+90
+-- added InspectApi.buffers and Inspector::getbuf()
+-- changed http_* rule options to use Inspector::getbuf()
+-- changed luajit rule option to use the cursor
+
89
-- pulled in the latest from tom and josh
# initialization
#--------------------------------------------------------------------------
-AC_INIT([snort], [2.10.089])
+AC_INIT([snort], [2.10.090])
AC_PREREQ([2.68])
AC_CONFIG_SRCDIR([src/main.h])
-- if present, called once when script is loaded
-- here we return bool indicating args ok
function init ()
- args.bt = get_buffer_type(args.buf)
-
- if ( args.bt < 0 ) then
- return 'bad buf'
- end
-
if ( args.pat == nil ) then
return 'missing pat'
end
-- see snort.lua for available buffers
-- buf is a luajit cdata
- local buf = ffi.C.get_buffer(args.bt)
+ local buf = ffi.C.get_cursor()
-- str is a lua string
local str = ffi.string(buf.data, buf.len)
-- export SNORT_LUA_PATH=$install_dir/conf/
---------------------------------------------------------------------------
-require("snort_config") -- for loading
+require('snort_config') -- for loading
-- useful constants
K = 1024
--search_method = 'lowmem_q',
split_any_any = true,
search_optimize = true,
- max_pattern_len = 20
+ max_pattern_len = 20,
+ max_queue_events = 16
}
-- Configure the event queue.
event_queue =
{
- max_queue = 8,
- log = 5,
+ max_queue = 16,
+ log = 8,
order_events = 'content_length'
}
}
-- Configure Perf Profiling for debugging
+--[[
profile =
{
rules =
file = { append = true }
}
}
+--]]
---------------------------------------------------------------------------
-- configure inspectors
post_depth = 65495,
}
-nhttp_inspect =
-{
- test_input = false,
- test_output = false
-}
+nhttp_inspect = { }
---------------------------------------------------------------------------
-- ftp / telnet normalization and anomaly detection
session_timeout = 180,
--require_3whs = -1,
- show_rebuilt_packets = true,
+ show_rebuilt_packets = false,
flush_factor = 0,
overlap_limit = 10,
#alert http any any -> 1.2.3.4 80 ( sid:3; msg:"3"; content:"HTTP"; )
# no ; separated content suboptions
-alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"BLACKLIST URI request for known malicious URI - /inst.php?fff="; flow:to_server,established; content:"/inst.php?fff=", nocase, http_uri; content: "coid=", nocase, http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, reference:url,labs.snort.org/docs/16924.html; classtype:trojan-activity; sid:16924; rev:5;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"BLACKLIST URI request for known malicious URI - /inst.php?fff="; flow:to_server,established; http_uri; content:"/inst.php?fff=", nocase; content: "coid=", nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, reference:url,labs.snort.org/docs/16924.html; classtype:trojan-activity; sid:16924; rev:5;)
# fast_pattern:<offset>,<length>; ->
# fast_pattern:<offset> <length>;
+
+# test pattern = "ABABACD"
+#alert tcp any any -> any any ( sid:100; content:"ABA"; )
+#alert tcp any any -> any any ( sid:200; raw_data; content:"ABA"; )
+#alert tcp any any -> any any ( sid:300; pkt_data; content:"ABA"; )
+#alert tcp any any -> any any ( sid:400; content:"ABA"; content:"C", depth 6; )
+#alert tcp any any -> any any ( sid:401; content:"ABA"; content:"C", depth 5; )
+#alert tcp any any -> any any ( sid:402; content:"ABA"; content:"C", offset 5; )
+#alert tcp any any -> any any ( sid:403; content:"ABA"; content:"C", offset 6; )
+#alert tcp any any -> any any ( sid:404; content:"ABA"; content:"C", offset 5, depth 6; )
+alert tcp any any -> any any ( sid:510; content:"ABA"; content:"C", within 1; )
+alert tcp any any -> any any ( sid:110; pcre:"/ABA/"; )
+alert tcp any any -> any any ( sid:210; raw_data; pcre:"/ABA/"; )
+alert tcp any any -> any any ( sid:310; pkt_data; pcre:"/ABA/"; )
+alert tcp any any -> any any ( sid:410; pcre:"/ABA/"; pcre:"/C/"; )
+alert tcp any any -> any any ( sid:411; pcre:"/ABA/"; pcre:"/AC/R"; )
+alert tcp any any -> any any ( sid:412; pcre:"/ABA/"; pcre:"/AC/"; )
+alert tcp any any -> any any ( sid:414; pcre:"/ABA/"; pcre:"/C/R"; )
]]
network =
#define MAX_URI 8192
-// NOTE - if you change these, you must also change:
-// detection-plugins/ips_pcre.h
-typedef enum
+enum HTTP_BUFFER
{
HTTP_BUFFER_NONE,
- HTTP_BUFFER_URI,
- HTTP_BUFFER_HEADER,
HTTP_BUFFER_CLIENT_BODY,
- HTTP_BUFFER_METHOD,
HTTP_BUFFER_COOKIE,
+ HTTP_BUFFER_HEADER,
+ HTTP_BUFFER_METHOD,
+ HTTP_BUFFER_RAW_COOKIE,
+ HTTP_BUFFER_RAW_HEADER,
+ HTTP_BUFFER_RAW_URI,
HTTP_BUFFER_STAT_CODE,
HTTP_BUFFER_STAT_MSG,
- HTTP_BUFFER_RAW_URI,
- HTTP_BUFFER_RAW_HEADER,
- HTTP_BUFFER_RAW_COOKIE,
+ HTTP_BUFFER_URI,
HTTP_BUFFER_MAX
-} HTTP_BUFFER;
+};
#endif
enum DetectFlagType
"Normal Content",
"HTTP Uri content",
"HTTP Header content",
- "HTTP Client body content",
- "HTTP Method content",
+ "HTTP Client body content"
};
/*
}
free_detection_option_root(&pg->pgNonContentTree);
-
free(pg);
}
#define PRM_GET_FIRST_GROUP_NODE_NC(pg) (pg->pgHeadNC)
#define PRM_GET_NEXT_GROUP_NODE_NC(rn) (rn->rnNext)
-typedef enum _PmType
+enum PmType
{
PM_TYPE__CONTENT = 0,
PM_TYPE__HTTP_URI_CONTENT,
PM_TYPE__HTTP_HEADER_CONTENT,
PM_TYPE__HTTP_CLIENT_BODY_CONTENT,
- PM_TYPE__HTTP_METHOD_CONTENT,
PM_TYPE__MAX
-
-} PmType;
+};
typedef struct _not_rule_node_ {
#include "file_mime_process.h"
#include "file_resume_block.h"
-#include "service_inspectors/http_inspect/hi_main.h" // FIXIT bad dependency
+#include "framework/inspector.h"
#include "detection_util.h"
+#include "service_inspectors/http_inspect/hi_main.h" // FIXIT bad dependency; use inspector::get_buf()
#include "target_based/sftarget_protocol_reference.h"
#include "target_based/sftarget_reader.h"
uint32_t len = 0;
uint32_t type = 0;
uint32_t file_sig;
- const HttpBuffer* hb = GetHttpBuffer(HTTP_BUFFER_STAT_CODE);
+ InspectionBuffer hb;
- /*Not HTTP response, return*/
- if ( !hb )
+ if ( !p->flow || !p->flow->clouseau ||
+ // FIXIT cache id at parse time for runtime use
+ !p->flow->clouseau->get_buf("http_stat_code", p, hb) )
+ {
return 0;
+ }
/*Not partial content, return*/
- if ( (hb->length != 3) || strncmp((const char*)hb->buf, "206", 3) )
+ if ( (hb.len != 3) || strncmp((const char*)hb.data, "206", 3) )
return 0;
/*Use URI as the identifier for file*/
Cursor(Packet*);
Cursor(const Cursor&);
- bool is(const char* s)
+ const char* get_name() const
+ { return name; };
+
+ bool is(const char* s) const
{ return !strcmp(name, s); };
void reset(Packet*);
void set(const char* s, const uint8_t* b, unsigned n)
{ name = s; data = b; sz = n; pos = delta = 0; };
- const uint8_t* buffer()
+ const uint8_t* buffer() const
{ return data; };
- unsigned size()
+ unsigned size() const
{ return sz; };
- const uint8_t* start()
+ const uint8_t* start() const
{ return data + pos; };
- unsigned length()
+ unsigned length() const
{ return sz - pos; };
- unsigned get_pos()
+ unsigned get_pos() const
{ return pos; };
- unsigned get_delta()
+ unsigned get_delta() const
{ return delta; };
bool add_pos(unsigned n)
#include "inspector.h"
#include <assert.h>
+#include <string.h>
//-------------------------------------------------------------------------
// packet handler stuff
return true;
}
+unsigned Inspector::get_buf_id(const char* key)
+{
+ const char** p = api->buffers;
+ unsigned id = 0;
+
+ if ( !p )
+ return 0;
+
+ while ( p[id] && strcmp(key, p[id]) )
+ ++id;
+
+ return p[id] ? id+1 : 0;
+}
+
+bool Inspector::get_buf(const char* key, Packet* p, InspectionBuffer& b)
+{
+ unsigned id = get_buf_id(key);
+
+ if ( !id )
+ return false;
+
+ return get_buf(id, p, b);
+}
+
bool to_server;
};
+struct InspectionBuffer
+{
+ const uint8_t* data;
+ unsigned len;
+};
+
+struct InspectApi;
+
//-------------------------------------------------------------------------
// api for class
//-------------------------------------------------------------------------
void set_service(ServiceId id) { srv_id = id; };
ServiceId get_service() { return srv_id; };
+ // key is listed in api buffers
+ // id-1 is zero based index into buffers array
+ unsigned get_buf_id(const char* key);
+ virtual bool get_buf(const char* key, Packet*, InspectionBuffer&);
+ virtual bool get_buf(unsigned /*id*/, Packet*, InspectionBuffer&)
+ { return false; };
+
// IT_SERVICE only
virtual class StreamSplitter* get_splitter(bool /*to_server*/)
{ return nullptr; };
+ void set_api(const InspectApi* p)
+ { api = p; };
+
public:
static unsigned max_slots;
static THREAD_LOCAL unsigned slot;
Inspector(); // internal init only at this point
private:
+ const InspectApi* api;
unsigned* ref_count;
ServiceId srv_id;
};
InspectorType type;
uint16_t proto_bits;
+ const char** buffers; // null terminated list of exported buffers
const char* service; // nullptr when type != IT_SERVICE
//ServiceTag tags; // null terminated list of tags
ips_flags.cc
ips_fragbits.cc
ips_fragoffset.cc
+ ips_http.cc
ips_icmp_id.cc
ips_icmp_seq.cc
ips_icode.cc
ips_ttl.cc
ips_window.cc
ips_urilen.cc
- ips_urilen.h
)
set (IPS_SOURCES
ips_flags.cc \
ips_fragbits.cc \
ips_fragoffset.cc \
+ips_http.cc \
ips_icmp_id.cc \
ips_icmp_seq.cc \
ips_icode.cc \
ips_session.cc \
ips_tos.cc \
ips_ttl.cc \
-ips_window.cc \
-ips_urilen.cc ips_urilen.h
+ips_urilen.cc \
+ips_window.cc
libips_options_a_SOURCES = \
ips_byte_extract.cc ips_byte_extract.h \
pmd->last_check = (PmdLastCheck*)SnortAlloc(get_instance_max() * sizeof(*pmd->last_check));
}
-static int FastPatterns(OptTreeNode *otn, int list_type)
+static int fast_pattern_count(OptTreeNode *otn, int list_type)
{
OptFpList* fpl = otn ? otn->opt_func : nullptr;
int c = 0;
return c;
}
-static int32_t ParseInt(const char* data, const char* tag)
+static int32_t parse_int(
+ const char* data, const char* tag, int low = -65535, int high = 65535)
{
int32_t value = 0;
char *endptr = NULL;
if (errno == ERANGE)
ParseError("Range problem on '%s' value.", tag);
- if ((value > 65535) || (value < -65535))
- ParseError("'%s' must in -65535:65535", tag);
+ if ((value > high) || (value < low))
+ ParseError("'%s' must in %d:%d", tag, low, high);
return value;
}
-static void ValidateContent(
+static void validate_content(
SnortConfig*, PatternMatchData *pmd, OptTreeNode* otn)
{
if (pmd == NULL)
}
}
- if ( FastPatterns(otn, RULE_OPTION_TYPE_CONTENT) > 1 )
+ if ( fast_pattern_count(otn, RULE_OPTION_TYPE_CONTENT) > 1 )
ParseError("Only one content per rule may be used for fast pattern matching.");
}
idx->shift_stride = make_shift(idx->pattern_buf, idx->pattern_size);
}
-static char *PayloadExtractParameter(char *data, int *result_len)
+static char *extract_parameter(char *data, int *result_len)
{
char *quote_one = NULL, *quote_two = NULL;
char *comma = NULL;
#define BAD_OFFSET (CMF_OFFSET | CMF_DISTANCE | CMF_WITHIN)
#define BAD_DEPTH (CMF_DEPTH | CMF_DISTANCE | CMF_WITHIN)
-static void PayloadSearchOffset(
+static void parse_offset(
PatternMatchData* pmd, char *data, OptTreeNode*)
{
if ( GetCMF(pmd) & BAD_OFFSET && pmd->use_doe )
if (isdigit(data[0]) || data[0] == '-')
{
- pmd->offset = ParseInt(data, "offset");
+ pmd->offset = parse_int(data, "offset");
}
else
{
pmd->offset););
}
-static void PayloadSearchDepth(
+static void parse_depth(
PatternMatchData* pmd, char *data, OptTreeNode*)
{
if ( GetCMF(pmd) & BAD_DEPTH && pmd->use_doe )
if (isdigit(data[0]) || data[0] == '-')
{
- pmd->depth = ParseInt(data, "depth");
+ pmd->depth = parse_int(data, "depth");
/* check to make sure that this the depth allows this rule to fire */
if (pmd->depth < (int)pmd->pattern_size)
pmd->depth););
}
-static void PayloadSearchDistance(
+static void parse_distance(
PatternMatchData* pmd, char *data, OptTreeNode*)
{
if ( GetCMF(pmd) & BAD_DISTANCE && !pmd->use_doe )
if (isdigit(data[0]) || data[0] == '-')
{
- pmd->offset = ParseInt(data, "distance");
+ pmd->offset = parse_int(data, "distance");
}
else
{
pmd->use_doe = 1;
}
-static void PayloadSearchWithin(
+static void parse_within(
PatternMatchData* pmd, char *data, OptTreeNode*)
{
if ( GetCMF(pmd) & BAD_WITHIN && !pmd->use_doe )
if (isdigit(data[0]) || data[0] == '-')
{
- pmd->depth = ParseInt(data, "within");
+ pmd->depth = parse_int(data, "within");
if (pmd->depth < (int)pmd->pattern_size)
ParseError("within (%d) is smaller than size of pattern", pmd->depth);
pmd->use_doe = 1;
}
-static void PayloadSearchNocase(
+static void parse_nocase(
PatternMatchData* pmd, char *data, OptTreeNode*)
{
unsigned int i;
make_precomp(pmd);
}
-static void PayloadSearchFastPattern(
+static void parse_fast_pattern(
PatternMatchData* pmd, char *data, OptTreeNode*)
{
if ( data )
pmd->fp = 1;
}
-static void PayloadSearchFastPatternOnly(
+static void parse_fast_pattern_only(
PatternMatchData* pmd, char *data, OptTreeNode*)
{
if ( data )
pmd->fp_only = 1;
}
-static void PayloadSearchFastPatternOffset(
+static const char* error_str =
+ "fast_pattern_offset + fast_pattern_length must be less "
+ "than or equal to the actual pattern length which is %u.";
+
+static void parse_fast_pattern_offset(
PatternMatchData* pmd, char *data, OptTreeNode*)
{
if (data == NULL)
ParseError("Missing argument to 'fast_pattern_offset' option");
- long offset = ParseInt(data, "fast_pattern_offset");
-
- static const char* error_str =
- "fast_pattern_offset must be non-negative and fast_pattern_offset + "
- "fast_pattern_length must be less than or equal to the actual pattern "
- "length which is %u.";
-
- if ( (offset < 0) || (offset > UINT16_MAX))
- ParseError(error_str, data, pmd->pattern_size);
+ long offset = parse_int(data, "fast_pattern_offset", 0, UINT16_MAX);
if ((int)pmd->pattern_size < (offset + pmd->fp_length))
ParseError(error_str, data, pmd->pattern_size);
pmd->fp = 1;
}
-static void PayloadSearchFastPatternLength(
+static void parse_fast_pattern_length(
PatternMatchData* pmd, char *data, OptTreeNode*)
{
if (data == NULL)
ParseError("Missing argument to 'fast_pattern_length' option");
- long length = ParseInt(data, "fast_pattern_length");
-
- const char* error_str =
- "fast_pattern_length must be positive and fast_pattern_offset + "
- "fast_pattern_length must be less than or equal to the actual pattern "
- "length which is %u.";
-
- if ( (length < 0) || (length > UINT16_MAX))
- ParseError(error_str, data, pmd->pattern_size);
+ long length = parse_int(data, "fast_pattern_length", 0, UINT16_MAX);
if ((int)pmd->pattern_size < (pmd->fp_offset + length))
ParseError(error_str, data, pmd->pattern_size);
data_dup = SnortStrdup(data);
data_end = data_dup + strlen(data_dup);
- opt_data = PayloadExtractParameter(data_dup, &opt_len);
+ opt_data = extract_parameter(data_dup, &opt_len);
content_parse(opt_data, pmd);
update_pmd(pmd);
next_opt = opt_data + opt_len;
break;
opt_len = 0;
- opt_data = PayloadExtractParameter(next_opt, &opt_len);
+ opt_data = extract_parameter(next_opt, &opt_len);
if (!opt_data)
break;
if (!strcasecmp(opts[0], "offset"))
{
- PayloadSearchOffset(pmd, opt1, otn);
+ parse_offset(pmd, opt1, otn);
}
else if (!strcasecmp(opts[0], "depth"))
{
- PayloadSearchDepth(pmd, opt1, otn);
+ parse_depth(pmd, opt1, otn);
}
else if (!strcasecmp(opts[0], "nocase"))
{
- PayloadSearchNocase(pmd, opt1, otn);
+ parse_nocase(pmd, opt1, otn);
}
else if (!strcasecmp(opts[0], "fast_pattern"))
{
- PayloadSearchFastPattern(pmd, opt1, otn);
+ parse_fast_pattern(pmd, opt1, otn);
}
else if (!strcasecmp(opts[0], "fast_pattern_only"))
{
- PayloadSearchFastPatternOnly(pmd, opt1, otn);
+ parse_fast_pattern_only(pmd, opt1, otn);
}
else if (!strcasecmp(opts[0], "fast_pattern_offset"))
{
- PayloadSearchFastPatternOffset(pmd, opt1, otn);
+ parse_fast_pattern_offset(pmd, opt1, otn);
}
else if (!strcasecmp(opts[0], "fast_pattern_length"))
{
- PayloadSearchFastPatternLength(pmd, opt1, otn);
+ parse_fast_pattern_length(pmd, opt1, otn);
}
else if (!strcasecmp(opts[0], "distance"))
{
- PayloadSearchDistance(pmd, opt1, otn);
+ parse_distance(pmd, opt1, otn);
}
else if (!strcasecmp(opts[0], "within"))
{
- PayloadSearchWithin(pmd, opt1, otn);
+ parse_within(pmd, opt1, otn);
}
else
{
}
free(data_dup);
- ValidateContent(sc, pmd, otn);
+ validate_content(sc, pmd, otn);
return new ContentOption(pmd, "content");
}
#include "snort_debug.h"
#include "detection/rules.h"
#include "detection/treenodes.h"
-#include "detection/detection_util.h"
-#include "framework/content_buffer.h"
extern THREAD_LOCAL int lastType;
-#define CHECK_AND_PATTERN_MATCH 1
-#define CHECK_URI_PATTERN_MATCH 2
-
struct PmdLastCheck
{
struct timeval ts;
uint64_t packet_number;
uint32_t rebuild_flag;
- };
+};
-typedef struct _PatternMatchData
+struct PatternMatchData
{
int offset; /* pattern search start offset */
int depth; /* pattern search depth */
applies to negative contents that are not relative */
PmdLastCheck* last_check;
-} PatternMatchData;
+};
-PatternMatchData* content_get_data(void* pv);
+PatternMatchData* content_get_data(void*);
bool content_next(PatternMatchData*);
int PatternMatchAdjustRelativeOffsets(
bool is_fast_pattern_only(OptFpList*);
bool is_unbounded(void*);
-// FIXIT must add same fast_pattern options from content to these
-// rule options:
-static inline bool IsHttpBufFpEligible (HTTP_BUFFER http_buffer)
-{
- switch ( http_buffer )
- {
- case HTTP_BUFFER_URI:
- case HTTP_BUFFER_HEADER:
- case HTTP_BUFFER_CLIENT_BODY:
- return true;
- default:
- break;
- }
- return false;
-}
-
#endif
#include "managers/ips_manager.h"
#include "hash/sfhashfcn.h"
#include "parser/parser.h"
-#include "detection/detection_util.h"
+#include "framework/cursor.h"
using namespace std;
// luajit ffi stuff
//-------------------------------------------------------------------------
-enum BufferType
-{
- BT_PAYLOAD,
- BT_URI
-};
-
struct Buffer
{
- enum BufferType type;
+ const char* type;
const uint8_t* data;
- uint32_t len;
+ unsigned len;
};
extern "C" {
// ensure Lua can link with this
-const Buffer* get_buffer(BufferType);
+const Buffer* get_buffer();
}
static THREAD_LOCAL Packet* packet;
+static THREAD_LOCAL Cursor* cursor;
+static THREAD_LOCAL Buffer buf;
//namespace snort_ffi
//{
-const Buffer* get_buffer(BufferType type)
+const Buffer* get_buffer()
{
- static Buffer buf;
- buf.type = type;
-
- if ( type == BT_PAYLOAD && packet )
- {
- buf.data = packet->data;
- buf.len = packet->dsize;
- return &buf;
- }
- else if ( type != BT_PAYLOAD )
- {
- const HttpBuffer* p = GetHttpBuffer((HTTP_BUFFER)type);
-
- if ( p )
- {
- buf.data = p->buf;
- buf.len = p->length;
- return &buf;
- }
- }
- buf.data = (uint8_t*)"";
- buf.len = 0;
-
+ assert(cursor);
+ buf.type = cursor->get_name();
+ buf.data = cursor->start();
+ buf.len = cursor->length();
return &buf;
}
//};
return true;
}
-int LuaJITOption::eval(Cursor&, Packet* p)
+int LuaJITOption::eval(Cursor& c, Packet* p)
{
packet = p;
+ cursor = &c;
lua_State* L = lua[get_instance_id()];
lua_getglobal(L, opt_eval);
extern const BaseApi* ips_flags;
extern const BaseApi* ips_fragbits;
extern const BaseApi* ips_fragoffset;
+extern const BaseApi* ips_http_uri;
+extern const BaseApi* ips_http_header;
+extern const BaseApi* ips_http_client_body;
+extern const BaseApi* ips_http_method;
+extern const BaseApi* ips_http_cookie;
+extern const BaseApi* ips_http_stat_code;
+extern const BaseApi* ips_http_stat_msg;
+extern const BaseApi* ips_http_raw_uri;
+extern const BaseApi* ips_http_raw_header;
+extern const BaseApi* ips_http_raw_cookie;
extern const BaseApi* ips_icmp_id;
extern const BaseApi* ips_icmp_seq;
extern const BaseApi* ips_icode;
ips_file_data,
ips_flow,
ips_flowbits,
+ ips_http_uri,
+ ips_http_header,
+ ips_http_client_body,
+ ips_http_method,
+ ips_http_cookie,
+ ips_http_stat_code,
+ ips_http_stat_msg,
+ ips_http_raw_uri,
+ ips_http_raw_header,
+ ips_http_raw_cookie,
ips_ip_proto,
ips_pcre,
ips_so,
** USA
*/
-#include "ips_urilen.h"
-
#ifdef HAVE_CONFIG_H
#include "config.h"
#endif
#include "detection/detection_defines.h"
#include "detection_util.h"
#include "framework/ips_option.h"
+#include "framework/inspector.h"
+#include "flow/flow.h"
static const char* s_name = "urilen";
static PreprocStats* uc_get_profile(const char* key)
{
- if ( !strcmp(key, "urilen_check") )
+ if ( !strcmp(key, s_name) )
return &urilenCheckPerfStats;
return nullptr;
#define URILEN_CHECK_LT 3
#define URILEN_CHECK_RG 4
+struct UriLenCheckData
+{
+ uint16_t urilen;
+ uint16_t urilen2;
+ char oper;
+ const char* key;
+
+};
+
class UriLenOption : public IpsOption
{
public:
mix(a,b,c);
- a += data->uri_buf;
+ a += strcmp(data->key, "http_uri");
b += 0;
mix_str(a,b,c,get_name());
if ((left->urilen == right->urilen)
&& (left->urilen2 == right->urilen2)
&& (left->oper == right->oper)
- && (left->uri_buf == right->uri_buf))
+ && (!strcmp(left->key, right->key)) )
{
return true;
}
return false;
}
-int UriLenOption::eval(Cursor&, Packet*)
+int UriLenOption::eval(Cursor&, Packet* p)
{
UriLenCheckData *udata = &config;
int rval = DETECTION_OPTION_NO_MATCH;
- const HttpBuffer* hb = GetHttpBuffer((HTTP_BUFFER)udata->uri_buf);
- PROFILE_VARS;
+ InspectionBuffer hb;
+ PROFILE_VARS;
PREPROC_PROFILE_START(urilenCheckPerfStats);
- if ( !hb )
+ if ( !p->flow || !p->flow->clouseau ||
+ // FIXIT cache id at parse time for runtime use
+ !p->flow->clouseau->get_buf(udata->key, p, hb) )
{
PREPROC_PROFILE_END(urilenCheckPerfStats);
return rval;
switch (udata->oper)
{
case URILEN_CHECK_EQ:
- if (udata->urilen == hb->length)
+ if (udata->urilen == hb.len)
rval = DETECTION_OPTION_MATCH;
break;
case URILEN_CHECK_GT:
- if (udata->urilen < hb->length)
+ if (udata->urilen < hb.len)
rval = DETECTION_OPTION_MATCH;
break;
case URILEN_CHECK_LT:
- if (udata->urilen > hb->length)
+ if (udata->urilen > hb.len)
rval = DETECTION_OPTION_MATCH;
break;
case URILEN_CHECK_RG:
- if ((udata->urilen <= hb->length) && (udata->urilen2 >= hb->length))
+ if ((udata->urilen <= hb.len) && (udata->urilen2 >= hb.len))
rval = DETECTION_OPTION_MATCH;
break;
default:
break;
}
- /* if the test isn't successful, return 0 */
PREPROC_PROFILE_END(urilenCheckPerfStats);
return rval;
}
if (num_toks > 1)
{
if (!strcmp(toks[1], URI_LEN_BUF_NORM))
- ds_ptr->uri_buf = HTTP_BUFFER_URI;
+ ds_ptr->key = "http_uri";
else if (!strcmp(toks[1], URI_LEN_BUF_RAW))
- ds_ptr->uri_buf = HTTP_BUFFER_RAW_URI;
+ ds_ptr->key = "http_raw_uri";
else
ParseError("Invalid 'urilen' argument.");
}
ParseError("Invalid 'urilen' argument.");
}
- ds_ptr->uri_buf = HTTP_BUFFER_RAW_URI;
+ ds_ptr->key = "http_raw_uri";
}
mSplitFree(&toks, num_toks);
static void urilen_ginit(SnortConfig*)
{
#ifdef PERF_PROFILING
- RegisterOtnProfile("urilen_check", &urilenCheckPerfStats, uc_get_profile);
+ RegisterOtnProfile(s_name, &urilenCheckPerfStats, uc_get_profile);
#endif
}
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
- ** Copyright (C) 2005-2013 Sourcefire, Inc.
- **
- ** This program is free software; you can redistribute it and/or modify
- ** it under the terms of the GNU General Public License Version 2 as
- ** published by the Free Software Foundation. You may not use, modify or
- ** distribute this program under any other version of the GNU General
- ** Public License.
- **
- ** This program is distributed in the hope that it will be useful,
- ** but WITHOUT ANY WARRANTY; without even the implied warranty of
- ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- ** GNU General Public License for more details.
- **
- ** You should have received a copy of the GNU General Public License
- ** along with this program; if not, write to the Free Software
- ** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
- */
-
-#ifndef IPS_URILEN_H
-#define IPS_URILEN_H
-
-#include <stdint.h>
-
-typedef struct _UriLenCheckData
-{
- uint16_t urilen;
- uint16_t urilen2;
- char oper;
- int uri_buf;
-
-} UriLenCheckData;
-
-#endif
-
const char* eol = !(++idx % max) ? "\n" : "";
LogMessage(" %18.18s(v%u)%s", s, v, eol);
};
+ void dump(const char* s, const char* t)
+ {
+ LogMessage("%s::%s\n", s, t);
+ };
private:
unsigned max;
unsigned idx;
void Swapper::apply()
{
if ( new_conf )
+ {
snort_conf = new_conf;
set_default_policy();
+ }
if ( new_attribs )
SFAT_SetConfig(new_attribs);
{
Module* mod = ModuleManager::get_module(p.api.base.name);
handler = p.api.ctor(mod);
+ handler->set_api(&p.api);
}
typedef list<PHGlobal*> PHGlobalList;
d.dump(p->api.base.name, p->api.base.version);
}
+void InspectorManager::dump_buffers()
+{
+ Dumper d("Inspection Buffers");
+
+ for ( const auto* p : s_handlers )
+ {
+ const char** b = p->api.buffers;
+
+ while ( b && *b )
+ {
+ d.dump(p->api.base.name, *b);
+ ++b;
+ }
+ }
+}
+
void InspectorManager::release_plugins ()
{
empty_trash();
public:
static void add_plugin(const InspectApi* api);
static void dump_plugins(void);
+ static void dump_buffers(void);
static void release_plugins(void);
static void new_policy(InspectionPolicy*);
ffi = require("ffi")
ffi.cdef[[
-enum BufferType {
- BT_PAYLOAD,
- BT_HTTP_URI,
- BT_HTTP_HEADER,
- BT_HTTP_CLIENT_BODY,
- BT_HTTP_METHOD,
- BT_HTTP_COOKIE,
- BT_HTTP_STAT_CODE,
- BT_HTTP_STAT_MSG,
- BT_HTTP_RAW_URI,
- BT_HTTP_RAW_HEADER,
- BT_HTTP_RAW_COOKIE
-};
-struct Buffer {
- enum BufferType type;
+struct Buffer
+{
+ const char* type;
const uint8_t* data;
- uint32_t len;
+ unsigned len;
};
-const struct Buffer* get_buffer(enum BufferType);
+const Buffer* get_buffer();
]]
-function get_buffer_type(type)
- if ( type ) then
- type = type:lower()
- end
- if ( type == nil or type == 'payload' ) then
- return ffi.C.BT_PAYLOAD
- end
- if ( type == 'http_uri' ) then
- return ffi.C.BT_HTTP_URI
- end
- if ( type == 'http_header' ) then
- return ffi.C.BT_HTTP_HEADER
- end
- if ( type == 'http_client_body' ) then
- return ffi.C.BT_HTTP_CLIENT_BODY
- end
- if ( type == 'http_method' ) then
- return ffi.C.BT_HTTP_METHOD
- end
- if ( type == 'http_cookie' ) then
- return ffi.C.BT_HTTP_COOKIE
- end
- if ( type == 'http_stat_code' ) then
- return ffi.C.BT_HTTP_STAT_CODE
- end
- if ( type == 'http_stat_msg' ) then
- return ffi.C.BT_HTTP_STAT_MSG
- end
- if ( type == 'http_raw_uri' ) then
- return ffi.C.BT_HTTP_RAW_URI
- end
- if ( type == 'http_raw_header' ) then
- return ffi.C.BT_HTTP_RAW_HEADER
- end
- if ( type == 'http_raw_cookie' ) then
- return ffi.C.BT_HTTP_RAW_COOKIE
- end
- return -1
-end
-
},
IT_PROTOCOL,
PROTO_BIT__ARP,
+ nullptr, // buffers
nullptr, // service
as_init,
nullptr, // term
},
IT_PACKET,
PROTO_BITS,
+ nullptr, // buffers
nullptr, // service
no_init,
nullptr, // term
},
IT_PACKET,
PROTO_BIT__ALL,
+ nullptr, // buffers
nullptr, // service
pm_init,
nullptr, // term
},
IT_PROTOCOL,
PROTO_BIT__IP|PROTO_BIT__ICMP|PROTO_BIT__TCP|PROTO_BIT__UDP, // FIXIT dynamic assign
+ nullptr, // buffers
nullptr, // service
sp_init,
nullptr, // term
#include "managers/shell.h"
#include "managers/event_manager.h"
#include "managers/ips_manager.h"
+#include "managers/inspector_manager.h"
#include "managers/module_manager.h"
#include "managers/plugin_manager.h"
#include "packet_io/trough.h"
exit(0);
}
-enum HelpType { HT_CFG, HT_CMD, HT_GID, HT_IPS, HT_MOD };
+enum HelpType { HT_CFG, HT_CMD, HT_GID, HT_IPS, HT_MOD, HT_BUF };
static void show_help(SnortConfig* sc, const char* val, HelpType ht)
{
ModuleManager::show_commands(s_markup, val);
ModuleManager::show_rules(s_markup, val);
break;
+ case HT_BUF:
+ InspectorManager::dump_buffers();
+ break;
}
ModuleManager::term();
PluginManager::release_plugins();
show_help(sc, val, HT_GID);
}
+static void config_help_buffers(SnortConfig* sc, const char* val)
+{
+ show_help(sc, val, HT_BUF);
+}
+
static void config_help_builtin(SnortConfig* sc, const char* val)
{
show_help(sc, val, HT_IPS);
set_main_hook(snort_inspect);
}
-static void config_log_alerts(SnortConfig* sc, const char*)
-{
- sc->output = OUTPUT_LOG;
-}
-
static void config_line_buffer(SnortConfig* sc, const char*)
{
sc->output_flags |= OUTPUT_FLAG__LINE_BUFFER;
{ "O", ConfigObfuscate,
"obfuscate the logged IP addresses" },
- { "P", ConfigPacketSnaplen,
- "<snap> (same as --snaplen)" },
-
{ "Q", config_inline,
"enable inline mode operation" },
{ "S", config_set_var,
"<n=v> set rules file variable n equal to value v" },
- { "s", config_log_alerts,
- "log alert messages to syslog" },
+ { "s", ConfigPacketSnaplen,
+ "<snap> (same as --snaplen)" },
{ "T", config_test_mode,
"test and report on the current Snort configuration" },
{ "help-builtin", config_help_builtin,
"<module prefix> output matching builtin rules" },
+ { "help-buffers", config_help_buffers,
+ "output available inspection buffers" },
+
{ "help-commands", config_help_commands,
"<module prefix> output matching commands" },
"<n> skip 1st n packets", },
{ "snaplen", ConfigPacketSnaplen,
- "<snap> set snaplen of packet (same as -P)", },
+ "<snap> set snaplen of packet (same as -s)", },
{ "treat-drop-as-alert", ConfigTreatDropAsAlert,
"converts drop, sdrop, and reject rules into alert rules during startup" },
},
IT_PROTOCOL,
PROTO_BIT__UDP,
+ nullptr, // buffers
nullptr, // service
bo_init,
nullptr, // term
//IT_SESSION, // FIXIT should be service only
IT_SERVICE,
PROTO_BIT__TCP,
+ nullptr, // buffers
"ftp", // FIXIT add ftp-data inspector
fs_init,
nullptr, // term
},
IT_SERVICE,
PROTO_BIT__TCP,
+ nullptr, // buffers
"telnet",
tn_init,
nullptr, // term
set (FILE_LIST
http_inspect.cc
- http_inspect.h
hi_main.cc
hi_main.h
hi_ad.cc
hi_cmd_lookup.cc
hi_cmd_lookup.h
hi_include.h
- hi_ips_options.cc
hi_mi.cc
hi_mi.h
hi_norm.cc
hi_ui_config.h
hi_ui_iis_unicode_map.cc
hi_ui_iis_unicode_map.h
- hi_uri.h
- hi_urilen_check.h
hi_util.h
hi_util_hbm.cc
hi_util_hbm.h
AUTOMAKE_OPTIONS=foreign no-dependencies
file_list = \
-http_inspect.cc http_inspect.h \
+http_inspect.cc \
hi_main.cc hi_main.h \
hi_ad.cc hi_ad.h \
hi_client.cc hi_client.h \
hi_cmd_lookup.cc hi_cmd_lookup.h \
hi_events.h \
hi_include.h \
-hi_ips_options.cc \
hi_mi.cc hi_mi.h \
hi_module.cc hi_module.h \
hi_norm.cc hi_norm.h \
hi_stateful_inspect.h \
hi_ui_config.cc hi_ui_config.h \
hi_ui_iis_unicode_map.cc hi_ui_iis_unicode_map.h \
-hi_uri.h \
-hi_urilen_check.h \
hi_util.h \
hi_util_hbm.cc hi_util_hbm.h \
hi_util_kmap.cc hi_util_kmap.h \
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-** Copyright (C) 2002-2013 Sourcefire, Inc.
-** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-#ifdef HAVE_CONFIG_H
-#include "config.h"
-#endif
-
-#include <sys/types.h>
-#include <stdlib.h>
-#include <string.h>
-#include <ctype.h>
-
-#include "snort_types.h"
-#include "treenodes.h"
-#include "protocols/packet.h"
-#include "parser.h"
-#include "util.h"
-#include "snort_debug.h"
-#include "snort.h"
-#include "profiler.h"
-#include "fpdetect.h"
-#include "detection/detection_defines.h"
-#include "detection/detection_util.h"
-#include "framework/ips_option.h"
-#include "framework/cursor.h"
-
-//-------------------------------------------------------------------------
-// api methods
-//-------------------------------------------------------------------------
-
-static const char* s_name = "http_ips";
-
-#ifdef PERF_PROFILING
-static THREAD_LOCAL PreprocStats httpIpsPerfStats;
-
-static PreprocStats* hi_ips_get_profile(const char* key)
-{
- if ( !strcmp(key, s_name) )
- return &httpIpsPerfStats;
-
- return nullptr;
-}
-#endif
-
-static void hi_ips_dtor(IpsOption* p)
-{
- delete p;
-}
-
-static void hi_ips_ginit(SnortConfig*)
-{
-#ifdef PERF_PROFILING
- RegisterOtnProfile(s_name, &httpIpsPerfStats, hi_ips_get_profile);
-#endif
-}
-
-//-------------------------------------------------------------------------
-// generic buffer stuffer
-//-------------------------------------------------------------------------
-
-class HttpIpsOption : public IpsOption
-{
-public:
- HttpIpsOption(const char* s, HTTP_BUFFER b) : IpsOption(s)
- { key = s; type = b; };
-
- int eval(Cursor&, Packet*);
-private:
- const char* key;
- HTTP_BUFFER type;
-};
-
-int HttpIpsOption::eval(Cursor& c, Packet*)
-{
- PROFILE_VARS;
- PREPROC_PROFILE_START(httpIpsPerfStats);
-
- int rval;
- const HttpBuffer* hb = GetHttpBuffer(type);
-
- if ( !hb )
- rval = DETECTION_OPTION_MATCH;
- else
- {
- c.set(key, hb->buf, hb->length);
- rval = DETECTION_OPTION_MATCH;
- }
-
- PREPROC_PROFILE_END(httpIpsPerfStats);
- return rval;
-}
-
-//-------------------------------------------------------------------------
-// http_uri
-//-------------------------------------------------------------------------
-
-static IpsOption* http_uri_ctor(
- SnortConfig*, char* data, OptTreeNode*)
-{
- if (!IsEmptyStr(data))
- ParseError("%s takes no arguments", "http_uri");
-
- return new HttpIpsOption("http_uri", HTTP_BUFFER_URI);
-}
-
-static const IpsApi http_uri_api =
-{
- {
- PT_IPS_OPTION,
- "http_uri",
- IPSAPI_PLUGIN_V0,
- 0,
- nullptr,
- nullptr
- },
- OPT_TYPE_DETECTION,
- 1, PROTO_BIT__TCP,
- hi_ips_ginit,
- nullptr,
- nullptr,
- nullptr,
- http_uri_ctor,
- hi_ips_dtor,
- nullptr
-};
-
-//-------------------------------------------------------------------------
-// http_header
-//-------------------------------------------------------------------------
-
-static IpsOption* http_header_ctor(
- SnortConfig*, char* data, OptTreeNode*)
-{
- if (!IsEmptyStr(data))
- ParseError("%s takes no arguments", "http_header");
-
- return new HttpIpsOption("http_header", HTTP_BUFFER_HEADER);
-}
-
-static const IpsApi http_header_api =
-{
- {
- PT_IPS_OPTION,
- "http_header",
- IPSAPI_PLUGIN_V0,
- 0,
- nullptr,
- nullptr
- },
- OPT_TYPE_DETECTION,
- 1, PROTO_BIT__TCP,
- hi_ips_ginit,
- nullptr,
- nullptr,
- nullptr,
- http_header_ctor,
- hi_ips_dtor,
- nullptr
-};
-
-//-------------------------------------------------------------------------
-// http_client_body
-//-------------------------------------------------------------------------
-
-static IpsOption* http_client_body_ctor(
- SnortConfig*, char* data, OptTreeNode*)
-{
- if (!IsEmptyStr(data))
- ParseError("%s takes no arguments", "http_client_body");
-
- return new HttpIpsOption("http_client_body", HTTP_BUFFER_CLIENT_BODY);
-}
-
-static const IpsApi http_client_body_api =
-{
- {
- PT_IPS_OPTION,
- "http_client_body",
- IPSAPI_PLUGIN_V0,
- 0,
- nullptr,
- nullptr
- },
- OPT_TYPE_DETECTION,
- 1, PROTO_BIT__TCP,
- hi_ips_ginit,
- nullptr,
- nullptr,
- nullptr,
- http_client_body_ctor,
- hi_ips_dtor,
- nullptr
-};
-
-//-------------------------------------------------------------------------
-// http_method
-//-------------------------------------------------------------------------
-
-static IpsOption* http_method_ctor(
- SnortConfig*, char* data, OptTreeNode*)
-{
- if (!IsEmptyStr(data))
- ParseError("%s takes no arguments", "http_method");
-
- return new HttpIpsOption("http_method", HTTP_BUFFER_METHOD);
-}
-
-static const IpsApi http_method_api =
-{
- {
- PT_IPS_OPTION,
- "http_method",
- IPSAPI_PLUGIN_V0,
- 0,
- nullptr,
- nullptr
- },
- OPT_TYPE_DETECTION,
- 1, PROTO_BIT__TCP,
- hi_ips_ginit,
- nullptr,
- nullptr,
- nullptr,
- http_method_ctor,
- hi_ips_dtor,
- nullptr
-};
-
-//-------------------------------------------------------------------------
-// http_cookie
-//-------------------------------------------------------------------------
-
-static IpsOption* http_cookie_ctor(
- SnortConfig*, char* data, OptTreeNode*)
-{
- if (!IsEmptyStr(data))
- ParseError("%s takes no arguments", "http_cookie");
-
- return new HttpIpsOption("http_cookie", HTTP_BUFFER_COOKIE);
-}
-
-static const IpsApi http_cookie_api =
-{
- {
- PT_IPS_OPTION,
- "http_cookie",
- IPSAPI_PLUGIN_V0,
- 0,
- nullptr,
- nullptr
- },
- OPT_TYPE_DETECTION,
- 1, PROTO_BIT__TCP,
- hi_ips_ginit,
- nullptr,
- nullptr,
- nullptr,
- http_cookie_ctor,
- hi_ips_dtor,
- nullptr
-};
-
-//-------------------------------------------------------------------------
-// http_stat_code
-//-------------------------------------------------------------------------
-
-static IpsOption* http_stat_code_ctor(
- SnortConfig*, char* data, OptTreeNode*)
-{
- if (!IsEmptyStr(data))
- ParseError("%s takes no arguments", "http_stat_code");
-
- return new HttpIpsOption("http_stat_code", HTTP_BUFFER_STAT_CODE);
-}
-
-static const IpsApi http_stat_code_api =
-{
- {
- PT_IPS_OPTION,
- "http_stat_code",
- IPSAPI_PLUGIN_V0,
- 0,
- nullptr,
- nullptr
- },
- OPT_TYPE_DETECTION,
- 1, PROTO_BIT__TCP,
- hi_ips_ginit,
- nullptr,
- nullptr,
- nullptr,
- http_stat_code_ctor,
- hi_ips_dtor,
- nullptr
-};
-
-//-------------------------------------------------------------------------
-// http_stat_msg
-//-------------------------------------------------------------------------
-
-static IpsOption* http_stat_msg_ctor(
- SnortConfig*, char* data, OptTreeNode*)
-{
- if (!IsEmptyStr(data))
- ParseError("%s takes no arguments", "http_stat_msg");
-
- return new HttpIpsOption("http_stat_msg", HTTP_BUFFER_STAT_MSG);
-}
-
-static const IpsApi http_stat_msg_api =
-{
- {
- PT_IPS_OPTION,
- "http_stat_msg",
- IPSAPI_PLUGIN_V0,
- 0,
- nullptr,
- nullptr
- },
- OPT_TYPE_DETECTION,
- 1, PROTO_BIT__TCP,
- hi_ips_ginit,
- nullptr,
- nullptr,
- nullptr,
- http_stat_msg_ctor,
- hi_ips_dtor,
- nullptr
-};
-
-//-------------------------------------------------------------------------
-// http_raw_uri
-//-------------------------------------------------------------------------
-
-static IpsOption* http_raw_uri_ctor(
- SnortConfig*, char* data, OptTreeNode*)
-{
- if (!IsEmptyStr(data))
- ParseError("%s takes no arguments", "http_raw_uri");
-
- return new HttpIpsOption("http_raw_uri", HTTP_BUFFER_RAW_URI);
-}
-
-static const IpsApi http_raw_uri_api =
-{
- {
- PT_IPS_OPTION,
- "http_raw_uri",
- IPSAPI_PLUGIN_V0,
- 0,
- nullptr,
- nullptr
- },
- OPT_TYPE_DETECTION,
- 1, PROTO_BIT__TCP,
- hi_ips_ginit,
- nullptr,
- nullptr,
- nullptr,
- http_raw_uri_ctor,
- hi_ips_dtor,
- nullptr
-};
-
-//-------------------------------------------------------------------------
-// http_raw_header
-//-------------------------------------------------------------------------
-
-static IpsOption* http_raw_header_ctor(
- SnortConfig*, char* data, OptTreeNode*)
-{
- if (!IsEmptyStr(data))
- ParseError("%s takes no arguments", "http_raw_header");
-
- return new HttpIpsOption("http_raw_header", HTTP_BUFFER_RAW_HEADER);
-}
-
-static const IpsApi http_raw_header_api =
-{
- {
- PT_IPS_OPTION,
- "http_raw_header",
- IPSAPI_PLUGIN_V0,
- 0,
- nullptr,
- nullptr
- },
- OPT_TYPE_DETECTION,
- 1, PROTO_BIT__TCP,
- hi_ips_ginit,
- nullptr,
- nullptr,
- nullptr,
- http_raw_header_ctor,
- hi_ips_dtor,
- nullptr
-};
-
-//-------------------------------------------------------------------------
-// http_raw_cookie
-//-------------------------------------------------------------------------
-
-static IpsOption* http_raw_cookie_ctor(
- SnortConfig*, char* data, OptTreeNode*)
-{
- if (!IsEmptyStr(data))
- ParseError("%s takes no arguments", "http_raw_cookie");
-
- return new HttpIpsOption("http_raw_cookie", HTTP_BUFFER_RAW_COOKIE);
-}
-
-static const IpsApi http_raw_cookie_api =
-{
- {
- PT_IPS_OPTION,
- "http_raw_cookie",
- IPSAPI_PLUGIN_V0,
- 0,
- nullptr,
- nullptr
- },
- OPT_TYPE_DETECTION,
- 1, PROTO_BIT__TCP,
- hi_ips_ginit,
- nullptr,
- nullptr,
- nullptr,
- http_raw_cookie_ctor,
- hi_ips_dtor,
- nullptr
-};
-
-//-------------------------------------------------------------------------
-// plugins
-//-------------------------------------------------------------------------
-
-#ifdef BUILDING_SO
-SO_PUBLIC const BaseApi* snort_plugins[] =
-{
- &http_uri_api.base,
- &http_header_api.base,
- &http_client_body_api.base,
- &http_method_api.base,
- &http_cookie_api.base,
- &http_stat_code_api.base,
- &http_stat_msg_api.base,
- &http_raw_uri_api.base,
- &http_raw_header_api.base,
- &http_raw_cookie_api.base,
- nullptr
-};
-#else
-const BaseApi* ips_http_uri = &http_uri_api.base;
-const BaseApi* ips_http_header = &http_header_api.base;
-const BaseApi* ips_http_client_body = &http_client_body_api.base;
-const BaseApi* ips_http_method = &http_method_api.base;
-const BaseApi* ips_http_cookie = &http_cookie_api.base;
-const BaseApi* ips_http_stat_code = &http_stat_code_api.base;
-const BaseApi* ips_http_stat_msg = &http_stat_msg_api.base;
-const BaseApi* ips_http_raw_uri = &http_raw_uri_api.base;
-const BaseApi* ips_http_raw_header = &http_raw_header_api.base;
-const BaseApi* ips_http_raw_cookie = &http_raw_cookie_api.base;
-#endif
-
file_api->free_mime_session(hsd->mime_ssn);
}
+// FIXIT this should leverage inspector get_buf()
int GetHttpTrueIP(Flow* flow, uint8_t **buf, uint32_t *len, uint32_t *type)
{
HttpsessionData* hsd = get_session_data(flow);
+++ /dev/null
-/****************************************************************************
- *
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
- * Copyright (C) 2005-2013 Sourcefire, Inc.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License Version 2 as
- * published by the Free Software Foundation. You may not use, modify or
- * distribute this program under any other version of the GNU General
- * Public License.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
- *
- ****************************************************************************/
-
-#ifndef HI_URI_H
-#define HI_URI_H
-
-#ifdef HAVE_CONFIG_H
-#include <config.h>
-#endif
-/**
-** This structure holds pointers to the different sections of an HTTP
-** request. We need to track where whitespace begins and ends, so we
-** can evaluate the placement of the URI correctly.
-**
-** For example,
-**
-** GET / HTTP/1.0
-** ^ ^
-** start end
-**
-** The end space pointers are set to NULL if there is space until the end
-** of the buffer.
-*/
-typedef struct s_URI_PTR
-{
- const u_char *uri; /* the beginning of the URI */
- const u_char *uri_end; /* the end of the URI */
- const u_char *norm; /* ptr to first normalization occurence */
- const u_char *ident; /* ptr to beginning of the HTTP identifier */
- const u_char *first_sp_start; /* beginning of first space delimiter */
- const u_char *first_sp_end; /* end of first space delimiter */
- const u_char *second_sp_start; /* beginning of second space delimiter */
- const u_char *second_sp_end; /* end of second space delimiter */
- const u_char *param; /* '?' (beginning of parameter field) */
- const u_char *delimiter; /* HTTP URI delimiter (\r\n\) */
- const u_char *last_dir; /* ptr to last dir, so we catch long dirs */
- const u_char *proxy; /* ptr to the absolute URI */
-} URI_PTR;
-
-#define URI_END 1
-#define NO_URI -1
-
-#endif /* HI_URI_H */
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-** Copyright (C) 2005-2013 Sourcefire, Inc.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-/*
- * hi_urilen_check.h: Structure definitions/function prototype(s)
- * for the URI length detection plugin.
- */
-
-/* $Id */
-
-#ifndef HI_URILEN_CHECK_H
-#define HI_URILEN_CHECK_H
-
-#define URILEN_OP_GT (0x1)
-#define URILEN_OP_LT (0x2)
-#define URILEN_OP_EQ (0x3)
-#define URILEN_OP_RANGE (0x4)
-
-/* Structure stored as callback data for use by URILEN
- * detection plugin code.
- */
-typedef struct _UriLenCheckData
-{
- int urilen;
- int urilen2;
- char op;
-} UriLenCheckData;
-
-/* Function prototype(s) */
-extern int UriLenCheckInit( char*, char*, void** );
-extern int UriLenCheckEval( void*, uint8_t**, void* );
-
-#endif /* HI_URILEN_CHECK_H */
{ return new HttpSplitter(c2s); };
void eval(Packet*);
+ bool get_buf(unsigned, Packet*, InspectionBuffer&);
void pinit();
void pterm();
Share::release(global);
}
+bool HttpInspect::get_buf(unsigned id, Packet*, InspectionBuffer& b)
+{
+ const HttpBuffer* h = GetHttpBuffer((HTTP_BUFFER)id);
+
+ if ( !h )
+ return false;
+
+ b.data = h->buf;
+ b.len = h->length;
+ return true;
+}
+
bool HttpInspect::configure (SnortConfig* sc)
{
global = (HttpData*)Share::acquire(GLOBAL_KEYWORD);
//-------------------------------------------------------------------------
+static const char* buffers[] =
+{
+ "http_client_body",
+ "http_cookie",
+ "http_header",
+ "http_method",
+ "http_raw_cookie",
+ "http_raw_header",
+ "http_raw_uri",
+ "http_stat_code",
+ "http_stat_msg",
+ "http_uri",
+ nullptr
+};
+
static const InspectApi hs_api =
{
{
},
IT_SERVICE,
PROTO_BIT__TCP,
+ buffers,
"http",
hs_init,
hs_term,
+++ /dev/null
-/****************************************************************************
- *
- * Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License Version 2 as
- * published by the Free Software Foundation. You may not use, modify or
- * distribute this program under any other version of the GNU General
- * Public License.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
- *
- ****************************************************************************/
-
-#ifndef HTTP_INSPECT_H
-#define HTTP_INSPECT_H
-
-#ifdef HAVE_CONFIG_H
-#include "config.h"
-#endif
-
-struct BaseApi;
-
-extern const BaseApi* ips_http_uri;
-extern const BaseApi* ips_http_header;
-extern const BaseApi* ips_http_client_body;
-extern const BaseApi* ips_http_method;
-extern const BaseApi* ips_http_cookie;
-extern const BaseApi* ips_http_stat_code;
-extern const BaseApi* ips_http_stat_msg;
-extern const BaseApi* ips_http_raw_uri;
-extern const BaseApi* ips_http_raw_header;
-extern const BaseApi* ips_http_raw_cookie;
-
-#endif
-
},
IT_SERVICE,
PROTO_BIT__TCP,
+ nullptr, // buffers
"http",
NHttpApi::nhttp_init,
NHttpApi::nhttp_term,
},
IT_SERVICE,
PROTO_BIT__TCP,
+ nullptr, // buffers
"sunrpc",
rd_init,
nullptr, // term
#include "config.h"
#endif
#include "framework/inspector.h"
-#include "http_inspect/http_inspect.h"
extern const BaseApi* sin_http_global;
extern const BaseApi* sin_http_server;
sin_http_global,
sin_http_server,
- ips_http_uri,
- ips_http_header,
- ips_http_client_body,
- ips_http_method,
- ips_http_cookie,
- ips_http_stat_code,
- ips_http_stat_msg,
- ips_http_raw_uri,
- ips_http_raw_header,
- ips_http_raw_cookie,
-
#ifdef STATIC_INSPECTORS
sin_bo,
sin_ftp_client,
},
IT_STREAM,
PROTO_BIT__IP,
+ nullptr, // buffers
nullptr, // service
base_init,
nullptr, // term
},
IT_STREAM,
PROTO_BIT__ICMP,
+ nullptr, // buffers
nullptr, // service
icmp_init,
nullptr, // term
},
IT_STREAM,
PROTO_BIT__IP,
+ nullptr, // buffers
nullptr, // service
ip_init,
nullptr, // term
},
IT_STREAM,
PROTO_BIT__TCP,
+ nullptr, // buffers
nullptr, // service
tcp_init,
nullptr, // term
},
IT_STREAM,
PROTO_BIT__UDP,
+ nullptr, // buffers
nullptr, // service
udp_init,
nullptr, // term
projects / thirdparty / snort3.git / commitdiff
