort::SnortConfig*);
+ Swapper(snort::SnortConfig*, snort::SnortConfig*, tTargetBasedConfig*, tTargetBasedConfig*);
Swapper(tTargetBasedConfig*, tTargetBasedConfig*);
~Swapper();
static void set_reload_in_progress(bool rip) { reload_in_progress = rip; }
private:
- SnortConfig* old_conf;
- SnortConfig* new_conf;
+ snort::SnortConfig* old_conf;
+ snort::SnortConfig* new_conf;
tTargetBasedConfig* old_attribs;
tTargetBasedConfig* new_attribs;
const char* get_instance_file(std::string& file, const char* name)
{
bool sep = false;
- file = !SnortConfig::get_conf()->log_dir.empty() ? SnortConfig::get_conf()->log_dir : "./";
+ file = !snort::SnortConfig::get_conf()->log_dir.empty() ? snort::SnortConfig::get_conf()->log_dir : "./";
if ( file.back() != '/' )
file += '/';
- if ( !SnortConfig::get_conf()->run_prefix.empty() )
+ if ( !snort::SnortConfig::get_conf()->run_prefix.empty() )
{
- file += SnortConfig::get_conf()->run_prefix;
+ file += snort::SnortConfig::get_conf()->run_prefix;
sep = true;
}
- if ( (ThreadConfig::get_instance_max() > 1) || SnortConfig::get_conf()->id_zero )
+ if ( (ThreadConfig::get_instance_max() > 1) || snort::SnortConfig::get_conf()->id_zero )
{
char id[8];
- snprintf(id, sizeof(id), "%u", get_instance_id() + SnortConfig::get_conf()->id_offset);
+ snprintf(id, sizeof(id), "%u", get_instance_id() + snort::SnortConfig::get_conf()->id_offset);
file += id;
sep = true;
}
- if ( SnortConfig::get_conf()->id_subdir )
+ if ( snort::SnortConfig::get_conf()->id_subdir )
{
file += '/';
struct stat s;
#include "packet_io/active.h"
#include "parser/parser.h"
+using namespace snort;
using namespace std;
struct Actor
#include "framework/ips_action.h"
#include "framework/module.h"
-#ifdef PIGLET
-#include "framework/ips_action.h"
-#endif
-
+namespace snort
+{
struct ActionApi;
class IpsAction;
struct SnortConfig;
struct Packet;
+}
//-------------------------------------------------------------------------
#ifdef PIGLET
struct IpsActionWrapper
{
- IpsActionWrapper(const ActionApi* a, IpsAction* p) :
+ IpsActionWrapper(const snort::ActionApi* a, snort::IpsAction* p) :
api { a }, instance { p } { }
~IpsActionWrapper()
api->dtor(instance);
}
- const ActionApi* api;
- IpsAction* instance;
+ const snort::ActionApi* api;
+ snort::IpsAction* instance;
};
#endif
class ActionManager
{
public:
- static void add_plugin(const ActionApi*);
+ static void add_plugin(const snort::ActionApi*);
static void release_plugins();
static void dump_plugins();
- static Actions::Type get_action_type(const char*);
+ static snort::Actions::Type get_action_type(const char*);
- static void instantiate(const ActionApi*, Module*, SnortConfig*);
+ static void instantiate(const snort::ActionApi*, snort::Module*, snort::SnortConfig*);
- static void thread_init(SnortConfig*);
- static void thread_term(SnortConfig*);
+ static void thread_init(snort::SnortConfig*);
+ static void thread_term(snort::SnortConfig*);
static void reset_queue();
- static void queue_reject(const Packet*);
- static void queue(IpsAction*);
- static void execute(Packet*);
+ static void queue_reject(const snort::Packet*);
+ static void queue(snort::IpsAction*);
+ static void execute(snort::Packet*);
#ifdef PIGLET
- static IpsActionWrapper* instantiate(const char*, Module*);
+ static IpsActionWrapper* instantiate(const char*, snort::Module*);
#endif
};
#include "protocols/packet_manager.h"
#include "utils/dnet_header.h"
+using namespace snort;
+
struct CodecManager::CodecApiWrapper
{
const CodecApi* api;
#include "framework/codec.h"
#endif
-struct SnortConfig;
-struct CodecApi;
+namespace snort
+{
class Codec;
+struct CodecApi;
class Module;
class PacketManager;
struct ProfileStats;
+struct SnortConfig;
+}
//-------------------------------------------------------------------------
-extern THREAD_LOCAL ProfileStats decodePerfStats;
+extern THREAD_LOCAL snort::ProfileStats decodePerfStats;
#ifdef PIGLET
struct CodecWrapper
{
- CodecWrapper(const CodecApi* a, Codec* p) :
+ CodecWrapper(const snort::CodecApi* a, snort::Codec* p) :
api { a }, instance { p } { }
~CodecWrapper()
api->dtor(instance);
}
- const CodecApi* api;
- Codec* instance;
+ const snort::CodecApi* api;
+ snort::Codec* instance;
};
#endif
class CodecManager
{
public:
- friend class PacketManager;
+ friend class snort::PacketManager;
// global plugin initializer
- static void add_plugin(const struct CodecApi*);
+ static void add_plugin(const struct snort::CodecApi*);
// instantiate a specific codec with a codec specific Module
- static void instantiate(const CodecApi*, Module*, SnortConfig*);
+ static void instantiate(const snort::CodecApi*, snort::Module*, snort::SnortConfig*);
// instantiate any codec for which a module has not been provided.
static void instantiate();
// destroy all global codec related information
static void release_plugins();
// initialize the current threads DLT and Packet struct
- static void thread_init(SnortConfig*);
+ static void thread_init(snort::SnortConfig*);
// destroy thread_local data
static void thread_term();
// print all of the codec plugins
static void dump_plugins();
#ifdef PIGLET
- static CodecWrapper* instantiate(const char*, Module*, SnortConfig*);
+ static CodecWrapper* instantiate(const char*, snort::Module*, snort::SnortConfig*);
#endif
static uint8_t get_max_layers()
static std::vector<CodecApiWrapper> s_codecs;
static std::array<ProtocolIndex, num_protocol_ids> s_proto_map;
- static std::array<Codec*, UINT8_MAX> s_protocols;
+ static std::array<snort::Codec*, UINT8_MAX> s_protocols;
static THREAD_LOCAL ProtocolId grinder_id;
static THREAD_LOCAL ProtocolIndex grinder;
*/
// Private struct defined in an anonymous namespace.
- static void instantiate(CodecApiWrapper&, Module*, SnortConfig*);
- static CodecApiWrapper& get_api_wrapper(const CodecApi* cd_api);
+ static void instantiate(CodecApiWrapper&, snort::Module*, snort::SnortConfig*);
+ static CodecApiWrapper& get_api_wrapper(const snort::CodecApi* cd_api);
static uint8_t get_codec(const char* const keyword);
#ifdef PIGLET
- static const CodecApi* find_api(const char*);
+ static const snort::CodecApi* find_api(const char*);
#endif
};
#include "main/snort_debug.h"
#include "utils/util.h"
+using namespace snort;
+
// ConnectorManager Private Data
// One ConnectorElem for each Connector within the ConnectorCommon configuration
#include <string>
-struct SnortConfig;
-struct ConnectorApi;
+namespace snort
+{
class Connector;
+struct ConnectorApi;
class Module;
+struct SnortConfig;
+}
//-------------------------------------------------------------------------
class ConnectorManager
{
public:
- static void add_plugin(const ConnectorApi* api);
+ static void add_plugin(const snort::ConnectorApi* api);
static void dump_plugins();
static void release_plugins();
- static void instantiate(const ConnectorApi*, Module*, SnortConfig*);
+ static void instantiate(const snort::ConnectorApi*, snort::Module*, snort::SnortConfig*);
static void thread_init();
static void thread_term();
/* get_connector() returns the thread-specific object. */
- static Connector* get_connector(const std::string& name);
+ static snort::Connector* get_connector(const std::string& name);
};
#endif
#include "module_manager.h"
+using namespace snort;
using namespace std;
struct Output
// OutputSet is a group of Loggers that can be attached to external data.
// Also provides runtime logging.
-#include "framework/module.h"
-
-#ifdef PIGLET
#include "framework/logger.h"
-#endif
+#include "framework/module.h"
#define OUTPUT_TYPE_FLAG__NONE 0x0
#define OUTPUT_TYPE_FLAG__ALERT 0x1
#define OUTPUT_TYPE_FLAG__LOG 0x2
+namespace snort
+{
+struct LogApi;
struct Packet;
+struct SnortConfig;
+}
struct Event;
struct OutputSet;
-struct SnortConfig;
-struct LogApi;
//-------------------------------------------------------------------------
#ifdef PIGLET
struct LoggerWrapper
{
- LoggerWrapper(const LogApi* a, Logger* p) :
+ LoggerWrapper(const snort::LogApi* a, snort::Logger* p) :
api { a }, instance { p } { }
~LoggerWrapper()
api->dtor(instance);
}
- const LogApi* api;
- Logger* instance;
+ const snort::LogApi* api;
+ snort::Logger* instance;
};
#endif
class EventManager
{
public:
- static void add_plugin(const LogApi*);
+ static void add_plugin(const snort::LogApi*);
static void dump_plugins();
static void release_plugins();
- static void instantiate(const char*, SnortConfig*);
- static void instantiate(const LogApi*, Module*, SnortConfig*);
+ static void instantiate(const char*, snort::SnortConfig*);
+ static void instantiate(const snort::LogApi*, snort::Module*, snort::SnortConfig*);
static unsigned get_output_type_flags(char*);
- static void add_output(OutputSet**, class Logger*);
+ static void add_output(OutputSet**, snort::Logger*);
static void copy_outputs(OutputSet* dst, OutputSet* src);
static void release_outputs(OutputSet*);
static void open_outputs();
static void close_outputs();
- static void call_alerters(OutputSet*, Packet*, const char* message, const Event&);
- static void call_loggers(OutputSet*, Packet*, const char* message, Event*);
+ static void call_alerters(OutputSet*, snort::Packet*, const char* message, const Event&);
+ static void call_loggers(OutputSet*, snort::Packet*, const char* message, Event*);
static void enable_alerts(bool b) { alert_enabled = b; }
static void enable_logs(bool b) { log_enabled = b; }
#ifdef PIGLET
- static LoggerWrapper* instantiate(const char* name, Module*, SnortConfig*);
+ static LoggerWrapper* instantiate(const char* name, snort::Module*, snort::SnortConfig*);
#endif
private:
- static void instantiate(struct Output*, Module*, SnortConfig*);
+ static void instantiate(struct Output*, snort::Module*, snort::SnortConfig*);
static bool alert_enabled;
static bool log_enabled;
#include "module_manager.h"
+using namespace snort;
using namespace std;
// FIXIT-L define module names just once
if ( get_instance(fp, keyword, false, old_it) )
{
- if ( Snort::is_reloading() )
+ if ( snort::Snort::is_reloading() )
{
(*old_it)->set_reloaded(RELOAD_TYPE_REENABLED);
fp->ilist.erase(old_it);
return nullptr;
}
- if ( Snort::is_reloading() )
+ if ( snort::Snort::is_reloading() )
{
if ( reloaded )
p->set_reloaded(RELOAD_TYPE_REENABLED);
Inspector* InspectorManager::get_binder()
{
- InspectionPolicy* pi = get_inspection_policy();
+ InspectionPolicy* pi = snort::get_inspection_policy();
if ( !pi || !pi->framework_policy )
return nullptr;
InspectionPolicy* pi;
if (dflt_only)
- pi = get_default_inspection_policy(SnortConfig::get_conf());
+ pi = snort::get_default_inspection_policy(SnortConfig::get_conf());
else
- pi = get_inspection_policy();
+ pi = snort::get_inspection_policy();
if ( !pi || !pi->framework_policy )
return nullptr;
// pin->tinit() only called for default policy
set_default_policy();
- InspectionPolicy* pi = get_inspection_policy();
+ InspectionPolicy* pi = snort::get_inspection_policy();
if ( pi && pi->framework_policy )
{
{
// pin->tterm() only called for default policy
set_default_policy();
- InspectionPolicy* pi = get_inspection_policy();
+ InspectionPolicy* pi = snort::get_inspection_policy();
if ( pi && pi->framework_policy )
{
assert(mod);
FrameworkConfig* fc = sc->framework_config;
- FrameworkPolicy* fp = get_inspection_policy()->framework_policy;
+ FrameworkPolicy* fp = snort::get_inspection_policy()->framework_policy;
// FIXIT-L should not need to lookup inspector etc
// since given api and mod
if ( !ppc )
return nullptr;
- auto fp = get_inspection_policy()->framework_policy;
+ auto fp = snort::get_inspection_policy()->framework_policy;
auto ppi = get_new(ppc, fp, name, mod, sc);
if ( !ppi )
void InspectorManager::print_config(SnortConfig* sc)
{
- InspectionPolicy* pi = get_inspection_policy();
+ InspectionPolicy* pi = snort::get_inspection_policy();
if ( !pi->framework_policy )
return;
void InspectorManager::execute_control(Packet* p)
{
SnortConfig* sc = SnortConfig::get_conf();
- FrameworkPolicy* fp = get_default_inspection_policy(sc)->framework_policy;
+ FrameworkPolicy* fp = snort::get_default_inspection_policy(sc)->framework_policy;
::execute(p, fp->control.vec, fp->control.num);
}
void InspectorManager::execute(Packet* p)
{
- FrameworkPolicy* fp = get_inspection_policy()->framework_policy;
+ FrameworkPolicy* fp = snort::get_inspection_policy()->framework_policy;
assert(fp);
if ( !p->has_paf_payload() )
// a flow control wrapper) and use eval() instead of process()
// for stream_*.
::execute(p, fp->session.vec, fp->session.num);
- fp = get_inspection_policy()->framework_policy;
+ fp = snort::get_inspection_policy()->framework_policy;
}
// must check between each ::execute()
if ( p->disable_inspect )
void InspectorManager::probe(Packet* p)
{
- FrameworkPolicy* fp = get_inspection_policy()->framework_policy;
+ FrameworkPolicy* fp = snort::get_inspection_policy()->framework_policy;
::execute(p, fp->probe.vec, fp->probe.num);
}
#include "framework/inspector.h"
#endif
-struct Packet;
struct FrameworkPolicy;
-struct SnortConfig;
struct InspectionPolicy;
+namespace snort
+{
+struct Packet;
+struct SnortConfig;
+
//-------------------------------------------------------------------------
class InspectorManager
static void full_inspection(Packet*);
static void execute_control(Packet*);
};
-
+}
#endif
#include "module_manager.h"
#include "plugin_manager.h"
+using namespace snort;
using namespace std;
struct Option
#include "framework/ips_option.h"
#include "framework/module.h"
-struct SnortConfig;
-struct IpsApi;
+namespace snort
+{
+ struct IpsApi;
+ class IpsOption;
+ struct SnortConfig;
+}
//-------------------------------------------------------------------------
#ifdef PIGLET
struct IpsOptionWrapper
{
- IpsOptionWrapper(const IpsApi* a, IpsOption* p) :
+ IpsOptionWrapper(const snort::IpsApi* a, snort::IpsOption* p) :
api { a }, instance { p } { }
~IpsOptionWrapper()
api->dtor(instance);
}
- const IpsApi* api;
- IpsOption* instance;
+ const snort::IpsApi* api;
+ snort::IpsOption* instance;
};
#endif
class IpsManager
{
public:
- static void add_plugin(const IpsApi*);
+ static void add_plugin(const snort::IpsApi*);
static void dump_plugins();
static void release_plugins();
- static void instantiate(const IpsApi*, Module*, SnortConfig*);
+ static void instantiate(const snort::IpsApi*, snort::Module*, snort::SnortConfig*);
static bool get_option(
- SnortConfig*, struct OptTreeNode*, int proto,
- const char* keyword, char* args, RuleOptType&);
+ snort::SnortConfig*, struct OptTreeNode*, int proto,
+ const char* keyword, char* args, snort::RuleOptType&);
- static bool option_begin(SnortConfig*, const char* key, int proto);
+ static bool option_begin(snort::SnortConfig*, const char* key, int proto);
static bool option_set(
- SnortConfig*, const char* key, const char* opt, const char* val);
+ snort::SnortConfig*, const char* key, const char* opt, const char* val);
static bool option_end(
- SnortConfig*, OptTreeNode*, int proto, const char* key, RuleOptType&);
+ snort::SnortConfig*, OptTreeNode*, int proto, const char* key, snort::RuleOptType&);
- static void delete_option(class IpsOption*);
+ static void delete_option(snort::IpsOption*);
static const char* get_option_keyword();
- static void global_init(SnortConfig*);
- static void global_term(SnortConfig*);
+ static void global_init(snort::SnortConfig*);
+ static void global_term(snort::SnortConfig*);
static void reset_options();
static void setup_options();
static void clear_options();
- static bool verify(SnortConfig*);
+ static bool verify(snort::SnortConfig*);
#ifdef PIGLET
- static IpsOptionWrapper* instantiate(const char*, Module*, struct OptTreeNode*);
+ static IpsOptionWrapper* instantiate(const char*, snort::Module*, struct OptTreeNode*);
#endif
};
#include "plugin_manager.h"
+using namespace snort;
using namespace std;
struct ModHook
if ( val.get_type() != Value::VT_STR )
return false;
- if ( get_ips_policy() == nullptr )
+ if ( snort::get_ips_policy() == nullptr )
return true;
trace("var", fqn, val);
return false;
// FIXIT-M only basic modules and inspectors can be reloaded at present
- if ( ( Snort::is_reloading() )
+ if ( ( snort::Snort::is_reloading() )
and h->api and h->api->type != PT_INSPECTOR )
return false;
//-------------------------------------------------------------------------
+namespace snort
+{
+struct BaseApi;
+class Module;
struct SnortConfig;
+}
+
class Shell;
class ModuleManager
static void init();
static void term();
- static void add_module(class Module*, const struct BaseApi* = nullptr);
- static Module* get_module(const char*);
- static Module* get_default_module(const char*, SnortConfig*);
+ static void add_module(snort::Module*, const snort::BaseApi* = nullptr);
+ static snort::Module* get_module(const char*);
+ static snort::Module* get_default_module(const char*, snort::SnortConfig*);
static const char* get_current_module();
- static std::list<Module*> get_all_modules();
+ static std::list<snort::Module*> get_all_modules();
static void list_modules(const char* = nullptr);
static void dump_modules();
static void dump_defaults(const char* = nullptr);
static void load_commands(Shell*);
- static void load_rules(SnortConfig*);
- static void set_config(SnortConfig*);
+ static void load_rules(snort::SnortConfig*);
+ static void set_config(snort::SnortConfig*);
static void reset_errors();
static unsigned get_errors();
- static void dump_stats(SnortConfig*, const char* skip = nullptr);
- static void accumulate(SnortConfig*);
- static void reset_stats(SnortConfig*);
+ static void dump_stats(snort::SnortConfig*, const char* skip = nullptr);
+ static void accumulate(snort::SnortConfig*);
+ static void reset_stats(snort::SnortConfig*);
static std::set<uint32_t> gids;
};
#include "module_manager.h"
+using namespace snort;
using namespace std;
typedef list<const MpseApi*> EngineList;
#include "framework/mpse.h"
#endif
+namespace snort
+{
struct MpseApi;
class Mpse;
struct SnortConfig;
+}
//-------------------------------------------------------------------------
#ifdef PIGLET
struct MpseWrapper
{
- MpseWrapper(const MpseApi* a, Mpse* p) :
+ MpseWrapper(const snort::MpseApi* a, snort::Mpse* p) :
api { a }, instance { p } { }
~MpseWrapper()
api->dtor(instance);
}
- const MpseApi* api;
- Mpse* instance;
+ const snort::MpseApi* api;
+ snort::Mpse* instance;
};
#endif
class MpseManager
{
public:
- static void add_plugin(const MpseApi*);
+ static void add_plugin(const snort::MpseApi*);
static void release_plugins();
static void dump_plugins();
- static void instantiate(const MpseApi*, Module*, SnortConfig*);
- static const MpseApi* get_search_api(const char* type);
- static void delete_search_engine(Mpse*);
-
- static Mpse* get_search_engine(const char*);
- static Mpse* get_search_engine(
- SnortConfig* sc,const MpseApi* api, const struct MpseAgent*);
-
- static void activate_search_engine(const MpseApi*, SnortConfig*);
- static void setup_search_engine(const MpseApi*, SnortConfig*);
- static void start_search_engine(const MpseApi*);
- static void stop_search_engine(const MpseApi*);
- static bool search_engine_trim(const MpseApi*);
- static bool is_regex_capable(const MpseApi*);
- static void print_mpse_summary(const MpseApi*);
+ static void instantiate(const snort::MpseApi*, snort::Module*, snort::SnortConfig*);
+ static const snort::MpseApi* get_search_api(const char* type);
+ static void delete_search_engine(snort::Mpse*);
+
+ static snort::Mpse* get_search_engine(const char*);
+ static snort::Mpse* get_search_engine(
+ snort::SnortConfig* sc,const snort::MpseApi* api, const struct MpseAgent*);
+
+ static void activate_search_engine(const snort::MpseApi*, snort::SnortConfig*);
+ static void setup_search_engine(const snort::MpseApi*, snort::SnortConfig*);
+ static void start_search_engine(const snort::MpseApi*);
+ static void stop_search_engine(const snort::MpseApi*);
+ static bool search_engine_trim(const snort::MpseApi*);
+ static bool is_regex_capable(const snort::MpseApi*);
+ static void print_mpse_summary(const snort::MpseApi*);
static void print_search_engine_stats();
#ifdef PIGLET
- static MpseWrapper* instantiate(const char*, Module*, SnortConfig*);
+ static MpseWrapper* instantiate(const char*, snort::Module*, snort::SnortConfig*);
#endif
};
#include "script_manager.h"
#include "so_manager.h"
+using namespace snort;
using namespace std;
#define lib_pattern "*.so"
#include "framework/base_api.h"
+namespace snort
+{
class Module;
struct SnortConfig;
+}
class PluginManager
{
public:
// plugin methods
- static void load_plugins(const BaseApi**);
+ static void load_plugins(const snort::BaseApi**);
static void load_plugins(const std::string& lib_paths);
static void list_plugins();
static PlugType get_type(const char*);
static const char* get_type_name(PlugType);
- static const BaseApi* get_api(PlugType, const char* name);
+ static const snort::BaseApi* get_api(PlugType, const char* name);
#ifdef PIGLET
static PlugType get_type_from_name(const std::string&);
#endif
static const char* get_current_plugin();
- static void instantiate(const BaseApi*, Module*, SnortConfig*);
- static void instantiate(const BaseApi*, Module*, SnortConfig*, const char* name);
+ static void instantiate(const snort::BaseApi*, snort::Module*, snort::SnortConfig*);
+ static void instantiate(const snort::BaseApi*, snort::Module*, snort::SnortConfig*,
+ const char* name);
static const char* get_available_plugins(PlugType);
};
#include "piglet/piglet_manager.h"
#endif
+using namespace snort;
using namespace std;
// FIXIT-P this approach results in N * K lua states where
public:
static void load_scripts(const std::vector<std::string>& paths);
static void release_scripts();
- static const BaseApi** get_plugins();
+ static const snort::BaseApi** get_plugins();
static std::string* get_chunk(const char* key);
};
#include "framework/so_rule.h"
+namespace snort
+{
struct SnortConfig;
+}
struct SoApi;
//-------------------------------------------------------------------------
if ( !thread_cap )
return true;
- const auto& config = *SnortConfig::get_conf()->memory;
+ const auto& config = *snort::SnortConfig::get_conf()->memory;
return memory::free_space(n, thread_cap, s_tracker, prune_handler) || config.soft;
}
void MemoryCap::calculate(unsigned num_threads)
{
assert(!is_packet_thread());
- const MemoryConfig& config = *SnortConfig::get_conf()->memory;
+ const MemoryConfig& config = *snort::SnortConfig::get_conf()->memory;
auto main_thread_used = s_tracker.used();
if ( !MemoryModule::is_active() )
return;
- const MemoryConfig& config = *SnortConfig::get_conf()->memory;
+ const MemoryConfig& config = *snort::SnortConfig::get_conf()->memory;
- if ( SnortConfig::log_verbose() or s_tracker.allocations )
+ if ( snort::SnortConfig::log_verbose() or s_tracker.allocations )
LogLabel("memory (heap)");
- if ( SnortConfig::log_verbose() )
+ if ( snort::SnortConfig::log_verbose() )
{
LogMessage(" global cap: %zu\n", config.cap);
LogMessage(" global preemptive threshold percent: %zu\n", config.threshold);
#include "memory_config.h"
+using namespace snort;
+
// -----------------------------------------------------------------------------
// memory attributes
// -----------------------------------------------------------------------------
#include "framework/module.h"
-class MemoryModule : public Module
+class MemoryModule : public snort::Module
{
public:
MemoryModule();
- bool set(const char*, Value&, SnortConfig*) override;
- bool end(const char*, int, SnortConfig*) override;
+ bool set(const char*, snort::Value&, snort::SnortConfig*) override;
+ bool end(const char*, int, snort::SnortConfig*) override;
Usage get_usage() const override
{ return GLOBAL; }
void prune_handler()
{
- Stream::prune_flows();
+ snort::Stream::prune_flows();
}
} // namespace memory
// update file depth and max_depth etc
void DecodeConfig::sync_all_depths()
{
- file_depth = FileService::get_max_file_depth();
+ file_depth = snort::FileService::get_max_file_depth();
if ((file_depth >= 0)or (b64_depth >= 0) or (qp_depth >= 0)
or (bitenc_depth >= 0) or (uu_depth >= 0))
decode_enabled = true;
#include "utils/util.h"
#include "utils/util_cstring.h"
+using namespace snort;
+
#define MAX_FILE 1024
#define MAX_EMAIL 1024
uint32_t email_hdrs_log_depth = 0;
};
+namespace snort
+{
class Flow;
+}
class MailLogState
{
/* accumulate MIME attachment filenames. The filenames are appended by commas */
int log_file_name(const uint8_t* start, int length, bool* disp_cont);
- void set_file_name_from_log(Flow*);
+ void set_file_name_from_log(snort::Flow*);
int log_email_hdrs(const uint8_t* start, int length);
int log_email_id (const uint8_t* start, int length, EmailUserType);
#include "log/messages.h"
#include "search_engines/search_tool.h"
+using namespace snort;
+
struct MimeToken
{
const char* name;
#include "mime/file_mime_log.h"
#include "mime/file_mime_paf.h"
+namespace snort
+{
/* state flags */
#define MIME_FLAG_FOLDING 0x00000001
#define MIME_FLAG_IN_CONTENT_TYPE 0x00000002
const uint8_t* process_mime_data_paf(Flow*, const uint8_t* start, const uint8_t* end,
bool upload, FilePosition);
};
-
+}
#endif
#include "time/packet_time.h"
#include "appid_session.h"
+using namespace snort;
+
static THREAD_LOCAL AFActKey master_key;
static THREAD_LOCAL XHash* AF_indicators = nullptr; // list of "indicator apps"
static THREAD_LOCAL XHash* AF_actives = nullptr; // list of hosts to watch
#include "application_ids.h"
class AppIdSession;
+namespace snort
+{
struct Packet;
+}
// indicator - the appId that indicates there may be subsequent flows to look for,
// from the same host
int init_appid_forecast();
void clean_appid_forecast();
void add_af_indicator(AppId, AppId, AppId);
-void check_session_for_AF_indicator(Packet*, int, AppId);
-AppId check_session_for_AF_forecast(AppIdSession&, Packet*, int, AppId);
+void check_session_for_AF_indicator(snort::Packet*, int, AppId);
+AppId check_session_for_AF_forecast(AppIdSession&, snort::Packet*, int, AppId);
#endif
static std::mutex apr_mutex;
std::lock_guard<std::mutex> lock(apr_mutex);
- int16_t id = SnortConfig::get_conf()->proto_ref->add(protocol);
+ int16_t id = snort::SnortConfig::get_conf()->proto_ref->add(protocol);
return id;
}
uint32_t serviceId;
uint32_t clientId;
uint32_t payloadId;
- int16_t snortId = SFTARGET_UNKNOWN_PROTOCOL;
+ int16_t snortId = snort::SFTARGET_UNKNOWN_PROTOCOL;
uint32_t flags = 0;
uint32_t priority = APP_PRIORITY_DEFAULT;
ClientDetector* client_detector = nullptr;
#include "service_plugins/service_netbios.h"
#include "utils/util.h"
+using namespace snort;
+
#define SSL_WHITELIST_PKT_LIMIT 20
+namespace snort
+{
AppIdApi appid_api;
+}
AppIdSession* AppIdApi::get_appid_session(Flow& flow)
{
#include "flow/flow.h"
enum class IpProtocol : uint8_t;
+
class AppIdDnsSession;
class AppIdHttpSession;
class AppIdSession;
+namespace snort
+{
#define APPID_SESSION_RESPONDER_MONITORED (1ULL << 0)
#define APPID_SESSION_INITIATOR_MONITORED (1ULL << 1)
#define APPID_SESSION_SPECIAL_MONITORED (1ULL << 2)
};
SO_PUBLIC extern AppIdApi appid_api;
-
+}
#endif
static void map_app_names_to_snort_ids()
{
/* init globals for snortId compares */
- snortId_for_unsynchronized = SnortConfig::get_conf()->proto_ref->add("unsynchronized");
- snortId_for_ftp_data = SnortConfig::get_conf()->proto_ref->add("ftp-data");
- snortId_for_http2 = SnortConfig::get_conf()->proto_ref->add("http2");
+ snortId_for_unsynchronized = snort::SnortConfig::get_conf()->proto_ref->add("unsynchronized");
+ snortId_for_ftp_data = snort::SnortConfig::get_conf()->proto_ref->add("ftp-data");
+ snortId_for_http2 = snort::SnortConfig::get_conf()->proto_ref->add("http2");
}
AppIdModuleConfig::AppIdModuleConfig()
struct PortExclusion
{
int family;
- ip::snort_in6_addr ip;
- ip::snort_in6_addr netmask;
+ snort::ip::snort_in6_addr ip;
+ snort::ip::snort_in6_addr netmask;
};
struct AppIdSessionLogFilter
dip.clear();
}
- SfIp sip;
+ snort::SfIp sip;
bool sip_flag = false;
- SfIp dip;
+ snort::SfIp dip;
bool dip_flag = false;
uint16_t sport = 0;
uint16_t dport = 0;
private:
void read_port_detectors(const char* files);
void configure_analysis_networks(char* toklist[], uint32_t flag);
- int add_port_exclusion(AppIdPortExclusions&, const ip::snort_in6_addr* ip,
- const ip::snort_in6_addr* netmask, int family, uint16_t port);
+ int add_port_exclusion(AppIdPortExclusions&, const snort::ip::snort_in6_addr* ip,
+ const snort::ip::snort_in6_addr* netmask, int family, uint16_t port);
void process_port_exclusion(char* toklist[]);
void process_config_directive(char* toklist[], int /* reload */);
int load_analysis_config(const char* config_file, int reload, int instance_id);
#include "lua_detector_api.h"
#include "protocols/packet.h"
+using namespace snort;
+
int AppIdDetector::initialize()
{
if ( !tcp_patterns.empty() )
class AppIdConfig;
class LuaStateDescriptor;
+
+namespace snort
+{
struct Packet;
+}
#define STATE_ID_MAX_VALID_COUNT 5
class AppIdDiscoveryArgs
{
public:
- AppIdDiscoveryArgs(const uint8_t* data, uint16_t size, int dir, AppIdSession& asd, Packet* p)
- : data(data), size(size), dir(dir), asd(asd), pkt(p)
+ AppIdDiscoveryArgs(const uint8_t* data, uint16_t size, int dir, AppIdSession& asd,
+ snort::Packet* p) : data(data), size(size), dir(dir), asd(asd), pkt(p)
{
config = asd.config;
session_logging_enabled = asd.session_logging_enabled;
uint16_t size;
int dir;
AppIdSession& asd;
- Packet* pkt;
+ snort::Packet* pkt;
const AppIdConfig* config = nullptr;
bool session_logging_enabled = false;
char* session_logging_id = nullptr;
#include "protocols/packet.h"
#include "protocols/tcp.h"
+using namespace snort;
+
AppIdDiscovery::AppIdDiscovery(AppIdInspector& ins)
: inspector(ins)
{
class AppIdDetector;
class ServiceDetector;
struct ServiceDetectorPort;
+
+namespace snort
+{
struct Packet;
+}
#define SCAN_HTTP_VIA_FLAG (1<<0)
#define SCAN_HTTP_USER_AGENT_FLAG (1<<1)
virtual void initialize() = 0;
virtual void register_detector(const std::string&, AppIdDetector*, IpProtocol);
- virtual void add_pattern_data(AppIdDetector*, SearchTool*, int position,
+ virtual void add_pattern_data(AppIdDetector*, snort::SearchTool*, int position,
const uint8_t* const pattern, unsigned size, unsigned nocase);
virtual void register_tcp_pattern(AppIdDetector*, const uint8_t* const pattern, unsigned size,
int position, unsigned nocase);
int position, unsigned nocase);
virtual int add_service_port(AppIdDetector*, const ServiceDetectorPort&);
- static void do_application_discovery(Packet* p, AppIdInspector&);
+ static void do_application_discovery(snort::Packet* p, AppIdInspector&);
AppIdDetectors* get_tcp_detectors()
{
AppIdInspector& inspector;
AppIdDetectors tcp_detectors;
AppIdDetectors udp_detectors;
- SearchTool* tcp_patterns = nullptr;
+ snort::SearchTool* tcp_patterns = nullptr;
int tcp_pattern_count = 0;
- SearchTool* udp_patterns = nullptr;
+ snort::SearchTool* udp_patterns = nullptr;
int udp_pattern_count = 0;
std::vector<AppIdPatternMatchNode*> pattern_data;
};
#include "appid_session.h"
#include "utils/util.h"
+using namespace snort;
+
void HttpEventHandler::handle(DataEvent& event, Flow* flow)
{
int direction;
#include "pub_sub/http_events.h"
-class HttpEventHandler : public DataHandler
+namespace snort
+{
+class Flow;
+}
+
+class HttpEventHandler : public snort::DataHandler
{
public:
enum HttpEventType
event_type = type;
}
- void handle(DataEvent&, Flow*) override;
+ void handle(snort::DataEvent&, snort::Flow*) override;
private:
HttpEventType event_type;
#include "detector_plugins/http_url_patterns.h"
#include "profiler/profiler.h"
+
static const char* httpFieldName[ MAX_HTTP_FIELD_ID ] = // for use in debug messages
{
"useragent",
"body",
};
-ProfileStats httpPerfStats;
+snort::ProfileStats httpPerfStats;
AppIdHttpSession::AppIdHttpSession(AppIdSession& asd)
: asd(asd)
int AppIdHttpSession::process_http_packet(int direction)
{
- Profile http_profile_context(httpPerfStats);
+ snort::Profile http_profile_context(httpPerfStats);
AppId service_id = APP_ID_NONE;
AppId client_id = APP_ID_NONE;
AppId payload_id = APP_ID_NONE;
// FIXIT-H - This function is unused and untested currently... need to figure who wants it
// and what it should do
-void AppIdHttpSession::update_http_xff_address(struct XffFieldValue* xff_fields,
- uint32_t numXffFields)
+void AppIdHttpSession::update_http_xff_address(struct XffFieldValue* /*xff_fields*/,
+ uint32_t /*numXffFields*/)
{
#if 0
static const char* defaultXffPrecedence[] =
// For a comma-separated list of addresses, pick the last address
// FIXIT-L: change to select last address port from 2.9.10-42..not tested
- xff_addr = new SfIp();
+ xff_addr = new snort::SfIp();
char* xff_addr_str = nullptr;
char* tmp = strchr(xff_fields[j].value, ',');
uint16_t get_cookie_offset();
uint16_t get_cookie_end_offset();
- SfIp* get_xff_addr()
+ snort::SfIp* get_xff_addr()
{ return xff_addr; }
void update_host(const uint8_t* new_host, int32_t len);
int num_scans = 0;
bool rebuilt_offsets = false;
bool skip_simple_detect = false;
- SfIp* xff_addr = nullptr;
+ snort::SfIp* xff_addr = nullptr;
const char** xffPrecedence = nullptr;
unsigned numXffFields = 0;
std::vector<int> ptype_req_counts;
#include "detector_plugins/http_url_patterns.h"
#include "detector_plugins/detector_sip.h"
#include "detector_plugins/detector_pattern.h"
+#include "flow/flow.h"
#include "log/messages.h"
#include "log/packet_tracer.h"
#include "managers/inspector_manager.h"
#include "protocols/packet.h"
#include "profiler/profiler.h"
+using namespace snort;
+
// FIXIT-L - appid cleans up openssl now as it is the primary (only) user... eventually this
// should probably be done outside of appid
static void openssl_cleanup()
#include "application_ids.h"
#include "flow/flow.h"
+namespace snort
+{
struct Packet;
-class SipEventHandler;
struct SnortConfig;
+}
+class SipEventHandler;
-class AppIdInspector : public Inspector
+class AppIdInspector : public snort::Inspector
{
public:
AppIdInspector(AppIdModule&);
~AppIdInspector() override;
- bool configure(SnortConfig*) override;
- void show(SnortConfig*) override;
+ bool configure(snort::SnortConfig*) override;
+ void show(snort::SnortConfig*) override;
void tinit() override;
void tterm() override;
- void eval(Packet*) override;
+ void eval(snort::Packet*) override;
AppIdConfig* get_appid_config();
SipEventHandler& get_sip_event_handler()
#include "profiler/profiler.h"
#include "utils/util.h"
+using namespace snort;
using namespace std;
//-------------------------------------------------------------------------
#include "appid_config.h"
#include "framework/module.h"
-extern THREAD_LOCAL ProfileStats appidPerfStats;
+extern THREAD_LOCAL snort::ProfileStats appidPerfStats;
#define MOD_NAME "appid"
#define MOD_HELP "application and service identification"
-class AppIdModule : public Module
+class AppIdModule : public snort::Module
{
public:
AppIdModule();
~AppIdModule() override;
- bool begin(const char*, int, SnortConfig*) override;
- bool set(const char*, Value&, SnortConfig*) override;
- bool end(const char*, int, SnortConfig*) override;
+ bool begin(const char*, int, snort::SnortConfig*) override;
+ bool set(const char*, snort::Value&, snort::SnortConfig*) override;
+ bool end(const char*, int, snort::SnortConfig*) override;
const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
- ProfileStats* get_profile() const override;
+ snort::ProfileStats* get_profile() const override;
const AppIdModuleConfig* get_data();
#include "target_based/snort_protocols.h"
#include "time/packet_time.h"
+using namespace snort;
+
unsigned AppIdSession::inspector_id = 0;
THREAD_LOCAL uint32_t AppIdSession::appid_flow_data_id = 0;
#include "service_state.h"
#include "detector_plugins/http_url_patterns.h"
-struct AppIdServiceSubtype;
class ClientDetector;
class ServiceDetector;
class AppIdDnsSession;
initiator_ip.clear();
}
- APPID_FLOW_TYPE flow_type = APPID_FLOW_TYPE_IGNORE;
+ snort::APPID_FLOW_TYPE flow_type = snort::APPID_FLOW_TYPE_IGNORE;
unsigned policyId = 0;
//flags shared with other preprocessor via session attributes.
uint64_t flags = 0;
- SfIp initiator_ip;
+ snort::SfIp initiator_ip;
uint16_t initiator_port = 0;
};
int tls_orgUnit_strlen = 0;
};
-class AppIdSession : public FlowData
+class AppIdSession : public snort::FlowData
{
public:
- AppIdSession(IpProtocol, const SfIp*, uint16_t port, AppIdInspector&);
+ AppIdSession(IpProtocol, const snort::SfIp*, uint16_t port, AppIdInspector&);
~AppIdSession() override;
- static AppIdSession* allocate_session(const Packet*, IpProtocol, int, AppIdInspector&);
- static AppIdSession* create_future_session(const Packet*, const SfIp*, uint16_t, const SfIp*,
+ static AppIdSession* allocate_session(const snort::Packet*, IpProtocol, int, AppIdInspector&);
+ static AppIdSession* create_future_session(const snort::Packet*, const snort::SfIp*, uint16_t, const snort::SfIp*,
uint16_t, IpProtocol, int16_t, int, AppIdInspector&);
AppIdInspector& get_inspector() const
}
uint32_t session_id = 0;
- Flow* flow = nullptr;
+ snort::Flow* flow = nullptr;
AppIdConfig* config;
std::map<unsigned, AppIdFlowData*> flow_data;
AppInfoManager* app_info_mgr = nullptr;
CommonAppIdData common;
uint16_t session_packet_count = 0;
- SfIp service_ip;
+ snort::SfIp service_ip;
uint16_t service_port = 0;
IpProtocol protocol = IpProtocol::PROTO_NOT_SET;
uint8_t previous_tcp_flags = 0;
APPID_DISCOVERY_STATE service_disco_state = APPID_DISCO_STATE_NONE;
SESSION_SERVICE_SEARCH_STATE service_search_state = SESSION_SERVICE_SEARCH_STATE::START;
ServiceDetector* service_detector = nullptr;
- AppIdServiceSubtype* subtype = nullptr;
+ snort::AppIdServiceSubtype* subtype = nullptr;
std::vector<ServiceDetector*> service_candidates;
ServiceAppDescriptor service;
ClientAppDescriptor client;
AppId past_forecast = APP_ID_NONE;
bool is_http2 = false;
- SEARCH_SUPPORT_TYPE search_support_type = UNKNOWN_SEARCH_ENGINE;
+ snort::SEARCH_SUPPORT_TYPE search_support_type = snort::UNKNOWN_SEARCH_ENGINE;
bool in_expected_cache = false;
static unsigned inspector_id;
static void init() { inspector_id = FlowData::create_flow_data_id(); }
void get_application_ids(AppId&, AppId&, AppId&, AppId&);
bool is_ssl_session_decrypted();
- void examine_ssl_metadata(Packet*);
+ void examine_ssl_metadata(snort::Packet*);
void set_client_appid_data(AppId, char*);
void set_service_appid_data(AppId, char*, char*);
void set_referred_payload_app_id_data(AppId);
void check_app_detection_restart();
void update_encrypted_app_id(AppId);
void examine_rtmp_metadata();
- void sync_with_snort_id(AppId, Packet*);
- void stop_rna_service_inspection(Packet*, int);
+ void sync_with_snort_id(AppId, snort::Packet*);
+ void stop_rna_service_inspection(snort::Packet*, int);
bool is_payload_appid_set();
void clear_http_flags();
void delete_session_data();
bool is_ssl_decryption_enabled();
- void set_session_logging_state(const Packet*, int direction);
- void create_session_logging_id(int direction, Packet*);
+ void set_session_logging_state(const snort::Packet*, int direction);
+ void create_session_logging_id(int direction, snort::Packet*);
static THREAD_LOCAL uint32_t appid_flow_data_id;
AppId application_ids[APP_PROTOID_MAX];
/*Node for mlmp tree */
struct tMlmpTree
{
- SearchTool* patternTree;
+ snort::SearchTool* patternTree;
tPatternPrimaryNode* patternList;
uint32_t level;
};
detroyTreesRecursively. */
static int createTreesRecusively(tMlmpTree* rootNode)
{
- SearchTool* patternMatcher;
+ snort::SearchTool* patternMatcher;
tPatternPrimaryNode* primaryPatternNode;
tPatternNode* ddPatternNode;
/* set up the MPSE for url patterns */
- patternMatcher = rootNode->patternTree = new SearchTool("ac_full", true);
+ patternMatcher = rootNode->patternTree = new snort::SearchTool("ac_full", true);
for (primaryPatternNode = rootNode->patternList;
primaryPatternNode;
/*Root node */
struct tPatternRootNode
{
- SearchTool* patternTree;
+ snort::SearchTool* patternTree;
tPatternList* patternList;
tPatternList* lastPattern;
unsigned int level; /*some searches may be specific to levels. Increments from 1 at top
static int createTreesRecusively(void* root)
{
tPatternRootNode* rootNode = (tPatternRootNode*)root;
- SearchTool* patternMatcher;
+ snort::SearchTool* patternMatcher;
tPatternList* patternNode;
/* set up the MPSE for url patterns */
- if (!(patternMatcher = rootNode->patternTree = new SearchTool("ac_full", true)))
+ if (!(patternMatcher = rootNode->patternTree = new snort::SearchTool("ac_full", true)))
return -1;
for (patternNode = rootNode->patternList;
#include "protocols/packet.h"
#include "profiler/profiler.h"
+using namespace snort;
+
#define MAX_CANDIDATE_CLIENTS 10
ProfileStats clientMatchPerfStats;
static ClientDiscovery& get_instance(AppIdInspector* ins = nullptr);
void finalize_client_plugins();
- bool do_client_discovery(AppIdSession&, Packet*, int direction);
+ bool do_client_discovery(AppIdSession&, snort::Packet*, int direction);
private:
ClientDiscovery(AppIdInspector& ins);
void initialize() override;
- int exec_client_detectors(AppIdSession&, Packet*, int direction);
- ClientAppMatch* find_detector_candidates(const Packet* pkt, IpProtocol);
- void create_detector_candidates_list(AppIdSession&, Packet*);
- int get_detector_candidates_list(AppIdSession&, Packet*, int direction);
+ int exec_client_detectors(AppIdSession&, snort::Packet*, int direction);
+ ClientAppMatch* find_detector_candidates(const snort::Packet* pkt, IpProtocol);
+ void create_detector_candidates_list(AppIdSession&, snort::Packet*);
+ int get_detector_candidates_list(AppIdSession&, snort::Packet*, int direction);
};
#endif
struct ServiceDnsConfig
{
DetectorDNSHostPattern* DetectorDNSHostPatternList;
- SearchTool* dns_host_host_matcher;
+ snort::SearchTool* dns_host_host_matcher;
};
static THREAD_LOCAL ServiceDnsConfig serviceDnsConfig; // DNS service configuration
if (serviceDnsConfig.dns_host_host_matcher)
delete serviceDnsConfig.dns_host_host_matcher;
- serviceDnsConfig.dns_host_host_matcher = new SearchTool("ac_full", true);
+ serviceDnsConfig.dns_host_host_matcher = new snort::SearchTool("ac_full", true);
if (!serviceDnsConfig.dns_host_host_matcher)
return 0;
return APPID_INPROCESS;
}
-static int dns_host_scan_patterns(SearchTool* matcher, const uint8_t* pattern, size_t size,
+static int dns_host_scan_patterns(snort::SearchTool* matcher, const uint8_t* pattern, size_t size,
AppId* ClientAppId, AppId* payloadId)
{
MatchedDNSPatterns* mp = nullptr;
void ImapClientDetector::do_custom_init()
{
- cmd_matcher = new SearchTool("ac_full", true);
+ cmd_matcher = new snort::SearchTool("ac_full", true);
if ( !tcp_patterns.empty() )
{
ImapDetectorData* get_common_data(AppIdSession&);
private:
- SearchTool* cmd_matcher = nullptr;
+ snort::SearchTool* cmd_matcher = nullptr;
unsigned longest_pattern = 0;
};
static THREAD_LOCAL KerberosServiceDetector* krb_service_detector = nullptr;
static int krb_walk_server_packet(KRBState* krbs, const uint8_t* s, const uint8_t* end,
- AppIdSession& asd, Packet* pkt, const int dir, const char* reqCname)
+ AppIdSession& asd, snort::Packet* pkt, const int dir, const char* reqCname)
{
static const uint8_t KRB_SERVER_VERSION[] = "\x0a0\x003\x002\x001";
static const uint8_t KRB_SERVER_TYPE[] = "\x0a1\x003\x002\x001";
}
}
-static void register_pattern(SearchTool** patterns, Pattern* pattern)
+static void register_pattern(snort::SearchTool** patterns, Pattern* pattern)
{
if (!*patterns)
{
- *patterns = new SearchTool("ac_full", true);
+ *patterns = new snort::SearchTool("ac_full", true);
if (!*patterns)
{
ErrorMessage("Error initializing the pattern table\n");
return 0;
}
-static int csd_pattern_tree_search(const uint8_t* data, uint16_t size, SearchTool* patternTree)
+static int csd_pattern_tree_search(const uint8_t* data, uint16_t size, snort::SearchTool* patternTree)
{
PServiceMatch* matches = nullptr;
int PatternServiceDetector::validate(AppIdDiscoveryArgs& args)
{
- SearchTool* patternTree = nullptr;
+ snort::SearchTool* patternTree = nullptr;
if (!args.data )
return APPID_ENULL;
if (!args.size || args.dir == APP_ID_FROM_RESPONDER)
return APPID_INPROCESS;
- SearchTool* patternTree = (args.asd.protocol == IpProtocol::UDP) ?
+ snort::SearchTool* patternTree = (args.asd.protocol == IpProtocol::UDP) ?
udp_pattern_matcher : tcp_pattern_matcher;
AppId id = csd_pattern_tree_search(args.data, args.size, patternTree);
if (!id)
#include "client_plugins/client_detector.h"
#include "service_plugins/service_detector.h"
+namespace snort
+{
+class SearchTool;
+}
+
struct PortPatternNode
{
AppId appId;
unsigned longest;
};
-class SearchTool;
-class ClientDetector;
-class ServiceDetector;
-
class PatternClientDetector : public ClientDetector
{
public:
PortPatternNode* luaInjectedPatterns = nullptr;
PatternService* servicePortPattern = nullptr;
- SearchTool* tcp_pattern_matcher = nullptr;
- SearchTool* udp_pattern_matcher = nullptr;
+ snort::SearchTool* tcp_pattern_matcher = nullptr;
+ snort::SearchTool* udp_pattern_matcher = nullptr;
};
class PatternServiceDetector : public ServiceDetector
PortPatternNode* luaInjectedPatterns = nullptr;
PatternService* servicePortPattern = nullptr;
- SearchTool* tcp_pattern_matcher = nullptr;
- SearchTool* udp_pattern_matcher = nullptr;
- SearchTool* tcpPortPatternTree[65536] = { nullptr };
- SearchTool* udpPortPatternTree[65536] = { nullptr };
+ snort::SearchTool* tcp_pattern_matcher = nullptr;
+ snort::SearchTool* udp_pattern_matcher = nullptr;
+ snort::SearchTool* tcpPortPatternTree[65536] = { nullptr };
+ snort::SearchTool* udpPortPatternTree[65536] = { nullptr };
};
#endif
unsigned count;
const char* vendor;
char version[MAX_VERSION_SIZE];
- AppIdServiceSubtype* subtype;
+ snort::AppIdServiceSubtype* subtype;
int error;
};
void Pop3ClientDetector::do_custom_init()
{
- cmd_matcher = new SearchTool("ac_full", true);
+ cmd_matcher = new snort::SearchTool("ac_full", true);
if ( !tcp_patterns.empty() )
{
ServicePOP3Data* sd = &dd->server;
while (sd->subtype)
{
- AppIdServiceSubtype* sub = sd->subtype;
+ snort::AppIdServiceSubtype* sub = sd->subtype;
sd->subtype = sub->next;
if (sub->service)
snort_free((void*)sub->service);
pd->vendor = ven_im;
else if ((p=service_strstr(begin, len, (const unsigned char*)ven_po, sizeof(ven_po)-1)))
{
- AppIdServiceSubtype* sub;
+ snort::AppIdServiceSubtype* sub;
pd->vendor = ven_po;
p += (sizeof(ven_po) - 1);
;
if (p == s || p >= line_end || !(*p))
goto ven_ver_done;
- sub = (AppIdServiceSubtype*)snort_calloc(sizeof(AppIdServiceSubtype));
+ sub = (snort::AppIdServiceSubtype*)snort_calloc(sizeof(snort::AppIdServiceSubtype));
unsigned sub_len;
sub_len = p - s;
POP3DetectorData* get_common_data(AppIdSession&);
private:
- SearchTool* cmd_matcher = nullptr;
+ snort::SearchTool* cmd_matcher = nullptr;
unsigned longest_pattern = 0;
};
return 1;
}
-void SipServiceDetector::createRtpFlow(AppIdSession& asd, const Packet* pkt, const SfIp* cliIp,
- uint16_t cliPort, const SfIp* srvIp, uint16_t srvPort, IpProtocol proto, int16_t app_id)
+void SipServiceDetector::createRtpFlow(AppIdSession& asd, const snort::Packet* pkt,
+ const snort::SfIp* cliIp, uint16_t cliPort, const snort::SfIp* srvIp, uint16_t srvPort,
+ IpProtocol proto, int16_t app_id)
{
AppIdSession* fp = AppIdSession::create_future_session(pkt, cliIp, cliPort, srvIp, srvPort,
proto, app_id, APPID_EARLY_SESSION_FLAG_FW_RULE, handler->get_inspector());
THREAD_LOCAL SipUdpClientDetector* SipEventHandler::client = nullptr;
THREAD_LOCAL SipServiceDetector* SipEventHandler::service = nullptr;
-void SipEventHandler::handle(DataEvent& event, Flow* flow)
+void SipEventHandler::handle(snort::DataEvent& event, snort::Flow* flow)
{
SipEvent& sip_event = (SipEvent&)event;
AppIdSession* asd = nullptr;
if ( flow )
- asd = appid_api.get_appid_session(*flow);
+ asd = snort::appid_api.get_appid_session(*flow);
if ( !asd )
{
- const Packet* p = sip_event.get_packet();
+ const snort::Packet* p = sip_event.get_packet();
IpProtocol protocol = p->is_tcp() ? IpProtocol::TCP : IpProtocol::UDP;
int direction = p->is_from_client() ? APP_ID_FROM_INITIATOR : APP_ID_FROM_RESPONDER;
asd = AppIdSession::allocate_session(p, protocol, direction,
#include "framework/data_bus.h"
#include "pub_sub/sip_events.h"
+namespace snort
+{
+class Flow;
+}
+
struct SipUaUserData
{
AppId ClientAppId;
void addFutureRtpFlows(SipEvent&, AppIdSession&);
private:
- void createRtpFlow(AppIdSession&, const Packet*, const SfIp* cliIp,
- uint16_t cliPort, const SfIp* srvIp, uint16_t srvPort, IpProtocol, int16_t app_id);
+ void createRtpFlow(AppIdSession&, const snort::Packet*, const snort::SfIp* cliIp,
+ uint16_t cliPort, const snort::SfIp* srvIp, uint16_t srvPort, IpProtocol, int16_t app_id);
};
-class SipEventHandler : public DataHandler
+class SipEventHandler : public snort::DataHandler
{
public:
void set_service(SipServiceDetector* sd) { SipEventHandler::service = sd; }
void subscribe()
- { DataBus::subscribe(SIP_EVENT_TYPE_SIP_DIALOG_KEY, this); }
+ { snort::DataBus::subscribe(SIP_EVENT_TYPE_SIP_DIALOG_KEY, this); }
- void handle(DataEvent&, Flow*) override;
+ void handle(snort::DataEvent&, snort::Flow*) override;
private:
SipEventHandler() = default;
* Returns 0 if a recognized product is found. Otherwise returns 1.
*/
int SmtpClientDetector::identify_client_version(ClientSMTPData* const fd, const uint8_t* product,
- const uint8_t* data_end, AppIdSession& asd, Packet*)
+ const uint8_t* data_end, AppIdSession& asd, snort::Packet*)
{
const uint8_t* p;
AppId appId = (fd->flags & CLIENT_FLAG_SMTPS) ? APP_ID_SMTPS : APP_ID_SMTP;
const uint8_t* product, const uint8_t* product_end, ClientSMTPData* const,
AppIdSession&, AppId);
int identify_client_version(ClientSMTPData* const, const uint8_t* product,
- const uint8_t* data_end, AppIdSession&, Packet*);
+ const uint8_t* data_end, AppIdSession&, snort::Packet*);
};
class SmtpServiceDetector : public ServiceDetector
int HttpPatternMatchers::process_chp_list(CHPListElement* chplist)
{
for (size_t i = 0; i <= MAX_PATTERN_TYPE; i++)
- chp_matchers[i] = new SearchTool("ac_full", true);
+ chp_matchers[i] = new snort::SearchTool("ac_full", true);
for (CHPListElement* chpe = chplist; chpe; chpe = chpe->next)
chp_matchers[chpe->chp_action.ptype]->add(chpe->chp_action.pattern,
{ (const uint8_t*)HTTP_FIELD_PREFIX_USER_AGENT, REQ_AGENT_FID, HTTP_FIELD_PREFIX_USER_AGENT_SIZE },
};
-static SearchTool* process_http_field_patterns(FieldPattern* patternList, size_t patternListCount)
+static snort::SearchTool* process_http_field_patterns(FieldPattern* patternList, size_t patternListCount)
{
- SearchTool* patternMatcher = new SearchTool("ac_full", true);
+ snort::SearchTool* patternMatcher = new snort::SearchTool("ac_full", true);
for (size_t i=0; i < patternListCount; i++)
patternMatcher->add( (const char*)patternList[i].data, patternList[i].length,
return patternMatcher;
}
-static void process_patterns(SearchTool& matcher, DetectorHTTPPatterns& patterns, bool last = true)
+static void process_patterns(snort::SearchTool& matcher, DetectorHTTPPatterns& patterns, bool last = true)
{
for (auto& pat: patterns)
matcher.add(pat.pattern, pat.pattern_size, &pat, false);
}
// FIXIT-M: Is this still necessary now that we use inspection events?
-void HttpPatternMatchers::get_http_offsets(Packet* pkt, AppIdHttpSession* hsession)
+void HttpPatternMatchers::get_http_offsets(snort::Packet* pkt, AppIdHttpSession* hsession)
{
constexpr auto MIN_HTTP_REQ_HEADER_SIZE = (sizeof("GET /\r\n\r\n") - 1);
static const uint8_t crlfcrlf[] = "\r\n\r\n";
}
void HttpPatternMatchers::get_server_vendor_version(const char* data, int len, char** version,
- char** vendor, AppIdServiceSubtype** subtype)
+ char** vendor, snort::AppIdServiceSubtype** subtype)
{
int vendor_len = len;
{
if ( subname && subname_len > 0 && subver && *subname )
{
- AppIdServiceSubtype* sub =
- (AppIdServiceSubtype*)snort_calloc(sizeof(AppIdServiceSubtype));
+ snort::AppIdServiceSubtype* sub =
+ (snort::AppIdServiceSubtype*)snort_calloc(sizeof(snort::AppIdServiceSubtype));
char* tmp = (char*)snort_calloc(subname_len + 1);
memcpy(tmp, subname, subname_len);
tmp[subname_len] = 0;
if ( subname && subname_len > 0 && subver && *subname )
{
- AppIdServiceSubtype* sub =
- (AppIdServiceSubtype*)snort_calloc(sizeof(AppIdServiceSubtype));
+ snort::AppIdServiceSubtype* sub =
+ (snort::AppIdServiceSubtype*)snort_calloc(sizeof(snort::AppIdServiceSubtype));
char* tmp = (char*)snort_calloc(subname_len + 1);
memcpy(tmp, subname, subname_len);
tmp[subname_len] = 0;
#include "appid_utils/sf_multi_mpse.h"
#include "appid_utils/sf_mlmp.h"
-struct Packet;
+namespace snort
+{
struct AppIdServiceSubtype;
+struct Packet;
+}
class AppIdHttpSession;
class AppIdModuleConfig;
bool get_appid_from_url(char*, const char*, char**, const char*, AppId*, AppId*,
AppId*, AppId*, bool);
AppId get_appid_by_content_type(const char*, int);
- void get_server_vendor_version(const char*, int, char**, char**, AppIdServiceSubtype**);
+ void get_server_vendor_version(const char*, int, char**, char**, snort::AppIdServiceSubtype**);
void identify_user_agent(const char*, int, AppId&, AppId&, char**);
- void get_http_offsets(Packet*, AppIdHttpSession*);
+ void get_http_offsets(snort::Packet*, AppIdHttpSession*);
uint32_t parse_multiple_http_patterns(const char* pattern, tMlmpPattern*,
uint32_t numPartLimit, int level);
std::vector<HostUrlDetectorPattern*> host_url_patterns;
CHPListElement* chpList = nullptr;
- SearchTool url_matcher;
- SearchTool client_agent_matcher;
- SearchTool via_matcher;
- SearchTool content_type_matcher;
- SearchTool* field_matcher = nullptr;
- SearchTool* chp_matchers[MAX_PATTERN_TYPE + 1] = { nullptr };
+ snort::SearchTool url_matcher;
+ snort::SearchTool client_agent_matcher;
+ snort::SearchTool via_matcher;
+ snort::SearchTool content_type_matcher;
+ snort::SearchTool* field_matcher = nullptr;
+ snort::SearchTool* chp_matchers[MAX_PATTERN_TYPE + 1] = { nullptr };
tMlmpTree* host_url_matcher = nullptr;
tMlmpTree* rtmp_host_url_matcher = nullptr;
void Debug::print(const char*, int, uint64_t, const char*, ...) {}
#endif
+namespace snort
+{
// Stubs for packet
Packet::Packet(bool) { }
Packet::~Packet() { }
-// Stubs for inspectors
-unsigned AppIdSession::inspector_id = 0;
Inspector::Inspector() {}
Inspector::~Inspector() {}
bool Inspector::likes(Packet*) { return true; }
bool Inspector::get_buf(const char*, Packet*, InspectionBuffer&) { return true; }
class StreamSplitter* Inspector::get_splitter(bool) { return nullptr; }
-class AppIdInspector : public Inspector
+}
+
+class AppIdInspector : public snort::Inspector
{
public:
AppIdInspector(AppIdModule& ) {}
~AppIdInspector() {}
void eval(Packet*) {}
- bool configure(SnortConfig*) { return true; }
- void show(SnortConfig*) {}
+ bool configure(snort::SnortConfig*) { return true; }
+ void show(snort::SnortConfig*) {}
void tinit() {}
void tterm() {}
};
AppIdModule::AppIdModule()
: Module("a", "b") {}
AppIdModule::~AppIdModule() {}
-bool AppIdModule::begin(const char*, int, SnortConfig*)
+bool AppIdModule::begin(const char*, int, snort::SnortConfig*)
{
return false;
}
-bool AppIdModule::set(const char*, Value&, SnortConfig*)
+bool AppIdModule::set(const char*, snort::Value&, snort::SnortConfig*)
{
return false;
}
-bool AppIdModule::end(const char*, int, SnortConfig*)
+bool AppIdModule::end(const char*, int, snort::SnortConfig*)
{
return false;
}
{
return nullptr;
}
-ProfileStats* AppIdModule::get_profile() const
+
+snort::ProfileStats* AppIdModule::get_profile() const
{
return nullptr;
}
void show_stats(PegCount*, const PegInfo*, IndexVec&, const char*, FILE*) {}
// Stubs for appid sessions
-FlowData::FlowData(unsigned, Inspector*) {}
-FlowData::~FlowData() = default;
+snort::FlowData::FlowData(unsigned, Inspector*) {}
+snort::FlowData::~FlowData() = default;
+
+// Stubs for inspectors
+unsigned AppIdSession::inspector_id = 0;
AppIdSession::AppIdSession(IpProtocol, const SfIp*, uint16_t, AppIdInspector& inspector)
- : FlowData(inspector_id, (Inspector*)&inspector), inspector(inspector) {}
+ : snort::FlowData(inspector_id, (snort::Inspector*)&inspector), inspector(inspector) {}
AppIdSession::~AppIdSession() {}
AppIdHttpSession::AppIdHttpSession(AppIdSession& session)
: asd(session) {}
return 0;
}
+namespace snort
+{
// Stubs for search_tool.cc
SearchTool::SearchTool(const char*, bool) {}
SearchTool::~SearchTool() {}
memcpy(mp_arg, &mock_mp, sizeof(MatchedPatterns*));
return 0;
}
+}
// Stubs for appid_session.cc
static bool test_service_strstr_enabled = false;
#include <map>
#include "log/messages.h"
+#include "main/thread.h"
+#include "sfip/sf_ip.h"
#include "utils/cpp_macros.h"
+using namespace snort;
+
PADDING_GUARD_BEGIN
struct HostPortKey
{
#ifndef HOST_PORT_APP_CACHE_H
#define HOST_PORT_APP_CACHE_H
-#include "appid_api.h"
+#include "application_ids.h"
+#include "protocols/protocol_ids.h"
+
+namespace snort
+{
+struct SfIp;
+}
struct HostPortVal
{
public:
static void initialize();
static void terminate();
- static HostPortVal* find(const SfIp*, uint16_t port, IpProtocol);
- static bool add(const SfIp*, uint16_t port, IpProtocol, unsigned type, AppId);
+ static HostPortVal* find(const snort::SfIp*, uint16_t port, IpProtocol);
+ static bool add(const snort::SfIp*, uint16_t port, IpProtocol, unsigned type, AppId);
static void dump();
};
#include "protocols/packet.h"
#include "utils/util.h"
+using namespace snort;
+
//-------------------------------------------------------------------------
// appid option
//-------------------------------------------------------------------------
#include "profiler/profiler.h"
#include "protocols/packet.h"
+using namespace snort;
+
#define OVECCOUNT 30 /* should be a multiple of 3 */
enum LuaLogLevels
#include "client_plugins/client_detector.h"
#include "service_plugins/service_detector.h"
+namespace snort
+{
struct Packet;
+}
struct lua_State;
class AppIdSession;
uint16_t size = 0;
int dir = 0;
AppIdSession* asd;
- Packet* pkt = nullptr;
+ snort::Packet* pkt = nullptr;
uint8_t macAddress[6] = { 0 };
};
*/
static int create_detector_flow(lua_State* L)
{
- SfIp saddr;
- SfIp daddr;
+ snort::SfIp saddr;
+ snort::SfIp daddr;
AppIdDetector* ud = *UserData<AppIdDetector>::check(L, DETECTOR, 1);
LuaStateDescriptor* lsd = ud->validate_lua_state(true);
#include "protocols/eth.h"
#include "protocols/packet.h"
+using namespace snort;
+
#define DHCP_MAGIC_COOKIE 0x63825363
#define DHCP_OPTION55_LEN_MAX 255
int validate(AppIdDiscoveryArgs&) override;
// FIXIT-L - move to service discovery class
- static void AppIdFreeDhcpData(DHCPData*);
- static void AppIdFreeDhcpInfo(DHCPInfo*);
+ static void AppIdFreeDhcpData(snort::DHCPData*);
+ static void AppIdFreeDhcpInfo(snort::DHCPInfo*);
private:
int add_dhcp_info(AppIdSession&, unsigned op55_len, const uint8_t* op55, unsigned
#include "log/messages.h"
#include "sfip/sf_ip.h"
+using namespace snort;
+
static THREAD_LOCAL unsigned service_module_index = 0;
ServiceDetector::ServiceDetector()
void do_custom_init() override { }
void register_appid(AppId, unsigned extractsInfo) override;
- int service_inprocess(AppIdSession&, const Packet*, int dir);
- int add_service(AppIdSession&, const Packet*, int dir, AppId, const char* vendor = nullptr,
- const char* version = nullptr, const AppIdServiceSubtype* = nullptr);
- int add_service_consume_subtype(AppIdSession&, const Packet*, int dir, AppId,
- const char* vendor, const char* version, AppIdServiceSubtype*);
- int incompatible_data(AppIdSession&, const Packet*, int dir);
- int fail_service(AppIdSession&, const Packet*, int dir);
+ int service_inprocess(AppIdSession&, const snort::Packet*, int dir);
+ int add_service(AppIdSession&, const snort::Packet*, int dir, AppId, const char* vendor = nullptr,
+ const char* version = nullptr, const snort::AppIdServiceSubtype* = nullptr);
+ int add_service_consume_subtype(AppIdSession&, const snort::Packet*, int dir, AppId,
+ const char* vendor, const char* version, snort::AppIdServiceSubtype*);
+ int incompatible_data(AppIdSession&, const snort::Packet*, int dir);
+ int fail_service(AppIdSession&, const snort::Packet*, int dir);
void add_host_info(AppIdSession&, SERVICE_HOST_INFO_CODE, const void*)
{
void initialize_expected_session(AppIdSession&, AppIdSession&, uint64_t flags, APPID_SESSION_DIRECTION dir);
private:
- int update_service_data(AppIdSession&, const Packet*, int dir, AppId, const char* vendor,
+ int update_service_data(AppIdSession&, const snort::Packet*, int dir, AppId, const char* vendor,
const char* version);
};
#endif
#include "service_direct_connect.h"
+using namespace snort;
+
enum CONNECTION_STATES
{
CONN_STATE_INIT,
private:
int tcp_validate(const uint8_t* data, uint16_t size, const int dir, AppIdSession&,
- const Packet*, ServiceData*);
+ const snort::Packet*, ServiceData*);
int udp_validate(const uint8_t* data, uint16_t size, const int dir, AppIdSession&,
- const Packet*, ServiceData*);
+ const snort::Packet*, ServiceData*);
};
#endif
#include "service_regtest.h"
#endif
+using namespace snort;
+
static THREAD_LOCAL ServiceDetector* ftp_service = nullptr;
ProfileStats serviceMatchPerfStats;
class ServiceDetector;
class ServiceDiscoveryState;
+namespace snort
+{
+struct Packet;
+}
+
#define STATE_ID_INCONCLUSIVE_SERVICE_WEIGHT 3
#define STATE_ID_INVALID_CLIENT_THRESHOLD 9
#define STATE_ID_NEEDED_DUPE_DETRACT_COUNT 3
ServiceDetector* get_next_tcp_detector(AppIdDetectorsIterator&);
ServiceDetector* get_next_udp_detector(AppIdDetectorsIterator&);
- bool do_service_discovery(AppIdSession&, Packet*, int);
- int identify_service(AppIdSession&, Packet*, int dir);
- int fail_service(AppIdSession&, const Packet*, int dir, ServiceDetector*);
- int incompatible_data(AppIdSession&, const Packet*, int dir, ServiceDetector*);
+ bool do_service_discovery(AppIdSession&, snort::Packet*, int);
+ int identify_service(AppIdSession&, snort::Packet*, int dir);
+ int fail_service(AppIdSession&, const snort::Packet*, int dir, ServiceDetector*);
+ int incompatible_data(AppIdSession&, const snort::Packet*, int dir, ServiceDetector*);
static int add_ftp_service_state(AppIdSession&);
private:
ServiceDiscovery(AppIdInspector& ins);
void initialize() override;
- void get_next_service(const Packet*, const int dir, AppIdSession&, ServiceDiscoveryState*);
+ void get_next_service(const snort::Packet*, const int dir, AppIdSession&, ServiceDiscoveryState*);
void get_port_based_services(IpProtocol, uint16_t port, AppIdSession&);
- void match_by_pattern(AppIdSession&, const Packet*, IpProtocol);
+ void match_by_pattern(AppIdSession&, const snort::Packet*, IpProtocol);
std::map<uint16_t, std::vector<ServiceDetector*> > tcp_services;
std::map<uint16_t, std::vector<ServiceDetector*> > udp_services;
#include "app_info_table.h"
#include "protocols/packet.h"
+using namespace snort;
+
#define FTP_PORT 21
enum FTPState
int validate(AppIdDiscoveryArgs&) override;
private:
- void create_expected_session(AppIdSession& asd,const Packet* pkt, const SfIp* cliIp,
- uint16_t cliPort, const SfIp* srvIp, uint16_t srvPort, IpProtocol proto,
- int flags, APPID_SESSION_DIRECTION dir);
+ void create_expected_session(AppIdSession& asd,const snort::Packet* pkt,
+ const snort::SfIp* cliIp, uint16_t cliPort, const snort::SfIp* srvIp, uint16_t srvPort,
+ IpProtocol proto, int flags, APPID_SESSION_DIRECTION dir);
int16_t ftp_data_app_id = 0;
};
#include "protocols/packet.h"
#include "search_engines/search_tool.h"
+using namespace snort;
+
#define MDNS_PORT 5353
#define PATTERN_REFERENCE_PTR 3
#define PATTERN_STR_LOCAL_1 "\005local"
{ 5353, IpProtocol::UDP, false },
};
- matcher = new SearchTool("ac_full", true);
+ matcher = new snort::SearchTool("ac_full", true);
for (unsigned i = 0; i < sizeof(patterns) / sizeof(*patterns); i++)
matcher->add((const char*)patterns[i].pattern, patterns[i].length, &patterns[i]);
matcher->prep();
#include "service_detector.h"
+namespace snort
+{
class SearchTool;
+}
class ServiceDiscovery;
struct MatchedPatterns;
void destroy_match_list();
void destory_matcher();
int validate_reply(const uint8_t* data, uint16_t size);
- int analyze_user(AppIdSession&, const Packet*, uint16_t size);
+ int analyze_user(AppIdSession&, const snort::Packet*, uint16_t size);
int reference_pointer(const char* start_ptr, const char** resp_endptr, int* start_index,
uint16_t data_size, uint8_t* user_name_len, unsigned size);
- SearchTool* matcher = nullptr;
+ snort::SearchTool* matcher = nullptr;
MatchedPatterns* patternList= nullptr;
};
#endif
#include "dcerpc.h"
#include "protocols/packet.h"
+using namespace snort;
+
#define NBSS_PORT 139
#define NBNS_NB 32
int validate(AppIdDiscoveryArgs&) override;
- static void AppIdFreeSMBData(FpSMBData*);
+ static void AppIdFreeSMBData(snort::FpSMBData*);
private:
void add_smb_info(AppIdSession&, unsigned major, unsigned minor, uint32_t flags);
goto bail;
if (port && args.pkt)
{
- const SfIp* sip;
- const SfIp* dip;
+ const snort::SfIp* sip;
+ const snort::SfIp* dip;
dip = args.pkt->ptrs.ip_api.get_dst();
sip = args.pkt->ptrs.ip_api.get_src();
#include "log/messages.h"
#include "protocols/packet.h"
+using namespace snort;
+
/*#define APPID_DEBUG_RPC 1 */
enum RPCState
int rpc_udp_validate(AppIdDiscoveryArgs&);
int rpc_tcp_validate(AppIdDiscoveryArgs&);
int validate_packet(const uint8_t* data, uint16_t size, int dir, AppIdSession&,
- Packet*, ServiceRPCData*, const char** pname, uint32_t* program);
+ snort::Packet*, ServiceRPCData*, const char** pname, uint32_t* program);
int16_t app_id = 0;
};
#endif
sizeof(ServiceRSHELLData));
tmp_rd->state = RSHELL_STATE_STDERR_CONNECT_SYN;
tmp_rd->parent = rd;
- const SfIp* dip = args.pkt->ptrs.ip_api.get_dst();
- const SfIp* sip = args.pkt->ptrs.ip_api.get_src();
+ const snort::SfIp* dip = args.pkt->ptrs.ip_api.get_dst();
+ const snort::SfIp* sip = args.pkt->ptrs.ip_api.get_src();
AppIdSession* pf = AppIdSession::create_future_session(args.pkt, dip, 0, sip,
(uint16_t)port, IpProtocol::TCP, app_id, APPID_EARLY_SESSION_FLAG_FW_RULE,
handler->get_inspector());
sd->state = SNMP_STATE_RESPONSE;
/*adding expected connection in case the server doesn't send from 161*/
- const SfIp* dip = args.pkt->ptrs.ip_api.get_dst();
- const SfIp* sip = args.pkt->ptrs.ip_api.get_src();
+ const snort::SfIp* dip = args.pkt->ptrs.ip_api.get_dst();
+ const snort::SfIp* sip = args.pkt->ptrs.ip_api.get_src();
AppIdSession* pf = AppIdSession::create_future_session(args.pkt, dip, 0, sip,
args.pkt->ptrs.sp, args.asd.protocol, app_id, 0, handler->get_inspector());
if (pf)
#include "app_info_table.h"
#include "protocols/packet.h"
+using namespace snort;
+
#define SSL_PORT 443
enum SSLContentType
ssl_patterns_free(&service_ssl_config.DetectorSSLCnamePatternList);
}
-bool setSSLSquelch(Packet* p, int type, AppId appId, AppIdInspector& inspector)
+bool setSSLSquelch(snort::Packet* p, int type, AppId appId, AppIdInspector& inspector)
{
if (!AppInfoManager::get_instance().get_app_info_flags(appId, APPINFO_FLAG_SSL_SQUELCH))
return false;
- const SfIp* dip = p->ptrs.ip_api.get_dst();
- const SfIp* sip = p->ptrs.ip_api.get_src();
+ const snort::SfIp* dip = p->ptrs.ip_api.get_dst();
+ const snort::SfIp* sip = p->ptrs.ip_api.get_src();
AppIdSession* asd = AppIdSession::create_future_session(p, sip, 0, dip, p->ptrs.dp, IpProtocol::TCP,
appId, 0, inspector);
if ( asd )
int ssl_add_cert_pattern(uint8_t*, size_t, uint8_t, AppId);
int ssl_add_cname_pattern(uint8_t*, size_t, uint8_t, AppId);
void ssl_detector_free_patterns();
-bool setSSLSquelch(Packet*, int type, AppId, AppIdInspector& inspector);
+bool setSSLSquelch(snort::Packet*, int type, AppId, AppIdInspector& inspector);
#endif
int mode = 0;
uint16_t block = 0;
uint16_t tmp = 0;
- const SfIp* sip = nullptr;
- const SfIp* dip = nullptr;
+ const snort::SfIp* sip = nullptr;
+ const snort::SfIp* dip = nullptr;
AppIdSession* pf = nullptr;
const uint8_t* data = args.data;
uint16_t size = args.size;
#include "time/packet_time.h"
#include "utils/util.h"
+using namespace snort;
+
ServiceDiscoveryState::ServiceDiscoveryState()
{
state = SERVICE_ID_STATE::SEARCHING_PORT_PATTERN;
~ServiceDiscoveryState();
ServiceDetector* select_detector_by_brute_force(IpProtocol proto);
void set_service_id_valid(ServiceDetector* sd);
- void set_service_id_failed(AppIdSession& asd, const SfIp* client_ip,
+ void set_service_id_failed(AppIdSession& asd, const snort::SfIp* client_ip,
unsigned invalid_delta = 0);
- void update_service_incompatiable(const SfIp* ip);
+ void update_service_incompatiable(const snort::SfIp* ip);
SERVICE_ID_STATE get_state() const
{
AppIdDetectorList* brute_force_mgr = nullptr;
unsigned valid_count = 0;
unsigned detract_count = 0;
- SfIp last_detract;
+ snort::SfIp last_detract;
// consecutive incompatible flows - incompatible means client packet did not match.
unsigned invalid_client_count = 0;
* different every time, then consecutive incompatible status indicate that flow is not using
* specific service.
*/
- SfIp last_invalid_client;
+ snort::SfIp last_invalid_client;
time_t reset_time;
};
public:
static void initialize();
static void clean();
- static ServiceDiscoveryState* add(const SfIp*, IpProtocol, uint16_t port, bool decrypted);
- static ServiceDiscoveryState* get(const SfIp*, IpProtocol, uint16_t port, bool decrypted);
- static void remove(const SfIp*, IpProtocol, uint16_t port, bool decrypted);
- static void check_reset(AppIdSession& asd, const SfIp* ip, uint16_t port);
+ static ServiceDiscoveryState* add(const snort::SfIp*, IpProtocol, uint16_t port, bool decrypted);
+ static ServiceDiscoveryState* get(const snort::SfIp*, IpProtocol, uint16_t port, bool decrypted);
+ static void remove(const snort::SfIp*, IpProtocol, uint16_t port, bool decrypted);
+ static void check_reset(AppIdSession& asd, const snort::SfIp* ip, uint16_t port);
static void dump_stats();
};
#include <CppUTest/CommandLineTestRunner.h>
#include <CppUTest/TestHarness.h>
+using namespace snort;
+
void BootpServiceDetector::AppIdFreeDhcpData(DHCPData* data)
{
delete data;
#include <CppUTest/TestHarness.h>
#include <CppUTestExt/MockSupport.h>
+using namespace snort;
+
+namespace snort
+{
AppIdApi appid_api;
+}
const char* content_type = nullptr;
const char* cookie = nullptr;
typedef uint64_t Trace;
class Value;
+namespace snort
+{
Inspector::Inspector()
{
set_api(nullptr);
bool Inspector::likes(Packet*) { return true; }
bool Inspector::get_buf(const char*, Packet*, InspectionBuffer&) { return true; }
class StreamSplitter* Inspector::get_splitter(bool) { return nullptr; }
+}
class AppIdModule
{
};
-class AppIdInspector : public Inspector
+class AppIdInspector : public snort::Inspector
{
public:
AppIdInspector(AppIdModule& ) { }
~AppIdInspector() { }
- void eval(Packet*) { }
- bool configure(SnortConfig*) { return true; }
- void show(SnortConfig*) { }
+ void eval(snort::Packet*) { }
+ bool configure(snort::SnortConfig*) { return true; }
+ void show(snort::SnortConfig*) { }
void tinit() { }
void tterm() { }
};
#include "application_ids.h"
#include "thirdparty_appid_types.h"
+namespace snort
+{
struct Packet;
+}
#define THIRD_PARTY_APP_ID_API_VERSION 1
using ThirdPartyAppIDModFini = int (*)();
using ThirdPartyAppIDSessionCreate = void*(*)();
using ThirdPartyAppIDSessionDelete = int (*)(void* tpsession, int just_reset_state);
-using ThirdPartyAppIDSessionProcess = int (*)(void* tpsession, Packet*, int direction, // in
+using ThirdPartyAppIDSessionProcess = int (*)(void* tpsession, snort::Packet*, int direction, // in
AppId*, int* confidence, AppId** proto_list, ThirdPartyAppIDAttributeData** attribute_data);
using ThirdPartyAppIDPrintStats = int (*)();
using ThirdPartyAppIDResetStats = int (*)();
#ifndef THIRDPARTY_APPID_TYPES_H
#define THIRDPARTY_APPID_TYPES_H
-#define BUILD_NAVL_SUPPORT 1
+//#define BUILD_NAVL_SUPPORT 1
#include <cstdint>
#include "profiler/profiler.h"
#include "stream/stream.h"
+using namespace snort;
+
#define MODULE_SYMBOL "thirdparty_appid_impl_module"
static THREAD_LOCAL void* module_handle = nullptr;
class AppIdSession;
struct ThirdPartyAppIDModule;
struct ThirdPartyAppIDAttributeData;
+namespace snort
+{
struct Packet;
+}
extern THREAD_LOCAL ThirdPartyAppIDModule* thirdparty_appid_module;
void ThirdPartyAppIDInit(const AppIdModuleConfig*);
void ThirdPartyAppIDReconfigure();
void ThirdPartyAppIDFini();
-bool do_third_party_discovery(AppIdSession&, IpProtocol, const SfIp*, Packet*, int&);
+bool do_third_party_discovery(AppIdSession&, IpProtocol, const snort::SfIp*, snort::Packet*, int&);
inline bool is_third_party_appid_done(void* tp_session)
{
#include "arp_module.h"
+using namespace snort;
+
#define ARPSPOOF_UNICAST_ARP_REQUEST_STR \
"unicast ARP request"
#define ARPSPOOF_ETHERFRAME_ARP_MISMATCH_SRC_STR \
#define ARPSPOOF_ARP_CACHE_OVERWRITE_ATTACK 4
extern THREAD_LOCAL SimpleStats asstats;
-extern THREAD_LOCAL ProfileStats arpPerfStats;
+extern THREAD_LOCAL snort::ProfileStats arpPerfStats;
struct IPMacEntry
{
IPMacEntryList ipmel;
};
-class ArpSpoofModule : public Module
+class ArpSpoofModule : public snort::Module
{
public:
ArpSpoofModule();
~ArpSpoofModule() override;
- bool set(const char*, Value&, SnortConfig*) override;
- bool begin(const char*, int, SnortConfig*) override;
- bool end(const char*, int, SnortConfig*) override;
+ bool set(const char*, snort::Value&, snort::SnortConfig*) override;
+ bool begin(const char*, int, snort::SnortConfig*) override;
+ bool end(const char*, int, snort::SnortConfig*) override;
ArpSpoofConfig* get_config();
unsigned get_gid() const override
{ return GID_ARP_SPOOF; }
- const RuleMap* get_rules() const override;
- ProfileStats* get_profile() const override;
+ const snort::RuleMap* get_rules() const override;
+ snort::ProfileStats* get_profile() const override;
Usage get_usage() const override
{ return INSPECT; }
#include "arp_module.h"
+using namespace snort;
+
static const uint8_t bcast[6] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
THREAD_LOCAL ProfileStats arpPerfStats;
}
else
{
- const wlan::WifiHdr* wifih = layer::get_wifi_layer(p);
+ const snort::wlan::WifiHdr* wifih = snort::layer::get_wifi_layer(p);
if (wifih == nullptr)
return;
}
}
- const arp::EtherARP* ah = layer::get_arp_layer(p);
+ const snort::arp::EtherARP* ah = snort::layer::get_arp_layer(p);
/* is the ARP protocol type IP and the ARP hardware type Ethernet? */
if ((ntohs(ah->ea_hdr.ar_hrd) != 0x0001) ||
#include "parser/parse_ip.h"
#include "protocols/packet.h"
+using namespace snort;
using namespace std;
#define FILE_KEY ".file"
};
extern THREAD_LOCAL BindStats bstats;
-extern THREAD_LOCAL ProfileStats bindPerfStats;
+extern THREAD_LOCAL snort::ProfileStats bindPerfStats;
-class BinderModule : public Module
+class BinderModule : public snort::Module
{
public:
BinderModule();
~BinderModule() override;
- bool set(const char*, Value&, SnortConfig*) override;
- bool begin(const char*, int, SnortConfig*) override;
- bool end(const char*, int, SnortConfig*) override;
+ bool set(const char*, snort::Value&, snort::SnortConfig*) override;
+ bool begin(const char*, int, snort::SnortConfig*) override;
+ bool end(const char*, int, snort::SnortConfig*) override;
// used to create default binder
void add(const char* service, const char* type);
const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
- ProfileStats* get_profile() const override;
+ snort::ProfileStats* get_profile() const override;
std::vector<Binding*>& get_data();
#include "bind_module.h"
#include "binding.h"
+using namespace snort;
using namespace std;
THREAD_LOCAL ProfileStats bindPerfStats;
#include "framework/bits.h"
#include "sfip/sf_ipvar.h"
+namespace snort
+{
class Flow;
struct Packet;
+}
+
struct BindWhen
{
enum Role
Binding();
~Binding();
- bool check_all(const Flow*, Packet*) const;
- bool check_ips_policy(const Flow*) const;
- bool check_iface(const Packet*) const;
- bool check_vlan(const Flow*) const;
- bool check_addr(const Flow*) const;
- DirResult check_split_addr(const Flow*, const Packet*, const DirResult) const;
- bool check_proto(const Flow*) const;
- bool check_port(const Flow*) const;
- DirResult check_split_port(const Flow*, const Packet*, const DirResult) const;
- bool check_service(const Flow*) const;
- DirResult check_zone(const Packet*, const DirResult) const;
+ bool check_all(const snort::Flow*, snort::Packet*) const;
+ bool check_ips_policy(const snort::Flow*) const;
+ bool check_iface(const snort::Packet*) const;
+ bool check_vlan(const snort::Flow*) const;
+ bool check_addr(const snort::Flow*) const;
+ DirResult check_split_addr(const snort::Flow*, const snort::Packet*, const DirResult) const;
+ bool check_proto(const snort::Flow*) const;
+ bool check_port(const snort::Flow*) const;
+ DirResult check_split_port(const snort::Flow*, const snort::Packet*, const DirResult) const;
+ bool check_service(const snort::Flow*) const;
+ DirResult check_zone(const snort::Packet*, const DirResult) const;
};
#endif
#include "managers/plugin_manager.h"
+using namespace snort;
+
extern const BaseApi* nin_binder;
extern const BaseApi* nin_normalize;
extern const BaseApi* nin_perf_monitor;
#include "protocols/tcp_options.h"
#include "stream/tcp/tcp_normalizer.h"
+using namespace snort;
+
enum PegCounts
{
PC_IP4_TRIM,
{
NormMode mode = NORM_MODE_ON;
- if ( get_inspection_policy()->policy_mode != POLICY_MODE__INLINE )
+ if ( snort::get_inspection_policy()->policy_mode != POLICY_MODE__INLINE )
mode = NORM_MODE_TEST;
if ( !SFDAQ::forwarding_packet(p->pkth) )
static int Norm_IP4(
NormalizerConfig* c, Packet* p, uint8_t layer, int changes)
{
- IP4Hdr* h = (IP4Hdr*)const_cast<uint8_t*>(p->layers[layer].start);
+ ip::IP4Hdr* h = (ip::IP4Hdr*)const_cast<uint8_t*>(p->layers[layer].start);
uint16_t fragbits = ntohs(h->ip_off);
uint16_t origbits = fragbits;
const NormMode mode = get_norm_mode(p);
#include "normalize.h"
struct NormalizerConfig;
+namespace snort
+{
struct Packet;
+}
// all normalizers look like this:
// the return is 1 if packet was changed, else 0
typedef int (* NormalFunc)( // FIXIT-L why is this exposed?
- struct NormalizerConfig*, Packet*, uint8_t layer, int changes);
+ struct NormalizerConfig*, snort::Packet*, uint8_t layer, int changes);
extern const PegInfo norm_names[];
// these must be in the same order PROTO_IDs are defined!
// if entry is NULL, proto doesn't have normalization or it is disabled
- NormalFunc normalizers[PacketManager::max_protocols()];
+ NormalFunc normalizers[snort::PacketManager::max_protocols()];
};
int Norm_SetConfig(NormalizerConfig*);
-int Norm_Packet(NormalizerConfig*, Packet*);
+int Norm_Packet(NormalizerConfig*, snort::Packet*);
inline void Norm_Enable(NormalizerConfig* nc, NormFlags nf)
{
#include "main/policy.h"
#include "stream/tcp/tcp_normalizer.h"
+using namespace snort;
using namespace std;
static bool allow_names(NormalizerConfig* config, const char* s)
{
if ( !strcmp(fqn, NORM_NAME) )
{
- NetworkPolicy* policy = get_network_policy();
+ NetworkPolicy* policy = snort::get_network_policy();
// FIXIT-M untangle these policies. this is a workaround for loading inspection-only confs
if ( policy == nullptr )
{
set_network_policy(sc);
- policy = get_network_policy();
+ policy = snort::get_network_policy();
set_network_policy((NetworkPolicy*)nullptr);
}
#define NORM_NAME "normalizer"
#define NORM_HELP "packet scrubbing for inline mode"
-extern THREAD_LOCAL ProfileStats norm_perf_stats;
+extern THREAD_LOCAL snort::ProfileStats norm_perf_stats;
-class NormalizeModule : public Module
+class NormalizeModule : public snort::Module
{
public:
NormalizeModule();
~NormalizeModule() override;
- bool set(const char*, Value&, SnortConfig*) override;
- bool begin(const char*, int, SnortConfig*) override;
- bool end(const char*, int, SnortConfig*) override;
+ bool set(const char*, snort::Value&, snort::SnortConfig*) override;
+ bool begin(const char*, int, snort::SnortConfig*) override;
+ bool end(const char*, int, snort::SnortConfig*) override;
- ProfileStats* get_profile() const override;
+ snort::ProfileStats* get_profile() const override;
const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
{ return INSPECT; }
private:
- bool set_ip4(const char*, Value&, SnortConfig*);
- bool set_tcp(const char*, Value&, SnortConfig*);
+ bool set_ip4(const char*, snort::Value&, snort::SnortConfig*);
+ bool set_tcp(const char*, snort::Value&, snort::SnortConfig*);
void add_test_peg(const PegInfo&) const;
#include "norm_module.h"
+using namespace snort;
+
THREAD_LOCAL ProfileStats norm_perf_stats;
static THREAD_LOCAL uint32_t t_flags = 0;
if ( Norm_IsEnabled(nc, NORM_IP4_TTL) )
{
- NetworkPolicy* policy = get_network_policy();
+ NetworkPolicy* policy = snort::get_network_policy();
LogMessage("%12s: %s (min=%d, new=%d)\n", "ip4.ttl", ON,
policy->min_ttl, policy->new_ttl);
}
if ( Norm_IsEnabled(nc, NORM_IP6_TTL) )
{
- NetworkPolicy* policy = get_network_policy();
+ NetworkPolicy* policy = snort::get_network_policy();
LogMessage("%12s: %s (min=%d, new=%d)\n", "ip6.hops",
ON, policy->min_ttl, policy->new_ttl);
}
public:
Normalizer(const NormalizerConfig&);
- bool configure(SnortConfig*) override;
- void show(SnortConfig*) override;
- void eval(Packet*) override;
+ bool configure(snort::SnortConfig*) override;
+ void show(snort::SnortConfig*) override;
+ void eval(snort::Packet*) override;
private:
NormalizerConfig config;
// but would be better if binder could select
// in which case normal_mask must be moved to flow
// from cwaxman - why can't normal_mask be applied directly from Normalizer?
-bool Normalizer::configure(SnortConfig*)
+bool Normalizer::configure(snort::SnortConfig*)
{
// FIXIT-M move entire config to network policy? Leaving split loads the currently selected
// network policy with whichever instantiation of an inspection policy this normalize is in
- NetworkPolicy* nap = get_network_policy();
+ NetworkPolicy* nap = snort::get_network_policy();
nap->normal_mask = config.normalizer_flags;
if ( !(t_flags & nf) )
return false;
- if ( get_inspection_policy()->policy_mode != POLICY_MODE__INLINE )
+ if ( snort::get_inspection_policy()->policy_mode != POLICY_MODE__INLINE )
return false;
- NetworkPolicy* nap = get_network_policy();
+ NetworkPolicy* nap = snort::get_network_policy();
return ( (nap->normal_mask & nf) != 0 );
}
{
if (Normalize_IsEnabled(nf))
{
- const PolicyMode mode = get_inspection_policy()->policy_mode;
+ const PolicyMode mode = snort::get_inspection_policy()->policy_mode;
if ( mode == POLICY_MODE__INLINE )
return NORM_MODE_ON;
return NORM_MODE_TEST;
}
-void Normalizer::show(SnortConfig* sc)
+void Normalizer::show(snort::SnortConfig* sc)
{
LogMessage("Normalizer config:\n");
Print_IP4(sc, &config);
Print_TCP(&config);
}
-void Normalizer::eval(Packet* p)
+void Normalizer::eval(snort::Packet* p)
{
Profile profile(norm_perf_stats);
};
typedef PegCount (* NormPegs)[NORM_MODE_MAX];
-struct SnortConfig;
bool Normalize_IsEnabled(NormFlags);
NormMode Normalize_GetMode(NormFlags);
#include "packet_capture.h"
+using namespace snort;
using namespace std;
static int enable(lua_State*);
PegCount matched;
};
-class CaptureModule : public Module
+class CaptureModule : public snort::Module
{
public:
CaptureModule();
const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
- ProfileStats* get_profile() const override;
- const Command* get_commands() const override;
- bool set(const char*, Value&, SnortConfig*) override;
+ snort::ProfileStats* get_profile() const override;
+ const snort::Command* get_commands() const override;
+ bool set(const char*, snort::Value&, snort::SnortConfig*) override;
void get_config(CaptureConfig&);
};
extern THREAD_LOCAL CaptureStats cap_count_stats;
-extern THREAD_LOCAL ProfileStats cap_prof_stats;
+extern THREAD_LOCAL snort::ProfileStats cap_prof_stats;
#endif
#include "capture_module.h"
+using namespace snort;
using namespace std;
#define FILE_NAME "packet_capture.pcap"
#include "utils/util.h"
#endif
+using namespace snort;
using namespace std;
BaseTracker::BaseTracker(PerfConfig* perf)
#include "log/messages.h"
#include "protocols/packet.h"
+using namespace snort;
+
#define TRACKER_NAME PERF_NAME "_flow_ip"
struct FlowStateKey
~FlowIPTracker() override;
void reset() override;
- void update(Packet*) override;
+ void update(snort::Packet*) override;
void process(bool) override;
- int update_state(const SfIp* src_addr, const SfIp* dst_addr, FlowState);
+ int update_state(const snort::SfIp* src_addr, const snort::SfIp* dst_addr, FlowState);
private:
FlowStateValue stats;
XHash* ip_map;
char ip_a[41], ip_b[41];
- FlowStateValue* find_stats(const SfIp* src_addr, const SfIp* dst_addr, int* swapped);
+ FlowStateValue* find_stats(const snort::SfIp* src_addr, const snort::SfIp* dst_addr, int* swapped);
void write_stats();
void display_stats();
};
#include "catch/snort_catch.h"
#endif
+using namespace snort;
+
#define TRACKER_NAME PERF_NAME "_flow"
#define MAX_PKT_LEN 9000
public:
FlowTracker(PerfConfig* perf);
- void update(Packet*) override;
+ void update(snort::Packet*) override;
void process(bool) override;
protected:
#include "managers/module_manager.h"
+using namespace snort;
+
//-------------------------------------------------------------------------
// perf attributes
//-------------------------------------------------------------------------
struct PerfConfig:public PerfConfigBase
{
- std::vector<Module*> modules;
+ std::vector<snort::Module*> modules;
std::vector<IndexVec> mod_peg_idxs;
};
/* The Module Class for incorporation into Snort++ */
-class PerfMonModule : public Module
+class PerfMonModule : public snort::Module
{
public:
PerfMonModule();
- bool set(const char*, Value&, SnortConfig*) override;
- bool begin(const char*, int, SnortConfig*) override;
- bool end(const char*, int, SnortConfig*) override;
+ bool set(const char*, snort::Value&, snort::SnortConfig*) override;
+ bool begin(const char*, int, snort::SnortConfig*) override;
+ bool end(const char*, int, snort::SnortConfig*) override;
const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
- ProfileStats* get_profile() const override;
+ snort::ProfileStats* get_profile() const override;
void get_config(PerfConfig&);
};
extern THREAD_LOCAL SimpleStats pmstats;
-extern THREAD_LOCAL ProfileStats perfmonStats;
+extern THREAD_LOCAL snort::ProfileStats perfmonStats;
#endif
#include "catch/snort_catch.h"
#endif
+using namespace snort;
+
THREAD_LOCAL SimpleStats pmstats;
THREAD_LOCAL ProfileStats perfmonStats;
#include "perf_module.h"
+namespace snort
+{
struct Packet;
+}
extern PerfConfig* perfmon_config; // FIXIT-M shouldn't be needed externally
extern THREAD_LOCAL bool perfmon_rotate_perf_file;
file_name, mode, get_error(errno));
}
- if (chown(file_name, SnortConfig::get_uid(), SnortConfig::get_gid()) != 0)
+ if (chown(file_name, snort::SnortConfig::get_uid(),
+ snort::SnortConfig::get_gid()) != 0)
{
WarningMessage("perfmonitor: Unable to change permissions of "
"stats file '%s' to user:%d and group:%d: %s.\n",
- file_name, SnortConfig::get_uid(), SnortConfig::get_gid(), get_error(
- errno));
+ file_name, snort::SnortConfig::get_uid(), snort::SnortConfig::get_gid(),
+ get_error(errno));
}
}
}
public:
virtual void reset() {}
- virtual void update(Packet*) {}
+ virtual void update(snort::Packet*) {}
virtual void process(bool /*summary*/) {} // FIXIT-M get rid of this step.
virtual void update_time(time_t time) final { cur_time = time; }
#include "utils/util.h"
#include "utils/util_cstring.h"
+using namespace snort;
+
/*
IP COLLECTION INTERFACE
struct IP_PORT
{
- SfCidr ip;
+ snort::SfCidr ip;
PORTSET portset;
char notflag;
};
255.255.255.255, or 0xffffffff, or -1.
*/
IPSET* ipset_new();
-int ipset_add(IPSET* ipset, SfCidr* ip, void* port, int notflag);
-int ipset_contains(IPSET* ipset, const SfIp* ip, void* port);
+int ipset_add(IPSET* ipset, snort::SfCidr* ip, void* port, int notflag);
+int ipset_contains(IPSET* ipset, const snort::SfIp* ip, void* port);
IPSET* ipset_copy(IPSET* ipset);
void ipset_free(IPSET* ipset);
int ipset_print(IPSET* ipset);
#include "ps_inspect.h"
#include "ps_module.h"
+using namespace snort;
+
THREAD_LOCAL SimpleStats spstats;
THREAD_LOCAL ProfileStats psPerfStats;
#include "ps_inspect.h"
+using namespace snort;
+
PADDING_GUARD_BEGIN
struct PS_HASH_KEY
{
#include "sfip/sf_ip.h"
#include "ipobj.h"
+namespace snort
+{
+struct Packet;
+}
+
#define PS_OPEN_PORTS 8
#define PS_PROTO_NONE 0x00
unsigned short low_p;
unsigned short u_ports;
- SfIp high_ip;
- SfIp low_ip;
- SfIp u_ips;
+ snort::SfIp high_ip;
+ snort::SfIp low_ip;
+ snort::SfIp u_ips;
unsigned short open_ports[PS_OPEN_PORTS];
unsigned char open_ports_cnt;
struct PS_PKT
{
- struct Packet* pkt;
+ snort::Packet* pkt;
PS_TRACKER* scanner;
PS_TRACKER* scanned;
int proto;
int reverse_pkt;
- PS_PKT(Packet*);
+ PS_PKT(snort::Packet*);
};
void ps_cleanup();
#include "framework/inspector.h"
#include "ps_detect.h"
+namespace snort
+{
struct SfIp;
+}
struct PS_PROTO;
struct PS_TRACKER;
struct PS_PKT;
-class PortScan : public Inspector
+class PortScan : public snort::Inspector
{
public:
PortScan(class PortScanModule*);
~PortScan() override;
- void show(SnortConfig*) override;
- void eval(Packet*) override;
+ void show(snort::SnortConfig*) override;
+ void eval(snort::Packet*) override;
void tinit() override;
void tterm() override;
private:
- void ps_parse(SnortConfig*, char*);
+ void ps_parse(snort::SnortConfig*, char*);
- bool ps_ignore_ip(
- const SfIp* scanner, uint16_t scanner_port,
- const SfIp* scanned, uint16_t scanned_port);
+ bool ps_ignore_ip( const snort::SfIp* scanner, uint16_t scanner_port,
+ const snort::SfIp* scanned, uint16_t scanned_port);
bool ps_filter_ignore(PS_PKT*);
int ps_get_proto(PS_PKT*, int* proto);
void ps_proto_update_window(unsigned window, PS_PROTO*, time_t pkt_time);
- int ps_proto_update(
- PS_PROTO*, int ps_cnt, int pri_cnt, unsigned window, const SfIp* ip,
+ int ps_proto_update( PS_PROTO*, int ps_cnt, int pri_cnt, unsigned window, const snort::SfIp* ip,
u_short port, time_t pkt_time);
void ps_tracker_update_ip(PS_PKT*, PS_TRACKER* scanner, PS_TRACKER* scanned);
#include <cassert>
+using namespace snort;
+
//-------------------------------------------------------------------------
// port_scan params
//-------------------------------------------------------------------------
//-------------------------------------------------------------------------
extern THREAD_LOCAL SimpleStats spstats;
-extern THREAD_LOCAL ProfileStats psPerfStats;
+extern THREAD_LOCAL snort::ProfileStats psPerfStats;
struct PortscanConfig;
-class PortScanModule : public Module
+class PortScanModule : public snort::Module
{
public:
PortScanModule();
~PortScanModule() override;
- bool set(const char*, Value&, SnortConfig*) override;
- bool begin(const char*, int, SnortConfig*) override;
+ bool set(const char*, snort::Value&, snort::SnortConfig*) override;
+ bool begin(const char*, int, snort::SnortConfig*) override;
const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
- ProfileStats* get_profile() const override;
- const RuleMap* get_rules() const override;
+ snort::ProfileStats* get_profile() const override;
+ const snort::RuleMap* get_rules() const override;
unsigned get_gid() const override
{ return GID_PORT_SCAN; }
#include "reputation_module.h"
+using namespace snort;
+
THREAD_LOCAL ProfileStats reputationPerfStats;
THREAD_LOCAL ReputationStats reputationstats;
bool disabled = false;
};
-class ReputationFlowData : public FlowData
+class ReputationFlowData : public snort::FlowData
{
public:
- ReputationFlowData() : FlowData(inspector_id){}
+ ReputationFlowData() : snort::FlowData(inspector_id){}
static void init()
- { inspector_id = FlowData::create_flow_data_id(); }
+ { inspector_id = snort::FlowData::create_flow_data_id(); }
public:
static unsigned inspector_id;
#include "reputation_parse.h"
+using namespace snort;
using namespace std;
#define REPUTATION_EVENT_BLACKLIST_STR \
#define REPUTATION_NAME "reputation"
#define REPUTATION_HELP "reputation inspection"
+namespace snort
+{
struct SnortConfig;
+}
-extern THREAD_LOCAL ProfileStats reputationPerfStats;
+extern THREAD_LOCAL snort::ProfileStats reputationPerfStats;
extern unsigned long total_duplicates;
extern unsigned long total_invalids;
-class ReputationModule : public Module
+class ReputationModule : public snort::Module
{
public:
ReputationModule();
~ReputationModule() override;
- bool set(const char*, Value&, SnortConfig*) override;
- bool begin(const char*, int, SnortConfig*) override;
- bool end(const char*, int, SnortConfig*) override;
+ bool set(const char*, snort::Value&, snort::SnortConfig*) override;
+ bool begin(const char*, int, snort::SnortConfig*) override;
+ bool end(const char*, int, snort::SnortConfig*) override;
unsigned get_gid() const override
{ return GID_REPUTATION; }
- const RuleMap* get_rules() const override;
+ const snort::RuleMap* get_rules() const override;
const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
- ProfileStats* get_profile() const override;
+ snort::ProfileStats* get_profile() const override;
ReputationConfig* get_data();
return bytesAllocated;
}
-static int AddIPtoList(SfCidr* ipAddr,INFO ipInfo_ptr, ReputationConfig* config)
+static int AddIPtoList(snort::SfCidr* ipAddr,INFO ipInfo_ptr, ReputationConfig* config)
{
int iRet;
int iFinalRet = IP_INSERT_SUCCESS;
}
// FIXIT-L X Remove this or at least move it to SfCidr?
-static int snort_pton__address(char const* src, SfCidr* dest)
+static int snort_pton__address(char const* src, snort::SfCidr* dest)
{
unsigned char _temp[sizeof(struct in6_addr)];
// FIXIT-L X Remove this or at least move it to SfCidr?
#define isident(x) (isxdigit((x)) || (x) == ':' || (x) == '.')
-static int snort_pton(char const* src, SfCidr* dest)
+static int snort_pton(char const* src, snort::SfCidr* dest)
{
char ipbuf[INET6_ADDRSTRLEN];
char cidrbuf[sizeof("128")];
static int ProcessLine(char* line, INFO info, ReputationConfig* config)
{
- SfCidr address;
+ snort::SfCidr address;
if ( !line || *line == '\0' )
return IP_INSERT_SUCCESS;
#include "sfdaq.h"
+using namespace snort;
+
#define MAX_ATTEMPTS 20
// these can't be pkt flags because we do the handling
default:
if ( Active::packet_force_dropped() )
- Active::send_unreach(p, UnreachResponse::FWD);
+ Active::send_unreach(p, snort::UnreachResponse::FWD);
else
- Active::send_unreach(p, UnreachResponse::PORT);
+ Active::send_unreach(p, snort::UnreachResponse::PORT);
break;
}
}
}
}
-void Active::send_unreach(Packet* p, UnreachResponse type)
+void Active::send_unreach(Packet* p, snort::UnreachResponse type)
{
uint32_t len;
const uint8_t* rej;
#include "protocols/packet_manager.h"
+namespace snort
+{
struct Packet;
struct SnortConfig;
static void kill_session(Packet*, EncodeFlags = ENC_FLAG_FWD);
static void send_reset(Packet*, EncodeFlags);
- static void send_unreach(Packet*, UnreachResponse);
+ static void send_unreach(Packet*, snort::UnreachResponse);
static bool send_data(Packet*, EncodeFlags, const uint8_t* buf, uint32_t len);
static void inject_data(Packet*, EncodeFlags, const uint8_t* buf, uint32_t len);
ActiveSuspendContext() { Active::suspend(); }
~ActiveSuspendContext() { Active::resume(); }
};
-
+}
#endif
struct sockaddr_in* saddr = (struct sockaddr_in*)dev->addresses->addr;
if ((saddr->sin_family == AF_INET) || (saddr->sin_family == AF_INET6))
{
- SfIp dev_ip;
+ snort::SfIp dev_ip;
dev_ip.set(&saddr->sin_addr, saddr->sin_family);
printf("\t%s", dev_ip.ntoa());
}
#include "sfdaq_config.h"
+using namespace snort;
using namespace std;
#ifdef DEFAULT_DAQ
#include "main/snort_types.h"
#include "protocols/protocol_ids.h"
+namespace snort
+{
struct Packet;
struct SnortConfig;
struct SfIp;
static bool forwarding_packet(const DAQ_PktHdr_t*);
static bool break_loop(int error);
};
-
+}
#endif
#include "sfdaq_config.h"
+using namespace snort;
+
#define sfdaq_help "configure packet acquisition interface"
static const Parameter string_list_param[] =
#include "framework/module.h"
+namespace snort
+{
struct SnortConfig;
+}
struct SFDAQConfig;
struct SFDAQInstanceConfig;
-class SFDAQModule : public Module
+class SFDAQModule : public snort::Module
{
public:
SFDAQModule();
- bool set(const char*, Value&, SnortConfig*) override;
- bool begin(const char*, int, SnortConfig*) override;
- bool end(const char*, int, SnortConfig*) override;
+ bool set(const char*, snort::Value&, snort::SnortConfig*) override;
+ bool begin(const char*, int, snort::SnortConfig*) override;
+ bool end(const char*, int, snort::SnortConfig*) override;
const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
#include "packet_io/sfdaq_config.h"
#include "packet_io/sfdaq_module.h"
+using namespace snort;
+
TEST_CASE("Kitchen Sink", "[SFDAQModule]")
{
SFDAQModule sfdm;
continue;
/* do a quick check to make sure file exists */
- if (SnortConfig::read_mode() && stat(pcap_name.c_str(), &sb) == -1)
+ if (snort::SnortConfig::read_mode() && stat(pcap_name.c_str(), &sb) == -1)
{
ErrorMessage("Error getting stat on pcap file: %s: %s\n",
pcap_name.c_str(), get_error(errno));
pcap_list_file.close();
return -1;
}
- else if (SnortConfig::read_mode() && S_ISDIR(sb.st_mode))
+ else if (snort::SnortConfig::read_mode() && S_ISDIR(sb.st_mode))
{
Directory pcap_dir(pcap_name.c_str(), filter.c_str());
std::vector<std::string> tmp_queue;
pcap_queue.reserve(pcap_queue.size() + tmp_queue.size());
pcap_queue.insert(pcap_queue.end(), tmp_queue.begin(), tmp_queue.end());
}
- else if (!SnortConfig::read_mode() || S_ISREG(sb.st_mode))
+ else if (!snort::SnortConfig::read_mode() || S_ISREG(sb.st_mode))
{
if (filter.empty() ||
(fnmatch(filter.c_str(), pcap_name.c_str(), 0) == 0))
i = ++pos;
}
/* do a quick check to make sure file exists */
- if (SnortConfig::read_mode())
+ if (snort::SnortConfig::read_mode())
{
if (stat(pcap_name.c_str(), &sb) == -1)
{
#include "arg_list.h"
+using namespace snort;
using namespace std;
//-------------------------------------------------------------------------
#ifndef CMD_LINE_H
#define CMD_LINE_H
-struct SnortConfig* parse_cmd_line(int argc, char* argv[]);
+namespace snort
+{
+struct SnortConfig;
+}
+
+snort::SnortConfig* parse_cmd_line(int argc, char* argv[]);
#endif
void ConfigChecksumDrop(const char* args)
{
- NetworkPolicy* policy = get_network_policy();
+ NetworkPolicy* policy = snort::get_network_policy();
policy->checksum_drop = GetChecksumFlags(args);
}
void ConfigChecksumMode(const char* args)
{
- NetworkPolicy* policy = get_network_policy();
+ NetworkPolicy* policy = snort::get_network_policy();
policy->checksum_eval = GetChecksumFlags(args);
}
{
lua_conf = val;
SetSnortConfDir(lua_conf.c_str());
- Snort::set_main_hook(DetectionEngine::inspect);
+ snort::Snort::set_main_hook(snort::DetectionEngine::inspect);
}
void SetSnortConfDir(const char* file)
#include "parse_stream.h"
#include "vars.h"
+using namespace snort;
+
struct Location
{
std::string file;
void ParseIpVar(SnortConfig* sc, const char* var, const char* val)
{
int ret;
- IpsPolicy* p = get_ips_policy(); // FIXIT-M double check, see below
+ IpsPolicy* p = snort::get_ips_policy(); // FIXIT-M double check, see below
DisallowCrossTableDuplicateVars(sc, var, VAR_TYPE__IPVAR);
if ((ret = sfvt_define(p->ip_vartable, var, val)) != SFIP_SUCCESS)
}
}
-void add_service_to_otn(
- SnortConfig* sc, OptTreeNode* otn, const char* svc_name)
+void add_service_to_otn(SnortConfig* sc, OptTreeNode* otn, const char* svc_name)
{
if (otn->sigInfo.num_services >= sc->max_metadata_services)
{
void parse_conf_term();
void parse_conf_print();
+namespace snort
+{
struct SnortConfig;
+}
-void ParseConfigFile(SnortConfig*, const char* fname);
-void ParseConfigString(SnortConfig*, const char* str);
+void ParseConfigFile(snort::SnortConfig*, const char* fname);
+void ParseConfigString(snort::SnortConfig*, const char* str);
-void parse_include(SnortConfig*, const char*);
+void parse_include(snort::SnortConfig*, const char*);
-void AddRuleState(SnortConfig*, const RuleState&);
-void add_service_to_otn(SnortConfig*, OptTreeNode*, const char*);
+void AddRuleState(snort::SnortConfig*, const RuleState&);
+void add_service_to_otn(snort::SnortConfig*, OptTreeNode*, const char*);
-Actions::Type get_rule_type(const char*);
-ListHead* get_rule_list(SnortConfig*, const char*);
+snort::Actions::Type get_rule_type(const char*);
+ListHead* get_rule_list(snort::SnortConfig*, const char*);
#endif
int ret_code;
vartable_t* ip_vartable;
- ip_vartable = get_ips_policy()->ip_vartable;
+ ip_vartable = snort::get_ips_policy()->ip_vartable;
DebugFormat(DEBUG_CONFIGRULES,"Got address string: %s\n", addr);
(c == ','))
{
/* Open ended range, highport is 65k */
- hport = MAX_PORTS-1;
+ hport = snort::MAX_PORTS - 1;
PortObjectAddRange(po, lport, hport);
return po;
}
#include "parse_conf.h"
#include "parse_ports.h"
+using namespace snort;
+
#define SRC 0
#define DST 1
return 0;
}
-static int ProcessIP(
- SnortConfig*, const char* addr, RuleTreeNode* rtn, int mode, int)
+static int ProcessIP(SnortConfig*, const char* addr, RuleTreeNode* rtn, int mode, int)
{
- vartable_t* ip_vartable = get_ips_policy()->ip_vartable;
+ vartable_t* ip_vartable = snort::get_ips_policy()->ip_vartable;
assert(rtn);
/* If a rule has a variable in it, we want to copy that variable's
SnortConfig* sc, RuleTreeNode* test_node, ListHead* list)
{
RuleTreeNode* rtn = findHeadNode(
- sc, test_node, get_ips_policy()->policy_id);
+ sc, test_node, snort::get_ips_policy()->policy_id);
/* if it doesn't match any of the existing nodes, make a new node and
* stick it at the end of the list */
{
RuleTreeNode* rtnTmp2 = deleteRtnFromOtn(otn_cur, i, sc, (rtn_cur != rtn_new));
- if ( rtnTmp2 and (i != get_ips_policy()->policy_id) )
+ if ( rtnTmp2 and (i != snort::get_ips_policy()->policy_id) )
{
addRtnToOtn(sc, otn_new, rtnTmp2, i);
}
if ( s_ignore )
return;
- IpsPolicy* p = get_ips_policy();
+ IpsPolicy* p = snort::get_ips_policy();
if ( ParsePortList(&rtn, p->portVarTable, p->nonamePortVarTable, s, src ? SRC : DST) )
{
#include "detection/rules.h"
#include "framework/ips_option.h"
+namespace snort
+{
+struct SnortConfig;
+}
struct OptFpList;
struct OptTreeNode;
struct RuleTreeNode;
-struct SnortConfig;
void parse_rule_init();
void parse_rule_term();
void parse_rule_print();
-void parse_rule_type(SnortConfig*, const char*, RuleTreeNode&);
-void parse_rule_proto(SnortConfig*, const char*, RuleTreeNode&);
-void parse_rule_nets(SnortConfig*, const char*, bool src, RuleTreeNode&);
-void parse_rule_ports(SnortConfig*, const char*, bool src, RuleTreeNode&);
-void parse_rule_dir(SnortConfig*, const char*, RuleTreeNode&);
-void parse_rule_opt_begin(SnortConfig*, const char* key);
+void parse_rule_type(snort::SnortConfig*, const char*, RuleTreeNode&);
+void parse_rule_proto(snort::SnortConfig*, const char*, RuleTreeNode&);
+void parse_rule_nets(snort::SnortConfig*, const char*, bool src, RuleTreeNode&);
+void parse_rule_ports(snort::SnortConfig*, const char*, bool src, RuleTreeNode&);
+void parse_rule_dir(snort::SnortConfig*, const char*, RuleTreeNode&);
+void parse_rule_opt_begin(snort::SnortConfig*, const char* key);
void parse_rule_opt_set(
- SnortConfig*, const char* key, const char* opt, const char* val);
-void parse_rule_opt_end(SnortConfig*, const char* key, OptTreeNode*);
-OptTreeNode* parse_rule_open(SnortConfig*, RuleTreeNode&, bool stub = false);
-const char* parse_rule_close(SnortConfig*, RuleTreeNode&, OptTreeNode*);
+ snort::SnortConfig*, const char* key, const char* opt, const char* val);
+void parse_rule_opt_end(snort::SnortConfig*, const char* key, OptTreeNode*);
+OptTreeNode* parse_rule_open(snort::SnortConfig*, RuleTreeNode&, bool stub = false);
+const char* parse_rule_close(snort::SnortConfig*, RuleTreeNode&, OptTreeNode*);
int get_rule_count();
{ otn = nullptr; }
};
-static void parse_body(const char*, RuleParseState&, struct SnortConfig*);
+static void parse_body(const char*, RuleParseState&, struct snort::SnortConfig*);
static bool exec(
FsmAction act, string& tok,
- RuleParseState& rps, SnortConfig* sc)
+ RuleParseState& rps, snort::SnortConfig* sc)
{
switch ( act )
{
// parse_body() is called at the end of a stub rule to parse the detection
// options in an so rule. similar to parse_stream() except we start in a
// different state.
-static void parse_body(const char* extra, RuleParseState& rps, struct SnortConfig* sc)
+static void parse_body(const char* extra, RuleParseState& rps, snort::SnortConfig* sc)
{
stringstream is(extra);
}
}
-void parse_stream(istream& is, struct SnortConfig* sc)
+void parse_stream(istream& is, snort::SnortConfig* sc)
{
string tok;
TokenType type;
#ifndef PARSE_STREAM_H
#define PARSE_STREAM_H
+namespace snort
+{
+struct SnortConfig;
+}
+
#include <istream>
-void parse_stream(std::istream&, struct SnortConfig*);
+void parse_stream(std::istream&, snort::SnortConfig*);
#endif
#include "parse_stream.h"
#include "vars.h"
+using namespace snort;
+
bool parsing_follows_files = false;
static struct rule_index_map_t* ruleIndexMap = nullptr;
RuleTreeNode* deleteRtnFromOtn(OptTreeNode* otn, SnortConfig* sc)
{
- return deleteRtnFromOtn(otn, get_ips_policy()->policy_id, sc);
+ return deleteRtnFromOtn(otn, snort::get_ips_policy()->policy_id, sc);
}
static uint32_t rtn_hash_func(HashFnc*, const unsigned char *k, int)
int addRtnToOtn(SnortConfig*sc, OptTreeNode* otn, RuleTreeNode* rtn)
{
- return addRtnToOtn(sc, otn, rtn, get_ips_policy()->policy_id);
+ return addRtnToOtn(sc, otn, rtn, snort::get_ips_policy()->policy_id);
}
void rule_index_map_print_index(int index, char* buf, int bufsize)
#include "detection/treenodes.h"
#include "main/policy.h"
+namespace snort
+{
+struct SnortConfig;
+}
+
void parser_init();
-void parser_term(SnortConfig*);
+void parser_term(snort::SnortConfig*);
// line > 0 implies name is non-null
void get_parse_location(const char*& name, unsigned& line);
void pop_parse_location();
void inc_parse_position();
-SnortConfig* ParseSnortConf(const SnortConfig*, const char* fname = nullptr);
-void ParseRules(SnortConfig*);
+snort::SnortConfig* ParseSnortConf(const snort::SnortConfig*, const char* fname = nullptr);
+void ParseRules(snort::SnortConfig*);
-void OrderRuleLists(SnortConfig*, const char*);
+void OrderRuleLists(snort::SnortConfig*, const char*);
void PrintRuleOrder(RuleListNode*);
-char* ProcessFileOption(SnortConfig*, const char*);
-void SetRuleStates(SnortConfig*);
+char* ProcessFileOption(snort::SnortConfig*, const char*);
+void SetRuleStates(snort::SnortConfig*);
-void FreeRuleLists(SnortConfig*);
-void VarTablesFree(SnortConfig*);
+void FreeRuleLists(snort::SnortConfig*);
+void VarTablesFree(snort::SnortConfig*);
void parser_append_rules(const char*);
int ParseBool(const char* arg);
-int addRtnToOtn(SnortConfig*, struct OptTreeNode*, RuleTreeNode*);
-int addRtnToOtn(SnortConfig*, struct OptTreeNode*, RuleTreeNode*, PolicyId);
+int addRtnToOtn(snort::SnortConfig*, struct OptTreeNode*, RuleTreeNode*);
+int addRtnToOtn(snort::SnortConfig*, struct OptTreeNode*, RuleTreeNode*, PolicyId);
bool same_headers(RuleTreeNode*, RuleTreeNode*);
-RuleTreeNode* deleteRtnFromOtn(OptTreeNode*, SnortConfig* sc = nullptr);
-RuleTreeNode* deleteRtnFromOtn(struct OptTreeNode*, PolicyId, SnortConfig* sc = nullptr, bool remove = true);
+RuleTreeNode* deleteRtnFromOtn(OptTreeNode*, snort::SnortConfig* sc = nullptr);
+RuleTreeNode* deleteRtnFromOtn(struct OptTreeNode*, PolicyId, snort::SnortConfig* sc = nullptr, bool remove = true);
inline RuleTreeNode* getRtnFromOtn(const struct OptTreeNode* otn, PolicyId policyId)
{
inline RuleTreeNode* getRtnFromOtn(const struct OptTreeNode* otn)
{
- return getRtnFromOtn(otn, get_ips_policy()->policy_id);
+ return getRtnFromOtn(otn, snort::get_ips_policy()->policy_id);
}
inline RuleTreeNode* getRuntimeRtnFromOtn(const struct OptTreeNode* otn)
return getRtnFromOtn(otn);
}
-ListHead* CreateRuleType(SnortConfig* sc, const char* name, Actions::Type);
+ListHead* CreateRuleType(snort::SnortConfig* sc, const char* name, snort::Actions::Type);
void FreeRuleTreeNode(RuleTreeNode*);
void DestroyRuleTreeNode(RuleTreeNode*);
#include "catch/snort_catch.h"
#endif
+using namespace snort;
+
//-------------------------------------------------------------------------
// var node stuff
//-------------------------------------------------------------------------
PortObject* po;
POParser pop;
int rstat;
- PortVarTable* portVarTable = get_ips_policy()->portVarTable;
+ PortVarTable* portVarTable = snort::get_ips_policy()->portVarTable;
DisallowCrossTableDuplicateVars(sc, name, VAR_TYPE__PORTVAR);
void DisallowCrossTableDuplicateVars(
SnortConfig*, const char* name, VarType var_type)
{
- IpsPolicy* dp = get_ips_policy();
+ IpsPolicy* dp = snort::get_ips_policy();
VarEntry* var_table = dp->var_table;
PortVarTable* portVarTable = dp->portVarTable;
vartable_t* ip_vartable = dp->ip_vartable;
VarEntry* VarDefine(
SnortConfig* sc, const char* name, const char* value)
{
- IpsPolicy* dp = get_ips_policy();
+ IpsPolicy* dp = snort::get_ips_policy();
VarEntry* var_table = dp->var_table;
vartable_t* ip_vartable = dp->ip_vartable;
VarEntry* p;
const char* VarSearch(SnortConfig* sc, const char* name)
{
- IpsPolicy* dp = get_ips_policy();
+ IpsPolicy* dp = snort::get_ips_policy();
VarEntry* var_table = dp->var_table;
PortVarTable* portVarTable = dp->portVarTable;
vartable_t* ip_vartable = dp->ip_vartable;
#include "sfip/sf_vartable.h"
+namespace snort
+{
struct SnortConfig;
+}
//-------------------------------------------------------------------------
// var node stuff
VarNode* next;
};
-void config_set_var(SnortConfig*, const char*);
+void config_set_var(snort::SnortConfig*, const char*);
void FreeVarList(VarNode*);
//-------------------------------------------------------------------------
VarEntry* next;
};
-VarEntry* VarDefine(SnortConfig*, const char* name, const char* value);
-int PortVarDefine(SnortConfig*, const char* name, const char* s);
+VarEntry* VarDefine(snort::SnortConfig*, const char* name, const char* value);
+int PortVarDefine(snort::SnortConfig*, const char* name, const char* s);
// FIXIT-L put ParseIpVar() definition and declaration in matching files
-void ParseIpVar(SnortConfig*, const char* name, const char* s);
+void ParseIpVar(snort::SnortConfig*, const char* name, const char* s);
VarEntry* VarAlloc();
void DeleteVars(VarEntry* var_table);
-void AddVarToTable(SnortConfig*, const char*, const char*);
+void AddVarToTable(snort::SnortConfig*, const char*, const char*);
enum VarType
{
int VarIsIpAddr(vartable_t* ip_vartable, const char* value);
int VarIsIpList(vartable_t* ip_vartable, const char* value);
-void DisallowCrossTableDuplicateVars(SnortConfig*, const char* name, VarType var_type);
+void DisallowCrossTableDuplicateVars(snort::SnortConfig*, const char* name, VarType var_type);
-const char* VarSearch(SnortConfig*, const char* name);
-const char* ExpandVars(SnortConfig*, const char* string);
+const char* VarSearch(snort::SnortConfig*, const char* name);
+const char* ExpandVars(snort::SnortConfig*, const char* string);
#endif
}
bool piglet_mode()
-{ return SnortConfig::get_conf()->run_flags & RUN_FLAG__PIGLET; }
+{ return snort::SnortConfig::get_conf()->run_flags & RUN_FLAG__PIGLET; }
} // namespace Piglet
#include "main/snort_types.h"
struct lua_State;
+namespace snort
+{
class Module;
struct SnortConfig;
+}
#define PIGLET_API_VERSION 1
{
public:
BasePlugin(Lua::State& lua, const std::string& t,
- Module* m = nullptr, SnortConfig* sc = nullptr) :
+ snort::Module* m = nullptr, snort::SnortConfig* sc = nullptr) :
L { lua.get_ptr() }, target { t },
module { m }, snort_conf { sc } { }
protected:
lua_State* L;
std::string target;
- Module* module;
- SnortConfig* snort_conf;
+ snort::Module* module;
+ snort::SnortConfig* snort_conf;
std::string error; // FIXIT-L unused
// Plugin ctor/dtor
//--------------------------------------------------------------------------
-using PluginCtor = BasePlugin* (*)(Lua::State&, const std::string&, Module*, SnortConfig*);
+using PluginCtor = BasePlugin* (*)(Lua::State&, const std::string&, snort::Module*, snort::SnortConfig*);
using PluginDtor = void (*)(BasePlugin*);
//--------------------------------------------------------------------------
struct Api
{
- BaseApi base;
+ snort::BaseApi base;
PluginCtor ctor;
PluginDtor dtor;
PlugType target;
#define PLUGIN_KEY_SEP "::"
+namespace snort
+{
class Module;
+}
namespace Piglet
{
+using namespace snort;
using namespace std;
// -----------------------------------------------------------------------------
#include "managers/plugin_manager.h"
+using namespace snort;
+
extern const BaseApi* pp_codec;
extern const BaseApi* pp_inspector;
extern const BaseApi* pp_ips_action;
#include "pp_raw_buffer_iface.h"
+using namespace snort;
+
static const luaL_Reg methods[] =
{
{
#include "lua/lua_iface.h"
+namespace snort
+{
struct Buffer;
+}
-extern const struct Lua::TypeInterface<Buffer> BufferIface;
+extern const struct Lua::TypeInterface<snort::Buffer> BufferIface;
#endif
#include "pp_enc_state_iface.h"
#include "pp_raw_buffer_iface.h"
+using namespace snort;
+
class CodecPiglet : public Piglet::BasePlugin
{
public:
#include "framework/codec.h"
#include "lua/lua_arg.h"
+using namespace snort;
+
static void set_fields(lua_State* L, int tindex, CodecData& self)
{
Lua::Table table(L, tindex);
#include "lua/lua_iface.h"
+namespace snort
+{
struct CodecData;
+}
-extern const struct Lua::TypeInterface<CodecData> CodecDataIface;
+extern const struct Lua::TypeInterface<snort::CodecData> CodecDataIface;
#endif
#include "pp_ip_api_iface.h"
#include "pp_raw_buffer_iface.h"
+using namespace snort;
+
// FIXIT-M delete this, and make the IpApi arg in codec.update required
static const ip::IpApi default_ip_api {};
#include "lua/lua_iface.h"
+namespace snort
+{
class Codec;
+}
-extern const struct Lua::InstanceInterface<Codec> CodecIface;
+extern const struct Lua::InstanceInterface<snort::Codec> CodecIface;
#endif
#include "pp_packet_iface.h"
#include "pp_raw_buffer_iface.h"
+using namespace snort;
+
static void reset_from_packet(
lua_State* L, Cursor& self, Packet& p, int p_idx)
{
#include "framework/codec.h"
#include "lua/lua_arg.h"
+using namespace snort;
+
// FIXIT-M ip_api should also be its own object (copyable)
static const class ip::IpApi ip_api {};
#include "lua/lua_iface.h"
+namespace snort
+{
struct EncState;
+}
-extern const struct Lua::TypeInterface<EncState> EncStateIface;
+extern const struct Lua::TypeInterface<snort::EncState> EncStateIface;
#endif
#include "flow/flow.h"
#include "lua/lua_arg.h"
+using namespace snort;
+
static const luaL_Reg methods[] =
{
{
#include "lua/lua_iface.h"
+namespace snort
+{
class Flow;
+}
-extern const struct Lua::TypeInterface<Flow> FlowIface;
+extern const struct Lua::TypeInterface<snort::Flow> FlowIface;
#endif
#include "pp_raw_buffer_iface.h"
#include "pp_stream_splitter_iface.h"
+using namespace snort;
+
class InspectorPiglet : public Piglet::BasePlugin
{
public:
#include "pp_raw_buffer_iface.h"
#include "pp_stream_splitter_iface.h"
+using namespace snort;
+
// FIXIT-H needs to be updated for addition of get_fp_buf()
template<typename T>
static inline bool get_buf(
#include "lua/lua_iface.h"
+namespace snort
+{
class Inspector;
+}
-extern const struct Lua::InstanceInterface<Inspector> InspectorIface;
+extern const struct Lua::InstanceInterface<snort::Inspector> InspectorIface;
#endif
#include "pp_raw_buffer_iface.h"
+using namespace snort;
+
template<typename Header>
static void set_header(lua_State* L, ip::IpApi& ip_api, RawBuffer& rb)
{
{
"set_ip4",
[](lua_State* L)
- { return set<IP4Hdr>(L); }
+ { return set<ip::IP4Hdr>(L); }
},
{
"set_ip6",
#include "lua/lua_iface.h"
+namespace snort
+{
namespace ip
{
class IpApi;
}
+}
-extern const struct Lua::TypeInterface<ip::IpApi> IpApiIface;
+extern const struct Lua::TypeInterface<snort::ip::IpApi> IpApiIface;
#endif
#include "pp_packet_iface.h"
#include "pp_raw_buffer_iface.h"
+using namespace snort;
+
class IpsActionPiglet : public Piglet::BasePlugin
{
public:
#include "pp_packet_iface.h"
+using namespace snort;
+
static const luaL_Reg methods[] =
{
{
#include "lua/lua_iface.h"
+namespace snort
+{
class IpsAction;
+}
-extern const struct Lua::InstanceInterface<IpsAction> IpsActionIface;
+extern const struct Lua::InstanceInterface<snort::IpsAction> IpsActionIface;
#endif
#include "pp_packet_iface.h"
#include "pp_raw_buffer_iface.h"
+using namespace snort;
+
class IpsOptionPiglet : public Piglet::BasePlugin
{
public:
#include "pp_packet_iface.h"
#include "pp_cursor_iface.h"
+using namespace snort;
+
static const luaL_Reg methods[] =
{
{
#include "lua/lua_iface.h"
+namespace snort
+{
class IpsOption;
+}
-extern const struct Lua::InstanceInterface<IpsOption> IpsOptionIface;
+extern const struct Lua::InstanceInterface<snort::IpsOption> IpsOptionIface;
#endif
#include "pp_packet_iface.h"
#include "pp_raw_buffer_iface.h"
+using namespace snort;
+
class LoggerPiglet : public Piglet::BasePlugin
{
public:
#include "pp_event_iface.h"
#include "pp_packet_iface.h"
+using namespace snort;
+
static const luaL_Reg methods[] =
{
{
#include "lua/lua_iface.h"
+namespace snort
+{
class Logger;
+}
-extern const struct Lua::InstanceInterface<Logger> LoggerIface;
+extern const struct Lua::InstanceInterface<snort::Logger> LoggerIface;
#endif
#include "pp_flow_iface.h"
#include "pp_raw_buffer_iface.h"
+using namespace snort;
+
static void set_fields(lua_State* L, int tindex, Packet& self)
{
Lua::Table table(L, tindex);
#include "lua/lua_iface.h"
+namespace snort
+{
struct Packet;
+}
-extern const struct Lua::TypeInterface<Packet> PacketIface;
+extern const struct Lua::TypeInterface<snort::Packet> PacketIface;
#endif
#include "pp_search_engine_iface.h"
+using namespace snort;
+
class SearchEnginePiglet : public Piglet::BasePlugin
{
public:
{ nullptr, nullptr }
};
-const struct Lua::InstanceInterface<Mpse> SearchEngineIface =
+const struct Lua::InstanceInterface<snort::Mpse> SearchEngineIface =
{
"SearchEngine",
methods
#include "lua/lua_iface.h"
+namespace snort
+{
class Mpse;
+}
-extern const struct Lua::InstanceInterface<Mpse> SearchEngineIface;
+extern const struct Lua::InstanceInterface<snort::Mpse> SearchEngineIface;
#endif
#include "pp_so_rule_iface.h"
+using namespace snort;
+
class SoRulePiglet : public Piglet::BasePlugin
{
public:
#include "framework/so_rule.h"
+using namespace snort;
+
static const luaL_Reg methods[] =
{
{ nullptr, nullptr }
#include "lua/lua_iface.h"
+namespace snort
+{
class SoRule;
+}
-extern const struct Lua::TypeInterface<SoRule> SoRuleIface;
+extern const struct Lua::TypeInterface<snort::SoRule> SoRuleIface;
#endif
#include "pp_flow_iface.h"
#include "pp_raw_buffer_iface.h"
+using namespace snort;
+
template<typename From, typename To>
static inline void stack_push(lua_State* L, const From v)
{ Lua::Stack<To>::push(L, static_cast<To>(v)); }
#include "lua/lua_iface.h"
+namespace snort
+{
class StreamSplitter;
+}
-extern const struct Lua::TypeInterface<StreamSplitter> StreamSplitterIface;
+extern const struct Lua::TypeInterface<snort::StreamSplitter> StreamSplitterIface;
#endif
#include "pp_packet_iface.h"
#include "pp_raw_buffer_iface.h"
+using namespace snort;
+
class TestPiglet : public Piglet::BasePlugin
{
public:
#ifndef PORT_GROUP_H
#define PORT_GROUP_H
+namespace snort
+{
+ class Mpse;
+}
+
// PortGroup contains a set of fast patterns in the form of an MPSE and a
// set of non-fast-pattern (nfp) rules. when a PortGroup is selected, the
// MPSE will run fp rules if there is a match on the associated fast
RULE_NODE* nfp_head, * nfp_tail;
// pattern matchers
- class Mpse* mpse[PM_TYPE_MAX];
+ snort::Mpse* mpse[PM_TYPE_MAX];
// detection option tree
void* nfp_tree;
unsigned i;
/* static for printing so we don't put so many bytes on the stack */
- static char po_print_buf[MAX_PORTS]; // FIXIT-L delete this; replace with local stringstream
+ static char po_print_buf[snort::MAX_PORTS]; // FIXIT-L delete this; replace with local stringstream
int bufsize = sizeof(po_print_buf);
po_print_buf[0] = '\0';
// printing
//-------------------------------------------------------------------------
-char po_print_buf[MAX_PORTS];
+char po_print_buf[snort::MAX_PORTS];
int integer_compare(const void* int1, const void* int2);
// global for printing so we don't put so many bytes on the stack
-extern char po_print_buf[MAX_PORTS]; // FIXIT-L delete this; replace with local stringstream
+extern char po_print_buf[snort::MAX_PORTS]; // FIXIT-L delete this; replace with local stringstream
#endif
#include "catch/snort_catch.h"
#endif
+using namespace snort;
+
// -----------------------------------------------------------------------------
// static variables
// -----------------------------------------------------------------------------
#include "catch/snort_catch.h"
#endif
+using namespace snort;
+
// -----------------------------------------------------------------------------
// show statistics
// -----------------------------------------------------------------------------
int max_depth = -1;
};
+namespace snort
+{
class SO_PUBLIC MemoryContext
{
public:
private:
MemoryTracker* saved;
};
-
+}
#endif
#include "catch/snort_catch.h"
#endif
+using namespace snort;
+
static ProfilerNodeMap s_profiler_nodes;
void Profiler::register_module(Module* m)
#include "profiler_defs.h"
+namespace snort
+{
class Module;
+}
class Profiler
{
public:
- static void register_module(Module*);
- static void register_module(const char*, const char*, Module*);
- static void register_module(const char*, const char*, get_profile_stats_fn);
+ static void register_module(snort::Module*);
+ static void register_module(const char*, const char*, snort::Module*);
+ static void register_module(const char*, const char*, snort::get_profile_stats_fn);
// FIXIT-L do we need to call on main thread?
// call from packet threads, just before thread termination
#include "rule_profiler_defs.h"
#include "time_profiler_defs.h"
+namespace snort
+{
#define ROOT_NODE "total"
struct ProfilerConfig
using get_profile_stats_fn = ProfileStats* (*)(const char*);
using Profile = ProfileContext;
-
+}
#endif
#include "catch/snort_catch.h"
#endif
+using namespace snort;
+
// -----------------------------------------------------------------------------
// types
// -----------------------------------------------------------------------------
#include "profiler_defs.h"
+namespace snort
+{
class Module;
+}
struct GetProfileFunctor;
class ProfilerNode
ProfilerNode(const std::string& key) :
name { key } { }
- void set(Module* m);
- void set(get_profile_stats_fn fn);
+ void set(snort::Module* m);
+ void set(snort::get_profile_stats_fn fn);
bool is_set() const
{ return bool(getter); }
// thread local call
void accumulate();
- const ProfileStats& get_stats() const
+ const snort::ProfileStats& get_stats() const
{ return stats; }
- void set_stats(const ProfileStats& ps)
+ void set_stats(const snort::ProfileStats& ps)
{ stats = ps; }
void reset()
private:
std::vector<ProfilerNode*> children;
std::shared_ptr<GetProfileFunctor> getter;
- ProfileStats stats;
+ snort::ProfileStats stats;
};
inline bool operator==(const ProfilerNode& lhs, const ProfilerNode& rhs)
map_type::const_iterator end() const
{ return nodes.end(); }
- void register_node(const std::string&, const char*, Module*);
- void register_node(const std::string&, const char*, get_profile_stats_fn);
+ void register_node(const std::string&, const char*, snort::Module*);
+ void register_node(const std::string&, const char*, snort::get_profile_stats_fn);
void accumulate_nodes();
void reset_nodes();
#include "catch/snort_catch.h"
#endif
+using namespace snort;
+
#define s_rule_table_title "rule profile"
static inline OtnState& operator+=(OtnState& lhs, const OtnState& rhs)
#include "catch/snort_catch.h"
#endif
+using namespace snort;
+
#define s_time_table_title "module profile"
namespace time_stats
+
//--------------------------------------------------------------------------
// Copyright (C) 2014-2018 Cisco and/or its affiliates. All rights reserved.
//
#ifndef PROTOCOLS_ARP_H
#define PROTOCOLS_ARP_H
+namespace snort
+{
namespace arp
{
constexpr uint16_t ETHERARP_HDR_LEN = 28; /* sizeof EtherARP != 28 */
} // namespace arp
+} // namespace snort
#ifndef ARPOP_REQUEST
constexpr uint16_t ARPOP_REQUEST = 1; /* ARP request */
#define ETHERNET_HEADER_LEN 14
#define ETHERNET_MTU 1500
+namespace snort
+{
namespace eth
{
constexpr uint16_t MTU_LEN = 1500;
{ return ether_type; }
};
} // namespace eth
+} // namespace snort
#endif
#include <arpa/inet.h>
+namespace snort
+{
namespace gre
{
/* GRE related stuff */
{ return ether_type; }
};
} // namespace gre
+} // namespace snort
#endif
#include <cstdint>
#include "protocols/ipv4.h" // for in_addr
+namespace snort
+{
namespace icmp
{
constexpr uint32_t ICMP_BASE_LEN = 4;
/* IP header for unreach */
struct ih_ip
{
- ip::IP4Hdr* ip;
+ snort::ip::IP4Hdr* ip;
/* options and then 64 bits of data */
} ip;
#define s_icmp_data icmp_dun.data
};
} //namespace icmp
+} // namespace snort
-typedef icmp::ICMPHdr ICMPHdr;
+typedef snort::icmp::ICMPHdr ICMPHdr;
#ifndef ICMP_ECHOREPLY
constexpr uint8_t ICMP_ECHOREPLY = 0; /* Echo Reply */
#include <cstdint>
+namespace snort
+{
namespace icmp
{
constexpr uint16_t ICMP6_HEADER_MIN_LEN = 4;
uint16_t flags;
uint64_t nonce;
};
-} // namespace icmp6
+} // namespace icmp
+} // namespace snort
#endif
#include "layer.h"
+namespace snort
+{
namespace ip
{
void IpApi::reset()
return false;
}
} // namespace ip
+} // namespace snort
#include "protocols/ipv6.h"
#include "sfip/sf_ip.h"
+namespace snort
+{
struct Packet;
// FIXIT-L can I assume api is always valid?
};
} // namespace ip
-
+} // namespace snort
#endif
#define IP_MAXPACKET 65535 /* maximum packet size */
#endif
+namespace snort
+{
namespace ip
{
constexpr uint32_t IP4_BROADCAST = 0xffffffff;
}
return false;
}
-} /* namespace ip */
-
+} // namespace ip
+} // namespace snort
/* tcpdump shows us the way to cross platform compatibility */
-
-/* we need to change them as well as get them */
-// TYPEDEF WHICH NEED TO BE DELETED
-typedef ip::IP4Hdr IP4Hdr;
-
-/* #define IP_HEADER_LEN ip::ip4_hdr_len() */
-
#endif
#include "packet.h"
+namespace snort
+{
namespace ip
{
IpOptionIteratorIter::IpOptionIteratorIter(const IpOptions* first_opt) : opt(first_opt)
return IpOptionIteratorIter(reinterpret_cast<const IpOptions*>(end_ptr));
}
} // namespace ip
+} // namespace snort
#include "main/snort_types.h"
+namespace snort
+{
struct Packet;
namespace ip
const uint8_t* start_ptr;
};
} // namespace ip
-
+} // namespace snort
#endif
#include "protocols/protocol_ids.h"
+namespace snort
+{
namespace ip
{
constexpr uint8_t IP6_HEADER_LEN = 40;
{
return IPV6IdExtensionOrder((ProtocolId)ip_proto);
}
-} // namespace ipv6
-
+} // namespace ip
+} // namespace snort
#endif
#include "packet.h"
+namespace snort
+{
namespace layer
{
static THREAD_LOCAL const Packet* curr_pkt;
const icmp::ICMPHdr* get_icmp_embed_icmp(const ip::IpApi& api)
{ return reinterpret_cast<const icmp::ICMPHdr*>(api.ip_data()); }
} // namespace layer
+} // namespace snort
#include "main/snort_types.h"
#include "protocols/protocol_ids.h"
+namespace snort
+{
struct Layer
{
const uint8_t* start;
SO_PUBLIC bool set_outer_ip_api(const Packet* const, ip::IpApi&,
IpProtocol& next_ip_proto, int8_t& curr_layer);
} // namespace layer
-
+} // namespace snort
#endif
#include <cstdint>
+namespace snort
+{
namespace mpls
{
struct MplsHdr
constexpr int MPLS_PAYLOADTYPE_ETHERNET = 1;
constexpr int MPLS_PAYLOADTYPE_IPV4 = 2;
constexpr int MPLS_PAYLOADTYPE_IPV6 = 3;
-
+}
#endif
#include "packet_manager.h"
+namespace snort
+{
Packet::Packet(bool packet_data)
{
layers = new Layer[CodecManager::get_max_layers()];
}
return "other";
}
+} // namespace snort
#include "framework/decode_data.h"
#include "main/snort_types.h"
+class Endianness;
+class Obfuscator;
+
+namespace snort
+{
+class Flow;
+class IpsContext;
+
/* packet status flags */
#define PKT_REBUILT_FRAG 0x00000001 /* is a rebuilt fragment */
#define PKT_REBUILT_STREAM 0x00000002 /* is a rebuilt stream */
Packet(const Packet&) = delete;
Packet& operator=(const Packet&) = delete;
- class Flow* flow; /* for session tracking */
- class Endianness* endianness;
- class Obfuscator* obfuscator;
+ Flow* flow; /* for session tracking */
+ Endianness* endianness;
+ Obfuscator* obfuscator;
uint32_t packet_flags; /* special flags for the packet */
uint32_t xtradata_mask;
// nothing after this point is zeroed ...
// Everything beyond this point is set by PacketManager::decode()
- class IpsContext* context; // set by control
+ IpsContext* context; // set by control
const DAQ_PktHdr_t* pkth; // packet meta data
const uint8_t* pkt; // raw packet data
return value;
#endif
}
-
+}
#endif
#include "icmp4.h"
#include "icmp6.h"
+using namespace snort;
+
THREAD_LOCAL ProfileStats decodePerfStats;
// Decoding statistics
switch (type)
{
- case UnreachResponse::NET:
+ case snort::UnreachResponse::NET:
icmph->code = icmp::IcmpCode::NET_UNREACH;
break;
- case UnreachResponse::HOST:
+ case snort::UnreachResponse::HOST:
icmph->code = icmp::IcmpCode::HOST_UNREACH;
break;
- case UnreachResponse::PORT:
+ case snort::UnreachResponse::PORT:
icmph->code = icmp::IcmpCode::PORT_UNREACH;
break;
- case UnreachResponse::FWD:
+ case snort::UnreachResponse::FWD:
icmph->code = icmp::IcmpCode::PKT_FILTERED;
break;
default: // future proofing
switch (type)
{
- case UnreachResponse::NET:
+ case snort::UnreachResponse::NET:
icmph->code = icmp::Icmp6Code::UNREACH_NET;
break;
- case UnreachResponse::HOST:
+ case snort::UnreachResponse::HOST:
icmph->code = icmp::Icmp6Code::UNREACH_HOST;
break;
- case UnreachResponse::PORT:
+ case snort::UnreachResponse::PORT:
icmph->code = icmp::Icmp6Code::UNREACH_PORT;
break;
- case UnreachResponse::FWD:
+ case snort::UnreachResponse::FWD:
icmph->code = icmp::Icmp6Code::UNREACH_FILTER_PROHIB;
break;
default: // future proofing
#include "managers/codec_manager.h"
#include "protocols/packet.h"
-struct Packet;
struct TextLog;
+namespace snort
+{
+struct Packet;
+
enum class TcpResponse
{
FIN,
static std::array<PegCount, s_stats.size()> g_stats;
static const std::array<const char*, stat_offset> stat_names;
};
-
+}
#endif
#include <cstdint>
+namespace snort
+{
+namespace tcp
+{
// these are bits in th_flags:
#define TH_FIN 0x01
#define TH_SYN 0x02
#define GET_PKT_SEQ(p) (ntohl((p)->ptrs.tcph->th_seq))
-namespace tcp
-{
constexpr uint8_t TCP_MIN_HEADER_LEN = 20; // this is actually the minimal TCP header length
constexpr int OPT_TRUNC = -1;
constexpr int OPT_BADLEN = -2;
{ th_urp = new_urp; }
};
} // namespace tcp
+} // namespace snort
#endif
#include "packet.h"
#include "tcp.h"
-namespace tcp
+namespace snort
{
-TcpOptIteratorIter::TcpOptIteratorIter(const TcpOption* first_opt) : opt(first_opt)
+namespace tcp
{
-}
+TcpOptIteratorIter::TcpOptIteratorIter(const TcpOption* first_opt) : opt(first_opt) { }
-const TcpOption& TcpOptIteratorIter::operator*() const
-{ return *opt; }
+const TcpOption& TcpOptIteratorIter::operator*() const { return *opt; }
TcpOptIterator::TcpOptIterator(const TCPHdr* const tcp_header, const Packet* const p)
{
return TcpOptIteratorIter(reinterpret_cast<const TcpOption*>(end_ptr));
}
} // namespace ip
+} // namespace snort
#include "main/snort_types.h"
+namespace snort
+{
struct Packet;
namespace tcp
const uint8_t* end_ptr;
};
} // namespace tcp
+} // namespace snort
#endif
#include <arpa/inet.h>
+namespace snort
+{
namespace udp
{
constexpr uint8_t UDP_HEADER_LEN = 8;
inline uint16_t raw_cksum() const
{ return uh_chk; }
};
-} // namespace
+} // namespace udp
+} // namespace snort
#endif
#include <arpa/inet.h>
+namespace snort
+{
namespace vlan
{
struct VlanTagHdr
{ return ntohs(vth_proto); }
};
} // namespace vlan
+} // namespace snort
#endif
#include <cstdint>
+namespace snort
+{
namespace wlan
{
/*
#define WLAN_FLAG_WEP 0x4000 /* Wep Enabled 00000010 */
#define WLAN_FLAG_ORDER 0x8000 /* Strict Order 00000001 */
} // namespace wlan
+} // namespace snort
#endif
#define EXPECT_EVENT_TYPE_EARLY_SESSION_CREATE_KEY "expect_event_type_early_session_create"
-struct Packet;
-class FlowData;
+namespace snort
+{
struct ExpectFlow;
+class FlowData;
+struct Packet;
+}
-class ExpectEvent : public DataEvent
+class ExpectEvent : public snort::DataEvent
{
public:
- ExpectEvent(const Packet* ctrl_packet, ExpectFlow* ef, const FlowData* fd)
+ ExpectEvent(const snort::Packet* ctrl_packet, snort::ExpectFlow* ef,
+ const snort::FlowData* fd)
{
p = ctrl_packet;
expect_flow = ef;
flow_data = fd;
}
- const Packet* get_packet() override
+ const snort::Packet* get_packet() override
{ return p; }
- ExpectFlow* get_expect_flow()
+ snort::ExpectFlow* get_expect_flow()
{ return expect_flow; }
- const FlowData* get_flow_data()
+ const snort::FlowData* get_flow_data()
{ return flow_data; }
private:
- const Packet* p;
- ExpectFlow* expect_flow;
- const FlowData* flow_data;
+ const snort::Packet* p;
+ snort::ExpectFlow* expect_flow;
+ const snort::FlowData* flow_data;
};
#endif
class HttpMsgHeader;
-class SO_PUBLIC HttpEvent : public DataEvent
+class SO_PUBLIC HttpEvent : public snort::DataEvent
{
public:
HttpEvent(HttpMsgHeader* http_msg_header_) :
#include "service_inspectors/sip/sip_dialog.h"
+using namespace snort;
using namespace std;
SipEvent::SipEvent(const Packet* p, const SIPMsg* msg, const SIP_DialogData* dialog)
SIP_EVENT_TYPE_SIP_DIALOG
};
+namespace snort
+{
struct Packet;
struct SfIp;
+}
struct SIPMsg;
struct SIP_DialogData;
struct SIP_MediaSession;
SipEventMediaData(SIP_MediaData* data)
{ this->data = data; }
- const SfIp* get_address() const;
+ const snort::SfIp* get_address() const;
uint16_t get_port() const;
private:
SIP_MediaData* current_media_data = nullptr;
};
-class SipEvent : public DataEvent
+class SipEvent : public snort::DataEvent
{
public:
- SipEvent(const Packet*, const SIPMsg*, const SIP_DialogData*);
+ SipEvent(const snort::Packet*, const SIPMsg*, const SIP_DialogData*);
~SipEvent() override;
- const Packet* get_packet() override
+ const snort::Packet* get_packet() override
{ return p; }
const char* get_from() const
SipEventMediaSession* next_media_session();
private:
- const Packet* p;
+ const snort::Packet* p;
const SIPMsg* msg;
const SIP_DialogData* dialog;
#include "acsmx2.h"
+using namespace snort;
+
//-------------------------------------------------------------------------
// "ac_banded"
//-------------------------------------------------------------------------
#include "bnfa_search.h"
+using namespace snort;
+
//-------------------------------------------------------------------------
// "ac_bnfa"
//-------------------------------------------------------------------------
#include "acsmx2.h"
+using namespace snort;
+
//-------------------------------------------------------------------------
// "ac_full"
//-------------------------------------------------------------------------
#include "acsmx2.h"
+using namespace snort;
+
//-------------------------------------------------------------------------
// "ac_sparse"
//-------------------------------------------------------------------------
#include "acsmx2.h"
+using namespace snort;
+
//-------------------------------------------------------------------------
// "ac_sparse_bands"
//-------------------------------------------------------------------------
#include "acsmx.h"
+using namespace snort;
+
//-------------------------------------------------------------------------
// "ac_std"
//-------------------------------------------------------------------------
return 0;
}
-static void acsmBuildMatchStateTrees(SnortConfig* sc, ACSM_STRUCT* acsm)
+static void acsmBuildMatchStateTrees(snort::SnortConfig* sc, ACSM_STRUCT* acsm)
{
ACSM_PATTERN* mlist;
return 0;
}
-int acsmCompile(
- SnortConfig* sc, ACSM_STRUCT* acsm)
+int acsmCompile(snort::SnortConfig* sc, ACSM_STRUCT* acsm)
{
if ( int rval = _acsmCompile (acsm) )
return rval;
#include "search_common.h"
+namespace snort
+{
+struct SnortConfig;
+}
+
#define ALPHABET_SIZE 256
#define ACSM_FAIL_STATE (-1)
int acsmAddPattern(ACSM_STRUCT* p, const uint8_t* pat, unsigned n,
bool nocase, bool negative, void* id);
-int acsmCompile(struct SnortConfig*, ACSM_STRUCT*);
+int acsmCompile(snort::SnortConfig*, ACSM_STRUCT*);
int acsmSearch(ACSM_STRUCT * acsm, const uint8_t* T,
int n, MpseMatch, void* context, int* current_state);
}
}
-static void acsmBuildMatchStateTrees2(SnortConfig* sc, ACSM_STRUCT2* acsm)
+static void acsmBuildMatchStateTrees2(snort::SnortConfig* sc, ACSM_STRUCT2* acsm)
{
ACSM_PATTERN2** MatchList = acsm->acsmMatchList;
ACSM_PATTERN2* mlist;
return 0;
}
-int acsmCompile2(
- SnortConfig* sc, ACSM_STRUCT2* acsm)
+int acsmCompile2(snort::SnortConfig* sc, ACSM_STRUCT2* acsm)
{
if ( int rval = _acsmCompile2(acsm) )
return rval;
#include "search_common.h"
+namespace snort
+{
+struct SnortConfig;
+}
+
#define MAX_ALPHABET_SIZE 256
/*
ACSM_STRUCT2* p, const uint8_t* pat, unsigned n,
bool nocase, bool negative, void* id);
-int acsmCompile2(struct SnortConfig*, ACSM_STRUCT2*);
+int acsmCompile2(snort::SnortConfig*, ACSM_STRUCT2*);
int acsm_search_nfa(
ACSM_STRUCT2*, const uint8_t* T, int n, MpseMatch, void* context, int* current_state);
#include "search_engines.h"
+using namespace snort;
+
extern const BaseApi* se_ac_banded;
extern const BaseApi* se_ac_full;
extern const BaseApi* se_ac_sparse;
return 0;
}
-static void bnfaBuildMatchStateTrees(SnortConfig* sc, bnfa_struct_t* bnfa)
+static void bnfaBuildMatchStateTrees(snort::SnortConfig* sc, bnfa_struct_t* bnfa)
{
bnfa_match_node_t* mn;
bnfa_match_node_t** MatchList = bnfa->bnfaMatchList;
return 0;
}
-int bnfaCompile(
- SnortConfig* sc, bnfa_struct_t* bnfa)
+int bnfaCompile(snort::SnortConfig* sc, bnfa_struct_t* bnfa)
{
if ( int rval = _bnfaCompile (bnfa) )
return rval;
#include "search_common.h"
+namespace snort
+{
+struct SnortConfig;
+}
+
/* debugging - allow printing the trie and nfa in list format
#define ALLOW_LIST_PRINT */
bnfa_struct_t* pstruct, const uint8_t* pat, unsigned patlen,
bool nocase, bool negative, void* userdata);
-int bnfaCompile(struct SnortConfig*, bnfa_struct_t*);
+int bnfaCompile(snort::SnortConfig*, bnfa_struct_t*);
unsigned _bnfa_search_csparse_nfa(
bnfa_struct_t * pstruct, const uint8_t* t, int tlen, MpseMatch,
#include "main/snort_config.h"
#include "utils/stats.h"
+using namespace snort;
+
struct Pattern
{
std::string pat;
#ifndef HYPERSCAN_H
#define HYPERSCAN_H
+namespace snort
+{
struct SnortConfig;
-void hyperscan_setup(SnortConfig*);
-void hyperscan_cleanup(SnortConfig*);
+}
+
+void hyperscan_setup(snort::SnortConfig*);
+void hyperscan_cleanup(snort::SnortConfig*);
#endif
#ifndef SEARCH_COMMON_H
#define SEARCH_COMMON_H
-// interface to Mpse
+namespace snort
+{
+ struct SnortConfig;
+}
struct MpseAgent
{
- int (* build_tree)(struct SnortConfig*, void* id, void** tree);
+ int (* build_tree)(snort::SnortConfig*, void* id, void** tree);
int (* negate_list)(void* id, void** list);
void (* user_free)(void*);
#include "managers/plugin_manager.h"
-struct BaseApi;
+using namespace snort;
+
extern const BaseApi* se_ac_bnfa[];
#ifdef HAVE_HYPERSCAN
#ifndef SEARCH_ENGINES_H
#define SEARCH_ENGINES_H
+namespace snort
+{
struct BaseApi;
+}
void load_search_engines();
#include "managers/mpse_manager.h"
+namespace snort
+{
SearchTool::SearchTool(const char* method, bool dfa)
{
mpse = MpseManager::get_search_engine(method);
return num;
}
-
+} // namespace snort
#include "framework/mpse.h"
+namespace snort
+{
class SO_PUBLIC SearchTool
{
public:
class Mpse* mpse;
unsigned max_len;
};
-
+} // namespace snort
#endif
#include <CppUTest/CommandLineTestRunner.h>
#include <CppUTest/TestHarness.h>
+using namespace snort;
+
//-------------------------------------------------------------------------
// base stuff
//-------------------------------------------------------------------------
-
+namespace snort
+{
Mpse::Mpse(const char*) { }
int Mpse::search(
return _search(T, n, match, context, current_state);
}
+SnortConfig s_conf;
+THREAD_LOCAL SnortConfig* snort_conf = &s_conf;
+
+static SnortState s_state;
+
+SnortConfig::SnortConfig(SnortConfig*)
+{
+ state = &s_state;
+ memset(state, 0, sizeof(*state));
+ num_slots = 1;
+}
+
+SnortConfig::~SnortConfig() { }
+
+SnortConfig* SnortConfig::get_conf()
+{ return snort_conf; }
+
+}
//-------------------------------------------------------------------------
// stubs, spies, etc.
//-------------------------------------------------------------------------
void* /*user*/, void* /*tree*/, int /*index*/, void* /*context*/, void* /*list*/)
{ ++hits; return 0; }
-SnortConfig s_conf;
-THREAD_LOCAL SnortConfig* snort_conf = &s_conf;
-
-static SnortState s_state;
-
-SnortConfig::SnortConfig(SnortConfig*)
-{
- state = &s_state;
- memset(state, 0, sizeof(*state));
- num_slots = 1;
-}
-
-SnortConfig::~SnortConfig() { }
-
-SnortConfig* SnortConfig::get_conf()
-{ return snort_conf; }
unsigned get_instance_id()
{ return 0; }
#include <CppUTest/CommandLineTestRunner.h>
#include <CppUTest/TestHarness.h>
+using namespace snort;
+
//-------------------------------------------------------------------------
// base stuff
//-------------------------------------------------------------------------
+namespace snort
+{
SnortConfig s_conf;
+
THREAD_LOCAL SnortConfig* snort_conf = &s_conf;
static SnortState s_state;
SnortConfig* SnortConfig::get_conf()
{ return snort_conf; }
+}
unsigned get_instance_id()
{ return 0; }
static void* s_tree = (void*)"tree";
static void* s_list = (void*)"list";
+namespace snort
+{
static MpseAgent s_agent =
{
[](struct SnortConfig* sc, void*, void** ppt)
[](void** ppl) { CHECK(*ppl == s_list); }
};
+Mpse::Mpse(const char*) { }
+
+int Mpse::search(
+ const unsigned char* T, int n, MpseMatch match,
+ void* context, int* current_state)
+{
+ return _search(T, n, match, context, current_state);
+}
+
+int Mpse::search_all(
+ const unsigned char* T, int n, MpseMatch match,
+ void* context, int* current_state)
+{
+ return _search(T, n, match, context, current_state);
+}
+}
+
extern const BaseApi* se_ac_bnfa;
Mpse* mpse = nullptr;
mpse_api->dtor(mpse);
}
-Mpse::Mpse(const char*) { }
-
-int Mpse::search(
- const unsigned char* T, int n, MpseMatch match,
- void* context, int* current_state)
-{
- return _search(T, n, match, context, current_state);
-}
-
-int Mpse::search_all(
- const unsigned char* T, int n, MpseMatch match,
- void* context, int* current_state)
-{
- return _search(T, n, match, context, current_state);
-}
static int pattern_id = 0;
static int Test_SearchStrFound(
#define s_help \
"back orifice detection"
+using namespace snort;
+
/* global keyvalue for the BoRand() function */
static THREAD_LOCAL uint64_t holdrand = 1;
#include "dce_tcp.h"
#include "dce_tcp_module.h"
+using namespace snort;
+
static THREAD_LOCAL int co_reassembled = 0;
/********************************************************************
#include "dce_tcp.h"
#include "dce_udp.h"
+using namespace snort;
+
THREAD_LOCAL int dce2_detected = 0;
static THREAD_LOCAL bool using_rpkt = false;
}
}
-static void dce2_protocol_detect(DCE2_SsnData* sd, Packet* pkt)
+static void dce2_protocol_detect(DCE2_SsnData* sd, snort::Packet* pkt)
{
if (sd->trans == DCE2_TRANS_TYPE__TCP)
{
DCE2_Detect(sd);
return;
}
- Packet* top_pkt = DetectionEngine::get_current_packet();
+ snort::Packet* top_pkt = DetectionEngine::get_current_packet();
DCE2_PrintRoptions(&sd->ropts);
DebugMessage(DEBUG_DCE_COMMON, "Payload:\n");
DebugMessage(DEBUG_DCE_COMMON, "----------------------------------------------------------\n");
}
-DCE2_SsnData* get_dce2_session_data(Packet* p)
+DCE2_SsnData* get_dce2_session_data(snort::Packet* p)
{
DCE2_SmbSsnData* smb_data = get_dce2_smb_session_data(p->flow);
DCE2_SsnData* sd = (smb_data != nullptr) ? &(smb_data->sd) : nullptr;
uint16_t DCE2_GetRpktMaxData(DCE2_SsnData* sd, DCE2_RpktType rtype)
{
- Packet* p = sd->wire_pkt;
+ snort::Packet* p = sd->wire_pkt;
uint16_t overhead = 0;
switch (rtype)
DebugFormat(DEBUG_DCE_COMMON,"Invalid reassembly packet type: %d\n",rtype);
return 0;
}
- return (Packet::max_dsize - overhead);
+ return (snort::Packet::max_dsize - overhead);
}
-static void dce2_fill_rpkt_info(Packet* rpkt, Packet* p)
+static void dce2_fill_rpkt_info(snort::Packet* rpkt, snort::Packet* p)
{
rpkt->endianness = new DceEndianness();
rpkt->pkth = p->pkth;
rpkt->user_network_policy_id = p->user_network_policy_id;
}
-Packet* DCE2_GetRpkt(Packet* p,DCE2_RpktType rpkt_type,
+snort::Packet* DCE2_GetRpkt(snort::Packet* p,DCE2_RpktType rpkt_type,
const uint8_t* data, uint32_t data_len)
{
- Packet* rpkt = DetectionEngine::set_next_packet();
+ snort::Packet* rpkt = DetectionEngine::set_next_packet();
uint8_t* wrdata = const_cast<uint8_t*>(rpkt->data);
dce2_fill_rpkt_info(rpkt, p);
uint16_t data_overhead = 0;
return nullptr;
}
- if ((data_overhead + data_len) > Packet::max_dsize)
- data_len -= (data_overhead + data_len) - Packet::max_dsize;
+ if ((data_overhead + data_len) > snort::Packet::max_dsize)
+ data_len -= (data_overhead + data_len) - snort::Packet::max_dsize;
- if (data_len > Packet::max_dsize - data_overhead)
+ if (data_len > snort::Packet::max_dsize - data_overhead)
{
DebugMessage(DEBUG_DCE_COMMON, "Failed to create reassembly packet.\n");
delete rpkt->endianness;
}
memcpy_s((void*)(rpkt->data + data_overhead),
- Packet::max_dsize - data_overhead, data, data_len);
+ snort::Packet::max_dsize - data_overhead, data, data_len);
rpkt->dsize = data_len + data_overhead;
using_rpkt = true;
return rpkt;
}
-DCE2_Ret DCE2_AddDataToRpkt(Packet* rpkt, const uint8_t* data, uint32_t data_len)
+DCE2_Ret DCE2_AddDataToRpkt(snort::Packet* rpkt, const uint8_t* data, uint32_t data_len)
{
if ((rpkt == nullptr) || (data == nullptr) || (data_len == 0))
return DCE2_RET__ERROR;
return DCE2_RET__ERROR;
// FIXIT-L PORT_IF_NEEDED packet size and hdr check
- const uint8_t* pkt_data_end = rpkt->data + Packet::max_dsize;
+ const uint8_t* pkt_data_end = rpkt->data + snort::Packet::max_dsize;
const uint8_t* payload_end = rpkt->data + rpkt->dsize;
if ((payload_end + data_len) > pkt_data_end)
data_len = pkt_data_end - payload_end;
- if (data_len > Packet::max_dsize - rpkt->dsize)
+ if (data_len > snort::Packet::max_dsize - rpkt->dsize)
return DCE2_RET__ERROR;
- memcpy_s((void*)(payload_end), Packet::max_dsize - rpkt->dsize,
+ memcpy_s((void*)(payload_end), snort::Packet::max_dsize - rpkt->dsize,
data, data_len);
rpkt->dsize += (uint16_t)data_len;
#include "dce_list.h"
-extern const InspectApi dce2_smb_api;
-extern const InspectApi dce2_tcp_api;
-extern const InspectApi dce2_udp_api;
-extern const InspectApi dce_http_proxy_api;
-extern const InspectApi dce_http_server_api;
+extern const snort::InspectApi dce2_smb_api;
+extern const snort::InspectApi dce2_tcp_api;
+extern const snort::InspectApi dce2_udp_api;
+extern const snort::InspectApi dce_http_proxy_api;
+extern const snort::InspectApi dce_http_server_api;
extern THREAD_LOCAL int dce2_detected;
#define GID_DCE2 133
DCE2_Policy server_policy;
DCE2_Policy client_policy;
int flags;
- Packet* wire_pkt;
+ snort::Packet* wire_pkt;
uint64_t alert_mask;
DCE2_Roptions ropts;
void* config;
return UINT16_MAX;
}
-inline int DCE2_SsnFromServer(Packet* p)
+inline int DCE2_SsnFromServer(snort::Packet* p)
{
return p->is_from_server();
}
-inline int DCE2_SsnFromClient(Packet* p)
+inline int DCE2_SsnFromClient(snort::Packet* p)
{
return p->is_from_client();
}
inline void dce_alert(uint32_t gid, uint32_t sid, dce2CommonStats* stats)
{
- DetectionEngine::queue_event(gid,sid);
+ snort::DetectionEngine::queue_event(gid,sid);
stats->events++;
}
-bool dce2_set_common_config(Value&, dce2CommonProtoConf&);
+bool dce2_set_common_config(snort::Value&, dce2CommonProtoConf&);
void print_dce2_common_config(dce2CommonProtoConf&);
-bool dce2_set_co_config(Value&, dce2CoProtoConf&);
+bool dce2_set_co_config(snort::Value&, dce2CoProtoConf&);
void print_dce2_co_config(dce2CoProtoConf&);
-bool dce2_paf_abort(Flow*, DCE2_SsnData*);
+bool dce2_paf_abort(snort::Flow*, DCE2_SsnData*);
void DCE2_Detect(DCE2_SsnData*);
-Packet* DCE2_GetRpkt(Packet*, DCE2_RpktType, const uint8_t*, uint32_t);
+snort::Packet* DCE2_GetRpkt(snort::Packet*, DCE2_RpktType, const uint8_t*, uint32_t);
uint16_t DCE2_GetRpktMaxData(DCE2_SsnData*, DCE2_RpktType);
-DCE2_Ret DCE2_AddDataToRpkt(Packet*, const uint8_t*, uint32_t);
-DCE2_SsnData* get_dce2_session_data(Packet*);
+DCE2_Ret DCE2_AddDataToRpkt(snort::Packet*, const uint8_t*, uint32_t);
+DCE2_SsnData* get_dce2_session_data(snort::Packet*);
#endif
#include "binder/binder.h"
#include "managers/inspector_manager.h"
-void dce_http_bind(Flow* flow, const char* service)
+void dce_http_bind(snort::Flow* flow, const char* service)
{
assert (flow);
flow->service = service;
- Inspector* ins = InspectorManager::get_binder();
+ snort::Inspector* ins = snort::InspectorManager::get_binder();
if ( ins )
ins->exec(BinderSpace::ExecOperation::HANDLE_GADGET, flow);
#include "flow/flow.h"
-void dce_http_bind(Flow* flow, const char* service);
+void dce_http_bind(snort::Flow* flow, const char* service);
#endif
#include "managers/inspector_manager.h"
#include "stream/libtcp/tcp_stream_session.h"
+using namespace snort;
+
THREAD_LOCAL DceHttpProxyStats dce_http_proxy_stats;
//-------------------------------------------------------------------------
#include "framework/module.h"
#include "main/thread.h"
-struct SnortConfig;
-
-class DceHttpProxyModule : public Module
+class DceHttpProxyModule : public snort::Module
{
public:
DceHttpProxyModule();
#include "catch/snort_catch.h"
#endif
+using namespace snort;
+
// NOTE: These strings must have a length of at least one character
#define HTTP_PROXY_REQUEST "RPC_CONNECT"
#define HTTP_PROXY_RESPONSE "HTTP/1."
#include "dce_common.h"
#include "stream/stream_splitter.h"
-class DceHttpProxySplitter : public StreamSplitter
+class DceHttpProxySplitter : public snort::StreamSplitter
{
public:
DceHttpProxySplitter(bool c2s);
- Status scan(Flow*, const uint8_t* data, uint32_t len,
+ Status scan(snort::Flow*, const uint8_t* data, uint32_t len,
uint32_t flags, uint32_t* fp) override;
- const StreamBuffer reassemble(Flow*, unsigned, unsigned,
+ const snort::StreamBuffer reassemble(snort::Flow*, unsigned, unsigned,
const uint8_t*, unsigned, uint32_t, unsigned&) override;
bool is_paf() override
#include "managers/inspector_manager.h"
#include "stream/libtcp/tcp_stream_session.h"
+using namespace snort;
+
THREAD_LOCAL DceHttpServerStats dce_http_server_stats;
//-------------------------------------------------------------------------
#include "framework/module.h"
#include "main/thread.h"
-struct SnortConfig;
-
-class DceHttpServerModule : public Module
+class DceHttpServerModule : public snort::Module
{
public:
DceHttpServerModule();
#include "catch/snort_catch.h"
#endif
+using namespace snort;
+
// NOTE: These strings must have a length of at least one character
#define HTTP_SERVER_MARKER "ncacn_http/1.0"
#include "dce_common.h"
#include "stream/stream_splitter.h"
-class DceHttpServerSplitter : public StreamSplitter
+class DceHttpServerSplitter : public snort::StreamSplitter
{
public:
DceHttpServerSplitter(bool c2s);
- Status scan(Flow*, const uint8_t* data, uint32_t len,
+ Status scan(snort::Flow*, const uint8_t* data, uint32_t len,
uint32_t flags, uint32_t* fp) override;
// FIXIT-M - Should be able to implement but framework does not permit
/* const StreamBuffer* reassemble(Flow*, unsigned, unsigned,
THREAD_LOCAL dce2SmbStats dce2_smb_stats;
// used here
-THREAD_LOCAL ProfileStats dce2_smb_pstat_main;
-THREAD_LOCAL ProfileStats dce2_smb_pstat_session;
-THREAD_LOCAL ProfileStats dce2_smb_pstat_new_session;
-THREAD_LOCAL ProfileStats dce2_smb_pstat_smb_req;
+THREAD_LOCAL snort::ProfileStats dce2_smb_pstat_main;
+THREAD_LOCAL snort::ProfileStats dce2_smb_pstat_session;
+THREAD_LOCAL snort::ProfileStats dce2_smb_pstat_new_session;
+THREAD_LOCAL snort::ProfileStats dce2_smb_pstat_smb_req;
// used elsewhere
-THREAD_LOCAL ProfileStats dce2_smb_pstat_detect;
-THREAD_LOCAL ProfileStats dce2_smb_pstat_log;
-THREAD_LOCAL ProfileStats dce2_smb_pstat_co_seg;
-THREAD_LOCAL ProfileStats dce2_smb_pstat_co_frag;
-THREAD_LOCAL ProfileStats dce2_smb_pstat_co_reass;
-THREAD_LOCAL ProfileStats dce2_smb_pstat_co_ctx;
-THREAD_LOCAL ProfileStats dce2_smb_pstat_smb_seg;
-THREAD_LOCAL ProfileStats dce2_smb_pstat_smb_uid;
-THREAD_LOCAL ProfileStats dce2_smb_pstat_smb_tid;
-THREAD_LOCAL ProfileStats dce2_smb_pstat_smb_fid;
-THREAD_LOCAL ProfileStats dce2_smb_pstat_smb_file;
-THREAD_LOCAL ProfileStats dce2_smb_pstat_smb_file_detect;
-THREAD_LOCAL ProfileStats dce2_smb_pstat_smb_file_api;
-THREAD_LOCAL ProfileStats dce2_smb_pstat_smb_fingerprint;
-THREAD_LOCAL ProfileStats dce2_smb_pstat_smb_negotiate;
+THREAD_LOCAL snort::ProfileStats dce2_smb_pstat_detect;
+THREAD_LOCAL snort::ProfileStats dce2_smb_pstat_log;
+THREAD_LOCAL snort::ProfileStats dce2_smb_pstat_co_seg;
+THREAD_LOCAL snort::ProfileStats dce2_smb_pstat_co_frag;
+THREAD_LOCAL snort::ProfileStats dce2_smb_pstat_co_reass;
+THREAD_LOCAL snort::ProfileStats dce2_smb_pstat_co_ctx;
+THREAD_LOCAL snort::ProfileStats dce2_smb_pstat_smb_seg;
+THREAD_LOCAL snort::ProfileStats dce2_smb_pstat_smb_uid;
+THREAD_LOCAL snort::ProfileStats dce2_smb_pstat_smb_tid;
+THREAD_LOCAL snort::ProfileStats dce2_smb_pstat_smb_fid;
+THREAD_LOCAL snort::ProfileStats dce2_smb_pstat_smb_file;
+THREAD_LOCAL snort::ProfileStats dce2_smb_pstat_smb_file_detect;
+THREAD_LOCAL snort::ProfileStats dce2_smb_pstat_smb_file_api;
+THREAD_LOCAL snort::ProfileStats dce2_smb_pstat_smb_fingerprint;
+THREAD_LOCAL snort::ProfileStats dce2_smb_pstat_smb_negotiate;
//-------------------------------------------------------------------------
// debug stuff
// class stuff
//-------------------------------------------------------------------------
-class Dce2Smb : public Inspector
+class Dce2Smb : public snort::Inspector
{
public:
Dce2Smb(dce2SmbProtoConf&);
~Dce2Smb() override;
- void show(SnortConfig*) override;
- void eval(Packet*) override;
- StreamSplitter* get_splitter(bool c2s) override
+ void show(snort::SnortConfig*) override;
+ void eval(snort::Packet*) override;
+ snort::StreamSplitter* get_splitter(bool c2s) override
{
return new Dce2SmbSplitter(c2s);
}
if ((config.smb_file_inspection == DCE2_SMB_FILE_INSPECTION_ONLY)
|| (config.smb_file_inspection == DCE2_SMB_FILE_INSPECTION_ON))
{
- Active::set_enabled();
+ snort::Active::set_enabled();
}
}
}
}
-void Dce2Smb::show(SnortConfig*)
+void Dce2Smb::show(snort::SnortConfig*)
{
print_dce2_smb_conf(config);
}
-void Dce2Smb::eval(Packet* p)
+void Dce2Smb::eval(snort::Packet* p)
{
DCE2_SmbSsnData* dce2_smb_sess;
- Profile profile(dce2_smb_pstat_main);
+ snort::Profile profile(dce2_smb_pstat_main);
assert(p->has_tcp_data());
assert(p->flow);
// api stuff
//-------------------------------------------------------------------------
-static Module* mod_ctor()
+static snort::Module* mod_ctor()
{
return new Dce2SmbModule;
}
-static void mod_dtor(Module* m)
+static void mod_dtor(snort::Module* m)
{
delete m;
}
DCE2_SmbInitDeletePdu();
}
-static Inspector* dce2_smb_ctor(Module* m)
+static snort::Inspector* dce2_smb_ctor(snort::Module* m)
{
Dce2SmbModule* mod = (Dce2SmbModule*)m;
dce2SmbProtoConf config;
return new Dce2Smb(config);
}
-static void dce2_smb_dtor(Inspector* p)
+static void dce2_smb_dtor(snort::Inspector* p)
{
delete p;
}
-const InspectApi dce2_smb_api =
+const snort::InspectApi dce2_smb_api =
{
{
PT_INSPECTOR,
- sizeof(InspectApi),
+ sizeof(snort::InspectApi),
INSAPI_VERSION,
0,
API_RESERVED,
mod_ctor,
mod_dtor
},
- IT_SERVICE,
+ snort::IT_SERVICE,
(uint16_t)PktType::PDU,
nullptr, // buffers
"netbios-ssn",
};
extern THREAD_LOCAL dce2SmbStats dce2_smb_stats;
-extern THREAD_LOCAL ProfileStats dce2_smb_pstat_main;
-extern THREAD_LOCAL ProfileStats dce2_smb_pstat_session;
-extern THREAD_LOCAL ProfileStats dce2_smb_pstat_new_session;
-extern THREAD_LOCAL ProfileStats dce2_smb_pstat_detect;
-extern THREAD_LOCAL ProfileStats dce2_smb_pstat_log;
-extern THREAD_LOCAL ProfileStats dce2_smb_pstat_co_seg;
-extern THREAD_LOCAL ProfileStats dce2_smb_pstat_co_frag;
-extern THREAD_LOCAL ProfileStats dce2_smb_pstat_co_reass;
-extern THREAD_LOCAL ProfileStats dce2_smb_pstat_co_ctx;
-extern THREAD_LOCAL ProfileStats dce2_smb_pstat_smb_seg;
-extern THREAD_LOCAL ProfileStats dce2_smb_pstat_smb_req;
-extern THREAD_LOCAL ProfileStats dce2_smb_pstat_smb_uid;
-extern THREAD_LOCAL ProfileStats dce2_smb_pstat_smb_tid;
-extern THREAD_LOCAL ProfileStats dce2_smb_pstat_smb_fid;
-extern THREAD_LOCAL ProfileStats dce2_smb_pstat_smb_file;
-extern THREAD_LOCAL ProfileStats dce2_smb_pstat_smb_file_detect;
-extern THREAD_LOCAL ProfileStats dce2_smb_pstat_smb_file_api;
-extern THREAD_LOCAL ProfileStats dce2_smb_pstat_smb_fingerprint;
-extern THREAD_LOCAL ProfileStats dce2_smb_pstat_smb_negotiate;
+extern THREAD_LOCAL snort::ProfileStats dce2_smb_pstat_main;
+extern THREAD_LOCAL snort::ProfileStats dce2_smb_pstat_session;
+extern THREAD_LOCAL snort::ProfileStats dce2_smb_pstat_new_session;
+extern THREAD_LOCAL snort::ProfileStats dce2_smb_pstat_detect;
+extern THREAD_LOCAL snort::ProfileStats dce2_smb_pstat_log;
+extern THREAD_LOCAL snort::ProfileStats dce2_smb_pstat_co_seg;
+extern THREAD_LOCAL snort::ProfileStats dce2_smb_pstat_co_frag;
+extern THREAD_LOCAL snort::ProfileStats dce2_smb_pstat_co_reass;
+extern THREAD_LOCAL snort::ProfileStats dce2_smb_pstat_co_ctx;
+extern THREAD_LOCAL snort::ProfileStats dce2_smb_pstat_smb_seg;
+extern THREAD_LOCAL snort::ProfileStats dce2_smb_pstat_smb_req;
+extern THREAD_LOCAL snort::ProfileStats dce2_smb_pstat_smb_uid;
+extern THREAD_LOCAL snort::ProfileStats dce2_smb_pstat_smb_tid;
+extern THREAD_LOCAL snort::ProfileStats dce2_smb_pstat_smb_fid;
+extern THREAD_LOCAL snort::ProfileStats dce2_smb_pstat_smb_file;
+extern THREAD_LOCAL snort::ProfileStats dce2_smb_pstat_smb_file_detect;
+extern THREAD_LOCAL snort::ProfileStats dce2_smb_pstat_smb_file_api;
+extern THREAD_LOCAL snort::ProfileStats dce2_smb_pstat_smb_fingerprint;
+extern THREAD_LOCAL snort::ProfileStats dce2_smb_pstat_smb_negotiate;
enum DCE2_SmbSsnState
{
int fail_state;
};
-class Dce2SmbFlowData : public FlowData
+class Dce2SmbFlowData : public snort::FlowData
{
public:
Dce2SmbFlowData();
static void init()
{
- inspector_id = FlowData::create_flow_data_id();
+ inspector_id = snort::FlowData::create_flow_data_id();
}
public:
#define DCE2_MOCK_HDR_LEN__SMB_SRV \
(sizeof(NbssHdr) + sizeof(SmbNtHdr) + sizeof(SmbReadAndXResp))
-DCE2_SmbSsnData* get_dce2_smb_session_data(Flow*);
+DCE2_SmbSsnData* get_dce2_smb_session_data(snort::Flow*);
const char* get_smb_com_string(uint8_t);
#endif
#include "dce_smb_module.h"
#include "dce_smb_utils.h"
+using namespace snort;
+
#define UNKNOWN_FILE_SIZE ~0
// FIXIT-L port fileCache related code along with
const bool is_ipc, const uint64_t fid);
/* Check smb version based on smb header */
-DCE2_SmbVersion DCE2_Smb2Version(const Packet* p);
+DCE2_SmbVersion DCE2_Smb2Version(const snort::Packet* p);
#endif /* _DCE_SMB2_H_ */
{
const uint8_t* data_ptr = DCE2_BufferData(ftracker->fp_writex_raw->buf);
uint32_t data_len = DCE2_BufferLength(ftracker->fp_writex_raw->buf);
- Packet* rpkt = DCE2_SmbGetRpkt(ssd,
+ snort::Packet* rpkt = DCE2_SmbGetRpkt(ssd,
&data_ptr, &data_len, DCE2_RPKT_TYPE__SMB_TRANS);
if (rpkt == nullptr)
uint16_t byte_count = DCE2_ComInfoByteCount(com_info);
uint16_t com_dcnt = SmbReadRespCount((const SmbReadResp*)nb_ptr);
uint8_t fmt = *(nb_ptr + com_size);
- uint16_t fmt_dcnt = alignedNtohs((const uint16_t*)(nb_ptr + com_size + 1));
+ uint16_t fmt_dcnt = snort::alignedNtohs((const uint16_t*)(nb_ptr + com_size + 1));
DCE2_MOVE(nb_ptr, nb_len, (com_size + 3));
uint16_t byte_count = DCE2_ComInfoByteCount(com_info);
uint8_t fmt = *(nb_ptr + com_size);
uint16_t com_dcnt = SmbWriteReqCount((const SmbWriteReq*)nb_ptr);
- uint16_t fmt_dcnt = alignedNtohs((const uint16_t*)(nb_ptr + com_size + 1));
+ uint16_t fmt_dcnt = snort::alignedNtohs((const uint16_t*)(nb_ptr + com_size + 1));
uint16_t fid = SmbWriteReqFid((const SmbWriteReq*)nb_ptr);
uint32_t offset = SmbWriteReqOffset((const SmbWriteReq*)nb_ptr);
uint16_t byte_count = DCE2_ComInfoByteCount(com_info);
uint8_t fmt = *(nb_ptr + com_size);
uint16_t com_dcnt = SmbLockAndReadRespCount((const SmbLockAndReadResp*)nb_ptr);
- uint16_t fmt_dcnt = alignedNtohs((const uint16_t*)(nb_ptr + com_size + 1));
+ uint16_t fmt_dcnt = snort::alignedNtohs((const uint16_t*)(nb_ptr + com_size + 1));
DCE2_MOVE(nb_ptr, nb_len, (com_size + 3));
uint16_t byte_count = DCE2_ComInfoByteCount(com_info);
uint8_t fmt = *(nb_ptr + com_size);
uint16_t com_dcnt = SmbWriteAndUnlockReqCount((const SmbWriteAndUnlockReq*)nb_ptr);
- uint16_t fmt_dcnt = alignedNtohs((const uint16_t*)(nb_ptr + com_size + 1));
+ uint16_t fmt_dcnt = snort::alignedNtohs((const uint16_t*)(nb_ptr + com_size + 1));
uint16_t fid = SmbWriteAndUnlockReqFid((const SmbWriteAndUnlockReq*)nb_ptr);
uint32_t offset = SmbWriteAndUnlockReqOffset((const SmbWriteAndUnlockReq*)nb_ptr);
if ((word_count != 13) && (word_count != 12))
return DCE2_RET__SUCCESS;
- Profile profile(dce2_smb_pstat_smb_fingerprint);
+ snort::Profile profile(dce2_smb_pstat_smb_fingerprint);
if (word_count == 13)
{
if (DCE2_ComInfoByteCount(com_info) == 0)
return DCE2_RET__SUCCESS;
- Profile profile(dce2_smb_pstat_smb_fingerprint);
+ snort::Profile profile(dce2_smb_pstat_smb_fingerprint);
if (DCE2_ComInfoWordCount(com_info) == 3)
{
if (!DCE2_ComInfoCanProcessCommand(com_info))
return DCE2_RET__ERROR;
- Profile profile(dce2_smb_pstat_smb_negotiate);
+ snort::Profile profile(dce2_smb_pstat_smb_negotiate);
if (DCE2_ComInfoIsRequest(com_info))
{
#include "dce_smb.h"
+using namespace snort;
using namespace std;
static const PegInfo dce2_smb_pegs[] =
return(true);
}
-bool Dce2SmbModule::set(const char*, Value& v, SnortConfig*)
+bool Dce2SmbModule::set(const char*, snort::Value& v, snort::SnortConfig*)
{
if (dce2_set_co_config(v,config.common))
return true;
bool legacy_mode;
};
-class Dce2SmbModule : public Module
+class Dce2SmbModule : public snort::Module
{
public:
Dce2SmbModule();
~Dce2SmbModule() override;
- bool set(const char*, Value&, SnortConfig*) override;
+ bool set(const char*, snort::Value&, snort::SnortConfig*) override;
unsigned get_gid() const override
{ return GID_DCE2; }
- const RuleMap* get_rules() const override;
+ const snort::RuleMap* get_rules() const override;
const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
- ProfileStats* get_profile(unsigned, const char*&, const char*&) const override;
+ snort::ProfileStats* get_profile(unsigned, const char*&, const char*&) const override;
void get_data(dce2SmbProtoConf&);
Usage get_usage() const override
#include "dce_smb.h"
+using namespace snort;
+
/*********************************************************************
* Function: DCE2_PafSmbIsValidNetbiosHdr()
*
uint64_t nb_hdr; // Enough for NetBIOS header and 4 bytes SMB header
};
-class Dce2SmbSplitter : public StreamSplitter
+class Dce2SmbSplitter : public snort::StreamSplitter
{
public:
Dce2SmbSplitter(bool c2s);
- Status scan(Flow*, const uint8_t* data, uint32_t len,
+ Status scan(snort::Flow*, const uint8_t* data, uint32_t len,
uint32_t flags, uint32_t* fp) override;
bool is_paf() override
// Only two parameters but more seems okay
if (param_len >= 2)
{
- if ((alignedNtohs((const uint16_t*)param_ptr) & PIPE_STATE_MESSAGE_MODE))
+ if ((snort::alignedNtohs((const uint16_t*)param_ptr) & PIPE_STATE_MESSAGE_MODE))
ttracker->pipe_byte_mode = false;
else
ttracker->pipe_byte_mode = true;
|| (ftracker->ff_bytes_processed != 0))
return DCE2_RET__IGNORE;
- ssd->cur_rtracker->file_size = alignedNtohq((const uint64_t*)data_ptr);
+ ssd->cur_rtracker->file_size = snort::alignedNtohq((const uint64_t*)data_ptr);
ssd->cur_rtracker->ftracker = ftracker;
return DCE2_RET__SUCCESS;
{
const uint8_t* data_ptr = DCE2_BufferData(ttracker->dbuf);
uint32_t data_len = DCE2_BufferLength(ttracker->dbuf);
- Packet* rpkt = DCE2_SmbGetRpkt(ssd, &data_ptr,
+ snort::Packet* rpkt = DCE2_SmbGetRpkt(ssd, &data_ptr,
&data_len, DCE2_RPKT_TYPE__SMB_TRANS);
if (rpkt == nullptr)
{
const uint8_t* data_ptr = DCE2_BufferData(ttracker->dbuf);
uint32_t data_len = DCE2_BufferLength(ttracker->dbuf);
- Packet* rpkt = DCE2_SmbGetRpkt(ssd, &data_ptr, &data_len, DCE2_RPKT_TYPE__SMB_TRANS);
+ snort::Packet* rpkt = DCE2_SmbGetRpkt(ssd, &data_ptr, &data_len, DCE2_RPKT_TYPE__SMB_TRANS);
if (rpkt == nullptr)
return DCE2_RET__ERROR;
DCE2_Ret DCE2_SmbBufferTransactionData(DCE2_SmbTransactionTracker* ttracker,
const uint8_t* data_ptr, uint16_t dcnt, uint16_t ddisp)
{
- Profile profile(dce2_smb_pstat_smb_req);
+ snort::Profile profile(dce2_smb_pstat_smb_req);
DebugMessage(DEBUG_DCE_SMB, "Buffering transaction data.\n");
DCE2_Ret DCE2_SmbBufferTransactionParameters(DCE2_SmbTransactionTracker* ttracker,
const uint8_t* param_ptr, uint16_t pcnt, uint16_t pdisp)
{
- Profile profile(dce2_smb_pstat_smb_req);
+ snort::Profile profile(dce2_smb_pstat_smb_req);
DebugMessage(DEBUG_DCE_SMB, "Buffering transaction parameters.\n");
#include "dce_smb_module.h"
+using namespace snort;
+
static uint8_t dce2_smb_delete_pdu[65535];
/********************************************************************
static void DCE2_SmbInjectDeletePdu(DCE2_SmbSsnData* ssd, DCE2_SmbFileTracker* ftracker)
{
- Packet* inject_pkt = Snort::get_packet();
+ Packet* inject_pkt = snort::Snort::get_packet();
if ( inject_pkt->flow != ssd->sd.wire_pkt->flow )
return;
const uint8_t*, uint32_t);
void DCE2_SmbInitRdata(uint8_t*, int);
void DCE2_SmbSetRdata(DCE2_SmbSsnData*, uint8_t*, uint16_t);
-Packet* DCE2_SmbGetRpkt(DCE2_SmbSsnData*, const uint8_t**,
+snort::Packet* DCE2_SmbGetRpkt(DCE2_SmbSsnData*, const uint8_t**,
uint32_t*, DCE2_RpktType);
DCE2_Ret DCE2_SmbHandleSegmentation(DCE2_Buffer**,
const uint8_t*, uint32_t, uint32_t);
inline bool SmbUnicode(const SmbNtHdr* hdr)
{
- return (alignedNtohs(&hdr->smb_flg2) & SMB_FLG2__UNICODE) ? true : false;
+ return (snort::alignedNtohs(&hdr->smb_flg2) & SMB_FLG2__UNICODE) ? true : false;
}
inline bool SmbExtAttrReadOnly(const uint32_t ext_file_attrs)
inline bool SmbStatusNtCodes(const SmbNtHdr* hdr)
{
- if (alignedNtohs(&hdr->smb_flg2) & SMB_FLG2__NT_CODES)
+ if (snort::alignedNtohs(&hdr->smb_flg2) & SMB_FLG2__NT_CODES)
return true;
return false;
}
inline uint32_t SmbNtStatus(const SmbNtHdr* hdr)
{
- return alignedNtohl(&hdr->smb_status.nt_status);
+ return snort::alignedNtohl(&hdr->smb_status.nt_status);
}
inline uint8_t SmbStatusClass(const SmbNtHdr* hdr)
inline uint16_t SmbStatusCode(const SmbNtHdr* hdr)
{
- return alignedNtohs(&hdr->smb_status.smb_status.smb_code);
+ return snort::alignedNtohs(&hdr->smb_status.smb_status.smb_code);
}
inline uint8_t SmbNtStatusSeverity(const SmbNtHdr* hdr)
inline uint16_t SmbPid(const SmbNtHdr* hdr)
{
- return alignedNtohs(&hdr->smb_pid);
+ return snort::alignedNtohs(&hdr->smb_pid);
}
inline uint16_t SmbMid(const SmbNtHdr* hdr)
{
- return alignedNtohs(&hdr->smb_mid);
+ return snort::alignedNtohs(&hdr->smb_mid);
}
inline uint16_t SmbUid(const SmbNtHdr* hdr)
{
- return alignedNtohs(&hdr->smb_uid);
+ return snort::alignedNtohs(&hdr->smb_uid);
}
inline uint16_t SmbTid(const SmbNtHdr* hdr)
{
- return alignedNtohs(&hdr->smb_tid);
+ return snort::alignedNtohs(&hdr->smb_tid);
}
inline bool SmbErrorInvalidDeviceRequest(const SmbNtHdr* hdr)
#include "dce_tcp_module.h"
#include "dce_tcp_paf.h"
+using namespace snort;
+
Dce2TcpFlowData::Dce2TcpFlowData() : FlowData(inspector_id)
{
dce2_tcp_stats.concurrent_sessions++;
};
extern THREAD_LOCAL dce2TcpStats dce2_tcp_stats;
-extern THREAD_LOCAL ProfileStats dce2_tcp_pstat_main;
-extern THREAD_LOCAL ProfileStats dce2_tcp_pstat_session;
-extern THREAD_LOCAL ProfileStats dce2_tcp_pstat_new_session;
-extern THREAD_LOCAL ProfileStats dce2_tcp_pstat_session_state;
-extern THREAD_LOCAL ProfileStats dce2_tcp_pstat_detect;
-extern THREAD_LOCAL ProfileStats dce2_tcp_pstat_log;
-extern THREAD_LOCAL ProfileStats dce2_tcp_pstat_co_seg;
-extern THREAD_LOCAL ProfileStats dce2_tcp_pstat_co_frag;
-extern THREAD_LOCAL ProfileStats dce2_tcp_pstat_co_reass;
-extern THREAD_LOCAL ProfileStats dce2_tcp_pstat_co_ctx;
-
-inline bool DCE2_TcpAutodetect(Packet* p)
+extern THREAD_LOCAL snort::ProfileStats dce2_tcp_pstat_main;
+extern THREAD_LOCAL snort::ProfileStats dce2_tcp_pstat_session;
+extern THREAD_LOCAL snort::ProfileStats dce2_tcp_pstat_new_session;
+extern THREAD_LOCAL snort::ProfileStats dce2_tcp_pstat_session_state;
+extern THREAD_LOCAL snort::ProfileStats dce2_tcp_pstat_detect;
+extern THREAD_LOCAL snort::ProfileStats dce2_tcp_pstat_log;
+extern THREAD_LOCAL snort::ProfileStats dce2_tcp_pstat_co_seg;
+extern THREAD_LOCAL snort::ProfileStats dce2_tcp_pstat_co_frag;
+extern THREAD_LOCAL snort::ProfileStats dce2_tcp_pstat_co_reass;
+extern THREAD_LOCAL snort::ProfileStats dce2_tcp_pstat_co_ctx;
+
+inline bool DCE2_TcpAutodetect(snort::Packet* p)
{
if (p->dsize >= sizeof(DceRpcCoHdr))
{
DCE2_CoTracker co_tracker;
};
-class Dce2TcpFlowData : public FlowData
+class Dce2TcpFlowData : public snort::FlowData
{
public:
Dce2TcpFlowData();
static void init()
{
- inspector_id = FlowData::create_flow_data_id();
+ inspector_id = snort::FlowData::create_flow_data_id();
}
public:
DCE2_TcpSsnData dce2_tcp_session;
};
-DCE2_TcpSsnData* get_dce2_tcp_session_data(Flow*);
+DCE2_TcpSsnData* get_dce2_tcp_session_data(snort::Flow*);
#endif
#include "dce_tcp.h"
+using namespace snort;
using namespace std;
static const Parameter s_params[] =
#include "dce_common.h"
#include "framework/module.h"
+namespace snort
+{
struct SnortConfig;
+}
struct dce2TcpProtoConf
{
dce2CoProtoConf common;
};
-class Dce2TcpModule : public Module
+class Dce2TcpModule : public snort::Module
{
public:
Dce2TcpModule();
- bool set(const char*, Value&, SnortConfig*) override;
+ bool set(const char*, snort::Value&, snort::SnortConfig*) override;
unsigned get_gid() const override
{ return GID_DCE2; }
- const RuleMap* get_rules() const override;
+ const snort::RuleMap* get_rules() const override;
const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
- ProfileStats* get_profile(unsigned, const char*&, const char*&) const override;
+ snort::ProfileStats* get_profile(unsigned, const char*&, const char*&) const override;
void get_data(dce2TcpProtoConf&);
Usage get_usage() const override
#include "dce_tcp.h"
+using namespace snort;
+
/*********************************************************************
* Function: dce2_tcp_paf()
*
uint16_t frag_len;
};
-class Dce2TcpSplitter : public StreamSplitter
+class Dce2TcpSplitter : public snort::StreamSplitter
{
public:
Dce2TcpSplitter(bool c2s);
- Status scan(Flow*, const uint8_t* data, uint32_t len,
+ Status scan(snort::Flow*, const uint8_t* data, uint32_t len,
uint32_t flags, uint32_t* fp) override;
bool is_paf() override
#include "dce_udp_module.h"
+using namespace snort;
+
THREAD_LOCAL dce2UdpStats dce2_udp_stats;
THREAD_LOCAL ProfileStats dce2_udp_pstat_main;
};
extern THREAD_LOCAL dce2UdpStats dce2_udp_stats;
-extern THREAD_LOCAL ProfileStats dce2_udp_pstat_main;
-extern THREAD_LOCAL ProfileStats dce2_udp_pstat_session;
-extern THREAD_LOCAL ProfileStats dce2_udp_pstat_new_session;
-extern THREAD_LOCAL ProfileStats dce2_udp_pstat_detect;
-extern THREAD_LOCAL ProfileStats dce2_udp_pstat_log;
-extern THREAD_LOCAL ProfileStats dce2_udp_pstat_cl_acts;
-extern THREAD_LOCAL ProfileStats dce2_udp_pstat_cl_frag;
-extern THREAD_LOCAL ProfileStats dce2_udp_pstat_cl_reass;
+extern THREAD_LOCAL snort::ProfileStats dce2_udp_pstat_main;
+extern THREAD_LOCAL snort::ProfileStats dce2_udp_pstat_session;
+extern THREAD_LOCAL snort::ProfileStats dce2_udp_pstat_new_session;
+extern THREAD_LOCAL snort::ProfileStats dce2_udp_pstat_detect;
+extern THREAD_LOCAL snort::ProfileStats dce2_udp_pstat_log;
+extern THREAD_LOCAL snort::ProfileStats dce2_udp_pstat_cl_acts;
+extern THREAD_LOCAL snort::ProfileStats dce2_udp_pstat_cl_frag;
+extern THREAD_LOCAL snort::ProfileStats dce2_udp_pstat_cl_reass;
struct DceRpcClHdr /* Connectionless header */
{
DCE2_ClTracker cl_tracker;
};
-class Dce2UdpFlowData : public FlowData
+class Dce2UdpFlowData : public snort::FlowData
{
public:
Dce2UdpFlowData();
static void init()
{
- inspector_id = FlowData::create_flow_data_id();
+ inspector_id = snort::FlowData::create_flow_data_id();
}
static unsigned inspector_id;
DCE2_UdpSsnData dce2_udp_session;
};
-DCE2_UdpSsnData* get_dce2_udp_session_data(Flow*);
+DCE2_UdpSsnData* get_dce2_udp_session_data(snort::Flow*);
void DCE2_ClProcess(DCE2_SsnData* sd, DCE2_ClTracker* clt);
void DCE2_ClInitRdata(uint8_t*);
#include "dce_udp.h"
+using namespace snort;
using namespace std;
static const Parameter s_params[] =
#define DCE2_CL_DATA_LT_HDR_STR "connection-less DCE/RPC - data length less than header size"
#define DCE2_CL_BAD_SEQ_NUM_STR "connection-less DCE/RPC - bad sequence number"
+namespace snort
+{
struct SnortConfig;
+}
struct dce2UdpProtoConf
{
dce2CommonProtoConf common;
};
-class Dce2UdpModule : public Module
+class Dce2UdpModule : public snort::Module
{
public:
Dce2UdpModule();
- bool set(const char*, Value&, SnortConfig*) override;
+ bool set(const char*, snort::Value&, snort::SnortConfig*) override;
unsigned get_gid() const override
{ return GID_DCE2; }
- const RuleMap* get_rules() const override;
+ const snort::RuleMap* get_rules() const override;
const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
- ProfileStats* get_profile(unsigned, const char*&, const char*&) const override;
+ snort::ProfileStats* get_profile(unsigned, const char*&, const char*&) const override;
void get_data(dce2UdpProtoConf&);
Usage get_usage() const override
#include "dce_common.h"
#include "dce_udp_module.h"
+using namespace snort;
+
/********************************************************************
* Macros
********************************************************************/
#include "dce_common.h"
+using namespace snort;
+
//-------------------------------------------------------------------------
// dcerpc2 interface rule options
//-------------------------------------------------------------------------
#include "dce_common.h"
+using namespace snort;
+
//-------------------------------------------------------------------------
// dcerpc2 opnum rule options
//-------------------------------------------------------------------------
#include "dce_common.h"
+using namespace snort;
+
#define s_name "dce_stub_data"
#define s_help \
"sets the cursor to dcerpc stub data"
if (com_size < sizeof(SmbEmptyCom))
return 0;
- return alignedNtohs((const uint16_t*)(ptr + com_size - sizeof(uint16_t)));
+ return snort::alignedNtohs((const uint16_t*)(ptr + com_size - sizeof(uint16_t)));
}
inline uint16_t SmbEmptyComBcc(const SmbEmptyCom* ec)
{
- return alignedNtohs(&ec->smb_bcc);
+ return snort::alignedNtohs(&ec->smb_bcc);
}
inline int SmbType(const SmbNtHdr* hdr)
inline uint16_t SmbAndXOff2(const SmbAndXCommon* andx)
{
- return alignedNtohs(&andx->smb_off2);
+ return snort::alignedNtohs(&andx->smb_off2);
}
/* SMB formats (smb_fmt) Dialect, Pathname and ASCII are all
#include "dce_smb_utils.h"
#include "dce_smb2.h"
+using namespace snort;
+
/********************************************************************
* Global variables
********************************************************************/
dce2_smb_sess->tid = DCE2_SENTINEL;
dce2_smb_sess->ftracker.fid_v1 = DCE2_SENTINEL;
dce2_smb_sess->rtracker.mid = DCE2_SENTINEL;
- dce2_smb_sess->max_file_depth = FileService::get_max_file_depth();
+ dce2_smb_sess->max_file_depth = snort::FileService::get_max_file_depth();
DCE2_ResetRopts(&dce2_smb_sess->sd.ropts);
return;
}
- Packet* p = ssd->sd.wire_pkt;
+ snort::Packet* p = ssd->sd.wire_pkt;
DCE2_SmbVersion smb_version = DCE2_Smb2Version(p);
if (smb_version == DCE2_SMB_VERISON_1)
{
#include <cstdint>
+namespace snort
+{
+struct Packet;
+}
+
/********************************************************************
* SMB_COM_OPEN
********************************************************************/
inline uint16_t SmbOpenRespFid(const SmbOpenResp* resp)
{
- return alignedNtohs(&resp->smb_fid);
+ return snort::alignedNtohs(&resp->smb_fid);
}
inline uint32_t SmbOpenRespFileSize(const SmbOpenResp* resp)
{
- return alignedNtohl(&resp->smb_file_size);
+ return snort::alignedNtohl(&resp->smb_file_size);
}
inline uint16_t SmbOpenRespFileAttrs(const SmbOpenResp* resp)
{
- return alignedNtohs(&resp->smb_attr);
+ return snort::alignedNtohs(&resp->smb_attr);
}
inline bool SmbFileAttrsDirectory(const uint16_t file_attrs)
inline uint16_t SmbOpenRespAccessMode(const SmbOpenResp* resp)
{
- return alignedNtohs(&resp->smb_access);
+ return snort::alignedNtohs(&resp->smb_access);
}
inline bool SmbOpenForWriting(const uint16_t access_mode)
inline uint16_t SmbCreateReqFileAttrs(const SmbCreateReq* req)
{
- return alignedNtohs(&req->smb_file_attrs);
+ return snort::alignedNtohs(&req->smb_file_attrs);
}
inline bool SmbAttrDirectory(const uint16_t file_attrs)
inline uint16_t SmbCreateRespFid(const SmbCreateResp* resp)
{
- return alignedNtohs(&resp->smb_fid);
+ return snort::alignedNtohs(&resp->smb_fid);
}
/********************************************************************
inline uint16_t SmbCloseReqFid(const SmbCloseReq* req)
{
- return alignedNtohs(&req->smb_fid);
+ return snort::alignedNtohs(&req->smb_fid);
}
/********************************************************************
inline uint16_t SmbReadReqFid(const SmbReadReq* req)
{
- return alignedNtohs(&req->smb_fid);
+ return snort::alignedNtohs(&req->smb_fid);
}
inline uint32_t SmbReadReqOffset(const SmbReadReq* req)
{
- return alignedNtohl(&req->smb_off);
+ return snort::alignedNtohl(&req->smb_off);
}
inline uint16_t SmbReadRespCount(const SmbReadResp* resp)
{
- return alignedNtohs(&resp->smb_cnt);
+ return snort::alignedNtohs(&resp->smb_cnt);
}
/********************************************************************
inline uint16_t SmbWriteReqFid(const SmbWriteReq* req)
{
- return alignedNtohs(&req->smb_fid);
+ return snort::alignedNtohs(&req->smb_fid);
}
inline uint16_t SmbWriteReqCount(const SmbWriteReq* req)
{
- return alignedNtohs(&req->smb_cnt);
+ return snort::alignedNtohs(&req->smb_cnt);
}
inline uint32_t SmbWriteReqOffset(const SmbWriteReq* req)
{
- return alignedNtohl(&req->smb_offset);
+ return snort::alignedNtohl(&req->smb_offset);
}
inline uint16_t SmbWriteRespCount(const SmbWriteResp* resp)
{
- return alignedNtohs(&resp->smb_cnt);
+ return snort::alignedNtohs(&resp->smb_cnt);
}
/********************************************************************
inline uint16_t SmbCreateNewReqFileAttrs(const SmbCreateNewReq* req)
{
- return alignedNtohs(&req->smb_file_attrs);
+ return snort::alignedNtohs(&req->smb_file_attrs);
}
inline uint16_t SmbCreateNewRespFid(const SmbCreateNewResp* resp)
{
- return alignedNtohs(&resp->smb_fid);
+ return snort::alignedNtohs(&resp->smb_fid);
}
/********************************************************************
inline uint16_t SmbLockAndReadReqFid(const SmbLockAndReadReq* req)
{
- return alignedNtohs(&req->smb_fid);
+ return snort::alignedNtohs(&req->smb_fid);
}
inline uint32_t SmbLockAndReadReqOffset(const SmbLockAndReadReq* req)
{
- return alignedNtohl(&req->smb_read_offset);
+ return snort::alignedNtohl(&req->smb_read_offset);
}
inline uint16_t SmbLockAndReadRespCount(const SmbLockAndReadResp* resp)
{
- return alignedNtohs(&resp->smb_cnt);
+ return snort::alignedNtohs(&resp->smb_cnt);
}
/********************************************************************
inline uint16_t SmbWriteAndUnlockReqFid(const SmbWriteAndUnlockReq* req)
{
- return alignedNtohs(&req->smb_fid);
+ return snort::alignedNtohs(&req->smb_fid);
}
inline uint16_t SmbWriteAndUnlockReqCount(const SmbWriteAndUnlockReq* req)
{
- return alignedNtohs(&req->smb_cnt);
+ return snort::alignedNtohs(&req->smb_cnt);
}
inline uint32_t SmbWriteAndUnlockReqOffset(const SmbWriteAndUnlockReq* req)
{
- return alignedNtohl(&req->smb_write_offset);
+ return snort::alignedNtohl(&req->smb_write_offset);
}
/********************************************************************
inline uint32_t SmbOpenAndXReqAllocSize(const SmbOpenAndXReq* req)
{
- return alignedNtohl(&req->smb_size);
+ return snort::alignedNtohl(&req->smb_size);
}
inline uint16_t SmbOpenAndXReqFileAttrs(const SmbOpenAndXReq* req)
{
- return alignedNtohs(&req->smb_attr);
+ return snort::alignedNtohs(&req->smb_attr);
}
inline uint16_t SmbOpenAndXRespFid(const SmbOpenAndXResp* resp)
{
- return alignedNtohs(&resp->smb_fid);
+ return snort::alignedNtohs(&resp->smb_fid);
}
inline uint16_t SmbOpenAndXRespFileAttrs(const SmbOpenAndXResp* resp)
{
- return alignedNtohs(&resp->smb_attribute);
+ return snort::alignedNtohs(&resp->smb_attribute);
}
inline uint32_t SmbOpenAndXRespFileSize(const SmbOpenAndXResp* resp)
{
- return alignedNtohl(&resp->smb_size);
+ return snort::alignedNtohl(&resp->smb_size);
}
inline uint16_t SmbOpenAndXRespResourceType(const SmbOpenAndXResp* resp)
{
- return alignedNtohs(&resp->smb_type);
+ return snort::alignedNtohs(&resp->smb_type);
}
#define SMB_OPEN_RESULT__EXISTED 0x0001
inline uint16_t SmbOpenAndXRespOpenResults(const SmbOpenAndXResp* resp)
{
- return alignedNtohs(&resp->smb_action);
+ return snort::alignedNtohs(&resp->smb_action);
}
inline bool SmbOpenResultRead(const uint16_t open_results)
inline uint16_t SmbReadAndXReqFid(const SmbReadAndXReq* req)
{
- return alignedNtohs(&req->smb_fid);
+ return snort::alignedNtohs(&req->smb_fid);
}
inline uint64_t SmbReadAndXReqOffset(const SmbReadAndXExtReq* req)
{
if (req->smb_wct == 10)
- return (uint64_t)alignedNtohl(&req->smb_offset);
- return (uint64_t)alignedNtohl(&req->smb_off_high) << 32 | (uint64_t)alignedNtohl(
- &req->smb_offset);
+ return (uint64_t)snort::alignedNtohl(&req->smb_offset);
+
+ return (uint64_t)snort::alignedNtohl(&req->smb_off_high) << 32
+ | (uint64_t)snort::alignedNtohl(&req->smb_offset);
}
inline uint16_t SmbReadAndXRespDataOff(const SmbReadAndXResp* req)
{
- return alignedNtohs(&req->smb_doff);
+ return snort::alignedNtohs(&req->smb_doff);
}
inline uint32_t SmbReadAndXRespDataCnt(const SmbReadAndXResp* resp)
{
- return (uint32_t)alignedNtohs(&resp->smb_dsize_high) << 16 | (uint32_t)alignedNtohs(
- &resp->smb_dsize);
+ return (uint32_t)snort::alignedNtohs(&resp->smb_dsize_high) << 16
+ | (uint32_t)snort::alignedNtohs(&resp->smb_dsize);
}
/********************************************************************
inline uint16_t SmbWriteAndXReqFid(const SmbWriteAndXReq* req)
{
- return alignedNtohs(&req->smb_fid);
+ return snort::alignedNtohs(&req->smb_fid);
}
inline uint16_t SmbWriteAndXReqDataOff(const SmbWriteAndXReq* req)
{
- return alignedNtohs(&req->smb_doff);
+ return snort::alignedNtohs(&req->smb_doff);
}
inline uint16_t SmbWriteAndXReqRemaining(const SmbWriteAndXReq* req)
{
- return alignedNtohs(&req->smb_countleft);
+ return snort::alignedNtohs(&req->smb_countleft);
}
inline uint64_t SmbWriteAndXReqOffset(const SmbWriteAndXExtReq* req)
{
if (req->smb_wct == 12)
- return (uint64_t)alignedNtohl(&req->smb_offset);
- return (uint64_t)alignedNtohl(&req->smb_off_high) << 32 | (uint64_t)alignedNtohl(
- &req->smb_offset);
+ return (uint64_t)snort::alignedNtohl(&req->smb_offset);
+
+ return (uint64_t)snort::alignedNtohl(&req->smb_off_high) << 32
+ | (uint64_t)snort::alignedNtohl(&req->smb_offset);
}
inline uint32_t SmbWriteAndXReqDataCnt(const SmbWriteAndXReq* req)
{
- return (uint32_t)alignedNtohs(&req->smb_dsize_high) << 16 | (uint32_t)alignedNtohs(
- &req->smb_dsize);
+ return (uint32_t)snort::alignedNtohs(&req->smb_dsize_high) << 16
+ | (uint32_t)snort::alignedNtohs(&req->smb_dsize);
}
inline uint16_t SmbWriteAndXReqWriteMode(const SmbWriteAndXReq* req)
{
- return alignedNtohs(&req->smb_wmode);
+ return snort::alignedNtohs(&req->smb_wmode);
}
inline bool SmbWriteAndXReqStartRaw(const SmbWriteAndXReq* req)
{
- return ((alignedNtohs(&req->smb_wmode) & 0x000c) == 0x000c) ? true : false;
+ return ((snort::alignedNtohs(&req->smb_wmode) & 0x000c) == 0x000c) ? true : false;
}
inline bool SmbWriteAndXReqRaw(const SmbWriteAndXReq* req)
{
- return ((alignedNtohs(&req->smb_wmode) & 0x000c) == 0x0004) ? true : false;
+ return ((snort::alignedNtohs(&req->smb_wmode) & 0x000c) == 0x0004) ? true : false;
}
inline uint16_t SmbWriteAndXRespCnt(const SmbWriteAndXResp* resp)
{
- return alignedNtohs(&resp->smb_count);
+ return snort::alignedNtohs(&resp->smb_count);
}
/********************************************************************
inline uint16_t SmbSessionSetupAndXReqMaxMultiplex(const SmbLm10_SessionSetupAndXReq* req)
{
- return alignedNtohs(&req->smb_mpxmax);
+ return snort::alignedNtohs(&req->smb_mpxmax);
}
/* Extended request as defined in NT LM 1.0 document */
inline uint16_t SmbNt10SessionSetupAndXReqOemPassLen(const SmbNt10_SessionSetupAndXReq* req)
{
- return alignedNtohs(&req->smb_oem_passlen);
+ return snort::alignedNtohs(&req->smb_oem_passlen);
}
inline uint16_t SmbNt10SessionSetupAndXReqUnicodePassLen(const SmbNt10_SessionSetupAndXReq* req)
{
- return alignedNtohs(&req->smb_unicode_passlen);
+ return snort::alignedNtohs(&req->smb_unicode_passlen);
}
/* Extended request for security blob */
inline uint16_t SmbSessionSetupAndXReqBlobLen(const SmbNt10_SessionSetupAndXExtReq* req)
{
- return alignedNtohs(&req->smb_blob_len);
+ return snort::alignedNtohs(&req->smb_blob_len);
}
/* Extended response for security blob */
inline uint16_t SmbSessionSetupAndXRespBlobLen(const SmbNt10_SessionSetupAndXExtResp* resp)
{
- return alignedNtohs(&resp->smb_blob_len);
+ return snort::alignedNtohs(&resp->smb_blob_len);
}
/********************************************************************
inline uint16_t SmbLm_NegotiateRespMaxMultiplex(const SmbLm10_NegotiateProtocolResp* resp)
{
- return alignedNtohs(&resp->smb_maxmux);
+ return snort::alignedNtohs(&resp->smb_maxmux);
}
inline uint16_t SmbNt_NegotiateRespMaxMultiplex(const SmbNt_NegotiateProtocolResp* resp)
{
- return alignedNtohs(&resp->smb_maxmux);
+ return snort::alignedNtohs(&resp->smb_maxmux);
}
/* This is the Core Protocol response */
inline uint16_t SmbNegotiateRespDialectIndex(const SmbCore_NegotiateProtocolResp* resp)
{
- return alignedNtohs(&resp->smb_index);
+ return snort::alignedNtohs(&resp->smb_index);
}
/*********************************************************************
inline uint16_t SmbTreeConnectAndXReqPassLen(const SmbTreeConnectAndXReq* req)
{
- return alignedNtohs(&req->smb_spasslen);
+ return snort::alignedNtohs(&req->smb_spasslen);
}
/********************************************************************
inline uint16_t SmbNtCreateAndXReqFileNameLen(const SmbNtCreateAndXReq* req)
{
- return alignedNtohs(&req->smb_name_len);
+ return snort::alignedNtohs(&req->smb_name_len);
}
inline uint32_t SmbNtCreateAndXReqCreateDisposition(const SmbNtCreateAndXReq* req)
{
- return alignedNtohl(&req->smb_create_disp);
+ return snort::alignedNtohl(&req->smb_create_disp);
}
inline bool SmbCreateDispositionRead(const uint32_t create_disposition)
inline uint64_t SmbNtCreateAndXReqAllocSize(const SmbNtCreateAndXReq* req)
{
- return alignedNtohq(&req->smb_alloc_size);
+ return snort::alignedNtohq(&req->smb_alloc_size);
}
inline bool SmbNtCreateAndXReqSequentialOnly(const SmbNtCreateAndXReq* req)
{
- return (alignedNtohl(&req->smb_create_opts) & SMB_CREATE_OPTIONS__FILE_SEQUENTIAL_ONLY);
+ return (snort::alignedNtohl(&req->smb_create_opts) & SMB_CREATE_OPTIONS__FILE_SEQUENTIAL_ONLY);
}
inline uint32_t SmbNtCreateAndXReqFileAttrs(const SmbNtCreateAndXReq* req)
{
- return alignedNtohl(&req->smb_file_attrs);
+ return snort::alignedNtohl(&req->smb_file_attrs);
}
inline uint16_t SmbNtCreateAndXRespFid(const SmbNtCreateAndXResp* resp)
{
- return alignedNtohs(&resp->smb_fid);
+ return snort::alignedNtohs(&resp->smb_fid);
}
inline uint32_t SmbNtCreateAndXRespCreateDisposition(const SmbNtCreateAndXResp* resp)
{
- return alignedNtohl(&resp->smb_create_disposition);
+ return snort::alignedNtohl(&resp->smb_create_disposition);
}
inline bool SmbNtCreateAndXRespDirectory(const SmbNtCreateAndXResp* resp)
inline uint16_t SmbNtCreateAndXRespResourceType(const SmbNtCreateAndXResp* resp)
{
- return alignedNtohs(&resp->smb_resource_type);
+ return snort::alignedNtohs(&resp->smb_resource_type);
}
inline uint64_t SmbNtCreateAndXRespEndOfFile(const SmbNtCreateAndXResp* resp)
{
- return alignedNtohq(&resp->smb_eof);
+ return snort::alignedNtohq(&resp->smb_eof);
}
/********************************************************************
inline uint16_t SmbTransactionReqSubCom(const SmbTransactionReq* req)
{
- return alignedNtohs(&req->smb_setup1);
+ return snort::alignedNtohs(&req->smb_setup1);
}
inline uint16_t SmbTransactionReqFid(const SmbTransactionReq* req)
{
- return alignedNtohs(&req->smb_setup2);
+ return snort::alignedNtohs(&req->smb_setup2);
}
inline bool SmbTransactionReqDisconnectTid(const SmbTransactionReq* req)
{
- return (alignedNtohs(&req->smb_flags) & 0x0001) ? true : false;
+ return (snort::alignedNtohs(&req->smb_flags) & 0x0001) ? true : false;
}
inline bool SmbTransactionReqOneWay(const SmbTransactionReq* req)
{
- return (alignedNtohs(&req->smb_flags) & 0x0002) ? true : false;
+ return (snort::alignedNtohs(&req->smb_flags) & 0x0002) ? true : false;
}
inline uint8_t SmbTransactionReqSetupCnt(const SmbTransactionReq* req)
inline uint16_t SmbTransactionReqTotalDataCnt(const SmbTransactionReq* req)
{
- return alignedNtohs(&req->smb_tdscnt);
+ return snort::alignedNtohs(&req->smb_tdscnt);
}
inline uint16_t SmbTransactionReqDataCnt(const SmbTransactionReq* req)
{
- return alignedNtohs(&req->smb_dscnt);
+ return snort::alignedNtohs(&req->smb_dscnt);
}
inline uint16_t SmbTransactionReqDataOff(const SmbTransactionReq* req)
{
- return alignedNtohs(&req->smb_dsoff);
+ return snort::alignedNtohs(&req->smb_dsoff);
}
inline uint16_t SmbTransactionReqTotalParamCnt(const SmbTransactionReq* req)
{
- return alignedNtohs(&req->smb_tpscnt);
+ return snort::alignedNtohs(&req->smb_tpscnt);
}
inline uint16_t SmbTransactionReqParamCnt(const SmbTransactionReq* req)
{
- return alignedNtohs(&req->smb_pscnt);
+ return snort::alignedNtohs(&req->smb_pscnt);
}
inline uint16_t SmbTransactionReqParamOff(const SmbTransactionReq* req)
{
- return alignedNtohs(&req->smb_psoff);
+ return snort::alignedNtohs(&req->smb_psoff);
}
inline uint16_t SmbTransactionRespTotalDataCnt(const SmbTransactionResp* resp)
{
- return alignedNtohs(&resp->smb_tdrcnt);
+ return snort::alignedNtohs(&resp->smb_tdrcnt);
}
inline uint16_t SmbTransactionRespDataCnt(const SmbTransactionResp* resp)
{
- return alignedNtohs(&resp->smb_drcnt);
+ return snort::alignedNtohs(&resp->smb_drcnt);
}
inline uint16_t SmbTransactionRespDataOff(const SmbTransactionResp* resp)
{
- return alignedNtohs(&resp->smb_droff);
+ return snort::alignedNtohs(&resp->smb_droff);
}
inline uint16_t SmbTransactionRespDataDisp(const SmbTransactionResp* resp)
{
- return alignedNtohs(&resp->smb_drdisp);
+ return snort::alignedNtohs(&resp->smb_drdisp);
}
inline uint16_t SmbTransactionRespTotalParamCnt(const SmbTransactionResp* resp)
{
- return alignedNtohs(&resp->smb_tprcnt);
+ return snort::alignedNtohs(&resp->smb_tprcnt);
}
inline uint16_t SmbTransactionRespParamCnt(const SmbTransactionResp* resp)
{
- return alignedNtohs(&resp->smb_prcnt);
+ return snort::alignedNtohs(&resp->smb_prcnt);
}
inline uint16_t SmbTransactionRespParamOff(const SmbTransactionResp* resp)
{
- return alignedNtohs(&resp->smb_proff);
+ return snort::alignedNtohs(&resp->smb_proff);
}
inline uint16_t SmbTransactionRespParamDisp(const SmbTransactionResp* resp)
{
- return alignedNtohs(&resp->smb_prdisp);
+ return snort::alignedNtohs(&resp->smb_prdisp);
}
// Flags for TRANS_SET_NMPIPE_STATE parameters
inline uint16_t SmbTransaction2ReqSubCom(const SmbTransaction2Req* req)
{
- return alignedNtohs(&req->smb_setup);
+ return snort::alignedNtohs(&req->smb_setup);
}
inline uint16_t SmbTransaction2ReqTotalParamCnt(const SmbTransaction2Req* req)
{
- return alignedNtohs(&req->smb_total_param_count);
+ return snort::alignedNtohs(&req->smb_total_param_count);
}
inline uint16_t SmbTransaction2ReqParamCnt(const SmbTransaction2Req* req)
{
- return alignedNtohs(&req->smb_param_count);
+ return snort::alignedNtohs(&req->smb_param_count);
}
inline uint16_t SmbTransaction2ReqParamOff(const SmbTransaction2Req* req)
{
- return alignedNtohs(&req->smb_param_offset);
+ return snort::alignedNtohs(&req->smb_param_offset);
}
inline uint16_t SmbTransaction2ReqTotalDataCnt(const SmbTransaction2Req* req)
{
- return alignedNtohs(&req->smb_total_data_count);
+ return snort::alignedNtohs(&req->smb_total_data_count);
}
inline uint16_t SmbTransaction2ReqDataCnt(const SmbTransaction2Req* req)
{
- return alignedNtohs(&req->smb_data_count);
+ return snort::alignedNtohs(&req->smb_data_count);
}
inline uint16_t SmbTransaction2ReqDataOff(const SmbTransaction2Req* req)
{
- return alignedNtohs(&req->smb_data_offset);
+ return snort::alignedNtohs(&req->smb_data_offset);
}
inline uint8_t SmbTransaction2ReqSetupCnt(const SmbTransaction2Req* req)
inline uint16_t SmbTransaction2RespTotalParamCnt(const SmbTransaction2Resp* resp)
{
- return alignedNtohs(&resp->smb_total_param_count);
+ return snort::alignedNtohs(&resp->smb_total_param_count);
}
inline uint16_t SmbTransaction2RespParamCnt(const SmbTransaction2Resp* resp)
{
- return alignedNtohs(&resp->smb_param_count);
+ return snort::alignedNtohs(&resp->smb_param_count);
}
inline uint16_t SmbTransaction2RespParamOff(const SmbTransaction2Resp* resp)
{
- return alignedNtohs(&resp->smb_param_offset);
+ return snort::alignedNtohs(&resp->smb_param_offset);
}
inline uint16_t SmbTransaction2RespParamDisp(const SmbTransaction2Resp* resp)
{
- return alignedNtohs(&resp->smb_param_disp);
+ return snort::alignedNtohs(&resp->smb_param_disp);
}
inline uint16_t SmbTransaction2RespTotalDataCnt(const SmbTransaction2Resp* resp)
{
- return alignedNtohs(&resp->smb_total_data_count);
+ return snort::alignedNtohs(&resp->smb_total_data_count);
}
inline uint16_t SmbTransaction2RespDataCnt(const SmbTransaction2Resp* resp)
{
- return alignedNtohs(&resp->smb_data_count);
+ return snort::alignedNtohs(&resp->smb_data_count);
}
inline uint16_t SmbTransaction2RespDataOff(const SmbTransaction2Resp* resp)
{
- return alignedNtohs(&resp->smb_data_offset);
+ return snort::alignedNtohs(&resp->smb_data_offset);
}
inline uint16_t SmbTransaction2RespDataDisp(const SmbTransaction2Resp* resp)
{
- return alignedNtohs(&resp->smb_data_disp);
+ return snort::alignedNtohs(&resp->smb_data_disp);
}
struct SmbTrans2Open2ReqParams
inline uint16_t SmbTrans2Open2ReqAccessMode(const SmbTrans2Open2ReqParams* req)
{
- return alignedNtohs(&req->AccessMode);
+ return snort::alignedNtohs(&req->AccessMode);
}
inline uint16_t SmbTrans2Open2ReqFileAttrs(const SmbTrans2Open2ReqParams* req)
{
- return alignedNtohs(&req->FileAttributes);
+ return snort::alignedNtohs(&req->FileAttributes);
}
inline uint16_t SmbTrans2Open2ReqOpenMode(const SmbTrans2Open2ReqParams* req)
{
- return alignedNtohs(&req->OpenMode);
+ return snort::alignedNtohs(&req->OpenMode);
}
inline uint32_t SmbTrans2Open2ReqAllocSize(const SmbTrans2Open2ReqParams* req)
{
- return alignedNtohl(&req->AllocationSize);
+ return snort::alignedNtohl(&req->AllocationSize);
}
struct SmbTrans2Open2RespParams
inline uint16_t SmbTrans2Open2RespFid(const SmbTrans2Open2RespParams* resp)
{
- return alignedNtohs(&resp->smb_fid);
+ return snort::alignedNtohs(&resp->smb_fid);
}
inline uint16_t SmbTrans2Open2RespFileAttrs(const SmbTrans2Open2RespParams* resp)
{
- return alignedNtohs(&resp->file_attributes);
+ return snort::alignedNtohs(&resp->file_attributes);
}
inline uint32_t SmbTrans2Open2RespFileDataSize(const SmbTrans2Open2RespParams* resp)
{
- return alignedNtohl(&resp->file_data_size);
+ return snort::alignedNtohl(&resp->file_data_size);
}
inline uint16_t SmbTrans2Open2RespResourceType(const SmbTrans2Open2RespParams* resp)
{
- return alignedNtohs(&resp->resource_type);
+ return snort::alignedNtohs(&resp->resource_type);
}
inline uint16_t SmbTrans2Open2RespActionTaken(const SmbTrans2Open2RespParams* resp)
{
- return alignedNtohs(&resp->action_taken);
+ return snort::alignedNtohs(&resp->action_taken);
}
struct SmbTrans2Open2Resp
inline uint16_t SmbTrans2QueryFileInfoReqFid(const SmbTrans2QueryFileInfoReqParams* req)
{
- return alignedNtohs(&req->fid);
+ return snort::alignedNtohs(&req->fid);
}
inline uint16_t SmbTrans2QueryFileInfoReqInfoLevel(const SmbTrans2QueryFileInfoReqParams* req)
{
- return alignedNtohs(&req->information_level);
+ return snort::alignedNtohs(&req->information_level);
}
struct SmbQueryInfoStandard
inline uint32_t SmbQueryInfoStandardFileDataSize(const SmbQueryInfoStandard* q)
{
- return alignedNtohl(&q->FileDataSize);
+ return snort::alignedNtohl(&q->FileDataSize);
}
struct SmbQueryInfoQueryEaSize
inline uint32_t SmbQueryInfoQueryEaSizeFileDataSize(const SmbQueryInfoQueryEaSize* q)
{
- return alignedNtohl(&q->FileDataSize);
+ return snort::alignedNtohl(&q->FileDataSize);
}
struct SmbQueryFileStandardInfo
inline uint64_t SmbQueryFileStandardInfoEndOfFile(const SmbQueryFileStandardInfo* q)
{
- return alignedNtohq(&q->EndOfFile);
+ return snort::alignedNtohq(&q->EndOfFile);
}
struct SmbQueryFileAllInfo
inline uint64_t SmbQueryFileAllInfoEndOfFile(const SmbQueryFileAllInfo* q)
{
- return alignedNtohq(&q->EndOfFile);
+ return snort::alignedNtohq(&q->EndOfFile);
}
struct SmbQueryPTFileAllInfo
inline uint64_t SmbQueryPTFileAllInfoEndOfFile(const SmbQueryPTFileAllInfo* q)
{
- return alignedNtohq(&q->EndOfFile);
+ return snort::alignedNtohq(&q->EndOfFile);
}
struct SmbQueryPTNetworkOpenInfo
inline uint64_t SmbQueryPTNetworkOpenInfoEndOfFile(const SmbQueryPTNetworkOpenInfo* q)
{
- return alignedNtohq(&q->EndOfFile);
+ return snort::alignedNtohq(&q->EndOfFile);
}
struct SmbQueryPTFileStreamInfo
inline uint64_t SmbQueryPTFileStreamInfoStreamSize(const SmbQueryPTFileStreamInfo* q)
{
- return alignedNtohq(&q->StreamSize);
+ return snort::alignedNtohq(&q->StreamSize);
}
struct SmbTrans2QueryFileInformationResp
inline uint16_t SmbTrans2SetFileInfoReqFid(const SmbTrans2SetFileInfoReqParams* req)
{
- return alignedNtohs(&req->fid);
+ return snort::alignedNtohs(&req->fid);
}
inline uint16_t SmbTrans2SetFileInfoReqInfoLevel(const SmbTrans2SetFileInfoReqParams* req)
{
- return alignedNtohs(&req->information_level);
+ return snort::alignedNtohs(&req->information_level);
}
inline bool SmbSetFileInfoEndOfFile(const uint16_t info_level)
inline uint32_t SmbSetFileInfoExtFileAttrs(const SmbSetFileBasicInfo* info)
{
- return alignedNtohl(&info->ExtFileAttributes);
+ return snort::alignedNtohl(&info->ExtFileAttributes);
}
inline bool SmbSetFileInfoSetFileBasicInfo(const uint16_t info_level)
inline uint16_t SmbNtTransactReqSubCom(const SmbNtTransactReq* req)
{
- return alignedNtohs(&req->smb_function);
+ return snort::alignedNtohs(&req->smb_function);
}
inline uint8_t SmbNtTransactReqSetupCnt(const SmbNtTransactReq* req)
inline uint32_t SmbNtTransactReqTotalParamCnt(const SmbNtTransactReq* req)
{
- return alignedNtohl(&req->smb_total_param_count);
+ return snort::alignedNtohl(&req->smb_total_param_count);
}
inline uint32_t SmbNtTransactReqParamCnt(const SmbNtTransactReq* req)
{
- return alignedNtohl(&req->smb_param_count);
+ return snort::alignedNtohl(&req->smb_param_count);
}
inline uint32_t SmbNtTransactReqParamOff(const SmbNtTransactReq* req)
{
- return alignedNtohl(&req->smb_param_offset);
+ return snort::alignedNtohl(&req->smb_param_offset);
}
inline uint32_t SmbNtTransactReqTotalDataCnt(const SmbNtTransactReq* req)
{
- return alignedNtohl(&req->smb_total_data_count);
+ return snort::alignedNtohl(&req->smb_total_data_count);
}
inline uint32_t SmbNtTransactReqDataCnt(const SmbNtTransactReq* req)
{
- return alignedNtohl(&req->smb_data_count);
+ return snort::alignedNtohl(&req->smb_data_count);
}
inline uint32_t SmbNtTransactReqDataOff(const SmbNtTransactReq* req)
{
- return alignedNtohl(&req->smb_data_offset);
+ return snort::alignedNtohl(&req->smb_data_offset);
}
inline uint32_t SmbNtTransactRespTotalParamCnt(const SmbNtTransactResp* resp)
{
- return alignedNtohl(&resp->smb_total_param_count);
+ return snort::alignedNtohl(&resp->smb_total_param_count);
}
inline uint32_t SmbNtTransactRespParamCnt(const SmbNtTransactResp* resp)
{
- return alignedNtohl(&resp->smb_param_count);
+ return snort::alignedNtohl(&resp->smb_param_count);
}
inline uint32_t SmbNtTransactRespParamOff(const SmbNtTransactResp* resp)
{
- return alignedNtohl(&resp->smb_param_offset);
+ return snort::alignedNtohl(&resp->smb_param_offset);
}
inline uint32_t SmbNtTransactRespParamDisp(const SmbNtTransactResp* resp)
{
- return alignedNtohl(&resp->smb_param_disp);
+ return snort::alignedNtohl(&resp->smb_param_disp);
}
inline uint32_t SmbNtTransactRespTotalDataCnt(const SmbNtTransactResp* resp)
{
- return alignedNtohl(&resp->smb_total_data_count);
+ return snort::alignedNtohl(&resp->smb_total_data_count);
}
inline uint32_t SmbNtTransactRespDataCnt(const SmbNtTransactResp* resp)
{
- return alignedNtohl(&resp->smb_data_count);
+ return snort::alignedNtohl(&resp->smb_data_count);
}
inline uint32_t SmbNtTransactRespDataOff(const SmbNtTransactResp* resp)
{
- return alignedNtohl(&resp->smb_data_offset);
+ return snort::alignedNtohl(&resp->smb_data_offset);
}
inline uint32_t SmbNtTransactRespDataDisp(const SmbNtTransactResp* resp)
{
- return alignedNtohl(&resp->smb_data_disp);
+ return snort::alignedNtohl(&resp->smb_data_disp);
}
struct SmbNtTransactCreateReqParams
inline uint64_t SmbNtTransactCreateReqAllocSize(const SmbNtTransactCreateReqParams* req)
{
- return alignedNtohq(&req->allocation_size);
+ return snort::alignedNtohq(&req->allocation_size);
}
inline uint32_t SmbNtTransactCreateReqFileNameLength(const SmbNtTransactCreateReqParams* req)
{
- return alignedNtohl(&req->name_length);
+ return snort::alignedNtohl(&req->name_length);
}
inline uint32_t SmbNtTransactCreateReqFileAttrs(const SmbNtTransactCreateReqParams* req)
{
- return alignedNtohl(&req->ext_file_attributes);
+ return snort::alignedNtohl(&req->ext_file_attributes);
}
inline bool SmbNtTransactCreateReqSequentialOnly(const SmbNtTransactCreateReqParams* req)
{
- return (alignedNtohl(&req->create_options) & SMB_CREATE_OPTIONS__FILE_SEQUENTIAL_ONLY);
+ return (snort::alignedNtohl(&req->create_options) & SMB_CREATE_OPTIONS__FILE_SEQUENTIAL_ONLY);
}
struct SmbNtTransactCreateReq
inline uint16_t SmbNtTransactCreateRespFid(const SmbNtTransactCreateRespParams* resp)
{
- return alignedNtohs(&resp->smb_fid);
+ return snort::alignedNtohs(&resp->smb_fid);
}
inline uint32_t SmbNtTransactCreateRespCreateAction(const SmbNtTransactCreateRespParams* resp)
{
- return alignedNtohl(&resp->create_action);
+ return snort::alignedNtohl(&resp->create_action);
}
inline uint64_t SmbNtTransactCreateRespEndOfFile(const SmbNtTransactCreateRespParams* resp)
{
- return alignedNtohq(&resp->end_of_file);
+ return snort::alignedNtohq(&resp->end_of_file);
}
inline uint16_t SmbNtTransactCreateRespResourceType(const SmbNtTransactCreateRespParams* resp)
{
- return alignedNtohs(&resp->resource_type);
+ return snort::alignedNtohs(&resp->resource_type);
}
inline bool SmbNtTransactCreateRespDirectory(const SmbNtTransactCreateRespParams* resp)
inline uint16_t SmbTransactionSecondaryReqTotalDataCnt(const SmbTransactionSecondaryReq* req)
{
- return alignedNtohs(&req->smb_tdscnt);
+ return snort::alignedNtohs(&req->smb_tdscnt);
}
inline uint16_t SmbTransactionSecondaryReqDataCnt(const SmbTransactionSecondaryReq* req)
{
- return alignedNtohs(&req->smb_dscnt);
+ return snort::alignedNtohs(&req->smb_dscnt);
}
inline uint16_t SmbTransactionSecondaryReqDataOff(const SmbTransactionSecondaryReq* req)
{
- return alignedNtohs(&req->smb_dsoff);
+ return snort::alignedNtohs(&req->smb_dsoff);
}
inline uint16_t SmbTransactionSecondaryReqDataDisp(const SmbTransactionSecondaryReq* req)
{
- return alignedNtohs(&req->smb_dsdisp);
+ return snort::alignedNtohs(&req->smb_dsdisp);
}
inline uint16_t SmbTransactionSecondaryReqTotalParamCnt(const SmbTransactionSecondaryReq* req)
{
- return alignedNtohs(&req->smb_tpscnt);
+ return snort::alignedNtohs(&req->smb_tpscnt);
}
inline uint16_t SmbTransactionSecondaryReqParamCnt(const SmbTransactionSecondaryReq* req)
{
- return alignedNtohs(&req->smb_pscnt);
+ return snort::alignedNtohs(&req->smb_pscnt);
}
inline uint16_t SmbTransactionSecondaryReqParamOff(const SmbTransactionSecondaryReq* req)
{
- return alignedNtohs(&req->smb_psoff);
+ return snort::alignedNtohs(&req->smb_psoff);
}
inline uint16_t SmbTransactionSecondaryReqParamDisp(const SmbTransactionSecondaryReq* req)
{
- return alignedNtohs(&req->smb_psdisp);
+ return snort::alignedNtohs(&req->smb_psdisp);
}
/********************************************************************
inline uint16_t SmbTransaction2SecondaryReqTotalParamCnt(const SmbTransaction2SecondaryReq* req)
{
- return alignedNtohs(&req->smb_total_param_count);
+ return snort::alignedNtohs(&req->smb_total_param_count);
}
inline uint16_t SmbTransaction2SecondaryReqParamCnt(const SmbTransaction2SecondaryReq* req)
{
- return alignedNtohs(&req->smb_param_count);
+ return snort::alignedNtohs(&req->smb_param_count);
}
inline uint16_t SmbTransaction2SecondaryReqParamOff(const SmbTransaction2SecondaryReq* req)
{
- return alignedNtohs(&req->smb_param_offset);
+ return snort::alignedNtohs(&req->smb_param_offset);
}
inline uint16_t SmbTransaction2SecondaryReqParamDisp(const SmbTransaction2SecondaryReq* req)
{
- return alignedNtohs(&req->smb_param_disp);
+ return snort::alignedNtohs(&req->smb_param_disp);
}
inline uint16_t SmbTransaction2SecondaryReqTotalDataCnt(const SmbTransaction2SecondaryReq* req)
{
- return alignedNtohs(&req->smb_total_data_count);
+ return snort::alignedNtohs(&req->smb_total_data_count);
}
inline uint16_t SmbTransaction2SecondaryReqDataCnt(const SmbTransaction2SecondaryReq* req)
{
- return alignedNtohs(&req->smb_data_count);
+ return snort::alignedNtohs(&req->smb_data_count);
}
inline uint16_t SmbTransaction2SecondaryReqDataOff(const SmbTransaction2SecondaryReq* req)
{
- return alignedNtohs(&req->smb_data_offset);
+ return snort::alignedNtohs(&req->smb_data_offset);
}
inline uint16_t SmbTransaction2SecondaryReqDataDisp(const SmbTransaction2SecondaryReq* req)
{
- return alignedNtohs(&req->smb_data_disp);
+ return snort::alignedNtohs(&req->smb_data_disp);
}
/********************************************************************
inline uint32_t SmbNtTransactSecondaryReqTotalParamCnt(const SmbNtTransactSecondaryReq* req)
{
- return alignedNtohl(&req->smb_total_param_count);
+ return snort::alignedNtohl(&req->smb_total_param_count);
}
inline uint32_t SmbNtTransactSecondaryReqParamCnt(const SmbNtTransactSecondaryReq* req)
{
- return alignedNtohl(&req->smb_param_count);
+ return snort::alignedNtohl(&req->smb_param_count);
}
inline uint32_t SmbNtTransactSecondaryReqParamOff(const SmbNtTransactSecondaryReq* req)
{
- return alignedNtohl(&req->smb_param_offset);
+ return snort::alignedNtohl(&req->smb_param_offset);
}
inline uint32_t SmbNtTransactSecondaryReqParamDisp(const SmbNtTransactSecondaryReq* req)
{
- return alignedNtohl(&req->smb_param_disp);
+ return snort::alignedNtohl(&req->smb_param_disp);
}
inline uint32_t SmbNtTransactSecondaryReqTotalDataCnt(const SmbNtTransactSecondaryReq* req)
{
- return alignedNtohl(&req->smb_total_data_count);
+ return snort::alignedNtohl(&req->smb_total_data_count);
}
inline uint32_t SmbNtTransactSecondaryReqDataCnt(const SmbNtTransactSecondaryReq* req)
{
- return alignedNtohl(&req->smb_data_count);
+ return snort::alignedNtohl(&req->smb_data_count);
}
inline uint32_t SmbNtTransactSecondaryReqDataOff(const SmbNtTransactSecondaryReq* req)
{
- return alignedNtohl(&req->smb_data_offset);
+ return snort::alignedNtohl(&req->smb_data_offset);
}
inline uint32_t SmbNtTransactSecondaryReqDataDisp(const SmbNtTransactSecondaryReq* req)
{
- return alignedNtohl(&req->smb_data_disp);
+ return snort::alignedNtohl(&req->smb_data_disp);
}
/********************************************************************
inline uint16_t SmbReadRawReqFid(const SmbReadRawReq* req)
{
- return alignedNtohs(&req->smb_fid);
+ return snort::alignedNtohs(&req->smb_fid);
}
inline uint64_t SmbReadRawReqOffset(const SmbReadRawExtReq* req)
{
if (req->smb_wct == 8)
- return (uint64_t)alignedNtohl(&req->smb_offset);
- return (uint64_t)alignedNtohl(&req->smb_off_high) << 32 | (uint64_t)alignedNtohl(
- &req->smb_offset);
+ return (uint64_t)snort::alignedNtohl(&req->smb_offset);
+
+ return (uint64_t)snort::alignedNtohl(&req->smb_off_high) << 32
+ | (uint64_t)snort::alignedNtohl(&req->smb_offset);
}
/********************************************************************
inline uint16_t SmbWriteRawReqTotalCount(const SmbWriteRawReq* req)
{
- return alignedNtohs(&req->smb_tcount);
+ return snort::alignedNtohs(&req->smb_tcount);
}
inline bool SmbWriteRawReqWriteThrough(const SmbWriteRawReq* req)
{
- return alignedNtohs(&req->smb_wmode) & 0x0001;
+ return snort::alignedNtohs(&req->smb_wmode) & 0x0001;
}
inline uint16_t SmbWriteRawReqFid(const SmbWriteRawReq* req)
{
- return alignedNtohs(&req->smb_fid);
+ return snort::alignedNtohs(&req->smb_fid);
}
inline uint16_t SmbWriteRawReqDataOff(const SmbWriteRawReq* req)
{
- return alignedNtohs(&req->smb_doff);
+ return snort::alignedNtohs(&req->smb_doff);
}
inline uint16_t SmbWriteRawReqDataCnt(const SmbWriteRawReq* req)
{
- return alignedNtohs(&req->smb_dsize);
+ return snort::alignedNtohs(&req->smb_dsize);
}
inline uint64_t SmbWriteRawReqOffset(const SmbWriteRawExtReq* req)
{
if (req->smb_wct == 12)
- return (uint64_t)alignedNtohl(&req->smb_offset);
- return (uint64_t)alignedNtohl(&req->smb_off_high) << 32 | (uint64_t)alignedNtohl(
- &req->smb_offset);
+ return (uint64_t)snort::alignedNtohl(&req->smb_offset);
+
+ return (uint64_t)snort::alignedNtohl(&req->smb_off_high) << 32 |
+ (uint64_t)snort::alignedNtohl(&req->smb_offset);
}
inline uint16_t SmbWriteRawInterimRespRemaining(const SmbWriteRawInterimResp* resp)
{
- return alignedNtohs(&resp->smb_remaining);
+ return snort::alignedNtohs(&resp->smb_remaining);
}
/********************************************************************
inline uint16_t SmbWriteCompleteRespCount(const SmbWriteCompleteResp* resp)
{
- return alignedNtohs(&resp->smb_count);
+ return snort::alignedNtohs(&resp->smb_count);
}
/********************************************************************
inline uint16_t SmbWriteAndCloseReqFid(const SmbWriteAndCloseReq* req)
{
- return alignedNtohs(&req->smb_fid);
+ return snort::alignedNtohs(&req->smb_fid);
}
inline uint16_t SmbWriteAndCloseReqCount(const SmbWriteAndCloseReq* req)
{
- return alignedNtohs(&req->smb_count);
+ return snort::alignedNtohs(&req->smb_count);
}
inline uint32_t SmbWriteAndCloseReqOffset(const SmbWriteAndCloseReq* req)
{
- return alignedNtohl(&req->smb_offset);
+ return snort::alignedNtohl(&req->smb_offset);
}
inline uint16_t SmbWriteAndCloseRespCount(const SmbWriteAndCloseResp* resp)
{
- return alignedNtohs(&resp->smb_count);
+ return snort::alignedNtohs(&resp->smb_count);
}
#pragma pack()
void DCE2_SmbInitGlobals();
void DCE2_SmbProcess(struct DCE2_SmbSsnData*);
-DCE2_SmbSsnData* dce2_handle_smb_session(struct Packet*, struct dce2SmbProtoConf*);
+DCE2_SmbSsnData* dce2_handle_smb_session(snort::Packet*, struct dce2SmbProtoConf*);
#endif
#include "dnp3_paf.h"
#include "dnp3_reassembly.h"
+using namespace snort;
+
THREAD_LOCAL Dnp3Stats dnp3_stats;
THREAD_LOCAL ProfileStats dnp3_perf_stats;
dnp3_reassembly_data_t server_rdata;
};
-class Dnp3FlowData : public FlowData
+class Dnp3FlowData : public snort::FlowData
{
public:
Dnp3FlowData();
static void init()
{
- inspector_id = FlowData::create_flow_data_id();
+ inspector_id = snort::FlowData::create_flow_data_id();
}
public:
};
extern THREAD_LOCAL Dnp3Stats dnp3_stats;
-extern THREAD_LOCAL ProfileStats dnp3_perf_stats;
+extern THREAD_LOCAL snort::ProfileStats dnp3_perf_stats;
#endif
#include "dnp3.h"
+using namespace snort;
using namespace std;
static const Parameter s_params[] =
#define GID_DNP3 145
+namespace snort
+{
struct SnortConfig;
+}
struct dnp3ProtoConf
{
bool check_crc;
};
-class Dnp3Module : public Module
+class Dnp3Module : public snort::Module
{
public:
Dnp3Module();
- bool set(const char*, Value&, SnortConfig*) override;
+ bool set(const char*, snort::Value&, snort::SnortConfig*) override;
unsigned get_gid() const override
{ return GID_DNP3; }
- const RuleMap* get_rules() const override;
+ const snort::RuleMap* get_rules() const override;
const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
- ProfileStats* get_profile() const override;
+ snort::ProfileStats* get_profile() const override;
Usage get_usage() const override
{ return INSPECT; }
#include "dnp3.h"
+using namespace snort;
+
/* Function: dnp3_paf()
Purpose: DNP3 PAF callback.
uint16_t real_length;
};
-class Dnp3Splitter : public StreamSplitter
+class Dnp3Splitter : public snort::StreamSplitter
{
public:
Dnp3Splitter(bool c2s);
- Status scan(Flow*, const uint8_t* data, uint32_t len,
+ Status scan(snort::Flow*, const uint8_t* data, uint32_t len,
uint32_t flags, uint32_t* fp) override;
bool is_paf() override
#include "dnp3_map.h"
+using namespace snort;
+
/* CRC look-up table, for computeCRC() below */
static uint16_t crcLookUpTable[256] =
{
#include "dnp3_module.h"
#include "dnp3.h"
-bool dnp3_full_reassembly(dnp3ProtoConf& config, dnp3_session_data_t* session, Packet* p,
+bool dnp3_full_reassembly(dnp3ProtoConf& config, dnp3_session_data_t* session, snort::Packet* p,
const uint8_t* pdu_start, uint16_t pdu_length);
void dnp3_reassembly_reset(dnp3_reassembly_data_t* rdata);
#include "dnp3.h"
+using namespace snort;
+
#define s_name "dnp3_data"
#define s_help \
"sets the cursor to dnp3 data"
#include "dnp3.h"
#include "dnp3_map.h"
+using namespace snort;
+
//-------------------------------------------------------------------------
// DNP3 function code rule options
//-------------------------------------------------------------------------
#include "dnp3.h"
#include "dnp3_map.h"
+using namespace snort;
+
//-------------------------------------------------------------------------
// DNP3 indicator flags rule options
//-------------------------------------------------------------------------
#include "dnp3.h"
+using namespace snort;
+
//-------------------------------------------------------------------------
// DNP3 object headers rule options
//-------------------------------------------------------------------------
#include "dns_module.h"
+using namespace snort;
+
#define MAX_UDP_PAYLOAD 0x1FFF
#define DNS_RR_PTR 0xC0
uint8_t flags;
};
-class DnsFlowData : public FlowData
+class DnsFlowData : public snort::FlowData
{
public:
DnsFlowData();
~DnsFlowData() override;
static void init()
- { inspector_id = FlowData::create_flow_data_id(); }
+ { inspector_id = snort::FlowData::create_flow_data_id(); }
public:
static unsigned inspector_id;
#include "dns_module.h"
+using namespace snort;
using namespace std;
#define DNS_EVENT_OBSOLETE_TYPES_STR \
#include "framework/module.h"
#include "main/thread.h"
+namespace snort
+{
+struct SnortConfig;
+}
+
#define GID_DNS 131
#define DNS_EVENT_OBSOLETE_TYPES 1
#define DNS_NAME "dns"
#define DNS_HELP "dns inspection"
-struct SnortConfig;
struct DnsStats
{
extern const PegInfo dns_peg_names[];
extern THREAD_LOCAL DnsStats dnsstats;
-extern THREAD_LOCAL ProfileStats dnsPerfStats;
+extern THREAD_LOCAL snort::ProfileStats dnsPerfStats;
-class DnsModule : public Module
+class DnsModule : public snort::Module
{
public:
DnsModule();
- bool set(const char*, Value&, SnortConfig*) override
+ bool set(const char*, snort::Value&, snort::SnortConfig*) override
{ return false; }
unsigned get_gid() const override
{ return GID_DNS; }
- const RuleMap* get_rules() const override;
+ const snort::RuleMap* get_rules() const override;
const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
- ProfileStats* get_profile() const override;
+ snort::ProfileStats* get_profile() const override;
Usage get_usage() const override
{ return INSPECT; }
* Returns: -1 on error
*
*/
-int CheckFTPServerConfigs(
- SnortConfig*, FTP_SERVER_PROTO_CONF* serverConf)
+int CheckFTPServerConfigs(snort::SnortConfig*, FTP_SERVER_PROTO_CONF* serverConf)
{
if (CheckFTPCmdOptions(serverConf))
{
}
// FIXIT-L eliminate legacy void* cruft
-int FTPCheckConfigs(SnortConfig* sc, void* pData)
+int FTPCheckConfigs(snort::SnortConfig* sc, void* pData)
{
FTP_SERVER_PROTO_CONF* config = (FTP_SERVER_PROTO_CONF*)pData;
return 0;
}
-void do_detection(Packet* p)
+void do_detection(snort::Packet* p)
{
- DataBus::publish(PACKET_EVENT, p);
- DetectionEngine::disable_all(p);
+ snort::DataBus::publish(PACKET_EVENT, p);
+ snort::DetectionEngine::disable_all(p);
}
#define BUF_SIZE 1024
+namespace snort
+{
struct Packet;
struct ProfileStats;
struct SnortConfig;
+}
extern int16_t ftp_data_app_id;
-void do_detection(Packet*);
+void do_detection(snort::Packet*);
void CleanupFTPServerConf(void* serverConf);
void CleanupFTPCMDConf(void* ftpCmd);
void CleanupFTPBounceTo(void* ftpBounce);
-int CheckFTPServerConfigs(SnortConfig*, FTP_SERVER_PROTO_CONF*);
-int FTPCheckConfigs(SnortConfig*, void*);
+int CheckFTPServerConfigs(snort::SnortConfig*, FTP_SERVER_PROTO_CONF*);
+int FTPCheckConfigs(snort::SnortConfig*, void*);
-FTP_CLIENT_PROTO_CONF* get_ftp_client(Packet*);
-FTP_SERVER_PROTO_CONF* get_ftp_server(Packet*);
+FTP_CLIENT_PROTO_CONF* get_ftp_client(snort::Packet*);
+FTP_SERVER_PROTO_CONF* get_ftp_server(snort::Packet*);
#endif
#include "pp_ftp.h"
#include "telnet.h"
+using namespace snort;
+
int16_t ftp_data_app_id = SFTARGET_UNKNOWN_PROTOCOL;
#define client_key "ftp_client"
* Returns: int => return code indicating error or success
*
*/
-int ftp_bounce_lookup_add(BOUNCE_LOOKUP* BounceLookup,
- const SfIp* Ip, FTP_BOUNCE_TO* BounceTo)
+int ftp_bounce_lookup_add(BOUNCE_LOOKUP* BounceLookup, const snort::SfIp* Ip,
+ FTP_BOUNCE_TO* BounceTo)
{
int iRet;
* matching IP if found, NULL otherwise.
*
*/
-FTP_BOUNCE_TO* ftp_bounce_lookup_find(
- BOUNCE_LOOKUP* BounceLookup, const SfIp* Ip, int* iError)
+FTP_BOUNCE_TO* ftp_bounce_lookup_find(BOUNCE_LOOKUP* BounceLookup, const snort::SfIp* Ip,
+ int* iError)
{
FTP_BOUNCE_TO* BounceTo = nullptr;
* Returns: FTP_BOUNCE_TO* => Pointer to first bounce configuration structure
*
*/
-FTP_BOUNCE_TO* ftp_bounce_lookup_first(BOUNCE_LOOKUP* BounceLookup,
- int* iError)
+FTP_BOUNCE_TO* ftp_bounce_lookup_first(BOUNCE_LOOKUP* BounceLookup, int* iError)
{
FTP_BOUNCE_TO* BounceTo;
* Returns: FTP_BOUNCE_TO* => Pointer to next bounce configuration structure
*
*/
-FTP_BOUNCE_TO* ftp_bounce_lookup_next(BOUNCE_LOOKUP* BounceLookup,
- int* iError)
+FTP_BOUNCE_TO* ftp_bounce_lookup_next(BOUNCE_LOOKUP* BounceLookup, int* iError)
{
FTP_BOUNCE_TO* BounceTo;
int ftp_bounce_lookup_init(BOUNCE_LOOKUP** BounceLookup);
int ftp_bounce_lookup_cleanup(BOUNCE_LOOKUP** BounceLookup);
-int ftp_bounce_lookup_add(BOUNCE_LOOKUP* BounceLookup, const SfIp* ip, FTP_BOUNCE_TO* BounceTo);
+int ftp_bounce_lookup_add(BOUNCE_LOOKUP* BounceLookup, const snort::SfIp* ip, FTP_BOUNCE_TO* BounceTo);
-FTP_BOUNCE_TO* ftp_bounce_lookup_find(BOUNCE_LOOKUP* BounceLookup, const SfIp* ip, int* iError);
+FTP_BOUNCE_TO* ftp_bounce_lookup_find(BOUNCE_LOOKUP* BounceLookup, const snort::SfIp* ip, int* iError);
// FIXIT-L orphan code until FTP client inspector acquires a show() method
// FTP_BOUNCE_TO* ftp_bounce_lookup_first(BOUNCE_LOOKUP* BounceLookup, int* iError);
// FTP_BOUNCE_TO* ftp_bounce_lookup_next(BOUNCE_LOOKUP* BounceLookup, int* iError);
#include "ftpp_si.h"
#include "ftpdata_splitter.h"
+using namespace snort;
+
#define s_name "ftp_data"
#define s_help \
#include "framework/inspector.h"
-extern const InspectApi fd_api;
+extern const snort::InspectApi fd_api;
#endif
#include "ftpp_si.h"
+using namespace snort;
using namespace std;
#define FTP_CLIENT "ftp_client"
#define FTP_BOUNCE 8
#define FTP_EVASIVE_TELNET_CMD 9
+namespace snort
+{
struct SnortConfig;
+}
-extern THREAD_LOCAL ProfileStats ftpPerfStats;
+extern THREAD_LOCAL snort::ProfileStats ftpPerfStats;
//-------------------------------------------------------------------------
BounceTo(std::string& address, Port lo, Port hi);
};
-class FtpClientModule : public Module
+class FtpClientModule : public snort::Module
{
public:
FtpClientModule();
~FtpClientModule() override;
- bool set(const char*, Value&, SnortConfig*) override;
- bool begin(const char*, int, SnortConfig*) override;
- bool end(const char*, int, SnortConfig*) override;
+ bool set(const char*, snort::Value&, snort::SnortConfig*) override;
+ bool begin(const char*, int, snort::SnortConfig*) override;
+ bool end(const char*, int, snort::SnortConfig*) override;
FTP_CLIENT_PROTO_CONF* get_data();
const BounceTo* get_bounce(unsigned idx);
FtpCmd(std::string&, std::string&, int);
};
-class FtpServerModule : public Module
+class FtpServerModule : public snort::Module
{
public:
FtpServerModule();
~FtpServerModule() override;
- bool set(const char*, Value&, SnortConfig*) override;
- bool begin(const char*, int, SnortConfig*) override;
- bool end(const char*, int, SnortConfig*) override;
+ bool set(const char*, snort::Value&, snort::SnortConfig*) override;
+ bool begin(const char*, int, snort::SnortConfig*) override;
+ bool end(const char*, int, snort::SnortConfig*) override;
unsigned get_gid() const override
{ return GID_FTP; }
- const RuleMap* get_rules() const override;
+ const snort::RuleMap* get_rules() const override;
const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
- ProfileStats* get_profile() const override;
+ snort::ProfileStats* get_profile() const override;
Usage get_usage() const override
{ return INSPECT; }
const FtpCmd* get_cmd(unsigned idx);
private:
- void add_commands(Value&, uint32_t flags, int num = 0);
+ void add_commands(snort::Value&, uint32_t flags, int num = 0);
private:
FTP_SERVER_PROTO_CONF* conf;
#include <cstring>
+using namespace snort;
+
FtpSplitter::FtpSplitter(bool c2s) : StreamSplitter(c2s) { }
// flush at last line feed in data
#include "stream/stream_splitter.h"
-class FtpSplitter : public StreamSplitter
+class FtpSplitter : public snort::StreamSplitter
{
public:
FtpSplitter(bool c2s);
- Status scan(Flow*, const uint8_t* data, uint32_t len,
+ Status scan(snort::Flow*, const uint8_t* data, uint32_t len,
uint32_t flags, uint32_t* fp) override;
bool is_paf() override { return true; }
#include "file_api/file_flows.h"
#include "ftpp_si.h"
+using namespace snort;
+
void FtpDataSplitter::restart_scan()
{
bytes = segs = 0;
#include "stream/flush_bucket.h"
#include "stream/stream_splitter.h"
+namespace snort
+{
class Flow;
+}
//---------------------------------------------------------------------------------
// FtpDataSplitter - flush when current seg size is different from previous segment
//---------------------------------------------------------------------------------
-class FtpDataSplitter : public StreamSplitter
+class FtpDataSplitter : public snort::StreamSplitter
{
public:
- FtpDataSplitter(bool b, uint16_t sz = 0) : StreamSplitter(b)
+ FtpDataSplitter(bool b, uint16_t sz = 0) : snort::StreamSplitter(b)
{
min = sz + get_flush_bucket_size();
restart_scan();
}
- Status scan(Flow*, const uint8_t*, uint32_t len, uint32_t flags, uint32_t* fp ) override;
- bool finish(Flow*) override;
+ Status scan(snort::Flow*, const uint8_t*, uint32_t len, uint32_t flags, uint32_t* fp ) override;
+ bool finish(snort::Flow*) override;
private:
uint16_t min;
#include "ft_main.h"
#include "ftpp_return_codes.h"
+using namespace snort;
+
unsigned FtpFlowData::inspector_id = 0;
unsigned TelnetFlowData::inspector_id = 0;
int encr_state;
};
-class TelnetFlowData : public FlowData
+class TelnetFlowData : public snort::FlowData
{
public:
TelnetFlowData();
~TelnetFlowData() override;
static void init()
- { inspector_id = FlowData::create_flow_data_id(); }
+ { inspector_id = snort::FlowData::create_flow_data_id(); }
public:
static unsigned inspector_id;
int data_chan_index;
int data_xfer_index;
bool data_xfer_dir;
- SfIp clientIP;
+ snort::SfIp clientIP;
uint16_t clientPort;
- SfIp serverIP;
+ snort::SfIp serverIP;
uint16_t serverPort;
/* A file is being transferred on ftp-data channel */
void FTPFreesession(FTP_SESSION*);
-class FtpFlowData : public FlowData
+class FtpFlowData : public snort::FlowData
{
public:
FtpFlowData();
~FtpFlowData() override;
static void init()
- { inspector_id = FlowData::create_flow_data_id(); }
+ { inspector_id = snort::FlowData::create_flow_data_id(); }
public:
static unsigned inspector_id;
unsigned char packet_flags;
};
-class FtpDataFlowData : public FlowData
+class FtpDataFlowData : public snort::FlowData
{
public:
- FtpDataFlowData(Packet*);
+ FtpDataFlowData(snort::Packet*);
~FtpDataFlowData() override;
static void init()
- { inspector_id = FlowData::create_flow_data_id(); }
+ { inspector_id = snort::FlowData::create_flow_data_id(); }
- void handle_expected(Packet*) override;
- void handle_eof(Packet*) override;
+ void handle_expected(snort::Packet*) override;
+ void handle_eof(snort::Packet*) override;
public:
static unsigned inspector_id;
*/
struct FTPP_SI_INPUT
{
- SfIp sip;
- SfIp dip;
+ snort::SfIp sip;
+ snort::SfIp dip;
unsigned short sport;
unsigned short dport;
unsigned char pdir;
unsigned char pproto;
};
-int FTPGetPacketDir(Packet*);
+int FTPGetPacketDir(snort::Packet*);
/* FTP-Data file processing */
-FTP_DATA_SESSION* FTPDatasessionNew(Packet* p);
+FTP_DATA_SESSION* FTPDatasessionNew(snort::Packet* p);
void FTPDatasessionFree(void* p_ssn);
-bool FTPDataDirection(Packet* p, FTP_DATA_SESSION* ftpdata);
+bool FTPDataDirection(snort::Packet* p, FTP_DATA_SESSION* ftpdata);
-int TelnetsessionInspection(
- Packet*, TELNET_PROTO_CONF*, TELNET_SESSION**, FTPP_SI_INPUT*, int* piInspectMode);
+int TelnetsessionInspection(snort::Packet*, TELNET_PROTO_CONF*, TELNET_SESSION**,
+ FTPP_SI_INPUT*, int* piInspectMode);
-int FTPsessionInspection(
- Packet*, FTP_SESSION**, FTPP_SI_INPUT*, int* piInspectMode);
+int FTPsessionInspection(snort::Packet*, FTP_SESSION**, FTPP_SI_INPUT*, int* piInspectMode);
-int SetSiInput(FTPP_SI_INPUT*, Packet*);
+int SetSiInput(FTPP_SI_INPUT*, snort::Packet*);
struct FtpStats
{
typedef struct s_FTP_BOUNCE_TO
{
- SfIp ip;
+ snort::SfIp ip;
int relevant_bits;
unsigned short portlo;
unsigned short porthi;
#include "ftpp_return_codes.h"
#include "pp_telnet.h"
+using namespace snort;
+
#ifndef MAXHOSTNAMELEN /* Why doesn't Windows define this? */
#define MAXHOSTNAMELEN 256
#endif
#include "ftpp_si.h"
/* list of function prototypes for this preprocessor */
-extern int check_ftp(FTP_SESSION* session, Packet* p, int iMode);
+extern int check_ftp(FTP_SESSION* session, snort::Packet* p, int iMode);
-extern int initialize_ftp(FTP_SESSION* session, Packet* p, int iMode);
+extern int initialize_ftp(FTP_SESSION* session, snort::Packet* p, int iMode);
#endif
#include "ftpp_return_codes.h"
#include "telnet_module.h"
+using namespace snort;
+
#define NUL 0x00
#define CR 0x0d
#define LF 0x0a
#define FTPP_IGNORE_TNC_ERASE_CMDS 1
/* list of function prototypes for this preprocessor */
-extern int normalize_telnet(TELNET_SESSION*, Packet*, int iMode, char ignoreEraseCmd);
+extern int normalize_telnet(TELNET_SESSION*, snort::Packet*, int iMode, char ignoreEraseCmd);
-void reset_telnet_buffer(Packet*);
-const uint8_t* get_telnet_buffer(Packet*, unsigned&);
+void reset_telnet_buffer(snort::Packet*);
+const uint8_t* get_telnet_buffer(snort::Packet*, unsigned&);
#endif
#include "pp_telnet.h"
#include "telnet_module.h"
+using namespace snort;
+
THREAD_LOCAL ProfileStats telnetPerfStats;
THREAD_LOCAL TelnetStats tnstats;
#include "framework/inspector.h"
-extern const InspectApi tn_api;
+extern const snort::InspectApi tn_api;
#endif
#include "ftpp_si.h"
+using namespace snort;
using namespace std;
//-------------------------------------------------------------------------
#define TEL_NAME "telnet"
#define TEL_HELP "telnet inspection and normalization"
+namespace snort
+{
struct SnortConfig;
+}
-extern THREAD_LOCAL ProfileStats telnetPerfStats;
+extern THREAD_LOCAL snort::ProfileStats telnetPerfStats;
-class TelnetModule : public Module
+class TelnetModule : public snort::Module
{
public:
TelnetModule();
~TelnetModule() override;
- bool set(const char*, Value&, SnortConfig*) override;
- bool begin(const char*, int, SnortConfig*) override;
- bool end(const char*, int, SnortConfig*) override;
+ bool set(const char*, snort::Value&, snort::SnortConfig*) override;
+ bool begin(const char*, int, snort::SnortConfig*) override;
+ bool end(const char*, int, snort::SnortConfig*) override;
unsigned get_gid() const override
{ return GID_TELNET; }
- const RuleMap* get_rules() const override;
+ const snort::RuleMap* get_rules() const override;
const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
- ProfileStats* get_profile() const override;
+ snort::ProfileStats* get_profile() const override;
Usage get_usage() const override
{ return INSPECT; }
#include "gtp_inspect.h"
+using namespace snort;
+
#define GTPMSG_ZERO_LEN offsetof(GTPMsg, msg_id)
THREAD_LOCAL GTP_Stats gtp_stats;
#include "framework/counts.h"
#include "main/thread.h"
+namespace snort
+{
+struct Packet;
+}
+
#define MIN_GTP_VERSION_CODE (0)
#define MAX_GTP_VERSION_CODE (2)
extern THREAD_LOCAL GTP_Stats gtp_stats;
-void GTPmain(const GTPConfig&, struct Packet*);
+void GTPmain(const GTPConfig&, snort::Packet*);
#endif
#include "gtp.h"
#include "gtp_module.h"
+using namespace snort;
+
//-------------------------------------------------------------------------
// flow stuff
//-------------------------------------------------------------------------
GTP_IEData* gtp_infoElements;
};
-class GtpFlowData : public FlowData
+class GtpFlowData : public snort::FlowData
{
public:
GtpFlowData();
#include "gtp.h"
+using namespace snort;
+
THREAD_LOCAL ProfileStats gtp_inspect_prof;
#define GTP_EVENT_BAD_MSG_LEN_STR "message length is invalid"
#define GTP_NAME "gtp_inspect"
#define GTP_HELP "gtp control channel inspection"
-extern THREAD_LOCAL ProfileStats gtp_inspect_prof;
+extern THREAD_LOCAL snort::ProfileStats gtp_inspect_prof;
struct GtpStuff
{
int length;
};
-class GtpInspectModule : public Module
+class GtpInspectModule : public snort::Module
{
public:
GtpInspectModule();
- bool set(const char*, Value&, SnortConfig*) override;
- bool begin(const char*, int, SnortConfig*) override;
- bool end(const char*, int, SnortConfig*) override;
+ bool set(const char*, snort::Value&, snort::SnortConfig*) override;
+ bool begin(const char*, int, snort::SnortConfig*) override;
+ bool end(const char*, int, snort::SnortConfig*) override;
unsigned get_gid() const override
{ return GID_GTP; }
- const RuleMap* get_rules() const override;
+ const snort::RuleMap* get_rules() const override;
const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
- ProfileStats* get_profile() const override
+ snort::ProfileStats* get_profile() const override
{ return >p_inspect_prof; }
Usage get_usage() const override
#pragma pack(1)
static inline void alert(int sid)
{
- DetectionEngine::queue_event(GID_GTP, sid);
+ snort::DetectionEngine::queue_event(GID_GTP, sid);
gtp_stats.events++;
}
#include "gtp.h"
#include "gtp_inspect.h"
+using namespace snort;
+
static const char* s_name = "gtp_info";
//-------------------------------------------------------------------------
#include "gtp.h"
#include "gtp_inspect.h"
+using namespace snort;
+
static const char* s_name = "gtp_type";
//-------------------------------------------------------------------------
#include "gtp_inspect.h"
+using namespace snort;
+
static const char* s_name = "gtp_version";
//-------------------------------------------------------------------------
#include "http2_inspect.h"
+using namespace snort;
+
const char* Http2Api::http2_my_name = HTTP2_NAME;
const char* Http2Api::http2_help = "the HTTP/2 inspector";
class Http2Api
{
public:
- static const InspectApi http2_api;
+ static const snort::InspectApi http2_api;
static const char* classic_buffer_names[];
private:
Http2Api() = delete;
- static Module* http2_mod_ctor() { return new Http2Module; }
- static void http2_mod_dtor(Module* m) { delete m; }
+ static snort::Module* http2_mod_ctor() { return new Http2Module; }
+ static void http2_mod_dtor(snort::Module* m) { delete m; }
static const char* http2_my_name;
static const char* http2_help;
static void http2_init() { Http2FlowData::init(); }
static void http2_term() { }
- static Inspector* http2_ctor(Module* mod);
- static void http2_dtor(Inspector* p) { delete p; }
+ static snort::Inspector* http2_ctor(snort::Module* mod);
+ static void http2_dtor(snort::Inspector* p) { delete p; }
static void http2_tinit() { }
static void http2_tterm() { }
};
#include "http2_enum.h"
#include "http2_module.h"
+using namespace snort;
using namespace Http2Enums;
unsigned Http2FlowData::inspector_id = 0;
#include "stream/stream_splitter.h"
#include "http2_enum.h"
-class Http2FlowData : public FlowData
+class Http2FlowData : public snort::FlowData
{
public:
Http2FlowData();
~Http2FlowData() override;
static unsigned inspector_id;
- static void init() { inspector_id = FlowData::create_flow_data_id(); }
+ static void init() { inspector_id = snort::FlowData::create_flow_data_id(); }
friend class Http2Inspect;
friend class Http2StreamSplitter;
- friend const StreamBuffer implement_reassemble(Http2FlowData*, unsigned, unsigned,
+ friend const snort::StreamBuffer implement_reassemble(Http2FlowData*, unsigned, unsigned,
const uint8_t*, unsigned, uint32_t, unsigned&, Http2Enums::SourceId);
- friend StreamSplitter::Status implement_scan(Http2FlowData*, const uint8_t*, uint32_t,
+ friend snort::StreamSplitter::Status implement_scan(Http2FlowData*, const uint8_t*, uint32_t,
uint32_t*, Http2Enums::SourceId);
friend bool implement_get_buf(unsigned id, Http2FlowData*, Http2Enums::SourceId,
- InspectionBuffer&);
+ snort::InspectionBuffer&);
protected:
// 0 element refers to client frame, 1 element refers to server frame
#include "service_inspectors/http_inspect/http_test_manager.h"
#include "stream/stream.h"
+using namespace snort;
using namespace Http2Enums;
Http2Inspect::Http2Inspect(const Http2ParaList* params_) : params(params_)
class Http2Api;
-class Http2Inspect : public Inspector
+class Http2Inspect : public snort::Inspector
{
public:
Http2Inspect(const Http2ParaList* params_);
~Http2Inspect() override { delete params; }
- bool get_buf(InspectionBuffer::Type ibt, Packet* p, InspectionBuffer& b) override;
- bool get_buf(unsigned id, Packet* p, InspectionBuffer& b) override;
- bool get_fp_buf(InspectionBuffer::Type ibt, Packet* p, InspectionBuffer& b) override;
- bool configure(SnortConfig*) override;
- void show(SnortConfig*) override { LogMessage("Http2Inspect\n"); }
- void eval(Packet* p) override;
- void clear(Packet* p) override;
+ bool get_buf(snort::InspectionBuffer::Type ibt, snort::Packet* p, snort::InspectionBuffer& b) override;
+ bool get_buf(unsigned id, snort::Packet* p, snort::InspectionBuffer& b) override;
+ bool get_fp_buf(snort::InspectionBuffer::Type ibt, snort::Packet* p,
+ snort::InspectionBuffer& b) override;
+ bool configure(snort::SnortConfig*) override;
+ void show(snort::SnortConfig*) override { LogMessage("Http2Inspect\n"); }
+ void eval(snort::Packet* p) override;
+ void clear(snort::Packet* p) override;
void tinit() override { }
void tterm() override { }
Http2StreamSplitter* get_splitter(bool is_client_to_server) override
};
bool implement_get_buf(unsigned id, Http2FlowData* session_data, Http2Enums::SourceId source_id,
- InspectionBuffer& b);
+ snort::InspectionBuffer& b);
#endif
#include "http2_inspect.h"
#include "http2_flow_data.h"
+using namespace snort;
using namespace Http2Enums;
bool implement_get_buf(unsigned id, Http2FlowData* session_data, SourceId source_id,
#include "http2_module.h"
+using namespace snort;
using namespace Http2Enums;
const Parameter Http2Module::http2_params[] =
public:
};
-class Http2Module : public Module
+class Http2Module : public snort::Module
{
public:
- Http2Module() : Module(HTTP2_NAME, HTTP2_HELP, http2_params) { }
+ Http2Module() : snort::Module(HTTP2_NAME, HTTP2_HELP, http2_params) { }
~Http2Module() override { delete params; }
- bool begin(const char*, int, SnortConfig*) override;
- bool end(const char*, int, SnortConfig*) override;
- bool set(const char*, Value&, SnortConfig*) override;
+ bool begin(const char*, int, snort::SnortConfig*) override;
+ bool end(const char*, int, snort::SnortConfig*) override;
+ bool set(const char*, snort::Value&, snort::SnortConfig*) override;
unsigned get_gid() const override { return Http2Enums::HTTP2_GID; }
- const RuleMap* get_rules() const override { return http2_events; }
+ const snort::RuleMap* get_rules() const override { return http2_events; }
const Http2ParaList* get_once_params()
{
Http2ParaList* ret_val = params;
static PegCount get_peg_counts(Http2Enums::PEG_COUNT counter)
{ return peg_counts[counter]; }
- ProfileStats* get_profile() const override;
+ snort::ProfileStats* get_profile() const override;
- static ProfileStats& get_profile_stats()
+ static snort::ProfileStats& get_profile_stats()
{ return http2_profile; }
Usage get_usage() const override
{ return INSPECT; }
private:
- static const Parameter http2_params[];
- static const RuleMap http2_events[];
+ static const snort::Parameter http2_params[];
+ static const snort::RuleMap http2_events[];
Http2ParaList* params = nullptr;
static const PegInfo peg_names[];
- static THREAD_LOCAL ProfileStats http2_profile;
+ static THREAD_LOCAL snort::ProfileStats http2_profile;
static THREAD_LOCAL PegCount peg_counts[];
};
#include "http2_stream_splitter.h"
#include "http2_module.h"
+using namespace snort;
using namespace Http2Enums;
// Mindless scan() that just flushes whatever it is given
class Http2Inspect;
-class Http2StreamSplitter : public StreamSplitter
+class Http2StreamSplitter : public snort::StreamSplitter
{
public:
- Http2StreamSplitter(bool is_client_to_server) : StreamSplitter(is_client_to_server),
+ Http2StreamSplitter(bool is_client_to_server) : snort::StreamSplitter(is_client_to_server),
source_id(is_client_to_server ? Http2Enums::SRC_CLIENT : Http2Enums::SRC_SERVER) { }
- Status scan(Flow* flow, const uint8_t* data, uint32_t length, uint32_t not_used,
+ Status scan(snort::Flow* flow, const uint8_t* data, uint32_t length, uint32_t not_used,
uint32_t* flush_offset) override;
- const StreamBuffer reassemble(Flow* flow, unsigned total, unsigned offset, const
+ const snort::StreamBuffer reassemble(snort::Flow* flow, unsigned total, unsigned offset, const
uint8_t* data, unsigned len, uint32_t flags, unsigned& copied) override;
- bool finish(Flow* flow) override;
+ bool finish(snort::Flow* flow) override;
bool is_paf() override { return true; }
// FIXIT-M should return actual packet buffer size
- unsigned max(Flow*) override { return Http2Enums::MAX_OCTETS; }
+ unsigned max(snort::Flow*) override { return Http2Enums::MAX_OCTETS; }
private:
const Http2Enums::SourceId source_id;
};
-StreamSplitter::Status implement_scan(Http2FlowData* session_data, const uint8_t* data,
+snort::StreamSplitter::Status implement_scan(Http2FlowData* session_data, const uint8_t* data,
uint32_t length, uint32_t* flush_offset, Http2Enums::SourceId source_id);
-const StreamBuffer implement_reassemble(Http2FlowData* session_data, unsigned total,
+const snort::StreamBuffer implement_reassemble(Http2FlowData* session_data, unsigned total,
unsigned offset, const uint8_t* data, unsigned len, uint32_t flags, unsigned& copied,
Http2Enums::SourceId source_id);
#include "protocols/packet.h"
#include "http2_flow_data.h"
+using namespace snort;
using namespace Http2Enums;
StreamSplitter::Status implement_scan(Http2FlowData* session_data, const uint8_t* data,
using namespace Http2Enums;
-const RuleMap Http2Module::http2_events[] =
+const snort::RuleMap Http2Module::http2_events[] =
{
{ 0, nullptr }
};
#include "http2_flow_data.h"
#include "http2_inspect.h"
+using namespace snort;
using namespace Http2Enums;
THREAD_LOCAL std::array<ProfileStats, PSI_MAX> Http2CursorModule::http2_ps;
enum PsIdx { PSI_FRAME_DATA, PSI_FRAME_HEADER, PSI_MAX };
-class Http2CursorModule : public Module
+class Http2CursorModule : public snort::Module
{
public:
Http2CursorModule(const char* key_, const char* help, Http2Enums::HTTP2_BUFFER buffer_index_,
- CursorActionType cat_, PsIdx psi_) : Module(key_, help), key(key_),
+ snort::CursorActionType cat_, PsIdx psi_) : snort::Module(key_, help), key(key_),
buffer_index(buffer_index_), cat(cat_), psi(psi_) {}
- ProfileStats* get_profile() const override { return &http2_ps[psi]; }
- static void mod_dtor(Module* m) { delete m; }
- bool begin(const char*, int, SnortConfig*) override;
- bool set(const char*, Value&, SnortConfig*) override;
- bool end(const char*, int, SnortConfig*) override;
+ snort::ProfileStats* get_profile() const override { return &http2_ps[psi]; }
+ static void mod_dtor(snort::Module* m) { delete m; }
+ bool begin(const char*, int, snort::SnortConfig*) override;
+ bool set(const char*, snort::Value&, snort::SnortConfig*) override;
+ bool end(const char*, int, snort::SnortConfig*) override;
Usage get_usage() const override
{ return DETECT; }
private:
friend class Http2IpsOption;
- static THREAD_LOCAL std::array<ProfileStats, PsIdx::PSI_MAX> http2_ps;
+ static THREAD_LOCAL std::array<snort::ProfileStats, PsIdx::PSI_MAX> http2_ps;
struct Http2RuleParaList
{
const char* const key;
const Http2Enums::HTTP2_BUFFER buffer_index;
- const CursorActionType cat;
+ const snort::CursorActionType cat;
const PsIdx psi;
Http2RuleParaList para_list;
};
-class Http2IpsOption : public IpsOption
+class Http2IpsOption : public snort::IpsOption
{
public:
Http2IpsOption(const Http2CursorModule* cm) :
- IpsOption(cm->key, RULE_OPTION_TYPE_BUFFER_SET), key(cm->key),
+ snort::IpsOption(cm->key, RULE_OPTION_TYPE_BUFFER_SET), key(cm->key),
buffer_index(cm->buffer_index), cat(cm->cat), psi(cm->psi) {}
- CursorActionType get_cursor_type() const override { return cat; }
- EvalStatus eval(Cursor&, Packet*) override;
+ snort::CursorActionType get_cursor_type() const override { return cat; }
+ EvalStatus eval(Cursor&, snort::Packet*) override;
uint32_t hash() const override;
- bool operator==(const IpsOption& ips) const override;
- static IpsOption* opt_ctor(Module* m, OptTreeNode*)
+ bool operator==(const snort::IpsOption& ips) const override;
+ static snort::IpsOption* opt_ctor(snort::Module* m, OptTreeNode*)
{ return new Http2IpsOption((Http2CursorModule*)m); }
static void opt_dtor(IpsOption* p) { delete p; }
private:
const char* const key;
const Http2Enums::HTTP2_BUFFER buffer_index;
- const CursorActionType cat;
+ const snort::CursorActionType cat;
const PsIdx psi;
};
#include "service_inspectors/http2_inspect/http2_module.h"
// Stubs whose sole purpose is to make the test code link
-FlowData::FlowData(unsigned u, Inspector* ph) : next(nullptr), prev(nullptr), handler(ph), id(u) {}
-FlowData::~FlowData() {}
-unsigned FlowData::flow_data_id = 0;
+snort::FlowData::FlowData(unsigned u, Inspector* ph) : next(nullptr), prev(nullptr), handler(ph), id(u) {}
+snort::FlowData::~FlowData() {}
+unsigned snort::FlowData::flow_data_id = 0;
void show_stats(PegCount*, const PegInfo*, unsigned, const char*) { }
void show_stats(PegCount*, const PegInfo*, IndexVec&, const char*, FILE*) { }
void show_stats(SimpleStats*, const char*) { }
#include <CppUTest/TestHarness.h>
#include <CppUTestExt/MockSupport.h>
+using namespace snort;
using namespace Http2Enums;
TEST_GROUP(http2_get_buf_test)
#include <CppUTest/TestHarness.h>
#include <CppUTestExt/MockSupport.h>
+using namespace snort;
using namespace Http2Enums;
TEST_GROUP(http2_scan_test)
#include "http_inspect.h"
+using namespace snort;
+
const char* HttpApi::http_my_name = HTTP_NAME;
const char* HttpApi::http_help = "the new HTTP inspector!";
class HttpApi
{
public:
- static const InspectApi http_api;
+ static const snort::InspectApi http_api;
static const char* classic_buffer_names[];
private:
HttpApi() = delete;
- static Module* http_mod_ctor() { return new HttpModule; }
- static void http_mod_dtor(Module* m) { delete m; }
+ static snort::Module* http_mod_ctor() { return new HttpModule; }
+ static void http_mod_dtor(snort::Module* m) { delete m; }
static const char* http_my_name;
static const char* http_help;
static void http_init() { HttpFlowData::init(); }
static void http_term() { }
- static Inspector* http_ctor(Module* mod);
- static void http_dtor(Inspector* p) { delete p; }
+ static snort::Inspector* http_ctor(snort::Module* mod);
+ static void http_dtor(snort::Inspector* p) { delete p; }
static void http_tinit() { }
static void http_tterm() { }
};
assert((sid > 0) && (sid <= MAX));
if (!events_generated[sid-1])
{
- DetectionEngine::queue_event(HttpEnums::HTTP_GID, (uint32_t)sid);
+ snort::DetectionEngine::queue_event(HttpEnums::HTTP_GID, (uint32_t)sid);
events_generated[sid-1] = true;
}
}
class HttpJsNorm;
class HttpMsgSection;
-class HttpFlowData : public FlowData
+class HttpFlowData : public snort::FlowData
{
public:
HttpFlowData();
~HttpFlowData() override;
static unsigned inspector_id;
- static void init() { inspector_id = FlowData::create_flow_data_id(); }
+ static void init() { inspector_id = snort::FlowData::create_flow_data_id(); }
friend class HttpInspect;
friend class HttpMsgSection;
HttpEnums::STAT_NOT_PRESENT };
int64_t detect_depth_remaining[2] = { HttpEnums::STAT_NOT_PRESENT,
HttpEnums::STAT_NOT_PRESENT };
- MimeSession* mime_state[2] = { nullptr, nullptr };
+ snort::MimeSession* mime_state[2] = { nullptr, nullptr };
UtfDecodeSession* utf_state = nullptr; // SRC_SERVER only
fd_session_t* fd_state = nullptr; // SRC_SERVER only
struct FdCallbackContext
#include "http_msg_trailer.h"
#include "http_test_manager.h"
+using namespace snort;
using namespace HttpEnums;
uint32_t HttpInspect::xtra_trueip_id;
class HttpApi;
-class HttpInspect : public Inspector
+class HttpInspect : public snort::Inspector
{
public:
HttpInspect(const HttpParaList* params_);
~HttpInspect() override { delete params; }
- bool get_buf(InspectionBuffer::Type ibt, Packet* p, InspectionBuffer& b) override;
- bool get_buf(unsigned id, Packet* p, InspectionBuffer& b) override;
- bool http_get_buf(
- unsigned id, uint64_t sub_id, uint64_t form, Packet* p, InspectionBuffer& b);
- bool get_fp_buf(InspectionBuffer::Type ibt, Packet* p, InspectionBuffer& b) override;
- bool configure(SnortConfig*) override;
- void show(SnortConfig*) override { LogMessage("HttpInspect\n"); }
- void eval(Packet* p) override;
- void clear(Packet* p) override;
+ bool get_buf(snort::InspectionBuffer::Type ibt, snort::Packet* p,
+ snort::InspectionBuffer& b) override;
+ bool get_buf(unsigned id, snort::Packet* p, snort::InspectionBuffer& b) override;
+ bool http_get_buf(unsigned id, uint64_t sub_id, uint64_t form, snort::Packet* p,
+ snort::InspectionBuffer& b);
+ bool get_fp_buf(snort::InspectionBuffer::Type ibt, snort::Packet* p, snort::InspectionBuffer& b) override;
+ bool configure(snort::SnortConfig*) override;
+ void show(snort::SnortConfig*) override { LogMessage("HttpInspect\n"); }
+ void eval(snort::Packet* p) override;
+ void clear(snort::Packet* p) override;
void tinit() override { }
void tterm() override { }
HttpStreamSplitter* get_splitter(bool is_client_to_server) override
{
return new HttpStreamSplitter(is_client_to_server, this);
}
- static HttpEnums::InspectSection get_latest_is(const Packet* p);
+ static HttpEnums::InspectSection get_latest_is(const snort::Packet* p);
// Callbacks that provide "extra data"
- static int get_xtra_trueip(Flow*, uint8_t**, uint32_t*, uint32_t*);
- static int get_xtra_uri(Flow*, uint8_t**, uint32_t*, uint32_t*);
- static int get_xtra_host(Flow*, uint8_t** buf, uint32_t* len, uint32_t* type);
- static int get_xtra_jsnorm(Flow*, uint8_t**, uint32_t*, uint32_t*);
+ static int get_xtra_trueip(snort::Flow*, uint8_t**, uint32_t*, uint32_t*);
+ static int get_xtra_uri(snort::Flow*, uint8_t**, uint32_t*, uint32_t*);
+ static int get_xtra_host(snort::Flow*, uint8_t** buf, uint32_t* len, uint32_t* type);
+ static int get_xtra_jsnorm(snort::Flow*, uint8_t**, uint32_t*, uint32_t*);
private:
friend HttpApi;
friend HttpStreamSplitter;
- bool process(const uint8_t* data, const uint16_t dsize, Flow* const flow,
+ bool process(const uint8_t* data, const uint16_t dsize, snort::Flow* const flow,
HttpEnums::SourceId source_id_, bool buf_owner) const;
- static HttpEnums::SourceId get_latest_src(const Packet* p);
+ static HttpEnums::SourceId get_latest_src(const snort::Packet* p);
const HttpParaList* const params;
if ( javascript_search_mpse || htmltype_search_mpse )
return;
- javascript_search_mpse = new SearchTool;
- htmltype_search_mpse = new SearchTool;
+ javascript_search_mpse = new snort::SearchTool;
+ htmltype_search_mpse = new snort::SearchTool;
javascript_search_mpse->add(script_start, script_start_length, JS_JAVASCRIPT);
javascript_search_mpse->prep();
const int max_javascript_whitespaces;
const HttpParaList::UriParam& uri_param;
- SearchTool* javascript_search_mpse;
- SearchTool* htmltype_search_mpse;
+ snort::SearchTool* javascript_search_mpse;
+ snort::SearchTool* htmltype_search_mpse;
static int search_js_found(void*, void*, int index, void*, void*);
static int search_html_found(void* id, void*, int, void*, void*);
#include "http_js_norm.h"
#include "http_uri_norm.h"
+using namespace snort;
using namespace HttpEnums;
const Parameter HttpModule::http_params[] =
#endif
};
-class HttpModule : public Module
+class HttpModule : public snort::Module
{
public:
HttpModule() : Module(HTTP_NAME, HTTP_HELP, http_params) { }
~HttpModule() override { delete params; }
- bool begin(const char*, int, SnortConfig*) override;
- bool end(const char*, int, SnortConfig*) override;
- bool set(const char*, Value&, SnortConfig*) override;
+ bool begin(const char*, int, snort::SnortConfig*) override;
+ bool end(const char*, int, snort::SnortConfig*) override;
+ bool set(const char*, snort::Value&, snort::SnortConfig*) override;
unsigned get_gid() const override { return HttpEnums::HTTP_GID; }
- const RuleMap* get_rules() const override { return http_events; }
+ const snort::RuleMap* get_rules() const override { return http_events; }
const HttpParaList* get_once_params()
{
HttpParaList* ret_val = params;
static PegCount get_peg_counts(HttpEnums::PEG_COUNT counter)
{ return peg_counts[counter]; }
- ProfileStats* get_profile() const override;
+ snort::ProfileStats* get_profile() const override;
- static ProfileStats& get_profile_stats()
+ static snort::ProfileStats& get_profile_stats()
{ return http_profile; }
Usage get_usage() const override
#endif
private:
- static const Parameter http_params[];
- static const RuleMap http_events[];
+ static const snort::Parameter http_params[];
+ static const snort::RuleMap http_events[];
HttpParaList* params = nullptr;
static const PegInfo peg_names[];
- static THREAD_LOCAL ProfileStats http_profile;
+ static THREAD_LOCAL snort::ProfileStats http_profile;
static THREAD_LOCAL PegCount peg_counts[];
};
using namespace HttpEnums;
HttpMsgBody::HttpMsgBody(const uint8_t* buffer, const uint16_t buf_size,
- HttpFlowData* session_data_, SourceId source_id_, bool buf_owner, Flow* flow_,
+ HttpFlowData* session_data_, SourceId source_id_, bool buf_owner, snort::Flow* flow_,
const HttpParaList* params_) :
HttpMsgSection(buffer, buf_size, session_data_, source_id_, buf_owner, flow_, params_),
body_octets(session_data->body_octets[source_id]),
js_norm_body.length() : session_data->detect_depth_remaining[source_id];
detect_data.set(detect_length, js_norm_body.start());
session_data->detect_depth_remaining[source_id] -= detect_length;
- set_file_data(
- const_cast<uint8_t*>(detect_data.start()), (unsigned)detect_data.length());
+ snort::set_file_data(const_cast<uint8_t*>(detect_data.start()),
+ (unsigned)detect_data.length());
}
if (session_data->file_depth_remaining[source_id] > 0)
if (!session_data->mime_state[source_id])
{
- FileFlows* file_flows = FileFlows::get_file_flows(flow);
+ snort::FileFlows* file_flows = snort::FileFlows::get_file_flows(flow);
const bool download = (source_id == SRC_SERVER);
HttpMsgRequest* request = transaction->get_request();
protected:
HttpMsgBody(const uint8_t* buffer, const uint16_t buf_size, HttpFlowData* session_data_,
- HttpEnums::SourceId source_id_, bool buf_owner, Flow* flow_,
+ HttpEnums::SourceId source_id_, bool buf_owner, snort::Flow* flow_,
const HttpParaList* params_);
int64_t body_octets;
{
public:
HttpMsgBodyChunk(const uint8_t* buffer, const uint16_t buf_size, HttpFlowData* session_data_,
- HttpEnums::SourceId source_id_, bool buf_owner, Flow* flow_, const HttpParaList* params_)
+ HttpEnums::SourceId source_id_, bool buf_owner, snort::Flow* flow_, const HttpParaList* params_)
: HttpMsgBody(buffer, buf_size, session_data_, source_id_, buf_owner, flow_, params_) {}
void update_flow() override;
{
public:
HttpMsgBodyCl(const uint8_t* buffer, const uint16_t buf_size, HttpFlowData* session_data_,
- HttpEnums::SourceId source_id_, bool buf_owner, Flow* flow_, const HttpParaList* params_)
+ HttpEnums::SourceId source_id_, bool buf_owner, snort::Flow* flow_, const HttpParaList* params_)
: HttpMsgBody(buffer, buf_size, session_data_, source_id_, buf_owner, flow_, params_),
data_length(session_data->data_length[source_id]) {}
void update_flow() override;
{
public:
HttpMsgBodyOld(const uint8_t* buffer, const uint16_t buf_size, HttpFlowData* session_data_,
- HttpEnums::SourceId source_id_, bool buf_owner, Flow* flow_, const HttpParaList* params_)
+ HttpEnums::SourceId source_id_, bool buf_owner, snort::Flow* flow_, const HttpParaList* params_)
: HttpMsgBody(buffer, buf_size, session_data_, source_id_, buf_owner, flow_, params_),
data_length(session_data->data_length[source_id]) {}
void update_flow() override;
protected:
HttpMsgHeadShared(const uint8_t* buffer, const uint16_t buf_size,
- HttpFlowData* session_data_, HttpEnums::SourceId source_id_, bool buf_owner, Flow* flow_,
+ HttpFlowData* session_data_, HttpEnums::SourceId source_id_, bool buf_owner, snort::Flow* flow_,
const HttpParaList* params_)
: HttpMsgSection(buffer, buf_size, session_data_, source_id_, buf_owner, flow_, params_)
{ }
#include "pub_sub/http_events.h"
#include "sfip/sf_ip.h"
+using namespace snort;
using namespace HttpEnums;
HttpMsgHeader::HttpMsgHeader(const uint8_t* buffer, const uint16_t buf_size,
{
public:
HttpMsgHeader(const uint8_t* buffer, const uint16_t buf_size, HttpFlowData* session_data_,
- HttpEnums::SourceId source_id_, bool buf_owner, Flow* flow_,
+ HttpEnums::SourceId source_id_, bool buf_owner, snort::Flow* flow_,
const HttpParaList* params_);
HttpEnums::InspectSection get_inspection_section() const override
{ return detection_section ? HttpEnums::IS_DETECTION : HttpEnums::IS_NONE; }
using namespace HttpEnums;
HttpMsgRequest::HttpMsgRequest(const uint8_t* buffer, const uint16_t buf_size,
- HttpFlowData* session_data_, SourceId source_id_, bool buf_owner, Flow* flow_,
+ HttpFlowData* session_data_, SourceId source_id_, bool buf_owner, snort::Flow* flow_,
const HttpParaList* params_) :
HttpMsgStart(buffer, buf_size, session_data_, source_id_, buf_owner, flow_, params_)
{
{
public:
HttpMsgRequest(const uint8_t* buffer, const uint16_t buf_size, HttpFlowData* session_data_,
- HttpEnums::SourceId source_id_, bool buf_owner, Flow* flow_,
+ HttpEnums::SourceId source_id_, bool buf_owner, snort::Flow* flow_,
const HttpParaList* params_);
~HttpMsgRequest() override { delete uri; }
void gen_events() override;
using namespace HttpEnums;
HttpMsgSection::HttpMsgSection(const uint8_t* buffer, const uint16_t buf_size,
- HttpFlowData* session_data_, SourceId source_id_, bool buf_owner, Flow* flow_,
+ HttpFlowData* session_data_, SourceId source_id_, bool buf_owner, snort::Flow* flow_,
const HttpParaList* params_) :
msg_text(buf_size, buffer, buf_owner),
session_data(session_data_),
{
case CMP_NONE:
{
- unsigned max_pdu = SnortConfig::get_conf()->max_pdu;
+ unsigned max_pdu = snort::SnortConfig::get_conf()->max_pdu;
session_data->section_size_target[source_id] = max_pdu + random_increment;
session_data->section_size_max[source_id] = max_pdu + (max_pdu >> 1);
break;
protected:
HttpMsgSection(const uint8_t* buffer, const uint16_t buf_size, HttpFlowData* session_data_,
- HttpEnums::SourceId source_id_, bool buf_owner, Flow* flow_, const HttpParaList*
+ HttpEnums::SourceId source_id_, bool buf_owner, snort::Flow* flow_, const HttpParaList*
params_);
const Field msg_text;
HttpFlowData* const session_data;
const HttpEnums::SourceId source_id;
- Flow* const flow;
+ snort::Flow* const flow;
uint64_t trans_num;
const HttpParaList* const params;
HttpTransaction* const transaction;
protected:
HttpMsgStart(const uint8_t* buffer, const uint16_t buf_size, HttpFlowData* session_data_,
- HttpEnums::SourceId source_id_, bool buf_owner, Flow* flow_, const HttpParaList* params_)
+ HttpEnums::SourceId source_id_, bool buf_owner, snort::Flow* flow_,
+ const HttpParaList* params_)
: HttpMsgSection(buffer, buf_size, session_data_, source_id_, buf_owner, flow_, params_)
{ }
virtual void parse_start_line() = 0;
using namespace HttpEnums;
HttpMsgStatus::HttpMsgStatus(const uint8_t* buffer, const uint16_t buf_size,
- HttpFlowData* session_data_, SourceId source_id_, bool buf_owner, Flow* flow_,
+ HttpFlowData* session_data_, SourceId source_id_, bool buf_owner, snort::Flow* flow_,
const HttpParaList* params_) :
HttpMsgStart(buffer, buf_size, session_data_, source_id_, buf_owner, flow_, params_)
{
{
public:
HttpMsgStatus(const uint8_t* buffer, const uint16_t buf_size, HttpFlowData* session_data_,
- HttpEnums::SourceId source_id_, bool buf_owner, Flow* flow_,
+ HttpEnums::SourceId source_id_, bool buf_owner, snort::Flow* flow_,
const HttpParaList* params_);
void gen_events() override;
void update_flow() override;
using namespace HttpEnums;
HttpMsgTrailer::HttpMsgTrailer(const uint8_t* buffer, const uint16_t buf_size,
- HttpFlowData* session_data_, SourceId source_id_, bool buf_owner, Flow* flow_,
+ HttpFlowData* session_data_, SourceId source_id_, bool buf_owner, snort::Flow* flow_,
const HttpParaList* params_) :
HttpMsgHeadShared(buffer, buf_size, session_data_, source_id_, buf_owner, flow_, params_)
{
{
public:
HttpMsgTrailer(const uint8_t* buffer, const uint16_t buf_size, HttpFlowData* session_data_,
- HttpEnums::SourceId source_id_, bool buf_owner, Flow* flow_,
+ HttpEnums::SourceId source_id_, bool buf_owner, snort::Flow* flow_,
const HttpParaList* params_);
HttpEnums::InspectSection get_inspection_section() const override
{ return HttpEnums::IS_TRAILER; }
class HttpInspect;
-class HttpStreamSplitter : public StreamSplitter
+class HttpStreamSplitter : public snort::StreamSplitter
{
public:
HttpStreamSplitter(bool is_client_to_server, HttpInspect* my_inspector_) :
- StreamSplitter(is_client_to_server),
+ snort::StreamSplitter(is_client_to_server),
source_id(is_client_to_server ? HttpEnums::SRC_CLIENT : HttpEnums::SRC_SERVER),
my_inspector(my_inspector_) { }
- Status scan(Flow* flow, const uint8_t* data, uint32_t length, uint32_t not_used,
+ Status scan(snort::Flow* flow, const uint8_t* data, uint32_t length, uint32_t not_used,
uint32_t* flush_offset) override;
- const StreamBuffer reassemble(Flow* flow, unsigned total, unsigned, const
+ const snort::StreamBuffer reassemble(snort::Flow* flow, unsigned total, unsigned, const
uint8_t* data, unsigned len, uint32_t flags, unsigned& copied) override;
- bool finish(Flow* flow) override;
+ bool finish(snort::Flow* flow) override;
bool is_paf() override { return true; }
// FIXIT-M should return actual packet buffer size
- unsigned max(Flow*) override { return HttpEnums::MAX_OCTETS; }
+ unsigned max(snort::Flow*) override { return HttpEnums::MAX_OCTETS; }
private:
void prepare_flush(HttpFlowData* session_data, uint32_t* flush_offset, HttpEnums::SectionType
using namespace HttpEnums;
-bool HttpStreamSplitter::finish(Flow* flow)
+bool HttpStreamSplitter::finish(snort::Flow* flow)
{
HttpFlowData* session_data = (HttpFlowData*)flow->get_flow_data(HttpFlowData::inspector_id);
// FIXIT-M - this assert has been changed to check for null session data and return false if so
{
if (!session_data->mime_state[source_id])
{
- FileFlows* file_flows = FileFlows::get_file_flows(flow);
+ snort::FileFlows* file_flows = snort::FileFlows::get_file_flows(flow);
const bool download = (source_id == SRC_SERVER);
size_t file_index = 0;
offset += length;
}
-const StreamBuffer HttpStreamSplitter::reassemble(Flow* flow, unsigned total, unsigned,
+const snort::StreamBuffer HttpStreamSplitter::reassemble(snort::Flow* flow, unsigned total, unsigned,
const uint8_t* data, unsigned len, uint32_t flags, unsigned& copied)
{
- StreamBuffer http_buf { nullptr, 0 };
+ snort::StreamBuffer http_buf { nullptr, 0 };
copied = len;
#include "http_stream_splitter.h"
#include "http_test_input.h"
+using namespace snort;
using namespace HttpEnums;
// Convenience function. All housekeeping that must be done before we can return FLUSH to stream.
#pragma clang diagnostic pop
#endif
-const RuleMap HttpModule::http_events[] =
+const snort::RuleMap HttpModule::http_events[] =
{
{ EVENT_ASCII, "ascii encoding" },
{ EVENT_DOUBLE_DECODE, "double decoding attack" },
#include "http_inspect.h"
#include "http_msg_head_shared.h"
+using namespace snort;
using namespace HttpEnums;
THREAD_LOCAL std::array<ProfileStats, PSI_MAX> HttpCursorModule::http_ps;
PSI_RAW_HEADER, PSI_RAW_REQUEST, PSI_RAW_STATUS, PSI_RAW_TRAILER, PSI_RAW_URI, PSI_STAT_CODE,
PSI_STAT_MSG, PSI_TRAILER, PSI_TRUE_IP, PSI_URI, PSI_VERSION, PSI_MAX };
-class HttpCursorModule : public Module
+class HttpCursorModule : public snort::Module
{
public:
HttpCursorModule(const char* key_, const char* help, HttpEnums::HTTP_BUFFER buffer_index_,
- CursorActionType cat_, PsIdx psi_) : Module(key_, help), key(key_),
- buffer_index(buffer_index_), cat(cat_), psi(psi_) {}
+ snort::CursorActionType cat_, PsIdx psi_)
+ : snort::Module(key_, help), key(key_), buffer_index(buffer_index_),
+ cat(cat_), psi(psi_) {}
HttpCursorModule(const char* key_, const char* help, HttpEnums::HTTP_BUFFER buffer_index_,
- CursorActionType cat_, PsIdx psi_, const Parameter params[]) : Module(key_, help, params),
- key(key_), buffer_index(buffer_index_), cat(cat_), psi(psi_) {}
- ProfileStats* get_profile() const override { return &http_ps[psi]; }
- static void mod_dtor(Module* m) { delete m; }
- bool begin(const char*, int, SnortConfig*) override;
- bool set(const char*, Value&, SnortConfig*) override;
- bool end(const char*, int, SnortConfig*) override;
+ snort::CursorActionType cat_, PsIdx psi_, const snort::Parameter params[])
+ : snort::Module(key_, help, params), key(key_), buffer_index(buffer_index_),
+ cat(cat_), psi(psi_) {}
+ snort::ProfileStats* get_profile() const override { return &http_ps[psi]; }
+ static void mod_dtor(snort::Module* m) { delete m; }
+ bool begin(const char*, int, snort::SnortConfig*) override;
+ bool set(const char*, snort::Value&, snort::SnortConfig*) override;
+ bool end(const char*, int, snort::SnortConfig*) override;
Usage get_usage() const override
{ return DETECT; }
private:
friend class HttpIpsOption;
- static THREAD_LOCAL std::array<ProfileStats, PsIdx::PSI_MAX> http_ps;
+ static THREAD_LOCAL std::array<snort::ProfileStats, PsIdx::PSI_MAX> http_ps;
struct HttpRuleParaList
{
const char* const key;
const HttpEnums::HTTP_BUFFER buffer_index;
- const CursorActionType cat;
+ const snort::CursorActionType cat;
const PsIdx psi;
HttpRuleParaList para_list;
uint64_t form;
};
-class HttpIpsOption : public IpsOption
+class HttpIpsOption : public snort::IpsOption
{
public:
HttpIpsOption(const HttpCursorModule* cm) :
- IpsOption(cm->key, RULE_OPTION_TYPE_BUFFER_SET), key(cm->key),
+ snort::IpsOption(cm->key, RULE_OPTION_TYPE_BUFFER_SET), key(cm->key),
buffer_index(cm->buffer_index), cat(cm->cat), psi(cm->psi),
inspect_section(cm->inspect_section), sub_id(cm->sub_id), form(cm->form) {}
- CursorActionType get_cursor_type() const override { return cat; }
- EvalStatus eval(Cursor&, Packet*) override;
+ snort::CursorActionType get_cursor_type() const override { return cat; }
+ EvalStatus eval(Cursor&, snort::Packet*) override;
uint32_t hash() const override;
- bool operator==(const IpsOption& ips) const override;
- static IpsOption* opt_ctor(Module* m, OptTreeNode*)
+ bool operator==(const snort::IpsOption& ips) const override;
+ static IpsOption* opt_ctor(snort::Module* m, OptTreeNode*)
{ return new HttpIpsOption((HttpCursorModule*)m); }
- static void opt_dtor(IpsOption* p) { delete p; }
+ static void opt_dtor(snort::IpsOption* p) { delete p; }
private:
const char* const key;
const HttpEnums::HTTP_BUFFER buffer_index;
- const CursorActionType cat;
+ const snort::CursorActionType cat;
const PsIdx psi;
const HttpEnums::InspectSection inspect_section;
const uint64_t sub_id;
#include <CppUTest/TestHarness.h>
#include <CppUTestExt/MockSupport.h>
+using namespace snort;
using namespace HttpEnums;
// Stubs whose sole purpose is to make the test code link
#include <CppUTest/TestHarness.h>
#include <CppUTestExt/MockSupport.h>
+using namespace snort;
+
// Stubs whose sole purpose is to make the test code link
long HttpTestManager::print_amount {};
bool HttpTestManager::print_hex {};
#include <CppUTest/TestHarness.h>
#include <CppUTestExt/MockSupport.h>
+using namespace snort;
using namespace HttpEnums;
// Stubs whose sole purpose is to make the test code link
#include <CppUTest/TestHarness.h>
#include <CppUTestExt/MockSupport.h>
+using namespace snort;
using namespace HttpEnums;
// Stubs whose sole purpose is to make the test code link
#include <CppUTest/TestHarness.h>
#include <CppUTestExt/MockSupport.h>
+using namespace snort;
+
// Stubs whose sole purpose is to make the test code link
void ParseWarning(WarningGroup, const char*, ...) {}
void ParseError(const char*, ...) {}
#include "imap_module.h"
#include "imap_paf.h"
+using namespace snort;
+
THREAD_LOCAL ProfileStats imapPerfStats;
THREAD_LOCAL ImapStats imapstats;
int length;
};
-class ImapMime : public MimeSession
+class ImapMime : public snort::MimeSession
{
- using MimeSession::MimeSession;
+ using snort::MimeSession::MimeSession;
private:
void decode_alert() override;
- void reset_state(Flow* ssn) override;
- bool is_end_of_data(Flow* ssn) override;
+ void reset_state(snort::Flow* ssn) override;
+ bool is_end_of_data(snort::Flow* ssn) override;
};
struct IMAPData
ImapMime* mime_ssn;
};
-class ImapFlowData : public FlowData
+class ImapFlowData : public snort::FlowData
{
public:
ImapFlowData();
~ImapFlowData() override;
static void init()
- { inspector_id = FlowData::create_flow_data_id(); }
+ { inspector_id = snort::FlowData::create_flow_data_id(); }
public:
static unsigned inspector_id;
#include "log/messages.h"
+using namespace snort;
using namespace std;
#define IMAP_UNKNOWN_CMD_STR "unknown IMAP3 command"
#define IMAP_NAME "imap"
#define IMAP_HELP "imap inspection"
+namespace snort
+{
struct SnortConfig;
+}
-extern THREAD_LOCAL ProfileStats imapPerfStats;
+extern THREAD_LOCAL snort::ProfileStats imapPerfStats;
-class ImapModule : public Module
+class ImapModule : public snort::Module
{
public:
ImapModule();
~ImapModule() override;
- bool set(const char*, Value&, SnortConfig*) override;
- bool begin(const char*, int, SnortConfig*) override;
- bool end(const char*, int, SnortConfig*) override;
+ bool set(const char*, snort::Value&, snort::SnortConfig*) override;
+ bool begin(const char*, int, snort::SnortConfig*) override;
+ bool end(const char*, int, snort::SnortConfig*) override;
unsigned get_gid() const override
{ return GID_IMAP; }
- const RuleMap* get_rules() const override;
+ const snort::RuleMap* get_rules() const override;
const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
- ProfileStats* get_profile() const override;
+ snort::ProfileStats* get_profile() const override;
Usage get_usage() const override
{ return INSPECT; }
#include "imap.h"
+using namespace snort;
+
extern IMAPToken imap_resps[];
static inline ImapPafData* get_state(Flow* flow, bool c2s)
bool end_of_data;
};
-class ImapSplitter : public StreamSplitter
+class ImapSplitter : public snort::StreamSplitter
{
public:
ImapSplitter(bool c2s);
- Status scan(Flow*, const uint8_t* data, uint32_t len,
+ Status scan(snort::Flow*, const uint8_t* data, uint32_t len,
uint32_t flags, uint32_t* fp) override;
bool is_paf() override { return true; }
};
// Function: Check if IMAP data end is reached
-bool imap_is_data_end(Flow* ssn);
+bool imap_is_data_end(snort::Flow* ssn);
#endif
#include "modbus_decode.h"
+using namespace snort;
+
static const char* s_name = "modbus_data";
//-------------------------------------------------------------------------
#include "modbus.h"
+using namespace snort;
+
static const char* s_name = "modbus_func";
//-------------------------------------------------------------------------
#include "modbus.h"
+using namespace snort;
+
static const char* s_name = "modbus_unit";
//-------------------------------------------------------------------------
#include "modbus_module.h"
#include "modbus_paf.h"
+using namespace snort;
+
THREAD_LOCAL ModbusStats modbus_stats;
//-------------------------------------------------------------------------
uint8_t unit;
};
-class ModbusFlowData : public FlowData
+class ModbusFlowData : public snort::FlowData
{
public:
ModbusFlowData();
#include "modbus.h"
#include "modbus_module.h"
+using namespace snort;
+
// FIXIT-L convert this stuff to a table and make configurable
/* Modbus Function Codes */
#ifndef MODBUS_DECODE_H
#define MODBUS_DECODE_H
+namespace snort
+{
+struct Packet;
+}
+
/* Need 8 bytes for MBAP Header + Function Code */
#define MODBUS_MIN_LEN 8
-bool ModbusDecode(struct Packet*);
+bool ModbusDecode(snort::Packet*);
#endif
#include "modbus.h"
+using namespace snort;
+
THREAD_LOCAL ProfileStats modbus_prof;
//-------------------------------------------------------------------------
#define MODBUS_NAME "modbus"
#define MODBUS_HELP "modbus inspection"
-extern THREAD_LOCAL ProfileStats modbus_prof;
+extern THREAD_LOCAL snort::ProfileStats modbus_prof;
-class ModbusModule : public Module
+class ModbusModule : public snort::Module
{
public:
ModbusModule();
unsigned get_gid() const override
{ return GID_MODBUS; }
- const RuleMap* get_rules() const override;
+ const snort::RuleMap* get_rules() const override;
const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
- ProfileStats* get_profile() const override
+ snort::ProfileStats* get_profile() const override
{ return &modbus_prof; }
Usage get_usage() const override
#include "modbus.h"
#include "modbus_module.h"
+using namespace snort;
+
#define MODBUS_MIN_HDR_LEN 2 // Enough for Unit ID + Function
#define MODBUS_MAX_HDR_LEN 254 // Max PDU size is 260, 6 bytes already seen
MODBUS_PAF_STATE__SET_FLUSH
};
-class ModbusSplitter : public StreamSplitter
+class ModbusSplitter : public snort::StreamSplitter
{
public:
ModbusSplitter(bool);
- Status scan(
- Flow*, const uint8_t* data, uint32_t len,
- uint32_t flags, uint32_t* fp) override;
+ Status scan(snort::Flow*, const uint8_t* data, uint32_t len, uint32_t flags,
+ uint32_t* fp) override;
bool is_paf() override { return true; }
#include "pop_module.h"
#include "pop_paf.h"
+using namespace snort;
+
THREAD_LOCAL ProfileStats popPerfStats;
THREAD_LOCAL PopStats popstats;
int length;
};
-class PopMime : public MimeSession
+class PopMime : public snort::MimeSession
{
- using MimeSession::MimeSession;
+ using snort::MimeSession::MimeSession;
private:
void decode_alert() override;
- void reset_state(Flow* ssn) override;
- bool is_end_of_data(Flow* ssn) override;
+ void reset_state(snort::Flow* ssn) override;
+ bool is_end_of_data(snort::Flow* ssn) override;
};
struct POPData
PopMime* mime_ssn;
};
-class PopFlowData : public FlowData
+class PopFlowData : public snort::FlowData
{
public:
PopFlowData();
~PopFlowData() override;
static void init()
- { inspector_id = FlowData::create_flow_data_id(); }
+ { inspector_id = snort::FlowData::create_flow_data_id(); }
public:
static unsigned inspector_id;
#include "log/messages.h"
+using namespace snort;
using namespace std;
#define POP_UNKNOWN_CMD_STR "unknown POP3 command"
#define POP_NAME "pop"
#define POP_HELP "pop inspection"
+namespace snort
+{
struct SnortConfig;
+}
-extern THREAD_LOCAL ProfileStats popPerfStats;
+extern THREAD_LOCAL snort::ProfileStats popPerfStats;
-class PopModule : public Module
+class PopModule : public snort::Module
{
public:
PopModule();
~PopModule() override;
- bool set(const char*, Value&, SnortConfig*) override;
- bool begin(const char*, int, SnortConfig*) override;
- bool end(const char*, int, SnortConfig*) override;
+ bool set(const char*, snort::Value&, snort::SnortConfig*) override;
+ bool begin(const char*, int, snort::SnortConfig*) override;
+ bool end(const char*, int, snort::SnortConfig*) override;
unsigned get_gid() const override
{ return GID_POP; }
- const RuleMap* get_rules() const override;
+ const snort::RuleMap* get_rules() const override;
const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
- ProfileStats* get_profile() const override;
+ snort::ProfileStats* get_profile() const override;
Usage get_usage() const override
{ return INSPECT; }
#include "pop.h"
+using namespace snort;
+
extern POPToken pop_known_cmds[];
static inline PopPafData* get_state(Flow* flow, bool c2s)
bool end_of_data;
};
-class PopSplitter : public StreamSplitter
+class PopSplitter : public snort::StreamSplitter
{
public:
PopSplitter(bool c2s);
- Status scan(Flow*, const uint8_t* data, uint32_t len,
+ Status scan(snort::Flow*, const uint8_t* data, uint32_t len,
uint32_t flags, uint32_t* fp) override;
bool is_paf() override { return true; }
};
// Function: Callback to check if POP data end is reached
-bool pop_is_data_end(Flow* ssn);
+bool pop_is_data_end(snort::Flow* ssn);
#endif
#include "rpc_module.h"
+using namespace snort;
using namespace std;
#define RPC_MAX_BUF_SIZE 256
#include "rpc_module.h"
+using namespace snort;
+
#define RPC_FRAG_TRAFFIC_STR \
"fragmented RPC records"
#define RPC_MULTIPLE_RECORD_STR \
struct RpcStats;
extern THREAD_LOCAL RpcStats rdstats;
-extern THREAD_LOCAL ProfileStats rpcdecodePerfStats;
+extern THREAD_LOCAL snort::ProfileStats rpcdecodePerfStats;
-class RpcDecodeModule : public Module
+class RpcDecodeModule : public snort::Module
{
public:
RpcDecodeModule();
unsigned get_gid() const override
{ return GID_RPC_DECODE; }
- const RuleMap* get_rules() const override;
+ const snort::RuleMap* get_rules() const override;
const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
- ProfileStats* get_profile() const override;
+ snort::ProfileStats* get_profile() const override;
Usage get_usage() const override
{ return INSPECT; }
#include "managers/plugin_manager.h"
+using namespace snort;
+
extern const BaseApi* sin_imap;
extern const BaseApi* sin_pop;
extern const BaseApi* sin_smtp;
#include "sip.h"
+using namespace snort;
+
enum SipIdx
{
SIP_HEADER, SIP_BODY, SIP_MAX
#include "sip.h"
+using namespace snort;
+
//-------------------------------------------------------------------------
// sip_method
//-------------------------------------------------------------------------
#include "sip.h"
+using namespace snort;
+
//-------------------------------------------------------------------------
// sip_stat_code
//-------------------------------------------------------------------------
#include "sip_module.h"
#include "sip_utils.h"
+using namespace snort;
+
THREAD_LOCAL ProfileStats sipPerfStats;
static void snort_sip(SIP_PROTO_CONF* GlobalConf, Packet* p);
SIP_PROTO_CONF *sip_config;
};
-class SipFlowData : public FlowData
+class SipFlowData : public snort::FlowData
{
public:
SipFlowData();
~SipFlowData() override;
static void init()
- { inspector_id = FlowData::create_flow_data_id(); }
+ { inspector_id = snort::FlowData::create_flow_data_id(); }
public:
static unsigned inspector_id;
SIPData session;
};
-SIPData* get_sip_session_data(const Flow*);
+SIPData* get_sip_session_data(const snort::Flow*);
SIPMethodNode* add_sip_method(const char*);
#endif
struct SIP_MediaData
{
- SfIp maddress; // media IP
+ snort::SfIp maddress; // media IP
uint16_t mport; // media port
uint8_t numPort; // number of media ports
SIP_MediaData* nextM;
int savedFlag; // whether this data has been saved by a dialog,
// if savedFlag = 1, this session will be deleted after sip message is
// processed.
- SfIp maddress_default; // Default media IP
+ snort::SfIp maddress_default; // Default media IP
SIP_MediaDataList medias; // Media list in the session
SIP_MediaSession* nextS; // Next media session
};
#include "sip.h"
#include "sip_module.h"
+using namespace snort;
+
static void SIP_updateMedias(SIP_MediaSession*, SIP_MediaList*);
static int SIP_compareMedias(SIP_MediaDataList, SIP_MediaDataList);
static bool SIP_checkMediaChange(SIPMsg* sipMsg, SIP_DialogData* dialog);
#include "sip_parser.h"
+namespace snort
+{
struct Packet;
+}
#define TOTAL_RESPONSES 0
#define RESPONSE1XX 1
uint32_t num_dialogs;
};
-int SIP_updateDialog(SIPMsg* sipMsg, SIP_DialogList* dList, Packet* p, SIP_PROTO_CONF*);
+int SIP_updateDialog(SIPMsg* sipMsg, SIP_DialogList* dList, snort::Packet* p, SIP_PROTO_CONF*);
void sip_freeDialogs(SIP_DialogList* list);
#endif
#include <cassert>
+using namespace snort;
using namespace std;
#define SIP_EVENT_EMPTY_REQUEST_URI_STR "empty request URI"
#define SIP_NAME "sip"
#define SIP_HELP "sip inspection"
+namespace snort
+{
struct SnortConfig;
+}
-extern THREAD_LOCAL ProfileStats sipPerfStats;
+extern THREAD_LOCAL snort::ProfileStats sipPerfStats;
-class SipModule : public Module
+class SipModule : public snort::Module
{
public:
SipModule();
~SipModule() override;
- bool set(const char*, Value&, SnortConfig*) override;
- bool begin(const char*, int, SnortConfig*) override;
- bool end(const char*, int, SnortConfig*) override;
+ bool set(const char*, snort::Value&, snort::SnortConfig*) override;
+ bool begin(const char*, int, snort::SnortConfig*) override;
+ bool end(const char*, int, snort::SnortConfig*) override;
unsigned get_gid() const override
{ return GID_SIP; }
- const RuleMap* get_rules() const override;
+ const snort::RuleMap* get_rules() const override;
const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
- ProfileStats* get_profile() const override;
+ snort::ProfileStats* get_profile() const override;
Usage get_usage() const override
{ return INSPECT; }
#include "sip_module.h"
#include "sip_utils.h"
+using namespace snort;
+
#define MAX_NUM_32BIT 2147483647
#define SIP_PARSE_NOFOLDING (-2)
#include "smtp_util.h"
#include "smtp_xlink2state.h"
+using namespace snort;
+
THREAD_LOCAL ProfileStats smtpPerfStats;
THREAD_LOCAL SmtpStats smtpstats;
THREAD_LOCAL bool smtp_normalizing;
char name[MAX_AUTH_NAME_LEN];
};
-class SmtpMime : public MimeSession
+class SmtpMime : public snort::MimeSession
{
public:
- using MimeSession::MimeSession;
+ using snort::MimeSession::MimeSession;
SMTP_PROTO_CONF* config;
private:
int handle_header_line(const uint8_t* ptr, const uint8_t* eol,
int max_header_len) override;
int normalize_data(const uint8_t* ptr, const uint8_t* data_end) override;
void decode_alert() override;
- void reset_state(Flow* ssn) override;
- bool is_end_of_data(Flow* ssn) override;
+ void reset_state(snort::Flow* ssn) override;
+ bool is_end_of_data(snort::Flow* ssn) override;
};
struct SMTPData
SMTPAuthName* auth_name;
};
-class SmtpFlowData : public FlowData
+class SmtpFlowData : public snort::FlowData
{
public:
SmtpFlowData();
~SmtpFlowData() override;
static void init()
- { inspector_id = FlowData::create_flow_data_id(); }
+ { inspector_id = snort::FlowData::create_flow_data_id(); }
public:
static unsigned inspector_id;
SMTPToken* cmds;
SMTPCmdConfig* cmd_config;
SMTPSearch* cmd_search;
- SearchTool* cmd_search_mpse;
+ snort::SearchTool* cmd_search_mpse;
};
struct SmtpStats
#include "log/messages.h"
#include "utils/util.h"
+using namespace snort;
using namespace std;
SmtpCmd::SmtpCmd(std::string& key, uint32_t flg, int num)
#define PCMD_NORM 0x0020
#define PCMD_VALID 0x0040
+namespace snort
+{
struct SnortConfig;
+}
-extern THREAD_LOCAL ProfileStats smtpPerfStats;
+extern THREAD_LOCAL snort::ProfileStats smtpPerfStats;
struct SmtpCmd
{
std::string name;
SmtpCmd(std::string&, int);
};
-class SmtpModule : public Module
+class SmtpModule : public snort::Module
{
public:
SmtpModule();
~SmtpModule() override;
- bool set(const char*, Value&, SnortConfig*) override;
- bool begin(const char*, int, SnortConfig*) override;
- bool end(const char*, int, SnortConfig*) override;
+ bool set(const char*, snort::Value&, snort::SnortConfig*) override;
+ bool begin(const char*, int, snort::SnortConfig*) override;
+ bool end(const char*, int, snort::SnortConfig*) override;
unsigned get_gid() const override
{ return GID_SMTP; }
- const RuleMap* get_rules() const override;
+ const snort::RuleMap* get_rules() const override;
const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
- ProfileStats* get_profile() const override;
+ snort::ProfileStats* get_profile() const override;
SMTP_PROTO_CONF* get_data();
const SmtpCmd* get_cmd(unsigned idx);
{ return INSPECT; }
private:
- void add_commands(Value&, uint32_t flags);
+ void add_commands(snort::Value&, uint32_t flags);
private:
SMTP_PROTO_CONF* config;
* @retval 0 function succeeded without error
* @retval -1 there were errors
*/
-int SMTP_NormalizeCmd(Packet* p, const uint8_t* ptr, const uint8_t* eolm, const uint8_t* eol)
+int SMTP_NormalizeCmd(snort::Packet* p, const uint8_t* ptr, const uint8_t* eolm, const uint8_t* eol)
{
const uint8_t* tmp;
const uint8_t* cmd_start;
#include <cstdint>
+namespace snort
+{
struct Packet;
+}
-int SMTP_NormalizeCmd(Packet*, const uint8_t*, const uint8_t*, const uint8_t*);
+int SMTP_NormalizeCmd(snort::Packet*, const uint8_t*, const uint8_t*, const uint8_t*);
#endif
#include "smtp_module.h"
+using namespace snort;
+
/* State tracker for MIME PAF */
enum SmtpDataCMD
{
bool end_of_data;
};
-class SmtpSplitter : public StreamSplitter
+class SmtpSplitter : public snort::StreamSplitter
{
public:
SmtpSplitter(bool c2s, int max_auth_cmd_line_len);
- Status scan(Flow*, const uint8_t* data, uint32_t len,
+ Status scan(snort::Flow*, const uint8_t* data, uint32_t len,
uint32_t flags, uint32_t* fp) override;
bool is_paf() override { return true; }
};
// Function: Check if IMAP data end is reached
-bool smtp_is_data_end(Flow* ssn);
+bool smtp_is_data_end(snort::Flow* ssn);
#endif
#include "smtp.h"
+using namespace snort;
+
void SMTP_GetEOL(const uint8_t* ptr, const uint8_t* end,
const uint8_t** eol, const uint8_t** eolm)
{
#include "smtp_config.h"
+namespace snort
+{
struct Packet;
+}
void SMTP_GetEOL(const uint8_t*, const uint8_t*, const uint8_t**, const uint8_t**);
-void SMTP_LogFuncs(SMTP_PROTO_CONF*, Packet*, MimeSession*);
+void SMTP_LogFuncs(SMTP_PROTO_CONF*, snort::Packet*, snort::MimeSession*);
-int SMTP_CopyToAltBuffer(Packet*, const uint8_t*, int);
-const uint8_t* SMTP_GetAltBuffer(Packet*, unsigned& len);
-void SMTP_ResetAltBuffer(Packet*);
+int SMTP_CopyToAltBuffer(snort::Packet*, const uint8_t*, int);
+const uint8_t* SMTP_GetAltBuffer(snort::Packet*, unsigned& len);
+void SMTP_ResetAltBuffer(snort::Packet*);
#endif
* @retval 1 if alert raised
* @retval 0 if no alert raised
*/
-int ParseXLink2State(SMTP_PROTO_CONF* config, Packet* p, SMTPData* smtp_ssn, const uint8_t* ptr)
+int ParseXLink2State(SMTP_PROTO_CONF* config, snort::Packet* p, SMTPData* smtp_ssn, const uint8_t* ptr)
{
const uint8_t* lf = nullptr;
uint32_t len = 0;
/* Need to drop the packet if we're told to
* (outside of whether its thresholded). */
if (config->xlink2state == DROP_XLINK2STATE)
- Active::reset_session(p);
+ snort::Active::reset_session(p);
- DetectionEngine::queue_event(GID_SMTP, SMTP_XLINK2STATE_OVERFLOW);
+ snort::DetectionEngine::queue_event(GID_SMTP, SMTP_XLINK2STATE_OVERFLOW);
smtp_ssn->session_flags |= SMTP_FLAG_XLINK2STATE_ALERTED;
return 1;
#include "smtp.h"
-int ParseXLink2State(SMTP_PROTO_CONF*, Packet*, SMTPData*, const uint8_t*);
+int ParseXLink2State(SMTP_PROTO_CONF*, snort::Packet*, SMTPData*, const uint8_t*);
#endif
#include "ssh_module.h"
+using namespace snort;
+
THREAD_LOCAL ProfileStats sshPerfStats;
THREAD_LOCAL SshStats sshstats;
uint32_t state_flags; // Bit vector describing the current state of the session
};
-class SshFlowData : public FlowData
+class SshFlowData : public snort::FlowData
{
public:
SshFlowData();
~SshFlowData() override;
static void init()
- { inspector_id = FlowData::create_flow_data_id(); }
+ { inspector_id = snort::FlowData::create_flow_data_id(); }
public:
static unsigned inspector_id;
#include <cassert>
+using namespace snort;
using namespace std;
#define SSH_EVENT_RESPOVERFLOW_STR \
#define SSH_NAME "ssh"
#define SSH_HELP "ssh inspection"
-struct SnortConfig;
+namespace snort
+{struct SnortConfig;
+
+}
extern THREAD_LOCAL SshStats sshstats;
-extern THREAD_LOCAL ProfileStats sshPerfStats;
+extern THREAD_LOCAL snort::ProfileStats sshPerfStats;
-class SshModule : public Module
+class SshModule : public snort::Module
{
public:
SshModule();
~SshModule() override;
- bool set(const char*, Value&, SnortConfig*) override;
- bool begin(const char*, int, SnortConfig*) override;
+ bool set(const char*, snort::Value&, snort::SnortConfig*) override;
+ bool begin(const char*, int, snort::SnortConfig*) override;
unsigned get_gid() const override
{ return GID_SSH; }
- const RuleMap* get_rules() const override;
+ const snort::RuleMap* get_rules() const override;
const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
- ProfileStats* get_profile() const override;
+ snort::ProfileStats* get_profile() const override;
Usage get_usage() const override
{ return INSPECT; }
#include "ssl_inspector.h"
+using namespace snort;
+
//-------------------------------------------------------------------------
// ssl_state
//-------------------------------------------------------------------------
#include "ssl_inspector.h"
+using namespace snort;
+
//-------------------------------------------------------------------------
// ssl_version
//-------------------------------------------------------------------------
#include "ssl_module.h"
#include "ssl_splitter.h"
+using namespace snort;
+
THREAD_LOCAL ProfileStats sslPerfStats;
THREAD_LOCAL SslStats sslstats;
uint16_t partial_rec_len[4];
};
-class SslFlowData : public FlowData
+class SslFlowData : public snort::FlowData
{
public:
SslFlowData();
~SslFlowData() override;
static void init()
- { inspector_id = FlowData::create_flow_data_id(); }
+ { inspector_id = snort::FlowData::create_flow_data_id(); }
public:
static unsigned inspector_id;
SSLData session;
};
//Function: API to get the ssl flow data from the packet flow.
-SSLData* get_ssl_session_data(Flow* flow);
+SSLData* get_ssl_session_data(snort::Flow* flow);
#endif
#include <cassert>
+using namespace snort;
using namespace std;
#define SSL_INVALID_CLIENT_HELLO_STR "invalid client HELLO after server HELLO detected"
#define SSL_NAME "ssl"
#define SSL_HELP "ssl inspection"
+namespace snort
+{
struct SnortConfig;
+}
-extern THREAD_LOCAL ProfileStats sslPerfStats;
+extern THREAD_LOCAL snort::ProfileStats sslPerfStats;
-class SslModule : public Module
+class SslModule : public snort::Module
{
public:
SslModule();
~SslModule() override;
- bool set(const char*, Value&, SnortConfig*) override;
- bool begin(const char*, int, SnortConfig*) override;
+ bool set(const char*, snort::Value&, snort::SnortConfig*) override;
+ bool begin(const char*, int, snort::SnortConfig*) override;
unsigned get_gid() const override
{ return GID_SSL; }
- const RuleMap* get_rules() const override;
+ const snort::RuleMap* get_rules() const override;
const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
- ProfileStats* get_profile() const override;
+ snort::ProfileStats* get_profile() const override;
Usage get_usage() const override
{ return INSPECT; }
#include "protocols/ssl.h"
+using namespace snort;
+
SslSplitter::SslSplitter(bool c2s) : StreamSplitter(c2s)
{
paf_state = SSL_PAF_STATES_START;
SSL_PAF_STATES_PAD_V2, // sslv2, padding byte if needed
};
-class SslSplitter : public StreamSplitter
+class SslSplitter : public snort::StreamSplitter
{
public:
SslSplitter(bool c2s);
- Status scan(Flow*, const uint8_t* data, uint32_t len,
+ Status scan(snort::Flow*, const uint8_t* data, uint32_t len,
uint32_t flags, uint32_t* fp) override;
bool is_paf() override
#include "curses.h"
#include "magic.h"
+using namespace snort;
using namespace std;
//-------------------------------------------------------------------------
extern const PegInfo wiz_pegs[];
extern THREAD_LOCAL struct WizStats tstats;
-extern THREAD_LOCAL ProfileStats wizPerfStats;
+extern THREAD_LOCAL snort::ProfileStats wizPerfStats;
class MagicBook;
class CurseBook;
-class WizardModule : public Module
+class WizardModule : public snort::Module
{
public:
WizardModule();
~WizardModule() override;
- bool set(const char*, Value&, SnortConfig*) override;
- bool begin(const char*, int, SnortConfig*) override;
- bool end(const char*, int, SnortConfig*) override;
+ bool set(const char*, snort::Value&, snort::SnortConfig*) override;
+ bool begin(const char*, int, snort::SnortConfig*) override;
+ bool end(const char*, int, snort::SnortConfig*) override;
const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
- ProfileStats* get_profile() const override;
+ snort::ProfileStats* get_profile() const override;
MagicBook* get_book(bool c2s, bool hex);
CurseBook* get_curse_book();
#include "magic.h"
#include "wiz_module.h"
+using namespace snort;
using namespace std;
THREAD_LOCAL ProfileStats wizPerfStats;
#include "sf_cidr.h"
+using namespace snort;
+
SfIpRet SfCidr::set(const char* src)
{
return addr.set(src, &bits);
#include "sfip/sf_ip.h"
+namespace snort
+{
/*
* NOTE: As much as I'd love to make this a subclass of SfIp, member layout
* is undefined for POD inheritance.
}
return ret;
}
-
+}
#endif
#include "sf_cidr.h"
+using namespace snort;
+
/* Support function */
// note that an ip6 address may have a trailing dotted quad form
// but that it always has at least 2 ':'s; furthermore there is
return buf;
}
+bool SfIp::is_mapped() const
+{
+ if (ip32[0] || ip32[1] || ip16[4] || (ip16[5] != 0xffff && ip16[5]))
+ return false;
+
+ return true;
+}
+
+namespace snort
+{
const char* snort_inet_ntop(int family, const void* ip_raw, char* buf, int bufsize)
{
if (!ip_raw || !buf ||
return buf;
}
-
-bool SfIp::is_mapped() const
-{
- if (ip32[0] || ip32[1] || ip16[4] || (ip16[5] != 0xffff && ip16[5]))
- return false;
-
- return true;
}
-
#include "main/snort_types.h"
#include "sfip/sf_returns.h"
+namespace snort
+{
struct SfCidr;
struct SO_PUBLIC SfIp
// FIXIT-L X This should be in utils_net if anywhere, but that makes it way harder to link into unit tests
SO_PUBLIC const char* snort_inet_ntop(int family, const void* ip_raw, char* buf, int bufsize);
-
+}
#endif
#include "utils/util_cstring.h"
#endif
+using namespace snort;
+
#define LIST_OPEN '['
#define LIST_CLOSE ']'
#include "sfip/sf_returns.h"
+namespace snort
+{
struct SfIp;
struct SfCidr;
+}
/* Selects which mode a given variable is using to
* store and lookup IP addresses */
/* Used by the "list" mode. A doubly linked list of SfIp objects. */
typedef struct _ip_node
{
- SfCidr* ip;
+ snort::SfCidr* ip;
#define ip_addr ip; /* To ease porting Snort */
struct _ip_node* next;
int flags;
void sfvar_free(sfip_var_t* var);
// returns true if both args are valid and ip is contained by var
-bool sfvar_ip_in(sfip_var_t* var, const SfIp* ip);
+bool sfvar_ip_in(sfip_var_t* var, const snort::SfIp* ip);
#endif
{
vartable_t* table;
sfip_var_t* var;
- SfIp* ip;
+ snort::SfIp* ip;
SfIpRet status;
table = sfvt_alloc_table();
/* Containment tests */
var = sfvt_lookup_var(table, "goo");
- ip = (SfIp *)snort_alloc(sizeof(SfIp));
+ ip = (snort::SfIp *)snort_alloc(sizeof(snort::SfIp));
status = ip->set("192.168.248.255");
CHECK(SFIP_SUCCESS == status);
CHECK((sfvar_ip_in(var, ip) == false));
/* Check boundary cases */
var = sfvt_lookup_var(table, "goo");
snort_free(ip);
- ip = (SfIp *)snort_alloc(sizeof(SfIp));
+ ip = (snort::SfIp *)snort_alloc(sizeof(snort::SfIp));
status = ip->set("192.168.0.3");
CHECK(SFIP_SUCCESS == status);
CHECK((sfvar_ip_in(var, ip) == false));
snort_free(ip);
- ip = (SfIp *)snort_alloc(sizeof(SfIp));
+ ip = (snort::SfIp *)snort_alloc(sizeof(snort::SfIp));
status = ip->set("192.168.0.2");
CHECK(SFIP_SUCCESS == status);
CHECK((sfvar_ip_in(var, ip) == true));
#include "sf_cidr.h"
+using namespace snort;
+
//---------------------------------------------------------------
static int s_debug = 0;
#include "sfip/sf_cidr.h"
#include "utils/util.h"
+using namespace snort;
+
const char* rt_error_messages[] =
{
"Success",
table_t* sfrt_new(char type, char ip_type, long data_size, uint32_t mem_cap);
void sfrt_free(table_t*);
-GENERIC sfrt_lookup(const SfIp*, table_t*);
-GENERIC sfrt_search(const SfIp*, unsigned char len, table_t*);
+GENERIC sfrt_lookup(const snort::SfIp*, table_t*);
+GENERIC sfrt_search(const snort::SfIp*, unsigned char len, table_t*);
typedef void (* sfrt_iterator_callback)(void*);
void sfrt_cleanup(table_t*, sfrt_iterator_callback);
-int sfrt_insert(SfCidr*, unsigned char len, GENERIC, int behavior, table_t*);
-int sfrt_remove(SfCidr*, unsigned char len, GENERIC*, int behavior, table_t*);
+int sfrt_insert(snort::SfCidr*, unsigned char len, GENERIC, int behavior, table_t*);
+int sfrt_remove(snort::SfCidr*, unsigned char len, GENERIC*, int behavior, table_t*);
uint32_t sfrt_usage(table_t*);
void sfrt_print(table_t*);
#include "sfip/sf_cidr.h"
+using namespace snort;
#define MINIMUM_TABLE_MEMORY (768 * 1024)
long data_size, uint32_t mem_cap);
void sfrt_flat_free(TABLE_PTR table);
-GENERIC sfrt_flat_lookup(const SfIp* ip, table_flat_t* table);
-GENERIC sfrt_flat_dir8x_lookup(const SfIp* ip, table_flat_t* table);
+GENERIC sfrt_flat_lookup(const snort::SfIp* ip, table_flat_t* table);
+GENERIC sfrt_flat_dir8x_lookup(const snort::SfIp* ip, table_flat_t* table);
-int sfrt_flat_insert(SfCidr* cidr, unsigned char len, INFO ptr, int behavior,
+int sfrt_flat_insert(snort::SfCidr* cidr, unsigned char len, INFO ptr, int behavior,
table_flat_t* table, updateEntryInfoFunc updateEntry);
uint32_t sfrt_flat_usage(table_flat_t* table);
uint32_t sfrt_flat_num_entries(table_flat_t* table);
#include "sfrt.h"
+using namespace snort;
+
#define NUM_IPS 32
#define NUM_DATA 4
#include "managers/connector_manager.h"
#include "profiler/profiler_defs.h"
+using namespace snort;
+
/* Globals ****************************************************************/
THREAD_LOCAL SimpleStats sc_stats;
struct SCMessage
{
SideChannel* sc;
- Connector* connector;
- ConnectorMsgHandle* handle;
+ snort::Connector* connector;
+ snort::ConnectorMsgHandle* handle;
SCMsgHdr* hdr;
uint8_t* content;
uint32_t content_length;
bool transmit_message(SCMessage* msg);
void set_message_port(SCMessage* msg, SCPort port);
void set_default_port(SCPort port);
- Connector::Direction get_direction();
+ snort::Connector::Direction get_direction();
- Connector* connector_receive;
- Connector* connector_transmit;
+ snort::Connector* connector_receive;
+ snort::Connector* connector_transmit;
private:
SCSequence sequence;
#include "side_channel.h"
+using namespace snort;
//-------------------------------------------------------------------------
// side_channel module
};
extern THREAD_LOCAL SimpleStats sc_stats;
-extern THREAD_LOCAL ProfileStats sc_perf_stats;
+extern THREAD_LOCAL snort::ProfileStats sc_perf_stats;
-class SideChannelModule : public Module
+class SideChannelModule : public snort::Module
{
public:
SideChannelModule();
~SideChannelModule() override;
- bool set(const char*, Value&, SnortConfig*) override;
- bool begin(const char*, int, SnortConfig*) override;
- bool end(const char*, int, SnortConfig*) override;
+ bool set(const char*, snort::Value&, snort::SnortConfig*) override;
+ bool begin(const char*, int, snort::SnortConfig*) override;
+ bool end(const char*, int, snort::SnortConfig*) override;
PegCount* get_counts() const override
{ return (PegCount*)&sc_stats; }
const PegInfo* get_pegs() const override
{ return simple_pegs; }
- ProfileStats* get_profile() const override;
+ snort::ProfileStats* get_profile() const override;
Usage get_usage() const override
{ return GLOBAL; }
#include <CppUTest/CommandLineTestRunner.h>
#include <CppUTest/TestHarness.h>
+using namespace snort;
+
THREAD_LOCAL SimpleStats sc_stats;
THREAD_LOCAL ProfileStats sc_perf_stats;
#include <CppUTest/CommandLineTestRunner.h>
#include <CppUTest/TestHarness.h>
+using namespace snort;
+
class TestConnectorMsgHandle : public ConnectorMsgHandle
{
public:
#include "stream_ha.h"
#include "stream_module.h"
+using namespace snort;
+
//-------------------------------------------------------------------------
// stats
//-------------------------------------------------------------------------
#include "managers/inspector_manager.h"
#include "stream/stream.h"
+using namespace snort;
+
// HA Session flags helper macros
#define HA_IGNORED_SESSION_FLAGS \
(SSNFLAG_COUNTED_INITIALIZE | SSNFLAG_COUNTED_ESTABLISH | SSNFLAG_COUNTED_CLOSING)
class __attribute__((__packed__)) SessionHAContent
{
public:
- LwState ssn_state;
- Flow::FlowState flow_state;
+ snort::LwState ssn_state;
+ snort::Flow::FlowState flow_state;
uint8_t flags;
static const uint8_t FLAG_LOW = 0x01; // client address / port is low in key
static const uint8_t FLAG_IP6 = 0x02; // key addresses are ip6
{
public:
StreamHAClient() : FlowHAClient(sizeof(SessionHAContent), true) { }
- bool consume(Flow*&, FlowKey*, HAMessage*) override;
- bool produce(Flow*, HAMessage*) override;
- bool is_update_required(Flow*) override;
- bool is_delete_required(Flow*) override;
+ bool consume(snort::Flow*&, FlowKey*, HAMessage*) override;
+ bool produce(snort::Flow*, HAMessage*) override;
+ bool is_update_required(snort::Flow*) override;
+ bool is_delete_required(snort::Flow*) override;
private:
};
public:
ProtocolHA(PktType);
virtual ~ProtocolHA();
- virtual void delete_session(Flow*) { }
- virtual Flow* create_session(FlowKey*) { return nullptr; }
- virtual void deactivate_session(Flow*) { }
- virtual void process_deletion(Flow*);
+ virtual void delete_session(snort::Flow*) { }
+ virtual snort::Flow* create_session(FlowKey*) { return nullptr; }
+ virtual void deactivate_session(snort::Flow*) { }
+ virtual void process_deletion(snort::Flow*);
private:
};
#include "stream_module.h"
+using namespace snort;
using namespace std;
//-------------------------------------------------------------------------
#include "flow/flow_config.h"
#include "framework/module.h"
-extern THREAD_LOCAL ProfileStats s5PerfStats;
+extern THREAD_LOCAL snort::ProfileStats s5PerfStats;
+
+namespace snort
+{
struct SnortConfig;
+}
//-------------------------------------------------------------------------
// stream module
bool ip_frags_only;
};
-class StreamModule : public Module
+class StreamModule : public snort::Module
{
public:
StreamModule();
- bool begin(const char*, int, SnortConfig*) override;
- bool set(const char*, Value&, SnortConfig*) override;
+ bool begin(const char*, int, snort::SnortConfig*) override;
+ bool set(const char*, snort::Value&, snort::SnortConfig*) override;
const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
- ProfileStats* get_profile() const override;
+ snort::ProfileStats* get_profile() const override;
const StreamModuleConfig* get_data();
void sum_stats(bool) override;
#include "file_module.h"
+using namespace snort;
using namespace std;
//-------------------------------------------------------------------------
#include "framework/module.h"
+namespace snort
+{
struct SnortConfig;
+}
extern const PegInfo file_pegs[];
extern THREAD_LOCAL struct FileStats file_stats;
-extern THREAD_LOCAL ProfileStats file_perf_stats;
+extern THREAD_LOCAL snort::ProfileStats file_perf_stats;
//-------------------------------------------------------------------------
// stream_file module
#define MOD_NAME "stream_file"
#define MOD_HELP "stream inspector for file flow tracking and processing"
-class StreamFileModule : public Module
+class StreamFileModule : public snort::Module
{
public:
StreamFileModule();
- bool begin(const char*, int, SnortConfig*) override;
- bool set(const char*, Value&, SnortConfig*) override;
+ bool begin(const char*, int, snort::SnortConfig*) override;
+ bool set(const char*, snort::Value&, snort::SnortConfig*) override;
Usage get_usage() const override
{ return INSPECT; }
#include "stream_file.h"
+using namespace snort;
+
#define DECODE_PDU (DECODE_SOF | DECODE_EOF)
static THREAD_LOCAL ProfileStats file_ssn_stats;
class FileSession : public Session
{
public:
- FileSession(Flow*);
+ FileSession(snort::Flow*);
- bool setup(Packet*) override;
+ bool setup(snort::Packet*) override;
void clear() override;
- int process(Packet*) override;
+ int process(snort::Packet*) override;
bool is_sequenced(uint8_t /*dir*/) override
{ return true; }
{ return SSN_MISSING_NONE; }
private:
- void start(Packet*, Flow*);
- void update(Packet*, Flow*);
- void end(Packet*, Flow*);
+ void start(snort::Packet*, snort::Flow*);
+ void update(snort::Packet*, snort::Flow*);
+ void end(snort::Packet*, snort::Flow*);
};
#endif
#include "file_module.h"
#include "file_session.h"
+using namespace snort;
+
//-------------------------------------------------------------------------
// inspector stuff
//-------------------------------------------------------------------------
#ifndef STREAM_FILE_H
#define STREAM_FILE_H
+namespace snort
+{
+class Inspector;
+}
+
struct StreamFileConfig
{
bool upload;
};
-StreamFileConfig* get_file_cfg(class Inspector*);
+StreamFileConfig* get_file_cfg(snort::Inspector*);
#endif
if ( sz )
s_flush_bucket = new ConstFlushBucket(sz);
- else if ( SnortConfig::static_hash() )
+ else if ( snort::SnortConfig::static_hash() )
s_flush_bucket = new StaticFlushBucket;
else
#include "stream/icmp/icmp_session.h"
#include "stream/stream.h"
+using namespace snort;
+
Flow* IcmpHA::create_session(FlowKey* key)
{
assert(key);
//-------------------------------------------------------------------------
+namespace snort
+{
class Flow;
+}
class IcmpHA : public ProtocolHA
{
public:
IcmpHA() : ProtocolHA(PktType::ICMP) { }
- Flow* create_session(FlowKey*) override;
+ snort::Flow* create_session(FlowKey*) override;
private:
};
class IcmpHAManager
{
public:
- static void process_deletion(Flow* flow);
+ static void process_deletion(snort::Flow* flow);
static void tinit();
static void tterm();
static THREAD_LOCAL IcmpHA* icmp_ha;
#include "stream_icmp.h"
+using namespace snort;
using namespace std;
//-------------------------------------------------------------------------
extern const PegInfo icmp_pegs[];
extern THREAD_LOCAL struct IcmpStats icmpStats;
-extern THREAD_LOCAL ProfileStats icmp_perf_stats;
+extern THREAD_LOCAL snort::ProfileStats icmp_perf_stats;
+namespace snort
+{
struct SnortConfig;
+}
struct IcmpStats
{
struct StreamIcmpConfig;
-class StreamIcmpModule : public Module
+class StreamIcmpModule : public snort::Module
{
public:
StreamIcmpModule();
- bool set(const char*, Value&, SnortConfig*) override;
- bool begin(const char*, int, SnortConfig*) override;
- bool end(const char*, int, SnortConfig*) override;
+ bool set(const char*, snort::Value&, snort::SnortConfig*) override;
+ bool begin(const char*, int, snort::SnortConfig*) override;
+ bool end(const char*, int, snort::SnortConfig*) override;
- ProfileStats* get_profile() const override;
+ snort::ProfileStats* get_profile() const override;
const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
#include "icmp_module.h"
#include "stream_icmp.h"
+using namespace snort;
+
const PegInfo icmp_pegs[] =
{
SESSION_PEGS("icmp"),
class IcmpSession : public Session
{
public:
- IcmpSession(Flow*);
+ IcmpSession(snort::Flow*);
- bool setup(Packet*) override;
- void update_direction(char dir, const SfIp*, uint16_t port) override;
- int process(Packet*) override;
+ bool setup(snort::Packet*) override;
+ void update_direction(char dir, const snort::SfIp*, uint16_t port) override;
+ int process(snort::Packet*) override;
void clear() override;
public:
#include "icmp_module.h"
#include "icmp_session.h"
+using namespace snort;
+
//-------------------------------------------------------------------------
// helpers
//-------------------------------------------------------------------------
#include "ip_session.h"
#include "stream_ip.h"
+using namespace snort;
+
/* D E F I N E S **************************************************/
/* flags for the FragTracker->frag_flags field */
DetectionEngine de;
de.set_encode_packet(p);
- Snort::process_packet(dpkt, dpkt->pkth, dpkt->pkt, true);
+ snort::Snort::process_packet(dpkt, dpkt->pkth, dpkt->pkt, true);
de.set_encode_packet(nullptr);
trace_log(stream_ip, "Done with rebuilt packet, marking rebuilt...\n");
struct FragEngine;
struct FragTracker;
struct Fragment;
+namespace snort
+{
struct Packet;
struct SnortConfig;
+}
class Defrag
{
public:
Defrag(FragEngine&);
- bool configure(SnortConfig*);
- void show(SnortConfig*);
+ bool configure(snort::SnortConfig*);
+ void show(snort::SnortConfig*);
- void process(Packet*, FragTracker*);
+ void process(snort::Packet*, FragTracker*);
void cleanup(FragTracker*);
static void init();
private:
- int insert(Packet*, FragTracker*, FragEngine*);
- int new_tracker(Packet* p, FragTracker*);
+ int insert(snort::Packet*, FragTracker*, FragEngine*);
+ int new_tracker(snort::Packet* p, FragTracker*);
int add_frag_node( // FIXIT-L too many args
FragTracker* ft, FragEngine*,
Fragment* left, Fragment** retFrag);
int dup_frag_node(FragTracker*, Fragment* left, Fragment** retFrag);
- int expired(Packet*, FragTracker*, FragEngine*);
+ int expired(snort::Packet*, FragTracker*, FragEngine*);
private:
FragEngine& engine;
#include "ip_session.h"
+using namespace snort;
+
Flow* IpHA::create_session(FlowKey* key)
{
assert(key);
//-------------------------------------------------------------------------
+namespace snort
+{
class Flow;
+}
class IpHA : public ProtocolHA
{
public:
IpHA() : ProtocolHA(PktType::IP) { }
- Flow* create_session(FlowKey*) override;
+ snort::Flow* create_session(FlowKey*) override;
private:
};
class IpHAManager
{
public:
- static void process_deletion(Flow* flow);
+ static void process_deletion(snort::Flow* flow);
static void tinit();
static void tterm();
static THREAD_LOCAL IpHA* ip_ha;
#include "ip_session.h"
#include "stream_ip.h"
+using namespace snort;
using namespace std;
#define DEFRAG_IPOPTIONS_STR \
#include "framework/module.h"
#include "main/snort_debug.h"
+namespace snort
+{
struct SnortConfig;
+}
#define GLOBAL_KEYWORD "defrag"
#define ENGINE_KEYWORD "defrag_engine"
};
extern const PegInfo ip_pegs[];
-extern THREAD_LOCAL ProfileStats ip_perf_stats;
-extern THREAD_LOCAL ProfileStats fragPerfStats;
-extern THREAD_LOCAL ProfileStats fragInsertPerfStats;
-extern THREAD_LOCAL ProfileStats fragRebuildPerfStats;
+extern THREAD_LOCAL snort::ProfileStats ip_perf_stats;
+extern THREAD_LOCAL snort::ProfileStats fragPerfStats;
+extern THREAD_LOCAL snort::ProfileStats fragInsertPerfStats;
+extern THREAD_LOCAL snort::ProfileStats fragRebuildPerfStats;
extern Trace TRACE_NAME(stream_ip);
//-------------------------------------------------------------------------
struct StreamIpConfig;
-class StreamIpModule : public Module
+class StreamIpModule : public snort::Module
{
public:
StreamIpModule();
~StreamIpModule() override;
- bool set(const char*, Value&, SnortConfig*) override;
- bool begin(const char*, int, SnortConfig*) override;
- bool end(const char*, int, SnortConfig*) override;
+ bool set(const char*, snort::Value&, snort::SnortConfig*) override;
+ bool begin(const char*, int, snort::SnortConfig*) override;
+ bool end(const char*, int, snort::SnortConfig*) override;
- const RuleMap* get_rules() const override;
- ProfileStats* get_profile(unsigned, const char*&, const char*&) const override;
+ const snort::RuleMap* get_rules() const override;
+ snort::ProfileStats* get_profile(unsigned, const char*&, const char*&) const override;
const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
StreamIpConfig* get_data();
#include "ip_ha.h"
#include "stream_ip.h"
+using namespace snort;
+
const PegInfo ip_pegs[] =
{
SESSION_PEGS("ip"),
class IpSession : public Session
{
public:
- IpSession(Flow*);
+ IpSession(snort::Flow*);
- bool setup(Packet*) override;
- int process(Packet*) override;
+ bool setup(snort::Packet*) override;
+ int process(snort::Packet*) override;
void clear() override;
- bool add_alert(Packet*, uint32_t gid, uint32_t sid) override;
- bool check_alerted(Packet*, uint32_t gid, uint32_t sid) override;
+ bool add_alert(snort::Packet*, uint32_t gid, uint32_t sid) override;
+ bool check_alerted(snort::Packet*, uint32_t gid, uint32_t sid) override;
public:
FragTracker tracker;
#include "ip_module.h"
#include "ip_session.h"
+using namespace snort;
+
/* max frags in a single frag tracker */
#define DEFAULT_MAX_FRAGS 8192
StreamIpConfig();
};
-StreamIpConfig* get_ip_cfg(Inspector*);
-class Defrag* get_defrag(Inspector*);
+StreamIpConfig* get_ip_cfg(snort::Inspector*);
+class Defrag* get_defrag(snort::Inspector*);
#endif
#include "protocols/tcp.h"
#include "stream/tcp/tcp_session.h"
+using namespace snort;
+
// SYN PACKET
// IP 192.168.0.89.9012 > p3nlh044.shr.prod.phx3.secureserver.net.http: Flags [S], seq 9050, win
// 8192, length 0
#ifndef STREAM_LIBTCP_UNIT_TEST_H
#define STREAM_LIBTCP_UNIT_TEST_H
+namespace snort
+{
class Flow;
struct Packet;
+}
-Packet* get_syn_packet(Flow*);
-Packet* get_syn_ack_packet(Flow*);
-Packet* get_ack_packet(Flow*);
-Packet* get_fin_packet(Flow*);
-Packet* get_rst_packet(Flow*);
-Packet* get_data_packet(Flow*);
+snort::Packet* get_syn_packet(snort::Flow*);
+snort::Packet* get_syn_ack_packet(snort::Flow*);
+snort::Packet* get_ack_packet(snort::Flow*);
+snort::Packet* get_fin_packet(snort::Flow*);
+snort::Packet* get_rst_packet(snort::Flow*);
+snort::Packet* get_data_packet(snort::Flow*);
-void release_packet(Packet*);
+void release_packet(snort::Packet*);
#endif
#include "protocols/tcp_options.h"
#include "stream/tcp/tcp_defs.h"
-using namespace tcp;
+using namespace snort;
TcpSegmentDescriptor::TcpSegmentDescriptor(Flow* flow, Packet* pkt, TcpEventLogger& tel) :
flow(flow), pkt(pkt)
{
DebugMessage(DEBUG_STREAM_STATE, "Getting MSS...\n");
- TcpOptIterator iter(tcph, pkt);
- for ( const TcpOption& opt : iter )
+ tcp::TcpOptIterator iter(tcph, pkt);
+ for ( const tcp::TcpOption& opt : iter )
{
- if ( opt.code == TcpOptCode::MAXSEG )
+ if ( opt.code == tcp::TcpOptCode::MAXSEG )
{
*value = extract_16bits(opt.data);
DebugFormat(DEBUG_STREAM_STATE, "Found MSS %hu\n", *value);
{
DebugMessage(DEBUG_STREAM_STATE, "Getting wscale...\n");
- TcpOptIterator iter(tcph, pkt);
+ tcp::TcpOptIterator iter(tcph, pkt);
- for (const TcpOption& opt : iter)
+ for (const tcp::TcpOption& opt : iter)
{
- if (opt.code == TcpOptCode::WSCALE)
+ if (opt.code == tcp::TcpOptCode::WSCALE)
{
*value = (uint16_t)opt.data[0];
DebugFormat(DEBUG_STREAM_STATE, "Found wscale %d\n", *value);
class TcpSegmentDescriptor
{
public:
- TcpSegmentDescriptor(Flow*, Packet*, TcpEventLogger&);
+ TcpSegmentDescriptor(snort::Flow*, snort::Packet*, TcpEventLogger&);
virtual ~TcpSegmentDescriptor() = default;
uint32_t init_mss(uint16_t* value);
uint32_t init_wscale(uint16_t* value);
bool has_wscale();
- Flow* get_flow() const
+ snort::Flow* get_flow() const
{
return flow;
}
- Packet* get_pkt() const
+ snort::Packet* get_pkt() const
{
return pkt;
}
- const tcp::TCPHdr* get_tcph() const
+ const snort::tcp::TCPHdr* get_tcph() const
{
return tcph;
}
}
private:
- Flow* flow;
- Packet* pkt;
+ snort::Flow* flow;
+ snort::Packet* pkt;
- const tcp::TCPHdr* tcph;
+ const snort::tcp::TCPHdr* tcph;
uint16_t src_port;
uint16_t dst_port;
uint32_t seg_seq;
#include "main/snort_debug.h"
#include "stream/tcp/tcp_ha.h"
+using namespace snort;
+
#ifdef DEBUG_MSGS
const char* const flush_policy_names[] =
{
};
#endif
-TcpStreamSession::TcpStreamSession(Flow* flow) : Session(flow)
-{
-}
-
TcpStreamSession::~TcpStreamSession()
{
if (tcp_init)
class TcpStreamSession : public Session
{
public:
- TcpStreamSession(Flow*);
+ TcpStreamSession(snort::Flow* flow) : Session(flow) { }
~TcpStreamSession() override;
- bool setup(Packet*) override;
+ bool setup(snort::Packet*) override;
void clear() override;
- void cleanup(Packet* = nullptr) override;
- void set_splitter(bool, StreamSplitter*) override;
- StreamSplitter* get_splitter(bool) override;
+ void cleanup(snort::Packet* = nullptr) override;
+ void set_splitter(bool, snort::StreamSplitter*) override;
+ snort::StreamSplitter* get_splitter(bool) override;
bool is_sequenced(uint8_t /*dir*/) override;
bool are_packets_missing(uint8_t /*dir*/) override;
uint8_t get_reassembly_direction() override;
uint8_t missing_in_reassembled(uint8_t /*dir*/) override;
- void update_direction(char dir, const SfIp*, uint16_t port) override;
- bool add_alert(Packet*, uint32_t gid, uint32_t sid) override;
- bool check_alerted(Packet*, uint32_t gid, uint32_t sid) override;
- int update_alert(Packet*, uint32_t /*gid*/, uint32_t /*sid*/,
+ void update_direction(char dir, const snort::SfIp*, uint16_t port) override;
+ bool add_alert(snort::Packet*, uint32_t gid, uint32_t sid) override;
+ bool check_alerted(snort::Packet*, uint32_t gid, uint32_t sid) override;
+ int update_alert(snort::Packet*, uint32_t /*gid*/, uint32_t /*sid*/,
uint32_t /*event_id*/, uint32_t /*event_second*/) override;
static void sinit();
void start_proxy();
void print();
- void SetPacketHeaderFoo(const Packet* p);
+ void SetPacketHeaderFoo(const snort::Packet* p);
void GetPacketHeaderFoo(DAQ_PktHdr_t* pkth, uint32_t dir);
void SwapPacketHeaderFoo();
virtual void update_perf_base_state(char) { }
virtual void clear_session(
- bool free_flow_data, bool flush_segments, bool restart, Packet* p = nullptr) = 0;
+ bool free_flow_data, bool flush_segments, bool restart, snort::Packet* p = nullptr) = 0;
// FIXIT-L these 2 function names convey no meaning afaict... figure out
// why are they called and name appropriately...
- virtual void retransmit_process(Packet* p)
+ virtual void retransmit_process(snort::Packet* p)
{
// Data has already been analyzed so don't bother looking at it again.
- DetectionEngine::disable_content(p);
+ snort::DetectionEngine::disable_content(p);
}
- virtual void retransmit_handle(Packet* p)
+ virtual void retransmit_handle(snort::Packet* p)
{
flow->call_handlers(p, false);
}
- virtual void eof_handle(Packet* p)
+ virtual void eof_handle(snort::Packet* p)
{
flow->call_handlers(p, true);
}
TcpEventLogger tel;
private:
- ip::snort_in6_addr real_src_ip;
- ip::snort_in6_addr real_dst_ip;
- uint16_t real_src_port;
- uint16_t real_dst_port;
+ snort::ip::snort_in6_addr real_src_ip = { 0 };
+ snort::ip::snort_in6_addr real_dst_ip = { 0 };
+ uint16_t real_src_port = 0;
+ uint16_t real_dst_port = 0;
protected:
virtual void set_os_policy() = 0;
#include "stream/stream.h"
#include "stream/tcp/tcp_module.h"
+using namespace snort;
+
const char* tcp_state_names[] =
{
"TCP_LISTEN", "TCP_SYN_SENT", "TCP_SYN_RECV",
return tcp_event;
}
- TcpEvent set_tcp_event(TcpSegmentDescriptor& tsd);
+ TcpEvent set_tcp_event(TcpSegmentDescriptor&);
void set_tcp_event(TcpEvent tcp_event)
{
this->mss = mss;
}
- void cache_mac_address(TcpSegmentDescriptor& tsd, uint8_t direction);
+ void cache_mac_address(TcpSegmentDescriptor&, uint8_t direction);
bool compare_mac_addresses(const uint8_t eth_addr[]);
bool is_rst_pkt_sent() const
virtual void print() = 0;
virtual void init_flush_policy() = 0;
- virtual void set_splitter(StreamSplitter* ss) = 0;
- virtual void set_splitter(const Flow* flow) = 0;
+ virtual void set_splitter(snort::StreamSplitter* ss) = 0;
+ virtual void set_splitter(const snort::Flow* flow) = 0;
virtual void reset_splitter( ) = 0;
virtual void init_on_syn_sent(TcpSegmentDescriptor&) = 0;
virtual void init_on_syn_recv(TcpSegmentDescriptor&) = 0;
- virtual void init_on_synack_sent(TcpSegmentDescriptor& tsd) = 0;
- virtual void init_on_synack_recv(TcpSegmentDescriptor& tsd) = 0;
- virtual void init_on_3whs_ack_sent(TcpSegmentDescriptor& tsd) = 0;
- virtual void init_on_3whs_ack_recv(TcpSegmentDescriptor& tsd) = 0;
- virtual void init_on_data_seg_sent(TcpSegmentDescriptor& tsd) = 0;
- virtual void init_on_data_seg_recv(TcpSegmentDescriptor& tsd) = 0;
- virtual void finish_server_init(TcpSegmentDescriptor& tsd) = 0;
- virtual void finish_client_init(TcpSegmentDescriptor& tsd) = 0;
-
- virtual void update_tracker_ack_recv(TcpSegmentDescriptor& tsd) = 0;
- virtual void update_tracker_ack_sent(TcpSegmentDescriptor& tsd) = 0;
- virtual bool update_on_3whs_ack(TcpSegmentDescriptor& tsd) = 0;
- virtual bool update_on_rst_recv(TcpSegmentDescriptor& tsd) = 0;
+ virtual void init_on_synack_sent(TcpSegmentDescriptor&) = 0;
+ virtual void init_on_synack_recv(TcpSegmentDescriptor&) = 0;
+ virtual void init_on_3whs_ack_sent(TcpSegmentDescriptor&) = 0;
+ virtual void init_on_3whs_ack_recv(TcpSegmentDescriptor&) = 0;
+ virtual void init_on_data_seg_sent(TcpSegmentDescriptor&) = 0;
+ virtual void init_on_data_seg_recv(TcpSegmentDescriptor&) = 0;
+ virtual void finish_server_init(TcpSegmentDescriptor&) = 0;
+ virtual void finish_client_init(TcpSegmentDescriptor&) = 0;
+
+ virtual void update_tracker_ack_recv(TcpSegmentDescriptor&) = 0;
+ virtual void update_tracker_ack_sent(TcpSegmentDescriptor&) = 0;
+ virtual bool update_on_3whs_ack(TcpSegmentDescriptor&) = 0;
+ virtual bool update_on_rst_recv(TcpSegmentDescriptor&) = 0;
virtual void update_on_rst_sent() = 0;
- virtual bool update_on_fin_recv(TcpSegmentDescriptor& tsd) = 0;
- virtual bool update_on_fin_sent(TcpSegmentDescriptor& tsd) = 0;
- virtual bool is_segment_seq_valid(TcpSegmentDescriptor& tsd) = 0;
- virtual void flush_data_on_fin_recv(TcpSegmentDescriptor& tsd) = 0;
+ virtual bool update_on_fin_recv(TcpSegmentDescriptor&) = 0;
+ virtual bool update_on_fin_sent(TcpSegmentDescriptor&) = 0;
+ virtual bool is_segment_seq_valid(TcpSegmentDescriptor&) = 0;
+ virtual void flush_data_on_fin_recv(TcpSegmentDescriptor&) = 0;
bool client_tracker;
TcpState tcp_state;
uint32_t r_win_base = 0; /* remote side window base sequence number
* (i.e. the last ack we got) */
- StreamSplitter* splitter = nullptr;
+ snort::StreamSplitter* splitter = nullptr;
TcpNormalizer* normalizer = nullptr;
TcpReassembler* reassembler = nullptr;
TcpSession* session = nullptr;
#include "main/snort_debug.h"
#include "protocols/packet.h"
+using namespace snort;
+
//--------------------------------------------------------------------
// private state
//--------------------------------------------------------------------
#include "stream/stream_splitter.h"
-struct SnortConfig;
+namespace snort
+{
+class Flow;
+}
void* paf_new(unsigned max); // create new paf config (per policy)
void paf_delete(void*); // free config
uint32_t fpt; // current flush point
uint32_t tot; // total bytes flushed
- StreamSplitter::Status paf; // current scan state
+ snort::StreamSplitter::Status paf; // current scan state
};
void paf_setup(PAF_State*); // called at session start
inline uint32_t paf_initialized (PAF_State* ps)
{
- return ( ps->paf != StreamSplitter::START );
+ return ( ps->paf != snort::StreamSplitter::START );
}
inline uint32_t paf_active (PAF_State* ps)
{
- return ( ps->paf != StreamSplitter::ABORT );
+ return ( ps->paf != snort::StreamSplitter::ABORT );
}
inline void paf_jump(PAF_State* ps, uint32_t n)
}
// called on each in order segment
-int32_t paf_check(
- StreamSplitter* paf_config, PAF_State*, Flow* ssn,
- const uint8_t* data, uint32_t len, uint32_t total,
- uint32_t seq, uint32_t* flags);
+int32_t paf_check(snort::StreamSplitter* paf_config, PAF_State*, snort::Flow* ssn,
+ const uint8_t* data, uint32_t len, uint32_t total, uint32_t seq, uint32_t* flags);
#endif
#include "libtcp/stream_tcp_unit_test.h"
#endif
+using namespace snort;
+
// this should not be publicly accessible
extern THREAD_LOCAL class FlowControl* flow_con;
#include "flow/flow.h"
+
+struct HostAttributeEntry;
+
+namespace snort
+{
+class Flow;
+struct SfIp;
+class StreamSplitter;
+
/* traffic direction identification */
#define FROM_SERVER 0
#define FROM_CLIENT 1
"first | last | linux | old_linux | bsd | macos | solaris | irix | " \
"hpux11 | hpux10 | windows | win_2003 | vista | proxy"
-class Flow;
-struct SfIp;
-
typedef int (* LogFunction)(Flow*, uint8_t** buf, uint32_t* len, uint32_t* type);
typedef void (* LogExtraData)(Flow*, void* config, LogFunction* funcs,
uint32_t max_count, uint32_t xtradata_mask, uint32_t id, uint32_t sec);
// n-tuple parameters specified. Inspection will be turned off for this expected session
// when it arrives.
static int ignore_flow(
- const Packet* ctrlPkt, PktType, IpProtocol, const SfIp* srcIP, uint16_t srcPort,
- const SfIp* dstIP, uint16_t dstPort, char direction, uint32_t flowdata_id);
+ const Packet* ctrlPkt, PktType, IpProtocol, const snort::SfIp* srcIP, uint16_t srcPort,
+ const snort::SfIp* dstIP, uint16_t dstPort, char direction, uint32_t flowdata_id);
// Resume inspection for flow.
// FIXIT-L does resume work only for a flow that has been stopped by call to stop_inspection?
// initialize response count and expiration time
static void init_active_response(const Packet*, Flow*);
- static void set_splitter(Flow*, bool toServer, class StreamSplitter* = nullptr);
+ static void set_splitter(Flow*, bool toServer, StreamSplitter* = nullptr);
static StreamSplitter* get_splitter(Flow*, bool toServer);
// Turn off inspection for potential session. Adds session identifiers to a hash table.
// TCP only.
static int set_application_protocol_id_expected(
- const Packet* ctrlPkt, PktType, IpProtocol, const SfIp* srcIP, uint16_t srcPort,
- const SfIp* dstIP, uint16_t dstPort, int16_t appId, FlowData*);
+ const Packet* ctrlPkt, PktType, IpProtocol, const snort::SfIp* srcIP, uint16_t srcPort,
+ const snort::SfIp* dstIP, uint16_t dstPort, int16_t appId, FlowData*);
// Get pointer to application data for a flow based on the lookup tuples for cases where
// Snort does not have an active packet that is relevant.
static FlowData* get_flow_data(
PktType type, IpProtocol proto,
- const SfIp* a1, uint16_t p1, const SfIp* a2, uint16_t p2,
+ const snort::SfIp* a1, uint16_t p1, const snort::SfIp* a2, uint16_t p2,
uint16_t vlanId, uint32_t mplsId, uint16_t addrSpaceId, unsigned flowdata_id);
// Get pointer to application data for a flow using the FlowKey as the lookup criteria
// cases where Snort does not have an active packet that is relevant.
static Flow* get_flow(
PktType type, IpProtocol proto,
- const SfIp* a1, uint16_t p1, const SfIp* a2, uint16_t p2,
+ const snort::SfIp* a1, uint16_t p1, const snort::SfIp* a2, uint16_t p2,
uint16_t vlanId, uint32_t mplsId, uint16_t addrSpaceId);
// Delete the session if it is in the closed session state.
// Populate a session key from the Packet
static void populate_flow_key(Packet*, FlowKey*);
- static void update_direction(Flow*, char dir, const SfIp* ip, uint16_t port);
+ static void update_direction(Flow*, char dir, const snort::SfIp* ip, uint16_t port);
static void set_application_protocol_id(
- Flow*, const struct HostAttributeEntry*, int direction);
+ Flow*, const HostAttributeEntry*, int direction);
static bool is_midstream(Flow* flow)
{ return flow->ssn_state.session_flags & SSNFLAG_MIDSTREAM; }
private:
static void set_ip_protocol(Flow*);
};
-
+}
#endif
#include "managers/plugin_manager.h"
+using namespace snort;
+
extern const BaseApi* nin_stream_base;
extern const BaseApi* nin_stream_ip;
extern const BaseApi* nin_stream_icmp;
#include "flush_bucket.h"
#include "stream.h"
+using namespace snort;
+
unsigned StreamSplitter::max(Flow*)
{ return SnortConfig::get_conf()->max_pdu; }
#include "main/snort_types.h"
+namespace snort
+{
class Flow;
struct StreamBuffer
private:
unsigned byte_count = 0;
};
+}
#endif
#include "stream/libtcp/stream_tcp_unit_test.h"
#endif
+using namespace snort;
+
//-------------------------------------------------------------------------
// stream_reassemble
//-------------------------------------------------------------------------
#include "tcp_session.h"
+using namespace snort;
+
//-------------------------------------------------------------------------
// stream_size
//-------------------------------------------------------------------------
#include "tcp_module.h"
#include "tcp_session.h"
+using namespace snort;
+
//-------------------------------------------------------------------------
// inspector stuff
//-------------------------------------------------------------------------
#ifndef STREAM_TCP_H
#define STREAM_TCP_H
+namespace snort
+{
class Inspector;
+}
class TcpStreamConfig;
-TcpStreamConfig* get_tcp_cfg(Inspector*);
+TcpStreamConfig* get_tcp_cfg(snort::Inspector*);
#endif
static THREAD_LOCAL int s5_trace_enabled = -1; // FIXIT-L should use module trace feature
-inline void TraceEvent(const Packet* p, TcpSegmentDescriptor*, uint32_t txd, uint32_t rxd)
+inline void TraceEvent(const snort::Packet* p, TcpSegmentDescriptor*, uint32_t txd, uint32_t rxd)
{
int i;
char flags[7] = "UAPRSF";
- const tcp::TCPHdr* h = p->ptrs.tcph;
+ const snort::tcp::TCPHdr* h = p->ptrs.tcph;
const char* order = "";
if (!h)
pc.total_from_daq, flags, h->th_flags, rseq, rack, h->win(), p->dsize, order);
}
-inline void TraceSession(const Flow* lws)
+inline void TraceSession(const snort::Flow* lws)
{
fprintf(stdout, " LWS: ST=0x%x SF=0x%x CP=%hu SP=%hu\n", (unsigned)lws->session_state,
lws->ssn_state.session_flags, lws->client_port, lws->server_port);
fprintf(stdout, "\n");
}
-inline void TraceTCP(const Packet* p, const Flow* lws, TcpSegmentDescriptor* tsd, int event)
+inline void TraceTCP(const snort::Packet* p, const snort::Flow* lws, TcpSegmentDescriptor* tsd, int event)
{
const TcpSession* ssn = (TcpSession*)lws->session;
const TcpStreamTracker* srv = ssn ? ssn->server : nullptr;
}
}
-inline void S5TraceTCP(const Packet* p, const Flow* lws, TcpSegmentDescriptor* tsd, int event)
+inline void S5TraceTCP(const snort::Packet* p, const snort::Flow* lws, TcpSegmentDescriptor* tsd, int event)
{
if (!s5_trace_enabled)
return;
#include "main/thread.h"
+namespace snort
+{
struct Packet;
+}
/* actions */
#define ACTION_NOTHING 0x00000000
void TcpEventLogger::log_internal_event(uint32_t eventSid)
{
- if (is_internal_event_enabled(SnortConfig::get_conf()->rate_filter_config, eventSid))
+ if (is_internal_event_enabled(snort::SnortConfig::get_conf()->rate_filter_config, eventSid))
{
tcpStats.internalEvents++;
- DetectionEngine::queue_event(GENERATOR_INTERNAL, eventSid);
+ snort::DetectionEngine::queue_event(GENERATOR_INTERNAL, eventSid);
DebugFormat(DEBUG_STREAM, "Stream raised internal event %u\n", eventSid);
}
}
uint32_t idx = ffs(tcp_events);
if ( idx )
{
- DetectionEngine::queue_event(GID_STREAM_TCP, tcp_event_sids[ idx ].sid);
+ snort::DetectionEngine::queue_event(GID_STREAM_TCP, tcp_event_sids[ idx ].sid);
tcp_events ^= tcp_event_sids[ idx ].event_id;
tcpStats.events++;
}
#include "tcp_session.h"
+using namespace snort;
+
Flow* TcpHA::create_session(FlowKey* key)
{
assert(key);
//-------------------------------------------------------------------------
+namespace snort
+{
class Flow;
+}
class TcpHA : public ProtocolHA
{
public:
TcpHA() : ProtocolHA(PktType::TCP) { }
- Flow* create_session(FlowKey*) override;
- void deactivate_session(Flow*) override;
+ snort::Flow* create_session(FlowKey*) override;
+ void deactivate_session(snort::Flow*) override;
private:
};
class TcpHAManager
{
public:
- static void process_deletion(Flow* flow);
+ static void process_deletion(snort::Flow* flow);
static void tinit();
static void tterm();
static THREAD_LOCAL TcpHA* tcp_ha;
#include "profiler/profiler_defs.h"
+using namespace snort;
using namespace std;
//-------------------------------------------------------------------------
extern const PegInfo tcp_pegs[];
-extern THREAD_LOCAL ProfileStats s5TcpPerfStats;
-extern THREAD_LOCAL ProfileStats s5TcpNewSessPerfStats;
-extern THREAD_LOCAL ProfileStats s5TcpStatePerfStats;
-extern THREAD_LOCAL ProfileStats s5TcpDataPerfStats;
-extern THREAD_LOCAL ProfileStats s5TcpInsertPerfStats;
-extern THREAD_LOCAL ProfileStats s5TcpPAFPerfStats;
-extern THREAD_LOCAL ProfileStats s5TcpFlushPerfStats;
-extern THREAD_LOCAL ProfileStats s5TcpBuildPacketPerfStats;
-extern THREAD_LOCAL ProfileStats streamSizePerfStats;
+extern THREAD_LOCAL snort::ProfileStats s5TcpPerfStats;
+extern THREAD_LOCAL snort::ProfileStats s5TcpNewSessPerfStats;
+extern THREAD_LOCAL snort::ProfileStats s5TcpStatePerfStats;
+extern THREAD_LOCAL snort::ProfileStats s5TcpDataPerfStats;
+extern THREAD_LOCAL snort::ProfileStats s5TcpInsertPerfStats;
+extern THREAD_LOCAL snort::ProfileStats s5TcpPAFPerfStats;
+extern THREAD_LOCAL snort::ProfileStats s5TcpFlushPerfStats;
+extern THREAD_LOCAL snort::ProfileStats s5TcpBuildPacketPerfStats;
+extern THREAD_LOCAL snort::ProfileStats streamSizePerfStats;
struct TcpStats
{
#define MOD_NAME "stream_tcp"
#define MOD_HELP "stream inspector for TCP flow tracking and stream normalization and reassembly"
+namespace snort
+{
struct SnortConfig;
+}
-class StreamTcpModule : public Module
+class StreamTcpModule : public snort::Module
{
public:
StreamTcpModule();
- bool set(const char*, Value&, SnortConfig*) override;
- bool begin(const char*, int, SnortConfig*) override;
- bool end(const char*, int, SnortConfig*) override;
+ bool set(const char*, snort::Value&, snort::SnortConfig*) override;
+ bool begin(const char*, int, snort::SnortConfig*) override;
+ bool end(const char*, int, snort::SnortConfig*) override;
- const RuleMap* get_rules() const override;
+ const snort::RuleMap* get_rules() const override;
unsigned get_gid() const override
{ return GID_STREAM_TCP; }
TcpStreamConfig* get_data();
- ProfileStats* get_profile(unsigned, const char*&, const char*&) const override;
+ snort::ProfileStats* get_profile(unsigned, const char*&, const char*&) const override;
const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
#include "main/snort_debug.h"
#include "packet_io/active.h"
+using namespace snort;
+
THREAD_LOCAL PegCount tcp_norm_stats[PC_TCP_MAX][NORM_MODE_MAX];
static const PegInfo pegName[] =
virtual void trim_rst_payload(TcpSegmentDescriptor&, uint32_t max = 0);
virtual void trim_win_payload(TcpSegmentDescriptor&, uint32_t max = 0);
virtual void trim_mss_payload(TcpSegmentDescriptor&, uint32_t max = 0);
- virtual void ecn_tracker(const tcp::TCPHdr*, bool req3way);
- virtual void ecn_stripper(Packet*);
+ virtual void ecn_tracker(const snort::tcp::TCPHdr*, bool req3way);
+ virtual void ecn_stripper(snort::Packet*);
virtual uint32_t get_stream_window(TcpSegmentDescriptor&);
virtual uint32_t get_tcp_timestamp(TcpSegmentDescriptor&, bool strip);
virtual int handle_paws(TcpSegmentDescriptor&);
virtual bool validate_rst(TcpSegmentDescriptor&);
virtual int handle_repeated_syn(TcpSegmentDescriptor&) = 0;
- virtual uint16_t set_urg_offset(const tcp::TCPHdr* tcph, uint16_t dsize);
+ virtual uint16_t set_urg_offset(const snort::tcp::TCPHdr* tcph, uint16_t dsize);
static const PegInfo* get_normalization_pegs();
static NormPegs get_normalization_counts(unsigned&);
protected:
TcpNormalizer(StreamPolicy, TcpSession*, TcpStreamTracker*);
virtual void trim_payload(TcpSegmentDescriptor&, uint32_t, NormMode, TcpPegCounts);
- virtual bool strip_tcp_timestamp(TcpSegmentDescriptor&, const tcp::TcpOption*, NormMode);
+ virtual bool strip_tcp_timestamp(TcpSegmentDescriptor&, const snort::tcp::TcpOption*, NormMode);
virtual bool validate_rst_seq_geq(TcpSegmentDescriptor&);
virtual bool validate_rst_end_seq_geq(TcpSegmentDescriptor&);
virtual bool validate_rst_seq_eq(TcpSegmentDescriptor&);
#include "tcp_module.h"
+using namespace snort;
+
class TcpNormalizerFirst : public TcpNormalizer
{
public:
#include "tcp_module.h"
#include "tcp_normalizer.h"
+using namespace snort;
+
ReassemblyPolicy stream_reassembly_policy_map[] =
{
ReassemblyPolicy::OS_INVALID,
tcpStats.rebuilt_bytes += flushed_bytes;
ProfileExclude profile_exclude(s5TcpFlushPerfStats);
- Snort::inspect(pdu);
+ snort::Snort::inspect(pdu);
}
else
{
show_rebuilt_packet(pdu);
ProfileExclude profile_exclude(s5TcpFlushPerfStats);
- Snort::inspect(pdu);
+ snort::Snort::inspect(pdu);
if ( tracker->splitter )
tracker->splitter->update();
}
virtual int queue_packet_for_reassembly(TcpSegmentDescriptor&);
virtual void purge_segment_list();
- virtual int flush_stream(Packet* p, uint32_t dir, bool final_flush = false);
+ virtual int flush_stream(snort::Packet* p, uint32_t dir, bool final_flush = false);
virtual int purge_flushed_ackd();
- virtual void flush_queued_segments(Flow* flow, bool clear, Packet* p = nullptr);
+ virtual void flush_queued_segments(snort::Flow* flow, bool clear, snort::Packet* p = nullptr);
virtual bool is_segment_pending_flush();
- virtual int flush_on_data_policy(Packet*);
- virtual int flush_on_ack_policy(Packet*);
+ virtual int flush_on_data_policy(snort::Packet*);
+ virtual int flush_on_ack_policy(snort::Packet*);
void set_seglist_base_seq(uint32_t seglist_base_seq)
{
this->seglist_base_seq = seglist_base_seq;
void queue_reassembly_segment(TcpSegmentNode* prev, TcpSegmentNode*);
void init_overlap_editor(TcpSegmentDescriptor&);
bool is_segment_fasttrack(TcpSegmentNode* tail, TcpSegmentDescriptor&);
- int purge_alerts(Flow*);
- void show_rebuilt_packet(Packet*);
+ int purge_alerts(snort::Flow*);
+ void show_rebuilt_packet(snort::Packet*);
uint32_t get_flush_data_len(TcpSegmentNode*, uint32_t to_seq, unsigned max);
- int flush_data_segments(Packet*, uint32_t total, Packet* pdu);
- void prep_pdu(Flow*, Packet*, uint32_t pkt_flags, Packet* pdu);
- Packet* initialize_pdu(Packet* p, uint32_t pkt_flags, struct timeval tv);
- int _flush_to_seq(uint32_t bytes, Packet*, uint32_t pkt_flags);
- int flush_to_seq(uint32_t bytes, Packet*, uint32_t pkt_flags);
- int do_zero_byte_flush(Packet* p, uint32_t pkt_flags);
+ int flush_data_segments(snort::Packet*, uint32_t total, snort::Packet* pdu);
+ void prep_pdu(snort::Flow*, snort::Packet*, uint32_t pkt_flags, snort::Packet* pdu);
+ snort::Packet* initialize_pdu(snort::Packet* p, uint32_t pkt_flags, struct timeval tv);
+ int _flush_to_seq(uint32_t bytes, snort::Packet*, uint32_t pkt_flags);
+ int flush_to_seq(uint32_t bytes, snort::Packet*, uint32_t pkt_flags);
+ int do_zero_byte_flush(snort::Packet* p, uint32_t pkt_flags);
uint32_t get_q_footprint();
uint32_t get_q_sequenced();
- void final_flush(Packet*, uint32_t dir);
- uint32_t get_reverse_packet_dir(const Packet*);
- uint32_t get_forward_packet_dir(const Packet*);
+ void final_flush(snort::Packet*, uint32_t dir);
+ uint32_t get_reverse_packet_dir(const snort::Packet*);
+ uint32_t get_forward_packet_dir(const snort::Packet*);
int32_t flush_pdu_ips(uint32_t*);
void fallback();
int32_t flush_pdu_ackd(uint32_t* flags);
#include "tcp_reassemblers.h"
#include "tcp_stream_state_machine.h"
+using namespace snort;
+
#ifdef DEBUG_MSGS
static THREAD_LOCAL const char* t_name = nullptr;
static THREAD_LOCAL const char* l_name = nullptr;
tsm = TcpStreamStateMachine::get_instance();
client = new TcpTracker(true, this);
server = new TcpTracker(false, this);
+ splitter_init = false;
}
TcpSession::~TcpSession()
class TcpSession : public TcpStreamSession
{
public:
- TcpSession(Flow*);
+ TcpSession(snort::Flow*);
~TcpSession() override;
- bool setup(Packet*) override;
- void restart(Packet* p) override;
- void precheck(Packet* p) override;
- int process(Packet*) override;
+ bool setup(snort::Packet*) override;
+ void restart(snort::Packet* p) override;
+ void precheck(snort::Packet* p) override;
+ int process(snort::Packet*) override;
void flush() override;
- void flush_client(Packet*) override;
- void flush_server(Packet*) override;
- void flush_talker(Packet*, bool final_flush = false) override;
- void flush_listener(Packet*, bool final_flush = false) override;
+ void flush_client(snort::Packet*) override;
+ void flush_server(snort::Packet*) override;
+ void flush_talker(snort::Packet*, bool final_flush = false) override;
+ void flush_listener(snort::Packet*, bool final_flush = false) override;
- void clear_session(bool free_flow_data, bool flush_segments, bool restart, Packet* p = nullptr) override;
+ void clear_session(bool free_flow_data, bool flush_segments, bool restart, snort::Packet* p = nullptr) override;
- void set_extra_data(Packet*, uint32_t /*flag*/) override;
+ void set_extra_data(snort::Packet*, uint32_t /*flag*/) override;
void update_perf_base_state(char new_state) override;
TcpStreamTracker::TcpState get_talker_state() override;
void swap_trackers();
void NewTcpSessionOnSyn(TcpSegmentDescriptor&);
void NewTcpSessionOnSynAck(TcpSegmentDescriptor&);
- int process_dis(Packet*);
+ int process_dis(snort::Packet*);
void update_on_3whs_complete(TcpSegmentDescriptor&);
- bool is_flow_handling_packets(Packet*);
- void cleanup_session_if_expired(Packet*);
- bool do_packet_analysis_pre_checks(Packet*, TcpSegmentDescriptor&);
- void do_packet_analysis_post_checks(Packet*);
- void flush_tracker(TcpStreamTracker*, Packet*, uint32_t dir, bool final_flush);
+ bool is_flow_handling_packets(snort::Packet*);
+ void cleanup_session_if_expired(snort::Packet*);
+ bool do_packet_analysis_pre_checks(snort::Packet*, TcpSegmentDescriptor&);
+ void do_packet_analysis_post_checks(snort::Packet*);
+ void flush_tracker(TcpStreamTracker*, snort::Packet*, uint32_t dir, bool final_flush);
TcpStateMachine* tsm;
bool splitter_init;
bool TcpStateCloseWait::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- Flow* flow = tsd.get_flow();
+ snort::Flow* flow = tsd.get_flow();
if( trk.process_inorder_fin() )
{
trk.update_on_fin_recv(tsd);
bool TcpStateClosed::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- Flow* flow = tsd.get_flow();
+ snort::Flow* flow = tsd.get_flow();
flow->set_expire(tsd.get_pkt(), trk.session->config->session_timeout);
return true;
}
bool TcpStateClosed::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- Flow* flow = tsd.get_flow();
+ snort::Flow* flow = tsd.get_flow();
trk.update_tracker_ack_sent(tsd);
// data on a segment when we're not accepting data any more alert!
if ( trk.get_tcp_event() != TcpStreamTracker::TCP_FIN_RECV_EVENT )
{
TcpStreamTracker::TcpState talker_state = trk.session->get_talker_state();
- Flow* flow = tsd.get_flow();
+ snort::Flow* flow = tsd.get_flow();
if ( ( talker_state == TcpStreamTracker::TCP_TIME_WAIT ) || !flow->two_way_traffic() )
{
TEST_CASE("TCP State Closed", "[tcp_closed_state][stream_tcp]")
{
// initialization code here
- Flow* flow = new Flow;
+ snort::Flow* flow = new snort::Flow;
TcpStreamTracker* ctrk = new TcpStreamTracker(true);
TcpStreamTracker* strk = new TcpStreamTracker(false);
TcpEventLogger* tel = new TcpEventLogger;
bool TcpStateClosing::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- Flow* flow = tsd.get_flow();
+ snort::Flow* flow = tsd.get_flow();
trk.update_tracker_ack_recv(tsd);
if ( SEQ_GT(tsd.get_seg_seq(), trk.get_fin_final_seq() ) )
bool TcpStateFinWait1::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- Flow* flow = tsd.get_flow();
+ snort::Flow* flow = tsd.get_flow();
trk.update_tracker_ack_recv(tsd);
if ( trk.update_on_fin_recv(tsd) )
bool TcpStateFinWait2::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- Flow* flow = tsd.get_flow();
+ snort::Flow* flow = tsd.get_flow();
trk.update_tracker_ack_recv(tsd);
if ( trk.update_on_fin_recv(tsd) )
bool TcpStateLastAck::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- Flow* flow = tsd.get_flow();
+ snort::Flow* flow = tsd.get_flow();
trk.update_tracker_ack_recv(tsd);
if ( SEQ_EQ(tsd.get_seg_ack(), trk.get_snd_nxt() ) )
( trk.get_tcp_event() != TcpStreamTracker::TCP_FIN_RECV_EVENT ) )
{
TcpStreamTracker::TcpState talker_state = trk.session->get_talker_state();
- Flow* flow = tsd.get_flow();
+ snort::Flow* flow = tsd.get_flow();
if ( ( talker_state == TcpStreamTracker::TCP_TIME_WAIT )
|| ( talker_state == TcpStreamTracker::TCP_CLOSED ) )
#include "tcp_normalizer.h"
#include "tcp_session.h"
+using namespace snort;
+
TcpStateListen::TcpStateListen(TcpStateMachine& tsm) :
TcpStateHandler(TcpStreamTracker::TCP_LISTEN, tsm)
{
#include "tcp_normalizer.h"
#include "tcp_session.h"
+using namespace snort;
+
TcpStateNone::TcpStateNone(TcpStateMachine& tsm) :
TcpStateHandler(TcpStreamTracker::TCP_STATE_NONE, tsm)
{
#include "tcp_normalizer.h"
#include "tcp_session.h"
+using namespace snort;
using namespace std;
TcpStateSynRecv::TcpStateSynRecv(TcpStateMachine& tsm) :
bool TcpStateSynSent::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- Flow* flow = tsd.get_flow();
+ snort::Flow* flow = tsd.get_flow();
// FIXIT-H verify ack being sent is valid...
trk.update_tracker_ack_sent(tsd);
bool TcpStateSynSent::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- Flow* flow = tsd.get_flow();
+ snort::Flow* flow = tsd.get_flow();
// FIXIT-H verify ack being sent is valid...
trk.update_tracker_ack_sent(tsd);
if ( trk.get_tcp_event() != TcpStreamTracker::TCP_FIN_RECV_EVENT )
{
TcpStreamTracker::TcpState talker_state = trk.session->get_talker_state();
- Flow* flow = tsd.get_flow();
+ snort::Flow* flow = tsd.get_flow();
if ( ( talker_state == TcpStreamTracker::TCP_TIME_WAIT )
|| ( talker_state == TcpStreamTracker::TCP_CLOSED ) )
return hs_timeout >= 0;
}
- bool midstream_allowed(Packet* p)
+ bool midstream_allowed(snort::Packet* p)
{
if ( ( hs_timeout < 0 ) || ( p->pkth->ts.tv_sec - packet_first_time() < hs_timeout ) )
return true;
#include "tcp_normalizer.h"
#include "tcp_reassembler.h"
+using namespace snort;
+
TcpTracker::TcpTracker(bool client, TcpSession* ssn) :
TcpStreamTracker(client)
{
void init_tcp_state() override;
void print() override;
void init_flush_policy() override;
- void set_splitter(StreamSplitter* ss) override;
- void set_splitter(const Flow* flow) override;
+ void set_splitter(snort::StreamSplitter* ss) override;
+ void set_splitter(const snort::Flow* flow) override;
void reset_splitter( ) override;
void init_on_syn_sent(TcpSegmentDescriptor&) override;
void init_on_syn_recv(TcpSegmentDescriptor&) override;
- void init_on_synack_sent(TcpSegmentDescriptor& tsd) override;
- void init_on_synack_recv(TcpSegmentDescriptor& tsd) override;
- void init_on_3whs_ack_sent(TcpSegmentDescriptor& tsd) override;
- void init_on_3whs_ack_recv(TcpSegmentDescriptor& tsd) override;
- void init_on_data_seg_sent(TcpSegmentDescriptor& tsd) override;
- void init_on_data_seg_recv(TcpSegmentDescriptor& tsd) override;
- void finish_server_init(TcpSegmentDescriptor& tsd) override;
- void finish_client_init(TcpSegmentDescriptor& tsd) override;
+ void init_on_synack_sent(TcpSegmentDescriptor&) override;
+ void init_on_synack_recv(TcpSegmentDescriptor&) override;
+ void init_on_3whs_ack_sent(TcpSegmentDescriptor&) override;
+ void init_on_3whs_ack_recv(TcpSegmentDescriptor&) override;
+ void init_on_data_seg_sent(TcpSegmentDescriptor&) override;
+ void init_on_data_seg_recv(TcpSegmentDescriptor&) override;
+ void finish_server_init(TcpSegmentDescriptor&) override;
+ void finish_client_init(TcpSegmentDescriptor&) override;
- void update_tracker_ack_recv(TcpSegmentDescriptor& tsd) override;
- void update_tracker_ack_sent(TcpSegmentDescriptor& tsd) override;
- bool update_on_3whs_ack(TcpSegmentDescriptor& tsd) override;
- bool update_on_rst_recv(TcpSegmentDescriptor& tsd) override;
+ void update_tracker_ack_recv(TcpSegmentDescriptor&) override;
+ void update_tracker_ack_sent(TcpSegmentDescriptor&) override;
+ bool update_on_3whs_ack(TcpSegmentDescriptor&) override;
+ bool update_on_rst_recv(TcpSegmentDescriptor&) override;
void update_on_rst_sent() override;
- bool update_on_fin_recv(TcpSegmentDescriptor& tsd) override;
- bool update_on_fin_sent(TcpSegmentDescriptor& tsd) override;
- bool is_segment_seq_valid(TcpSegmentDescriptor& tsd) override;
- void flush_data_on_fin_recv(TcpSegmentDescriptor& tsd) override;
+ bool update_on_fin_recv(TcpSegmentDescriptor&) override;
+ bool update_on_fin_sent(TcpSegmentDescriptor&) override;
+ bool is_segment_seq_valid(TcpSegmentDescriptor&) override;
+ void flush_data_on_fin_recv(TcpSegmentDescriptor&) override;
void init_toolbox() override;
};
#include <CppUTest/TestHarness.h>
#include <CppUTestExt/MockSupport.h>
+using namespace snort;
+
NormMode mockNormMode = NORM_MODE_ON;
bool norm_enabled = true;
THREAD_LOCAL TcpStats tcpStats;
#include <CppUTest/CommandLineTestRunner.h>
#include <CppUTest/TestHarness.h>
+using namespace snort;
+
//--------------------------------------------------------------------------
// mocks
//--------------------------------------------------------------------------
-
+namespace snort
+{
THREAD_LOCAL SnortConfig* snort_conf = nullptr;
SnortConfig* SnortConfig::get_conf()
{ return snort_conf; }
static StreamSplitter* next_splitter = nullptr;
-static int flushed = 0;
Flow::Flow() { }
uint8_t* DetectionEngine::get_next_buffer(unsigned int&)
{ return nullptr; }
-uint16_t FlushBucket::get_size()
-{ return 1; }
-
StreamSplitter* Stream::get_splitter(Flow*, bool)
{ return next_splitter; }
+static int flushed = 0;
+
void Stream::flush_client(Packet*)
{ flushed = 1; }
void Stream::flush_server(Packet*)
{ flushed = 2; }
+}
+
+
+uint16_t FlushBucket::get_size()
+{ return 1; }
+
//--------------------------------------------------------------------------
// atom splitter tests
#include "udp_module.h"
#include "udp_session.h"
+using namespace snort;
+
//-------------------------------------------------------------------------
// helpers
//-------------------------------------------------------------------------
#include <cstdint>
+namespace snort
+{
class Inspector;
+}
struct StreamUdpConfig
{
StreamUdpConfig();
};
-StreamUdpConfig* get_udp_cfg(Inspector*);
+StreamUdpConfig* get_udp_cfg(snort::Inspector*);
#endif
#include "udp_session.h"
+using namespace snort;
+
Flow* UdpHA::create_session(FlowKey* key)
{
assert(key);
//-------------------------------------------------------------------------
+namespace snort
+{
class Flow;
+}
class UdpHA : public ProtocolHA
{
public:
UdpHA() : ProtocolHA(PktType::UDP) { }
- Flow* create_session(FlowKey*) override;
+ snort::Flow* create_session(FlowKey*) override;
private:
};
class UdpHAManager
{
public:
- static void process_deletion(Flow* flow);
+ static void process_deletion(snort::Flow* flow);
static void tinit();
static void tterm();
static THREAD_LOCAL UdpHA* udp_ha;
#include "stream_udp.h"
+using namespace snort;
using namespace std;
//-------------------------------------------------------------------------
#include "flow/session.h"
#include "framework/module.h"
+namespace snort
+{
struct SnortConfig;
+}
struct UdpStats
{
extern const PegInfo udp_pegs[];
extern THREAD_LOCAL struct UdpStats udpStats;
-extern THREAD_LOCAL ProfileStats udp_perf_stats;
+extern THREAD_LOCAL snort::ProfileStats udp_perf_stats;
//-------------------------------------------------------------------------
// stream_udp module
struct StreamUdpConfig;
-class StreamUdpModule : public Module
+class StreamUdpModule : public snort::Module
{
public:
StreamUdpModule();
- bool set(const char*, Value&, SnortConfig*) override;
- bool begin(const char*, int, SnortConfig*) override;
- bool end(const char*, int, SnortConfig*) override;
+ bool set(const char*, snort::Value&, snort::SnortConfig*) override;
+ bool begin(const char*, int, snort::SnortConfig*) override;
+ bool end(const char*, int, snort::SnortConfig*) override;
- ProfileStats* get_profile() const override;
+ snort::ProfileStats* get_profile() const override;
const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
StreamUdpConfig* get_data();
#include "udp_module.h"
#include "stream_udp.h"
+using namespace snort;
+
// NOTE: sender is assumed to be client
// responder is assumed to be server
class UdpSession : public Session
{
public:
- UdpSession(Flow*);
+ UdpSession(snort::Flow*);
- bool setup(Packet*) override;
- void update_direction(char dir, const SfIp*, uint16_t port) override;
- int process(Packet*) override;
+ bool setup(snort::Packet*) override;
+ void update_direction(char dir, const snort::SfIp*, uint16_t port) override;
+ int process(snort::Packet*) override;
void clear() override;
public:
#include "user_module.h"
#include "user_session.h"
+using namespace snort;
+
//-------------------------------------------------------------------------
// helpers
//-------------------------------------------------------------------------
#include <cstdint>
+namespace snort
+{
class Inspector;
+}
struct StreamUserConfig
{
StreamUserConfig();
};
-StreamUserConfig* get_user_cfg(Inspector*);
+StreamUserConfig* get_user_cfg(snort::Inspector*);
#endif
#include "stream_user.h"
+using namespace snort;
using namespace std;
Trace TRACE_NAME(stream_user);
#include "framework/module.h"
+namespace snort
+{
struct SnortConfig;
+}
-extern THREAD_LOCAL ProfileStats user_perf_stats;
+extern THREAD_LOCAL snort::ProfileStats user_perf_stats;
extern Trace TRACE_NAME(stream_user);
struct StreamUserConfig;
-class StreamUserModule : public Module
+class StreamUserModule : public snort::Module
{
public:
StreamUserModule();
~StreamUserModule() override;
- bool set(const char*, Value&, SnortConfig*) override;
- bool begin(const char*, int, SnortConfig*) override;
- bool end(const char*, int, SnortConfig*) override;
+ bool set(const char*, snort::Value&, snort::SnortConfig*) override;
+ bool begin(const char*, int, snort::SnortConfig*) override;
+ bool end(const char*, int, snort::SnortConfig*) override;
Usage get_usage() const override
{ return INSPECT; }
#include "stream_user.h"
#include "user_module.h"
+using namespace snort;
+
THREAD_LOCAL ProfileStats user_perf_stats;
// we always get exactly one copy of user data in order
up->packet_flags |= (p->packet_flags & (PKT_STREAM_EST|PKT_STREAM_UNEST_UNI));
trace_logf(stream_user, "detect[%d]\n", up->dsize);
- Snort::inspect(up);
+ snort::Snort::inspect(up);
}
int UserTracker::scan(Packet* p, uint32_t& flags)
void init();
void term();
- void process(Packet*);
- void add_data(Packet*);
- int scan(Packet*, uint32_t&);
- void flush(struct Packet*, unsigned, uint32_t);
- void detect(const struct Packet*, const struct StreamBuffer&, uint32_t, Packet* up);
+ void process(snort::Packet*);
+ void add_data(snort::Packet*);
+ int scan(snort::Packet*, uint32_t&);
+ void flush(struct snort::Packet*, unsigned, uint32_t);
+ void detect(const struct snort::Packet*, const struct snort::StreamBuffer&, uint32_t, snort::Packet* up);
std::list<UserSegment*> seg_list;
- StreamSplitter* splitter;
+ snort::StreamSplitter* splitter;
PAF_State paf_state;
unsigned total;
};
class UserSession : public Session
{
public:
- UserSession(Flow*);
+ UserSession(snort::Flow*);
- bool setup(Packet*) override;
+ bool setup(snort::Packet*) override;
void clear() override;
- int process(Packet*) override;
+ int process(snort::Packet*) override;
- void set_splitter(bool c2s, StreamSplitter*) override;
- StreamSplitter* get_splitter(bool c2s) override;
- void restart(Packet*) override;
+ void set_splitter(bool c2s, snort::StreamSplitter*) override;
+ snort::StreamSplitter* get_splitter(bool c2s) override;
+ void restart(snort::Packet*) override;
bool is_sequenced(uint8_t /*dir*/) override
{ return true; }
{ return SSN_MISSING_NONE; }
private:
- void start(Packet*, Flow*);
- void update(Packet*, Flow*);
- void end(Packet*, Flow*);
+ void start(snort::Packet*, snort::Flow*);
+ void update(snort::Packet*, snort::Flow*);
+ void end(snort::Packet*, snort::Flow*);
- void update_direction(char dir, const SfIp*, uint16_t port) override;
+ void update_direction(char dir, const snort::SfIp*, uint16_t port) override;
- bool add_alert(Packet*, uint32_t gid, uint32_t sid) override;
- bool check_alerted(Packet*, uint32_t gid, uint32_t sid) override;
+ bool add_alert(snort::Packet*, uint32_t gid, uint32_t sid) override;
+ bool check_alerted(snort::Packet*, uint32_t gid, uint32_t sid) override;
int update_alert(
- Packet*, uint32_t gid, uint32_t sid, uint32_t event_id, uint32_t event_second) override;
+ snort::Packet*, uint32_t gid, uint32_t sid, uint32_t event_id, uint32_t event_second) override;
- void flush_client(Packet*) override { }
- void flush_server(Packet*) override { }
- void flush_talker(Packet*, bool /*final_flush */ = false) override { }
- void flush_listener(Packet*, bool /*final_flush */ = false) override { }
+ void flush_client(snort::Packet*) override { }
+ void flush_server(snort::Packet*) override { }
+ void flush_talker(snort::Packet*, bool /*final_flush */ = false) override { }
+ void flush_listener(snort::Packet*, bool /*final_flush */ = false) override { }
- void set_extra_data(Packet*, uint32_t /* flag */) override { }
+ void set_extra_data(snort::Packet*, uint32_t /* flag */) override { }
uint8_t get_reassembly_direction() override;
struct HostAttributeEntry
{
- SfCidr ipAddr;
+ snort::SfCidr ipAddr;
HostInfo hostInfo;
ApplicationEntry* services;
ApplicationEntry* clients;
#include "utils/stats.h"
#include "utils/util.h"
+using namespace snort;
+
#define ATTRIBUTE_MAP_MAX_ROWS 1024
struct tTargetBasedConfig
#define MAX_MAX_METADATA_SERVICES 256
#define MIN_MAX_METADATA_SERVICES 1
+namespace snort
+{
struct Packet;
+}
/* main Functions, called by Snort shutdown */
void SFAT_Init();
uint32_t SFAT_NumberOfHosts();
/* API Lookup functions, to be called by Stream & Frag */
-HostAttributeEntry* SFAT_LookupHostEntryByIP(const SfIp* ipAddr);
-HostAttributeEntry* SFAT_LookupHostEntryBySrc(Packet* p);
-HostAttributeEntry* SFAT_LookupHostEntryByDst(Packet* p);
+HostAttributeEntry* SFAT_LookupHostEntryByIP(const snort::SfIp* ipAddr);
+HostAttributeEntry* SFAT_LookupHostEntryBySrc(snort::Packet* p);
+HostAttributeEntry* SFAT_LookupHostEntryByDst(snort::Packet* p);
#if 0
int SFAT_AddApplicationData(HostAttributeEntry*, struct ApplicationEntry*);
#endif
-void SFAT_UpdateApplicationProtocol(SfIp*, uint16_t port, uint16_t protocol, uint16_t id);
+void SFAT_UpdateApplicationProtocol(snort::SfIp*, uint16_t port, uint16_t protocol, uint16_t id);
// reload functions
struct tTargetBasedConfig;
#include "sftarget_data.h"
+using namespace snort;
using namespace std;
int16_t ProtocolReference::get_count()
#include "util.h"
+using namespace snort;
+
#define STATS_SEPARATOR \
"--------------------------------------------------"
#include "util_cstring.h"
+using namespace snort;
+
char** protocol_names = nullptr;
/****************************************************************************
#include "sfip/sf_cidr.h"
#include "util_cstring.h"
+namespace snort
+{
char* ObfuscateIpToText(const SfIp* ip, SfCidr& homenet, SfCidr& obfunet, InetBuf& ab)
{
ab[0] = 0;
return ab;
}
-
+}
#include <arpa/inet.h>
#include "main/snort_types.h"
+namespace snort
+{
struct SfCidr;
typedef char InetBuf[INET6_ADDRSTRLEN];
SO_PUBLIC char* ObfuscateIpToText(
const struct SfIp*, SfCidr& homenet, SfCidr& obfuscate_net, InetBuf&);
-
+}
#endif
projects / thirdparty / snort3.git / commitdiff
