reload and max_pdu changes

diff --git a/ChangeLog b/ChangeLog
index 9c008baf1458fb4e8286f32da3d139ff68d90805..8888392d0011456277199460ae574240cc900187 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -5,6 +5,10 @@
 -- misc FIXITs
 -- converted wizard to fully stateful
 -- implemented paf rescan upon auto service id
+-- changed StreamSplitter::max() from uint32_t to unsigned
+-- changed stream_tcp.paf_max to max_pdu
+-- added parse errors for module begin()/end() fails
+-- changed reload to not fatal on parse errors
 
 120
 -- tweaked --help!

diff --git a/configure.ac b/configure.ac
index 799dacc66c377e2e537acfc885690ba156f2f4b2..b9114dda0e1142aecb054616b2e4913814027935 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -25,7 +25,7 @@
 # initialization
 #--------------------------------------------------------------------------
 
-AC_INIT([snort], [2.10.120])
+AC_INIT([snort], [2.10.121])
 AC_PREREQ([2.68])
 
 AC_CONFIG_SRCDIR([src/main.h])

diff --git a/src/actions/act_reject.cc b/src/actions/act_reject.cc
index fba74b6cf05f617c450b49286e22031161c6f700..92fbb740a0d4315d9f823c9f4b24458f0009dcc3 100644 (file)
--- a/src/actions/act_reject.cc
+++ b/src/actions/act_reject.cc
@@ -155,7 +155,6 @@ public:
     RejectModule() : Module(s_name, s_help, s_params) { };
 
     bool begin(const char*, int, SnortConfig*);
-    bool end(const char*, int, SnortConfig*);
     bool set(const char*, Value&, SnortConfig*);
 
     ProfileStats* get_profile() const
@@ -170,11 +169,6 @@ bool RejectModule::begin(const char*, int, SnortConfig*)
     return true;
 }
 
-bool RejectModule::end(const char*, int, SnortConfig*)
-{
-    return ( flags != 0 );
-}
-
 static const int rst[] =
 {
     REJ_RST_SRC,

diff --git a/src/framework/module.h b/src/framework/module.h
index 60f9b1489c35058f43c032dba2bf1b4f655fde4b..4fdd9c59265c5df8343bf6e5ad2170b402fa87a5 100644 (file)
--- a/src/framework/module.h
+++ b/src/framework/module.h
@@ -18,7 +18,6 @@
 */
 // module.h author Russ Combs <rucombs@cisco.com>
 
-// FIXIT-H add optional default config to modules
 // FIXIT-M add trace param(s)
 // FIXIT-M add memcap related
 // FIXIT-L add set_default method

diff --git a/src/main.cc b/src/main.cc
index 95e0a8814eaf727d2d300e41cc75cc343829c16b..bc3b589083a5542da9077446a67b4bedee0e0180 100644 (file)
--- a/src/main.cc
+++ b/src/main.cc
@@ -287,13 +287,14 @@ int main_reload_config(lua_State*)
     }
     request.respond(".. reloading configuration\n");
     SnortConfig* old = snort_conf;
-    SnortConfig* sc = reload_config();
+    SnortConfig* sc = get_reload_config();
 
     if ( !sc )
     {
         request.respond("== reload failed\n");
         return 0;
     }
+    proc_stats.conf_reloads++;
     request.respond(".. swapping configuration\n");
     swapper = new Swapper(old, sc);
 
@@ -632,7 +633,7 @@ static bool set_mode()
 
     if ( int k = get_parse_errors() )
     {
-        ParseAbort("see prior %d errors", k);
+        FatalError("see prior %d errors\n", k);
         return false;
     }
     if ( ScTestMode() ||

diff --git a/src/main/shell.cc b/src/main/shell.cc
index f94feaf0eb1eff829a6ab551c5961acce4448697..9ba6583cd91d35772d9500accd5e17d79284f1ba 100644 (file)
--- a/src/main/shell.cc
+++ b/src/main/shell.cc
@@ -105,7 +105,10 @@ static void config_lua(
     run_config(L);
 
     if ( int k = ModuleManager::get_errors() )
-        FatalError("see prior %d errors\n", k);
+    {
+        if ( snort_is_starting() )
+            FatalError("see prior %d errors\n", k);
+    }
 }
 
 //-------------------------------------------------------------------------

diff --git a/src/main/snort.cc b/src/main/snort.cc
index 78c97c994aa525ec885fd5fb4897715ebc7400e8..441a8666d712dec6070e0adcf5cb63b9bd729e0e 100644 (file)
--- a/src/main/snort.cc
+++ b/src/main/snort.cc
@@ -136,6 +136,9 @@ static void SnortCleanup();
 // utility
 //-------------------------------------------------------------------------
 
+bool snort_is_starting()
+{ return snort_initializing; }
+
 #if 0
 #ifdef HAVE_DAQ_ACQUIRE_WITH_META
 static int MetaCallback(
@@ -165,7 +168,7 @@ static void SetupMetadataCallback(void)  // FIXDAQ
 #endif
 
 #if 0
-// FIXIT-H restart foo
+// FIXIT-L restart foo
 static void restart()
 {
     int daemon_mode = ScDaemonMode();
@@ -440,9 +443,6 @@ void snort_setup(int argc, char* argv[])
     InitGroups(ScUid(), ScGid());
     SnortUnprivilegedInit();
 
-    if ( int k = get_parse_errors() )
-        FatalError("see prior %d errors\n", k);
-
     set_quick_exit(false);
 }
 
@@ -566,14 +566,15 @@ void snort_cleanup()
 
 // FIXIT-M refactor this so startup and reload call the same core function to
 // instantiate things that can be reloaded
-static SnortConfig * get_reload_config(void)
+SnortConfig* get_reload_config()
 {
-    SnortConfig *sc = ParseSnortConf(snort_cmd_line_conf);
+    ModuleManager::reset_errors();
 
+    SnortConfig *sc = ParseSnortConf(snort_cmd_line_conf);
     sc = MergeSnortConfs(snort_cmd_line_conf, sc);
     init_policy(sc);
 
-    if (VerifyReload(sc) == -1)
+    if ( ModuleManager::get_errors() || VerifyReload(sc) == -1 )
     {
         SnortConfFree(sc);
         return NULL;
@@ -592,7 +593,7 @@ static SnortConfig * get_reload_config(void)
         return NULL;
     }
 
-    FlowbitResetCounts();
+    FlowbitResetCounts();  // FIXIT-L updates global hash, put in sc
     ParseRules(sc);
 
     // FIXIT-L see SnortInit() on config printing
@@ -605,11 +606,12 @@ static SnortConfig * get_reload_config(void)
 
     /* Need to do this after dynamic detection stuff is initialized, too */
     IpsManager::verify(sc);
-    ModuleManager::load_commands(snort_conf);
+    ModuleManager::load_commands(sc);
 
     if ((sc->file_mask != 0) && (sc->file_mask != snort_conf->file_mask))
         umask(sc->file_mask);
 
+    // FIXIT-L is this still needed?
     /* Transfer any user defined rule type outputs to the new rule list */
     {
         RuleListNode *cur = snort_conf->rule_lists;
@@ -648,18 +650,6 @@ static SnortConfig * get_reload_config(void)
     return sc;
 }
 
-SnortConfig* reload_config()
-{
-    SnortConfig* new_conf = get_reload_config();
-
-    if ( new_conf )
-    {
-        proc_stats.conf_reloads++;
-        snort_conf = new_conf;
-    }
-    return new_conf;
-}
-
 //-------------------------------------------------------------------------
 // runtime foo
 //-------------------------------------------------------------------------

diff --git a/src/main/snort.h b/src/main/snort.h
index 1fa786e9a44998ac208dc5793cfffa860b81b780..5beb2697365b0f58ddee212322454bb05f4f3374 100644 (file)
--- a/src/main/snort.h
+++ b/src/main/snort.h
@@ -46,11 +46,12 @@ struct IpsPolicy;
 struct _daq_pkthdr;
 typedef _daq_pkthdr DAQ_PktHdr_t;
 
-
-SnortConfig* reload_config();
+SnortConfig* get_reload_config();
 void snort_setup(int argc, char* argv[]);
 void snort_cleanup();
 
+bool snort_is_starting();
+
 void snort_thread_init(const char* intf);
 void snort_thread_term();
 

diff --git a/src/managers/module_manager.cc b/src/managers/module_manager.cc
index e2c96be0dd065623653ed474263a8f355b6531f4..e324ef8d23ad40028471282fba1d0adf61438df0 100644 (file)
--- a/src/managers/module_manager.cc
+++ b/src/managers/module_manager.cc
@@ -366,7 +366,11 @@ SO_PUBLIC bool open_table(const char* s, int idx)
         s_current = key;
     }
 
-    m->begin(s, idx, s_config);
+    if ( !m->begin(s, idx, s_config) )
+    {
+        ParseError("can't open %s", m->get_name());
+        return false;
+    }
     return true;
 }
 
@@ -377,7 +381,11 @@ SO_PUBLIC void close_table(const char* s, int idx)
 
     if ( ModHook* h = get_hook(key.c_str()) )
     {
-        h->mod->end(s, idx, s_config);
+        if ( !h->mod->end(s, idx, s_config) )
+        {
+            ParseError("can't close %s", h->mod->get_name());
+            return;
+        }
 
         if ( !idx && h->api && (key == s) )
             PluginManager::instantiate(h->api, h->mod, s_config);
@@ -458,12 +466,11 @@ const char* ModuleManager::get_current_module()
 void ModuleManager::set_config(SnortConfig* sc)
 { s_config = sc; }
 
+void ModuleManager::reset_errors()
+{ s_errors = 0; }
+
 unsigned ModuleManager::get_errors()
-{
-    unsigned err = s_errors;
-    s_errors = 0;
-    return err;
-}
+{ return s_errors; }
 
 void ModuleManager::list_modules()
 {

diff --git a/src/managers/module_manager.h b/src/managers/module_manager.h
index 9e6b39a970fb403d373ce570077c690180992479..1c322d277488384cddb56daaaafff2fcc69eb1e9 100644 (file)
--- a/src/managers/module_manager.h
+++ b/src/managers/module_manager.h
@@ -50,6 +50,8 @@ public:
     static void load_commands(SnortConfig*);
     static void load_rules(SnortConfig*);
     static void set_config(SnortConfig*);
+
+    static void reset_errors();
     static unsigned get_errors();
 
     static void dump_stats(SnortConfig*);

diff --git a/src/managers/snort_config.lua b/src/managers/snort_config.lua
index 5118f1b9d07b58b39434137fad40b699375014d3..26e17547fb9b914e7dd7b8d92162a035ea40428a 100644 (file)
--- a/src/managers/snort_config.lua
+++ b/src/managers/snort_config.lua
@@ -16,6 +16,7 @@
 -- along with this program; if not, write to the Free Software
 -- Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 ---------------------------------------------------------------------------
+-- snort_config.lua author Russ Combs <rucombs@cisco.com>
 
 ---------------------------------------------------------------------------
 -- Snort uses this to configure Lua settings into C++

diff --git a/src/parser/parser.cc b/src/parser/parser.cc
index d5e23be3b7488a7e6347161a271f3f97388261d5..b941655a93a0bb36c7827b87bc58e588e09a2ee7 100644 (file)
--- a/src/parser/parser.cc
+++ b/src/parser/parser.cc
@@ -597,7 +597,6 @@ static void parse_file(SnortConfig* sc, Shell* sh)
 SnortConfig * ParseSnortConf(const SnortConfig* boot_conf)
 {
     SnortConfig *sc = SnortConfNew();
-    snort_conf = sc;
 
     sc->logging_flags = boot_conf->logging_flags;
     VarNode* tmp = boot_conf->var_list;

diff --git a/src/service_inspectors/nhttp_inspect/nhttp_stream_splitter.h b/src/service_inspectors/nhttp_inspect/nhttp_stream_splitter.h
index 9700f30c43f931af767b80e9c917037cccb9d6a2..b658b632ffb73bbeca7b4db46b7ef46ccf912def 100644 (file)
--- a/src/service_inspectors/nhttp_inspect/nhttp_stream_splitter.h
+++ b/src/service_inspectors/nhttp_inspect/nhttp_stream_splitter.h
@@ -43,7 +43,7 @@ public:
     const StreamBuffer* reassemble(Flow* flow, unsigned total, unsigned offset, const uint8_t* data, unsigned len,
        uint32_t flags, unsigned& copied);
     bool is_paf() { return true; };
-    uint32_t max() { return paf_max; };
+    unsigned max() { return paf_max; };
 private:
     void prepare_flush(NHttpFlowData* session_data, uint32_t* flush_offset, NHttpEnums::SourceId source_id,
        NHttpEnums::SectionType section_type, bool tcp_close, uint64_t infractions, uint32_t num_octets);
@@ -52,7 +52,7 @@ private:
     NHttpInspect* const my_inspector;
 
     uint8_t *section_buffer = nullptr;
-    uint32_t paf_max = 63780;
+    unsigned paf_max = 63780;
 };
 
 #endif

diff --git a/src/service_inspectors/rpc_decode/rpc_decode.cc b/src/service_inspectors/rpc_decode/rpc_decode.cc
index 937c7a8399e4fb832781463b232417611f38b005..f05422e452bd6003610a783fe78648a760052054 100644 (file)
--- a/src/service_inspectors/rpc_decode/rpc_decode.cc
+++ b/src/service_inspectors/rpc_decode/rpc_decode.cc
@@ -980,7 +980,7 @@ public:
         uint32_t, uint32_t*)
     { return SEARCH; };
 
-    uint32_t max() { return MIN_CALL_BODY_SZ; };
+    unsigned max() { return MIN_CALL_BODY_SZ; };
 };
 
 //-------------------------------------------------------------------------

diff --git a/src/stream/stream_splitter.cc b/src/stream/stream_splitter.cc
index 38272cf4bd53608271aeef362e7dc70652883261..4207420f25f403c379afa5f1a18376e7bc45f55f 100644 (file)
--- a/src/stream/stream_splitter.cc
+++ b/src/stream/stream_splitter.cc
@@ -29,8 +29,8 @@
 static THREAD_LOCAL uint8_t pdu_buf[65536];
 static THREAD_LOCAL StreamBuffer str_buf;
 
-uint32_t StreamSplitter::max()
-{ return 16384; }  // FIXIT-H make default configurable
+unsigned StreamSplitter::max()
+{ return 16384; }  // subclasses should override this
 
 const StreamBuffer* StreamSplitter::reassemble(
     Flow*, unsigned, unsigned offset, const uint8_t* p,

diff --git a/src/stream/stream_splitter.h b/src/stream/stream_splitter.h
index 8a3eeb2cad66002175beea527c59d5e604fae946..28fa0e4f8203a268b858f2e0e7bea2ed4bdc326f 100644 (file)
--- a/src/stream/stream_splitter.h
+++ b/src/stream/stream_splitter.h
@@ -39,7 +39,7 @@ class SO_PUBLIC StreamSplitter
 public:
     virtual ~StreamSplitter() { };
 
-    enum Status // FIXIT-H move inside StreamSplitter
+    enum Status
     {
         ABORT,  // non-paf operation
         START,  // internal use only
@@ -67,7 +67,7 @@ public:
     );
 
     virtual bool is_paf() { return false; };
-    virtual uint32_t max();
+    virtual unsigned max();
 
     virtual void reset() { };
     virtual void update() { };
@@ -79,6 +79,7 @@ protected:
     StreamSplitter(bool b) { c2s = b; };
 
 private:
+    static unsigned s_max;
     bool c2s;
 };
 

diff --git a/src/stream/tcp/tcp_module.cc b/src/stream/tcp/tcp_module.cc
index 504451c39dd9d225196cbd9e08f3214962a5beba..f5eceba69f9ab631c044cdc09154fe6da5246bbe 100644 (file)
--- a/src/stream/tcp/tcp_module.cc
+++ b/src/stream/tcp/tcp_module.cc
@@ -116,7 +116,7 @@ static const Parameter s_params[] =
     { "overlap_limit", Parameter::PT_INT, "0:255", "0",
       "maximum number of allowed overlapping segments per session" },
 
-    { "paf_max", Parameter::PT_INT, "1460:63780", "16384",
+    { "max_pdu", Parameter::PT_INT, "1460:63780", "16384",
       "maximum reassembled PDU size" },
 
     { "policy", Parameter::PT_ENUM, policies, "linux",
@@ -274,7 +274,7 @@ bool StreamTcpModule::set(const char*, Value& v, SnortConfig*)
     else if ( v.is("max_window") )
         config->max_window = v.get_long();
 
-    else if ( v.is("paf_max") )
+    else if ( v.is("max_pdu") )
         config->paf_max = v.get_long();
 
     else if ( v.is("policy") )