Pending - build 150
+-- additional refactoring and cleanup
+-- fix http_inspect mpse search
+-- fixed urg rule option
+-- change daq.var to daq.vars to support multiple params
+ reported by Sancho Panza
+-- ensure unknown sources are analyzed
-- pop and imap inspectors ported
15/04/28 - build 149
static const Parameter dl_params[] =
{
- { "key", Parameter::PT_STRING, nullptr, nullptr,
+ { "key", Parameter::PT_STRING, nullptr, "http_uri",
"name of data buffer to log" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
static const char* s_name = "urg";
static const char* s_help = "detection for TCP urgent pointer";
-// FIXIT-H profiling is desirable but must be refactored to
-// avoid dependence on snort_config.h which snowballs
-//#undef PERF_PROFILING
-
static THREAD_LOCAL ProfileStats tcpUrgPerfStats;
//-------------------------------------------------------------------------
int TcpUrgOption::eval(Cursor&, Packet* p)
{
- //PROFILE_VARS;
- //MODULE_PROFILE_START(tcpUrgPerfStats);
+ PROFILE_VARS;
+ MODULE_PROFILE_START(tcpUrgPerfStats);
int rval = DETECTION_OPTION_NO_MATCH;
- if ( p->ptrs.tcph && config.eval(p->ptrs.tcph->th_ack) )
+ if ( p->ptrs.tcph and p->ptrs.tcph->are_flags_set(TH_URG) and
+ config.eval(p->ptrs.tcph->urp()) )
+ {
rval = DETECTION_OPTION_MATCH;
+ }
- //MODULE_PROFILE_END(tcpUrgPerfStats);
+ MODULE_PROFILE_END(tcpUrgPerfStats);
return rval;
}
static const Parameter s_params[] =
{
- { "*range", Parameter::PT_STRING, nullptr, nullptr,
+ { "~range", Parameter::PT_STRING, nullptr, nullptr,
"check if urgent offset is min<>max | <max | >min" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
bool UrgModule::set(const char*, Value& v, SnortConfig*)
{
- if ( !v.is("*range") )
+ if ( !v.is("~range") )
return false;
return data.parse(v.get_string());
#include "detection_util.h"
#include <time.h>
+#include <string>
#include "snort_config.h"
#include "log/text_log.h"
char time_buf[26];
ctime_r(&now, time_buf);
- char buf[STD_BUF];
- const char* dir = snort_conf->log_dir ? snort_conf->log_dir : ".";
- snprintf(buf, sizeof(buf), "%s/%s", dir, snort_conf->event_trace_file);
+ std::string fname;
+ get_instance_file(fname, "event_trace.txt");
- tlog = TextLog_Init (buf, 128, 8*1024*1024);
+ tlog = TextLog_Init (fname.c_str(), 128, 8*1024*1024);
TextLog_Print(tlog, "\nTrace started at %s", time_buf);
TextLog_Print(tlog, "Trace max_data is %u bytes\n", snort_conf->event_trace_max);
}
{
enum Type
{
- PT_TABLE, // range is Parameter*, deflt is TBD
- PT_LIST, // range is Parameter*, deflt is TBD
+ PT_TABLE, // range is Parameter*, no default
+ PT_LIST, // range is Parameter*, no default
PT_BOOL, // if you are reading this, get more coffee
PT_INT, // signed 64 bits or less determined by range
PT_REAL, // double
bool Value::get_next_token(string& tok)
{
- return ss && ( *ss >> tok );
+ return ss and ( *ss >> tok );
+}
+
+bool Value::get_next_csv_token(string& tok)
+{
+ return ss and std::getline(*ss, tok, ',');
}
bool Value::strtol(long& n) const
return str.c_str();
}
+void Value::update_mask(uint8_t& mask, uint8_t flag, bool invert)
+{
+ if ( get_bool() xor invert )
+ mask |= flag;
+ else
+ mask &= ~flag;
+}
+
+void Value::update_mask(uint16_t& mask, uint16_t flag, bool invert)
+{
+ if ( get_bool() xor invert )
+ mask |= flag;
+ else
+ mask &= ~flag;
+}
+
+void Value::update_mask(uint32_t& mask, uint32_t flag, bool invert)
+{
+ if ( get_bool() xor invert )
+ mask |= flag;
+ else
+ mask &= ~flag;
+}
+
+void Value::update_mask(uint64_t& mask, uint64_t flag, bool invert)
+{
+ if ( get_bool() xor invert )
+ mask |= flag;
+ else
+ mask &= ~flag;
+}
+
void set_first_token();
bool get_next_token(std::string&);
+ bool get_next_csv_token(std::string&);
+
+ // set/clear flag based on get_bool()
+ void update_mask(uint8_t& mask, uint8_t flag, bool invert = false);
+ void update_mask(uint16_t& mask, uint16_t flag, bool invert = false);
+ void update_mask(uint32_t& mask, uint32_t flag, bool invert = false);
+ void update_mask(uint64_t& mask, uint64_t flag, bool invert = false);
private:
void init()
return false;
}
+static const char* get_source()
+{
+ if ( Trough_Next() )
+ return Trough_First();
+
+ if ( unknown_source )
+ {
+ unknown_source = false;
+ return "";
+ }
+ return nullptr;
+}
+
static void main_loop()
{
unsigned idx = max_pigs, swine = 0;
--swine;
}
}
- else if ( Trough_Next() )
+ else if ( const char* src = get_source() )
{
Swapper* swapper = new Swapper(snort_conf, SFAT_GetConfig());
- pig.start(idx, Trough_First(), swapper);
+ pig.start(idx, src, swapper);
++swine;
continue;
}
sc->asn1_mem = v.get_long();
else if ( v.is("pcre_enable") )
- {
- if ( v.get_bool() )
- sc->run_flags &= ~RUN_FLAG__NO_PCRE;
- else
- sc->run_flags |= RUN_FLAG__NO_PCRE;
- }
+ v.update_mask(sc->run_flags, RUN_FLAG__NO_PCRE, true);
+
else if ( v.is("pcre_match_limit") )
sc->pcre_match_limit = v.get_long();
bool AlertsModule::set(const char*, Value& v, SnortConfig* sc)
{
if ( v.is("alert_with_interface_name") )
- sc->output_flags |= OUTPUT_FLAG__ALERT_IFACE;
+ v.update_mask(sc->output_flags, OUTPUT_FLAG__ALERT_IFACE);
else if ( v.is("default_rule_state") )
sc->default_rule_state = v.get_bool();
return ( sfip_pton(v.get_string(), &sc->homenet) == SFIP_SUCCESS );
else if ( v.is("stateful") )
- sc->run_flags |= RUN_FLAG__ASSURE_EST;
+ v.update_mask(sc->run_flags, RUN_FLAG__ASSURE_EST);
else if ( v.is("tunnel_verdicts") )
ConfigTunnelVerdicts(sc, v.get_string());
static const Parameter output_event_trace_params[] =
{
- { "file", Parameter::PT_STRING, nullptr, nullptr,
- "where to write event trace logs" },
-
{ "max_data", Parameter::PT_INT, "0:65535", "0",
"maximum amount of packet data to capture" },
bool OutputModule::set(const char*, Value& v, SnortConfig* sc)
{
if ( v.is("dump_chars_only") )
- {
- if ( v.get_bool() )
- sc->output_flags |= OUTPUT_FLAG__CHAR_DATA;
- }
+ v.update_mask(sc->output_flags, OUTPUT_FLAG__CHAR_DATA);
+
else if ( v.is("dump_payload") )
- {
- if ( v.get_bool() )
- sc->output_flags |= OUTPUT_FLAG__APP_DATA;
- }
+ v.update_mask(sc->output_flags, OUTPUT_FLAG__APP_DATA);
+
else if ( v.is("dump_payload_verbose") )
- {
- if ( v.get_bool() )
- sc->output_flags |= OUTPUT_FLAG__VERBOSE_DUMP;
- }
- else if ( v.is("file") )
- sc->event_trace_file = SnortStrdup(v.get_string());
+ v.update_mask(sc->output_flags, OUTPUT_FLAG__VERBOSE_DUMP);
else if ( v.is("log_ipv6_extra_data") )
- {
- if ( v.get_bool() )
- sc->log_ipv6_extra = 1; // FIXIT-M move to output|logging_flags
- }
+ // FIXIT-M move to output|logging_flags
+ sc->log_ipv6_extra = v.get_bool() ? 0 : 1;
+
else if ( v.is("quiet") )
- {
- if ( v.get_bool() )
- sc->logging_flags |= LOGGING_FLAG__QUIET;
- }
+ v.update_mask(sc->logging_flags, LOGGING_FLAG__QUIET);
+
else if ( v.is("logdir") )
- sc->log_dir = SnortStrdup(v.get_string());
+ sc->log_dir = v.get_string();
else if ( v.is("max_data") )
sc->event_trace_max = v.get_long();
else if ( v.is("nolog") )
- {
- if ( v.get_bool() )
- sc->output_flags |= OUTPUT_FLAG__NO_LOG;
- }
+ v.update_mask(sc->output_flags, OUTPUT_FLAG__NO_LOG);
+
else if ( v.is("obfuscate") )
- {
- if ( v.get_bool() )
- sc->output_flags |= OUTPUT_FLAG__OBFUSCATE;
- }
+ v.update_mask(sc->output_flags, OUTPUT_FLAG__OBFUSCATE);
+
else if ( v.is("show_year") )
- {
- if ( v.get_bool() )
- sc->output_flags |= OUTPUT_FLAG__INCLUDE_YEAR;
- }
+ v.update_mask(sc->output_flags, OUTPUT_FLAG__INCLUDE_YEAR);
+
else if ( v.is("tagged_packet_limit") )
sc->tagged_packet_limit = v.get_long();
else if ( v.is("verbose") )
- {
- if ( v.get_bool() )
- sc->logging_flags |= LOGGING_FLAG__VERBOSE;
- }
+ v.update_mask(sc->logging_flags, LOGGING_FLAG__VERBOSE);
+
else
return false;
sc->respond_attempts = v.get_long();
else if ( v.is("device") )
- sc->respond_device = SnortStrdup(v.get_string());
+ sc->respond_device = v.get_string();
else if ( v.is("dst_mac") )
ConfigDstMac(sc, v.get_string());
sc->addressspace_agnostic = v.get_long();
else if ( v.is("bpf_file") )
- sc->bpf_file = SnortStrdup(v.get_string());
+ sc->bpf_file = v.get_string();
else if ( v.is("enable_inline_init_failopen") )
- {
- if ( !v.get_bool() )
- sc->run_flags |= RUN_FLAG__DISABLE_FAILOPEN;
- }
+ v.update_mask(sc->run_flags, RUN_FLAG__DISABLE_FAILOPEN, true);
+
else if ( v.is("limit") )
sc->pkt_cnt = v.get_long();
"select type of DAQ" },
// FIXIT-L should be a list?
- { "var", Parameter::PT_STRING, nullptr, nullptr,
- "list of name=value DAQ-specific parameters" },
+ { "vars", Parameter::PT_STRING, nullptr, nullptr,
+ "comma separated list of name=value DAQ-specific parameters" },
{ "snaplen", Parameter::PT_INT, "0:65535", "deflt",
"set snap length (same as -P)" },
ConfigDaqMode(sc, v.get_string());
else if ( v.is("no_promisc") )
- {
- if ( v.get_bool() )
- sc->run_flags |= RUN_FLAG__NO_PROMISCUOUS;
- }
+ v.update_mask(sc->run_flags, RUN_FLAG__NO_PROMISCUOUS);
+
else if ( v.is("type") )
ConfigDaqType(sc, v.get_string());
- else if ( v.is("var") )
- ConfigDaqVar(sc, v.get_string());
+ else if ( v.is("vars") )
+ {
+ string tok;
+ v.set_first_token();
+ while ( v.get_next_csv_token(tok) )
+ ConfigDaqVar(sc, tok.c_str());
+ }
else if ( v.is("decode_data_link") )
{
if ( v.get_bool() )
CodecManager::instantiate();
- if ( snort_conf->output )
- EventManager::instantiate(snort_conf->output, snort_conf);
+ if ( !snort_conf->output.empty() )
+ EventManager::instantiate(snort_conf->output.c_str(), snort_conf);
if (SnortConfig::alert_before_pass())
{
// FIXIT-L stuff like this that is also done in snort_config.cc::VerifyReload()
// should be refactored
- if ((snort_conf->bpf_filter == NULL) && (snort_conf->bpf_file != NULL))
- snort_conf->bpf_filter = read_infile("packets.bpf_file", snort_conf->bpf_file);
+ if ( snort_conf->bpf_filter.empty() && !snort_conf->bpf_file.empty() )
+ snort_conf->bpf_filter = read_infile("bpf_file", snort_conf->bpf_file.c_str());
- if (snort_conf->bpf_filter != NULL)
- LogMessage("Snort BPF option: %s\n", snort_conf->bpf_filter);
+ if ( !snort_conf->bpf_filter.empty() )
+ LogMessage("Snort BPF option: %s\n", snort_conf->bpf_filter.c_str());
}
// this function should only include initialization that must be done as a
// much initialization stuff in Snort::init() as possible and to restrict this
// function to those things that depend on DAQ startup or non-root user/group.
//
-// FIXIT-J breaks DAQ_New()/Start() because packet threads won't be root when
+// FIXIT-L breaks DAQ_New()/Start() because packet threads won't be root when
// opening iface
void Snort::unprivileged_init()
{
/* create the PID file */
- if ( !SnortConfig::read_mode() && (SnortConfig::daemon_mode() || SnortConfig::create_pid_file()))
+ if ( !SnortConfig::read_mode() &&
+ (SnortConfig::daemon_mode() || SnortConfig::create_pid_file()))
{
CreatePidFile(snort_main_thread_pid);
}
/* Drop the Chrooted Settings */
- if (snort_conf->chroot_dir)
- SetChroot(snort_conf->chroot_dir, &snort_conf->log_dir);
+ if ( !snort_conf->chroot_dir.empty() )
+ SetChroot(snort_conf->chroot_dir, snort_conf->log_dir);
/* Drop privileges if requested, when initialization is done */
SetUidGid(SnortConfig::get_uid(), SnortConfig::get_gid());
ClosePidFile();
/* remove pid file */
- if ( snort_conf->pid_filename[0] )
+ if ( !snort_conf->pid_filename.empty() )
{
- int ret;
-
- ret = unlink(snort_conf->pid_filename);
+ int ret = unlink(snort_conf->pid_filename.c_str());
if (ret != 0)
{
ErrorMessage("Could not remove pid file %s: %s\n",
- snort_conf->pid_filename, get_error(errno));
+ snort_conf->pid_filename.c_str(), get_error(errno));
}
}
{
SnortConfig tmp;
- /* Have to trick LogMessage to log correctly after snort_conf
- * is freed */
- memset(&tmp, 0, sizeof(tmp));
-
- if (snort_conf != NULL)
+ // Have to trick LogMessage to log correctly after snort_conf is freed
+ if ( snort_conf )
{
tmp.logging_flags |=
(snort_conf->logging_flags & LOGGING_FLAG__QUIET);
show_source(intf);
// FIXIT-M the start-up sequence is a little off due to dropping privs
- DAQ_New(snort_conf, intf);
- DAQ_Start();
+ if ( !DAQ_New(snort_conf, intf) )
+ DAQ_Start();
s_packet = PacketManager::encode_new(false);
CodecManager::thread_init(snort_conf);
#include "time/ppm.h"
#include "time/profiler.h"
#include "main/thread.h"
+#include "sfip/sf_ip.h"
THREAD_LOCAL SnortConfig* snort_conf = nullptr;
* among run_modes is how we handle packets via the log_func. */
SnortConfig::SnortConfig()
{
- memset(this, 0, sizeof(*this));
-
- pkt_cnt = 0;
- pkt_skip = 0;
- pkt_snaplen = -1;
- output_flags = 0;
num_layers = DEFAULT_LAYERMAX;
- max_ip6_extensions = 0;
- max_ip_layers = 0;
- gtp_ports = nullptr;
-
- /*user_id and group_id should be initialized to -1 by default, because
- * chown() use this later, -1 means no change to user_id/group_id*/
- user_id = -1;
- group_id = -1;
-
- tagged_packet_limit = 256;
- default_rule_state = true;
-
- // FIXIT-L pcre_match_limit* are interdependent
- // somehow a packet thread needs a much lower setting
- pcre_match_limit = 1500;
- pcre_match_limit_recursion = 1500;
-
- memset(pid_filename, 0, sizeof(pid_filename));
- /* Default max size of the attribute table */
max_attribute_hosts = DEFAULT_MAX_ATTRIBUTE_HOSTS;
max_attribute_services_per_host = DEFAULT_MAX_ATTRIBUTE_SERVICES_PER_HOST;
- /* Default max number of services per rule */
max_metadata_services = DEFAULT_MAX_METADATA_SERVICES;
mpls_stack_depth = DEFAULT_LABELCHAIN_LENGTH;
InspectorManager::new_config(this);
- var_list = NULL;
-
num_slots = get_instance_max();
state = (SnortState*)SnortAlloc(sizeof(SnortState)*num_slots);
source_affinity = new std::map<const std::string, int>;
thread_affinity = new std::vector<int>(32, -1);
-}
-
-SnortConfig::~SnortConfig()
-{
- if ( log_dir )
- free(log_dir);
-
- if ( orig_log_dir )
- free(orig_log_dir);
-
- if ( bpf_file )
- free(bpf_file);
- if ( chroot_dir )
- free(chroot_dir);
+ sfip_clear(homenet);
+ sfip_clear(obfuscation_net);
- if ( bpf_filter )
- free(bpf_filter);
+ memset(evalOrder, 0, sizeof(evalOrder));
- if ( event_trace_file )
- free(event_trace_file);
+ memset(&Alert, 0, sizeof(Alert));
+ memset(&Log, 0, sizeof(Log));
+ memset(&Pass, 0, sizeof(Pass));
+ memset(&Drop, 0, sizeof(Drop));
+ memset(&SDrop, 0, sizeof(SDrop));
+}
+SnortConfig::~SnortConfig()
+{
FreeRuleStateList(rule_state_list);
FreeClassifications(classifications);
FreeReferences(references);
if ( ip_proto_only_lists )
{
- unsigned int j;
-
- for (j = 0; j < NUM_IP_PROTOS; j++)
+ for (int j = 0; j < NUM_IP_PROTOS; j++)
sflist_free_all(ip_proto_only_lists[j], NULL);
free(ip_proto_only_lists);
fpDeleteFastPacketDetection(this);
- if ( daq_type )
- free(daq_type);
-
- if ( daq_mode )
- free(daq_mode);
-
if ( daq_vars )
StringVector_Delete(daq_vars);
if ( daq_dirs )
StringVector_Delete(daq_dirs);
- if ( respond_device )
- free(respond_device);
-
if (eth_dst )
free(eth_dst);
- if ( output )
- free(output);
-
delete file_config;
if ( var_list )
// merge in everything from the command line config
void SnortConfig::merge(SnortConfig* cmd_line)
{
- if ( !cmd_line->log_dir && !log_dir )
- log_dir = SnortStrdup(DEFAULT_LOG_DIR);
+ if ( !cmd_line->log_dir.empty() )
+ log_dir = cmd_line->log_dir;
- else if ( cmd_line->log_dir )
- {
- if ( log_dir )
- free(log_dir);
-
- log_dir = SnortStrdup(cmd_line->log_dir);
- }
+ if ( log_dir.empty() )
+ log_dir = DEFAULT_LOG_DIR;
run_prefix = cmd_line->run_prefix;
- cmd_line->run_prefix = nullptr;
id_subdir = cmd_line->id_subdir;
id_zero = cmd_line->id_zero;
/* Used because of a potential chroot */
- orig_log_dir = SnortStrdup(log_dir);
+ orig_log_dir = log_dir;
event_log_id = cmd_line->event_log_id;
// only set by cmd_line to override other conf output settings
output = cmd_line->output;
- cmd_line->output = nullptr;
/* Merge checksum flags. If command line modified them, use from the
* command line, else just use from config_file. */
if (cmd_line->homenet.family != 0)
memcpy(&homenet, &cmd_line->homenet, sizeof(sfip_t));
- if ( cmd_line->bpf_file )
- {
- if ( bpf_file )
- free(bpf_file);
- bpf_file = SnortStrdup(cmd_line->bpf_file);
- }
+ if ( !cmd_line->bpf_file.empty() )
+ bpf_file = cmd_line->bpf_file;
- if ( cmd_line->bpf_filter )
- bpf_filter = SnortStrdup(cmd_line->bpf_filter);
+ if ( !cmd_line->bpf_filter.empty() )
+ bpf_filter = cmd_line->bpf_filter;
if (cmd_line->pkt_snaplen != -1)
pkt_snaplen = cmd_line->pkt_snaplen;
if (cmd_line->file_mask != 0)
file_mask = cmd_line->file_mask;
- if ( cmd_line->chroot_dir )
+ if ( !cmd_line->chroot_dir.empty() )
{
- if ( chroot_dir )
- free(chroot_dir);
- chroot_dir = SnortStrdup(cmd_line->chroot_dir);
+ chroot_dir = cmd_line->chroot_dir;
}
- if ( cmd_line->daq_type )
- daq_type = SnortStrdup(cmd_line->daq_type);
+ if ( cmd_line->daq_type.size() )
+ daq_type = cmd_line->daq_type;
- if ( cmd_line->daq_mode )
- daq_mode = SnortStrdup(cmd_line->daq_mode);
+ if ( cmd_line->daq_mode.size() )
+ daq_mode = cmd_line->daq_mode;
if ( cmd_line->dirty_pig )
dirty_pig = cmd_line->dirty_pig;
return false;
}
- if ( !bpf_filter && bpf_file )
- bpf_filter = read_infile("packets.bpf_file", bpf_file);
-
- if ( bpf_filter && snort_conf->bpf_filter )
- {
- if (strcasecmp(snort_conf->bpf_filter, bpf_filter) != 0)
- {
- ErrorMessage("Snort Reload: Changing the bpf filter configuration "
- "requires a restart.\n");
- return false;
- }
- }
- else if (bpf_filter != snort_conf->bpf_filter)
+ if ( bpf_filter != snort_conf->bpf_filter )
{
ErrorMessage("Snort Reload: Changing the bpf filter configuration "
"requires a restart.\n");
return false;
}
- if ( snort_conf->chroot_dir && chroot_dir )
- {
- if (strcasecmp(snort_conf->chroot_dir, chroot_dir) != 0)
- {
- ErrorMessage("Snort Reload: Changing the chroot directory "
- "configuration requires a restart.\n");
- return false;
- }
- }
- else if (snort_conf->chroot_dir != chroot_dir)
+ if (snort_conf->chroot_dir != chroot_dir)
{
ErrorMessage("Snort Reload: Changing the chroot directory "
"configuration requires a restart.\n");
}
/* Orig log dir because a chroot might have changed it */
- if ( snort_conf->orig_log_dir && orig_log_dir )
- {
- if (strcasecmp(snort_conf->orig_log_dir, orig_log_dir) != 0)
- {
- ErrorMessage("Snort Reload: Changing the log directory "
- "configuration requires a restart.\n");
- return false;
- }
- }
- else if (snort_conf->orig_log_dir != orig_log_dir)
+ if (snort_conf->orig_log_dir != orig_log_dir)
{
ErrorMessage("Snort Reload: Changing the log directory "
"configuration requires a restart.\n");
#include "config.h"
#endif
-#include <vector>
#include <map>
+#include <string>
+#include <vector>
#include <sys/stat.h>
#include "detection/rules.h"
public:
//------------------------------------------------------
// alert module stuff
- bool default_rule_state;
+ bool default_rule_state = true;
- uint16_t flowbit_size;
+ uint16_t flowbit_size = 0;
sfip_t homenet;
//------------------------------------------------------
// output module stuff
- uint32_t output_flags;
- uint32_t logging_flags;
- uint32_t warning_flags;
+ uint32_t output_flags = 0;
+ uint32_t logging_flags = 0;
+ uint32_t warning_flags = 0;
- uint8_t log_ipv6_extra;
- uint16_t event_trace_max;
- long int tagged_packet_limit;
+ uint8_t log_ipv6_extra = 0;
+ uint16_t event_trace_max = 0;
+ long int tagged_packet_limit = 256;
- char* event_trace_file;
- char* log_dir; /* -l or config log_dir */
+ std::string log_dir;
//------------------------------------------------------
// daq stuff
- char* daq_type; /* --daq or config daq */
- char* daq_mode; /* --daq-mode or config daq_mode */
- void* daq_vars; /* --daq-var or config daq_var */
- void* daq_dirs; /* --daq-dir or config daq_dir */
+ std::string daq_type;
+ std::string daq_mode;
+
+ void* daq_vars = nullptr;
+ void* daq_dirs = nullptr;
//------------------------------------------------------
// detection module stuff
- long int pcre_match_limit;
- long int pcre_match_limit_recursion;
- int pcre_ovector_size; // computed from rules
+ // FIXIT-L pcre_match_limit* are interdependent
+ // somehow a packet thread needs a much lower setting
+ long int pcre_match_limit = 1500;
+ long int pcre_match_limit_recursion = 1500;
+ int pcre_ovector_size = 0;
- int asn1_mem;
- int run_flags;
+ int asn1_mem = 0;
+ uint32_t run_flags = 0;
//------------------------------------------------------
// process stuff
- int user_id;
- int group_id;
- int dirty_pig;
+ // user_id and group_id should be initialized to -1 by default, because
+ // chown() use this later, -1 means no change to user_id/group_id
+ int user_id = -1;
+ int group_id = -1;
- char* chroot_dir; /* -t or config chroot */
+ int dirty_pig = 0;
- char* plugin_path;
- char* script_path;
+ std::string chroot_dir; /* -t or config chroot */
+ std::string plugin_path;
+ std::string script_path;
- mode_t file_mask;
+ mode_t file_mask = 0;
//------------------------------------------------------
// decode module stuff
- uint8_t mpls_payload_type;
- long int mpls_stack_depth;
+ uint8_t mpls_payload_type = 0;
+ long int mpls_stack_depth = 0;
- uint8_t enable_teredo;
- uint8_t enable_esp;
- PortList* gtp_ports;
+ uint8_t enable_teredo = 0;
+ uint8_t enable_esp = 0;
+ PortList* gtp_ports = nullptr;
- uint8_t num_layers;
- uint8_t max_ip6_extensions;
- uint8_t max_ip_layers;
- int pkt_snaplen;
+ uint8_t num_layers = 0;
+ uint8_t max_ip6_extensions = 0;
+ uint8_t max_ip_layers = 0;
+ int pkt_snaplen = -1;
//------------------------------------------------------
// active stuff
- uint8_t respond_attempts;
- uint8_t max_responses;
- uint8_t min_interval;
- char* respond_device;
- uint8_t* eth_dst;
+ uint8_t respond_attempts = 0;
+ uint8_t max_responses = 0;
+ uint8_t min_interval = 0;
+ uint8_t* eth_dst = nullptr;
- char* output;
+ std::string respond_device;
+ std::string output;
//------------------------------------------------------
// attribute tables stuff
- uint32_t max_attribute_hosts;
- uint32_t max_attribute_services_per_host;
- uint32_t max_metadata_services;
+ uint32_t max_attribute_hosts = 0;
+ uint32_t max_attribute_services_per_host = 0;
+ uint32_t max_metadata_services = 0;
//------------------------------------------------------
// packet module stuff
- uint8_t vlan_agnostic;
- uint8_t addressspace_agnostic;
+ uint8_t vlan_agnostic = 0;
+ uint8_t addressspace_agnostic = 0;
- uint64_t pkt_cnt; /* -n */
- uint64_t pkt_skip;
+ uint64_t pkt_cnt = 0; /* -n */
+ uint64_t pkt_skip = 0;
- char* bpf_file; /* -F or config bpf_file */
+ std::string bpf_file; /* -F or config bpf_file */
//------------------------------------------------------
// various modules
- struct FastPatternConfig* fast_pattern_config;
- struct EventQueueConfig* event_queue_config;
+ struct FastPatternConfig* fast_pattern_config = nullptr;
+ struct EventQueueConfig* event_queue_config = nullptr;
- class FileConfig* file_config;
+ class FileConfig* file_config = nullptr;
/* XXX XXX policy specific? */
- struct ThresholdConfig* threshold_config;
- struct RateFilterConfig* rate_filter_config;
+ struct ThresholdConfig* threshold_config = nullptr;
+ struct RateFilterConfig* rate_filter_config = nullptr;
//------------------------------------------------------
// FIXIT-L command line only stuff, add to conf / module
- uint32_t event_log_id; /* -G */
- sfip_t obfuscation_net; // -B
- char* bpf_filter; // --bpf
+ uint32_t event_log_id = 0;
+ sfip_t obfuscation_net;
+ std::string bpf_filter;
//------------------------------------------------------
// FIXIT-L non-module stuff - separate config from derived state?
- char* run_prefix;
- bool id_subdir;
- bool id_zero;
+ std::string run_prefix;
+ bool id_subdir = false;
+ bool id_zero = false;
- bool stdin_rules;
+ bool stdin_rules = false;
- char pid_filename[1024];
- char* orig_log_dir; /* set in case of chroot */
+ std::string pid_filename;
+ std::string orig_log_dir; /* set in case of chroot */
- int thiszone;
+ int thiszone = 0;
- struct RuleState* rule_state_list;
- struct ClassType* classifications;
- struct ReferenceSystemNode* references;
- struct SFGHASH* otn_map;
+ struct RuleState* rule_state_list = nullptr;
+ struct ClassType* classifications = nullptr;
+ struct ReferenceSystemNode* references = nullptr;
+ struct SFGHASH* otn_map = nullptr;
- struct DetectionFilterConfig* detection_filter_config;
+ struct DetectionFilterConfig* detection_filter_config = nullptr;
- struct sf_list** ip_proto_only_lists;
+ struct sf_list** ip_proto_only_lists = nullptr;
uint8_t ip_proto_array[NUM_IP_PROTOS];
- int num_rule_types;
- struct RuleListNode* rule_lists;
+ int num_rule_types = 0;
+ struct RuleListNode* rule_lists = nullptr;
int evalOrder[RULE_TYPE__MAX + 1];
ListHead Alert;
ListHead Drop;
ListHead SDrop;
- struct FrameworkConfig* framework_config;
+ struct FrameworkConfig* framework_config = nullptr;
/* master port list table */
- struct RulePortTables* port_tables;
+ struct RulePortTables* port_tables = nullptr;
/* The port-rule-maps map the src-dst ports to rules for
* udp and tcp, for Ip we map the dst port as the protocol,
* rules may or may not have content. We process the content
* 1st and then the no content rules for udp/tcp and icmp, and
* then we process the ip rules. */
- PORT_RULE_MAP* prmIpRTNX;
- PORT_RULE_MAP* prmTcpRTNX;
- PORT_RULE_MAP* prmUdpRTNX;
- PORT_RULE_MAP* prmIcmpRTNX;
+ PORT_RULE_MAP* prmIpRTNX = nullptr;
+ PORT_RULE_MAP* prmTcpRTNX = nullptr;
+ PORT_RULE_MAP* prmUdpRTNX = nullptr;
+ PORT_RULE_MAP* prmIcmpRTNX = nullptr;
- srmm_table_t* srmmTable; /* srvc rule map master table */
- srmm_table_t* spgmmTable; /* srvc port_group map master table */
- sopg_table_t* sopgTable; /* service-oridnal to port_group table */
+ srmm_table_t* srmmTable = nullptr; /* srvc rule map master table */
+ srmm_table_t* spgmmTable = nullptr; /* srvc port_group map master table */
+ sopg_table_t* sopgTable = nullptr; /* service-oridnal to port_group table */
- SFXHASH* detection_option_hash_table;
- SFXHASH* detection_option_tree_hash_table;
+ SFXHASH* detection_option_hash_table = nullptr;
+ SFXHASH* detection_option_tree_hash_table = nullptr;
- PolicyMap* policy_map;
+ PolicyMap* policy_map = nullptr;
- uint8_t tunnel_mask;
+ uint8_t tunnel_mask = 0;
- char* output_dir;
-
- struct VarNode* var_list;
+ struct VarNode* var_list = nullptr;
//------------------------------------------------------
// deliberately not conditional
// to avoid plugin compatibility issues
- struct ProfileConfig* profile_rules;
- struct ProfileConfig* profile_modules;
+ struct ProfileConfig* profile_rules = nullptr;
+ struct ProfileConfig* profile_modules = nullptr;
- struct ppm_cfg_t* ppm_cfg;
- struct _IntelPmHandles* ipm_handles;
+ struct ppm_cfg_t* ppm_cfg = nullptr;
+ struct _IntelPmHandles* ipm_handles = nullptr;
- unsigned remote_control;
+ unsigned remote_control = 0;
//------------------------------------------------------
- SnortState* state;
- unsigned num_slots;
+ SnortState* state = nullptr;
+ unsigned num_slots = 0;
std::map<const std::string, int>* source_affinity;
- std::vector<int>* thread_affinity;
+ std::vector<int>* thread_affinity = nullptr;
+ //------------------------------------------------------
// policy access
InspectionPolicy* get_inspection_policy()
{ return policy_map->inspection_policy[0]; }
ConfigAlertBeforePass(sc, v.get_string());
else if ( v.is("--bpf") )
- sc->bpf_filter = SnortStrdup(v.get_string());
+ sc->bpf_filter = v.get_string();
else if ( v.is("--c2x") )
c2x(v.get_string());
dump_rule_text(sc, v.get_string());
else if ( v.is("--run-prefix") )
- sc->run_prefix = SnortStrdup(v.get_string());
+ sc->run_prefix = v.get_string();
else if ( v.is("--script-path") )
ConfigScriptPath(sc, v.get_string());
const char* get_instance_file(std::string& file, const char* name)
{
bool sep = false;
- file = snort_conf->log_dir ? snort_conf->log_dir : "./";
+ file = !snort_conf->log_dir.empty() ? snort_conf->log_dir : "./";
if ( file.back() != '/' )
file += '/';
- if ( snort_conf->run_prefix )
+ if ( !snort_conf->run_prefix.empty() )
{
file += snort_conf->run_prefix;
sep = true;
}
}
-static void load_plugins(const char* s)
+static void load_plugins(const std::string& paths)
{
- if ( !s )
- return;
-
- vector<char> buf(s, s+strlen(s)+1);
+ const char* t = paths.c_str();
+ vector<char> buf(t, t+strlen(t)+1);
char* last;
- s = strtok_r(&buf[0], ":", &last);
+ char* s = strtok_r(&buf[0], ":", &last);
while ( s )
{
// framework methods
//-------------------------------------------------------------------------
-void PluginManager::load_plugins(const char* paths)
+void PluginManager::load_plugins(const std::string& paths)
{
// builtins
load_list(codecs);
load_list(loggers);
// plugins
- ::load_plugins(paths);
+ if ( !paths.empty() )
+ ::load_plugins(paths);
// scripts
// FIXIT-L need path to script for --list-plugins
#include "config.h"
#endif
+#include <string>
+
#include "snort_types.h"
#include "framework/base_api.h"
{
public:
// plugin methods
- static void load_plugins(const char* lib_paths);
+ static void load_plugins(const std::string& lib_paths);
static void list_plugins();
static void show_plugins();
static void dump_plugins();
// public methods
//-------------------------------------------------------------------------
-void ScriptManager::load_scripts(const char* s)
+void ScriptManager::load_scripts(const std::string& paths)
{
- if ( !s )
+ if ( paths.empty() )
return;
- vector<char> buf(s, s+strlen(s)+1);
- char* last;
+ const char* t = paths.c_str();
+ vector<char> buf(t, t+strlen(t)+1);
+ char* last, * s;
s = strtok_r(&buf[0], ":", &last);
class ScriptManager
{
public:
- static void load_scripts(const char* paths);
+ static void load_scripts(const std::string& paths);
static void release_scripts();
static const BaseApi** get_plugins();
static std::string* get_chunk(const char* key);
if ( s_enabled && !s_attempts )
s_attempts = 1;
- if ( s_enabled && (!DAQ_CanInject() || sc->respond_device) )
+ if ( s_enabled && (!DAQ_CanInject() || !sc->respond_device.empty()) )
{
- if ( SnortConfig::read_mode() || Active_Open(sc->respond_device) )
+ if ( SnortConfig::read_mode() || Active_Open(sc->respond_device.c_str()) )
{
ParseWarning(WARN_DAQ, "active responses disabled since DAQ "
"can't inject packets.");
DAQ_Mode DAQ_GetMode(const SnortConfig* sc)
{
- if ( sc->daq_mode )
+ if ( sc->daq_mode.size() )
{
int i;
for ( i = 0; i < MAX_DAQ_MODE; i++ )
{
- if ( !strcasecmp(daq_mode_string((DAQ_Mode)i), sc->daq_mode) )
+ if ( !strcasecmp(daq_mode_string((DAQ_Mode)i), sc->daq_mode.c_str()) )
{
if ( SnortConfig::adaptor_inline_mode() && (i != DAQ_MODE_INLINE) )
- FatalError("DAQ '%s' mode incompatible with -Q\n", sc->daq_mode);
+ FatalError("DAQ '%s' mode incompatible with -Q\n", sc->daq_mode.c_str());
return (DAQ_Mode)i;
}
}
- FatalError("Bad DAQ mode '%s'\n", sc->daq_mode);
+ FatalError("Bad DAQ mode '%s'\n", sc->daq_mode.c_str());
}
if ( SnortConfig::adaptor_inline_mode() )
return DAQ_MODE_INLINE;
void DAQ_Init(const SnortConfig* sc)
{
- const char* type = DAQ_DEFAULT;
if ( !loaded )
DAQ_Load(sc);
- if ( sc->daq_type )
- type = sc->daq_type;
+ const char* type = DAQ_DEFAULT;
+
+ if ( sc->daq_type.size() )
+ type = sc->daq_type.c_str();
daq_mod = daq_find_module(type);
if ( !key )
break;
+ while ( isspace(*key) )
+ ++key;
+
val = strchr(key, '=');
if ( val )
cfg.flags |= DAQ_CFG_PROMISC;
}
- DAQ_Config(&cfg);
+ if ( DAQ_Config(&cfg) )
+ return -1;
if ( !DAQ_ValidateInstance() )
FatalError("DAQ configuration incompatible with intended operation.\n");
if ( DAQ_UnprivilegedStart() )
daq_dlt = daq_get_datalink_type(daq_mod, daq_hand);
- DAQ_SetFilter(sc->bpf_filter);
+ DAQ_SetFilter(sc->bpf_filter.c_str());
daq_config_clear_values(&cfg);
memset(&daq_stats, 0, sizeof(daq_stats));
void ConfigChrootDir(SnortConfig* sc, const char* args)
{
- if ((args == NULL) || (sc->chroot_dir != NULL))
+ if ( !args || !sc )
return;
- sc->chroot_dir = SnortStrdup(args);
+ sc->chroot_dir = args;
}
void ConfigCreatePidFile(SnortConfig* sc, const char*)
void ConfigLogDir(SnortConfig* sc, const char* args)
{
- if ((args == NULL) || (sc->log_dir != NULL))
+ if ( !args || !sc )
return;
- sc->log_dir = SnortStrdup(args);
+ sc->log_dir = args;
}
void ConfigDaqType(SnortConfig* sc, const char* args)
if ( !args || !sc )
return;
- if ( sc->daq_type )
- {
- ParseError("setting DAQ to %s but %s already selected.", args, sc->daq_type);
- return;
- }
-
// will be validated later after paths are established
- sc->daq_type = SnortStrdup(args);
+ sc->daq_type = args;
}
void ConfigDaqMode(SnortConfig* sc, const char* args)
{
- if ( !args || !sc || sc->daq_mode )
+ if ( !args || !sc )
return;
// will be validated later when daq is instantiated
- sc->daq_mode = SnortStrdup(args);
+ sc->daq_mode = args;
}
void ConfigDaqVar(SnortConfig* sc, const char* args)
void ConfigPluginPath(SnortConfig* sc, const char* args)
{
if ( sc && args )
- sc->plugin_path = SnortStrdup(args);
+ sc->plugin_path = args;
}
void ConfigScriptPath(SnortConfig* sc, const char* args)
{
if ( sc && args )
- sc->script_path = SnortStrdup(args);
+ sc->script_path = args;
}
void config_syslog(SnortConfig* sc, const char*)
free(rtn);
}
-char* ProcessFileOption(SnortConfig* sc, const char* filespec)
-{
- char* filename = NULL;
-
- if (sc == NULL)
- sc = snort_conf;
-
- if (filespec == NULL)
- {
- ParseAbort(
- "no arguement in this file option, remove extra ':' at the end of the alert option");
- }
-
- /* look for ".." in the string and complain and exit if it is found */
- if (strstr(filespec, "..") != NULL)
- {
- ParseError("file definition contains '..'. Do not do that.");
- }
-
- if (filespec[0] == '/')
- {
- /* absolute filespecs are saved as is */
- filename = SnortStrdup(filespec);
- }
- else
- {
- std::string buf;
-
- /* relative filespec is considered relative to the log directory
- or /var/log if the log directory has not been set
- Make sure this function isn't called before log dir is set */
- if ((sc != NULL) && (sc->log_dir != NULL))
- buf = snort_conf->log_dir;
- else
- buf = DEFAULT_LOG_DIR;
-
- buf += "/";
- buf += filespec;
-
- filename = SnortStrdup(buf.c_str());
- }
-
- DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"ProcessFileOption: %s\n", filename); );
-
- return filename;
-}
-
/****************************************************************************
* Purpose: Adjust the information for a given rule
* relative to the Rule State list
inline uint32_t seq() const
{ return ntohl(th_seq); }
+ inline uint32_t ack() const
+ { return ntohl(th_ack); }
+
inline bool has_options() const
{ return ((th_offx2 & 0xf0) > 0x50); }
inline uint32_t raw_seq() const
{ return th_seq; }
+ inline uint32_t raw_ack() const
+ { return th_ack; }
+
inline uint8_t raw_hlen() const
{ return th_offx2 >> 4; }
static uint32_t xtra_gzip_id;
static uint32_t xtra_jsnorm_id;
-THREAD_LOCAL HISearch hi_js_search[HI_LAST];
-THREAD_LOCAL HISearch hi_html_search[HTML_LAST];
-THREAD_LOCAL HISearch* hi_current_search = NULL;
+HISearch hi_js_search[HI_LAST];
+HISearch hi_html_search[HTML_LAST];
+
+THREAD_LOCAL const HISearch* hi_current_search = NULL;
THREAD_LOCAL HISearchInfo hi_search_info;
THREAD_LOCAL HIStats hi_stats;
extern class SearchTool* hi_javascript_search_mpse;
extern class SearchTool* hi_htmltype_search_mpse;
-extern THREAD_LOCAL HISearch hi_js_search[HI_LAST];
-extern THREAD_LOCAL HISearch hi_html_search[HTML_LAST];
-extern THREAD_LOCAL HISearch* hi_current_search;
+extern HISearch hi_js_search[HI_LAST];
+extern HISearch hi_html_search[HTML_LAST];
+
+extern const THREAD_LOCAL HISearch* hi_current_search;
extern THREAD_LOCAL HISearchInfo hi_search_info;
void ApplyFlowDepth(HTTPINSPECT_CONF*, Packet*, HttpSessionData*, int, int, uint32_t);
void CreatePidFile(pid_t pid)
{
- const char* dir = snort_conf->log_dir ? snort_conf->log_dir : ".";
- SnortSnprintf(snort_conf->pid_filename,
- sizeof(snort_conf->pid_filename), "%s/snort.pid", dir);
+ snort_conf->pid_filename = snort_conf->log_dir;
+ snort_conf->pid_filename += "/snort.pid";
- if (!SnortConfig::no_lock_pid_file())
+ if ( !SnortConfig::no_lock_pid_file() )
{
- char pid_lockfilename[STD_BUF+1];
+ std::string pid_lockfilename = snort_conf->pid_filename;
+ pid_lockfilename += ".lck";
int lock_fd;
/* First, lock the PID file */
- SnortSnprintf(pid_lockfilename, STD_BUF, "%s.lck",
- snort_conf->pid_filename);
- pid_lockfile = fopen(pid_lockfilename, "w");
+ pid_lockfile = fopen(pid_lockfilename.c_str(), "w");
- if (pid_lockfile)
+ if ( pid_lockfile )
{
struct flock lock;
lock_fd = fileno(pid_lockfile);
{
ClosePidFile();
ParseError("Failed to Lock PID File \"%s\" for PID \"%d\"\n",
- snort_conf->pid_filename, (int)pid);
+ snort_conf->pid_filename.c_str(), (int)pid);
return;
}
}
}
/* Okay, were able to lock PID file, now open and write PID */
- pid_file = fopen(snort_conf->pid_filename, "w");
+ pid_file = fopen(snort_conf->pid_filename.c_str(), "w");
if (pid_file)
{
LogMessage("Writing PID \"%d\" to file \"%s\"\n", (int)pid,
- snort_conf->pid_filename);
+ snort_conf->pid_filename.c_str());
fprintf(pid_file, "%d\n", (int)pid);
fflush(pid_file);
}
{
const char* error = get_error(errno);
ErrorMessage("Failed to create pid file %s, Error: %s",
- snort_conf->pid_filename, error);
- snort_conf->pid_filename[0] = 0;
+ snort_conf->pid_filename.c_str(), error);
+ snort_conf->pid_filename.clear();
}
}
return(cp);
}
-/****************************************************************************
- *
- * Function: CheckLogDir()
- *
- * Purpose: CyberPsychotic sez: basically we only check if logdir exist and
- * writable, since it might screw the whole thing in the middle. Any
- * other checks could be performed here as well.
- *
- * Arguments: None.
- *
- * Returns: void function
- *
- ****************************************************************************/
-void CheckLogDir(void)
-{
- struct stat st;
-
- if (snort_conf->log_dir == NULL)
- return;
-
- if (stat(snort_conf->log_dir, &st) == -1)
- ParseError("Stat check on log dir failed: %s.\n", get_error(errno));
-
- else if (!S_ISDIR(st.st_mode) || (access(snort_conf->log_dir, W_OK) == -1))
- {
- ParseError("Can not get write access to logging directory \"%s\". "
- "(directory doesn't exist or permissions are set incorrectly "
- "or it is not a directory at all)\n",
- snort_conf->log_dir);
- }
-}
-
/* Guaranteed to be '\0' terminated even if truncation occurs.
*
* returns SNORT_SNPRINTF_SUCCESS if successful
* @param directory directory to chroot to
* @param logstore ptr to snort_conf->log_dir which must be dynamically allocated
*/
-void SetChroot(char* directory, char** logstore)
+void SetChroot(std::string directory, std::string& logstore)
{
char* absdir;
size_t abslen;
- char* logdir;
-
- if (!directory || !logstore)
- {
- ParseError("Null parameter passed\n");
- return;
- }
- logdir = *logstore;
-
- if (logdir == NULL || *logdir == '\0')
+ if ( logstore.empty() )
{
ParseError("Null log directory\n");
return;
DEBUG_WRAP(DebugMessage(DEBUG_INIT,"SetChroot: %s\n",
CurrentWorkingDir()); );
- logdir = GetAbsolutePath(logdir);
+ const char* logdir = GetAbsolutePath(logstore.c_str());
DEBUG_WRAP(DebugMessage(DEBUG_INIT, "SetChroot: %s\n",
CurrentWorkingDir()));
- logdir = SnortStrdup(logdir);
-
- /* We're going to reset logstore, so free it now */
- free(*logstore);
- *logstore = NULL;
-
/* change to the directory */
- if (chdir(directory) != 0)
+ if (chdir(directory.c_str()) != 0)
{
- ParseError("SetChroot: Can not chdir to \"%s\": %s\n", directory,
+ ParseError("SetChroot: Can not chdir to \"%s\": %s\n", directory.c_str(),
get_error(errno));
- free(logdir);
return;
}
if (absdir == NULL)
{
ParseError("NULL Chroot found\n");
- free(logdir);
return;
}
if (chroot(absdir) < 0)
{
ParseError("Can not chroot to \"%s\": absolute: %s: %s\n",
- directory, absdir, get_error(errno));
- free(logdir);
+ directory.c_str(), absdir, get_error(errno));
return;
}
{
ParseError("Can not chdir to \"/\" after chroot: %s\n",
get_error(errno));
- free(logdir);
return;
}
if (strncmp(absdir, logdir, strlen(absdir)))
{
ParseError("Absdir is not a subset of the logdir");
- free(logdir);
return;
}
if (abslen >= strlen(logdir))
{
- *logstore = SnortStrdup("/");
+ logstore = "/";
}
else
{
- *logstore = SnortStrdup(logdir + abslen);
+ logstore = logdir + abslen;
}
DEBUG_WRAP(DebugMessage(DEBUG_INIT,"new logdir from %s to %s\n",
- logdir, *logstore));
+ logdir, logstore.c_str()));
- LogMessage("Chroot directory = %s\n", directory);
- free(logdir);
+ LogMessage("Chroot directory = %s\n", directory.c_str());
}
/**
/**
* Given a directory name, return a ptr to a static
*/
-char* GetAbsolutePath(char* dir)
+char* GetAbsolutePath(const char* dir)
{
char* savedir, * dirp;
static THREAD_LOCAL char buf[PATH_MAX_UTIL + 1];
#include <sys/syscall.h>
#endif
+#include <string>
+
#include "main/snort_types.h"
#include "log/messages.h"
void ClosePidFile(void);
void SetUidGid(int, int);
void InitGroups(int, int);
-void SetChroot(char*, char**);
+void SetChroot(std::string root_dir, std::string& log_dir);
void InitProtoNames(void);
SO_PUBLIC int SnortSnprintf(char*, size_t, const char*, ...) __attribute__((format (printf, 3,
unsigned long lo, unsigned long hi, unsigned long* value);
char* CurrentWorkingDir(void);
-char* GetAbsolutePath(char* dir);
+char* GetAbsolutePath(const char* dir);
char* StripPrefixDir(char* prefix, char* dir);
void PrintVersion(void);
projects / thirdparty / snort3.git / commitdiff
