refactored flow state

diff --git a/ChangeLog b/ChangeLog
index cd4b5c200ca3f59bd50326a7cf0939b06459a3a3..ef4905a25cd7bd1c06e03dfeb773ef608ca1b3df 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -8,6 +8,7 @@
 -- ip defrag fixes
 -- refactored splitter fallback
 -- fix binder.use.service
+-- refactored flow state
 
 125
 -- discovered can't catch exceptions thrown from Lua to C++; need to

diff --git a/src/flow/flow.cc b/src/flow/flow.cc
index 1da4f0e6374c0ead651ff9a5d821d75d74c519bd..1c8f4695c0e4f6875afde63576afb2dc3743912b 100644 (file)
--- a/src/flow/flow.cc
+++ b/src/flow/flow.cc
@@ -135,10 +135,15 @@ void Flow::restart(bool freeAppData)
     expire_time = 0;
 }
 
+//static const char* fsxlt[] =
+//{
+//    "setup", "inspect", "allow", "block"
+//};
+
 void Flow::clear(bool freeAppData)
 {
     restart(freeAppData);
-    flow_state = 0;
+    set_state(SETUP);
 
     if ( ssn_client )
     {

diff --git a/src/flow/flow.h b/src/flow/flow.h
index c5e9c2b9cf047f865cee2393c47cb446a092d285..96e8395cd1fc0c628bff05c339736483bd840789 100644 (file)
--- a/src/flow/flow.h
+++ b/src/flow/flow.h
@@ -115,7 +115,7 @@ private:
     unsigned id;
 };
 
-struct FlowState
+struct LwState
 {
     uint32_t   session_flags;
 
@@ -126,16 +126,24 @@ struct FlowState
     char       ignore_direction; /* flag to ignore traffic on this session */
 };
 
-typedef enum {
+enum Stream_Event
+{
     SE_REXMIT,
     SE_EOF,
     SE_MAX
-} Stream_Event;
+};
 
 // this struct is organized by member size for compactness
 class Flow
 {
 public:
+    enum FlowState
+    {
+        SETUP,
+        INSPECT,
+        BLOCK,
+        ALLOW
+    };
     Flow();
     Flow(PktType);
     ~Flow();
@@ -171,6 +179,9 @@ public:
     bool was_blocked() const
     { return (s5_state.session_flags & SSNFLAG_BLOCK) != 0; };
 
+    void set_state(FlowState fs)
+    { flow_state = fs; };
+
     void set_client(Inspector* ins)
     {
         ssn_client = ins;
@@ -224,8 +235,8 @@ public:  // FIXIT-M privatize if possible
 
     unsigned policy_id;
 
-    int flow_state;  // FIXIT-H wow - this is poorly encapsulated!  did i do that?  :(
-    FlowState s5_state;  // FIXIT-L rename this (s5 not appropriate)
+    FlowState flow_state;
+    LwState s5_state;  // FIXIT-L rename this (s5 not appropriate)
 
     // FIXIT-L can client and server ip and port be removed from flow?
     sfip_t client_ip; // FIXIT-L family and bits should be changed to uint16_t

diff --git a/src/flow/flow_control.cc b/src/flow/flow_control.cc
index 4b0e01f58e1b79d178efd5356beaa5260bfbc016..57e131ecf0496b4f8acfd1ff0d933d3d70cc6b8e 100644 (file)
--- a/src/flow/flow_control.cc
+++ b/src/flow/flow_control.cc
@@ -342,36 +342,35 @@ unsigned FlowControl::process(FlowCache* cache, Packet* p)
     {
         init_roles(p, flow);
         Inspector* b = InspectorManager::get_binder();
+
         if ( b )
             b->eval(p);
+
+        if ( !flow->ssn_client || !flow->session->setup(p) )
+            flow->set_state(Flow::ALLOW);
+
         ++news;
     }
 
     switch ( flow->flow_state )
     {
-    case 1: // block
-        stream.drop_packet(p);
-        flow->flow_state = 1;
-        break;
-
-    case 2: // allow
-        stream.stop_inspection(flow, p, SSN_DIR_BOTH, -1, 0);
+    case Flow::SETUP:
+        flow->set_state(Flow::ALLOW);
         break;
 
-    case 3: // setup
-        if ( !flow->ssn_client || !flow->session->setup(p) )
-        {
-            flow->flow_state = 2;
-            break;
-        }
-        flow->flow_state = 4;
-        // now process
-
-    case 4: // inspect
+    case Flow::INSPECT:
         assert(flow->ssn_client);
         assert(flow->ssn_server);
         flow->session->process(p);
         break;
+
+    case Flow::ALLOW:
+        stream.stop_inspection(flow, p, SSN_DIR_BOTH, -1, 0);
+        break;
+
+    case Flow::BLOCK:
+        stream.drop_packet(p);
+        break;
     }
 
     if ( flow->next && is_bidirectional(flow) )

diff --git a/src/network_inspectors/binder/bind_module.cc b/src/network_inspectors/binder/bind_module.cc
index 8268ab1e9dfed8353c8dd51332de3e964ffca9de..3e9ebfb22d57b9e9e72718af3fca81fa5cfaaf34 100644 (file)
--- a/src/network_inspectors/binder/bind_module.cc
+++ b/src/network_inspectors/binder/bind_module.cc
@@ -163,7 +163,7 @@ bool BinderModule::set(const char* fqn, Value& v, SnortConfig*)
 
     // use
     else if ( v.is("action") )
-        work->use.action = (BindAction)(v.get_long() + 1);
+        work->use.action = (BindAction)(v.get_long());
 
     else if ( v.is("file") )
     {

diff --git a/src/network_inspectors/binder/binder.cc b/src/network_inspectors/binder/binder.cc
index 175bb1e3e0f73f96c48d60a29ff1d46283bf46cc..c1207c3347b7f1cff25b2cd7b1545d25436c5893 100644 (file)
--- a/src/network_inspectors/binder/binder.cc
+++ b/src/network_inspectors/binder/binder.cc
@@ -211,9 +211,16 @@ void Binder::eval(Packet* p)
     flow->iface_out = p->pkth->egress_index;
 
     Binding* pb = get_binding(flow);
-    flow->flow_state = apply(flow, pb);
+    BindAction action = apply(flow, pb);
 
-    ++bstats.verdicts[flow->flow_state - 1];
+    switch ( action )
+    {
+    case BA_BLOCK: flow->set_state(Flow::BLOCK); break;
+    case BA_ALLOW: flow->set_state(Flow::ALLOW); break;
+    case BA_INSPECT: flow->set_state(Flow::INSPECT); break;
+    }
+
+    ++bstats.verdicts[action];
     ++bstats.packets;
 }
 

diff --git a/src/network_inspectors/binder/binding.h b/src/network_inspectors/binder/binding.h
index 0951761c7a60549eefb2b62dd7a2b34a65fe6093..4f1a654eff92175f1426140bbc511a2f7c105766 100644 (file)
--- a/src/network_inspectors/binder/binding.h
+++ b/src/network_inspectors/binder/binding.h
@@ -37,7 +37,7 @@ enum BindRole
 
 enum BindAction
 {
-    BA_BLOCK = 1,
+    BA_BLOCK,
     BA_ALLOW,
     BA_INSPECT
 };

diff --git a/src/stream/stream_api.cc b/src/stream/stream_api.cc
index 9095da5732b8d30ebbd54bc9c67c13349fa3bea3..a20fadfac8cea9092beb1a6ebcdb5eaf7a4f10b0 100644 (file)
--- a/src/stream/stream_api.cc
+++ b/src/stream/stream_api.cc
@@ -229,7 +229,7 @@ void Stream::stop_inspection(
     /* TODO: Handle bytes/response parameters */
 
     DisableInspection(p);
-    flow->flow_state = 2;
+    flow->set_state(Flow::ALLOW);
 }
 
 void Stream::resume_inspection(Flow* flow, char dir)
@@ -297,7 +297,7 @@ void Stream::drop_packet(Packet *p)
     if (!flow)
         return;
 
-    flow->flow_state = 1;
+    flow->set_state(Flow::BLOCK);
     flow->session->clear();
 
     if (!(p->packet_flags & PKT_STATELESS))