fix compile issue reported by Josh

diff --git a/doc/differences.txt b/doc/differences.txt
index 030d530e79f549e94fe4b43e514597d0fb1693c5..83f9fb46e46edf622a2e387a294b9a97ad5e5d0f 100644 (file)
--- a/doc/differences.txt
+++ b/doc/differences.txt
@@ -1,81 +1,94 @@
 Snort++ differs from Snort in the following ways:
 
-* no ; separated content suboptions
-* fastpattern:1 2;
-* replaced "unknown args are bpf" with --bpf
+* command line and conf file syntax made more uniform
+* removed unused and deprecated features
+* remove as many barriers to successful run as possible
+  (eg: no upper bounds on memcaps)
+* assume the simplest mode of operation
+  (eg: never assume input from or output to some hardcoded filename)
+
+=== Build Options
+
+* configure --with-lib{pcap,pcre}-* -> --with-{pcap,pcre}-*
+* control socket, cs_dir, and users were deleted
+
+=== Command Line
+
+* --pause loads config and waits for resume before processing packets
+* --require-rule-sid is hardened
+* --shell enables interactive Lua shell
+* -T is assumed if no input given
+* added --help-config prefix to dump all matching settings
+* added --script-path
+* added -K text; -K text/pcap is old dump/log mode
 * added -z <#> and --max-packet-threads <#>
-* sid == 0 not allowed
-* all rules must have a sid
-* deleted log_ascii
-* deleted activate / dynamic rules
-* changed default logging mode to -K none
-* deleted layer2resets and flexresp2_*
-* deleted config threshold and ips rule threshold (-> event_filter)
-* deleted --disable-attribute-table-reload-thread
-* deleted config decode_*_{alerts,drops} (use rules only)
+* delete --enable-mpls-multicast, --enable-mpls-overlapping-ip, 
+  --max-mpls-labelchain-len, --mpls-payload-type
 * deleted --no-interface-pidfile
+* deleting command line options which will be available with --lua or some such including:
+  -I, -h, -F, -p, --disable-inline-init-failopen
+* hardened -n < 0
+* removed --search-method
+* replaced "unknown args are bpf" with --bpf
 * replaced --dynamic-*-lib[-dir] with --plugin-path (with : separators)
+
+=== Conf File
+
+* Snort++ has a default unicode.map
+* Snort++ will not enforce an upper bound on memcaps and the like within 64 bits
+* Snort++ will supply a default *_global config if not specified
+  (Snort would fatal; eg http_inspect_server w/o http_inspect_global)
+* address list syntax changes: [[ and ]] must be [ [ and ] ] to avoid Lua string
+  parsing errors (unless in quoted string)
+* because the Lua conf is live code, we lose file:line locations in app error messages
+  (syntax errors from Lua have file:line)
 * changed search-method names for consistency
-* eliminated ac-split; must use ac-full-q split-any-any
-* removed --search-method
-* lowmem* search methods are now in snort_examples
-* deleted config dump-dynamic-rules-path
-* deleted config ipv6_frag (not actually used)
-* deleted metadata engine shared
-* soid is now a non-metadata option
-* rule option sequence: <stub> soid <hidden>
-* added --script-path
-* switched to lua path
-* config autogenerate_preprocessor_decoder_rules:
-   only with 1 packet thread (should probably delete this)
-   renamed to autogenerate_builtin_rules
-* deleting command line options which will be available with --lua or some
-   such including:  -I, -h, -F, -p, --disable-inline-init-failopen
 * delete config include_vlan_in_alerts (not used in code)
 * delete config so_rule_memcap (not used in code)
-* delete --enable-mpls-multicast, --enable-mpls-overlapping-ip,
-   --max-mpls-labelchain-len, --mpls-payload-type
-* lua field names are (lower) case sensitive; snort.conf largely wasn't
-* renamed type and print config suboptions to avoid confusion with lua 
-   functions (not strictly necessary)
-* deleted unused rule_state.action
-* general output guideline: don't print zero counts
-* because the Lua conf is live code, we lose file:line locations in
-   app error messages (syntax errors from Lua have file:line)
-* added --help-config prefix to dump all matching settings
-* hardened -n < 0
-* removed various run modes - now just one
-* added -K text; -K text/pcap is old dump/log mode
-* -T is assumed if no input given
-* --require-rule-sid is hardened
-* --shell enables interactive Lua shell
-* --pause loads config and waits for resume before processing packets
-* no positional parameters; all name = value
-* alert_fast includes packet data by default
-* all text mode outputs default to stdout
-* limits like "1234K" are now "limit = 1234, units = 'K'"
-* Snort++ queues decoder and inspector events to the main event queue
-  before ips policy is selected; since some events may not be enabled,
-  the queue needs to be sized larger than with Snort which used an
-  intermediate queue for decoder events.
-* deleted metadata: rule-flushing (with PDU flushing rule flushing can
-  cause missed attacks, the opposite of its intent)
-* configure --with-lib{pcap,pcre}-* -> --with-{pcap,pcre}-*
-* control socket, cs_dir, and users were deleted
-* frag3 default policy is linux not bsd
+* deleted --disable-attribute-table-reload-thread
+* deleted config decode_*_{alerts,drops} (use rules only)
+* deleted config dump-dynamic-rules-path
+* deleted config ipv6_frag (not actually used)
+* deleted config threshold and ips rule threshold (-> event_filter)
+* eliminated ac-split; must use ac-full-q split-any-any
 * frag3 -> defrag, arpspoof -> arp_spoof, sfportscan -> port_scan,
   perfmonitor -> perf_monitor, bo -> back_orifice
-* portscan.detect_ack_scans deleted (exact same as include_midstream)
-* address list syntax changes: [[ and ]] must be [ [ and ] ] to avoid Lua
-  string parsing errors (unless in quoted string)
-* module filenames are not configurable:
-  always <log-dir>/<module-name><suffix>
+* limits like "1234K" are now "limit = 1234, units = 'K'"
+* lua field names are (lower) case sensitive; snort.conf largely wasn't
+* module filenames are not configurable: always <log-dir>/<module-name><suffix>
   (suffix is determined by module)
+* no positional parameters; all name = value
 * perf_monitor configuration was simplified
-* Snort++ will not enforce an upper bound on memcaps and the like within 64
-  bits
-* Snort++ will supply a default *_global config if not specified
-  (Snort would fatal; eg http_inspect_server w/o http_inspect_global)
-* Snort++ has a default unicode.map
+* portscan.detect_ack_scans deleted (exact same as include_midstream)
+* removed various run modes - now just one
+* frag3 default policy is linux not bsd
+* lowmem* search methods are now in snort_examples
+* deleted unused http_inspect stateful mode
+
+=== Rules
+
+* all rules must have a sid
+* deleted activate / dynamic rules
+* deleted metadata engine shared
+* deleted metadata: rule-flushing (with PDU flushing rule flushing can cause
+  missed attacks, the opposite of its intent)
+* deleted unused rule_state.action
+* fastpattern:1 2;
+* no ; separated content suboptions
+* rule option sequence: <stub> soid <hidden>
+* sid == 0 not allowed
+* soid is now a non-metadata option
+
+=== Output
+
+* alert_fast includes packet data by default
+* all text mode outputs default to stdout
+* changed default logging mode to -K none
+* deleted layer2resets and flexresp2_*
+* deleted log_ascii
+* general output guideline: don't print zero counts
+* Snort++ queues decoder and inspector events to the main event queue before ips policy
+  is selected; since some events may not be enabled, the queue needs to be sized larger
+  than with Snort which used an intermediate queue for decoder events.
 * deleted the intermediate http and ftp_telnet event queues
 

diff --git a/doc/style.txt b/doc/style.txt
index 05c0b0a06852650c835cc0afffbdf6c6e28dfdbe..a26af7ba9cc829857c1cd5000ed0b030bc8ae522 100644 (file)
--- a/doc/style.txt
+++ b/doc/style.txt
@@ -16,6 +16,8 @@ yet firm so feedback is welcome to get something we can live with.
 
 * Use lower case filenames with underscores.
 
+* Use lower case namespaces (preferably short, w/o underscores).
+
 === Comments
 
 * Write comments sparingly with a mind towards future proofing.  Often the
@@ -61,6 +63,18 @@ yet firm so feedback is welcome to get something we can live with.
         calling_a_func_with_a_long_name(
             arg1, arg2, arg3);
 
+* Put function signature on one line, except when breaking for the arg
+  list:
+
+    No:
+        inline
+        bool foo()
+        { // ...
+
+    Yes:
+        inline bool foo()
+        { // ...
+
 === Headers
 
 * Don't hesitate to create a new header if it is needed.  Don't lump

diff --git a/src/framework/inspector.h b/src/framework/inspector.h
index 1e859c301f7ea473330ce14068658dc6a0756349..bf5c82826f92de33aee3987e567c5c2ec8a5a575 100644 (file)
--- a/src/framework/inspector.h
+++ b/src/framework/inspector.h
@@ -97,8 +97,8 @@ typedef Inspector* (*PreprocCtorFunc)(Module*);
 typedef void (*PreprocDtorFunc)(Inspector*);
 
 // FIXIT ensure all pp's provide stats
-struct
-InspectApi {
+struct InspectApi
+{
     BaseApi base;
     Priority priority;
     uint16_t proto_bits;

diff --git a/src/framework/ips_option.h b/src/framework/ips_option.h
index e0b20680abeb8cfef47e7ae8fdc2ad46ae820c56..e4934c2416e4a7dd7e8487b93384c9f41c6838ba 100644 (file)
--- a/src/framework/ips_option.h
+++ b/src/framework/ips_option.h
@@ -86,8 +86,8 @@ typedef enum _RuleOptType
 
 } RuleOptType;
 
-struct
-IpsApi {
+struct IpsApi
+{
     BaseApi base;
     RuleOptType type;
     unsigned max_per_rule;

diff --git a/src/framework/logger.h b/src/framework/logger.h
index 3ce484aaae60da7e5a16b95935d2e76982fadcc5..dd9980ebf1d4c825bd5ad92b85e438cde6170f4e 100644 (file)
--- a/src/framework/logger.h
+++ b/src/framework/logger.h
@@ -67,8 +67,8 @@ typedef Logger* (*eh_new)(struct SnortConfig*, class Module*);
 typedef void (*eh_del)(Logger*);
 
 // FIXIT ensure all eh provide stats
-struct
-LogApi {
+struct LogApi
+{
     BaseApi base;
     unsigned flags;
     eh_new ctor;

diff --git a/src/framework/mpse.h b/src/framework/mpse.h
index 6239215b77cd1632374946bd51dc9ceb49c4ff58..8c2eaaffa6bd8b8167d348c3239bc98044e02329 100644 (file)
--- a/src/framework/mpse.h
+++ b/src/framework/mpse.h
@@ -127,8 +127,8 @@ typedef Mpse* (*mpse_new_f)(
 
 typedef void (*mpse_del_f)(Mpse*);
 
-struct
-MpseApi {
+struct MpseApi
+{
     BaseApi base;
     bool trim;
 

diff --git a/src/framework/so_rule.h b/src/framework/so_rule.h
index 609d61d0ff8a46aabd617cc6e042da91072d8022..1470957f13dc75d87f43dbaa22318bfa3c15fee8 100644 (file)
--- a/src/framework/so_rule.h
+++ b/src/framework/so_rule.h
@@ -46,8 +46,8 @@ typedef so_eval_f (*so_new_f)(const char* key, void**);
 typedef void (*so_del_f)(void*);
 typedef void (*so_aux_f)();
 
-struct
-SoApi {
+struct SoApi
+{
     BaseApi base;
 
     const uint8_t* rule;

diff --git a/src/log/messages.h b/src/log/messages.h
index 73a1a96a9393fd9723193ef66d66947df8b52967..478834f6444faf9cb592eec95ce444fdbebefbcc 100644 (file)
--- a/src/log/messages.h
+++ b/src/log/messages.h
@@ -73,7 +73,7 @@ public:
     void dump(const char* s, unsigned v)
     {
         const char* eol = !(++idx % max) ? "\n" : "";
-        LogMessage("\t%15.15s(v%u)%s", s, v, eol);
+        LogMessage("    %18.18s(v%u)%s", s, v, eol);
     };  
 private:
     unsigned max;

diff --git a/src/packet_io/sfdaq.cc b/src/packet_io/sfdaq.cc
index 3282dbddd4dec0d8d38bc3352ee6457218ed8932..77d7e893918532ea11ce71781adb779b01e53916 100644 (file)
--- a/src/packet_io/sfdaq.cc
+++ b/src/packet_io/sfdaq.cc
@@ -596,7 +596,7 @@ const DAQ_Stats_t* DAQ_GetStats (void)
 
 //--------------------------------------------------------------------
 
-int DAQ_ModifyFlow(const void* /*h*/, uint32_t /*id*/)
+int DAQ_ModifyFlow(const void* h, uint32_t id)
 {
 #ifdef HAVE_DAQ_ACQUIRE_WITH_META
     const DAQ_PktHdr_t *hdr = (DAQ_PktHdr_t*) h;
@@ -605,6 +605,8 @@ int DAQ_ModifyFlow(const void* /*h*/, uint32_t /*id*/)
     mod.opaque = id;
     return daq_modify_flow(daq_mod, daq_hand, hdr, &mod);
 #else
+    UNUSED(h);
+    UNUSED(id);
     return -1;
 #endif
 }