updated help

diff --git a/ChangeLog b/ChangeLog
index e45a9162bbbd8c8df7fe77b0b8ef36608e5e00ff..8f2f1912f1091b8fab428bf29aaa3beb5fdd1bca 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,6 +1,7 @@
 109
 -- changed --help to give overview of help
 -- fixed stream_ip alerts (defrag -> stream_ip)
+-- added missing help to parameters
 
 108
 -- added IpsAction for ips rule action plugins

diff --git a/src/framework/module.h b/src/framework/module.h
index 5ada9b2fee9a29332394e2d185079c03c30f953a..9b2a7bf9cf6553ba87c9104c0edcea2a577f38f5 100644 (file)
--- a/src/framework/module.h
+++ b/src/framework/module.h
@@ -54,6 +54,7 @@ struct RuleMap
 
 struct ProfileStats;
 
+// FIXIT add brief help string to modules
 class Module
 {
 public:

diff --git a/src/framework/parameter.h b/src/framework/parameter.h
index f80867855fb5b5d73c43f94c03b0fffac3e0e92f..2aba31a7f20ec7eca154d5573f15ee2981795c00 100644 (file)
--- a/src/framework/parameter.h
+++ b/src/framework/parameter.h
@@ -50,7 +50,7 @@ struct Parameter
     const char* name;
     Type type;
     const void* range;  // nullptr|const char*|const Parameter*
-    const char* deflt;
+    const char* deflt;  // FIXIT add defaults for tables and lists
     const char* help;
 
     const char* get_type() const;

diff --git a/src/loggers/alert_full.cc b/src/loggers/alert_full.cc
index 30cdf083e17828a02ca23eab165793b5829d83bd..ba9ed71de9e3139419201aeffa5473fc4704acb1 100644 (file)
--- a/src/loggers/alert_full.cc
+++ b/src/loggers/alert_full.cc
@@ -77,7 +77,7 @@ static const Parameter full_params[] =
       "set limit (0 is unlimited)" },
 
     { "units", Parameter::PT_ENUM, "B | K | M | G", "B",
-      "help" },
+      "limit is in bytes | KB | MB | GB" },
 
     { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
 };

diff --git a/src/managers/module_manager.cc b/src/managers/module_manager.cc
index d428693b53e4edab966f13d912b6a2ec25f31dcf..ebd43a3ab2fae1a181b6d1d8543c73946ded4ec0 100644 (file)
--- a/src/managers/module_manager.cc
+++ b/src/managers/module_manager.cc
@@ -483,30 +483,21 @@ void ModuleManager::dump_modules()
             d.dump(p->mod->get_name());
 }
 
-static const char* mod_types[PT_MAX] =
-{
-    "data",
-    "codec",
-    "logger",
-    "ips option",
-    "so rule",
-    "inspector",
-    "search engine"
-};
-
 static const char* mod_type(const BaseApi* api)
 {
     if ( !api )
         return "basic";
 
-    if ( api->type > PT_MAX )
-        return "error";
-
-    return mod_types[api->type];
+    return PluginManager::get_type_name(api->type);
 }
 
 void ModuleManager::show_module(const char* name)
 {
+    if ( !name || !*name )
+    {
+        cerr << "module name required" << endl;
+        return;
+    }
     s_modules.sort(comp_gids);
 
     for ( auto p : s_modules )

diff --git a/src/managers/plugin_manager.cc b/src/managers/plugin_manager.cc
index cfcd9457e135c6298dd256d69a5b5a351c566699..c3a9187ad850cd73e0bb2fb9262fb783e25b5bd6 100644 (file)
--- a/src/managers/plugin_manager.cc
+++ b/src/managers/plugin_manager.cc
@@ -81,16 +81,24 @@ struct Symbol
 static Symbol symbols[PT_MAX] =
 {
     // sequence must match PlugType definition
-    { "module", 0 },
+    { "data", 0 },
     { "codec", CDAPI_VERSION },
     { "inspector", INSAPI_VERSION },
     { "ips_action", ACTAPI_VERSION },
     { "ips_option", IPSAPI_VERSION },
     { "search_engine", SEAPI_VERSION },
     { "so_rule", SOAPI_VERSION },
-    { "event_handler", LOGAPI_VERSION }
+    { "logger", LOGAPI_VERSION }
 };
-    
+ 
+const char* PluginManager::get_type_name(PlugType pt)
+{
+    if ( pt >= PT_MAX )
+        return "error";
+
+    return symbols[pt].name;
+}
+
 struct Plugin
 {
     string key;

diff --git a/src/managers/plugin_manager.h b/src/managers/plugin_manager.h
index e65852e0c2e6863b58123cc21d88e5f0ed0d21db..73d573b4c36125bbde5833718061d20088ba4947 100644 (file)
--- a/src/managers/plugin_manager.h
+++ b/src/managers/plugin_manager.h
@@ -51,6 +51,7 @@ public:
     static void release_plugins();
     static const BaseApi* get_api(PlugType, const char* name);
     static void instantiate(const BaseApi*, Module*, SnortConfig*);
+    static const char* get_type_name(PlugType);
 };
 
 #endif

diff --git a/src/network_inspectors/arp_spoof/arp_module.cc b/src/network_inspectors/arp_spoof/arp_module.cc
index f7ece3f9538564ba29162fd07dda9284e92d5fb2..49c5fe7f8bfc991917467155661234abce36d990 100644 (file)
--- a/src/network_inspectors/arp_spoof/arp_module.cc
+++ b/src/network_inspectors/arp_spoof/arp_module.cc
@@ -51,11 +51,8 @@ static const Parameter arp_spoof_hosts_params[] =
 
 static const Parameter arp_spoof_params[] =
 {
-    { "unicast", Parameter::PT_BOOL, nullptr, "false",
-      "help" },
-
     { "hosts", Parameter::PT_LIST, arp_spoof_hosts_params, nullptr,
-      "help" },
+      "configure ARP cache overwrite attacks" },
 
     { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
 };
@@ -85,8 +82,6 @@ ArpSpoofModule::ArpSpoofModule() :
     Module(mod_name, arp_spoof_params)
 {
     config = new ArpSpoofConfig;
-
-    config->check_unicast_arp = false;
     config->check_overwrite = false;
 }
 
@@ -104,10 +99,7 @@ ProfileStats* ArpSpoofModule::get_profile() const
 
 bool ArpSpoofModule::set(const char*, Value& v, SnortConfig*)
 {
-    if ( v.is("unicast") )
-        config->check_unicast_arp = v.get_bool();
-
-    else if ( v.is("ip") )
+    if ( v.is("ip") )
         host.ipv4_addr = v.get_ip4();
 
     else if ( v.is("mac") )

diff --git a/src/network_inspectors/arp_spoof/arp_module.h b/src/network_inspectors/arp_spoof/arp_module.h
index 7390bcef74fb3ef92d702c1c010e770a84a6b77c..1a0c8bb2efa37cb3d1f3fa6db5c56983bd76b3c7 100644 (file)
--- a/src/network_inspectors/arp_spoof/arp_module.h
+++ b/src/network_inspectors/arp_spoof/arp_module.h
@@ -49,7 +49,6 @@ typedef std::vector<IPMacEntry> IPMacEntryList;
 
 struct ArpSpoofConfig
 {
-    bool check_unicast_arp;
     bool check_overwrite;
 
     IPMacEntryList ipmel;

diff --git a/src/network_inspectors/arp_spoof/arp_spoof.cc b/src/network_inspectors/arp_spoof/arp_spoof.cc
index 1c9d9ee7feee212921f5b506579cd2d15a7e99dc..e71955286b0b9f625738740b9a01acf37b3ac3bb 100644 (file)
--- a/src/network_inspectors/arp_spoof/arp_spoof.cc
+++ b/src/network_inspectors/arp_spoof/arp_spoof.cc
@@ -199,16 +199,13 @@ void ArpSpoof::eval(Packet *p)
     switch(ntohs(ah->ea_hdr.ar_op))
     {
         case ARPOP_REQUEST:
-            if (config->check_unicast_arp)
+            if (memcmp((u_char *)eh->ether_dst, (u_char *)bcast, 6) != 0)
             {
-                if (memcmp((u_char *)eh->ether_dst, (u_char *)bcast, 6) != 0)
-                {
-                    SnortEventqAdd(GID_ARP_SPOOF,
-                            ARPSPOOF_UNICAST_ARP_REQUEST);
-
-                    DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,
-                            "MODNAME: Unicast request\n"););
-                }
+                SnortEventqAdd(GID_ARP_SPOOF,
+                    ARPSPOOF_UNICAST_ARP_REQUEST);
+
+                DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,
+                        "MODNAME: Unicast request\n"););
             }
             else if (memcmp((u_char *)eh->ether_src,
                     (u_char *)ah->arp_sha, 6) != 0)

diff --git a/src/parser/cmd_line.cc b/src/parser/cmd_line.cc
index df6a00ab264d06676774ac9e66109fbef8a6e12e..370aca133e5b4f639e336e76fae67dec72e7dce7 100644 (file)
--- a/src/parser/cmd_line.cc
+++ b/src/parser/cmd_line.cc
@@ -75,13 +75,13 @@ static const char* snort_help =
 "Snort has several options to get more help:\n"
 "\n"
 "--help this overview of help\n"
-"--help-builtin <module prefix> output matching builtin rules\n"
+"--help-builtin [<module prefix>] output matching builtin rules\n"
 "--help-buffers output available inspection buffers\n"
-"--help-commands <module prefix> output matching commands\n"
-"--help-config <module prefix> output matching config options\n"
-"--help-gids <module prefix> output matching generators\n"
-"--help-module output description of given module\n"
-"--help-options <option prefix> output matching command line option quick help\n"
+"--help-commands [<module prefix>] output matching commands\n"
+"--help-config [<module prefix>] output matching config options\n"
+"--help-gids [<module prefix>] output matching generators\n"
+"--help-module <module> output description of given module\n"
+"--help-options [<option prefix>] output matching command line options\n"
 "--help-signals dump available control signals\n"
 "--list-modules list all known modules\n"
 "--list-plugins list all known modules\n"
@@ -845,16 +845,16 @@ static ConfigFunc basic_opts[] =
       "output available inspection buffers" },
 
     { "help-commands", help_commands,
-      "<module prefix> output matching commands" },
+      "[<module prefix>] output matching commands" },
 
     { "help-config", help_config,
-      "<module prefix> output matching config options" },
+      "[<module prefix>] output matching config options" },
 
     { "help-gids", help_gids,
-      "<module prefix> output matching generators" },
+      "[<module prefix>] output matching generators" },
 
     { "help-module", help_module,
-      "output description of given module" },
+      "<module> output description of given module" },
 
     { "help-options", help_options,
       "<option prefix> output matching command line option quick help" },

diff --git a/src/protocols/layer.cc b/src/protocols/layer.cc
index 1441fda5125879a1c1cfd132e1afdff686bb32b1..fd7ff92069c14d8e79066cc8a7b43b0aee4b4785 100644 (file)
--- a/src/protocols/layer.cc
+++ b/src/protocols/layer.cc
@@ -132,6 +132,7 @@ uint8_t get_outer_ip_next_pro(const Packet* const p)
                 break;
         }
     }
+    return -1;
 }
 
 int get_inner_ip_lyr(const Packet* const p)

diff --git a/src/service_inspectors/ftp_telnet/ftpp_ui_config.cc b/src/service_inspectors/ftp_telnet/ftpp_ui_config.cc
index 6b3a5fd4f37b4b9b2e0343625424a6a89a4299a6..126f8f36ddefbaa4453d2d28ca98c6f2629729cc 100644 (file)
--- a/src/service_inspectors/ftp_telnet/ftpp_ui_config.cc
+++ b/src/service_inspectors/ftp_telnet/ftpp_ui_config.cc
@@ -77,9 +77,7 @@ TELNET_PROTO_CONF::TELNET_PROTO_CONF()
 {
     normalize = check_encrypted_data = 0;
     ayt_threshold = FTPP_UI_CONFIG_TELNET_DEF_AYT_THRESHOLD;
-
     detect_encrypted = 0;
-    detect_anomalies = 0;
 }
 
 /*

diff --git a/src/service_inspectors/ftp_telnet/ftpp_ui_config.h b/src/service_inspectors/ftp_telnet/ftpp_ui_config.h
index 1c446909df9aa1b2a374ebe9cfbdef1b7ef4a796..7086f0af0789b3fbda73c5f3aafd2dbf238d3f15 100644 (file)
--- a/src/service_inspectors/ftp_telnet/ftpp_ui_config.h
+++ b/src/service_inspectors/ftp_telnet/ftpp_ui_config.h
@@ -244,7 +244,6 @@ struct TELNET_PROTO_CONF
     bool normalize;
     bool check_encrypted_data;
     bool detect_encrypted;
-    bool detect_anomalies;
 
     TELNET_PROTO_CONF();
 };

diff --git a/src/service_inspectors/ftp_telnet/telnet.cc b/src/service_inspectors/ftp_telnet/telnet.cc
index f8de365951f31dfbf53e0c3d27228c861d4ce6d5..2cd6635cf2be6235780bb6297591c1de6efa9276 100644 (file)
--- a/src/service_inspectors/ftp_telnet/telnet.cc
+++ b/src/service_inspectors/ftp_telnet/telnet.cc
@@ -216,8 +216,6 @@ static int PrintTelnetConf(TELNET_PROTO_CONF *TelnetConf)
     LogMessage("      Are You There Threshold: %d\n",
         TelnetConf->ayt_threshold);
     LogMessage("      Normalize: %s\n", TelnetConf->normalize ? "YES" : "NO");
-    LogMessage("      Detect Anomalies: %s\n",
-            TelnetConf->detect_anomalies ? "YES" : "NO");
     PrintConfOpt(TelnetConf->detect_encrypted, "Check for Encrypted Traffic");
     LogMessage("      Continue to check encrypted data: %s\n",
         TelnetConf->check_encrypted_data ? "YES" : "NO");

diff --git a/src/service_inspectors/ftp_telnet/telnet_module.cc b/src/service_inspectors/ftp_telnet/telnet_module.cc
index 61a53933cfabad9f6ed73a0ff5bd78302a4fabf9..76dd7f3a93cb24bd29ad08d4775ea9d2ed84f83f 100644 (file)
--- a/src/service_inspectors/ftp_telnet/telnet_module.cc
+++ b/src/service_inspectors/ftp_telnet/telnet_module.cc
@@ -44,9 +44,6 @@ static const Parameter telnet_params[] =
     { "check_encrypted", Parameter::PT_BOOL, nullptr, "false",
       "check for end of encryption" },
 
-    { "detect_anomalies", Parameter::PT_BOOL, nullptr, "false",
-      "help" },
-
     { "encrypted_traffic", Parameter::PT_BOOL, nullptr, "false",
       "check for encrypted telnet and ftp" },
 
@@ -91,9 +88,6 @@ bool TelnetModule::set(const char*, Value& v, SnortConfig*)
     else if ( v.is("check_encrypted") )
         conf->detect_encrypted = v.get_bool();
 
-    else if ( v.is("detect_anomalies") )
-        conf->detect_anomalies = v.get_bool();
-
     else if ( v.is("encrypted_traffic") )
         conf->check_encrypted_data = v.get_bool();
 

diff --git a/src/service_inspectors/http_inspect/hi_module.cc b/src/service_inspectors/http_inspect/hi_module.cc
index a5d58fb5ad53f6495f76d19f06c0aeb3fba164dc..87f071a2205d5101e66725aa2ce5f4e3509cab48 100644 (file)
--- a/src/service_inspectors/http_inspect/hi_module.cc
+++ b/src/service_inspectors/http_inspect/hi_module.cc
@@ -37,10 +37,10 @@
 static const Parameter hi_umap_params[] =
 {
     { "code_page", Parameter::PT_INT, "0:", "1252",
-      "help" },
+      "select code page in map file" },
 
     { "map_file", Parameter::PT_STRING, nullptr, nullptr,
-      "help" },
+      "unicode map file" },
 
     { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
 };
@@ -71,7 +71,7 @@ static const Parameter hi_global_params[] =
       "maximum amount of packet payload to decompress" },
 
     { "decode", Parameter::PT_TABLE, hi_decode_params, nullptr,
-      "help" },
+      "decode parameters" },
 
     { "decompress_depth", Parameter::PT_INT, "1:65535", "2920",
       "maximum amount of decompressed data to process" },
@@ -93,7 +93,7 @@ static const Parameter hi_global_params[] =
       "alert on proxy usage for servers without allow_proxy_use" },
 
     { "unicode_map", Parameter::PT_TABLE, hi_umap_params, nullptr,
-      "help" },
+      "default unicode map configuration" },
 
     { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
 };
@@ -287,7 +287,7 @@ static const Parameter hi_server_params[] =
       "log True-Client-IP and X-Forwarded-For headers with unified2 alerts as extra data" },
 
     { "extended_ascii_uri", Parameter::PT_BOOL, nullptr, "false",
-      "help" },
+      "allow extended ASCII codes in the request URI" },
 
     { "extended_response_inspection", Parameter::PT_BOOL, nullptr, "false",
       "extract resonse headers" },
@@ -305,7 +305,7 @@ static const Parameter hi_server_params[] =
       "enable unicode code point mapping using unicode_map settings" },
 
     { "iis_unicode_map", Parameter::PT_TABLE, hi_umap_params, nullptr,
-      "help" },
+      "server unicode map configuration" },
 
     { "inspect_gzip", Parameter::PT_BOOL, nullptr, "false",
       "enable gzip decompression of compressed bodies" },
@@ -326,7 +326,7 @@ static const Parameter hi_server_params[] =
       "maximum allowd client request headers" },
 
     { "max_spaces", Parameter::PT_INT, "0:65535", "200",
-      "help" },
+      "maximum allowed whitespaces when folding" },
 
     { "multi_slash", Parameter::PT_BOOL, nullptr, "true",
       "normalize out consecutive slashes in URI" },
@@ -341,10 +341,10 @@ static const Parameter hi_server_params[] =
       "allows HTTP 0.9 processing" },
 
     { "normalize_cookies", Parameter::PT_BOOL, nullptr, "false",
-      "help" },
+      "normalize cookies similar to URI" },
 
     { "normalize_headers", Parameter::PT_BOOL, nullptr, "false",
-      "help" },
+      "normalize headers other than cookie similar to URI" },
 
     { "normalize_javascript", Parameter::PT_BOOL, nullptr, "false",
       "normalize javascript between <script> tags" },
@@ -353,7 +353,7 @@ static const Parameter hi_server_params[] =
       "maximum number of consecutive whitespaces" },
 
     { "normalize_utf", Parameter::PT_BOOL, nullptr, "false",
-      "help" },
+      "normalize response bodies with UTF content-types" },
 
     { "oversize_dir_length", Parameter::PT_INT, "0:", "0",
       "alert if a URL has a directory longer than this limit" },
@@ -374,14 +374,11 @@ static const Parameter hi_server_params[] =
       "alert if more than small_chunk_count consecutive chunks below this limit" },
 
     { "tab_uri_delimiter", Parameter::PT_BOOL, nullptr, "false",
-      "help" },
+      "whether a tab not preceded by a space is considered a delimiter or part of URI" },
 
     { "u_encode", Parameter::PT_BOOL, nullptr, "false",
       "decode %uXXXX character sequences" },
 
-//    { "unicode_map", Parameter::PT_TABLE, hi_umap_params, nullptr,
-//      "help" },
-
     { "unlimited_decompress", Parameter::PT_BOOL, nullptr, "false",
       "decompress across multiple packets" },
 
@@ -392,7 +389,7 @@ static const Parameter hi_server_params[] =
       "alert on directory traversals past the top level (web server root)" },
 
     { "whitespace_chars", Parameter::PT_BIT_LIST, "255", "false",
-      "help" },
+      "allowed white space characters" },
 
     { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
 };

diff --git a/src/stream/tcp/tcp_session.cc b/src/stream/tcp/tcp_session.cc
index 70cf2e631d6fabf4c38f8e91556c73f2aeb977d6..f3cc4c7d3a932499ef5088f6883511323d01107e 100644 (file)
--- a/src/stream/tcp/tcp_session.cc
+++ b/src/stream/tcp/tcp_session.cc
@@ -3873,9 +3873,8 @@ static void ProcessTcpStream(StreamTracker *rcv, TcpSession *tcpssn,
 
                 if (rcv->small_seg_count > config->max_consec_small_segs)
                 {
-                    /* Above threshold, log it... requires detect_anomalies be
-                    * on in this TCP policy, action controlled by preprocessor
-                    * rule. */
+                    /* Above threshold, log it...  in this TCP policy, 
+                     * action controlled by preprocessor rule. */
                     EventMaxSmallSegsExceeded();
 
                     /* Reset counter, so we're not too noisy */

diff --git a/tools/snort2lua/utils/snort2lua_util.cc b/tools/snort2lua/utils/snort2lua_util.cc
index cf289acfb1795c4452ab13611fd67d643324c211..5fa02da2f5307b67c3a6c8afa2ee86e17f5094f2 100644 (file)
--- a/tools/snort2lua/utils/snort2lua_util.cc
+++ b/tools/snort2lua/utils/snort2lua_util.cc
@@ -28,6 +28,7 @@
 #include <iostream>
 #include <string>
 #include <cstring>
+#include <sstream>
 #include "utils/snort2lua_util.h"
 #include "conversion_state.h"
 #include "data/dt_data.h"
@@ -98,10 +99,10 @@ std::size_t get_substr_length(std::string str, std::size_t max_length)
     }
     return str_len;
 }
-
-bool inline get_string_helper(std::istringstream& stream,
-                              std::string& option,
-                              const std::string& delimeters)
+    
+bool get_string(std::istringstream& stream,
+                std::string& option,
+                const std::string delimeters)
 {
     if (delimeters.empty() || !stream.good())
     {
@@ -148,12 +149,6 @@ bool inline get_string_helper(std::istringstream& stream,
     }
 }
 
-
-bool get_string(std::istringstream& stream,
-                      std::string& option,
-                       const std::string delimeters)
-{ return get_string_helper(stream, option, delimeters); }
-
 std::string get_rule_option_args(std::istringstream& stream)
 {
     std::string args = std::string();