another take on flow normalizations

diff --git a/doc/start.txt b/doc/start.txt
index 4d90613e0df83634b4423b5591abd8c77b04e42e..2e33ac39e5dc3cc51ff6629611036331894f24e0 100644 (file)
--- a/doc/start.txt
+++ b/doc/start.txt
@@ -155,3 +155,7 @@ include::errors.txt[]
 * Snort can't tell you the exact filename or line number of a semantic
   error but it will tell you the fully qualified name.
 
+* The dump DAQ will not work with multiple threads unless you use --daq-var
+  file=/dev/null.  This will be fixed in at some point to use the Snort log
+  directory, etc.
+

diff --git a/src/network_inspectors/binder/binder.cc b/src/network_inspectors/binder/binder.cc
index c1207c3347b7f1cff25b2cd7b1545d25436c5893..6ed14f0100919faf60e5678971c7861ed6765b53 100644 (file)
--- a/src/network_inspectors/binder/binder.cc
+++ b/src/network_inspectors/binder/binder.cc
@@ -311,7 +311,16 @@ Binding* Binder::get_binding(Flow* flow)
     // so we act as if binder wasn't configured at all
     return nullptr;
 }
-    
+
+// FIXIT-P these lookups should be optimized when the dust settles
+#define INS_WIZ  "wizard"
+#define INS_STR  "stream_"
+#define INS_IP   "stream_ip"
+#define INS_ICMP "stream_icmp"
+#define INS_TCP  "stream_tcp"
+#define INS_UDP  "stream_udp"
+#define INS_NORM "normalizer"
+
 BindAction Binder::apply(Flow* flow, Binding* pb)
 {
     if ( !pb )
@@ -327,7 +336,7 @@ BindAction Binder::apply(Flow* flow, Binding* pb)
         return pb->use.action;
     }
 
-    if ( !strncmp(pb->use.name.c_str(), "stream_", 7) )
+    if ( !strncmp(pb->use.name.c_str(), INS_STR, 7) )
     {
         set_session(flow, pb->use.name.c_str());
         return BA_INSPECT;
@@ -336,7 +345,7 @@ BindAction Binder::apply(Flow* flow, Binding* pb)
     init_flow(flow);
     Inspector* ins;
 
-    if ( pb->use.name == "wizard" )
+    if ( pb->use.name == INS_WIZ )
     {
         ins = InspectorManager::get_wizard();
         if ( ins )
@@ -365,22 +374,27 @@ BindAction Binder::apply(Flow* flow, Binding* pb)
 
 void Binder::init_flow(Flow* flow)
 {
+    Inspector* ins = InspectorManager::get_inspector(INS_NORM);
+
+    if ( ins )
+        ins->exec(0, flow);
+
     switch ( flow->protocol )
     {
     case PktType::IP:
-        set_session(flow, "stream_ip");
+        set_session(flow, INS_IP);
         break;
 
     case PktType::ICMP:
-        set_session(flow, "stream_icmp");
+        set_session(flow, INS_ICMP);
         break;
 
     case PktType::TCP:
-        set_session(flow, "stream_tcp");
+        set_session(flow, INS_TCP);
         break;
 
     case PktType::UDP:
-        set_session(flow, "stream_udp");
+        set_session(flow, INS_UDP);
         break;
 
     default:

diff --git a/src/network_inspectors/normalize/normalize.cc b/src/network_inspectors/normalize/normalize.cc
index 45ca58cef3254078f00d11d5e9a50a8376742636..9c7f19ce48dd98517fc2b70cdb88548207949e61 100644 (file)
--- a/src/network_inspectors/normalize/normalize.cc
+++ b/src/network_inspectors/normalize/normalize.cc
@@ -163,6 +163,7 @@ public:
     void tinit() override;
     void show(SnortConfig*) override;
     void eval(Packet*) override;
+    int exec(int, void*) override;
 
 private:
     NormalizerConfig config;
@@ -217,15 +218,20 @@ void Normalizer::eval(Packet *p)
     MODULE_PROFILE_START(norm_perf_stats);
 
     if ( !PacketIsRebuilt(p) && !Active_PacketWasDropped() )
-    {
         Norm_Packet(&config, p);
-        p->flow->set_normalizations(config.normalizer_flags);
-    }
 
     MODULE_PROFILE_END(norm_perf_stats);
     return;
 }
 
+int Normalizer::exec(int, void* pv)
+{
+    Flow* flow = (Flow*)pv;
+    assert(flow);
+    flow->set_normalizations(config.normalizer_flags);
+    return 0;
+}
+
 //-------------------------------------------------------------------------
 // api stuff
 //-------------------------------------------------------------------------