all parse warnings are optional; fix ip and tcp policy defines

diff --git a/ChangeLog b/ChangeLog
index 489e320ac26d59851674cf77c2c395e411cdf2f4..162caefec20950524691da9b93ad958a8d8f6964 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,7 @@
 Pending - build 142
 
+-- make all warnings optional
+-- fix ip and tcp policy defines
 -- fix ip and icmp flow client/server ip init
 -- added logging examples to usage
 

diff --git a/doc/style.txt b/doc/style.txt
index 7c70d85f7e7407977d19c3d884e0811d5f055c0f..96ec6bec051cf570805f32a92450af5fc5870833 100644 (file)
--- a/doc/style.txt
+++ b/doc/style.txt
@@ -152,7 +152,7 @@ yet firm so feedback is welcome to get something we can live with.
 ==== Headers
 
 * Don't hesitate to create a new header if it is needed.  Don't lump
-  unrelated stuff into a header because it is convenient.
+  unrelated stuff into an header because it is convenient.
 
 * Write header guards like this (leading underscores are reserved for
   system stuff).  In my_header.h:
@@ -164,7 +164,7 @@ yet firm so feedback is welcome to get something we can live with.
 
 * Includes from a different directory should specify parent directory.
   This makes it clear exactly what is included and avoids the primordial
-  soup that results from using -I this -I that -I the-other-thing ... .
+  soup that results from using -I this -I that -I the_other_thing ... .
 
     // given:
     src/foo/foo.cc
@@ -218,7 +218,7 @@ Currently using uncrustify from at https://github.com/bengardner/uncrustify
 to reformat legacy code and anything that happens to need a makeover at
 some point.
 
-The working config is crusty.cfg in the top level directory.  It does well,
+The working config is crusty.cfg in the top level directory.  It does well
 but will munge some things.  Specially formatted INDENT-OFF comments were
 added in 2 places to avoid a real mess.
 

diff --git a/doc/usage.txt b/doc/usage.txt
index 0c20c27b078cd593a4c67fbe2000f92003e1237a..48a9a2ed29715126736140e514d4d1e74bad25f4 100644 (file)
--- a/doc/usage.txt
+++ b/doc/usage.txt
@@ -34,8 +34,8 @@ Output help on "rule" options in AsciiDoc format:
 
     snort --markup --help-options rule
 
-NOTE: Snort++ stops reading command-line options after the "--help-*" and "--list-*" options,
-so any other options should be placed before them.
+NOTE: Snort++ stops reading command-line options after the "--help-*" and
+"--list-*" options, so any other options should be placed before them.
 
 
 ==== Sniffing and Logging
@@ -52,8 +52,9 @@ Dump packets with application data and layer 2 headers
 
     snort -r /path/to/my.pcap -K text -d -e
 
-NOTE: Command line options must be specified separately. "snort -de" won't work.
-You can still concatenate options and their arguments, however, so "snort -Ktext" will work.
+NOTE: Command line options must be specified separately. "snort -de" won't
+work.  You can still concatenate options and their arguments, however, so
+"snort -Ktext" will work.
 
 Dump packets from all pcaps in a directory:
 
@@ -104,12 +105,32 @@ Add or modify a configuration from the command line using the "--lua" option:
 
 NOTE: The "--lua" option can be specified multiple times.
 
-Run Snort++ in IDS mode on an entire directory of pcaps, processing each input source on a separate thread:
+Run Snort++ in IDS mode on an entire directory of pcaps, processing each
+input source on a separate thread:
 
     snort -c $my_path/etc/snort/snort.lua --pcap-dir /path/to/pcap/dir \
         --pcap-filter '*.pcap' --max-packet-threads 8
 
 
+=== Plugins
+
+Load external plugins and use the "ex" alert:
+
+    snort -c $my_path/etc/snort/snort.lua \
+        --plugin-path $my_path/lib/snort_extra \
+        -A alert_ex -r /path/to/my.pcap
+
+Test the LuaJIT rule option 'find' loaded from stdin:
+
+    snort -c $my_path/etc/snort/snort.lua \
+        --script-path $my_path/lib/snort_extra \
+        --stdin-rules -A cmg -r /path/to/my.pcap << END
+    alert tcp any any -> any 80 (
+        sid:3; msg:"found"; content:"GET";
+        find:"pat='HTTP/1%.%d'" ; )
+    END
+
+
 === Output Files
 
 To make it simple to configure outputs when you run with multiple packet

diff --git a/src/codecs/ip/cd_icmp6.cc b/src/codecs/ip/cd_icmp6.cc
index d4e85a1c377625fa534b1be2540df8f3b870bf6a..2bb856ff7bc02baa4be533ec6d30f6444ddde63e 100644 (file)
--- a/src/codecs/ip/cd_icmp6.cc
+++ b/src/codecs/ip/cd_icmp6.cc
@@ -118,9 +118,6 @@ bool Icmp6Codec::decode(const RawData& raw, CodecData& codec, DecodeData& snort)
 {
     if (raw.len < icmp::ICMP6_HEADER_MIN_LEN)
     {
-        DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
-            "WARNING: Truncated ICMP6 header (%d bytes).\n", raw.len); );
-
         codec_event(codec, DECODE_ICMP6_HDR_TRUNC);
         return false;
     }

diff --git a/src/codecs/ip/cd_ipv4.cc b/src/codecs/ip/cd_ipv4.cc
index e6a619349502ad292528efa4e10e4dbb50b76155..16e6b2203fe8e0039e95e7beb5301db6a0ab1db9 100644 (file)
--- a/src/codecs/ip/cd_ipv4.cc
+++ b/src/codecs/ip/cd_ipv4.cc
@@ -147,9 +147,6 @@ bool Ipv4Codec::decode(const RawData& raw, CodecData& codec, DecodeData& snort)
     /* do a little validation */
     if (raw.len < ip::IP4_HEADER_LEN)
     {
-        DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
-            "WARNING: Truncated IP4 header (%d bytes).\n", raw.len); );
-
         if ((codec.codec_flags & CODEC_UNSURE_ENCAP) == 0)
             codec_event(codec, DECODE_IP4_HDR_TRUNC);
         return false;

diff --git a/src/detection/fpcreate.cc b/src/detection/fpcreate.cc
index 15277cd370d53459b06283d33bde03b1800a257b..a8433ca85f24f817ff531f304ffb2040337024d8 100644 (file)
--- a/src/detection/fpcreate.cc
+++ b/src/detection/fpcreate.cc
@@ -834,7 +834,7 @@ void fpSetMaxQueueEvents(FastPatternConfig* fp, unsigned int num_events)
 void fpSetMaxPatternLen(FastPatternConfig* fp, unsigned int max_len)
 {
     if (fp->max_pattern_len != 0)
-        ParseWarning("maximum pattern length redefined from %d to %d.\n",
+        ParseWarning(WARN_CONF, "maximum pattern length redefined from %d to %d.\n",
             fp->max_pattern_len, max_len);
 
     fp->max_pattern_len = max_len;
@@ -1000,10 +1000,12 @@ void set_fp_content(OptTreeNode* otn)
         if ( tmp->fp )
         {
             if ( pmd )
-                ParseWarning("only one fast_pattern content per rule allowed - ignored");
+                ParseWarning(WARN_RULES,
+                    "only one fast_pattern content per rule allowed - ignored");
 
             else if ( !pmd_can_be_fp(tmp, curr_cat) )
-                ParseWarning("content ineligible for fast_pattern matcher - ignored");
+                ParseWarning(WARN_RULES,
+                    "content ineligible for fast_pattern matcher - ignored");
 
             else
                 pmd = tmp;
@@ -2253,7 +2255,7 @@ void fpBuildServicePortGroups(
                     FatalError("Could not AddProtocolReference\n");
 
                 else if ( id >= MAX_PROTOCOL_ORDINAL )
-                    ParseWarning("protocol-ordinal=%d exceeds "
+                    ParseWarning(WARN_RULES, "protocol-ordinal=%d exceeds "
                         "limit of %d for service=%s\n",id,MAX_PROTOCOL_ORDINAL,srvc);
             }
             else if ( id > 0 )

diff --git a/src/detection/signature.cc b/src/detection/signature.cc
index 56e5dd958b4f41d7140f507a120bdbb8f3d49d67..8d67f017383743ff6cdfc2a8f7b71d0353b25c5a 100644 (file)
--- a/src/detection/signature.cc
+++ b/src/detection/signature.cc
@@ -152,7 +152,7 @@ void AddClassification(
         /* dup check */
         if (strcasecmp(current->type, type) == 0)
         {
-            ParseWarning(
+            ParseWarning(WARN_CONF,
                 "Duplicate classification \"%s\""
                 "found, ignoring this line", type);
             return;

diff --git a/src/file_api/file_mime_config.cc b/src/file_api/file_mime_config.cc
index acd35cc234efa4e3f4ace2332ca64a1402d29f2f..f2f3af86a9b88fcee6d8abd4cd3d902053e7c876 100644 (file)
--- a/src/file_api/file_mime_config.cc
+++ b/src/file_api/file_mime_config.cc
@@ -104,7 +104,7 @@ static int ProcessDecodeDepth(
             {
                 decode_depth = decode_depth - 4;
             }
-            ParseWarning(
+            ParseWarning(WARN_CONF,
                 "%s: 'b64_decode_depth' is not a multiple of 4. "
                 "Rounding up to the next multiple of 4. The new 'b64_decode_depth' is %d.\n",
                 preproc_name, decode_depth);

diff --git a/src/helpers/process.cc b/src/helpers/process.cc
index 40b043c063aed196f266850dad783ae0f14fa2fc..3ee103bd12279bb531711a6f49e2de4c2ed51982 100644 (file)
--- a/src/helpers/process.cc
+++ b/src/helpers/process.cc
@@ -220,7 +220,7 @@ static int add_signal(int sig, sighandler_t signal_handler, int check_needed)
     }
     else if (check_needed && (SIG_IGN != pre_handler) && (SIG_DFL!= pre_handler))
     {
-        ParseWarning("handler is already installed for signal %d.\n", sig);
+        ParseWarning(WARN_CONF, "handler is already installed for signal %d.\n", sig);
     }
     return 1;
 }

diff --git a/src/ips_options/ips_content.cc b/src/ips_options/ips_content.cc
index f05265c196ce7777abc0ddc1ce783d4f1c2e3bd1..60724591f61f71902bceb525f217a4b675f86168 100644 (file)
--- a/src/ips_options/ips_content.cc
+++ b/src/ips_options/ips_content.cc
@@ -669,7 +669,7 @@ static const Parameter s_params[] =
     { "fast_pattern_offset", Parameter::PT_INT, nullptr, nullptr,
       "number of leading characters of this content the fast pattern matcher should exclude" },
 
-    { "fast_pattern_length", Parameter::PT_INT, nullptr, nullptr,
+    { "fast_pattern_length", Parameter::PT_INT, "1:", nullptr,
       "maximum number of characters from this content the fast pattern matcher should use" },
 
     { "offset", Parameter::PT_STRING, nullptr, nullptr,

diff --git a/src/ips_options/ips_flowbits.cc b/src/ips_options/ips_flowbits.cc
index ace9842e9b498d3a6ec4815382c851a4541e6e7c..e811e52d2336b5941d8be0b34051c9dd10269838 100644 (file)
--- a/src/ips_options/ips_flowbits.cc
+++ b/src/ips_options/ips_flowbits.cc
@@ -1045,14 +1045,14 @@ static void FlowBitsVerify(void)
 
         if ((fb->set > 0) && (fb->isset == 0))
         {
-            if ( snort_conf->logging_flags & LOGGING_FLAG__WARN_FLOWBITS )
-                ParseWarning("flowbits key '%s' is set but not checked.", (char*)n->key);
+            ParseWarning(WARN_FLOWBITS, "flowbits key '%s' is set but not checked.",
+                (char*)n->key);
             unchecked++;
         }
         else if ((fb->isset > 0) && (fb->set == 0))
         {
-            if ( snort_conf->logging_flags & LOGGING_FLAG__WARN_FLOWBITS )
-                ParseWarning("flowbits key '%s' is checked but not ever set.", (char*)n->key);
+            ParseWarning(WARN_FLOWBITS, "flowbits key '%s' is checked but not ever set.",
+                (char*)n->key);
             unset++;
         }
         else if ((fb->set == 0) && (fb->isset == 0))

diff --git a/src/ips_options/ips_replace.cc b/src/ips_options/ips_replace.cc
index 184f0b516dbdeeca631256e12118ba88ae8a1423..57185ec4eea245c4c4dd812260e2544f9016f535 100644 (file)
--- a/src/ips_options/ips_replace.cc
+++ b/src/ips_options/ips_replace.cc
@@ -67,7 +67,7 @@ static bool replace_ok()
     {
         if ( !warned )
         {
-            ParseWarning("payload replacements disabled because DAQ "
+            ParseWarning(WARN_DAQ, "payload replacements disabled because DAQ "
                 " can't replace packets.\n");
             warned = 1;
         }

diff --git a/src/main/modules.cc b/src/main/modules.cc
index e02b0dd5ff6894fbdb8634d0809df38b04f9057a..65af86b0cb4e62bdb6bc69e94906d401646c9c6f 100644 (file)
--- a/src/main/modules.cc
+++ b/src/main/modules.cc
@@ -1713,15 +1713,6 @@ bool RuleStateModule::end(const char*, int idx, SnortConfig* sc)
 // hosts module
 //-------------------------------------------------------------------------
 
-// FIXIT-L these are cloned from ip_module.cc and tcp_module.cc
-
-#define ip_policies \
-    "unknown | first | linux | bsd | bsd_right |last | windows | solaris"
-
-#define tcp_policies \
-    "unknown | first | last | bsd | linux | old-linux | windows | win-2003 | " \
-    "vista | solaris | hpux | hpux10 | irix | macos"
-
 static const Parameter service_params[] =
 {
     { "name", Parameter::PT_STRING, nullptr, nullptr,
@@ -1741,10 +1732,10 @@ static const Parameter hosts_params[] =
     { "ip", Parameter::PT_ADDR, nullptr, "0.0.0.0/32",
       "hosts address / cidr" },
 
-    { "frag_policy", Parameter::PT_ENUM, ip_policies, "linux",
+    { "frag_policy", Parameter::PT_ENUM, IP_POLICIES, IP_POLICY_DEFAULT,
       "defragmentation policy" },
 
-    { "tcp_policy", Parameter::PT_ENUM, tcp_policies, "linux",
+    { "tcp_policy", Parameter::PT_ENUM, TCP_POLICIES, TCP_POLICY_DEFAULT,
       "tcp reassembly policy" },
 
     { "services", Parameter::PT_LIST, service_params, nullptr,
@@ -1779,11 +1770,11 @@ bool HostsModule::set(const char*, Value& v, SnortConfig*)
 
     else if ( v.is("frag_policy") )
     {
-        host->hostInfo.fragPolicy = v.get_long();
+        host->hostInfo.fragPolicy = v.get_long() + 1;
     }
     else if ( v.is("tcp_policy") )
     {
-        host->hostInfo.streamPolicy = v.get_long();
+        host->hostInfo.streamPolicy = v.get_long() + 1;
     }
     else if ( v.is("name") )
         app->protocol = AddProtocolReference(v.get_string());

diff --git a/src/main/snort.h b/src/main/snort.h
index 66ecab1547d9e4eecdd5f9748b565df3ba546e44..6adb43dde0100f4aa809278ee10df6f472dcc192 100644 (file)
--- a/src/main/snort.h
+++ b/src/main/snort.h
@@ -150,8 +150,6 @@ enum LoggingFlag
     LOGGING_FLAG__QUIET           = 0x00000002,      /* -q */
     LOGGING_FLAG__SYSLOG          = 0x00000004,      /* -M */
     LOGGING_FLAG__SHOW_PLUGINS    = 0x00000008,      // --show-plugins
-    LOGGING_FLAG__WARN_FLOWBITS   = 0x00000010,      // --warn-flowbits
-    LOGGING_FLAG__WARN_UNKNOWN    = 0x00000020,      // --warn-unknown
 };
 
 enum TunnelFlags

diff --git a/src/main/snort_config.cc b/src/main/snort_config.cc
index fd02c68619b45cb324f290f3a6285d343382c3f8..840a54d35c42173847b1f7fb13eb8fa6681b9cb3 100644 (file)
--- a/src/main/snort_config.cc
+++ b/src/main/snort_config.cc
@@ -119,7 +119,7 @@ static void init_policy_mode(IpsPolicy* p)
 
         else if (!ScAdapterInlineMode())
         {
-            ParseWarning("adapter is in passive mode; switching policy mode to tap.");
+            ParseWarning(WARN_DAQ, "adapter is in passive mode; switching policy mode to tap.");
             p->policy_mode = POLICY_MODE__PASSIVE;
         }
         break;

diff --git a/src/main/snort_config.h b/src/main/snort_config.h
index 2a28c26ad538003d2722355d76e8b8d8669536c3..7a8f094cd7eb434c8c0a9d9ee27d8c0aab1294b1 100644 (file)
--- a/src/main/snort_config.h
+++ b/src/main/snort_config.h
@@ -79,8 +79,9 @@ struct SnortConfig
 
     //------------------------------------------------------
     // output module stuff
-    int output_flags;
-    int logging_flags;
+    uint32_t output_flags;
+    uint32_t logging_flags;
+    uint32_t warning_flags;
 
     uint8_t log_ipv6_extra;
     uint16_t event_trace_max;

diff --git a/src/main/snort_module.cc b/src/main/snort_module.cc
index de18e0c56d2780a7c8fc0fcba7195855b7a2ae11..59a46615ad103ee79171e6197e74afddd0ed6fd4 100644 (file)
--- a/src/main/snort_module.cc
+++ b/src/main/snort_module.cc
@@ -240,7 +240,7 @@ static const Parameter s_params[] =
       "<filter options> are standard BPF options, as seen in TCPDump" },
 
     { "--c2x", Parameter::PT_STRING, nullptr, nullptr,
-      "output hex for given char" },
+      "output hex for given char (see also --x2c)" },
 
     { "--create-pidfile", Parameter::PT_IMPLIED, nullptr, nullptr,
       "create PID file, even when not in Daemon mode" },
@@ -434,14 +434,32 @@ static const Parameter s_params[] =
     { "--warn-all", Parameter::PT_IMPLIED, nullptr, nullptr,
       "enable all warnings" },
 
+    { "--warn-conf", Parameter::PT_IMPLIED, nullptr, nullptr,
+      "warn about configuration issues" },
+
+    { "--warn-daq", Parameter::PT_IMPLIED, nullptr, nullptr,
+      "warn about DAQ issues, usually related to mode" },
+
     { "--warn-flowbits", Parameter::PT_IMPLIED, nullptr, nullptr,
       "warn about flowbits that are checked but not set and vice-versa" },
 
-    { "--warn-unknown", Parameter::PT_IMPLIED, nullptr, nullptr,
-      "warn about unknown symbols in your config" },
+    { "--warn-hosts", Parameter::PT_IMPLIED, nullptr, nullptr,
+      "warn about host table issues" },
+
+    { "--warn-rules", Parameter::PT_IMPLIED, nullptr, nullptr,
+      "warn about duplicate rules and rule parsing issues" },
+
+    { "--warn-scripts", Parameter::PT_IMPLIED, nullptr, nullptr,
+      "warn about issues discovered while processing Lua scripts" },
+
+    { "--warn-symbols", Parameter::PT_IMPLIED, nullptr, nullptr,
+      "warn about unknown symbols in your Lua config" },
+
+    { "--warn-vars", Parameter::PT_IMPLIED, nullptr, nullptr,
+      "warn about variable definition and usage issues" },
 
     { "--x2c", Parameter::PT_INT, nullptr, nullptr,
-      "output ASCII char for given hex" },
+      "output ASCII char for given hex (see also --c2x)" },
 
     { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
 };
@@ -793,15 +811,31 @@ bool SnortModule::set(const char*, Value& v, SnortConfig* sc)
         help_version(sc, v.get_string());
 
     else if ( v.is("--warn-all") )
-    {
-        sc->logging_flags |= LOGGING_FLAG__WARN_FLOWBITS;
-        sc->logging_flags |= LOGGING_FLAG__WARN_UNKNOWN;
-    }
+        sc->warning_flags = 0xFFFFFFFF;
+
+    else if ( v.is("--warn-conf") )
+        sc->warning_flags |= (1 << WARN_CONF);
+
+    else if ( v.is("--warn-daq") )
+        sc->warning_flags |= (1 << WARN_DAQ);
+
     else if ( v.is("--warn-flowbits") )
-        sc->logging_flags |= LOGGING_FLAG__WARN_FLOWBITS;
+        sc->warning_flags |= (1 << WARN_FLOWBITS);
+
+    else if ( v.is("--warn-hosts") )
+        sc->warning_flags |= (1 << WARN_HOSTS);
+
+    else if ( v.is("--warn-rules") )
+        sc->warning_flags |= (1 << WARN_RULES);
+
+    else if ( v.is("--warn-scripts") )
+        sc->warning_flags |= (1 << WARN_SCRIPTS);
+
+    else if ( v.is("--warn-symbols") )
+        sc->warning_flags |= (1 << WARN_SYMBOLS);
 
-    else if ( v.is("--warn-unknown") )
-        sc->logging_flags |= LOGGING_FLAG__WARN_UNKNOWN;
+    else if ( v.is("--warn-vars") )
+        sc->warning_flags |= (1 << WARN_VARS);
 
     else if ( v.is("--x2c") )
         x2c(v.get_long());

diff --git a/src/managers/module_manager.cc b/src/managers/module_manager.cc
index 17066be10b3bc0d713231b860f45b7cece4c8b7a..c2517b4629224518e6f5be7445f1e5c5d573f019 100644 (file)
--- a/src/managers/module_manager.cc
+++ b/src/managers/module_manager.cc
@@ -400,9 +400,6 @@ static bool ignored(const char* fqn)
 {
     static const char* ignore = nullptr;
 
-    if ( !(snort_conf->logging_flags & LOGGING_FLAG__WARN_UNKNOWN) )
-        return true;
-
     if ( !ignore )
     {
         ignore = getenv("SNORT_IGNORE");
@@ -441,7 +438,7 @@ static bool set_value(const char* fqn, Value& v)
         bool found = set_var(fqn, v);
 
         if ( !found && !ignored(fqn) )
-            ParseWarning("uknown symbol %s", fqn);
+            ParseWarning(WARN_SYMBOLS, "uknown symbol %s", fqn);
         return found;
     }
 

diff --git a/src/managers/script_manager.cc b/src/managers/script_manager.cc
index 52fa21502d3a23ad900b9fef60f3067171623189..50d504f248b2f9ff10797f20a15ef59af1f4b31e 100644 (file)
--- a/src/managers/script_manager.cc
+++ b/src/managers/script_manager.cc
@@ -127,7 +127,7 @@ static bool get_field(lua_State* L, const char* key, int& value)
 
     if ( !lua_isnumber(L, -1) )
     {
-        ParseWarning("%s is not a number", key);
+        ParseWarning(WARN_SCRIPTS, "%s is not a number", key);
         lua_pop(L, 1);
         return false;
     }
@@ -145,7 +145,7 @@ static bool get_field(lua_State* L, const char* key, string& value)
 
     if ( !lua_isstring(L, -1) )
     {
-        ParseWarning("%s is not a string", key);
+        ParseWarning(WARN_SCRIPTS, "%s is not a string", key);
         lua_pop(L, 1);
         return false;
     }
@@ -170,7 +170,7 @@ static void load_script(const char* f)
 
     if ( luaL_loadfile(L, f) )
     {
-        ParseWarning("can't load %s: %s", f, lua_tostring(L, -1));
+        ParseWarning(WARN_SCRIPTS, "can't load %s: %s", f, lua_tostring(L, -1));
         return;
     }
 
@@ -180,7 +180,7 @@ static void load_script(const char* f)
 
     if ( lua_pcall(L, 0, 0, 0) )
     {
-        ParseWarning("can't init %s: %s", f, lua_tostring(L, -1));
+        ParseWarning(WARN_SCRIPTS, "can't init %s: %s", f, lua_tostring(L, -1));
         return;
     }
 
@@ -188,7 +188,7 @@ static void load_script(const char* f)
 
     if ( !lua_istable(L, -1) )
     {
-        ParseWarning("can't get plugin from %s", f);
+        ParseWarning(WARN_SCRIPTS, "can't get plugin from %s", f);
         return;
     }
 

diff --git a/src/network_inspectors/normalize/normalize.cc b/src/network_inspectors/normalize/normalize.cc
index 0708728a94f1c17beb4a83c279e198806b2e01a3..c5df1d592747297a745f5271256517f76e7b6deb 100644 (file)
--- a/src/network_inspectors/normalize/normalize.cc
+++ b/src/network_inspectors/normalize/normalize.cc
@@ -187,7 +187,7 @@ bool Normalizer::configure(SnortConfig*)
     // FIXIT-L norm needs a nap policy mode
     if ( mode == POLICY_MODE__PASSIVE )
     {
-        ParseWarning("normalizations disabled because not inline.");
+        ParseWarning(WARN_DAQ, "normalizations disabled because not inline.");
         config.normalizer_flags = 0;
         return true;
     }

diff --git a/src/packet_io/active.cc b/src/packet_io/active.cc
index efe2e4c454529696854f0905a7ea8d995b59e5bc..f55fd22a024553bf1f470ad0770628dc1b967a98 100644 (file)
--- a/src/packet_io/active.cc
+++ b/src/packet_io/active.cc
@@ -111,7 +111,7 @@ int Active_Init(SnortConfig* sc)
     {
         if ( ScReadMode() || Active_Open(sc->respond_device) )
         {
-            ParseWarning("active responses disabled since DAQ "
+            ParseWarning(WARN_DAQ, "active responses disabled since DAQ "
                 "can't inject packets.");
 #ifndef REG_TEST
             s_attempts = 0;

diff --git a/src/packet_io/sfdaq.cc b/src/packet_io/sfdaq.cc
index 8c3e87caf7fb3853fd08172b7114750b3f5c8b85..d4f92a757cd0cd7fa5ea30b6db0617fb7764b55b 100644 (file)
--- a/src/packet_io/sfdaq.cc
+++ b/src/packet_io/sfdaq.cc
@@ -202,21 +202,21 @@ static int DAQ_ValidateInstance()
         return 1;
 
     if ( !(caps & DAQ_CAPA_BLOCK) )
-        ParseWarning("inline mode configured but DAQ can't block packets.\n");
+        ParseWarning(WARN_DAQ, "inline mode configured but DAQ can't block packets.\n");
 
 #if 0
     // this is checked in normalize.c and sp_respond.c
     // and warned/disabled only if it was configured
     if ( !(caps & DAQ_CAPA_REPLACE) )
     {
-        ParseWarning("normalizations/replacements disabled "
+        ParseWarning(WARN_DAQ, "normalizations/replacements disabled "
             " because DAQ can't replace packets.\n");
     }
 
     // this is checked in spp_stream.c and active.c
     // and warned/disabled only if it was configured
     if ( !(caps & DAQ_CAPA_INJECT) )
-        ParseWarning("inline mode configured but DAQ can't "
+        ParseWarning(WARN_DAQ, "inline mode configured but DAQ can't "
             "inject packets.\n");
 #endif
 

diff --git a/src/parser/parse_conf.cc b/src/parser/parse_conf.cc
index 04197abdcaa305280b35cce55298d22fdade08fe..3f8d41b9de84da6389400fc3d0942c28129ea732 100644 (file)
--- a/src/parser/parse_conf.cc
+++ b/src/parser/parse_conf.cc
@@ -168,7 +168,7 @@ void ParseIpVar(SnortConfig* sc, const char* var, const char* val)
             return;
 
         case SFIP_DUPLICATE:
-            ParseWarning("Var '%s' redefined.", var);
+            ParseWarning(WARN_VARS, "Var '%s' redefined.", var);
             break;
 
         case SFIP_CONFLICT:

diff --git a/src/parser/parse_rule.cc b/src/parser/parse_rule.cc
index ca3182bd9bf74649cb6ced467f7d5de0146a42d6..02cf2fc7520c33977c07c1de5d8814d46619b920 100644 (file)
--- a/src/parser/parse_rule.cc
+++ b/src/parser/parse_rule.cc
@@ -1161,7 +1161,7 @@ static int mergeDuplicateOtn(
         //OTN is for new policy group, salvage RTN
         deleteRtnFromOtn(otn_new);
 
-        ParseWarning(
+        ParseWarning(WARN_RULES,
             "%d:%d duplicates previous rule. Using revision %d.",
             otn_cur->sigInfo.generator, otn_cur->sigInfo.id, otn_cur->sigInfo.rev);
 
@@ -1207,7 +1207,7 @@ static int mergeDuplicateOtn(
         }
         else
         {
-            ParseWarning(
+            ParseWarning(WARN_RULES,
                 "%d:%d duplicates previous rule. Using revision %d.",
                 otn_new->sigInfo.generator, otn_new->sigInfo.id, otn_new->sigInfo.rev);
         }

diff --git a/src/parser/parse_stream.cc b/src/parser/parse_stream.cc
index b7c8c7337cf13e2b701fc55a0d6accabcb65e785..7d8f90ea189a1fecb388a8dd9107b752f7783e92 100644 (file)
--- a/src/parser/parse_stream.cc
+++ b/src/parser/parse_stream.cc
@@ -206,7 +206,7 @@ static TokenType get_token(
             else if ( c == '\\' )
                 state = esc ? 4 : 16;
             else if ( c == '\n' )
-                ParseWarning("line break in string on line %d\n", lines-1);
+                ParseWarning(WARN_RULES, "line break in string on line %d\n", lines-1);
             else
                 s += c;
             break;
@@ -221,7 +221,7 @@ static TokenType get_token(
             break;
         case 5:  // unquoted escape
             if ( c != '\n' && c != '\r' )
-                ParseWarning("invalid escape on line %d\n", lines);
+                ParseWarning(WARN_RULES, "invalid escape on line %d\n", lines);
             state = 0;
             break;
         case 6:  // token
@@ -313,7 +313,7 @@ static TokenType get_token(
                 state = 11;
             else if ( c == '\n' )
             {
-                ParseWarning("line break in commented string on line %d\n", lines-1);
+                ParseWarning(WARN_RULES, "line break in commented string on line %d\n", lines-1);
                 state = 11;
             }
             break;
@@ -325,7 +325,7 @@ static TokenType get_token(
             }
             else
             {
-                ParseWarning("\\x used with no following hex digits", lines-1);
+                ParseWarning(WARN_RULES, "\\x used with no following hex digits", lines-1);
                 s += c;
                 state = 3;
             }

diff --git a/src/parser/parser.cc b/src/parser/parser.cc
index 931b65e775a31350689375b7c0055ae9af539be3..755bee4bc8ed609aeea502bb751d463d2eaca3c9 100644 (file)
--- a/src/parser/parser.cc
+++ b/src/parser/parser.cc
@@ -607,6 +607,7 @@ SnortConfig* ParseSnortConf(const SnortConfig* boot_conf)
     SnortConfig* sc = SnortConfNew();
 
     sc->logging_flags = boot_conf->logging_flags;
+    sc->warning_flags = boot_conf->warning_flags;
     VarNode* tmp = boot_conf->var_list;
 
     const char* fname = get_snort_conf();
@@ -1123,8 +1124,11 @@ void ParseError(const char* format, ...)
     parse_errors++;
 }
 
-void ParseWarning(const char* format, ...)
+void ParseWarning(WarningGroup wg, const char* format, ...)
 {
+    if ( !(snort_conf->warning_flags & (1 << wg)) )
+        return;
+
     char buf[STD_BUF+1];
     va_list ap;
 

diff --git a/src/parser/parser.h b/src/parser/parser.h
index e829296030eb5e772e9df2d229f8e58fdcc3bc2a..7b9bc10bbf5522b4ea6a098bc2848f83f13dc2cb 100644 (file)
--- a/src/parser/parser.h
+++ b/src/parser/parser.h
@@ -68,9 +68,16 @@ void ConfigureSideChannelModules(SnortConfig*);
 
 SO_PUBLIC NORETURN void ParseAbort(const char*, ...);
 SO_PUBLIC void ParseError(const char*, ...);
-SO_PUBLIC void ParseWarning(const char*, ...);
 SO_PUBLIC void ParseMessage(const char*, ...);
 
+enum WarningGroup
+{
+    WARN_DAQ, WARN_CONF, WARN_VARS, WARN_SYMBOLS, WARN_SCRIPTS,
+    WARN_HOSTS, WARN_RULES, WARN_FLOWBITS, WARN_MAX
+};
+
+SO_PUBLIC void ParseWarning(WarningGroup, const char*, ...);
+
 int ParseBool(const char* arg);
 
 int addRtnToOtn(struct OptTreeNode*, RuleTreeNode*);

diff --git a/src/parser/vars.cc b/src/parser/vars.cc
index 16965618d3b45668c1e7ede89d0c2f01c7f707a2..dbca6dda6bf6ffc39167dfdc5ff7b2b602878ea2 100644 (file)
--- a/src/parser/vars.cc
+++ b/src/parser/vars.cc
@@ -196,7 +196,7 @@ int PortVarDefine(SnortConfig* sc, const char* name, const char* s)
     }
     else if ( rstat > 0 )
     {
-        ParseWarning("PortVar '%s', already defined.", po->name);
+        ParseWarning(WARN_VARS, "PortVar '%s', already defined.", po->name);
     }
 
 #if 0
@@ -522,7 +522,7 @@ VarEntry* VarDefine(
                 break;
 
             case SFIP_DUPLICATE:
-                ParseWarning("Var '%s' redefined.", name);
+                ParseWarning(WARN_VARS, "Var '%s' redefined.", name);
                 break;
 
             case SFIP_CONFLICT:
@@ -612,7 +612,7 @@ VarEntry* VarDefine(
                 free(p->value);
 
             p->value = SnortStrdup(value);
-            ParseWarning("Var '%s' redefined\n", p->name);
+            ParseWarning(WARN_VARS, "Var '%s' redefined\n", p->name);
             return p;
         }
 

diff --git a/src/service_inspectors/ftp_telnet/telnet.cc b/src/service_inspectors/ftp_telnet/telnet.cc
index b3dd3adb23edac80eea503f212f1ebe5b0dabf6c..ab57720ae1f17ebfc9a65220a867e32ec684de86 100644 (file)
--- a/src/service_inspectors/ftp_telnet/telnet.cc
+++ b/src/service_inspectors/ftp_telnet/telnet.cc
@@ -59,14 +59,14 @@ static int TelnetCheckConfigs(SnortConfig*, void* pData)
     if ((telnet_config->ayt_threshold > 0) &&
         !telnet_config->normalize)
     {
-        ParseWarning("telnet configuration check: using an "
+        ParseWarning(WARN_CONF, "telnet configuration check: using an "
             "AreYouThere threshold requires telnet normalization to be "
             "turned on.\n");
     }
     if ( telnet_config->detect_encrypted &&
         !telnet_config->normalize)
     {
-        ParseWarning("telnet configuration check: checking for "
+        ParseWarning(WARN_CONF, "telnet configuration check: checking for "
             "encrypted traffic requires telnet normalization to be turned on.\n");
     }
 

diff --git a/src/stream/ip/ip_module.cc b/src/stream/ip/ip_module.cc
index c68ae42712c94e44c367a99f250c49dd4f143fc4..29376ab7a3e9879f22dbe3155a34c5ddba4a5d08 100644 (file)
--- a/src/stream/ip/ip_module.cc
+++ b/src/stream/ip/ip_module.cc
@@ -79,10 +79,6 @@ FragEngine::FragEngine()
 // stream_ip module
 //-------------------------------------------------------------------------
 
-// sequence must match FRAG_POLICY_* enum
-#define policies  \
-    "first | linux | bsd | bsd_right | last | windows | solaris"
-
 static const RuleMap stream_ip_rules[] =
 {
     { DEFRAG_IPOPTIONS, DEFRAG_IPOPTIONS_STR },
@@ -114,7 +110,7 @@ static const Parameter s_params[] =
     { "min_ttl", Parameter::PT_INT, "1:255", "1",
       "discard fragments with ttl below the minimum" },
 
-    { "policy", Parameter::PT_ENUM, policies, "linux",
+    { "policy", Parameter::PT_ENUM, IP_POLICIES, IP_POLICY_DEFAULT,
       "fragment reassembly policy" },
 
     { "session_timeout", Parameter::PT_INT, "1:86400", "30",

diff --git a/src/stream/ip/stream_ip.h b/src/stream/ip/stream_ip.h
index fd6a9e4c4eb9a744489cd91281087df56f587af1..0c4dcfb1cdbbe8a338acce9264fb47c72d55a1e1 100644 (file)
--- a/src/stream/ip/stream_ip.h
+++ b/src/stream/ip/stream_ip.h
@@ -29,7 +29,7 @@
 #include "flow/flow.h"
 
 /* engine-based defragmentation policy enums */
-// must update parameter in defrag_module.cc if this changes
+// must update stream_api.h::IP_POLICIES if this changes
 enum
 {
     FRAG_POLICY_FIRST = 1,

diff --git a/src/stream/stream_api.h b/src/stream/stream_api.h
index 9af18721df98631cb41c2e770242a1429c1f51c5..660a304877e1827aa99479a3335e5195259b44d0 100644 (file)
--- a/src/stream/stream_api.h
+++ b/src/stream/stream_api.h
@@ -51,6 +51,18 @@
 #define SSN_DIR_FROM_RESPONDER 0x02
 #define SSN_DIR_BOTH           0x03
 
+// sequence must match FRAG_POLICY_* enum in stream_ip.h (1-based)
+#define IP_POLICIES  \
+     "first | linux | bsd | bsd-right | last | windows | solaris"
+
+// sequence must match STREAM_POLICY_* defines in tcp_session.cc (1-based)
+#define TCP_POLICIES \
+    "first | last | linux | old-linux | bsd | macos | solaris | irix | " \
+    "hpux11 | hpux10 | windows | win-2003 | vista | proxy"
+
+#define IP_POLICY_DEFAULT "linux"
+#define TCP_POLICY_DEFAULT "bsd"
+
 class Flow;
 
 typedef int (* LogFunction)(Flow*, uint8_t** buf, uint32_t* len, uint32_t* type);

diff --git a/src/stream/tcp/tcp_module.cc b/src/stream/tcp/tcp_module.cc
index a3f0b548a8e24d292010092c436af74c3ff99545..a0d565ee7dd82c8a539a52eb16276eb0d6a1e280 100644 (file)
--- a/src/stream/tcp/tcp_module.cc
+++ b/src/stream/tcp/tcp_module.cc
@@ -72,11 +72,6 @@ using namespace std;
 #define STREAM_TCP_NO_3WHS_STR \
     "TCP session without 3-way handshake"
 
-// sequence must match STREAM_POLICY_* and REASSEMBLY_POLICY_* defines
-#define policies \
-    "first | last | linux | old-linux | bsd | macos | solaris | irix | " \
-    "hpux | hpux10 | windows | win-2003 | vista | proxy"
-
 static const Parameter stream_tcp_small_params[] =
 {
     { "count", Parameter::PT_INT, "0:2048", "0",
@@ -119,7 +114,7 @@ static const Parameter s_params[] =
     { "max_pdu", Parameter::PT_INT, "1460:63780", "16384",
       "maximum reassembled PDU size" },
 
-    { "policy", Parameter::PT_ENUM, policies, "linux",
+    { "policy", Parameter::PT_ENUM, TCP_POLICIES, TCP_POLICY_DEFAULT,
       "determines operating system characteristics like reassembly" },
 
     { "reassemble_async", Parameter::PT_BOOL, nullptr, "true",

diff --git a/src/stream/tcp/tcp_session.cc b/src/stream/tcp/tcp_session.cc
index ebff01d79adefdfc516aa2ea7e11f6d1614fac26..6f1e5dd144af5e1bc97593858d1b90cc67214eb8 100644 (file)
--- a/src/stream/tcp/tcp_session.cc
+++ b/src/stream/tcp/tcp_session.cc
@@ -248,6 +248,7 @@ THREAD_LOCAL Memcap* tcp_memcap = nullptr;
 #define STREAM_MAX_FLUSH_FACTOR 2048
 
 /* target-based policy types */
+// changes to this enum require changes to stream_api.h::TCP_POLICIES
 #define STREAM_POLICY_FIRST       1
 #define STREAM_POLICY_LAST        2
 #define STREAM_POLICY_LINUX       3
@@ -423,17 +424,17 @@ static const char* const reassembly_policy_names[] =
     "first",
     "last",
     "linux",
-    "old linux",
+    "old-linux",
     "bsd",
     "macos",
-    "windows",
     "solaris",
     "irix",
     "hpux11",
     "hpux10",
     "windows",
     "win-2003",
-    "vista"
+    "vista",
+    "proxy"
 };
 
 #ifdef DEBUG_STREAM_EX

diff --git a/src/target_based/sftarget_reader.cc b/src/target_based/sftarget_reader.cc
index a6292ff6b4776069a28f9665429a0dcb3b18b036..f0689fe54affe5c74c64f7d3a0f03a3cdcc8dfb8 100644 (file)
--- a/src/target_based/sftarget_reader.cc
+++ b/src/target_based/sftarget_reader.cc
@@ -264,7 +264,7 @@ int SFAT_AddHostEntryToMap(HostAttributeEntry* host)
         {
             if ( !sfat_insufficient_space_logged )
             {
-                ParseWarning(
+                ParseWarning(WARN_HOSTS,
                     "AttributeTable insertion failed: %d Insufficient "
                     "space in attribute table, only configured to store %d hosts\n",
                     ret, ScMaxAttrHosts());
@@ -275,7 +275,7 @@ int SFAT_AddHostEntryToMap(HostAttributeEntry* host)
         }
         else if ( !sfat_grammar_error_printed )
         {
-            ParseWarning(
+            ParseWarning(WARN_HOSTS,
                 "AttributeTable insertion failed: %d '%s'\n",
                 ret, rt_error_messages[ret]);
             sfat_grammar_error_printed = true;