113

diff --git a/ChangeLog b/ChangeLog
index cc90a03bca9459391f7e184cca67d943d29ecfe5..6f1681e2570a7c008007204a6a9bc674f46a70d0 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -5,6 +5,7 @@
    ips_replace
 -- stream workarounds for new packet / protocol foo and shutdown sequencing
 -- fixed end of rule parsing to not require ; and recognize incomplete rules
+-- fixed executing a command wile paused
 
 112
 -- initial action plugin - reject

diff --git a/src/main.cc b/src/main.cc
index 8aa99b6426ee559a6ba3b608d28e50783d021597..a54c5fe4acb8fc3f32b4fe28f2203fe610fa86a7 100644 (file)
--- a/src/main.cc
+++ b/src/main.cc
@@ -445,6 +445,8 @@ static bool house_keeping()
 
 // FIXIT make these non-blocking
 // FIXIT allow at least 2 remote controls
+// FIXIT bind to configured ip including INADDR_ANY
+// (default is loopback if enabled)
 static int listener = -1;
 static int remote_control = -1;
 
@@ -456,21 +458,34 @@ static int socket_init()
     listener = socket(AF_INET, SOCK_STREAM, 0);
 
     if (listener < 0) 
+    {
+        FatalError("socket failed: %s\n", strerror(errno));
         return -2;
+    }
+
+    // FIXIT does this disable time wait for us?
+    int on = 1;
+    setsockopt(listener, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on));
 
     struct sockaddr_in addr;
     memset(&addr, 0, sizeof(addr));
 
     addr.sin_family = AF_INET;
-    addr.sin_addr.s_addr = INADDR_ANY;
+    addr.sin_addr.s_addr = htonl(0x7F000001);
     addr.sin_port = htons(snort_conf->remote_control);
 
     if ( ::bind(listener, (struct sockaddr*)&addr, sizeof(addr)) < 0 ) 
+    {
+        FatalError("bind failed: %s\n", strerror(errno));
         return -3;
+    }
 
     // FIXIT configure max conns
     if ( listen(listener, 5) < 0 )
+    {
+        FatalError("listen failed: %s\n", strerror(errno));
         return -4;
+    }
 
     return 0;
 }
@@ -621,6 +636,14 @@ static bool set_mode()
         return false;
     }
 
+    if ( snort_conf->run_flags & RUN_FLAG__PAUSE )
+    {
+        LogMessage("Paused; resume to start packet processing\n");
+        paused = true;
+    }
+    else
+        LogMessage("Commencing packet processing\n");
+
     if ( snort_conf->run_flags & RUN_FLAG__SHELL )
     {
         LogMessage("Entering command shell\n");
@@ -628,11 +651,6 @@ static bool set_mode()
         request.show_prompt();
     }
 
-    if ( snort_conf->run_flags & RUN_FLAG__PAUSE )
-        paused = true;
-    else
-        LogMessage("Commencing packet processing\n");
-
     return true;
 }
 

diff --git a/src/main/analyzer.cc b/src/main/analyzer.cc
index 662af6b51f5d1234a3f14372e71e4012f229af56..b4c1fddf9fdf9ca9ab7a501dafca57b871797620 100644 (file)
--- a/src/main/analyzer.cc
+++ b/src/main/analyzer.cc
@@ -63,6 +63,21 @@ void Analyzer::operator()(unsigned id, Swapper* ps)
     done = true;
 }
 
+bool Analyzer::execute(AnalyzerCommand ac)
+{
+    if ( command && command != AC_PAUSE )
+        return false;
+
+    // FIXIT executing a command while paused
+    // will cause a resume
+    command = ac;
+    return true;
+}
+
+// clear pause in analyze() to avoid extra acquires
+// (eg stop while paused)
+// clear other commands here to avoid clearing an
+// unexecuted command received while paused
 bool Analyzer::handle(AnalyzerCommand ac)
 {
     switch ( ac )
@@ -72,16 +87,18 @@ bool Analyzer::handle(AnalyzerCommand ac)
 
     case AC_PAUSE:
         {
-            chrono::seconds sec(1);
-            this_thread::sleep_for(sec);
+            chrono::milliseconds ms(500);
+            this_thread::sleep_for(ms);
         }
         break;
 
     case AC_RESUME:
+        command = AC_NONE;
         break;
 
     case AC_ROTATE:
         snort_rotate();
+        command = AC_NONE;
         break;
 
     case AC_SWAP:
@@ -90,6 +107,7 @@ bool Analyzer::handle(AnalyzerCommand ac)
             swap->apply();
             swap = nullptr;
         }
+        command = AC_NONE;
         break;
 
     default:
@@ -109,8 +127,6 @@ void Analyzer::analyze()
 
             if ( command == AC_PAUSE )
                 continue;
-
-            command = AC_NONE;
         }
         if ( DAQ_Acquire(0, main_func, NULL) )
             break;

diff --git a/src/main/analyzer.h b/src/main/analyzer.h
index f04eb3900d3956020f5c63d9c2f1cb7398828788..56d7daf1332bfa8e22b33ed2489aef3b7caf06e6 100644 (file)
--- a/src/main/analyzer.h
+++ b/src/main/analyzer.h
@@ -48,7 +48,8 @@ public:
     const char* get_source() { return source; };
 
     // FIXIT add asynchronous response too
-    void execute(AnalyzerCommand ac) { command = ac; };
+    bool execute(AnalyzerCommand);
+
     void set_config(Swapper* ps) { swap = ps; };
     bool swap_pending() { return swap != nullptr; };
 
@@ -60,7 +61,7 @@ private:
     bool done;
     uint64_t count;
     const char* source;
-    AnalyzerCommand command;
+    volatile AnalyzerCommand command;
     Swapper* swap;
 };
 

diff --git a/src/parser/cmd_line.cc b/src/parser/cmd_line.cc
index 88925cdc40105e97bd4ec4a494b0d33b7444acfa..da27f0cea22142e14717ac2ebc303fbf184ef8b1 100644 (file)
--- a/src/parser/cmd_line.cc
+++ b/src/parser/cmd_line.cc
@@ -801,7 +801,7 @@ static ConfigFunc basic_opts[] =
       "dump the raw packet data starting at the link layer" },
 
     { "x", config_conf_error_out, 
-      "exit on misconfiguration (same as --conf-error-out)" },
+      "same as --conf-error-out" },
 
     { "y", ConfigShowYear, 
       "include year in timestamp in the alert and log files" },
@@ -817,7 +817,7 @@ static ConfigFunc basic_opts[] =
       "<filter options> are standard BPF options, as seen in TCPDump" },
 
     { "conf-error-out", config_conf_error_out, 
-      "exit if certain Snort configuration problems occur (same as -x)" },
+      "output error instead of warning if duplicate rules are found (same as -x)" },
 
     { "create-pidfile", ConfigCreatePidFile,
       "create PID file, even when not in Daemon mode" },
@@ -880,7 +880,7 @@ static ConfigFunc basic_opts[] =
       "list all known modules" },
 
     { "list-plugins", list_plugins,
-      "list all known modules" },
+      "list all known plugins" },
 
     { "lua", config_lua,
       "<chunk> extend/override conf with chunk; may be repeated" },