109

diff --git a/ChangeLog b/ChangeLog
index 8f2f1912f1091b8fab428bf29aaa3beb5fdd1bca..5a48116bd9e27109e59b374c1555238809cf1bf8 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -2,6 +2,8 @@
 -- changed --help to give overview of help
 -- fixed stream_ip alerts (defrag -> stream_ip)
 -- added missing help to parameters
+-- pulled in latest from Josh
+-- added Flow* to StreamSplitter::reassemble()
 
 108
 -- added IpsAction for ips rule action plugins

diff --git a/configure.ac b/configure.ac
index fad740cceed1f81c65ea9d0337f9fee48f83ced7..b78433f1540cbe9f35a362a1f4f6242c77402c52 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -25,7 +25,7 @@
 # initialization
 #--------------------------------------------------------------------------
 
-AC_INIT([snort], [2.10.108])
+AC_INIT([snort], [2.10.109])
 AC_PREREQ([2.68])
 
 AC_CONFIG_SRCDIR([src/main.h])

diff --git a/src/managers/module_manager.cc b/src/managers/module_manager.cc
index ebd43a3ab2fae1a181b6d1d8543c73946ded4ec0..ed2728f5916e1cd5e65180a72ad1c5ed5a990054 100644 (file)
--- a/src/managers/module_manager.cc
+++ b/src/managers/module_manager.cc
@@ -718,7 +718,7 @@ void ModuleManager::load_rules(SnortConfig* sc)
 
             // note:  you can NOT do ss.str().c_str() here
             const string& rule = ss.str();
-            ParseConfigString(sc, rule.c_str(), true);
+            ParseConfigString(sc, rule.c_str());
 
             r++;
         }

diff --git a/src/network_inspectors/binder/binder.cc b/src/network_inspectors/binder/binder.cc
index 60a3ebfdcf98f00c991c072d0991b62c5489b435..5b665d0e0cc7954d77e9286f0951bc76362235a3 100644 (file)
--- a/src/network_inspectors/binder/binder.cc
+++ b/src/network_inspectors/binder/binder.cc
@@ -176,7 +176,6 @@ int Binder::check_rules(Flow* flow, Packet* p)
     unsigned i, sz = bindings.size();
 
     Port port = (p->packet_flags & PKT_FROM_CLIENT) ? p->dp : p->sp;
-    uint16_t vlan = vlan::vth_vlan(layer::get_vlan_layer(p));
 
     for ( i = 0; i < sz; i++ )
     {

diff --git a/src/parser/keywords.h b/src/parser/keywords.h
index a15b47654e7f3e8890f501767a09f8832c527a85..1170890f2d54f92bdb3fa09add5fd7ab4136e297 100644 (file)
--- a/src/parser/keywords.h
+++ b/src/parser/keywords.h
@@ -60,6 +60,7 @@
 #define RULE_OPT__METADATA          "metadata"
 #define RULE_OPT__PRIORITY          "priority"
 #define RULE_OPT__REFERENCE         "reference"
+#define RULE_OPT__REM               "rem"
 #define RULE_OPT__REVISION          "rev"
 #define RULE_OPT__SID               "sid"
 #define RULE_OPT__SOID              "soid"

diff --git a/src/parser/parse_conf.cc b/src/parser/parse_conf.cc
index 1c679e2f690f73df8f4bb0530937758b9c92956c..deae69d581c68cc0306b684cc51443411fc32409 100644 (file)
--- a/src/parser/parse_conf.cc
+++ b/src/parser/parse_conf.cc
@@ -124,30 +124,18 @@ static void inc_parse_position()
     ++loc.line;
 }
 
-static bool s_parse_rules = false;
 static void ParseTheConf(SnortConfig*, const char* fname);
 
-/* Used to determine whether or not to parse the keyword line based on
- * whether or not we're parsing rules */
-typedef enum _KeywordType
-{
-    KEYWORD_TYPE__MAIN,
-    KEYWORD_TYPE__RULE,
-    KEYWORD_TYPE__ALL
-
-} KeywordType;
-
 typedef void (*ParseFunc)(SnortConfig *, const char *);
 
-typedef struct _KeywordFunc
+struct KeywordFunc
 {
     const char *name;
-    KeywordType type;
     int expand_vars;
     int default_policy_only;
     ParseFunc parse_func;
 
-} KeywordFunc;
+};
 
 // only keep drop rules ...
 // if we are inline (and can actually drop),
@@ -293,11 +281,6 @@ void AddRuleState(SnortConfig* sc, const RuleState& rs)
     }
 }
 
-static void ParseFile(SnortConfig *sc, const char *args)
-{
-    parse_file_rule(args, &(sc->file_config));
-}
-
 static const KeywordFunc snort_conf_keywords[] =
 {
     // this stuff is expected to remain since rules don't fit in Lua tables
@@ -305,30 +288,18 @@ static const KeywordFunc snort_conf_keywords[] =
     // nested rules files
 
     // however, these must become pluggable ...
-    { ACTION_ALERT,    KEYWORD_TYPE__RULE, 0, 0, ParseAlert },
-    { ACTION_DROP,     KEYWORD_TYPE__RULE, 0, 0, ParseDrop },
-    { ACTION_BLOCK,    KEYWORD_TYPE__RULE, 0, 0, ParseDrop },
-    { ACTION_LOG,      KEYWORD_TYPE__RULE, 0, 0, ParseLog },
-    { ACTION_PASS,     KEYWORD_TYPE__RULE, 0, 0, ParsePass },
-    { ACTION_REJECT,   KEYWORD_TYPE__RULE, 0, 0, ParseReject },
-    { ACTION_SDROP,    KEYWORD_TYPE__RULE, 0, 0, ParseSdrop },
-    { ACTION_SBLOCK,   KEYWORD_TYPE__RULE, 0, 0, ParseSdrop },
-
-    { SNORT_CONF_KEYWORD__FILE,     KEYWORD_TYPE__MAIN, 0, 1, ParseFile },
-    { SNORT_CONF_KEYWORD__INCLUDE,  KEYWORD_TYPE__ALL,  1, 0, ParseInclude },
-
-#if 0
-    // this needs to be turned into an action plugin
-    // the special case parsing got in the way refactoring for Lua
-    // so it's toast - here for reference only
-
-    /* Special parsing case is ruletype.  Need to send the file pointer so
-     * it can parse what's between '{' and '}' which can span multiple
-     * lines without a line continuation character */
-    { SNORT_CONF_KEYWORD__RULE_TYPE, KEYWORD_TYPE__ALL,  1, 0, ParseRuleTypeDeclaration },
-#endif
-
-    { NULL, KEYWORD_TYPE__ALL, 0, 0, NULL }   /* Marks end of array */
+    { ACTION_ALERT,    0, 0, ParseAlert },
+    { ACTION_DROP,     0, 0, ParseDrop },
+    { ACTION_BLOCK,    0, 0, ParseDrop },
+    { ACTION_LOG,      0, 0, ParseLog },
+    { ACTION_PASS,     0, 0, ParsePass },
+    { ACTION_REJECT,   0, 0, ParseReject },
+    { ACTION_SDROP,    0, 0, ParseSdrop },
+    { ACTION_SBLOCK,   0, 0, ParseSdrop },
+
+    { SNORT_CONF_KEYWORD__INCLUDE,  1, 0, ParseInclude },
+
+    { NULL, 0, 0, NULL }   // sentinel
 };
 
 static int ContinuationCheck(char *rule)
@@ -438,14 +409,6 @@ static void ParseConfigFileLine(SnortConfig *sc, char *buf)
             {
                 if (strcasecmp(keyword, snort_conf_keywords[i].name) == 0)
                 {
-                    if (((snort_conf_keywords[i].type == KEYWORD_TYPE__RULE) &&
-                         !s_parse_rules) ||
-                        ((snort_conf_keywords[i].type == KEYWORD_TYPE__MAIN) &&
-                         s_parse_rules))
-                    {
-                        break;
-                    }
-
                     if (snort_conf_keywords[i].expand_vars)
                         args = SnortStrdup(ExpandVars(sc, toks[1]));
 
@@ -457,7 +420,7 @@ static void ParseConfigFileLine(SnortConfig *sc, char *buf)
             /* Didn't find any pre-defined snort_conf_keywords.  Look for a user defined
              * rule type */
 
-            if ((snort_conf_keywords[i].name == NULL) && s_parse_rules)
+            if ( (snort_conf_keywords[i].name == NULL) )
             {
                 RuleListNode *node;
 
@@ -548,10 +511,8 @@ static void ParseTheConf(SnortConfig *sc, const char *fname)
     free(buf);
 }
 
-void ParseConfigString(SnortConfig* sc, const char* s, bool parse_rules)
+void ParseConfigString(SnortConfig* sc, const char* s)
 {
-    s_parse_rules = parse_rules;
-
     string rules = s;
     stringstream ss(rules);
 
@@ -564,10 +525,8 @@ void ParseConfigString(SnortConfig* sc, const char* s, bool parse_rules)
 }
 
 void ParseConfigFile(
-    SnortConfig *sc, const char *fname, bool parse_rules)
+    SnortConfig *sc, const char *fname)
 {
-    s_parse_rules = parse_rules;
-
     if ( fname )
         ParseTheConf(sc, fname);
 }

diff --git a/src/parser/parse_conf.h b/src/parser/parse_conf.h
index 32f081cf6d7ea8c0a99b49ad659273797a866511..f421e6b5ab9177ee9759f94ff98032c629e58e47 100644 (file)
--- a/src/parser/parse_conf.h
+++ b/src/parser/parse_conf.h
@@ -29,8 +29,8 @@ void parse_conf_print();
 
 struct SnortConfig;
 
-void ParseConfigFile(SnortConfig*, const char* fname, bool do_rules);
-void ParseConfigString(SnortConfig*, const char* str, bool do_rules);
+void ParseConfigFile(SnortConfig*, const char* fname);
+void ParseConfigString(SnortConfig*, const char* str);
 
 void AddRuleState(SnortConfig*, const RuleState&);
 

diff --git a/src/parser/parse_otn.cc b/src/parser/parse_otn.cc
index 86dcccedff07071fcba4a27ad5fc56cd7b1f3c0f..eef20df3cfed8e60bb33c2429f0dc12a64e4a94f 100644 (file)
--- a/src/parser/parse_otn.cc
+++ b/src/parser/parse_otn.cc
@@ -481,6 +481,12 @@ static void ParseOtnReference(
     mSplitFree(&toks, num_toks);
 }
 
+static void ParseOtnRem(
+    SnortConfig*, RuleTreeNode*,
+    OptTreeNode*, const char*)
+{
+}
+
 static void ParseOtnRevision(
     SnortConfig*, RuleTreeNode*,
     OptTreeNode *otn, const char *args)
@@ -717,6 +723,7 @@ static RuleOptFunc rule_options[] =
     { RULE_OPT__MSG,              1, 1, 0, ParseOtnMessage },
     { RULE_OPT__PRIORITY,         1, 1, 0, ParseOtnPriority },
     { RULE_OPT__REFERENCE,        1, 0, 0, ParseOtnReference },
+    { RULE_OPT__REM,              1, 1, 0, ParseOtnRem },
     { RULE_OPT__REVISION,         1, 1, 0, ParseOtnRevision },
     { RULE_OPT__SID,              1, 1, 0, ParseOtnSid },
     { RULE_OPT__SOID,             1, 1, 0, ParseOtnSoid },

diff --git a/src/parser/parser.cc b/src/parser/parser.cc
index 9e255b5897f47c8c3093fc6a61bded2271acca07..ac75323ce2e65c3f853eda0d1318246b05b4d35e 100644 (file)
--- a/src/parser/parser.cc
+++ b/src/parser/parser.cc
@@ -778,14 +778,14 @@ void ParseRules(SnortConfig *sc)
         if ( fname && *fname )
         {
             push_parse_location(fname);
-            ParseConfigFile(sc, fname, true);
+            ParseConfigFile(sc, fname);
             pop_parse_location();
         }
 
         if ( !p->rules.empty() )
         {
             push_parse_location("rules");
-            ParseConfigString(sc, p->rules.c_str(), true);
+            ParseConfigString(sc, p->rules.c_str());
             pop_parse_location();
         }
     }

diff --git a/src/service_inspectors/ftp_telnet/ftp_module.cc b/src/service_inspectors/ftp_telnet/ftp_module.cc
index e8757a218ab90e5fb37bef4e4f2a34b63b0fd2c0..1884c767145fd5b0de14601296cbe2a8f903d444 100644 (file)
--- a/src/service_inspectors/ftp_telnet/ftp_module.cc
+++ b/src/service_inspectors/ftp_telnet/ftp_module.cc
@@ -132,13 +132,19 @@ FTP_CLIENT_PROTO_CONF* FtpClientModule::get_data()
     return tmp;
 }
 
-bool FtpClientModule::begin(const char*, int, SnortConfig*)
+bool FtpClientModule::begin(const char* fqn, int, SnortConfig*)
 {
     if ( !conf )
         conf = new FTP_CLIENT_PROTO_CONF;
 
     address.clear();
     port = last_port = 0;
+
+    if ( !strcmp(fqn, "ftp_client.bounce_to") )
+    {
+        for ( auto p : bounce_to )
+            delete p;
+    }
     return true;
 }
 

diff --git a/src/sfip/sf_iph.cc b/src/sfip/sf_iph.cc
index 2591bdb532e19b0a3fd0029c34ee02f888de2ae4..b5418f1d16d05422f0d7a6d3c6ba92589471328d 100644 (file)
--- a/src/sfip/sf_iph.cc
+++ b/src/sfip/sf_iph.cc
@@ -1,6 +1,6 @@
 /****************************************************************************
  *
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+ * Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
  * Copyright (C) 2007-2013 Sourcefire, Inc.
  *
  * This program is free software; you can redistribute it and/or modify
@@ -56,12 +56,12 @@ sfip_t *ip6_ret_src(const Packet *p)
     return &p->ip6h->ip_src;
 }
 
-sfip_t *orig_ip6_ret_src(const Packet *p)
+sfip_t *orig_ip6_ret_src(const Packet*)
 {
     VALIDATE(p, 1);
 
     return nullptr;
-//  return &p->orig_ip6h->ip_src;
+    //return &p->orig_ip6h->ip_src;
 }
 
 sfip_t *ip6_ret_dst(const Packet *p)

diff --git a/src/stream/stream_splitter.cc b/src/stream/stream_splitter.cc
index 41c2f638b353ba9f3adfb7ba61f0d05e6284051b..961a0b68d2f166b57e1bf2651c35ae8439f1a541 100644 (file)
--- a/src/stream/stream_splitter.cc
+++ b/src/stream/stream_splitter.cc
@@ -32,7 +32,8 @@ uint32_t StreamSplitter::max()
 { return 16384; }  // FIXIT make default configurable
 
 const StreamBuffer* StreamSplitter::reassemble(
-    unsigned offset, const uint8_t* p, unsigned n, uint32_t flags, unsigned& copied)
+    Flow*, unsigned offset, const uint8_t* p,
+    unsigned n, uint32_t flags, unsigned& copied)
 { 
     assert(offset + n < sizeof(pdu_buf));
     memcpy(pdu_buf+offset, p, n);

diff --git a/src/stream/stream_splitter.h b/src/stream/stream_splitter.h
index 3690aaf0259ac04c38f70039f732b6c4b8bfd84a..73eb778ef102dc397d24ee824589ca35a8d928d4 100644 (file)
--- a/src/stream/stream_splitter.h
+++ b/src/stream/stream_splitter.h
@@ -33,7 +33,6 @@ enum PAF_Status // FIXIT move inside StreamSplitter
     PAF_START,   // internal use only
     PAF_SEARCH,  // searching for next flush point
     PAF_FLUSH,   // flush at given offset
-    PAF_BUILD,   // reassemble to given offset
     PAF_SKIP     // skip ahead to given offset
 };
 
@@ -59,6 +58,7 @@ public:
     ) = 0;
 
     virtual const StreamBuffer* reassemble(
+        Flow*,
         unsigned offset,       // data offset from start of reassembly
         const uint8_t* data,   // data to reassemble
         unsigned len,          // length of data

diff --git a/src/stream/tcp/tcp_session.cc b/src/stream/tcp/tcp_session.cc
index f3cc4c7d3a932499ef5088f6883511323d01107e..85e9aa89be406b2cda421591ddcbf09ddec95062 100644 (file)
--- a/src/stream/tcp/tcp_session.cc
+++ b/src/stream/tcp/tcp_session.cc
@@ -1925,7 +1925,7 @@ static inline unsigned int getSegmentFlushSize(
  * flush the client seglist up to the most recently acked segment
  */
 static int FlushStream(
-    Packet*, StreamTracker *st, uint32_t toSeq, uint8_t *flushbuf,
+    Packet* p, StreamTracker *st, uint32_t toSeq, uint8_t *flushbuf,
     const uint8_t *flushbuf_end)
 {
     uint16_t bytes_flushed = 0;
@@ -1951,7 +1951,7 @@ static int FlushStream(
             flags |= PKT_PDU_TAIL;
 
         const StreamBuffer* sb = st->splitter->reassemble(
-            bytes_flushed, ss->payload, bytes_to_copy, flags, bytes_copied);
+            p->flow, bytes_flushed, ss->payload, bytes_to_copy, flags, bytes_copied);
 
         flags = 0;