act->send_reset(p, ENC_FLAG_FWD);
if ( flags & REJ_UNR_FWD )
- act->send_unreach(p, snort::UnreachResponse::FWD);
+ act->send_unreach(p, UnreachResponse::FWD);
if ( flags & REJ_UNR_NET )
- act->send_unreach(p, snort::UnreachResponse::NET);
+ act->send_unreach(p, UnreachResponse::NET);
if ( flags & REJ_UNR_HOST )
- act->send_unreach(p, snort::UnreachResponse::HOST);
+ act->send_unreach(p, UnreachResponse::HOST);
if ( flags & REJ_UNR_PORT )
- act->send_unreach(p, snort::UnreachResponse::PORT);
+ act->send_unreach(p, UnreachResponse::PORT);
}
//-------------------------------------------------------------------------
#include "managers/plugin_manager.h"
+using namespace snort;
+
#ifdef STATIC_IPS_ACTIONS
-extern const snort::BaseApi* act_react[];
-extern const snort::BaseApi* act_reject[];
+extern const BaseApi* act_react[];
+extern const BaseApi* act_reject[];
#endif
-extern const snort::BaseApi* act_replace[];
+extern const BaseApi* act_replace[];
void load_actions()
{
return false;
}
- if ( snort::SnortConfig::get_conf()->hit_ip_maxlayers(codec.ip_layer_cnt) )
+ if ( SnortConfig::get_conf()->hit_ip_maxlayers(codec.ip_layer_cnt) )
{
codec_event(codec, DECODE_IP_MULTIPLE_ENCAPSULATION);
return false;
/* If the previous layer was not IP-in-IP, this is not a 4-in-6 tunnel */
if ( codec.codec_flags & CODEC_NON_IP_TUNNEL )
codec.codec_flags &= ~CODEC_NON_IP_TUNNEL;
- else if ( snort::SnortConfig::tunnel_bypass_enabled(TUNNEL_4IN6) )
+ else if ( SnortConfig::tunnel_bypass_enabled(TUNNEL_4IN6) )
codec.tunnel_bypass = true;
}
else if (snort.ip_api.is_ip4())
/* If the previous layer was not IP-in-IP, this is not a 4-in-4 tunnel */
if ( codec.codec_flags & CODEC_NON_IP_TUNNEL )
codec.codec_flags &= ~CODEC_NON_IP_TUNNEL;
- else if (snort::SnortConfig::tunnel_bypass_enabled(TUNNEL_4IN4))
+ else if (SnortConfig::tunnel_bypass_enabled(TUNNEL_4IN4))
codec.tunnel_bypass = true;
}
*/
IP4AddrTests(iph, codec, snort);
- if (snort::SnortConfig::ip_checksums() && !valid_checksum_from_daq(raw))
+ if (SnortConfig::ip_checksums() && !valid_checksum_from_daq(raw))
{
// routers drop packets with bad IP checksums, we don't really need to check them...
int16_t csum = checksum::ip_cksum((const uint16_t*)iph, hlen);
const ip::IP4Hdr* const ip4h = reinterpret_cast<const ip::IP4Hdr*>(raw_pkt);
// FIXIT-RC this does NOT obfuscate correctly
- if (snort::SnortConfig::obfuscate())
+ if (SnortConfig::obfuscate())
{
TextLog_Print(text_log, "xxx.xxx.xxx.xxx -> xxx.xxx.xxx.xxx");
}
#include "framework/connector.h"
#include "managers/plugin_manager.h"
-extern const snort::BaseApi* file_connector[];
-extern const snort::BaseApi* tcp_connector[];
+using namespace snort;
+
+extern const BaseApi* file_connector[];
+extern const BaseApi* tcp_connector[];
void load_connectors()
{
}
static int fpFinishPortGroupRule(
- SnortConfig* sc, snort::Mpse* mpse, OptTreeNode* otn, PatternMatchData* pmd,
+ SnortConfig* sc, Mpse* mpse, OptTreeNode* otn, PatternMatchData* pmd,
FastPatternConfig* fp, Mpse::MpseType mpse_type, bool get_final_pat)
{
const char* pattern;
return 0;
}
-static void fpAddAlternatePatterns(SnortConfig* sc, snort::Mpse* mpse,
+static void fpAddAlternatePatterns(SnortConfig* sc, Mpse* mpse,
OptTreeNode* otn, PatternMatchData* pmd, FastPatternConfig* fp, Mpse::MpseType mpse_type)
{
fpFinishPortGroupRule(sc, mpse, otn, pmd, fp, mpse_type, false);
#include "fp_config.h"
+using namespace snort;
+
PORT_RULE_MAP* prmNewMap()
{
PORT_RULE_MAP* p = (PORT_RULE_MAP*)snort_calloc(sizeof(PORT_RULE_MAP));
assert(src and dst and gen);
*src = *dst = *gen = nullptr;
- if ( (dport != ANYPORT) and (dport < snort::MAX_PORTS) )
+ if ( (dport != ANYPORT) and (dport < MAX_PORTS) )
*dst = p->prmDstPort[dport];
- if ( (sport != ANYPORT) and (sport < snort::MAX_PORTS) )
+ if ( (sport != ANYPORT) and (sport < MAX_PORTS) )
*src = p->prmSrcPort[sport];
/* If no Src/Dst rules - use the generic set, if any exist */
if ( p->prmGeneric and (p->prmGeneric->rule_count > 0) )
{
- if ( snort::SnortConfig::get_conf()->fast_pattern_config->get_split_any_any() or (!*src and !*dst) )
+ if ( SnortConfig::get_conf()->fast_pattern_config->get_split_any_any() or (!*src and !*dst) )
{
*gen = p->prmGeneric;
}
// FIXIT-L this could be offloader specific
struct RegexRequest
{
- snort::Packet* packet = nullptr;
+ Packet* packet = nullptr;
std::thread* thread;
std::mutex mutex;
assert(busy.empty());
}
-bool RegexOffload::on_hold(snort::Flow* f) const
+bool RegexOffload::on_hold(Flow* f) const
{
for ( auto* req : busy )
{
MpseRegexOffload::MpseRegexOffload(unsigned max) : RegexOffload(max) { }
-void MpseRegexOffload::put(snort::Packet* p)
+void MpseRegexOffload::put(Packet* p)
{
Profile profile(mpsePerfStats);
p->context->searches.offload_search();
}
-bool MpseRegexOffload::get(snort::Packet*& p)
+bool MpseRegexOffload::get(Packet*& p)
{
Profile profile(mpsePerfStats);
assert(!busy.empty());
- snort::Mpse::MpseRespType resp_ret;
- snort::MpseBatch* batch;
+ Mpse::MpseRespType resp_ret;
+ MpseBatch* batch;
- resp_ret = snort::MpseBatch::poll_offload_responses(batch);
+ resp_ret = MpseBatch::poll_offload_responses(batch);
- if (resp_ret != snort::Mpse::MPSE_RESP_NOT_COMPLETE)
+ if (resp_ret != Mpse::MPSE_RESP_NOT_COMPLETE)
{
- if (resp_ret == snort::Mpse::MPSE_RESP_COMPLETE_FAIL)
+ if (resp_ret == Mpse::MPSE_RESP_COMPLETE_FAIL)
{
if (batch->can_fallback())
{
pc.offload_failures++;
}
- snort::IpsContext* c = (snort::IpsContext*)(batch->context);
+ IpsContext* c = (IpsContext*)(batch->context);
p = c->packet;
// Finished with items in batch so clear
unsigned i = ThreadConfig::get_instance_max();
for ( auto* req : idle )
- req->thread = new std::thread(worker, req, snort::SnortConfig::get_conf(), i++);
+ req->thread = new std::thread(worker, req, SnortConfig::get_conf(), i++);
}
ThreadRegexOffload::~ThreadRegexOffload()
}
}
-void ThreadRegexOffload::put(snort::Packet* p)
+void ThreadRegexOffload::put(Packet* p)
{
Profile profile(mpsePerfStats);
#endif
}
-bool ThreadRegexOffload::get(snort::Packet*& p)
+bool ThreadRegexOffload::get(Packet*& p)
{
Profile profile(mpsePerfStats);
assert(!busy.empty());
}
void ThreadRegexOffload::worker(
- RegexRequest* req, snort::SnortConfig* initial_config, unsigned id)
+ RegexRequest* req, SnortConfig* initial_config, unsigned id)
{
set_instance_id(id);
- snort::SnortConfig::set_conf(initial_config);
+ SnortConfig::set_conf(initial_config);
while ( true )
{
assert(req->packet->is_offloaded());
assert(req->packet->context->searches.items.size() > 0);
- snort::SnortConfig::set_conf(req->packet->context->conf);
- snort::IpsContext* c = req->packet->context;
- snort::Mpse::MpseRespType resp_ret;
+ SnortConfig::set_conf(req->packet->context->conf);
+ IpsContext* c = req->packet->context;
+ Mpse::MpseRespType resp_ret;
c->searches.offload_search();
{
resp_ret = c->searches.receive_offload_responses();
}
- while (resp_ret == snort::Mpse::MPSE_RESP_NOT_COMPLETE);
+ while (resp_ret == Mpse::MPSE_RESP_NOT_COMPLETE);
- if (resp_ret == snort::Mpse::MPSE_RESP_COMPLETE_FAIL)
+ if (resp_ret == Mpse::MPSE_RESP_COMPLETE_FAIL)
{
if (c->searches.can_fallback())
{
}
#endif
}
- snort::ModuleManager::accumulate_offload("search_engine");
- snort::ModuleManager::accumulate_offload("detection");
+ ModuleManager::accumulate_offload("search_engine");
+ ModuleManager::accumulate_offload("detection");
// FIXIT-M break this over-coupling. In reality we shouldn't be evaluating latency in offload.
PacketLatency::tterm();
{
switch ( action )
{
- case IpsPolicy::LOG: rtn->action = snort::Actions::Type::LOG; break;
- case IpsPolicy::PASS: rtn->action = snort::Actions::Type::PASS; break;
- case IpsPolicy::ALERT: rtn->action = snort::Actions::Type::ALERT; break;
- case IpsPolicy::DROP: rtn->action = snort::Actions::Type::DROP; break;
- case IpsPolicy::BLOCK: rtn->action = snort::Actions::Type::BLOCK; break;
- case IpsPolicy::RESET: rtn->action = snort::Actions::Type::RESET; break;
+ case IpsPolicy::LOG: rtn->action = Actions::Type::LOG; break;
+ case IpsPolicy::PASS: rtn->action = Actions::Type::PASS; break;
+ case IpsPolicy::ALERT: rtn->action = Actions::Type::ALERT; break;
+ case IpsPolicy::DROP: rtn->action = Actions::Type::DROP; break;
+ case IpsPolicy::BLOCK: rtn->action = Actions::Type::BLOCK; break;
+ case IpsPolicy::RESET: rtn->action = Actions::Type::RESET; break;
case IpsPolicy::INHERIT_ACTION: break;
}
switch ( enable )
#include "framework/ips_option.h"
#include "utils/util.h"
+using namespace snort;
+
OptFpList* AddOptFuncToList(RuleOptEvalFunc ro_eval_func, OptTreeNode* otn)
{
OptFpList* ofp = (OptFpList*)snort_calloc(sizeof(OptFpList));
return ofp;
}
-bool otn_set_agent(OptTreeNode* otn, snort::IpsOption* opt)
+bool otn_set_agent(OptTreeNode* otn, IpsOption* opt)
{
if ( otn->agent )
return false;
return true;
}
-void otn_trigger_actions(const OptTreeNode* otn, snort::Packet* p)
+void otn_trigger_actions(const OptTreeNode* otn, Packet* p)
{
if ( otn->agent )
otn->agent->action(p);
#include "detection/signature.h"
#include "main/snort_config.h"
+using namespace snort;
+
THREAD_LOCAL uint16_t event_id; // FIXIT-M also incremented in fpLogEvent()
void SetEvent(
event.sig_info->priority = priority;
/* this one gets set automatically */
- event.event_id = ++event_id | snort::SnortConfig::get_event_log_id();
+ event.event_id = ++event_id | SnortConfig::get_event_log_id();
if (event_ref)
event.event_reference = event_ref;
#include "file_api.h"
+class FileMemPool;
+
namespace snort
{
class FileInfo;
-}
-class FileMemPool;
struct FileCaptureBlock
{
int64_t capture_min_size;
int64_t capture_max_size;
};
+}
#endif
#include "file_flows.h"
+using namespace snort;
+
bool FileConfig::process_file_magic(FileMagicData& magic)
{
bool negated = false;
}
void FileConfig::get_magic_rule_ids_from_type(const std::string& type,
- const std::string& version, snort::FileTypeBitSet& ids_set)
+ const std::string& version, FileTypeBitSet& ids_set)
{
return fileIdentifier.get_magic_rule_ids_from_type(type, version, ids_set);
}
return "NA";
}
-FileConfig* get_file_config(snort::SnortConfig* sc)
+FileConfig* get_file_config(SnortConfig* sc)
{
- snort::FileInspect* fi = (snort::FileInspect*)snort::InspectorManager::get_inspector(FILE_ID_NAME, true, sc);
+ FileInspect* fi = (FileInspect*)InspectorManager::get_inspector(FILE_ID_NAME, true, sc);
if (fi)
return (fi->config);
namespace snort
{
void get_magic_rule_ids_from_type(const std::string& type, const std::string& version,
- snort::FileTypeBitSet& ids_set, snort::SnortConfig* sc)
+ FileTypeBitSet& ids_set, SnortConfig* sc)
{
FileConfig* conf = get_file_config(sc);
if (conf)
void FileIdentifier::init_merge_hash()
{
- identifier_merge_hash = snort::ghash_new(1000, sizeof(MergeNode), 0, nullptr);
+ identifier_merge_hash = ghash_new(1000, sizeof(MergeNode), 0, nullptr);
assert(identifier_merge_hash);
}
}
void FileIdentifier::get_magic_rule_ids_from_type(const std::string& type,
- const std::string& version, snort::FileTypeBitSet& ids_set)
+ const std::string& version, FileTypeBitSet& ids_set)
{
ids_set.reset();
#define SNORT_FILE_TYPE_UNKNOWN UINT16_MAX
#define SNORT_FILE_TYPE_CONTINUE 0
-class FileCapture;
class FileConfig;
class FileSegments;
namespace snort
{
+class FileCapture;
class FileInspect;
class Flow;
}
// Enable file type for all other features
- snort::FileService::enable_file_type();
+ FileService::enable_file_type();
type_enabled = true;
if (rule.use.signature_enabled)
- snort::FileService::enable_file_signature();
+ FileService::enable_file_signature();
if (rule.use.capture_enabled)
- snort::FileService::enable_file_capture();
+ FileService::enable_file_capture();
}
void FilePolicy::load()
{
if (type_enabled)
- snort::FileService::enable_file_type();
+ FileService::enable_file_type();
if (signature_enabled)
- snort::FileService::enable_file_signature();
+ FileService::enable_file_signature();
if (capture_enabled)
- snort::FileService::enable_file_capture();
+ FileService::enable_file_capture();
// Use default global setting
emptyRule.use.type_enabled = type_enabled;
#include "file_lib.h"
+using namespace snort;
+
FileSegment::~FileSegment ()
{
if (data)
delete data;
}
-FileSegments::FileSegments (snort::FileContext* ctx)
+FileSegments::FileSegments (FileContext* ctx)
{
head = nullptr;
current_offset = 0;
return SNORT_FILE_MIDDLE;
}
-int FileSegments::process_one(snort::Packet* p, const uint8_t* file_data, int data_size,
- snort::FilePolicyBase* policy)
+int FileSegments::process_one(Packet* p, const uint8_t* file_data, int data_size,
+ FilePolicyBase* policy)
{
FilePosition position = get_file_position(data_size, context->get_file_size());
return context->process(p, file_data, data_size, position, policy);
}
-int FileSegments::process_all(snort::Packet* p, snort::FilePolicyBase* policy)
+int FileSegments::process_all(Packet* p, FilePolicyBase* policy)
{
int ret = 1;
* 1: continue processing/log/block this file
* 0: ignore this file
*/
-int FileSegments::process(snort::Packet* p, const uint8_t* file_data, uint64_t data_size,
- uint64_t offset, snort::FilePolicyBase* policy)
+int FileSegments::process(Packet* p, const uint8_t* file_data, uint64_t data_size,
+ uint64_t offset, FilePolicyBase* policy)
{
int ret = 0;
snort_free(config);
}
-int detection_filter_test(void* pv, const snort::SfIp* sip, const snort::SfIp* dip, long curtime)
+int detection_filter_test(void* pv, const SfIp* sip, const SfIp* dip, long curtime)
{
if (pv == nullptr)
return 0;
if ( !detection_filter_hash )
return;
- snort::xhash_delete(detection_filter_hash);
+ xhash_delete(detection_filter_hash);
detection_filter_hash = nullptr;
}
* Create and Add a Thresholding Event Object
*/
int RateFilter_Create(
- snort::SnortConfig* sc, RateFilterConfig* rf_config, tSFRFConfigNode* thdx)
+ SnortConfig* sc, RateFilterConfig* rf_config, tSFRFConfigNode* thdx)
{
int error;
returns 1 - rate threshold reached
0 - rate threshold not reached
*/
-int RateFilter_Test(const OptTreeNode* otn, snort::Packet* p)
+int RateFilter_Test(const OptTreeNode* otn, Packet* p)
{
unsigned gid = otn->sigInfo.gid;
unsigned sid = otn->sigInfo.sid;
- const snort::SfIp* sip;
- const snort::SfIp* dip;
- snort::SfIp cleared;
+ const SfIp* sip;
+ const SfIp* dip;
+ SfIp cleared;
if ( p->ptrs.ip_api.is_ip() )
{
dip = &cleared;
}
- if ((snort::SnortConfig::get_conf() == nullptr) ||
- (snort::SnortConfig::get_conf()->rate_filter_config == nullptr))
+ if ((SnortConfig::get_conf() == nullptr) ||
+ (SnortConfig::get_conf()->rate_filter_config == nullptr))
{
/* this should not happen, see the create fcn */
return -1;
// events and these require: src -> client, dst -> server.
if ( p->is_from_server() )
{
- return SFRF_TestThreshold(snort::SnortConfig::get_conf()->rate_filter_config, gid, sid,
+ return SFRF_TestThreshold(SnortConfig::get_conf()->rate_filter_config, gid, sid,
dip, sip, p->pkth->ts.tv_sec, SFRF_COUNT_INCREMENT);
}
}
- return SFRF_TestThreshold(snort::SnortConfig::get_conf()->rate_filter_config, gid, sid,
+ return SFRF_TestThreshold(SnortConfig::get_conf()->rate_filter_config, gid, sid,
sip, dip, p->pkth->ts.tv_sec, SFRF_COUNT_INCREMENT);
}
* whether dos threshold is tracking by source or destination IP address. For tracking
* by rule, it is cleared out (all 0s).
*/
- snort::SfIp ip;
+ SfIp ip;
uint16_t padding;
} tSFRFTrackingNodeKey;
PADDING_GUARD_END
);
static tSFRFTrackingNode* _getSFRFTrackingNode(
- const snort::SfIp*,
+ const SfIp*,
unsigned tid,
time_t curTime
);
RateFilterConfig* config,
unsigned gid,
unsigned sid,
- const snort::SfIp* sip,
- const snort::SfIp* dip,
+ const SfIp* sip,
+ const SfIp* dip,
time_t curTime
);
*
* @return @retval 0 successfully added the thresholding object, !0 otherwise
*/
-int SFRF_ConfigAdd(snort::SnortConfig*, RateFilterConfig* rf_config, tSFRFConfigNode* cfgNode)
+int SFRF_ConfigAdd(SnortConfig*, RateFilterConfig* rf_config, tSFRFConfigNode* cfgNode)
{
GHash* genHash;
tSFRFSidNode* pSidNode;
tSFRFConfigNode* pNewConfigNode;
tSFRFGenHashKey key = { 0,0 };
- PolicyId policy_id = snort::get_ips_policy()->policy_id;
+ PolicyId policy_id = get_ips_policy()->policy_id;
if ((rf_config == nullptr) || (cfgNode == nullptr))
return -1;
*/
static int SFRF_TestObject(
tSFRFConfigNode* cfgNode,
- const snort::SfIp* ip,
+ const SfIp* ip,
time_t curTime,
SFRF_COUNT_OPERATION op
)
// if the count were not incremented in such cases, the
// threshold would never be exceeded.
if ( !cfgNode->seconds && dynNode->count > cfgNode->count )
- if ( cfgNode->newAction == snort::Actions::DROP )
+ if ( cfgNode->newAction == Actions::DROP )
dynNode->count--;
#ifdef SFRF_DEBUG
return retValue;
}
-static inline int SFRF_AppliesTo(tSFRFConfigNode* pCfg, const snort::SfIp* ip)
+static inline int SFRF_AppliesTo(tSFRFConfigNode* pCfg, const SfIp* ip)
{
return ( !pCfg->applyTo || sfvar_ip_in(pCfg->applyTo, ip) );
}
RateFilterConfig* config,
unsigned gid,
unsigned sid,
- const snort::SfIp* sip,
- const snort::SfIp* dip,
+ const SfIp* sip,
+ const SfIp* dip,
time_t curTime,
SFRF_COUNT_OPERATION op
)
int status = -1;
tSFRFGenHashKey key;
- PolicyId policy_id = snort::get_ips_policy()->policy_id;
+ PolicyId policy_id = get_ips_policy()->policy_id;
#ifdef SFRF_DEBUG
printf("--%d-%u-%u: %s() entering\n", 0, gid, sid, __func__);
case SFRF_TRACK_BY_RULE:
{
- snort::SfIp cleared;
+ SfIp cleared;
cleared.clear();
newStatus = SFRF_TestObject(cfgNode, &cleared, curTime, op);
}
fflush(stdout);
#endif
- return snort::Actions::MAX + cfgNode->newAction;
+ return Actions::MAX + cfgNode->newAction;
}
static void _updateDependentThresholds(
RateFilterConfig* config,
unsigned gid,
unsigned sid,
- const snort::SfIp* sip,
- const snort::SfIp* dip,
+ const SfIp* sip,
+ const SfIp* dip,
time_t curTime
)
{
}
}
-static tSFRFTrackingNode* _getSFRFTrackingNode(const snort::SfIp* ip, unsigned tid, time_t curTime)
+static tSFRFTrackingNode* _getSFRFTrackingNode(const SfIp* ip, unsigned tid, time_t curTime)
{
tSFRFTrackingNode* dynNode = nullptr;
tSFRFTrackingNodeKey key;
/* Setup key */
key.ip = *(ip);
key.tid = tid;
- key.policyId = snort::get_ips_policy()->policy_id;
+ key.policyId = get_ips_policy()->policy_id;
key.padding = 0;
/*
#include "rate_filter.h"
#include "sfrf.h"
+using namespace snort;
+
//---------------------------------------------------------------
#define IP_ANY nullptr // used to get "unset"
cfg.tracking = p->track;
cfg.count = p->count;
cfg.seconds = p->seconds;
- cfg.newAction = (snort::Actions::Type)RULE_NEW;
+ cfg.newAction = (Actions::Type)RULE_NEW;
cfg.timeout = p->timeout;
cfg.applyTo = p->ip ? sfip_var_from_string(p->ip, "sfrf_test") : nullptr;
// this is the only acceptable public value for op
SFRF_COUNT_OPERATION op = SFRF_COUNT_INCREMENT;
- snort::SfIp sip, dip;
+ SfIp sip, dip;
sip.set(p->sip);
dip.set(p->dip);
status = SFRF_TestThreshold(
rfc, p->gid, p->sid, &sip, &dip, curtime, op);
- if ( status >= snort::Actions::MAX )
- status -= snort::Actions::MAX;
+ if ( status >= Actions::MAX )
+ status -= Actions::MAX;
return status;
}
*/
static int sfthd_create_threshold_local(
- snort::SnortConfig*, ThresholdObjects* thd_objs, THD_NODE* config)
+ SnortConfig*, ThresholdObjects* thd_objs, THD_NODE* config)
{
GHash* sfthd_hash;
THD_ITEM* sfthd_item;
THD_NODE* sfthd_node;
tThdItemKey key;
- PolicyId policy_id = snort::get_network_policy()->policy_id;
+ PolicyId policy_id = get_network_policy()->policy_id;
if (thd_objs == nullptr )
return -1;
/*
*/
static int sfthd_create_threshold_global(
- snort::SnortConfig*, ThresholdObjects* thd_objs, THD_NODE* config)
+ SnortConfig*, ThresholdObjects* thd_objs, THD_NODE* config)
{
THD_NODE* sfthd_node;
- PolicyId policy_id = snort::get_network_policy()->policy_id;
+ PolicyId policy_id = get_network_policy()->policy_id;
if (thd_objs == nullptr)
return -1;
*/
int sfthd_create_threshold(
- snort::SnortConfig* sc,
+ SnortConfig* sc,
ThresholdObjects* thd_objs,
unsigned gen_id,
unsigned sig_id,
sfip_var_t* ip_address)
{
//allocate memory fpr sfthd_array if needed.
- PolicyId policyId = snort::get_network_policy()->policy_id;
+ PolicyId policyId = get_network_policy()->policy_id;
THD_NODE sfthd_node;
memset(&sfthd_node, 0, sizeof(sfthd_node));
#endif
int sfthd_test_rule(XHash* rule_hash, THD_NODE* sfthd_node,
- const snort::SfIp* sip, const snort::SfIp* dip, long curtime)
+ const SfIp* sip, const SfIp* dip, long curtime)
{
if ((rule_hash == nullptr) || (sfthd_node == nullptr))
return 0;
static inline int sfthd_test_suppress(
THD_NODE* sfthd_node,
- const snort::SfIp* ip)
+ const SfIp* ip)
{
if ( !sfthd_node->ip_address ||
sfvar_ip_in(sfthd_node->ip_address, ip) )
int sfthd_test_local(
XHash* local_hash,
THD_NODE* sfthd_node,
- const snort::SfIp* sip,
- const snort::SfIp* dip,
+ const SfIp* sip,
+ const SfIp* dip,
time_t curtime)
{
THD_IP_NODE_KEY key;
THD_IP_NODE data,* sfthd_ip_node;
- const snort::SfIp* ip;
+ const SfIp* ip;
- PolicyId policy_id = snort::get_network_policy()->policy_id;
+ PolicyId policy_id = get_network_policy()->policy_id;
#ifdef THD_DEBUG
char buf[24];
XHash* global_hash,
THD_NODE* sfthd_node,
unsigned sig_id, /* from current event */
- const snort::SfIp* sip, /* " */
- const snort::SfIp* dip, /* " */
+ const SfIp* sip, /* " */
+ const SfIp* dip, /* " */
time_t curtime)
{
THD_IP_GNODE_KEY key;
THD_IP_NODE data;
THD_IP_NODE* sfthd_ip_node;
- const snort::SfIp* ip;
+ const SfIp* ip;
- PolicyId policy_id = snort::get_network_policy()->policy_id;
+ PolicyId policy_id = get_network_policy()->policy_id;
#ifdef THD_DEBUG
char buf[24];
THD_STRUCT* thd,
unsigned gen_id,
unsigned sig_id,
- const snort::SfIp* sip,
- const snort::SfIp* dip,
+ const SfIp* sip,
+ const SfIp* dip,
long curtime)
{
tThdItemKey key;
int cnt;
#endif
- PolicyId policy_id = snort::get_network_policy()->policy_id;
+ PolicyId policy_id = get_network_policy()->policy_id;
if ((thd_objs == nullptr) || (thd == nullptr))
return 0;
long curtime = (long)p->now;
int status;
- snort::SfIp sip, dip;
+ SfIp sip, dip;
sip.set(p->sip);
dip.set(p->dip);
#include "sfthd.h"
+using namespace snort;
+
/* Data */
static THREAD_LOCAL THD_STRUCT* thd_runtime = nullptr;
int sfthreshold_create(
- snort::SnortConfig* sc, ThresholdConfig* thd_config, THDX_STRUCT* thdx)
+ SnortConfig* sc, ThresholdConfig* thd_config, THDX_STRUCT* thdx)
{
if (thd_config == nullptr)
return -1;
returns 0 - log
!0 - don't log
*/
-int sfthreshold_test(unsigned gen_id, unsigned sig_id, const snort::SfIp* sip,
- const snort::SfIp* dip, long curtime)
+int sfthreshold_test(unsigned gen_id, unsigned sig_id, const SfIp* sip,
+ const SfIp* dip, long curtime)
{
- if ((snort::SnortConfig::get_conf()->threshold_config == nullptr) ||
- !snort::SnortConfig::get_conf()->threshold_config->enabled)
+ if ((SnortConfig::get_conf()->threshold_config == nullptr) ||
+ !SnortConfig::get_conf()->threshold_config->enabled)
{
return 0;
}
if (!thd_checked)
{
thd_checked = 1;
- thd_answer = sfthd_test_threshold(snort::SnortConfig::get_conf()->threshold_config->thd_objs,
+ thd_answer = sfthd_test_threshold(SnortConfig::get_conf()->threshold_config->thd_objs,
thd_runtime, gen_id, sig_id, sip, dip, curtime);
}
void FlowHAState::reset() {}
-snort::FlowStash::~FlowStash() = default;
+FlowStash::~FlowStash() = default;
void FlowStash::reset() {}
DetectionEngine::~DetectionEngine() {}
-bool snort::layer::set_outer_ip_api(const Packet* const, ip::IpApi&, int8_t&)
+bool layer::set_outer_ip_api(const Packet* const, ip::IpApi&, int8_t&)
{ return false; }
uint8_t ip::IpApi::ttl() const { return 0; }
-const Layer* snort::layer::get_mpls_layer(const Packet* const) { return nullptr; }
+const Layer* layer::get_mpls_layer(const Packet* const) { return nullptr; }
-void snort::DataBus::publish(const char*, Packet*, Flow*) {}
+void DataBus::publish(const char*, Packet*, Flow*) {}
TEST_GROUP(nondefault_timeout)
{
class DummySession : public Session
{
public:
- DummySession(snort::Flow* f) : Session(f) { }
+ DummySession(Flow* f) : Session(f) { }
void clear() override { }
~DummySession() { }
};
using namespace snort;
static DataBus& get_data_bus()
-{ return snort::get_inspection_policy()->dbus; }
+{ return get_inspection_policy()->dbus; }
class BufferEvent : public DataEvent
{
// notify subscribers of event
void DataBus::publish(const char* key, DataEvent& e, Flow* f)
{
- InspectionPolicy* pi = snort::get_inspection_policy();
+ InspectionPolicy* pi = get_inspection_policy();
pi->dbus._publish(key, e, f);
// also publish to default policy to notify control subscribers such as appid
- InspectionPolicy* di = snort::get_default_inspection_policy(SnortConfig::get_conf());
+ InspectionPolicy* di = get_default_inspection_policy(SnortConfig::get_conf());
// of course, only when current is not default
if ( di != pi )
#include "primetable.h"
+using namespace snort;
+
HashFnc* hashfcn_new(int m)
{
HashFnc* p;
p = (HashFnc*)snort_calloc(sizeof(*p));
- if ( snort::SnortConfig::static_hash() )
+ if ( SnortConfig::static_hash() )
{
p->seed = 3193;
p->scale = 719;
#include "catch/snort_catch.h"
#endif
+using namespace snort;
using namespace std;
#define opt_init "init"
if ( luaL_loadbuffer(L, chunk.c_str(), chunk.size(), name) )
{
- snort::ParseError("%s luajit failed to load chunk %s", name, lua_tostring(L, -1));
+ ParseError("%s luajit failed to load chunk %s", name, lua_tostring(L, -1));
return false;
}
// now exec the chunk to define functions etc in L
if ( lua_pcall(L, 0, 0, 0) )
{
- snort::ParseError("%s luajit failed to init chunk %s", name, lua_tostring(L, -1));
+ ParseError("%s luajit failed to init chunk %s", name, lua_tostring(L, -1));
return false;
}
// load the args table
if ( luaL_dostring(L, args.c_str()) )
{
- snort::ParseError("%s luajit failed to init args %s", name, lua_tostring(L, -1));
+ ParseError("%s luajit failed to init args %s", name, lua_tostring(L, -1));
return false;
}
return true;
if ( lua_pcall(L, 0, 1, 0) || lua_type(L, -1) == LUA_TSTRING )
- snort::ParseError("%s %s", name, lua_tostring(L, -1));
+ ParseError("%s %s", name, lua_tostring(L, -1));
else if ( !lua_toboolean(L, -1) )
- snort::ParseError("%s init() returned false", name);
+ ParseError("%s init() returned false", name);
else
return true;
return sfvar_ip_in(varip, p->ptrs.ip_api.get_src()); // source ip only
}
-bool DiscoveryFilter::is_port_excluded(const snort::Packet* p)
+bool DiscoveryFilter::is_port_excluded(const Packet* p)
{
// Port exclusion: if the ip is in the port x protocol list, return true.
uint32_t key;
static void dirty_handler(int signal)
{
- snort::SnortConfig::get_conf()->dirty_pig = true;
+ SnortConfig::get_conf()->dirty_pig = true;
exit_handler(signal);
}
if ( errno )
FatalError("failed to setsid - %s", get_error(errno));
- if ( snort::SnortConfig::log_quiet() or snort::SnortConfig::log_syslog() )
+ if ( SnortConfig::log_quiet() or SnortConfig::log_syslog() )
snuff_stdio();
pid_t ppid = getppid();
//-------------------------------------------------------------------------
HostCacheModule::HostCacheModule() :
- snort::Module(HOST_CACHE_NAME, HOST_CACHE_HELP, host_cache_params) { }
+ Module(HOST_CACHE_NAME, HOST_CACHE_HELP, host_cache_params) { }
HostCacheModule::~HostCacheModule()
{
#include "main/snort_config.h"
#include "utils/util.h"
+using namespace snort;
+
/*
** Macros
*/
** @return none
**
*/
-void asn1_init_mem(snort::SnortConfig* sc)
+void asn1_init_mem(SnortConfig* sc)
{
asn1_config.num_nodes = sc->asn1_mem;
** @return none
**
*/
-void asn1_free_mem(snort::SnortConfig*)
+void asn1_free_mem(SnortConfig*)
{
if (asn1_config.mem != nullptr)
{
void ContentData::setup_bm()
{
- skip_stride = snort::make_skip(pmd.pattern_buf, pmd.pattern_size);
+ skip_stride = make_skip(pmd.pattern_buf, pmd.pattern_size);
shift_stride = make_shift(pmd.pattern_buf, pmd.pattern_size);
}
return false;
// Check if built-in pattern should be used.
- IpsPolicy* p = snort::get_ips_policy();
+ IpsPolicy* p = get_ips_policy();
if (config.pii == "credit_card")
{
config.pii = SD_CREDIT_PATTERN_ALL;
#include "time/packet_time.h"
#include "utils/util_cstring.h"
+using namespace snort;
+
static int already_fatal = 0;
static unsigned parse_errors = 0;
get_parse_location(file_name, file_line);
if ( file_line )
- snort::LogMessage(file, "%s: %s:%d %s\n", type, file_name, file_line, msg);
+ LogMessage(file, "%s: %s:%d %s\n", type, file_name, file_line, msg);
else if ( file_name )
- snort::LogMessage(file, "%s: %s: %s\n", type, file_name, msg);
+ LogMessage(file, "%s: %s: %s\n", type, file_name, msg);
else
- snort::LogMessage(file, "%s: %s\n", type, msg);
+ LogMessage(file, "%s: %s\n", type, msg);
}
namespace snort
{
void ParseWarning(WarningGroup wg, const char* format, ...)
{
- if ( !(snort::SnortConfig::get_conf()->warning_flags & (1 << wg)) )
+ if ( !(SnortConfig::get_conf()->warning_flags & (1 << wg)) )
return;
char buf[STD_BUF+1];
static void WriteLogMessage(FILE* fh, bool prefer_fh, const char* format, va_list& ap)
{
- if ( snort::SnortConfig::get_conf() && !prefer_fh )
+ if ( SnortConfig::get_conf() && !prefer_fh )
{
- if ( snort::SnortConfig::log_quiet() )
+ if ( SnortConfig::log_quiet() )
return;
- if ( snort::SnortConfig::log_syslog() )
+ if ( SnortConfig::log_syslog() )
{
char buf[STD_BUF+1];
vsnprintf(buf, STD_BUF, format, ap);
{
va_list ap;
- if ( snort::SnortConfig::get_conf() and snort::SnortConfig::log_quiet() )
+ if ( SnortConfig::get_conf() and SnortConfig::log_quiet() )
return;
va_start(ap, format);
- if ( snort::SnortConfig::get_conf() and snort::SnortConfig::log_syslog() )
+ if ( SnortConfig::get_conf() and SnortConfig::log_syslog() )
{
char buf[STD_BUF+1];
vsnprintf(buf, STD_BUF, format, ap);
va_start(ap, format);
- if ( snort::SnortConfig::get_conf() and snort::SnortConfig::log_syslog() )
+ if ( SnortConfig::get_conf() and SnortConfig::log_syslog() )
{
char buf[STD_BUF+1];
vsnprintf(buf, STD_BUF, format, ap);
buf[STD_BUF] = '\0';
- if ( snort::SnortConfig::get_conf() and snort::SnortConfig::log_syslog() )
+ if ( SnortConfig::get_conf() and SnortConfig::log_syslog() )
{
syslog(LOG_CONS | LOG_DAEMON | LOG_ERR, "FATAL ERROR: %s", buf);
}
#include "log/messages.h"
+using namespace snort;
+
namespace Lua
{
State::State(bool openlibs)
state = luaL_newstate();
if ( !state )
- snort::FatalError("Lua state instantiation failed\n");
+ FatalError("Lua state instantiation failed\n");
if ( openlibs )
luaL_openlibs(state);
#include "snort_config.h"
#include "swapper.h"
+using namespace snort;
+
bool ACStart::execute(Analyzer& analyzer, void**)
{
analyzer.start();
// FIXIT-P This incurs locking on all threads to retrieve stats. It
// could be reimplemented to optimize for large thread counts by
// retrieving stats in the command and accumulating in the main thread.
- snort::ModuleManager::accumulate(snort::SnortConfig::get_conf());
+ ModuleManager::accumulate(SnortConfig::get_conf());
return true;
}
{
ps->apply(analyzer);
- snort::SnortConfig* sc = ps->get_new_conf();
+ SnortConfig* sc = ps->get_new_conf();
if ( sc )
{
- std::list<snort::ReloadResourceTuner*>* reload_tuners;
+ std::list<ReloadResourceTuner*>* reload_tuners;
if ( !*ac_state )
{
- reload_tuners = new std::list<snort::ReloadResourceTuner*>(sc->get_reload_resource_tuners());
+ reload_tuners = new std::list<ReloadResourceTuner*>(sc->get_reload_resource_tuners());
*ac_state = reload_tuners;
}
else
- reload_tuners = (std::list<snort::ReloadResourceTuner*>*)*ac_state;
+ reload_tuners = (std::list<ReloadResourceTuner*>*)*ac_state;
if ( !reload_tuners->empty() )
{
{
if (ps)
{
- snort::SnortConfig* sc = ps->get_new_conf();
+ SnortConfig* sc = ps->get_new_conf();
if ( sc )
sc->clear_reload_resource_tuner_list();
}
delete ps;
Swapper::set_reload_in_progress(false);
- snort::LogMessage("== reload complete\n");
+ LogMessage("== reload complete\n");
request->respond("== reload complete\n", from_shell, true);
}
ACDAQSwap::~ACDAQSwap()
{
- snort::LogMessage("== daq module reload complete\n");
+ LogMessage("== daq module reload complete\n");
}
-snort::SFDAQInstance* snort::AnalyzerCommand::get_daq_instance(Analyzer& analyzer)
+SFDAQInstance* AnalyzerCommand::get_daq_instance(Analyzer& analyzer)
{
return analyzer.get_daq_instance();
}
#include "request.h"
#include "shell.h"
+using namespace snort;
using namespace std;
//------------------------------------------------------------------------
void ControlConn::configure() const
{
- snort::ModuleManager::load_commands(sh);
+ ModuleManager::load_commands(sh);
}
int ControlConn::shell_execute(int& current_fd, Request*& current_request)
#include "main.h"
#include "utils/util.h"
+using namespace snort;
+
//-------------------------------------------------------------------------
// request foo
//-------------------------------------------------------------------------
if ( fd < 1 )
{
if (!remote_only)
- snort::LogMessage("%s", s);
+ LogMessage("%s", s);
return;
}
vsnprintf(buf_ptr, buf_len, fmt, ap);
- if ( snort::SnortConfig::get_conf() and snort::SnortConfig::log_syslog() )
+ if ( SnortConfig::get_conf() and SnortConfig::log_syslog() )
syslog(LOG_DAEMON | LOG_DEBUG, "%s", buf);
else
output(buf, stdout);
{
if ( new_conf )
{
- const bool reload = (snort::SnortConfig::get_conf() != nullptr);
- snort::SnortConfig::set_conf(new_conf);
+ const bool reload = (SnortConfig::get_conf() != nullptr);
+ SnortConfig::set_conf(new_conf);
// FIXIT-M Determine whether we really want to do this before or after the set_conf
if (reload)
analyzer.reinit(new_conf);
const char* get_instance_file(std::string& file, const char* name)
{
bool sep = false;
- file = !snort::SnortConfig::get_conf()->log_dir.empty() ?
- snort::SnortConfig::get_conf()->log_dir : "./";
+ file = !SnortConfig::get_conf()->log_dir.empty() ?
+ SnortConfig::get_conf()->log_dir : "./";
if ( file.back() != '/' )
file += '/';
- if ( !snort::SnortConfig::get_conf()->run_prefix.empty() )
+ if ( !SnortConfig::get_conf()->run_prefix.empty() )
{
- file += snort::SnortConfig::get_conf()->run_prefix;
+ file += SnortConfig::get_conf()->run_prefix;
sep = true;
}
- if ( (ThreadConfig::get_instance_max() > 1) || snort::SnortConfig::get_conf()->id_zero )
+ if ( (ThreadConfig::get_instance_max() > 1) || SnortConfig::get_conf()->id_zero )
{
char id[8];
snprintf(id, sizeof(id), "%u",
- get_instance_id() + snort::SnortConfig::get_conf()->id_offset);
+ get_instance_id() + SnortConfig::get_conf()->id_offset);
file += id;
sep = true;
}
- if ( snort::SnortConfig::get_conf()->id_subdir )
+ if ( SnortConfig::get_conf()->id_subdir )
{
file += '/';
struct stat s;
#include "catch/snort_catch.h"
#endif
+using namespace snort;
+
static hwloc_topology_t topology = nullptr;
static hwloc_cpuset_t process_cpuset = nullptr;
static const struct hwloc_topology_support* topology_support = nullptr;
thread_affinity[key] = cpuset;
}
else
- snort::ParseWarning(WARN_CONF, "This platform does not support setting thread affinity.\n");
+ ParseWarning(WARN_CONF, "This platform does not support setting thread affinity.\n");
}
void ThreadConfig::implement_thread_affinity(SThreadType type, unsigned id)
current_cpuset = hwloc_bitmap_alloc();
hwloc_get_cpubind(topology, current_cpuset, HWLOC_CPUBIND_THREAD);
if (!hwloc_bitmap_isequal(current_cpuset, desired_cpuset))
- snort::LogMessage("Binding thread %u (type %u) to %s.\n", id, type, s);
+ LogMessage("Binding thread %u (type %u) to %s.\n", id, type, s);
hwloc_bitmap_free(current_cpuset);
if (hwloc_set_cpubind(topology, desired_cpuset, HWLOC_CPUBIND_THREAD))
{
- snort::FatalError("Failed to pin thread %u (type %u) to %s: %s (%d)\n",
- id, type, s, snort::get_error(errno), errno);
+ FatalError("Failed to pin thread %u (type %u) to %s: %s (%d)\n",
+ id, type, s, get_error(errno), errno);
}
free(s);
if ( get_instance(fp, keyword, false, old_it) )
{
- if ( snort::Snort::is_reloading() )
+ if ( Snort::is_reloading() )
{
(*old_it)->set_reloaded(RELOAD_TYPE_REENABLED);
fp->ilist.erase(old_it);
return nullptr;
}
- if ( snort::Snort::is_reloading() )
+ if ( Snort::is_reloading() )
{
if ( reloaded )
p->set_reloaded(RELOAD_TYPE_REENABLED);
Binder* InspectorManager::get_binder()
{
- InspectionPolicy* pi = snort::get_inspection_policy();
+ InspectionPolicy* pi = get_inspection_policy();
if ( !pi || !pi->framework_policy )
return nullptr;
InspectionPolicy* pi;
if (dflt_only && (sc != nullptr))
- pi = snort::get_default_inspection_policy(sc);
+ pi = get_default_inspection_policy(sc);
else if (dflt_only)
- pi = snort::get_default_inspection_policy(SnortConfig::get_conf());
+ pi = get_default_inspection_policy(SnortConfig::get_conf());
else
- pi = snort::get_inspection_policy();
+ pi = get_inspection_policy();
if ( !pi || !pi->framework_policy )
return nullptr;
// pin->tinit() only called for default policy
set_default_policy();
- InspectionPolicy* pi = snort::get_inspection_policy();
+ InspectionPolicy* pi = get_inspection_policy();
if ( pi && pi->framework_policy )
{
}
// pin->tinit() only called for default policy
- InspectionPolicy* pi = snort::get_default_inspection_policy(sc);
+ InspectionPolicy* pi = get_default_inspection_policy(sc);
if ( pi && pi->framework_policy )
{
// pin->tterm() only called for default policy
set_default_policy();
- InspectionPolicy* pi = snort::get_inspection_policy();
+ InspectionPolicy* pi = get_inspection_policy();
// FIXIT-RC Any inspectors that were once configured/instantiated but
// no longer exist in the conf cannot have their instance tterm()
assert(mod);
FrameworkConfig* fc = sc->framework_config;
- FrameworkPolicy* fp = snort::get_inspection_policy()->framework_policy;
+ FrameworkPolicy* fp = get_inspection_policy()->framework_policy;
// FIXIT-L should not need to lookup inspector etc
// since given api and mod
if ( !ppc )
return nullptr;
- auto fp = snort::get_inspection_policy()->framework_policy;
+ auto fp = get_inspection_policy()->framework_policy;
auto ppi = get_new(ppc, fp, name, mod, sc);
if ( !ppi )
void InspectorManager::print_config(SnortConfig* sc)
{
- InspectionPolicy* pi = snort::get_inspection_policy();
+ InspectionPolicy* pi = get_inspection_policy();
if ( !pi->framework_policy )
return;
void InspectorManager::execute(Packet* p)
{
- FrameworkPolicy* fp = snort::get_inspection_policy()->framework_policy;
+ FrameworkPolicy* fp = get_inspection_policy()->framework_policy;
assert(fp);
if ( !p->has_paf_payload() )
// a flow control wrapper) and use eval() instead of process()
// for stream_*.
::execute(p, fp->session.vec, fp->session.num);
- fp = snort::get_inspection_policy()->framework_policy;
+ fp = get_inspection_policy()->framework_policy;
}
// must check between each ::execute()
if ( p->disable_inspect )
return;
SnortConfig* sc = SnortConfig::get_conf();
- FrameworkPolicy* fp_dft = snort::get_default_inspection_policy(sc)->framework_policy;
+ FrameworkPolicy* fp_dft = get_default_inspection_policy(sc)->framework_policy;
if ( !p->flow )
{
void InspectorManager::probe(Packet* p)
{
- InspectionPolicy* policy = snort::SnortConfig::get_conf()->policy_map->get_inspection_policy(0);
+ InspectionPolicy* policy = SnortConfig::get_conf()->policy_map->get_inspection_policy(0);
FrameworkPolicy* fp = policy->framework_policy;
::execute(p, fp->probe.vec, fp->probe.num);
}
if ( val.get_type() != Value::VT_STR )
return false;
- if ( snort::get_ips_policy() == nullptr )
+ if ( get_ips_policy() == nullptr )
return true;
trace("var", fqn, val);
return false;
// FIXIT-M only basic modules, inspectors and ips actions can be reloaded at present
- if ( ( snort::Snort::is_reloading() ) and h->api
+ if ( ( Snort::is_reloading() ) and h->api
and h->api->type != PT_INSPECTOR and h->api->type != PT_IPS_ACTION )
return false;
cout << "no match" << endl;
}
-void ModuleManager::reload_module(const char* name, snort::SnortConfig* sc)
+void ModuleManager::reload_module(const char* name, SnortConfig* sc)
{
ModHook* h = get_hook(name);
#include "log/messages.h"
#include "parser/parse_so_rule.h"
+using namespace snort;
using namespace std;
static list<const SoApi*> s_rules;
void SoManager::dump_plugins()
{
- snort::Dumper d("SO Rules");
+ Dumper d("SO Rules");
for ( auto* p : s_rules )
d.dump(p->base.name, p->base.version);
void MemoryCap::calculate(unsigned num_threads)
{
assert(!is_packet_thread());
- const MemoryConfig& config = *snort::SnortConfig::get_conf()->memory;
+ const MemoryConfig& config = *SnortConfig::get_conf()->memory;
auto main_thread_used = s_tracker.used();
if ( !MemoryModule::is_active() )
return;
- const MemoryConfig& config = *snort::SnortConfig::get_conf()->memory;
+ const MemoryConfig& config = *SnortConfig::get_conf()->memory;
- if ( snort::SnortConfig::log_verbose() or mem_stats.allocations )
+ if ( SnortConfig::log_verbose() or mem_stats.allocations )
LogLabel("memory (heap)");
- if ( snort::SnortConfig::log_verbose() )
+ if ( SnortConfig::log_verbose() )
{
LogMessage(" global cap: %zu\n", config.cap);
LogMessage(" global preemptive threshold percent: %u\n", config.threshold);
#include "stream/stream.h"
+using namespace snort;
+
namespace memory
{
void prune_handler()
{
- snort::Stream::prune_flows();
+ Stream::prune_flows();
}
} // namespace memory
#include "decode_buffer.h"
+using namespace snort;
+
void B64Decode::reset_decode_state()
{
reset_decoded_bytes();
uint32_t encode_avail = buffer->get_encode_avail() - buffer->get_prev_encoded_bytes();
- if (snort::sf_strip_CRLF(start, (end-start), buffer->get_encode_buff() + buffer->get_prev_encoded_bytes(),
+ if (sf_strip_CRLF(start, (end-start), buffer->get_encode_buff() + buffer->get_prev_encoded_bytes(),
encode_avail, &act_encode_size) != 0)
{
reset_decode_state();
else
buffer->reset_saved();
- if (snort::sf_base64decode(buffer->get_encode_buff(), act_encode_size,
+ if (sf_base64decode(buffer->get_encode_buff(), act_encode_size,
decode_buf, buffer->get_decode_avail(), &act_decode_size) != 0)
{
reset_decode_state();
#include "decode_buffer.h"
+using namespace snort;
+
void QPDecode::reset_decode_state()
{
reset_decoded_bytes();
uint32_t encode_avail = buffer->get_encode_avail() - buffer->get_prev_encoded_bytes();
- if (snort::sf_strip_LWS(start, (end-start), buffer->get_encode_buff() + buffer->get_prev_encoded_bytes(),
+ if (sf_strip_LWS(start, (end-start), buffer->get_encode_buff() + buffer->get_prev_encoded_bytes(),
encode_avail, &act_encode_size) != 0)
{
reset_decode_state();
#include "decode_buffer.h"
+using namespace snort;
+
#define UU_DECODE_CHAR(c) (((c) - 0x20) & 0x3f)
void UUDecode::reset_decode_state()
}
else
{
- const uint8_t* sod = (const uint8_t*)snort::SnortStrnStr((const char*)src, 5, "begin");
+ const uint8_t* sod = (const uint8_t*)SnortStrnStr((const char*)src, 5, "begin");
if (sod)
{
*begin_found = true;
/*begin str found. Move to the actual data*/
- ptr = (const uint8_t*)snort::SnortStrnStr((const char*)(sod), (end - sod), "\n");
+ ptr = (const uint8_t*)SnortStrnStr((const char*)(sod), (end - sod), "\n");
if ( !ptr )
{
*bytes_read = slen;
// update file depth and max_depth etc
void DecodeConfig::sync_all_depths()
{
- file_depth = snort::FileService::get_max_file_depth();
+ file_depth = FileService::get_max_file_depth();
if ((file_depth >= 0)or (b64_depth >= 0) or (qp_depth >= 0)
or (bitenc_depth >= 0) or (uu_depth >= 0))
decode_enabled = true;
(void)File_Decomp_Init(fd_state);
}
-MimeDecode::MimeDecode(snort::DecodeConfig* conf)
+MimeDecode::MimeDecode(DecodeConfig* conf)
{
config = conf;
file_decomp_init();
#include <cstdint>
#include "main/snort_types.h"
+namespace snort
+{
enum EmailUserType
{
EMAIL_SENDER,
uint32_t email_hdrs_log_depth = 0;
};
-namespace snort
-{
class Flow;
-}
class SO_PUBLIC MailLogState
{
uint16_t file_logged;
uint16_t file_current;
};
+}
#endif
}
SnortProtocolId AppInfoManager::add_appid_protocol_reference(const char* protocol,
- snort::SnortConfig* sc)
+ SnortConfig* sc)
{
SnortProtocolId snort_protocol_id = sc->proto_ref->add(protocol);
return snort_protocol_id;
}
void AppInfoManager::init_appid_info_table(AppIdModuleConfig* mod_config,
- snort::SnortConfig* sc)
+ SnortConfig* sc)
{
if ( !mod_config->app_detector_dir )
{
#include "appid_app_descriptor.h"
#include "lua_detector_api.h"
-void ApplicationDescriptor::set_id(const snort::Packet& p, AppIdSession& asd,
+using namespace snort;
+
+void ApplicationDescriptor::set_id(const Packet& p, AppIdSession& asd,
AppidSessionDirection dir, AppId app_id, AppidChangeBits& change_bits)
{
if ( my_id != app_id )
misc_id, change_bits);
}
-void AppIdDiscovery::publish_appid_event(AppidChangeBits& change_bits, snort::Flow* flow)
+void AppIdDiscovery::publish_appid_event(AppidChangeBits& change_bits, Flow* flow)
{
if (change_bits.none())
return;
// FIXIT_H: - this code is wrong. We can't have
// tmp-xff_fields[j].value when tmp=0.
- // xff_addr = new snort::SfIp();
+ // xff_addr = new SfIp();
// char* xff_addr_str = nullptr;
// char* tmp = strchr(xff_fields[j].value, ',');
#include "utils/stats.h"
+using namespace snort;
+
std::unordered_map<AppId, uint32_t> AppIdPegCounts::appid_detector_pegs_idx;
std::vector<std::string> AppIdPegCounts::appid_detectors_info;
THREAD_LOCAL std::vector<AppIdPegCounts::AppIdDynamicPeg>* AppIdPegCounts::appid_peg_counts;
if (!print && unknown_pegs->all_zeros())
return;
- snort::LogLabel("Appid dynamic stats:");
+ LogLabel("Appid dynamic stats:");
for (unsigned i = 0; i < app_num; i++)
{
continue;
std::string app_name = AppIdPegCounts::appid_detectors_info[i];
- snort::LogMessage("%s: ", app_name.c_str());
+ LogMessage("%s: ", app_name.c_str());
pegs->print();
}
// Print unknown app stats
if (!unknown_pegs->all_zeros())
{
- snort::LogMessage("unknown_app: flows: %" PRIu64 ", clients: %" PRIu64 ", users: %" PRIu64 ", payloads %"
+ LogMessage("unknown_app: flows: %" PRIu64 ", clients: %" PRIu64 ", users: %" PRIu64 ", payloads %"
PRIu64 ", misc: %" PRIu64 "\n",
unknown_pegs->stats[0], unknown_pegs->stats[1], unknown_pegs->stats[2],
unknown_pegs->stats[3], unknown_pegs->stats[4]);
}
else
{
- snort::WarningMessage("Error saving statistics record for app id: %d", app_id);
+ WarningMessage("Error saving statistics record for app id: %d", app_id);
snort_free(record);
record = nullptr;
}
#include "search_engines/search_tool.h"
#include "utils/util.h"
+using namespace snort;
+
struct tPatternNode
{
tMlmpPattern pattern;
/*Node for mlmp tree */
struct tMlmpTree
{
- snort::SearchTool* patternTree;
+ SearchTool* patternTree;
tPatternPrimaryNode* patternList;
uint32_t level;
};
detroyTreesRecursively. */
static int createTreesRecusively(tMlmpTree* rootNode)
{
- snort::SearchTool* patternMatcher;
+ SearchTool* patternMatcher;
tPatternPrimaryNode* primaryPatternNode;
tPatternNode* ddPatternNode;
/* set up the MPSE for url patterns */
- patternMatcher = rootNode->patternTree = new snort::SearchTool("ac_full", true);
+ patternMatcher = rootNode->patternTree = new SearchTool("ac_full", true);
for (primaryPatternNode = rootNode->patternList;
primaryPatternNode;
#include "search_engines/search_tool.h"
#include "utils/util.h"
+using namespace snort;
+
struct tPatternRootNode;
struct tPatternList
{
/*Root node */
struct tPatternRootNode
{
- snort::SearchTool* patternTree;
+ SearchTool* patternTree;
tPatternList* patternList;
tPatternList* lastPattern;
unsigned int level; /*some searches may be specific to levels. Increments from 1 at top
static int createTreesRecusively(void* root)
{
tPatternRootNode* rootNode = (tPatternRootNode*)root;
- snort::SearchTool* patternMatcher;
+ SearchTool* patternMatcher;
tPatternList* patternNode;
/* set up the MPSE for url patterns */
- if (!(patternMatcher = rootNode->patternTree = new snort::SearchTool("ac_full", true)))
+ if (!(patternMatcher = rootNode->patternTree = new SearchTool("ac_full", true)))
return -1;
for (patternNode = rootNode->patternList;
#include "protocols/packet.h"
#include "log/messages.h"
+using namespace snort;
+
static THREAD_LOCAL unsigned client_module_index = 0;
ClientDetector::ClientDetector()
{
if ( AppInfoManager::get_instance().configured() )
{
- snort::ParseWarning(WARN_RULES,
+ ParseWarning(WARN_RULES,
"appid: no entry for %d in appMapping.data; no rule support for this ID.",
appId);
}
#include "app_info_table.h"
#include "application_ids.h"
+using namespace snort;
+
#define MAX_OPCODE 5
#define INVALID_OPCODE 3
struct ServiceDnsConfig
{
DetectorDNSHostPattern* DetectorDNSHostPatternList;
- snort::SearchTool* dns_host_host_matcher;
+ SearchTool* dns_host_host_matcher;
};
static ServiceDnsConfig serviceDnsConfig; // DNS service configuration
if (serviceDnsConfig.dns_host_host_matcher)
delete serviceDnsConfig.dns_host_host_matcher;
- serviceDnsConfig.dns_host_host_matcher = new snort::SearchTool("ac_full", true);
+ serviceDnsConfig.dns_host_host_matcher = new SearchTool("ac_full", true);
if (!serviceDnsConfig.dns_host_host_matcher)
return 0;
return APPID_INPROCESS;
}
-static int dns_host_scan_patterns(snort::SearchTool* matcher, const uint8_t* pattern, size_t size,
+static int dns_host_scan_patterns(SearchTool* matcher, const uint8_t* pattern, size_t size,
AppId* ClientAppId, AppId* payloadId)
{
MatchedDNSPatterns* mp = nullptr;
#include "search_engines/search_tool.h"
#include "utils/util.h"
+using namespace snort;
+
static const unsigned IMAP_USER_NAME_MAX_LEN = 32;
static const unsigned IMAP_TAG_MAX_LEN = 6;
static const unsigned MIN_CMDS = 3;
void ImapClientDetector::do_custom_init()
{
- cmd_matcher = new snort::SearchTool("ac_full", true);
+ cmd_matcher = new SearchTool("ac_full", true);
if ( !tcp_patterns.empty() )
{
static KerberosServiceDetector* krb_service_detector;
static int krb_walk_server_packet(KRBState* krbs, const uint8_t* s, const uint8_t* end,
- AppIdSession& asd, snort::Packet* pkt, const AppidSessionDirection dir,
+ AppIdSession& asd, Packet* pkt, const AppidSessionDirection dir,
const char* reqCname, AppidChangeBits& change_bits)
{
static const uint8_t KRB_SERVER_VERSION[] = "\x0a0\x003\x002\x001";
}
}
-static void register_pattern(snort::SearchTool** patterns, Pattern* pattern)
+static void register_pattern(SearchTool** patterns, Pattern* pattern)
{
if (!*patterns)
{
- *patterns = new snort::SearchTool("ac_full", true);
+ *patterns = new SearchTool("ac_full", true);
if (!*patterns)
{
- snort::ErrorMessage("Error initializing the pattern table\n");
+ ErrorMessage("Error initializing the pattern table\n");
return;
}
}
return 0;
}
-static int csd_pattern_tree_search(const uint8_t* data, uint16_t size, snort::SearchTool* patternTree)
+static int csd_pattern_tree_search(const uint8_t* data, uint16_t size, SearchTool* patternTree)
{
PServiceMatch* matches = nullptr;
int PatternServiceDetector::validate(AppIdDiscoveryArgs& args)
{
- snort::SearchTool* patternTree = nullptr;
+ SearchTool* patternTree = nullptr;
if (!args.data )
return APPID_ENULL;
if (!args.size || args.dir == APP_ID_FROM_RESPONDER)
return APPID_INPROCESS;
- snort::SearchTool* patternTree = (args.asd.protocol == IpProtocol::UDP) ?
+ SearchTool* patternTree = (args.asd.protocol == IpProtocol::UDP) ?
udp_pattern_matcher : tcp_pattern_matcher;
AppId id = csd_pattern_tree_search(args.data, args.size, patternTree);
if (!id)
unsigned count;
const char* vendor;
char version[MAX_VERSION_SIZE];
- snort::AppIdServiceSubtype* subtype;
+ AppIdServiceSubtype* subtype;
int error;
};
void Pop3ClientDetector::do_custom_init()
{
- cmd_matcher = new snort::SearchTool("ac_full", true);
+ cmd_matcher = new SearchTool("ac_full", true);
if ( !tcp_patterns.empty() )
{
ServicePOP3Data* sd = &dd->server;
while (sd->subtype)
{
- snort::AppIdServiceSubtype* sub = sd->subtype;
+ AppIdServiceSubtype* sub = sd->subtype;
sd->subtype = sub->next;
if (sub->service)
snort_free((void*)sub->service);
pd->vendor = ven_im;
else if ((p=service_strstr(begin, len, (const unsigned char*)ven_po, sizeof(ven_po)-1)))
{
- snort::AppIdServiceSubtype* sub;
+ AppIdServiceSubtype* sub;
pd->vendor = ven_po;
p += (sizeof(ven_po) - 1);
;
if (p == s || p >= line_end || !(*p))
goto ven_ver_done;
- sub = (snort::AppIdServiceSubtype*)snort_calloc(sizeof(snort::AppIdServiceSubtype));
+ sub = (AppIdServiceSubtype*)snort_calloc(sizeof(AppIdServiceSubtype));
unsigned sub_len;
sub_len = p - s;
#include "app_info_table.h"
#include "protocols/packet.h"
+using namespace snort;
+
enum SMTPClientState
{
SMTP_CLIENT_STATE_NONE,
* Returns 0 if a recognized product is found. Otherwise returns 1.
*/
int SmtpClientDetector::identify_client_version(ClientSMTPData* const fd, const uint8_t* product,
- const uint8_t* data_end, AppIdSession& asd, snort::Packet*, AppidChangeBits& change_bits)
+ const uint8_t* data_end, AppIdSession& asd, Packet*, AppidChangeBits& change_bits)
{
const uint8_t* p;
AppId appId = APP_ID_SMTP;
int HttpPatternMatchers::process_chp_list(CHPListElement* chplist)
{
for (size_t i = 0; i < NUM_HTTP_FIELDS; i++)
- chp_matchers[i] = new snort::SearchTool("ac_full", true);
+ chp_matchers[i] = new SearchTool("ac_full", true);
for (CHPListElement* chpe = chplist; chpe; chpe = chpe->next)
chp_matchers[chpe->chp_action.ptype]->add(chpe->chp_action.pattern,
HTTP_FIELD_PREFIX_USER_AGENT_SIZE },
};
-static snort::SearchTool* process_http_field_patterns(FieldPattern* patternList,
+static SearchTool* process_http_field_patterns(FieldPattern* patternList,
size_t patternListCount)
{
- snort::SearchTool* patternMatcher = new snort::SearchTool("ac_full", true);
+ SearchTool* patternMatcher = new SearchTool("ac_full", true);
for (size_t i=0; i < patternListCount; i++)
patternMatcher->add( (const char*)patternList[i].data, patternList[i].length,
return patternMatcher;
}
-static void process_patterns(snort::SearchTool& matcher, DetectorHTTPPatterns& patterns, bool
+static void process_patterns(SearchTool& matcher, DetectorHTTPPatterns& patterns, bool
last = true)
{
for (auto& pat: patterns)
}
// FIXIT-RC: Is this still necessary now that we use inspection events?
-void HttpPatternMatchers::get_http_offsets(snort::Packet* pkt, AppIdHttpSession* hsession)
+void HttpPatternMatchers::get_http_offsets(Packet* pkt, AppIdHttpSession* hsession)
{
constexpr auto MIN_HTTP_REQ_HEADER_SIZE = (sizeof("GET /\r\n\r\n") - 1);
static const uint8_t crlfcrlf[] = "\r\n\r\n";
}
void HttpPatternMatchers::get_server_vendor_version(const char* data, int len, char** version,
- char** vendor, snort::AppIdServiceSubtype** subtype)
+ char** vendor, AppIdServiceSubtype** subtype)
{
int vendor_len = len;
{
if ( subname && subname_len > 0 && subver && *subname )
{
- snort::AppIdServiceSubtype* sub =
- (snort::AppIdServiceSubtype*)snort_calloc(
- sizeof(snort::AppIdServiceSubtype));
+ AppIdServiceSubtype* sub =
+ (AppIdServiceSubtype*)snort_calloc(
+ sizeof(AppIdServiceSubtype));
char* tmp = (char*)snort_calloc(subname_len + 1);
memcpy(tmp, subname, subname_len);
tmp[subname_len] = 0;
if ( subname && subname_len > 0 && subver && *subname )
{
- snort::AppIdServiceSubtype* sub =
- (snort::AppIdServiceSubtype*)snort_calloc(sizeof(snort::AppIdServiceSubtype));
+ AppIdServiceSubtype* sub =
+ (AppIdServiceSubtype*)snort_calloc(sizeof(AppIdServiceSubtype));
char* tmp = (char*)snort_calloc(subname_len + 1);
memcpy(tmp, subname, subname_len);
tmp[subname_len] = 0;
for (unsigned i = 0; i <= partNum; i++)
snort_free((void*)parts[i].pattern);
- snort::ErrorMessage("Failed to allocate memory");
+ ErrorMessage("Failed to allocate memory");
return 0;
}
partNum++;
static CHPAction my_match;
static void* my_chp_rewritten = nullptr;
-void ApplicationDescriptor::set_id(const snort::Packet&, AppIdSession&, AppidSessionDirection, AppId, AppidChangeBits&) { }
+void ApplicationDescriptor::set_id(const Packet&, AppIdSession&, AppidSessionDirection, AppId, AppidChangeBits&) { }
TEST_GROUP(http_url_patterns_tests)
{
#include "lua_detector_module.h"
#include "lua_detector_util.h"
+using namespace snort;
+
/* Lua flag bit/index to C flag value (0 for invalid). */
static const uint64_t FLAGS_TABLE_LUA_TO_C[32]
{
*/
static int create_detector_flow(lua_State* L)
{
- snort::SfIp saddr;
- snort::SfIp daddr;
+ SfIp saddr;
+ SfIp daddr;
AppIdDetector* ud = *UserData<AppIdDetector>::check(L, DETECTOR, 1);
// Verify detector user data and that we are in packet context
{ 5353, IpProtocol::UDP, false },
};
- matcher = new snort::SearchTool("ac_full", true);
+ matcher = new SearchTool("ac_full", true);
for (unsigned i = 0; i < sizeof(patterns) / sizeof(*patterns); i++)
matcher->add((const char*)patterns[i].pattern, patterns[i].length, &patterns[i]);
matcher->prep();
#include "app_info_table.h"
#include "protocols/packet.h"
+using namespace snort;
+
#define REXEC_PORT 512
#define REXEC_MAX_PORT_PACKET 6
{
case REXEC_STATE_PORT:
if(rexec_snort_protocol_id == UNKNOWN_PROTOCOL_ID)
- rexec_snort_protocol_id = snort::SnortConfig::get_conf()->proto_ref->find("rexec");
+ rexec_snort_protocol_id = SnortConfig::get_conf()->proto_ref->find("rexec");
if (args.dir != APP_ID_FROM_INITIATOR)
goto bail;
goto bail;
if (port && args.pkt)
{
- const snort::SfIp* sip;
- const snort::SfIp* dip;
+ const SfIp* sip;
+ const SfIp* dip;
dip = args.pkt->ptrs.ip_api.get_dst();
sip = args.pkt->ptrs.ip_api.get_src();
#include "appid_debug.h"
#include "appid_inspector.h"
+using namespace snort;
+
#define RSHELL_PORT 514
#define RSHELL_MAX_PORT_PACKET 6
}
if (appidDebug->is_active())
- snort::LogMessage("AppIdDbg %s RSHELL state %d\n", appidDebug->get_debug_session(), rd->state);
+ LogMessage("AppIdDbg %s RSHELL state %d\n", appidDebug->get_debug_session(), rd->state);
switch (rd->state)
{
if (port)
{
if(rsh_error_snort_protocol_id == UNKNOWN_PROTOCOL_ID)
- rsh_error_snort_protocol_id = snort::SnortConfig::get_conf()->proto_ref->find("rsh-error");
+ rsh_error_snort_protocol_id = SnortConfig::get_conf()->proto_ref->find("rsh-error");
ServiceRSHELLData* tmp_rd = (ServiceRSHELLData*)snort_calloc(
sizeof(ServiceRSHELLData));
tmp_rd->state = RSHELL_STATE_STDERR_CONNECT_SYN;
tmp_rd->parent = rd;
- const snort::SfIp* dip = args.pkt->ptrs.ip_api.get_dst();
- const snort::SfIp* sip = args.pkt->ptrs.ip_api.get_src();
+ const SfIp* dip = args.pkt->ptrs.ip_api.get_dst();
+ const SfIp* sip = args.pkt->ptrs.ip_api.get_src();
AppIdSession* pf = AppIdSession::create_future_session(args.pkt, dip, 0, sip,
(uint16_t)port, IpProtocol::TCP, rsh_error_snort_protocol_id, APPID_EARLY_SESSION_FLAG_FW_RULE);
if (pf)
#include "appid_debug.h"
#include "appid_inspector.h"
+using namespace snort;
+
#define SNMP_PORT 161
#define SNMP_VERSION_1 0
if (snmp_verify_packet(&data, data+size, &pdu, &version))
{
if (appidDebug->is_active())
- snort::LogMessage("AppIdDbg %s SNMP payload verify failed\n", appidDebug->get_debug_session());
+ LogMessage("AppIdDbg %s SNMP payload verify failed\n", appidDebug->get_debug_session());
if (args.asd.get_session_flags(APPID_SESSION_UDP_REVERSED))
{
if (args.dir == APP_ID_FROM_RESPONDER)
}
if (appidDebug->is_active())
- snort::LogMessage("AppIdDbg %s SNMP state %d\n", appidDebug->get_debug_session(), sd->state);
+ LogMessage("AppIdDbg %s SNMP state %d\n", appidDebug->get_debug_session(), sd->state);
switch (sd->state)
{
/*adding expected connection in case the server doesn't send from 161*/
if(snmp_snort_protocol_id == UNKNOWN_PROTOCOL_ID)
- snmp_snort_protocol_id = snort::SnortConfig::get_conf()->proto_ref->find("snmp");
+ snmp_snort_protocol_id = SnortConfig::get_conf()->proto_ref->find("snmp");
- const snort::SfIp* dip = args.pkt->ptrs.ip_api.get_dst();
- const snort::SfIp* sip = args.pkt->ptrs.ip_api.get_src();
+ const SfIp* dip = args.pkt->ptrs.ip_api.get_dst();
+ const SfIp* sip = args.pkt->ptrs.ip_api.get_src();
AppIdSession* pf = AppIdSession::create_future_session(args.pkt, dip, 0, sip,
args.pkt->ptrs.sp, args.asd.protocol, snmp_snort_protocol_id, 0);
if (pf)
int mode = 0;
uint16_t block = 0;
uint16_t tmp = 0;
- const snort::SfIp* sip = nullptr;
- const snort::SfIp* dip = nullptr;
+ const SfIp* sip = nullptr;
+ const SfIp* dip = nullptr;
AppIdSession* pf = nullptr;
const uint8_t* data = args.data;
uint16_t size = args.size;
goto bail;
if(tftp_snort_protocol_id == UNKNOWN_PROTOCOL_ID)
- tftp_snort_protocol_id = snort::SnortConfig::get_conf()->proto_ref->find("tftp");
+ tftp_snort_protocol_id = SnortConfig::get_conf()->proto_ref->find("tftp");
tmp_td = (ServiceTFTPData*)snort_calloc(sizeof(ServiceTFTPData));
tmp_td->state = TFTP_STATE_TRANSFER;
}
-void ApplicationDescriptor::set_id(const snort::Packet&, AppIdSession&, AppidSessionDirection, AppId, AppidChangeBits&) { }
+void ApplicationDescriptor::set_id(const Packet&, AppIdSession&, AppidSessionDirection, AppId, AppidChangeBits&) { }
const char* AppInfoManager::get_app_name(AppId)
{
return test_app_name;
FlowData::~FlowData() = default;
}
-void ApplicationDescriptor::set_id(const snort::Packet&, AppIdSession&, AppidSessionDirection, AppId, AppidChangeBits&) { }
+void ApplicationDescriptor::set_id(const Packet&, AppIdSession&, AppidSessionDirection, AppId, AppidChangeBits&) { }
class AppIdInspector
{
public:
#include <CppUTest/CommandLineTestRunner.h>
#include <CppUTest/TestHarness.h>
-void ApplicationDescriptor::set_id(const snort::Packet&, AppIdSession&, AppidSessionDirection, AppId, AppidChangeBits&) { }
+void ApplicationDescriptor::set_id(const Packet&, AppIdSession&, AppidSessionDirection, AppId, AppidChangeBits&) { }
void AppIdHttpSession::set_http_change_bits(AppidChangeBits&, HttpFieldIds) {}
class TestDetector : public AppIdDetector
// Stubs for matchers
static HttpPatternMatchers* http_matchers;
HttpPatternMatchers::~HttpPatternMatchers() {}
-void HttpPatternMatchers::get_http_offsets(snort::Packet*, AppIdHttpSession*) {}
+void HttpPatternMatchers::get_http_offsets(Packet*, AppIdHttpSession*) {}
HttpPatternMatchers* HttpPatternMatchers::get_instance()
{
return http_matchers;
}
-void ApplicationDescriptor::set_id(const snort::Packet&, AppIdSession&, AppidSessionDirection, AppId, AppidChangeBits&) { }
+void ApplicationDescriptor::set_id(const Packet&, AppIdSession&, AppidSessionDirection, AppId, AppidChangeBits&) { }
// Stubs for AppIdModule
-AppIdModule::AppIdModule(): snort::Module("appid_mock", "appid_mock_help") {}
+AppIdModule::AppIdModule(): Module("appid_mock", "appid_mock_help") {}
AppIdModule::~AppIdModule() {}
void AppIdModule::sum_stats(bool) {}
void AppIdModule::show_dynamic_stats() {}
-bool AppIdModule::begin(char const*, int, snort::SnortConfig*) { return true; }
-bool AppIdModule::end(char const*, int, snort::SnortConfig*) { return true; }
-bool AppIdModule::set(char const*, snort::Value&, snort::SnortConfig*) { return true; }
-const snort::Command* AppIdModule::get_commands() const { return nullptr; }
+bool AppIdModule::begin(char const*, int, SnortConfig*) { return true; }
+bool AppIdModule::end(char const*, int, SnortConfig*) { return true; }
+bool AppIdModule::set(char const*, Value&, SnortConfig*) { return true; }
+const Command* AppIdModule::get_commands() const { return nullptr; }
const PegInfo* AppIdModule::get_pegs() const { return nullptr; }
PegCount* AppIdModule::get_counts() const { return nullptr; }
-snort::ProfileStats* AppIdModule::get_profile() const { return nullptr; }
+ProfileStats* AppIdModule::get_profile() const { return nullptr; }
// Stubs for config
AppIdModuleConfig::~AppIdModuleConfig() {}
// Stubs for AppIdInspector
AppIdInspector::AppIdInspector(AppIdModule&) {}
AppIdInspector::~AppIdInspector() = default;
-void AppIdInspector::eval(snort::Packet*) { }
-bool AppIdInspector::configure(snort::SnortConfig*) { return true; }
-void AppIdInspector::show(snort::SnortConfig*) { }
+void AppIdInspector::eval(Packet*) { }
+bool AppIdInspector::configure(SnortConfig*) { return true; }
+void AppIdInspector::show(SnortConfig*) { }
void AppIdInspector::tinit() { }
void AppIdInspector::tterm() { }
AppIdConfig* AppIdInspector::get_appid_config()
#include <CppUTest/CommandLineTestRunner.h>
#include <CppUTest/TestHarness.h>
-void ApplicationDescriptor::set_id(const snort::Packet&, AppIdSession&, AppidSessionDirection, AppId, AppidChangeBits&) { }
+void ApplicationDescriptor::set_id(const Packet&, AppIdSession&, AppidSessionDirection, AppId, AppidChangeBits&) { }
void AppIdHttpSession::set_http_change_bits(AppidChangeBits&, HttpFieldIds) {}
class MockServiceDetector : public ServiceDetector
THREAD_LOCAL AppIdDebug* appidDebug = nullptr;
void AppIdDebug::activate(const Flow*, const AppIdSession*, bool) { active = true; }
-void ApplicationDescriptor::set_id(const snort::Packet&, AppIdSession&, AppidSessionDirection, AppId, AppidChangeBits&) { }
+void ApplicationDescriptor::set_id(const Packet&, AppIdSession&, AppidSessionDirection, AppId, AppidChangeBits&) { }
using namespace snort;
namespace snort
};
FakeHttpMsgHeader* fake_msg_header = nullptr;
-void AppIdDiscovery::publish_appid_event(AppidChangeBits&, snort::Flow*) {}
+void AppIdDiscovery::publish_appid_event(AppidChangeBits&, Flow*) {}
void AppIdHttpSession::set_http_change_bits(AppidChangeBits&, HttpFieldIds) {}
#include <CppUTest/TestHarness.h>
using namespace snort;
-void ApplicationDescriptor::set_id(const snort::Packet&, AppIdSession&, AppidSessionDirection, AppId, AppidChangeBits&) { }
+void ApplicationDescriptor::set_id(const Packet&, AppIdSession&, AppidSessionDirection, AppId, AppidChangeBits&) { }
const char* AppInfoManager::get_app_name(AppId)
{
return "";
}
void HttpPatternMatchers::get_server_vendor_version(const char*, int, char**,
- char**, snort::AppIdServiceSubtype**)
+ char**, AppIdServiceSubtype**)
{
}
#include <CppUTest/CommandLineTestRunner.h>
#include <CppUTest/TestHarness.h>
-void ApplicationDescriptor::set_id(const snort::Packet&, AppIdSession&, AppidSessionDirection, AppId, AppidChangeBits&) { }
+void ApplicationDescriptor::set_id(const Packet&, AppIdSession&, AppidSessionDirection, AppId, AppidChangeBits&) { }
void BootpServiceDetector::AppIdFreeDhcpData(DHCPData* data)
{
delete data;
void AppIdDebug::activate(const Flow*, const AppIdSession*, bool) { active = true; }
-void ApplicationDescriptor::set_id(const snort::Packet&, AppIdSession&, AppidSessionDirection, AppId, AppidChangeBits&) { }
+void ApplicationDescriptor::set_id(const Packet&, AppIdSession&, AppidSessionDirection, AppId, AppidChangeBits&) { }
AppIdSession::AppIdSession(IpProtocol, const SfIp*, uint16_t, AppIdInspector&)
: FlowData(0) {}
AppIdSession::~AppIdSession() = default;
#define WhereMacro __FILE__ << ": " << __FUNCTION__ << ": " << __LINE__
+using namespace snort;
using namespace std;
class ThirdPartyAppIDModuleImpl : public ThirdPartyAppIDModule
public:
bool reset() override { return 1; }
- TPState process(const
snort::Packet&, AppidSessionDirection, vector<AppId>&,
+ TPState process(const Packet&, AppidSessionDirection, vector<AppId>&,
ThirdPartyAppIDAttributeData&) override { return TP_STATE_INIT; }
int disable_flags(uint32_t) override { return 0; }
}
const PegInfo* ArpSpoofModule::get_pegs() const
-{ return snort::simple_pegs; }
+{ return simple_pegs; }
PegCount* ArpSpoofModule::get_counts() const
{ return (PegCount*)&asstats; }
}
else
{
- const snort::wlan::WifiHdr* wifih = snort::layer::get_wifi_layer(p);
+ const wlan::WifiHdr* wifih = layer::get_wifi_layer(p);
if (wifih == nullptr)
return;
}
}
- const snort::arp::EtherARP* ah = snort::layer::get_arp_layer(p);
+ const arp::EtherARP* ah = layer::get_arp_layer(p);
/* is the ARP protocol type IP and the ARP hardware type Ethernet? */
if ((ntohs(ah->ea_hdr.ar_hrd) != 0x0001) ||
{
NormMode mode = NORM_MODE_ON;
- if ( snort::get_inspection_policy()->policy_mode != POLICY_MODE__INLINE )
+ if ( get_inspection_policy()->policy_mode != POLICY_MODE__INLINE )
mode = NORM_MODE_TEST;
if ( !SFDAQ::forwarding_packet(p->pkth) )
{
if ( !strcmp(fqn, NORM_NAME) )
{
- NetworkPolicy* policy = snort::get_network_policy();
+ NetworkPolicy* policy = get_network_policy();
// FIXIT-M untangle these policies. this is a workaround for loading inspection-only confs
if ( policy == nullptr )
{
set_network_policy(sc);
- policy = snort::get_network_policy();
+ policy = get_network_policy();
set_network_policy((NetworkPolicy*)nullptr);
}
if ( Norm_IsEnabled(nc, NORM_IP4_TTL) )
{
- NetworkPolicy* policy = snort::get_network_policy();
+ NetworkPolicy* policy = get_network_policy();
LogMessage("%12s: %s (min=%d, new=%d)\n", "ip4.ttl", ON,
policy->min_ttl, policy->new_ttl);
}
if ( Norm_IsEnabled(nc, NORM_IP6_TTL) )
{
- NetworkPolicy* policy = snort::get_network_policy();
+ NetworkPolicy* policy = get_network_policy();
LogMessage("%12s: %s (min=%d, new=%d)\n", "ip6.hops",
ON, policy->min_ttl, policy->new_ttl);
}
public:
Normalizer(const NormalizerConfig&);
- bool configure(snort::SnortConfig*) override;
- void show(snort::SnortConfig*) override;
- void eval(snort::Packet*) override;
+ bool configure(SnortConfig*) override;
+ void show(SnortConfig*) override;
+ void eval(Packet*) override;
private:
NormalizerConfig config;
// but would be better if binder could select
// in which case normal_mask must be moved to flow
// from cwaxman - why can't normal_mask be applied directly from Normalizer?
-bool Normalizer::configure(snort::SnortConfig*)
+bool Normalizer::configure(SnortConfig*)
{
// FIXIT-M move entire config to network policy? Leaving split loads the currently selected
// network policy with whichever instantiation of an inspection policy this normalize is in
- NetworkPolicy* nap = snort::get_network_policy();
+ NetworkPolicy* nap = get_network_policy();
nap->normal_mask = config.normalizer_flags;
if ( !(t_flags & nf) )
return false;
- if ( snort::get_inspection_policy()->policy_mode != POLICY_MODE__INLINE )
+ if ( get_inspection_policy()->policy_mode != POLICY_MODE__INLINE )
return false;
- NetworkPolicy* nap = snort::get_network_policy();
+ NetworkPolicy* nap = get_network_policy();
return ( (nap->normal_mask & nf) != 0 );
}
{
if (Normalize_IsEnabled(nf))
{
- const PolicyMode mode = snort::get_inspection_policy()->policy_mode;
+ const PolicyMode mode = get_inspection_policy()->policy_mode;
if ( mode == POLICY_MODE__INLINE )
return NORM_MODE_ON;
return NORM_MODE_TEST;
}
-void Normalizer::show(snort::SnortConfig* sc)
+void Normalizer::show(SnortConfig* sc)
{
LogMessage("Normalizer config:\n");
Print_IP4(sc, &config);
Print_TCP(&config);
}
-void Normalizer::eval(snort::Packet* p)
+void Normalizer::eval(Packet* p)
{
Profile profile(norm_perf_stats);
#define TRACKER_NAME PERF_NAME "_cpu"
-using namespace std;
+using namespace snort;
static inline uint64_t get_microseconds(struct timeval t)
{
CPUTracker::CPUTracker(PerfConfig *perf) : PerfTracker(perf, TRACKER_NAME)
{
- formatter->register_section("thread_" + to_string(snort::get_instance_id()));
+ formatter->register_section("thread_" + std::to_string(get_instance_id()));
formatter->register_field("cpu_user", &user_stat);
formatter->register_field("cpu_system", &system_stat);
formatter->register_field("cpu_wall", &wall_stat);
}
const PegInfo* PerfMonModule::get_pegs() const
-{ return snort::simple_pegs; }
+{ return simple_pegs; }
PegCount* PerfMonModule::get_counts() const
{ return (PegCount*)&pmstats; }
file_name, mode, get_error(errno));
}
- if (chown(file_name, snort::SnortConfig::get_uid(),
- snort::SnortConfig::get_gid()) != 0)
+ if (chown(file_name, SnortConfig::get_uid(),
+ SnortConfig::get_gid()) != 0)
{
WarningMessage("perfmonitor: Unable to change permissions of "
"stats file '%s' to user:%d and group:%d: %s.\n",
- file_name, snort::SnortConfig::get_uid(), snort::SnortConfig::get_gid(),
+ file_name, SnortConfig::get_uid(), SnortConfig::get_gid(),
get_error(errno));
}
}
{ return &psPerfStats; }
const PegInfo* PortScanModule::get_pegs() const
-{ return snort::simple_pegs; }
+{ return simple_pegs; }
PegCount* PortScanModule::get_counts() const
{ return (PegCount*)&spstats; }
return bytes_allocated;
}
-static int add_ip(snort::SfCidr* ip_addr,INFO info_ptr, ReputationConfig* config)
+static int add_ip(SfCidr* ip_addr,INFO info_ptr, ReputationConfig* config)
{
int ret;
int final_ret = IP_INSERT_SUCCESS;
}
// FIXIT-L X Remove this or at least move it to SfCidr?
-static int snort_pton_address(char const* src, snort::SfCidr* dest)
+static int snort_pton_address(char const* src, SfCidr* dest)
{
unsigned char _temp[sizeof(struct in6_addr)];
// FIXIT-L X Remove this or at least move it to SfCidr?
#define isident(x) (isxdigit((x)) || (x) == ':' || (x) == '.')
-static int snort_pton(char const* src, snort::SfCidr* dest)
+static int snort_pton(char const* src, SfCidr* dest)
{
char ipbuf[INET6_ADDRSTRLEN];
char cidrbuf[sizeof("128")];
static int process_line(char* line, INFO info, ReputationConfig* config)
{
- snort::SfCidr address;
+ SfCidr address;
if ( !line || *line == '\0' )
return IP_INSERT_SUCCESS;
static inline bool is_eligible_packet(const Packet* p)
{
if ( p->has_ip() or
- memcmp(snort::layer::get_eth_layer(p)->ether_src, zero_mac, MAC_SIZE) )
+ memcmp(layer::get_eth_layer(p)->ether_src, zero_mac, MAC_SIZE) )
return true;
return false;
}
return false;
if ( p->is_from_client() )
{
- const snort::SfIp* src = p->ptrs.ip_api.get_src();
- const snort::SfIp* dst = p->ptrs.ip_api.get_dst();
+ const SfIp* src = p->ptrs.ip_api.get_src();
+ const SfIp* dst = p->ptrs.ip_api.get_dst();
if ( !src->is_set() and IN6_IS_ADDR_MULTICAST(dst->get_ip6_ptr()) and
p->ptrs.sp == 68 and p->ptrs.dp == 67 )
return false; // skip BOOTP
}
-void RnaPnd::generate_change_host_update(RnaTracker* ht, const snort::Packet* p,
+void RnaPnd::generate_change_host_update(RnaTracker* ht, const Packet* p,
const SfIp* src_ip, const uint8_t* src_mac, time_t sec)
{
if ( !ht || !update_timeout)
default:
if ( packet_force_dropped() )
- send_unreach(p, snort::UnreachResponse::FWD);
+ send_unreach(p, UnreachResponse::FWD);
else
- send_unreach(p, snort::UnreachResponse::PORT);
+ send_unreach(p, UnreachResponse::PORT);
break;
}
}
}
}
-void Active::send_unreach(Packet* p, snort::UnreachResponse type)
+void Active::send_unreach(Packet* p, UnreachResponse type)
{
uint32_t len;
const uint8_t* rej;
#include "sfip/sf_vartable.h"
#include "utils/util.h"
+using namespace snort;
+
sfip_var_t* sfip_var_from_string(const char* addr, const char* caller)
{
sfip_var_t* ret;
int ret_code;
vartable_t* ip_vartable = nullptr;
- if (snort::get_ips_policy())
- ip_vartable = snort::get_ips_policy()->ip_vartable;
+ if (get_ips_policy())
+ ip_vartable = get_ips_policy()->ip_vartable;
ret = (sfip_var_t*)snort_calloc(sizeof(sfip_var_t));
{
if (ret_code == SFIP_LOOKUP_FAILURE)
{
- snort::ParseError("%s: Undefined variable in the IP list: %s", caller, addr);
+ ParseError("%s: Undefined variable in the IP list: %s", caller, addr);
return ret;
}
else if (ret_code == SFIP_CONFLICT)
{
- snort::ParseError("%s: Negated IP ranges equal to or"
+ ParseError("%s: Negated IP ranges equal to or"
" more-specific than non-negated ranges are not allowed."
" Consider inverting the logic: %s.", caller, addr);
return ret;
}
else if (ret_code == SFIP_LOOKUP_UNAVAILABLE)
{
- snort::ParseError("%s: Error parsing IP list: %s. "
+ ParseError("%s: Error parsing IP list: %s. "
"Snort variables are only permitted in rule headers, otherwise use Lua variables.",
caller, addr);
return ret;
}
else
{
- snort::ParseError("%s: Unable to process IP list: %s", caller, addr);
+ ParseError("%s: Unable to process IP list: %s", caller, addr);
return ret;
}
}
(c == ','))
{
/* Open ended range, highport is 65k */
- hport = snort::MAX_PORTS - 1;
+ hport = MAX_PORTS - 1;
PortObjectAddRange(po, lport, hport);
return po;
}
static bool exec(
FsmAction act, string& tok,
- RuleParseState& rps, snort::SnortConfig* sc)
+ RuleParseState& rps, SnortConfig* sc)
{
switch ( act )
{
return 1; // escape, option goes to "
}
-void parse_stream(istream& is, snort::SnortConfig* sc)
+void parse_stream(istream& is, SnortConfig* sc)
{
string tok;
TokenType type;
PortObject* po;
POParser pop;
int rstat;
- PortVarTable* portVarTable = snort::get_ips_policy()->portVarTable;
+ PortVarTable* portVarTable = get_ips_policy()->portVarTable;
DisallowCrossTableDuplicateVars(sc, name, VAR_TYPE__PORTVAR);
void DisallowCrossTableDuplicateVars(
SnortConfig*, const char* name, VarType var_type)
{
- IpsPolicy* dp = snort::get_ips_policy();
+ IpsPolicy* dp = get_ips_policy();
VarEntry* var_table = dp->var_table;
PortVarTable* portVarTable = dp->portVarTable;
vartable_t* ip_vartable = dp->ip_vartable;
VarEntry* VarDefine(
SnortConfig* sc, const char* name, const char* value)
{
- IpsPolicy* dp = snort::get_ips_policy();
+ IpsPolicy* dp = get_ips_policy();
VarEntry* var_table = dp->var_table;
vartable_t* ip_vartable = dp->ip_vartable;
VarEntry* p;
const char* VarSearch(SnortConfig* sc, const char* name)
{
- IpsPolicy* dp = snort::get_ips_policy();
+ IpsPolicy* dp = get_ips_policy();
VarEntry* var_table = dp->var_table;
PortVarTable* portVarTable = dp->portVarTable;
vartable_t* ip_vartable = dp->ip_vartable;
#include "piglet_output.h"
#include "piglet_runner.h"
+using namespace snort;
+
namespace Piglet
{
int main()
}
bool piglet_mode()
-{ return snort::SnortConfig::get_conf()->run_flags & RUN_FLAG__PIGLET; }
+{ return SnortConfig::get_conf()->run_flags & RUN_FLAG__PIGLET; }
} // namespace Piglet
#include "framework/mpse.h"
+using namespace snort;
+
static const luaL_Reg methods[] =
{
{ nullptr, nullptr }
};
-const struct Lua::InstanceInterface<snort::Mpse> SearchEngineIface =
+const struct Lua::InstanceInterface<Mpse> SearchEngineIface =
{
"SearchEngine",
methods
p=(PortObjectItem*)sflist_next(&pos) )
{
if ((p->lport == poi->lport) && (p->hport == poi->hport))
- snort::ParseWarning(WARN_RULES, "duplicate ports in list");
+ ParseWarning(WARN_RULES, "duplicate ports in list");
}
sflist_add_tail(po->item_list, poi);
SnortSnprintfAppend(buf, bufsize, " ]");
- snort::LogMessage("%s", buf);
+ LogMessage("%s", buf);
snort_free(buf);
}
unsigned i;
/* static for printing so we don't put so many bytes on the stack */
- static char print_buf[snort::MAX_PORTS]; // FIXIT-L delete this; replace with local stringstream
+ static char print_buf[MAX_PORTS]; // FIXIT-L delete this; replace with local stringstream
int bufsize = sizeof(print_buf);
print_buf[0] = '\0';
}
SnortSnprintfAppend(print_buf, bufsize, " ]\n }\n");
- snort::LogMessage("%s", print_buf);
+ LogMessage("%s", print_buf);
snort_free(rlist);
}
// printing
//-------------------------------------------------------------------------
-char po_print_buf[snort::MAX_PORTS];
+char po_print_buf[MAX_PORTS];
#include "port_object.h"
#include "port_table.h"
+using namespace snort;
+
#define DEFAULT_LARGE_RULE_GROUP 9
PortProto::PortProto()
nfp = PortObjectNew();
if ( !src or !dst or !any or !nfp )
- snort::ParseAbort("can't allocate port structs");
+ ParseAbort("can't allocate port structs");
// someday these could be read from snort.conf, something like...
// 'config portlist: large-rule-count <val>'
RulePortTables* rpt = new RulePortTables;
if ( !(rpt->svc_any = PortObjectNew()) )
- snort::ParseAbort("ParseRulesFile udp any-any PortObjectNew() failed");
+ ParseAbort("ParseRulesFile udp any-any PortObjectNew() failed");
PortObjectAddPortAny(rpt->svc_any);
switch (type)
{
- case snort::UnreachResponse::NET:
+ case UnreachResponse::NET:
icmph->code = icmp::IcmpCode::NET_UNREACH;
break;
- case snort::UnreachResponse::HOST:
+ case UnreachResponse::HOST:
icmph->code = icmp::IcmpCode::HOST_UNREACH;
break;
- case snort::UnreachResponse::PORT:
+ case UnreachResponse::PORT:
icmph->code = icmp::IcmpCode::PORT_UNREACH;
break;
- case snort::UnreachResponse::FWD:
+ case UnreachResponse::FWD:
icmph->code = icmp::IcmpCode::PKT_FILTERED;
break;
default: // future proofing
switch (type)
{
- case snort::UnreachResponse::NET:
+ case UnreachResponse::NET:
icmph->code = icmp::Icmp6Code::UNREACH_NET;
break;
- case snort::UnreachResponse::HOST:
+ case UnreachResponse::HOST:
icmph->code = icmp::Icmp6Code::UNREACH_HOST;
break;
- case snort::UnreachResponse::PORT:
+ case UnreachResponse::PORT:
icmph->code = icmp::Icmp6Code::UNREACH_PORT;
break;
- case snort::UnreachResponse::FWD:
+ case UnreachResponse::FWD:
icmph->code = icmp::Icmp6Code::UNREACH_FILTER_PROHIB;
break;
default: // future proofing
#include "main/thread.h"
#include "utils/util.h"
+using namespace snort;
+
#define MEMASSERT(p,s) if (!(p)) { fprintf(stderr,"ACSM-No Memory: %s\n",s); exit(0); }
static int max_memory = 0;
return 0;
}
-static void acsmBuildMatchStateTrees(snort::SnortConfig* sc, ACSM_STRUCT* acsm)
+static void acsmBuildMatchStateTrees(SnortConfig* sc, ACSM_STRUCT* acsm)
{
ACSM_PATTERN* mlist;
return 0;
}
-int acsmCompile(snort::SnortConfig* sc, ACSM_STRUCT* acsm)
+int acsmCompile(SnortConfig* sc, ACSM_STRUCT* acsm)
{
if ( int rval = _acsmCompile (acsm) )
return rval;
#define printf LogMessage
-#define MEMASSERT(p,s) if (!(p)) { snort::FatalError("ACSM-No Memory: %s\n",s); }
+#define MEMASSERT(p,s) if (!(p)) { FatalError("ACSM-No Memory: %s\n",s); }
static int acsm2_total_memory = 0;
static int acsm2_pattern_memory = 0;
}
}
-static void acsmBuildMatchStateTrees2(snort::SnortConfig* sc, ACSM_STRUCT2* acsm)
+static void acsmBuildMatchStateTrees2(SnortConfig* sc, ACSM_STRUCT2* acsm)
{
ACSM_PATTERN2** MatchList = acsm->acsmMatchList;
ACSM_PATTERN2* mlist;
return 0;
}
-int acsmCompile2(snort::SnortConfig* sc, ACSM_STRUCT2* acsm)
+int acsmCompile2(SnortConfig* sc, ACSM_STRUCT2* acsm)
{
if ( int rval = _acsmCompile2(acsm) )
return rval;
return 0;
}
-static void bnfaBuildMatchStateTrees(snort::SnortConfig* sc, bnfa_struct_t* bnfa)
+static void bnfaBuildMatchStateTrees(SnortConfig* sc, bnfa_struct_t* bnfa)
{
bnfa_match_node_t* mn;
bnfa_match_node_t** MatchList = bnfa->bnfaMatchList;
return 0;
}
-int bnfaCompile(snort::SnortConfig* sc, bnfa_struct_t* bnfa)
+int bnfaCompile(SnortConfig* sc, bnfa_struct_t* bnfa)
{
if ( int rval = _bnfaCompile (bnfa) )
return rval;
};
const PegInfo* BoModule::get_pegs() const
-{ return snort::simple_pegs; }
+{ return simple_pegs; }
PegCount* BoModule::get_counts() const
{ return (PegCount*)&bostats; }
DCE2_Detect(sd);
return;
}
- snort::Packet* top_pkt = DetectionEngine::get_current_packet();
+ Packet* top_pkt = DetectionEngine::get_current_packet();
DetectionEngine::detect(top_pkt);
dce2_detected = 1;
/* Always reset rule option data after detecting */
DCE2_ResetRopts(sd , top_pkt);
}
-DCE2_TransType get_dce2_trans_type(const snort::Packet* p)
+DCE2_TransType get_dce2_trans_type(const Packet* p)
{
DCE2_SmbSsnData* smb_data = get_dce2_smb_session_data(p->flow);
DCE2_SsnData* sd = (smb_data != nullptr) ? &(smb_data->sd) : nullptr;
uint16_t DCE2_GetRpktMaxData(DCE2_RpktType rtype)
{
- snort::Packet* p = DetectionEngine::get_current_packet();
+ Packet* p = DetectionEngine::get_current_packet();
uint16_t overhead = 0;
switch (rtype)
assert(false);
return 0;
}
- return (snort::Packet::max_dsize - overhead);
+ return (Packet::max_dsize - overhead);
}
-static void dce2_fill_rpkt_info(snort::Packet* rpkt, snort::Packet* p)
+static void dce2_fill_rpkt_info(Packet* rpkt, Packet* p)
{
rpkt->endianness = new DceEndianness();
rpkt->pkth = p->pkth;
rpkt->user_network_policy_id = p->user_network_policy_id;
}
-snort::Packet* DCE2_GetRpkt(snort::Packet* p,DCE2_RpktType rpkt_type,
+Packet* DCE2_GetRpkt(Packet* p,DCE2_RpktType rpkt_type,
const uint8_t* data, uint32_t data_len)
{
- snort::Packet* rpkt = DetectionEngine::set_next_packet(p);
+ Packet* rpkt = DetectionEngine::set_next_packet(p);
uint8_t* wrdata = const_cast<uint8_t*>(rpkt->data);
dce2_fill_rpkt_info(rpkt, p);
uint16_t data_overhead = 0;
return nullptr;
}
- if ((data_overhead + data_len) > snort::Packet::max_dsize)
- data_len -= (data_overhead + data_len) - snort::Packet::max_dsize;
+ if ((data_overhead + data_len) > Packet::max_dsize)
+ data_len -= (data_overhead + data_len) - Packet::max_dsize;
- if (data_len > snort::Packet::max_dsize - data_overhead)
+ if (data_len > Packet::max_dsize - data_overhead)
{
delete rpkt->endianness;
rpkt->endianness = nullptr;
}
memcpy_s((void*)(rpkt->data + data_overhead),
- snort::Packet::max_dsize - data_overhead, data, data_len);
+ Packet::max_dsize - data_overhead, data, data_len);
rpkt->dsize = data_len + data_overhead;
using_rpkt = true;
return rpkt;
}
-DCE2_Ret DCE2_AddDataToRpkt(snort::Packet* rpkt, const uint8_t* data, uint32_t data_len)
+DCE2_Ret DCE2_AddDataToRpkt(Packet* rpkt, const uint8_t* data, uint32_t data_len)
{
if ((rpkt == nullptr) || (data == nullptr) || (data_len == 0))
return DCE2_RET__ERROR;
return DCE2_RET__ERROR;
// FIXIT-L PORT_IF_NEEDED packet size and hdr check
- const uint8_t* pkt_data_end = rpkt->data + snort::Packet::max_dsize;
+ const uint8_t* pkt_data_end = rpkt->data + Packet::max_dsize;
const uint8_t* payload_end = rpkt->data + rpkt->dsize;
if ((payload_end + data_len) > pkt_data_end)
data_len = pkt_data_end - payload_end;
- if (data_len > snort::Packet::max_dsize - rpkt->dsize)
+ if (data_len > Packet::max_dsize - rpkt->dsize)
return DCE2_RET__ERROR;
- memcpy_s((void*)(payload_end), snort::Packet::max_dsize - rpkt->dsize,
+ memcpy_s((void*)(payload_end), Packet::max_dsize - rpkt->dsize,
data, data_len);
rpkt->dsize += (uint16_t)data_len;
#include "dce_smb_utils.h"
#include "dce_smb2.h"
+using namespace snort;
+
THREAD_LOCAL dce2SmbStats dce2_smb_stats;
-THREAD_LOCAL snort::ProfileStats dce2_smb_pstat_main;
+THREAD_LOCAL ProfileStats dce2_smb_pstat_main;
//-------------------------------------------------------------------------
// debug stuff
// class stuff
//-------------------------------------------------------------------------
-class Dce2Smb : public snort::Inspector
+class Dce2Smb : public Inspector
{
public:
Dce2Smb(const dce2SmbProtoConf&);
~Dce2Smb() override;
- void show(snort::SnortConfig*) override;
- void eval(snort::Packet*) override;
- void clear(snort::Packet*) override;
- snort::StreamSplitter* get_splitter(bool c2s) override
+ void show(SnortConfig*) override;
+ void eval(Packet*) override;
+ void clear(Packet*) override;
+ StreamSplitter* get_splitter(bool c2s) override
{
return new Dce2SmbSplitter(c2s);
}
if ((config.smb_file_inspection == DCE2_SMB_FILE_INSPECTION_ONLY)
|| (config.smb_file_inspection == DCE2_SMB_FILE_INSPECTION_ON))
{
- snort::Active::set_enabled();
+ Active::set_enabled();
}
}
}
}
-void Dce2Smb::show(snort::SnortConfig*)
+void Dce2Smb::show(SnortConfig*)
{
print_dce2_smb_conf(config);
}
-void Dce2Smb::eval(snort::Packet* p)
+void Dce2Smb::eval(Packet* p)
{
DCE2_SmbSsnData* dce2_smb_sess;
- snort::Profile profile(dce2_smb_pstat_main);
+ Profile profile(dce2_smb_pstat_main);
assert(p->has_tcp_data());
assert(p->flow);
}
}
-void Dce2Smb::clear(snort::Packet* p)
+void Dce2Smb::clear(Packet* p)
{
DCE2_SmbSsnData* dce2_smb_sess = get_dce2_smb_session_data(p->flow);
if ( dce2_smb_sess )
// api stuff
//-------------------------------------------------------------------------
-static snort::Module* mod_ctor()
+static Module* mod_ctor()
{
return new Dce2SmbModule;
}
-static void mod_dtor(snort::Module* m)
+static void mod_dtor(Module* m)
{
delete m;
}
DceContextData::init(DCE2_TRANS_TYPE__SMB);
}
-static snort::Inspector* dce2_smb_ctor(snort::Module* m)
+static Inspector* dce2_smb_ctor(Module* m)
{
Dce2SmbModule* mod = (Dce2SmbModule*)m;
dce2SmbProtoConf config;
return new Dce2Smb(config);
}
-static void dce2_smb_dtor(snort::Inspector* p)
+static void dce2_smb_dtor(Inspector* p)
{
delete p;
}
-const snort::InspectApi dce2_smb_api =
+const InspectApi dce2_smb_api =
{
{
PT_INSPECTOR,
- sizeof(snort::InspectApi),
+ sizeof(InspectApi),
INSAPI_VERSION,
0,
API_RESERVED,
mod_ctor,
mod_dtor
},
- snort::IT_SERVICE,
+ IT_SERVICE,
PROTO_BIT__PDU,
nullptr, // buffers
"netbios-ssn",
{
const uint8_t* data_ptr = DCE2_BufferData(ftracker->fp_writex_raw->buf);
uint32_t data_len = DCE2_BufferLength(ftracker->fp_writex_raw->buf);
- snort::Packet* rpkt = DCE2_SmbGetRpkt(ssd,
+ Packet* rpkt = DCE2_SmbGetRpkt(ssd,
&data_ptr, &data_len, DCE2_RPKT_TYPE__SMB_TRANS);
if (rpkt == nullptr)
uint16_t byte_count = DCE2_ComInfoByteCount(com_info);
uint16_t com_dcnt = SmbReadRespCount((const SmbReadResp*)nb_ptr);
uint8_t fmt = *(nb_ptr + com_size);
- uint16_t fmt_dcnt = snort::alignedNtohs((const uint16_t*)(nb_ptr + com_size + 1));
+ uint16_t fmt_dcnt = alignedNtohs((const uint16_t*)(nb_ptr + com_size + 1));
dce2_move(nb_ptr, nb_len, (com_size + 3));
uint16_t byte_count = DCE2_ComInfoByteCount(com_info);
uint8_t fmt = *(nb_ptr + com_size);
uint16_t com_dcnt = SmbWriteReqCount((const SmbWriteReq*)nb_ptr);
- uint16_t fmt_dcnt = snort::alignedNtohs((const uint16_t*)(nb_ptr + com_size + 1));
+ uint16_t fmt_dcnt = alignedNtohs((const uint16_t*)(nb_ptr + com_size + 1));
uint16_t fid = SmbWriteReqFid((const SmbWriteReq*)nb_ptr);
uint32_t offset = SmbWriteReqOffset((const SmbWriteReq*)nb_ptr);
uint16_t byte_count = DCE2_ComInfoByteCount(com_info);
uint8_t fmt = *(nb_ptr + com_size);
uint16_t com_dcnt = SmbLockAndReadRespCount((const SmbLockAndReadResp*)nb_ptr);
- uint16_t fmt_dcnt = snort::alignedNtohs((const uint16_t*)(nb_ptr + com_size + 1));
+ uint16_t fmt_dcnt = alignedNtohs((const uint16_t*)(nb_ptr + com_size + 1));
dce2_move(nb_ptr, nb_len, (com_size + 3));
uint16_t byte_count = DCE2_ComInfoByteCount(com_info);
uint8_t fmt = *(nb_ptr + com_size);
uint16_t com_dcnt = SmbWriteAndUnlockReqCount((const SmbWriteAndUnlockReq*)nb_ptr);
- uint16_t fmt_dcnt = snort::alignedNtohs((const uint16_t*)(nb_ptr + com_size + 1));
+ uint16_t fmt_dcnt = alignedNtohs((const uint16_t*)(nb_ptr + com_size + 1));
uint16_t fid = SmbWriteAndUnlockReqFid((const SmbWriteAndUnlockReq*)nb_ptr);
uint32_t offset = SmbWriteAndUnlockReqOffset((const SmbWriteAndUnlockReq*)nb_ptr);
return(true);
}
-bool Dce2SmbModule::set(const char* fqn, snort::Value& v, snort::SnortConfig* c)
+bool Dce2SmbModule::set(const char* fqn, Value& v, SnortConfig* c)
{
if (dce2_set_co_config(v,config.common))
return true;
#include "framework/module.h"
#include "dce_list.h"
+namespace snort
+{
struct SnortConfig;
+}
#define DCE2_VALID_SMB_VERSION_FLAG_V1 1
#define DCE2_VALID_SMB_VERSION_FLAG_V2 2
// Only two parameters but more seems okay
if (param_len >= 2)
{
- if ((snort::alignedNtohs((const uint16_t*)param_ptr) & PIPE_STATE_MESSAGE_MODE))
+ if ((alignedNtohs((const uint16_t*)param_ptr) & PIPE_STATE_MESSAGE_MODE))
ttracker->pipe_byte_mode = false;
else
ttracker->pipe_byte_mode = true;
|| (ftracker->ff_bytes_processed != 0))
return DCE2_RET__IGNORE;
- ssd->cur_rtracker->file_size = snort::alignedNtohq((const uint64_t*)data_ptr);
+ ssd->cur_rtracker->file_size = alignedNtohq((const uint64_t*)data_ptr);
ssd->cur_rtracker->ftracker = ftracker;
return DCE2_RET__SUCCESS;
{
const uint8_t* data_ptr = DCE2_BufferData(ttracker->dbuf);
uint32_t data_len = DCE2_BufferLength(ttracker->dbuf);
- snort::Packet* rpkt = DCE2_SmbGetRpkt(ssd, &data_ptr,
+ Packet* rpkt = DCE2_SmbGetRpkt(ssd, &data_ptr,
&data_len, DCE2_RPKT_TYPE__SMB_TRANS);
if (rpkt == nullptr)
{
const uint8_t* data_ptr = DCE2_BufferData(ttracker->dbuf);
uint32_t data_len = DCE2_BufferLength(ttracker->dbuf);
- snort::Packet* rpkt = DCE2_SmbGetRpkt(ssd, &data_ptr, &data_len, DCE2_RPKT_TYPE__SMB_TRANS);
+ Packet* rpkt = DCE2_SmbGetRpkt(ssd, &data_ptr, &data_len, DCE2_RPKT_TYPE__SMB_TRANS);
if (rpkt == nullptr)
return DCE2_RET__ERROR;
dce2_smb_sess->tid = DCE2_SENTINEL;
dce2_smb_sess->ftracker.fid_v1 = DCE2_SENTINEL;
dce2_smb_sess->rtracker.mid = DCE2_SENTINEL;
- dce2_smb_sess->max_file_depth = snort::FileService::get_max_file_depth();
+ dce2_smb_sess->max_file_depth = FileService::get_max_file_depth();
DCE2_ResetRopts(&dce2_smb_sess->sd, p);
#include "ftp_bounce_lookup.h"
#include "ftpp_return_codes.h"
+using namespace snort;
+
void CleanupFTPCMDConf(void* ftpCmd)
{
FTP_CMD_CONF* FTPCmd = (FTP_CMD_CONF*)ftpCmd;
if ( cmdConf->check_validity && !len )
{
- snort::ErrorMessage("FTPConfigCheck() configuration for server, "
+ ErrorMessage("FTPConfigCheck() configuration for server, "
"command '%s' has max length of 0 and parameters to validate\n",
cmdConf->cmd_name);
config_error = 1;
* Returns: -1 on error
*
*/
-int CheckFTPServerConfigs(snort::SnortConfig*, FTP_SERVER_PROTO_CONF* serverConf)
+int CheckFTPServerConfigs(SnortConfig*, FTP_SERVER_PROTO_CONF* serverConf)
{
if (CheckFTPCmdOptions(serverConf))
{
- snort::ErrorMessage("FTPConfigCheck(): invalid configuration for FTP commands\n");
+ ErrorMessage("FTPConfigCheck(): invalid configuration for FTP commands\n");
return -1;
}
return 0;
}
// FIXIT-L eliminate legacy void* cruft
-int FTPCheckConfigs(snort::SnortConfig* sc, void* pData)
+int FTPCheckConfigs(SnortConfig* sc, void* pData)
{
FTP_SERVER_PROTO_CONF* config = (FTP_SERVER_PROTO_CONF*)pData;
if ( !config )
{
- snort::ErrorMessage("FTP configuration requires "
+ ErrorMessage("FTP configuration requires "
"default client and default server configurations.\n");
return -1;
}
return rval;
// Verify that FTP client and FTP data inspectors are initialized.
- if(!snort::InspectorManager::get_inspector(FTP_CLIENT_NAME, false))
+ if(!InspectorManager::get_inspector(FTP_CLIENT_NAME, false))
{
- snort::ParseError("ftp_server requires that %s also be configured.", FTP_CLIENT_NAME);
+ ParseError("ftp_server requires that %s also be configured.", FTP_CLIENT_NAME);
return -1;
}
- if(!snort::InspectorManager::get_inspector(FTP_DATA_NAME, false))
+ if(!InspectorManager::get_inspector(FTP_DATA_NAME, false))
{
- snort::ParseError("ftp_server requires that %s also be configured.", FTP_DATA_NAME);
+ ParseError("ftp_server requires that %s also be configured.", FTP_DATA_NAME);
return -1;
}
return 0;
}
-void do_detection(snort::Packet* p)
+void do_detection(Packet* p)
{
- snort::DataBus::publish(PACKET_EVENT, p);
- snort::DetectionEngine::disable_all(p);
+ DataBus::publish(PACKET_EVENT, p);
+ DetectionEngine::disable_all(p);
}
* Returns: int => return code indicating error or success
*
*/
-int ftp_bounce_lookup_add(BOUNCE_LOOKUP* BounceLookup, const snort::SfIp* Ip,
+int ftp_bounce_lookup_add(BOUNCE_LOOKUP* BounceLookup, const SfIp* Ip,
FTP_BOUNCE_TO* BounceTo)
{
int iRet;
* matching IP if found, NULL otherwise.
*
*/
-FTP_BOUNCE_TO* ftp_bounce_lookup_find(BOUNCE_LOOKUP* BounceLookup, const snort::SfIp* Ip,
+FTP_BOUNCE_TO* ftp_bounce_lookup_find(BOUNCE_LOOKUP* BounceLookup, const SfIp* Ip,
int* iError)
{
FTP_BOUNCE_TO* BounceTo = nullptr;
};
const PegInfo* FtpDataModule::get_pegs() const
-{ return snort::simple_pegs; }
+{ return simple_pegs; }
PegCount* FtpDataModule::get_counts() const
{ return (PegCount*)&fdstats; }
#include "ftp_cmd_lookup.h"
#include "ftpp_return_codes.h"
+using namespace snort;
+
#define CONF_SEPARATORS " \n"
#define ALLOW_BOUNCE "bounce_to"
{
/* explicit check that we have enough room for copy */
if (numChoices <= ThisFmt->numChoices)
- snort::ParseError("Can't do memcpy - index out of range ");
+ ParseError("Can't do memcpy - index out of range ");
memcpy(tmpChoices, ThisFmt->choices,
sizeof(FTP_PARAM_FMT*) * ThisFmt->numChoices);
if (iRet)
{
- snort::ParseError("Failed to add configuration for Bounce object '%s'.", ALLOW_BOUNCE);
+ ParseError("Failed to add configuration for Bounce object '%s'.", ALLOW_BOUNCE);
snort_free(newBounce);
return FTPP_FATAL_ERR;
}
char *file_name = strrchr(ftpssn->filename, '/');
if(!file_name)
file_name = ftpssn->filename;
- ftpssn->path_hash = snort::str_to_hash((uint8_t *)file_name, strlen(file_name));
+ ftpssn->path_hash = str_to_hash((uint8_t *)file_name, strlen(file_name));
// 0 for Download, 1 for Upload
ftpssn->data_xfer_dir = CmdConf->file_get_cmd ? false : true;
#pragma pack(1)
static inline void alert(int sid)
{
- snort::DetectionEngine::queue_event(GID_GTP, sid);
+ DetectionEngine::queue_event(GID_GTP, sid);
gtp_stats.events++;
}
StreamSplitter::Status Http2StreamSplitter::scan(Packet* pkt, const uint8_t* data, uint32_t length,
uint32_t, uint32_t* flush_offset)
{
- snort::Profile profile(Http2Module::get_profile_stats());
+ Profile profile(Http2Module::get_profile_stats());
// This is the session state information we share with Http2Inspect and store with stream. A
// session is defined by a TCP connection. Since scan() is the first to see a new TCP
const StreamBuffer Http2StreamSplitter::reassemble(Flow* flow, unsigned total, unsigned offset,
const uint8_t* data, unsigned len, uint32_t flags, unsigned& copied)
{
- snort::Profile profile(Http2Module::get_profile_stats());
+ Profile profile(Http2Module::get_profile_stats());
copied = len;
#ifdef REG_TEST
if (HttpTestManager::use_test_input(HttpTestManager::IN_HTTP2))
{
- snort::StreamBuffer http_buf { nullptr, 0 };
+ StreamBuffer http_buf { nullptr, 0 };
if (!(flags & PKT_PDU_TAIL))
{
return http_buf;
// is implemented
if (session_data->payload_discard[source_id])
{
- snort::StreamBuffer frame_buf { nullptr, 0 };
+ StreamBuffer frame_buf { nullptr, 0 };
session_data->payload_discard[source_id] = false;
#ifdef REG_TEST
// Eventually we will need to address unexpected connection closes
bool Http2StreamSplitter::finish(Flow* flow)
{
- snort::Profile profile(Http2Module::get_profile_stats());
+ Profile profile(Http2Module::get_profile_stats());
Http2FlowData* session_data = (Http2FlowData*)flow->get_flow_data(Http2FlowData::inspector_id);
// FIXIT-M - this assert has been changed to check for null session data and return false if so
return false;
}
-bool Http2StreamSplitter::init_partial_flush(snort::Flow* flow)
+bool Http2StreamSplitter::init_partial_flush(Flow* flow)
{
- snort::Profile profile(Http2Module::get_profile_stats());
+ Profile profile(Http2Module::get_profile_stats());
if (source_id != SRC_SERVER)
{
#include "http2_module.h"
using namespace Http2Enums;
+using namespace snort;
-const snort::RuleMap Http2Module::http2_events[] =
+const RuleMap Http2Module::http2_events[] =
{
{ EVENT_INT_DECODE_FAILURE, "error in HPACK integer value" },
{ EVENT_INT_LEADING_ZEROS, "integer value has leading zeros" },
if ( javascript_search_mpse || htmltype_search_mpse )
return;
- javascript_search_mpse = new snort::SearchTool;
- htmltype_search_mpse = new snort::SearchTool;
+ javascript_search_mpse = new SearchTool;
+ htmltype_search_mpse = new SearchTool;
javascript_search_mpse->add(script_start, script_start_length, JS_JAVASCRIPT);
javascript_search_mpse->prep();
using namespace HttpEnums;
HttpMsgBody::HttpMsgBody(const uint8_t* buffer, const uint16_t buf_size,
- HttpFlowData* session_data_, SourceId source_id_, bool buf_owner, snort::Flow* flow_,
+ HttpFlowData* session_data_, SourceId source_id_, bool buf_owner, Flow* flow_,
const HttpParaList* params_) :
HttpMsgSection(buffer, buf_size, session_data_, source_id_, buf_owner, flow_, params_),
body_octets(session_data->body_octets[source_id]),
detect_data.set(detect_length, js_norm_body.start());
if (!session_data->partial_flush[source_id])
session_data->detect_depth_remaining[source_id] -= detect_length;
- snort::set_file_data(const_cast<uint8_t*>(detect_data.start()),
+ set_file_data(const_cast<uint8_t*>(detect_data.start()),
(unsigned)detect_data.length());
}
if (!session_data->mime_state[source_id])
{
- snort::FileFlows* file_flows = snort::FileFlows::get_file_flows(flow);
+ FileFlows* file_flows = FileFlows::get_file_flows(flow);
const bool download = (source_id == SRC_SERVER);
size_t file_index = 0;
void setup_file_decompression();
// Dummy configurations to support MIME processing
- MailLogConfig mime_conf;
+ snort::MailLogConfig mime_conf;
snort::DecodeConfig decode_conf;
Field true_ip;
using namespace HttpCommon;
using namespace HttpEnums;
+using namespace snort;
HttpMsgRequest::HttpMsgRequest(const uint8_t* buffer, const uint16_t buf_size,
- HttpFlowData* session_data_, SourceId source_id_, bool buf_owner, snort::Flow* flow_,
+ HttpFlowData* session_data_, SourceId source_id_, bool buf_owner, Flow* flow_,
const HttpParaList* params_) :
HttpMsgStart(buffer, buf_size, session_data_, source_id_, buf_owner, flow_, params_)
{
using namespace HttpCommon;
using namespace HttpEnums;
+using namespace snort;
HttpMsgSection::HttpMsgSection(const uint8_t* buffer, const uint16_t buf_size,
- HttpFlowData* session_data_, SourceId source_id_, bool buf_owner, snort::Flow* flow_,
+ HttpFlowData* session_data_, SourceId source_id_, bool buf_owner, Flow* flow_,
const HttpParaList* params_) :
msg_text(buf_size, buffer, buf_owner),
session_data(session_data_),
else
{
// Just for file processing
- session_data->section_size_target[source_id] = snort::SnortConfig::get_conf()->max_pdu;
+ session_data->section_size_target[source_id] = SnortConfig::get_conf()->max_pdu;
session_data->stretch_section_to_packet[source_id] = true;
}
return;
}
const unsigned target_size = (session_data->compression[source_id] == CMP_NONE) ?
- snort::SnortConfig::get_conf()->max_pdu : GZIP_BLOCK_SIZE;
+ SnortConfig::get_conf()->max_pdu : GZIP_BLOCK_SIZE;
if (detect_depth_remaining <= target_size)
{
using namespace HttpCommon;
using namespace HttpEnums;
+using namespace snort;
HttpMsgStatus::HttpMsgStatus(const uint8_t* buffer, const uint16_t buf_size,
- HttpFlowData* session_data_, SourceId source_id_, bool buf_owner, snort::Flow* flow_,
+ HttpFlowData* session_data_, SourceId source_id_, bool buf_owner, Flow* flow_,
const HttpParaList* params_) :
HttpMsgStart(buffer, buf_size, session_data_, source_id_, buf_owner, flow_, params_)
{
using namespace HttpCommon;
using namespace HttpEnums;
+using namespace snort;
HttpMsgTrailer::HttpMsgTrailer(const uint8_t* buffer, const uint16_t buf_size,
- HttpFlowData* session_data_, SourceId source_id_, bool buf_owner, snort::Flow* flow_,
+ HttpFlowData* session_data_, SourceId source_id_, bool buf_owner, Flow* flow_,
const HttpParaList* params_) :
HttpMsgHeadShared(buffer, buf_size, session_data_, source_id_, buf_owner, flow_, params_)
{
using namespace HttpCommon;
using namespace HttpEnums;
+using namespace snort;
-bool HttpStreamSplitter::finish(snort::Flow* flow)
+bool HttpStreamSplitter::finish(Flow* flow)
{
- snort::Profile profile(HttpModule::get_profile_stats());
+ Profile profile(HttpModule::get_profile_stats());
HttpFlowData* session_data = (HttpFlowData*)flow->get_flow_data(HttpFlowData::inspector_id);
// FIXIT-M - this assert has been changed to check for null session data and return false if so
(session_data->cutter[source_id] != nullptr) &&
(session_data->cutter[source_id]->get_octets_seen() == 0))
{
- snort::Packet* packet = snort::DetectionEngine::get_current_packet();
+ Packet* packet = DetectionEngine::get_current_packet();
if (!session_data->mime_state[source_id])
{
- snort::FileFlows* file_flows = snort::FileFlows::get_file_flows(flow);
+ FileFlows* file_flows = FileFlows::get_file_flows(flow);
const bool download = (source_id == SRC_SERVER);
size_t file_index = 0;
return session_data->section_type[source_id] != SEC__NOT_COMPUTE;
}
-bool HttpStreamSplitter::init_partial_flush(snort::Flow* flow)
+bool HttpStreamSplitter::init_partial_flush(Flow* flow)
{
- snort::Profile profile(HttpModule::get_profile_stats());
+ Profile profile(HttpModule::get_profile_stats());
if (source_id != SRC_SERVER)
{
#include "http_test_input.h"
using namespace HttpEnums;
+using namespace snort;
void HttpStreamSplitter::chunk_spray(HttpFlowData* session_data, uint8_t* buffer,
const uint8_t* data, unsigned length) const
offset += length;
}
-const snort::StreamBuffer HttpStreamSplitter::reassemble(snort::Flow* flow, unsigned total,
+const StreamBuffer HttpStreamSplitter::reassemble(Flow* flow, unsigned total,
unsigned, const uint8_t* data, unsigned len, uint32_t flags, unsigned& copied)
{
- snort::Profile profile(HttpModule::get_profile_stats());
+ Profile profile(HttpModule::get_profile_stats());
- snort::StreamBuffer http_buf { nullptr, 0 };
+ StreamBuffer http_buf { nullptr, 0 };
copied = len;
StreamSplitter::Status HttpStreamSplitter::scan(Packet* pkt, const uint8_t* data, uint32_t length,
uint32_t, uint32_t* flush_offset)
{
- snort::Profile profile(HttpModule::get_profile_stats());
+ Profile profile(HttpModule::get_profile_stats());
assert(length <= MAX_OCTETS);
#include "http_msg_request.h"
using namespace HttpEnums;
+using namespace snort;
const StrCode HttpMsgRequest::method_list[] =
{
&NORMALIZER_BASIC, // HEAD_PROXY_AGENT
};
-const snort::RuleMap HttpModule::http_events[] =
+const RuleMap HttpModule::http_events[] =
{
{ EVENT_ASCII, "ascii encoding" },
{ EVENT_DOUBLE_DECODE, "double decoding attack" },
using namespace HttpCommon;
using namespace HttpEnums;
+using namespace snort;
void HttpUri::parse_uri()
{
if (abs_path.length() > 0 )
{
- abs_path_hash = snort::str_to_hash(abs_path.start(), abs_path.length());
+ abs_path_hash = str_to_hash(abs_path.start(), abs_path.length());
}
return abs_path_hash;
#include "log/messages.h"
using namespace HttpEnums;
+using namespace snort;
void UriNormalizer::normalize(const Field& input, Field& result, bool do_path, uint8_t* buffer,
const HttpParaList::UriParam& uri_param, HttpInfractions* infractions, HttpEventGen* events)
FILE* file = fopen(filename, "r");
if (file == nullptr)
{
- snort::ParseError("Cannot open unicode map file %s", filename);
+ ParseError("Cannot open unicode map file %s", filename);
return;
}
// Advance file to the desired code page
if (!advance_to_code_page(file, code_page))
{
- snort::ParseError("Did not find code page %d in unicode map file %s", code_page, filename);
+ ParseError("Did not find code page %d in unicode map file %s", code_page, filename);
fclose(file);
return;
}
if (!map_code_points(file, map))
{
- snort::ParseError("Error while reading code page %d in unicode map file %s", code_page, filename);
+ ParseError("Error while reading code page %d in unicode map file %s", code_page, filename);
fclose(file);
return;
}
struct IMAP_PROTO_CONF
{
snort::DecodeConfig decode_conf;
- MailLogConfig log_config;
+ snort::MailLogConfig log_config;
};
struct ImapStats
struct POP_PROTO_CONF
{
snort::DecodeConfig decode_conf;
- MailLogConfig log_config;
+ snort::MailLogConfig log_config;
};
struct PopStats
#include <CppUTest/TestHarness.h>
#include <CppUTestExt/MockSupport.h>
+using namespace snort;
+
TEST_GROUP(sip_splitter_scan_test)
{
SipSplitterUT ssut = SipSplitterUT(SipSplitter(true));
TEST(sip_splitter_scan_test, scan_start_content_len_test)
{
uint32_t fp = 0;
- snort::StreamSplitter::Status ret = ssut.splitter_scan(nullptr,
+ StreamSplitter::Status ret = ssut.splitter_scan(nullptr,
(const uint8_t *)"0xBEEF0xBEEF\n", 13, 0, &fp);
- CHECK_EQUAL(ret, snort::StreamSplitter::SEARCH);
+ CHECK_EQUAL(ret, StreamSplitter::SEARCH);
CHECK_EQUAL(ssut.splitter_get_paf_state(), SIP_PAF_CONTENT_LEN_CMD);
CHECK_EQUAL(fp, 0);
}
TEST(sip_splitter_scan_test, scan_start_content_len_negative_test)
{
uint32_t fp = 0;
- snort::StreamSplitter::Status ret = ssut.splitter_scan(nullptr,
+ StreamSplitter::Status ret = ssut.splitter_scan(nullptr,
(const uint8_t *)"0xBEEF0xBEEF", 12, 0, &fp);
- CHECK_EQUAL(ret, snort::StreamSplitter::SEARCH);
+ CHECK_EQUAL(ret, StreamSplitter::SEARCH);
CHECK_EQUAL(ssut.splitter_get_paf_state(), SIP_PAF_START_STATE);
CHECK_EQUAL(fp, 0);
}
{
uint32_t fp = 0;
ssut.splitter_set_paf_state(SIP_PAF_CONTENT_LEN_CMD);
- snort::StreamSplitter::Status ret = ssut.splitter_scan(nullptr,
+ StreamSplitter::Status ret = ssut.splitter_scan(nullptr,
(const uint8_t *)"C", 1, 0, &fp);
- CHECK_EQUAL(ret, snort::StreamSplitter::SEARCH);
+ CHECK_EQUAL(ret, StreamSplitter::SEARCH);
CHECK_EQUAL(ssut.splitter_get_paf_state(), SIP_PAF_CONTENT_LEN_CMD);
CHECK_EQUAL(*ssut.splitter_get_next_letter(), (ssut.splitter_get_content_length_key())[1]);
CHECK_EQUAL(fp, 0);
{
uint32_t fp = 0;
ssut.splitter_set_paf_state(SIP_PAF_CONTENT_LEN_CONVERT);
- snort::StreamSplitter::Status ret = ssut.splitter_scan(nullptr,
+ StreamSplitter::Status ret = ssut.splitter_scan(nullptr,
(const uint8_t *)"144 ", 4, 0, &fp);
- CHECK_EQUAL(ret, snort::StreamSplitter::SEARCH);
+ CHECK_EQUAL(ret, StreamSplitter::SEARCH);
CHECK_EQUAL(ssut.splitter_get_paf_state(), SIP_PAF_BODY_SEARCH);
CHECK_EQUAL(ssut.splitter_get_content_length(), 144);
CHECK_EQUAL(fp, 0);
{
uint32_t fp = 0;
ssut.splitter_set_paf_state(SIP_PAF_CONTENT_LEN_CONVERT);
- snort::StreamSplitter::Status ret = ssut.splitter_scan(nullptr,
+ StreamSplitter::Status ret = ssut.splitter_scan(nullptr,
(const uint8_t *)"144i", 4, 0, &fp);
- CHECK_EQUAL(ret, snort::StreamSplitter::SEARCH);
+ CHECK_EQUAL(ret, StreamSplitter::SEARCH);
CHECK_TRUE(ssut.is_init());
CHECK_EQUAL(fp, 0);
}
{
uint32_t fp = 0;
ssut.splitter_set_paf_state(SIP_PAF_BODY_SEARCH);
- snort::StreamSplitter::Status ret = ssut.splitter_scan(nullptr,
+ StreamSplitter::Status ret = ssut.splitter_scan(nullptr,
(const uint8_t *)"\r\n\r\n", 4, 0, &fp);
- CHECK_EQUAL(ret, snort::StreamSplitter::SEARCH);
+ CHECK_EQUAL(ret, StreamSplitter::SEARCH);
CHECK_EQUAL(ssut.splitter_get_paf_state(), SIP_PAF_FLUSH_STATE);
CHECK_EQUAL(fp, 0);
ssut.splitter_set_paf_state(SIP_PAF_BODY_SEARCH);
ret = ssut.splitter_scan(nullptr, (const uint8_t *)"\n\n", 2, 0, &fp);
- CHECK_EQUAL(ret, snort::StreamSplitter::SEARCH);
+ CHECK_EQUAL(ret, StreamSplitter::SEARCH);
CHECK_EQUAL(ssut.splitter_get_paf_state(), SIP_PAF_FLUSH_STATE);
CHECK_EQUAL(fp, 0);
}
ssut.splitter_set_content_length(6);
// Sip splitter starts searching body from one character behind the actual body.
- snort::StreamSplitter::Status ret = ssut.splitter_scan(nullptr,
+ StreamSplitter::Status ret = ssut.splitter_scan(nullptr,
(const uint8_t *)"\nfoobar", 7, 0, &fp);
- CHECK_EQUAL(ret, snort::StreamSplitter::FLUSH);
+ CHECK_EQUAL(ret, StreamSplitter::FLUSH);
CHECK_TRUE(ssut.is_init());
CHECK_EQUAL(fp, 7);
ssut.splitter_set_content_length(12);
ret = ssut.splitter_scan(nullptr, (const uint8_t *)"\nfoobar", 7, 0, &fp);
- CHECK_EQUAL(ret, snort::StreamSplitter::SEARCH);
+ CHECK_EQUAL(ret, StreamSplitter::SEARCH);
CHECK_EQUAL(ssut.splitter_get_paf_state(), SIP_PAF_FLUSH_STATE);
CHECK_EQUAL(ssut.splitter_get_content_length(), 5);
CHECK_EQUAL(fp, 0);
//Continue scanning the remaining buffer
ret = ssut.splitter_scan(nullptr, (const uint8_t *)"foobar", 6, 0, &fp);
- CHECK_EQUAL(ret, snort::StreamSplitter::FLUSH);
+ CHECK_EQUAL(ret, StreamSplitter::FLUSH);
CHECK_TRUE(ssut.is_init());
CHECK_EQUAL(fp, 6);
}
{
// Setup
MailLogConfig log_config;
- snort::DecodeConfig decode_conf;
+ DecodeConfig decode_conf;
log_config.log_email_hdrs = 0;
SmtpMime mime_ssn(&decode_conf, &log_config);
smtp_normalizing = true;
{
// Setup
MailLogConfig log_config;
- snort::DecodeConfig decode_conf;
+ DecodeConfig decode_conf;
SmtpMime mime_ssn(&decode_conf, &log_config);
smtp_normalizing = true;
SMTP_PROTO_CONF config;
int max_header_line_len = 0;
int max_response_line_len = 0;
int xlink2state;
- MailLogConfig log_config;
+ snort::MailLogConfig log_config;
snort::DecodeConfig decode_conf;
uint32_t xtra_filename_id;
#include "smtp.h"
#include "smtp_util.h"
+using namespace snort;
+
/*
* SMTP_NormalizeCmd
*
* @retval 0 function succeeded without error
* @retval -1 there were errors
*/
-int SMTP_NormalizeCmd(snort::Packet* p, const uint8_t* ptr, const uint8_t* eolm, const uint8_t* eol)
+int SMTP_NormalizeCmd(Packet* p, const uint8_t* ptr, const uint8_t* eolm, const uint8_t* eol)
{
const uint8_t* tmp;
const uint8_t* cmd_start;
#include "smtp_module.h"
+using namespace snort;
+
#define XLINK_OTHER 1
#define XLINK_FIRST 2
#define XLINK_CHUNK 3
* @retval 1 if alert raised
* @retval 0 if no alert raised
*/
-int ParseXLink2State(SMTP_PROTO_CONF* config, snort::Packet* p, SMTPData* smtp_ssn, const uint8_t* ptr)
+int ParseXLink2State(SMTP_PROTO_CONF* config, Packet* p, SMTPData* smtp_ssn, const uint8_t* ptr)
{
const uint8_t* lf = nullptr;
uint32_t len = 0;
if (config->xlink2state == DROP_XLINK2STATE)
p->active->reset_session(p);
- snort::DetectionEngine::queue_event(GID_SMTP, SMTP_XLINK2STATE_OVERFLOW);
+ DetectionEngine::queue_event(GID_SMTP, SMTP_XLINK2STATE_OVERFLOW);
smtp_ssn->session_flags |= SMTP_FLAG_XLINK2STATE_ALERTED;
return 1;
CHECK(!strcmp("!9.0.0.0,!dead:beef:0000:0000:0000:0000:0000:0000", sfipvar_test_buff));
/* Check lookups */
- snort::SfIp* ip = (snort::SfIp *)snort_alloc(sizeof(snort::SfIp));
+ SfIp* ip = (SfIp *)snort_alloc(sizeof(SfIp));
CHECK(ip->set("9.8.3.2") == SFIP_SUCCESS);
CHECK((sfvar_ip_in(var1, ip) == false));
snort_free(ip);
- ip = (snort::SfIp *)snort_alloc(sizeof(snort::SfIp));
+ ip = (SfIp *)snort_alloc(sizeof(SfIp));
uint16_t srcBits;
CHECK(ip->set("1.2.3.4/24", &srcBits) == SFIP_SUCCESS);
CHECK((sfvar_ip_in(var1, ip) == true));
snort_free(ip);
- ip = (snort::SfIp *)snort_alloc(sizeof(snort::SfIp));
+ ip = (SfIp *)snort_alloc(sizeof(SfIp));
CHECK(ip->set("dead:beef::0") == SFIP_SUCCESS);
CHECK((sfvar_ip_in(var1, ip) == false));
snort_free(ip);
- ip = (snort::SfIp *)snort_alloc(sizeof(snort::SfIp));
+ ip = (SfIp *)snort_alloc(sizeof(SfIp));
CHECK(ip->set("cafe:abcd::9999") == SFIP_SUCCESS);
CHECK((sfvar_ip_in(var1, ip) == true));
snort_free(ip);
len = strlen(name) + strlen(value) + 2;
buf = (char*)snort_alloc(len);
- snort::SnortSnprintf(buf, len, "%s %s", name, value);
+ SnortSnprintf(buf, len, "%s %s", name, value);
ret = sfvt_add_str(table, buf, &ipret);
if ((ret == SFIP_SUCCESS) || (ret == SFIP_DUPLICATE))
{
vartable_t* table;
sfip_var_t* var;
- snort::SfIp* ip;
+ SfIp* ip;
SfIpRet status;
table = sfvt_alloc_table();
/* Containment tests */
var = sfvt_lookup_var(table, "goo");
- ip = (snort::SfIp *)snort_alloc(sizeof(snort::SfIp));
+ ip = (SfIp *)snort_alloc(sizeof(SfIp));
status = ip->set("192.168.248.255");
CHECK(SFIP_SUCCESS == status);
CHECK((sfvar_ip_in(var, ip) == false));
/* Check boundary cases */
var = sfvt_lookup_var(table, "goo");
snort_free(ip);
- ip = (snort::SfIp *)snort_alloc(sizeof(snort::SfIp));
+ ip = (SfIp *)snort_alloc(sizeof(SfIp));
status = ip->set("192.168.0.3");
CHECK(SFIP_SUCCESS == status);
CHECK((sfvar_ip_in(var, ip) == false));
snort_free(ip);
- ip = (snort::SfIp *)snort_alloc(sizeof(snort::SfIp));
+ ip = (SfIp *)snort_alloc(sizeof(SfIp));
status = ip->set("192.168.0.2");
CHECK(SFIP_SUCCESS == status);
CHECK((sfvar_ip_in(var, ip) == true));
#include "main/snort_config.h"
+using namespace snort;
+
//-------------------------------------------------------------------------
// static base members
//-------------------------------------------------------------------------
if ( sz )
s_flush_bucket = new ConstFlushBucket(sz);
- else if ( snort::SnortConfig::static_hash() )
+ else if ( SnortConfig::static_hash() )
s_flush_bucket = new StaticFlushBucket;
else
return -1;
}
-bool TcpStreamSession::set_packet_action_to_hold(snort::Packet* p)
+bool TcpStreamSession::set_packet_action_to_hold(Packet* p)
{
return listener->set_held_packet(p);
}
return valid_seq;
}
-bool TcpStreamTracker::set_held_packet(snort::Packet* p)
+bool TcpStreamTracker::set_held_packet(Packet* p)
{
// FIXIT-M - limit of packets held per packet thread should be determined based on runtime criteria
// such as # of DAQ Msg buffers, # of threads, etc... for now we use small number like 10
return false;
}
-bool TcpStreamTracker::is_retransmit_of_held_packet(snort::Packet* cp)
+bool TcpStreamTracker::is_retransmit_of_held_packet(Packet* cp)
{
if ( !held_packet or ( cp->daq_msg == held_packet ) )
return false;
return false;
}
-void TcpStreamTracker::finalize_held_packet(snort::Packet* cp)
+void TcpStreamTracker::finalize_held_packet(Packet* cp)
{
if ( held_packet )
{
}
}
-void TcpStreamTracker::finalize_held_packet(snort::Flow* flow)
+void TcpStreamTracker::finalize_held_packet(Flow* flow)
{
if ( held_packet )
{
// max paf max = max datagram - eth mtu - 255 = 63780
#define MAX_PAF_MAX (65535 - PAF_LIMIT_FUZZ - 255)
-THREAD_LOCAL snort::ProfileStats pafPerfStats;
+THREAD_LOCAL ProfileStats pafPerfStats;
//--------------------------------------------------------------------
#include "tcp_normalizers.h"
#include "tcp_session.h"
+using namespace snort;
-static void set_retransmit_flag(snort::Packet* p)
+static void set_retransmit_flag(Packet* p)
{
- if ( snort::PacketTracer::is_active() )
+ if ( PacketTracer::is_active() )
{
- snort::PacketTracer::log("Packet was retransmitted and %s from the retry queue.\n",
+ PacketTracer::log("Packet was retransmitted and %s from the retry queue.\n",
p->is_retry() ? "is" : "is not");
}
void SegmentOverlapEditor::print(TcpReassemblerState& trs)
{
- snort::LogMessage(" seglist_base_seq: %X\n", trs.sos.seglist_base_seq);
- snort::LogMessage(" seglist head: %p\n", (void*)trs.sos.seglist.head);
- snort::LogMessage(" seglist tail: %p\n", (void*)trs.sos.seglist.tail);
- snort::LogMessage(" seglist current: %p\n", (void*)trs.sos.seglist.cur_rseg);
- snort::LogMessage(" seg_count: %d\n", trs.sos.seg_count);
- snort::LogMessage(" seg_bytes_total: %d\n", trs.sos.seg_bytes_total);
- snort::LogMessage(" seg_bytes_logical: %d\n", trs.sos.seg_bytes_logical);
+ LogMessage(" seglist_base_seq: %X\n", trs.sos.seglist_base_seq);
+ LogMessage(" seglist head: %p\n", (void*)trs.sos.seglist.head);
+ LogMessage(" seglist tail: %p\n", (void*)trs.sos.seglist.tail);
+ LogMessage(" seglist current: %p\n", (void*)trs.sos.seglist.cur_rseg);
+ LogMessage(" seg_count: %d\n", trs.sos.seg_count);
+ LogMessage(" seg_bytes_total: %d\n", trs.sos.seg_bytes_total);
+ LogMessage(" seg_bytes_logical: %d\n", trs.sos.seg_bytes_logical);
}
#include "tcp_module.h"
+using namespace snort;
+
struct tcp_event_sid
{
uint32_t event_id;
void TcpEventLogger::log_internal_event(uint32_t eventSid)
{
- if (is_internal_event_enabled(snort::SnortConfig::get_conf()->rate_filter_config, eventSid))
+ if (is_internal_event_enabled(SnortConfig::get_conf()->rate_filter_config, eventSid))
{
tcpStats.internalEvents++;
- snort::DetectionEngine::queue_event(GID_SESSION, eventSid);
+ DetectionEngine::queue_event(GID_SESSION, eventSid);
}
}
uint32_t idx = ffs(tcp_events);
if ( idx )
{
- snort::DetectionEngine::queue_event(GID_STREAM_TCP, tcp_event_sids[ idx ].sid);
+ DetectionEngine::queue_event(GID_STREAM_TCP, tcp_event_sids[ idx ].sid);
tcp_events ^= tcp_event_sids[ idx ].event_id;
tcpStats.events++;
}
#include "stream/paf.h"
using namespace snort;
-using namespace std;
//-------------------------------------------------------------------------
// stream_tcp module
#include "catch/snort_catch.h"
#endif
-using namespace std;
+using namespace snort;
TcpStateCloseWait::TcpStateCloseWait(TcpStateMachine& tsm) :
TcpStateHandler(TcpStreamTracker::TCP_CLOSE_WAIT, tsm)
bool TcpStateCloseWait::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- snort::Flow* flow = tsd.get_flow();
+ Flow* flow = tsd.get_flow();
trk.update_tracker_ack_recv(tsd);
#include "catch/snort_catch.h"
#endif
+using namespace snort;
+
TcpStateClosed::TcpStateClosed(TcpStateMachine& tsm) :
TcpStateHandler(TcpStreamTracker::TCP_CLOSED, tsm)
{
bool TcpStateClosed::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- snort::Flow* flow = tsd.get_flow();
+ Flow* flow = tsd.get_flow();
flow->set_expire(tsd.get_pkt(), trk.session->config->session_timeout);
return true;
}
bool TcpStateClosed::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- snort::Flow* flow = tsd.get_flow();
+ Flow* flow = tsd.get_flow();
trk.update_tracker_ack_sent(tsd);
// data on a segment when we're not accepting data any more alert!
if ( trk.get_tcp_event() != TcpStreamTracker::TCP_FIN_RECV_EVENT )
{
TcpStreamTracker::TcpState talker_state = trk.session->get_talker_state();
- snort::Flow* flow = tsd.get_flow();
+ Flow* flow = tsd.get_flow();
if ( ( talker_state == TcpStreamTracker::TCP_TIME_WAIT ) || !flow->two_way_traffic() )
{
TEST_CASE("TCP State Closed", "[tcp_closed_state][stream_tcp]")
{
// initialization code here
- snort::Flow* flow = new snort::Flow;
+ Flow* flow = new Flow;
TcpStreamTracker* ctrk = new TcpStreamTracker(true);
TcpStreamTracker* strk = new TcpStreamTracker(false);
TcpEventLogger* tel = new TcpEventLogger;
#include "catch/snort_catch.h"
#endif
-using namespace std;
+using namespace snort;
TcpStateClosing::TcpStateClosing(TcpStateMachine& tsm) :
TcpStateHandler(TcpStreamTracker::TCP_CLOSING, tsm)
bool TcpStateClosing::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- snort::Flow* flow = tsd.get_flow();
+ Flow* flow = tsd.get_flow();
trk.update_tracker_ack_recv(tsd);
if ( SEQ_GT(tsd.get_seg_seq(), trk.get_fin_final_seq() ) )
#include "tcp_module.h"
#include "tcp_session.h"
-using namespace std;
+using namespace snort;
TcpStateFinWait1::TcpStateFinWait1(TcpStateMachine& tsm) :
TcpStateHandler(TcpStreamTracker::TCP_FIN_WAIT1, tsm)
bool TcpStateFinWait1::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- snort::Flow* flow = tsd.get_flow();
+ Flow* flow = tsd.get_flow();
trk.update_tracker_ack_recv(tsd);
if ( trk.update_on_fin_recv(tsd) )
#include "tcp_normalizers.h"
#include "tcp_session.h"
-using namespace std;
+using namespace snort;
TcpStateFinWait2::TcpStateFinWait2(TcpStateMachine& tsm) :
TcpStateHandler(TcpStreamTracker::TCP_FIN_WAIT2, tsm)
bool TcpStateFinWait2::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- snort::Flow* flow = tsd.get_flow();
+ Flow* flow = tsd.get_flow();
trk.update_tracker_ack_recv(tsd);
if ( trk.update_on_fin_recv(tsd) )
#include "tcp_normalizers.h"
#include "tcp_session.h"
-using namespace std;
+using namespace snort;
TcpStateLastAck::TcpStateLastAck(TcpStateMachine& tsm) :
TcpStateHandler(TcpStreamTracker::TCP_LAST_ACK, tsm)
bool TcpStateLastAck::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- snort::Flow* flow = tsd.get_flow();
+ Flow* flow = tsd.get_flow();
trk.update_tracker_ack_recv(tsd);
if ( SEQ_EQ(tsd.get_seg_ack(), trk.get_snd_nxt() ) )
( trk.get_tcp_event() != TcpStreamTracker::TCP_FIN_RECV_EVENT ) )
{
TcpStreamTracker::TcpState talker_state = trk.session->get_talker_state();
- snort::Flow* flow = tsd.get_flow();
+ Flow* flow = tsd.get_flow();
if ( ( talker_state == TcpStreamTracker::TCP_TIME_WAIT )
|| ( talker_state == TcpStreamTracker::TCP_CLOSED ) )
#include "tcp_session.h"
using namespace snort;
-using namespace std;
TcpStateSynRecv::TcpStateSynRecv(TcpStateMachine& tsm) :
TcpStateHandler(TcpStreamTracker::TCP_SYN_RECV, tsm)
#include "tcp_session.h"
-using namespace std;
+using namespace snort;
TcpStateSynSent::TcpStateSynSent(TcpStateMachine& tsm) :
TcpStateHandler(TcpStreamTracker::TCP_SYN_SENT, tsm)
bool TcpStateSynSent::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- snort::Flow* flow = tsd.get_flow();
+ Flow* flow = tsd.get_flow();
// FIXIT-H verify ack being sent is valid...
trk.update_tracker_ack_sent(tsd);
bool TcpStateSynSent::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- snort::Flow* flow = tsd.get_flow();
+ Flow* flow = tsd.get_flow();
// FIXIT-H verify ack being sent is valid...
trk.update_tracker_ack_sent(tsd);
#include "tcp_normalizers.h"
#include "tcp_session.h"
-using namespace std;
+using namespace snort;
TcpStateTimeWait::TcpStateTimeWait(TcpStateMachine& tsm) :
TcpStateHandler(TcpStreamTracker::TCP_TIME_WAIT, tsm)
if ( trk.get_tcp_event() != TcpStreamTracker::TCP_FIN_RECV_EVENT )
{
TcpStreamTracker::TcpState talker_state = trk.session->get_talker_state();
- snort::Flow* flow = tsd.get_flow();
+ Flow* flow = tsd.get_flow();
if ( ( talker_state == TcpStreamTracker::TCP_TIME_WAIT )
|| ( talker_state == TcpStreamTracker::TCP_CLOSED ) )
projects / thirdparty / snort3.git / commitdiff
