REG_TEST changes to make -A cmg look like Snort

diff --git a/ChangeLog b/ChangeLog
index c2f44d080cd999ee107de0e770cbfcde26370c67..ad04866c657dd6b02b33c344bfbcb5ace39690a9 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -27,6 +27,7 @@
 -- updated binder to bind data, session, and gadget
 -- http_inspect -> http_global, http_server -> http_inspect,
    nhttp_inspect -> new_http_inspect
+-- REG_TEST patches to make -A cmg look more like Snort
 
 125
 -- discovered can't catch exceptions thrown from Lua to C++; need to

diff --git a/src/log/log_text.cc b/src/log/log_text.cc
index 4d0ec0580c2a983eeff0a64334fafd0d96515317..7b161d96e3c46673b604afb2fcd38cc10e1c6621 100644 (file)
--- a/src/log/log_text.cc
+++ b/src/log/log_text.cc
@@ -1601,11 +1601,18 @@ void LogNetData (TextLog* log, const uint8_t* data, const int len, Packet *p)
         pb += BYTES_PER_FRAME;
         TextLog_NewLine(log);
     }
+#ifndef REG_TEST
     TextLog_NewLine(log);
+#endif
 }
 
+#ifdef REG_TEST
+#define SEPARATOR \
+    "=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+"
+#else
 #define SEPARATOR \
     "=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-="
+#endif
 
 static int LogObfuscatedData(TextLog* log, Packet *p)
 {
@@ -1645,6 +1652,7 @@ static int LogObfuscatedData(TextLog* log, Packet *p)
     return 0;
 }
 
+#ifndef REG_TEST
 static void LogPacketType(TextLog* log, Packet* p)
 {
     TextLog_NewLine(log);
@@ -1682,6 +1690,7 @@ static void LogPacketType(TextLog* log, Packet* p)
     } /* switch */
     TextLog_NewLine(log);
 }
+#endif
 
 /*--------------------------------------------------------------------
  * Function: LogIPPkt(TextLog*, int, Packet *)
@@ -1701,8 +1710,10 @@ static void LogPacketType(TextLog* log, Packet* p)
 
 void LogIPPkt(TextLog* log, Packet * p)
 {
+#ifndef REG_TEST
     LogPacketType(log, p);
     TextLog_Print(log, "%s\n", SEPARATOR);
+#endif
 
     /* dump the timestamp */
     LogTimeStamp(log, p);
@@ -1819,6 +1830,9 @@ void LogIPPkt(TextLog* log, Packet * p)
     {
         LogNetData(log, p->pkt, p->pkth->caplen, p);
     }
+#ifdef REG_TEST
+    TextLog_Print(log, "\n%s\n", SEPARATOR);
+#endif
 }
 
 /*--------------------------------------------------------------------

diff --git a/src/loggers/alert_fast.cc b/src/loggers/alert_fast.cc
index 5a38d0dc55b9f7c855ec5e67b9dc8f2caec6ee62..9109ef62c6c666b9328e0f217112f02842c29b7c 100644 (file)
--- a/src/loggers/alert_fast.cc
+++ b/src/loggers/alert_fast.cc
@@ -190,6 +190,57 @@ void FastLogger::close()
         TextLog_Term(fast_log);
 }
 
+#ifdef REG_TEST
+static void LogReassembly(const Packet* p)
+{
+    /* Log whether or not this is reassembled data - only indicate
+     * if we're actually going to show any of the payload */
+    if ( !ScOutputAppData() || !p->dsize || !PacketWasCooked(p) )
+        return;
+
+    switch ( p->pseudo_type )
+    {
+    case PSEUDO_PKT_SMB_SEG:
+        TextLog_Print(fast_log, "\n%s\n", "SMB desegmented packet");
+        break;
+    case PSEUDO_PKT_DCE_SEG:
+        TextLog_Print(fast_log, "\n%s\n", "DCE/RPC desegmented packet");
+        break;
+    case PSEUDO_PKT_DCE_FRAG:
+        TextLog_Print(fast_log, "\n%s\n", "DCE/RPC defragmented packet");
+        break;
+    case PSEUDO_PKT_SMB_TRANS:
+        TextLog_Print(fast_log, "\n%s\n", "SMB Transact reassembled packet");
+        break;
+    case PSEUDO_PKT_DCE_RPKT:
+        TextLog_Print(fast_log, "\n%s\n", "DCE/RPC reassembled packet");
+        break;
+    case PSEUDO_PKT_TCP:
+        TextLog_Print(fast_log, "\n%s\n", "Stream reassembled packet");
+        break;
+    case PSEUDO_PKT_IP:
+        TextLog_Print(fast_log, "\n%s\n", "Frag reassembled packet");
+        break;
+    default:
+        // FIXTHIS do we get here for portscan or sdf?
+        break;
+    }
+}
+#endif
+
+static const char* get_pkt_type(Packet* p)
+{
+    switch ( p->ptrs.get_pkt_type() )
+    {
+    case PktType::IP:   return "IP";
+    case PktType::ICMP: return "ICMP";
+    case PktType::TCP:  return "TCP";
+    case PktType::UDP:  return "UDP";
+    default: break;
+    }
+    return "error";
+}
+
 void FastLogger::alert(Packet *p, const char *msg, Event *event)
 {
     LogTimeStamp(fast_log, p);
@@ -230,25 +281,30 @@ void FastLogger::alert(Packet *p, const char *msg, Event *event)
 
         if (msg != NULL)
         {
+#ifdef REG_TEST
+            string tmp = msg + 1;
+            tmp.pop_back();
+            TextLog_Puts(fast_log, tmp.c_str());
+#else
             TextLog_Puts(fast_log, msg);
-            TextLog_Puts(fast_log, " [**] ");
-        }
-        else
-        {
-            TextLog_Puts(fast_log, "[**] ");
+#endif
         }
+        TextLog_Puts(fast_log, " [**] ");
     }
 
     /* print the packet header to the alert file */
     if (p->has_ip())
     {
         LogPriorityData(fast_log, event, 0);
-        TextLog_Print(fast_log, "{%s} ", protocol_names[p->get_ip_proto_next()]);
+        TextLog_Print(fast_log, "{%s} ", get_pkt_type(p));
         LogIpAddrs(fast_log, p);
     }
 
     if(packet)
     {
+#ifdef REG_TEST
+        LogReassembly(p);
+#endif
         if(p->ptrs.ip_api.is_valid())
             LogIPPkt(fast_log, p);
 

diff --git a/src/main/snort.cc b/src/main/snort.cc
index 0994bbd8ce4bd7b1c67bab027ad4ddc901df2e5a..2ff293c6a7e6d342f4a2f6b6e2fd6133045c0d27 100644 (file)
--- a/src/main/snort.cc
+++ b/src/main/snort.cc
@@ -912,8 +912,31 @@ void snort_thread_rotate()
     SetRotatePerfFileFlag();
 }
 
+#ifdef REG_TEST
+static void PQ_Show (const char* pcap)
+{
+    if ( !ScPcapShow() )
+        return;
+
+    if ( !strcmp(pcap, "-") ) pcap = "stdin";
+
+    static bool first = true;
+    if ( first )
+        first = false;
+    else
+        fprintf(stdout, "%s", "\n");
+
+    fprintf(stdout,
+        "Reading network traffic from \"%s\" with snaplen = %d\n",
+        pcap, DAQ_GetSnapLen());
+}
+#endif
+
 void snort_thread_init(const char* intf)
 {
+#ifdef REG_TEST
+    PQ_Show(intf);
+#endif
     // FIXIT-J the start-up sequence is a little off due to dropping privs
     DAQ_New(snort_conf, intf);
     DAQ_Start();

diff --git a/src/network_inspectors/normalize/normalize.cc b/src/network_inspectors/normalize/normalize.cc
index 9c7f19ce48dd98517fc2b70cdb88548207949e61..1d248633dff3dcb4c9acc5b38091c8a0785391da 100644 (file)
--- a/src/network_inspectors/normalize/normalize.cc
+++ b/src/network_inspectors/normalize/normalize.cc
@@ -167,13 +167,11 @@ public:
 
 private:
     NormalizerConfig config;
-    bool disabled;
 };
 
 Normalizer::Normalizer(const NormalizerConfig& nc)
 {
     config = nc;
-    disabled = false;
 }
 
 void Normalizer::tinit()
@@ -187,7 +185,7 @@ void Normalizer::tinit()
     if ( get_ips_policy()->policy_mode != POLICY_MODE__INLINE )
     {
         ParseWarning("normalizations disabled because not inline.\n");
-        disabled = true;
+        config.normalizer_flags = 0;
         return;
     }
 

diff --git a/src/service_inspectors/http_inspect/hi_module.h b/src/service_inspectors/http_inspect/hi_module.h
index 30588a4a2419ff30351bc3a866e3697ce06ba2e4..0b584f34a81d5e888585e2f3bd957959e93a8f3e 100644 (file)
--- a/src/service_inspectors/http_inspect/hi_module.h
+++ b/src/service_inspectors/http_inspect/hi_module.h
@@ -28,8 +28,13 @@
 #include "hi_ui_config.h"
 #include "hi_events.h"
 
+#ifdef REG_TEST
+#define GLOBAL_KEYWORD "http_inspect"
+#define SERVER_KEYWORD "http_server"
+#else
 #define GLOBAL_KEYWORD "http_global"
 #define SERVER_KEYWORD "http_inspect"
+#endif
 
 #define GLOBAL_HELP "shared HTTP inspector settings"
 #define SERVER_HELP "main HTTP inspector module"

diff --git a/src/service_inspectors/service_inspectors.cc b/src/service_inspectors/service_inspectors.cc
index b05d454b4f0fa214cebcaa13bd0b6a4f4c2b76b0..a36fe4ea0e61afd7bd018ffd3b12c9137b5a8d20 100644 (file)
--- a/src/service_inspectors/service_inspectors.cc
+++ b/src/service_inspectors/service_inspectors.cc
@@ -33,7 +33,9 @@ extern const BaseApi* sin_bo;
 extern const BaseApi* sin_ftp_client;
 extern const BaseApi* sin_ftp_server;
 extern const BaseApi* sin_ftp_data;
+#ifndef REG_TEST
 extern const BaseApi* sin_nhttp;
+#endif
 extern const BaseApi* sin_rpc_decode;
 extern const BaseApi* sin_telnet;
 extern const BaseApi* sin_wizard;
@@ -49,7 +51,9 @@ const BaseApi* service_inspectors[] =
     sin_ftp_client,
     sin_ftp_server,
     sin_ftp_data,
+#ifndef REG_TEST
     sin_nhttp,
+#endif
     sin_rpc_decode,
     sin_telnet,
     sin_wizard,

diff --git a/src/stream/tcp/tcp_session.cc b/src/stream/tcp/tcp_session.cc
index dc29366cfefa7585ab94128b156dc93097c334ed..4b684847f24c2d9cebf8dee4dcb7e9f143e3deac 100644 (file)
--- a/src/stream/tcp/tcp_session.cc
+++ b/src/stream/tcp/tcp_session.cc
@@ -1897,7 +1897,15 @@ static void ShowRebuiltPacket (TcpSession* ssn, Packet* pkt)
 {
     if ( (ssn->client.config->flags & STREAM5_CONFIG_SHOW_PACKETS) ||
          (ssn->server.config->flags & STREAM5_CONFIG_SHOW_PACKETS) )
+    {
+#ifdef REG_TEST
+        printf("+++++++++++++++++++Stream Packet+++++++++++++++++++++\n");
+#endif
         LogIPPkt(pkt);
+#ifdef REG_TEST
+        printf("\n+++++++++++++++++++++++++++++++++++++++++++++++++++++\n");
+#endif
+    }
 }
 
 static inline unsigned int getSegmentFlushSize(