118
-- fixed bind action
-- tweaked main loop
+-- added module 1-line help
117
-- added --stdin-rules
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* react_help =
+ "send response to client and terminate session";
+
class ReactModule : public Module
{
public:
- ReactModule() : Module(s_name, react_params) { };
+ ReactModule() : Module(s_name, react_help, react_params) { };
bool begin(const char*, int, SnortConfig*);
bool set(const char*, Value&, SnortConfig*);
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* rej_help =
+ "terminate session with TCP reset or ICMP unreachable";
+
class RejectModule : public Module
{
public:
- RejectModule() : Module(s_name, rej_params) { };
+ RejectModule() : Module(s_name, rej_help, rej_params) { };
bool begin(const char*, int, SnortConfig*);
bool end(const char*, int, SnortConfig*);
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* rep_help =
+ "overwrite packet contents";
+
class ReplaceModule : public Module
{
public:
- ReplaceModule() : Module(s_name, rep_params) { };
+ ReplaceModule() : Module(s_name, rep_help, rep_params) { };
bool set(const char*, Value&, SnortConfig*);
bool begin(const char*, int, SnortConfig*);
bool end(const char*, int, SnortConfig*);
class DecodeModule : public Module
{
public:
- DecodeModule(const char* s) : Module(s)
+ DecodeModule(const char* s, const char* h) : Module(s, h)
{ };
- DecodeModule(const char* s, const Parameter* p, bool is_list = false)
- : Module(s, p, is_list) { };
+ DecodeModule(const char* s, const char* h, const Parameter* p, bool is_list = false)
+ : Module(s, h, p, is_list) { };
unsigned get_gid() const
{ return GID_DECODE; };
{ 0, nullptr }
};
+static const char* s_help =
+ "support for IP authentication header";
+
class AuthModule : public DecodeModule
{
public:
- AuthModule() : DecodeModule(CD_AUTH_NAME) {}
+ AuthModule() : DecodeModule(CD_AUTH_NAME, s_help) {}
const RuleMap* get_rules() const
{ return auth_rules; }
// auth module
//-------------------------------------------------------------------------
-
class AuthCodec : public Codec
{
public:
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* esp_help =
+ "support for encapsulating security payload";
class EspModule : public DecodeModule
{
public:
- EspModule() : DecodeModule(CD_ESP_NAME, esp_params) {}
+ EspModule() : DecodeModule(CD_ESP_NAME, esp_help, esp_params) {}
const RuleMap* get_rules() const
{ return esp_rules; }
{ 0, nullptr }
};
+static const char* gre_help =
+ "support for generic routing encapsulation";
class GreModule : public DecodeModule
{
public:
- GreModule() : DecodeModule(CD_GRE_NAME) {}
+ GreModule() : DecodeModule(CD_GRE_NAME, gre_help) {}
const RuleMap* get_rules() const
{ return gre_rules; }
};
-
-
-
-
class GreCodec : public Codec
{
public:
{ 0, nullptr }
};
+static const char* icmp4_help =
+ "support for internet control message protocol v4";
+
class Icmp4Module : public DecodeModule
{
public:
- Icmp4Module() : DecodeModule(CD_ICMP4_NAME) {}
+ Icmp4Module() : DecodeModule(CD_ICMP4_NAME, icmp4_help) {}
const RuleMap* get_rules() const
{ return icmp4_rules; }
};
-
-
class Icmp4Codec : public Codec{
public:
{ 0, nullptr }
};
+static const char* icmp6_help =
+ "support for internet control message protocol v6";
+
class Icmp6Module : public DecodeModule
{
public:
- Icmp6Module() : DecodeModule(CD_ICMP6_NAME) {}
+ Icmp6Module() : DecodeModule(CD_ICMP6_NAME, icmp6_help) {}
const RuleMap* get_rules() const
{ return icmp6_rules; }
{ 0, nullptr }
};
+static const char* igmp_help =
+ "support for internet group management protocol";
class IgmpModule : public DecodeModule
{
public:
- IgmpModule() : DecodeModule(CD_IGMP_NAME) {}
+ IgmpModule() : DecodeModule(CD_IGMP_NAME, igmp_help) {}
const RuleMap* get_rules() const
{ return igmp_rules; }
{ 0, nullptr }
};
+static const char* ipv4_help =
+ "support for internet protocol v4";
+
class Ipv4Module : public DecodeModule
{
public:
- Ipv4Module() : DecodeModule(CD_IPV4_NAME) {}
+ Ipv4Module() : DecodeModule(CD_IPV4_NAME, ipv4_help) {}
const RuleMap* get_rules() const
{ return ipv4_rules; }
};
-
-
class Ipv4Codec : public Codec
{
public:
{ 0, nullptr }
};
+static const char* ipv6_help =
+ "support for internet protocol v6";
class Ipv6Module : public DecodeModule
{
public:
- Ipv6Module() : DecodeModule(CD_IPV6_NAME) {}
+ Ipv6Module() : DecodeModule(CD_IPV6_NAME, ipv6_help) {}
const RuleMap* get_rules() const
{ return ipv6_rules; }
{ 0, nullptr }
};
+static const char* pgm_help =
+ "support for pragmatic general multicast";
class PgmModule : public DecodeModule
{
public:
- PgmModule() : DecodeModule(CD_PGM_NAME) {}
+ PgmModule() : DecodeModule(CD_PGM_NAME, pgm_help) {}
const RuleMap* get_rules() const
{ return pgm_rules; }
{ 0, nullptr }
};
+static const char* tcp_help =
+ "support for transmission control protocol";
class TcpModule : public DecodeModule
{
public:
- TcpModule() : DecodeModule(CD_TCP_NAME) {}
+ TcpModule() : DecodeModule(CD_TCP_NAME, tcp_help) {}
const RuleMap* get_rules() const
{ return tcp_rules; }
};
-
-
class TcpCodec : public Codec
{
public:
{ 0, nullptr }
};
+static const char* udp_help =
+ "support for user datagram protocol";
+
class UdpModule : public DecodeModule
{
public:
- UdpModule() : DecodeModule(CD_UDP_NAME, udp_params) {}
+ UdpModule() : DecodeModule(CD_UDP_NAME, udp_help, udp_params) {}
const RuleMap* get_rules() const
{ return udp_rules; }
*/
// cd_arp.cc author Josh Rosenbaum <jrosenba@cisco.com>
-
-
-
-
-
#include "framework/codec.h"
#include "codecs/decode_module.h"
#include "codecs/codec_events.h"
{ 0, nullptr }
};
+static const char* arp_help =
+ "support for address resolution protocol";
class ArpModule : public DecodeModule
{
public:
- ArpModule() : DecodeModule(CD_ARP_NAME) {}
+ ArpModule() : DecodeModule(CD_ARP_NAME, arp_help) {}
const RuleMap* get_rules() const
{ return arp_rules; }
{ 0, nullptr }
};
+static const char* eapol_help =
+ "support for extensible authentication protocol over LAN";
+
class EapolModule : public DecodeModule
{
public:
- EapolModule() : DecodeModule(CD_EAPOL_NAME) {}
+ EapolModule() : DecodeModule(CD_EAPOL_NAME, eapol_help) {}
const RuleMap* get_rules() const
{ return eapol_rules; }
{ 0, nullptr }
};
+static const char* erspan2_help =
+ "support for encapsulated remote switched port analyzer - type 2";
+
class Erspan2Module : public DecodeModule
{
public:
- Erspan2Module() : DecodeModule(CD_ERSPAN2_NAME) {}
+ Erspan2Module() : DecodeModule(CD_ERSPAN2_NAME, erspan2_help) {}
const RuleMap* get_rules() const
{ return erspan2_rules; }
{ 0, nullptr }
};
+static const char* erspan3_help =
+ "support for encapsulated remote switched port analyzer - type 3";
+
class Erspan3Module : public DecodeModule
{
public:
- Erspan3Module() : DecodeModule(CD_ERSPAN3_NAME) {}
+ Erspan3Module() : DecodeModule(CD_ERSPAN3_NAME, erspan3_help) {}
const RuleMap* get_rules() const
{ return erspan3_rules; }
{ 0, nullptr }
};
+static const char* mpls_help =
+ "support for multiprotocol label switching";
+
class MplsModule : public DecodeModule
{
public:
- MplsModule() : DecodeModule(CD_MPLS_NAME, mpls_params) {};
+ MplsModule() : DecodeModule(CD_MPLS_NAME, mpls_help, mpls_params) {};
const RuleMap* get_rules() const
{ return mpls_rules; }
{ 0, nullptr }
};
+static const char* pppoe_help =
+ "support for point-to-point protocol over ethernet";
+
class PPPoEModule : public DecodeModule
{
public:
- PPPoEModule() : DecodeModule(CD_PPPOE_NAME) {}
+ PPPoEModule() : DecodeModule(CD_PPPOE_NAME, pppoe_help) {}
const RuleMap* get_rules() const
{ return pppoe_rules; }
{ 0, nullptr }
};
+static const char* vlan_help =
+ "support for virtual local area network";
+
class VlanModule : public DecodeModule
{
public:
- VlanModule() : DecodeModule(CD_VLAN_NAME) {}
+ VlanModule() : DecodeModule(CD_VLAN_NAME, vlan_help) {}
const RuleMap* get_rules() const
{ return vlan_rules; }
{ 0, nullptr }
};
+static const char* gtp_help =
+ "support for general-packet-radio-service tunnelling protocol";
+
class GtpModule : public DecodeModule
{
public:
- GtpModule() : DecodeModule(CD_GTP_NAME) {};
+ GtpModule() : DecodeModule(CD_GTP_NAME, gtp_help) {};
const RuleMap* get_rules() const
{ return gtp_rules; }
{ 0, nullptr }
};
+static const char* eth_help =
+ "support for ethernet protocol";
+
class EthModule : public DecodeModule
{
public:
- EthModule() : DecodeModule(CD_ETH_NAME) {}
+ EthModule() : DecodeModule(CD_ETH_NAME, eth_help) {}
const RuleMap* get_rules() const
{ return eth_rules; }
{ 0, nullptr }
};
+static const char* wlan_help =
+ "support for wireless local area network protocol";
+
class WlanCodecModule : public DecodeModule
{
public:
- WlanCodecModule() : DecodeModule(CD_WLAN_NAME) {}
+ WlanCodecModule() : DecodeModule(CD_WLAN_NAME, wlan_help) {}
const RuleMap* get_rules() const
{ return wlan_rules; }
#define CODEC_NAME "name"
+static const char* name_help =
+ "support for name protocol";
+
// inherit from DecodeModule rather than Module so the GID for
// all codecs are identical. Additionally, all of the SIDS are
// defined in DecodeModule. So, when creating new events, you
class NameModule : public DecodeModule
{
public:
- NameModule();
+ NameModule() : Module("name", name_help) { };
bool set(const char*, Value&, SnortConfig*);
bool begin(const char*, int, SnortConfig*);
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
-void Module::init(const char* s)
+void Module::init(const char* s, const char* h)
{
name = s;
+ help = h;
params = null_params;
list = false;
cmds = nullptr;
num_counts = -1;
}
-Module::Module(const char* s)
-{ init(s); }
+Module::Module(const char* s, const char* h)
+{ init(s, h); }
-Module::Module(const char* s, const Parameter* p, bool is_list)
+Module::Module(const char* s, const char* h, const Parameter* p, bool is_list)
{
- init(s);
+ init(s, h);
params = p;
list = is_list;
}
return params->type;
};
+ const char* get_help() const
+ { return help; };
+
const Parameter* get_parameters() const
{ return params; };
unsigned /*index*/, const char*& /*name*/, const char*& /*parent*/) const
{ return nullptr; };
+ virtual const char* get_defaults() const
+ { return nullptr; };
+
virtual void sum_stats();
virtual void show_stats();
virtual void reset_stats();
protected:
- Module(const char*);
- Module(const char*, const Parameter*, bool is_list = false);
+ Module(const char* name, const char* help);
+ Module(const char* name, const char* help, const Parameter*, bool is_list = false);
private:
friend class ModuleManager;
- void init(const char* s);
+ void init(const char*, const char* = nullptr);
- bool list;
const char* name;
+ const char* help;
+
const Parameter* params;
+ bool list;
+
const Command* cmds;
const RuleMap* rules;
+
std::vector<PegCount> counts;
int num_counts;
};
// module
//-------------------------------------------------------------------------
-static const Parameter ack_params[] =
+static const Parameter s_params[] =
{
{ "~range", Parameter::PT_STRING, nullptr, nullptr,
"check if packet payload size is min<>max | <max | >min" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "rule option to match on TCP ack numbers";
+
class AckModule : public Module
{
public:
- AckModule() : Module(s_name, ack_params) { };
+ AckModule() : Module(s_name, s_help, s_params) { };
bool begin(const char*, int, SnortConfig*);
bool set(const char*, Value&, SnortConfig*);
// module
//-------------------------------------------------------------------------
-static const Parameter asn1_params[] =
+static const Parameter s_params[] =
{
{ BITSTRING_OPT, Parameter::PT_IMPLIED, nullptr, nullptr,
"Detects invalid bitstring encodings that are known to be remotely exploitable." },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "rule option for asn1 detection";
+
class Asn1Module : public Module
{
public:
- Asn1Module() : Module(s_name, asn1_params) { };
+ Asn1Module() : Module(s_name, s_help, s_params) { };
bool begin(const char*, int, SnortConfig*);
bool set(const char*, Value&, SnortConfig*);
// decode module
//-------------------------------------------------------------------------
-static const Parameter decode_params[] =
+static const Parameter s_params[] =
{
{ "bytes", Parameter::PT_INT, "1:", nullptr,
"Number of base64 encoded bytes to decode." },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "rule option to decode base64 data - must be used with base64_data option";
+
class B64DecodeModule : public Module
{
public:
- B64DecodeModule() : Module(s_name, decode_params) { };
+ B64DecodeModule() : Module(s_name, s_help, s_params) { };
bool begin(const char*, int, SnortConfig*);
bool set(const char*, Value&, SnortConfig*);
// module
//-------------------------------------------------------------------------
-static const Parameter len_params[] =
+static const Parameter s_params[] =
{
{ "~range", Parameter::PT_STRING, nullptr, nullptr,
"min<>max | <max | >min" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "rule option to check length of current buffer";
+
class LenModule : public Module
{
public:
- LenModule() : Module(s_name, len_params) { };
+ LenModule() : Module(s_name, s_help, s_params) { };
bool begin(const char*, int, SnortConfig*);
bool set(const char*, Value&, SnortConfig*);
// module
//-------------------------------------------------------------------------
-static const Parameter extract_params[] =
+static const Parameter s_params[] =
{
{ "~count", Parameter::PT_INT, "1:10", nullptr,
"number of bytes to pick up from the buffer" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "rule option to convert data to an integer variable";
+
class ExtractModule : public Module
{
public:
- ExtractModule() : Module(s_name, extract_params) { };
+ ExtractModule() : Module(s_name, s_help, s_params) { };
bool begin(const char*, int, SnortConfig*);
bool end(const char*, int, SnortConfig*);
// module
//-------------------------------------------------------------------------
-static const Parameter jump_params[] =
+static const Parameter s_params[] =
{
{ "~count", Parameter::PT_INT, "1:10", nullptr,
"number of bytes to pick up from the buffer" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "rule option to move the detection cursor";
+
class ByteJumpModule : public Module
{
public:
- ByteJumpModule() : Module(s_name, jump_params) { };
+ ByteJumpModule() : Module(s_name, s_help, s_params) { };
bool begin(const char*, int, SnortConfig*);
bool end(const char*, int, SnortConfig*);
// module
//-------------------------------------------------------------------------
-static const Parameter jump_params[] =
+static const Parameter s_params[] =
{
{ "~count", Parameter::PT_INT, "1:10", nullptr,
"number of bytes to pick up from the buffer" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "rule option to convert data to integer and compare";
+
class ByteTestModule : public Module
{
public:
- ByteTestModule() : Module(s_name, jump_params) { };
+ ByteTestModule() : Module(s_name, s_help, s_params) { };
bool begin(const char*, int, SnortConfig*);
bool end(const char*, int, SnortConfig*);
// module
//-------------------------------------------------------------------------
-static const Parameter classtype_params[] =
+static const Parameter s_params[] =
{
{ "~", Parameter::PT_STRING, nullptr, nullptr,
"classification for this rule" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "general rule option for rule classification";
+
class ClassTypeModule : public Module
{
public:
- ClassTypeModule() : Module(s_name, classtype_params) { };
+ ClassTypeModule() : Module(s_name, s_help, s_params) { };
bool set(const char*, Value&, SnortConfig*);
ClassType* type;
};
// module
//-------------------------------------------------------------------------
-static const Parameter content_params[] =
+static const Parameter s_params[] =
{
{ "~data", Parameter::PT_STRING, nullptr, nullptr,
"data to match" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "payload rule option for basic pattern matching";
+
class ContentModule : public Module
{
public:
- ContentModule() : Module(s_name, content_params)
+ ContentModule() : Module(s_name, s_help, s_params)
{ pmd = nullptr; };
~ContentModule()
// module
//-------------------------------------------------------------------------
-static const Parameter cvs_params[] =
+static const Parameter s_params[] =
{
{ CVS_CONF_INVALID_ENTRY_STR, Parameter::PT_IMPLIED, nullptr, nullptr,
"looks for an invalid Entry string" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "payload rule option for detecting specific attacks";
+
class CvsModule : public Module
{
public:
- CvsModule() : Module(s_name, cvs_params) { };
+ CvsModule() : Module(s_name, s_help, s_params) { };
bool begin(const char*, int, SnortConfig*);
bool set(const char*, Value&, SnortConfig*);
// module
//-------------------------------------------------------------------------
-static const Parameter detection_filter_params[] =
+static const Parameter s_params[] =
{
{ "track", Parameter::PT_ENUM, "by_src | by_dst", nullptr,
"track hits by source or destination IP address" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "rule option to require multiple hits before a rule generates an event";
+
class DetectionFilterModule : public Module
{
public:
- DetectionFilterModule() : Module(s_name, detection_filter_params) { };
+ DetectionFilterModule() : Module(s_name, s_help, s_params) { };
bool set(const char*, Value&, SnortConfig*);
bool begin(const char*, int, SnortConfig*);
// module
//-------------------------------------------------------------------------
-static const Parameter dsize_params[] =
+static const Parameter s_params[] =
{
{ "~range", Parameter::PT_STRING, nullptr, nullptr,
"check if packet payload size is min<>max | <max | >min" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "rule option to test payload size";
+
class DsizeModule : public Module
{
public:
- DsizeModule() : Module(s_name, dsize_params) { };
+ DsizeModule() : Module(s_name, s_help, s_params) { };
bool begin(const char*, int, SnortConfig*);
bool set(const char*, Value&, SnortConfig*);
// module
//-------------------------------------------------------------------------
+static const char* s_help =
+ "rule option to set detection cursor to file data";
+
class FileDataModule : public Module
{
public:
- FileDataModule() : Module(s_name) { };
+ FileDataModule() : Module(s_name, s_help) { };
ProfileStats* get_profile() const
{ return &fileDataPerfStats; };
// module
//-------------------------------------------------------------------------
-static const Parameter flags_params[] =
+static const Parameter s_params[] =
{
{ "~test_flags", Parameter::PT_STRING, nullptr, nullptr,
"these flags are tested" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "rule option to test TCP control flags";
+
class FlagsModule : public Module
{
public:
- FlagsModule() : Module(s_name, flags_params) { };
+ FlagsModule() : Module(s_name, s_help, s_params) { };
bool begin(const char*, int, SnortConfig*);
bool set(const char*, Value&, SnortConfig*);
// module
//-------------------------------------------------------------------------
-static const Parameter flow_params[] =
+static const Parameter s_params[] =
{
{ "to_client", Parameter::PT_IMPLIED, nullptr, nullptr,
"match on server responses" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "rule option to check session properties";
+
class FlowModule : public Module
{
public:
- FlowModule() : Module(s_name, flow_params) { };
+ FlowModule() : Module(s_name, s_help, s_params) { };
bool begin(const char*, int, SnortConfig*);
bool set(const char*, Value&, SnortConfig*);
// module
//-------------------------------------------------------------------------
-static const Parameter flowbits_params[] =
+static const Parameter s_params[] =
{
{ "~command", Parameter::PT_STRING, nullptr, nullptr,
"set|reset|isset|etc." },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "rule option to set and test arbitrary boolean flags";
+
class FlowbitsModule : public Module
{
public:
- FlowbitsModule() : Module(s_name, flowbits_params) { };
+ FlowbitsModule() : Module(s_name, s_help, s_params) { };
bool begin(const char*, int, SnortConfig*);
bool set(const char*, Value&, SnortConfig*);
// module
//-------------------------------------------------------------------------
-static const Parameter fragbits_params[] =
+static const Parameter s_params[] =
{
{ "~flags", Parameter::PT_STRING, nullptr, nullptr,
"these flags are tested" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "rule option to test IP frag flags";
+
class FragBitsModule : public Module
{
public:
- FragBitsModule() : Module(s_name, fragbits_params) { };
+ FragBitsModule() : Module(s_name, s_help, s_params) { };
bool begin(const char*, int, SnortConfig*);
bool set(const char*, Value&, SnortConfig*);
// module
//-------------------------------------------------------------------------
-static const Parameter fragoff_params[] =
+static const Parameter s_params[] =
{
{ "~range", Parameter::PT_STRING, nullptr, nullptr,
"check if packet payload size is min<>max | <max | >min" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "rule option to test IP frag offset";
+
class FragOffsetModule : public Module
{
public:
- FragOffsetModule() : Module(s_name, fragoff_params) { };
+ FragOffsetModule() : Module(s_name, s_help, s_params) { };
bool begin(const char*, int, SnortConfig*);
bool set(const char*, Value&, SnortConfig*);
// module
//-------------------------------------------------------------------------
-static const Parameter gid_params[] =
+static const Parameter s_params[] =
{
{ "~", Parameter::PT_INT, "1:", nullptr,
"generator id" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "rule option specifying rule generator";
+
class GidModule : public Module
{
public:
- GidModule() : Module(s_name, gid_params) { };
+ GidModule() : Module(s_name, s_help, s_params) { };
bool set(const char*, Value&, SnortConfig*);
int gid;
};
class HttpCursorModule : public Module
{
public:
- HttpCursorModule(const char* s, ProfileStats& p) :
- Module(s), ps(p) { };
+ HttpCursorModule(const char* s, const char* h, ProfileStats& p) :
+ Module(s, h), ps(p) { };
ProfileStats* get_profile() const
{ return &ps; };
#undef IPS_OPT
#define IPS_OPT "http_uri"
+static const char* uri_help =
+ "rule option to set the detection cursor to the normalized URI buffer";
+
static THREAD_LOCAL ProfileStats uri_ps;
static Module* uri_mod_ctor()
{
- return new HttpCursorModule(IPS_OPT, uri_ps);
+ return new HttpCursorModule(IPS_OPT, uri_help, uri_ps);
}
static IpsOption* uri_opt_ctor(Module*, OptTreeNode*)
#undef IPS_OPT
#define IPS_OPT "http_client_body"
-static THREAD_LOCAL ProfileStats client_body_ps;
+static const char* cb_help =
+ "rule option to set the detection cursor to the request body";
+
+static THREAD_LOCAL ProfileStats cb_ps;
static Module* client_body_mod_ctor()
{
- return new HttpCursorModule(IPS_OPT, client_body_ps);
+ return new HttpCursorModule(IPS_OPT, cb_help, cb_ps);
}
static IpsOption* client_body_opt_ctor(Module*, OptTreeNode*)
{
- return new HttpIpsOption(IPS_OPT, client_body_ps, CAT_SET_BODY);
+ return new HttpIpsOption(IPS_OPT, cb_ps, CAT_SET_BODY);
}
static const IpsApi client_body_api =
#undef IPS_OPT
#define IPS_OPT "http_method"
-static THREAD_LOCAL ProfileStats method_ps;
+static const char* meth_help =
+ "rule option to set the detection cursor to the HTTP request method";
+
+static THREAD_LOCAL ProfileStats meth_ps;
static Module* method_mod_ctor()
{
- return new HttpCursorModule(IPS_OPT, method_ps);
+ return new HttpCursorModule(IPS_OPT, meth_help, meth_ps);
}
static IpsOption* method_opt_ctor(Module*, OptTreeNode*)
{
- return new HttpIpsOption(IPS_OPT, method_ps);
+ return new HttpIpsOption(IPS_OPT, meth_ps);
}
static const IpsApi method_api =
#undef IPS_OPT
#define IPS_OPT "http_cookie"
+static const char* cookie_help =
+ "rule option to set the detection cursor to the HTTP cookie";
+
static THREAD_LOCAL ProfileStats cookie_ps;
static Module* cookie_mod_ctor()
{
- return new HttpCursorModule(IPS_OPT, cookie_ps);
+ return new HttpCursorModule(IPS_OPT, cookie_help, cookie_ps);
}
static IpsOption* cookie_opt_ctor(Module*, OptTreeNode*)
#undef IPS_OPT
#define IPS_OPT "http_stat_code"
+static const char* stat_code_help =
+ "rule option to set the detection cursor to the HTTP status code";
+
static THREAD_LOCAL ProfileStats stat_code_ps;
static Module* stat_code_mod_ctor()
{
- return new HttpCursorModule(IPS_OPT, stat_code_ps);
+ return new HttpCursorModule(IPS_OPT, stat_code_help, stat_code_ps);
}
static IpsOption* stat_code_opt_ctor(Module*, OptTreeNode*)
#undef IPS_OPT
#define IPS_OPT "http_stat_msg"
+static const char* stat_msg_help =
+ "rule option to set the detection cursor to the HTTP status message";
+
static THREAD_LOCAL ProfileStats stat_msg_ps;
static Module* stat_msg_mod_ctor()
{
- return new HttpCursorModule(IPS_OPT, stat_msg_ps);
+ return new HttpCursorModule(IPS_OPT, stat_msg_help, stat_msg_ps);
}
static IpsOption* stat_msg_opt_ctor(Module*, OptTreeNode*)
#undef IPS_OPT
#define IPS_OPT "http_raw_uri"
+static const char* raw_uri_help =
+ "rule option to set the detection cursor to the unnormalized URI";
+
static THREAD_LOCAL ProfileStats raw_uri_ps;
static Module* raw_uri_mod_ctor()
{
- return new HttpCursorModule(IPS_OPT, raw_uri_ps);
+ return new HttpCursorModule(IPS_OPT, raw_uri_help, raw_uri_ps);
}
static IpsOption* raw_uri_opt_ctor(Module*, OptTreeNode*)
#undef IPS_OPT
#define IPS_OPT "http_raw_header"
+static const char* raw_header_help =
+ "rule option to set the detection cursor to the unnormalized headers";
+
static THREAD_LOCAL ProfileStats raw_header_ps;
static Module* raw_header_mod_ctor()
{
- return new HttpCursorModule(IPS_OPT, raw_header_ps);
+ return new HttpCursorModule(IPS_OPT, raw_header_help, raw_header_ps);
}
static IpsOption* raw_header_opt_ctor(Module*, OptTreeNode*)
#undef IPS_OPT
#define IPS_OPT "http_raw_cookie"
+static const char* raw_cookie_help =
+ "rule option to set the detection cursor to the unnormalized cookie";
+
static THREAD_LOCAL ProfileStats raw_cookie_ps;
static Module* raw_cookie_mod_ctor()
{
- return new HttpCursorModule(IPS_OPT, raw_cookie_ps);
+ return new HttpCursorModule(IPS_OPT, raw_cookie_help, raw_cookie_ps);
}
static IpsOption* raw_cookie_opt_ctor(Module*, OptTreeNode*)
static THREAD_LOCAL ProfileStats httpHeaderPerfStats;
-static const Parameter hh_params[] =
+static const Parameter s_params[] =
{
{ "~name", Parameter::PT_STRING, nullptr, nullptr,
"restrict to given header" },
// module
//-------------------------------------------------------------------------
+static const char* s_help =
+ "rule option to set the detection cursor to the normalized header(s)";
+
class HttpHeaderModule : public Module
{
public:
- HttpHeaderModule() : Module(s_name, hh_params) { };
+ HttpHeaderModule() : Module(s_name, s_help, s_params) { };
bool begin(const char*, int, SnortConfig*);
bool set(const char*, Value&, SnortConfig*);
// module
//-------------------------------------------------------------------------
-static const Parameter icmp_id_params[] =
+static const Parameter s_params[] =
{
{ "~range", Parameter::PT_STRING, nullptr, nullptr,
- "check if packet payload size is min<>max | <max | >min" },
+ "check if icmp id is min<>max | <max | >min" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "rule option to check ICMP ID";
+
class IcmpIdModule : public Module
{
public:
- IcmpIdModule() : Module(s_name, icmp_id_params) { };
+ IcmpIdModule() : Module(s_name, s_help, s_params) { };
bool begin(const char*, int, SnortConfig*);
bool set(const char*, Value&, SnortConfig*);
// module
//-------------------------------------------------------------------------
-static const Parameter icmp_id_params[] =
+static const Parameter s_params[] =
{
{ "~range", Parameter::PT_STRING, nullptr, nullptr,
- "check if packet payload size is min<>max | <max | >min" },
+ "check if icmp sequence number is min<>max | <max | >min" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "rule option to check ICMP sequence number";
+
class IcmpSeqModule : public Module
{
public:
- IcmpSeqModule() : Module(s_name, icmp_id_params) { };
+ IcmpSeqModule() : Module(s_name, s_help, s_params) { };
bool begin(const char*, int, SnortConfig*);
bool set(const char*, Value&, SnortConfig*);
// module
//-------------------------------------------------------------------------
-static const Parameter icmp_id_params[] =
+static const Parameter s_params[] =
{
{ "~range", Parameter::PT_STRING, nullptr, nullptr,
- "check if packet payload size is min<>max | <max | >min" },
+ "check if ICMP code is min<>max | <max | >min" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "rule option to check ICMP code";
+
class IcodeModule : public Module
{
public:
- IcodeModule() : Module(s_name, icmp_id_params) { };
+ IcodeModule() : Module(s_name, s_help, s_params) { };
bool begin(const char*, int, SnortConfig*);
bool set(const char*, Value&, SnortConfig*);
// module
//-------------------------------------------------------------------------
-static const Parameter ip_id_params[] =
+static const Parameter s_params[] =
{
{ "~range", Parameter::PT_STRING, nullptr, nullptr,
- "check if packet payload size is min<>max | <max | >min" },
+ "check if the IP ID is min<>max | <max | >min" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "rule option to check the IP ID field";
+
class IpIdModule : public Module
{
public:
- IpIdModule() : Module(s_name, ip_id_params) { };
+ IpIdModule() : Module(s_name, s_help, s_params) { };
bool begin(const char*, int, SnortConfig*);
bool set(const char*, Value&, SnortConfig*);
// module
//-------------------------------------------------------------------------
-static const Parameter ip_proto_params[] =
+static const Parameter s_params[] =
{
{ "~proto", Parameter::PT_STRING, nullptr, nullptr,
"[!|>|<] name or number" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "rule option to check the IP protocol number";
+
class IpProtoModule : public Module
{
public:
- IpProtoModule() : Module(s_name, ip_proto_params) { };
+ IpProtoModule() : Module(s_name, s_help, s_params) { };
bool begin(const char*, int, SnortConfig*);
bool set(const char*, Value&, SnortConfig*);
static const char* s_opts =
"rr|eol|nop|ts|sec|esec|lsrr|lsrre|ssrr|satid|any";
-static const Parameter ipopt_params[] =
+static const Parameter s_params[] =
{
{ "~opt", Parameter::PT_SELECT, s_opts, nullptr,
"output format" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "rule option to check for IP options";
+
class IpOptModule : public Module
{
public:
- IpOptModule() : Module(s_name, ipopt_params) { };
+ IpOptModule() : Module(s_name, s_help, s_params) { };
bool begin(const char*, int, SnortConfig*);
bool set(const char*, Value&, SnortConfig*);
// module
//-------------------------------------------------------------------------
-static const Parameter isdataat_params[] =
+static const Parameter s_params[] =
{
{ "~length", Parameter::PT_STRING, nullptr, nullptr,
"num | !num" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "rule option to check for the presence of payload data";
+
class IsDataAtModule : public Module
{
public:
- IsDataAtModule() : Module(s_name, isdataat_params) { };
+ IsDataAtModule() : Module(s_name, s_help, s_params) { };
bool begin(const char*, int, SnortConfig*);
bool set(const char*, Value&, SnortConfig*);
// module
//-------------------------------------------------------------------------
-static const Parameter itype_params[] =
+static const Parameter s_params[] =
{
{ "~range", Parameter::PT_STRING, nullptr, nullptr,
- "check if packet payload size is min<>max | <max | >min" },
+ "check if icmp type is min<>max | <max | >min" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "rule option to check ICMP type";
+
class ItypeModule : public Module
{
public:
- ItypeModule() : Module(s_name, itype_params) { };
+ ItypeModule() : Module(s_name, s_help, s_params) { };
bool begin(const char*, int, SnortConfig*);
bool set(const char*, Value&, SnortConfig*);
// module stuff
//-------------------------------------------------------------------------
-static const Parameter luajit_params[] =
+static const Parameter s_params[] =
{
{ "~", Parameter::PT_STRING, nullptr, nullptr,
"luajit arguments" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "rule option for detecting with Lua scripts";
+
class LuaJitModule : public Module
{
public:
- LuaJitModule(const char* name) : Module(name, luajit_params)
+ LuaJitModule(const char* name) : Module(name, s_help, s_params)
{ };
bool begin(const char*, int, SnortConfig*);
// module
//-------------------------------------------------------------------------
-static const Parameter metadata_params[] =
+static const Parameter s_params[] =
{
{ "service", Parameter::PT_STRING, nullptr, nullptr,
"service name" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "rule option for conveying arbitrary name, value data within the rule text";
+
class MetadataModule : public Module
{
public:
- MetadataModule() : Module(s_name, metadata_params)
+ MetadataModule() : Module(s_name, s_help, s_params)
{ snort_config = nullptr; };
bool set(const char*, Value&, SnortConfig*);
// module
//-------------------------------------------------------------------------
-static const Parameter msg_params[] =
+static const Parameter s_params[] =
{
{ "~", Parameter::PT_STRING, nullptr, nullptr,
"message describing rule" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "rule option summarizing rule purpose output with events";
+
class MsgModule : public Module
{
public:
- MsgModule() : Module(s_name, msg_params) { };
+ MsgModule() : Module(s_name, s_help, s_params) { };
bool set(const char*, Value&, SnortConfig*);
std::string msg;
};
// module
//-------------------------------------------------------------------------
-static const Parameter pcre_params[] =
+static const Parameter s_params[] =
{
{ "~regex", Parameter::PT_STRING, nullptr, nullptr,
"Snort regular expression" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "rule option for matching payload data with regex";
+
class PcreModule : public Module
{
public:
- PcreModule() : Module(s_name, pcre_params)
+ PcreModule() : Module(s_name, s_help, s_params)
{ data = nullptr; };
~PcreModule()
// module
//-------------------------------------------------------------------------
+static const char* s_help =
+ "rule option to set the detection cursor to the normalized packet data";
+
class PktDataModule : public Module
{
public:
- PktDataModule() : Module(s_name) { };
+ PktDataModule() : Module(s_name, s_help) { };
ProfileStats* get_profile() const
{ return &pktDataPerfStats; };
// module
//-------------------------------------------------------------------------
-static const Parameter priority_params[] =
+static const Parameter s_params[] =
{
{ "~", Parameter::PT_INT, "1:", nullptr,
"generator id" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "rule option for prioritizing events";
+
class PriorityModule : public Module
{
public:
- PriorityModule() : Module(s_name, priority_params) { };
+ PriorityModule() : Module(s_name, s_help, s_params) { };
bool set(const char*, Value&, SnortConfig*);
int priority;
};
// module
//-------------------------------------------------------------------------
+static const char* s_help =
+ "rule option to set the detection cursor to the raw packet data";
+
class RawDataModule : public Module
{
public:
- RawDataModule() : Module(s_name) { };
+ RawDataModule() : Module(s_name, s_help) { };
ProfileStats* get_profile() const
{ return &rawDataPerfStats; };
// module
//-------------------------------------------------------------------------
-static const Parameter reference_params[] =
+static const Parameter s_params[] =
{
{ "~scheme", Parameter::PT_STRING, nullptr, nullptr,
"reference scheme" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "rule option to indicate relevant attack indentification system";
+
class ReferenceModule : public Module
{
public:
- ReferenceModule() : Module(s_name, reference_params) { };
+ ReferenceModule() : Module(s_name, s_help, s_params) { };
bool set(const char*, Value&, SnortConfig*);
bool begin(const char*, int, SnortConfig*);
// module
//-------------------------------------------------------------------------
-static const Parameter rem_params[] =
+static const Parameter s_params[] =
{
{ "~", Parameter::PT_STRING, nullptr, nullptr,
"comment" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "rule option to convey an arbitrary comment in the rule body";
+
class RemModule : public Module
{
public:
- RemModule() : Module(s_name, rem_params) { };
+ RemModule() : Module(s_name, s_help, s_params) { };
bool set(const char*, Value&, SnortConfig*);
};
// module
//-------------------------------------------------------------------------
-static const Parameter repl_params[] =
+static const Parameter s_params[] =
{
{ "~", Parameter::PT_STRING, nullptr, nullptr,
"byte code to replace with" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "rule option to overwrite payload data; use with rewrite action";
+
class ReplModule : public Module
{
public:
- ReplModule() : Module(s_name, repl_params) { };
+ ReplModule() : Module(s_name, s_help, s_params) { };
bool begin(const char*, int, SnortConfig*);
bool set(const char*, Value&, SnortConfig*);
// module
//-------------------------------------------------------------------------
-static const Parameter rev_params[] =
+static const Parameter s_params[] =
{
{ "~", Parameter::PT_INT, "1:", nullptr,
"revision" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "rule option to indicate current revision of signature";
+
class RevModule : public Module
{
public:
- RevModule() : Module(s_name, rev_params) { };
+ RevModule() : Module(s_name, s_help, s_params) { };
bool set(const char*, Value&, SnortConfig*);
int rev;
};
// module
//-------------------------------------------------------------------------
-static const Parameter rpc_params[] =
+static const Parameter s_params[] =
{
{ "~app", Parameter::PT_STRING, nullptr, nullptr,
"application number" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "rule option to check SUNRPC CALL parameters";
+
class RpcModule : public Module
{
public:
- RpcModule() : Module(s_name, rpc_params) { };
+ RpcModule() : Module(s_name, s_help, s_params) { };
bool begin(const char*, int, SnortConfig*);
bool set(const char*, Value&, SnortConfig*);
// module
//-------------------------------------------------------------------------
-static const Parameter seq_params[] =
+static const Parameter s_params[] =
{
{ "~range", Parameter::PT_STRING, nullptr, nullptr,
"check if packet payload size is min<>max | <max | >min" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "rule option to check TCP sequence number";
+
class SeqModule : public Module
{
public:
- SeqModule() : Module(s_name, seq_params) { };
+ SeqModule() : Module(s_name, s_help, s_params) { };
bool begin(const char*, int, SnortConfig*);
bool set(const char*, Value&, SnortConfig*);
// module
//-------------------------------------------------------------------------
-static const Parameter ssn_params[] =
+static const Parameter s_params[] =
{
{ "~mode", Parameter::PT_ENUM, "printable|binary|all", nullptr,
"output format" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "rule option to check user data from TCP sessions";
+
class SsnModule : public Module
{
public:
- SsnModule() : Module(s_name, ssn_params) { };
+ SsnModule() : Module(s_name, s_help, s_params) { };
bool begin(const char*, int, SnortConfig*);
bool set(const char*, Value&, SnortConfig*);
// module
//-------------------------------------------------------------------------
-static const Parameter sid_params[] =
+static const Parameter s_params[] =
{
{ "~", Parameter::PT_INT, "1:", nullptr,
"signature id" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "rule option to indicate signature number";
+
class SidModule : public Module
{
public:
- SidModule() : Module(s_name, sid_params) { };
+ SidModule() : Module(s_name, s_help, s_params) { };
bool set(const char*, Value&, SnortConfig*);
int sid;
};
// module
//-------------------------------------------------------------------------
-static const Parameter so_params[] =
+static const Parameter s_params[] =
{
{ "~func", Parameter::PT_STRING, nullptr, nullptr,
"name of eval function" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "rule option to call custom eval function";
+
class SoModule : public Module
{
public:
- SoModule() : Module(s_name, so_params) { };
+ SoModule() : Module(s_name, s_help, s_params) { };
bool begin(const char*, int, SnortConfig*);
bool set(const char*, Value&, SnortConfig*);
// module
//-------------------------------------------------------------------------
-static const Parameter soid_params[] =
+static const Parameter s_params[] =
{
{ "~", Parameter::PT_STRING, nullptr, nullptr,
"SO rule ID has <gid>|<sid> format, like 3|12345" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "rule option to specify a shared object rule ID";
+
class SoidModule : public Module
{
public:
- SoidModule() : Module(s_name, soid_params) { };
+ SoidModule() : Module(s_name, s_help, s_params) { };
bool set(const char*, Value&, SnortConfig*);
std::string soid;
};
// module
//-------------------------------------------------------------------------
-static const Parameter tag_params[] =
+static const Parameter s_params[] =
{
{ "~", Parameter::PT_ENUM, "session|host_src|host_dst", nullptr,
"log all packets in session or all packets to or from host" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "rule option to log additional packets";
+
class TagModule : public Module
{
public:
- TagModule() : Module(s_name, tag_params)
+ TagModule() : Module(s_name, s_help, s_params)
{ tag = nullptr; };
bool set(const char*, Value&, SnortConfig*);
// module
//-------------------------------------------------------------------------
-static const Parameter tos_params[] =
+static const Parameter s_params[] =
{
{ "~range", Parameter::PT_STRING, nullptr, nullptr,
"check if packet payload size is min<>max | <max | >min" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "rule option to check type of service field";
+
class TosModule : public Module
{
public:
- TosModule() : Module(s_name, tos_params) { };
+ TosModule() : Module(s_name, s_help, s_params) { };
bool begin(const char*, int, SnortConfig*);
bool set(const char*, Value&, SnortConfig*);
// module
//-------------------------------------------------------------------------
-static const Parameter ttl_params[] =
+static const Parameter s_params[] =
{
{ "~range", Parameter::PT_STRING, nullptr, nullptr,
"check if packet payload size is min<>max | <max | >min" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "rule option to check time to live field";
+
class TtlModule : public Module
{
public:
- TtlModule() : Module(s_name, ttl_params) { };
+ TtlModule() : Module(s_name, s_help, s_params) { };
bool begin(const char*, int, SnortConfig*);
bool set(const char*, Value&, SnortConfig*);
// module
//-------------------------------------------------------------------------
-static const Parameter window[] =
+static const Parameter s_params[] =
{
{ "~range", Parameter::PT_STRING, nullptr, nullptr,
"check if packet payload size is min<>max | <max | >min" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "rule option to check TCP window field";
+
class WindowModule : public Module
{
public:
- WindowModule() : Module(s_name, window) { };
+ WindowModule() : Module(s_name, s_help, s_params) { };
bool begin(const char*, int, SnortConfig*);
bool set(const char*, Value&, SnortConfig*);
static THREAD_LOCAL TextLog* csv_log;
+static const char* s_name = "alert_csv";
+
using namespace std;
//-------------------------------------------------------------------------
static const char* csv_deflt =
"timestamp gid sid rev src_addr src_port dst_addr dst_port";
-static const Parameter csv_params[] =
+static const Parameter s_params[] =
{
// FIXIT-M provide PT_FILE and PT_PATH and enforce no
// path chars in file (outputs file must be in instance dir)
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "output event in csv format";
+
class CsvModule : public Module
{
public:
- CsvModule() : Module("alert_csv", csv_params) { };
+ CsvModule() : Module(s_name, s_help, s_params) { };
bool set(const char*, Value&, SnortConfig*);
bool begin(const char*, int, SnortConfig*);
bool end(const char*, int, SnortConfig*);
{
{
PT_LOGGER,
- "alert_csv",
+ s_name,
LOGAPI_PLUGIN_V0,
0,
mod_ctor,
using namespace std;
+static const char* s_name = "alert_fast";
+
//-------------------------------------------------------------------------
// module stuff
//-------------------------------------------------------------------------
-static const Parameter fast_params[] =
+static const Parameter s_params[] =
{
{ "file", Parameter::PT_STRING, nullptr, "stdout",
"name of alert file" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "output event with brief text format";
+
class FastModule : public Module
{
public:
- FastModule() : Module("alert_fast", fast_params) { };
+ FastModule() : Module(s_name, s_help, s_params) { };
bool set(const char*, Value&, SnortConfig*);
bool begin(const char*, int, SnortConfig*);
bool end(const char*, int, SnortConfig*);
{
{
PT_LOGGER,
- "alert_fast",
+ s_name,
LOGAPI_PLUGIN_V0,
0,
mod_ctor,
using namespace std;
+static const char* s_name = "alert_full";
+
//-------------------------------------------------------------------------
// module stuff
//-------------------------------------------------------------------------
-static const Parameter full_params[] =
+static const Parameter s_params[] =
{
{ "file", Parameter::PT_STRING, nullptr, nullptr,
"name of alert file" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "output event with full packet dump";
+
class FullModule : public Module
{
public:
- FullModule() : Module("alert_full", full_params) { };
+ FullModule() : Module(s_name, s_help, s_params) { };
bool set(const char*, Value&, SnortConfig*);
bool begin(const char*, int, SnortConfig*);
bool end(const char*, int, SnortConfig*);
{
{
PT_LOGGER,
- "alert_full",
+ s_name,
LOGAPI_PLUGIN_V0,
0,
mod_ctor,
// module stuff
//-------------------------------------------------------------------------
-static const Parameter luajit_params[] =
+static const Parameter s_params[] =
{
{ "args", Parameter::PT_STRING, nullptr, nullptr,
"luajit logger arguments" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "output event from custom Lua script";
+
class LuaLogModule : public Module
{
public:
- LuaLogModule(const char* name) : Module(name, luajit_params)
+ LuaLogModule(const char* name) : Module(name, s_help, s_params)
{ };
bool begin(const char*, int, SnortConfig*)
{
{
PT_LOGGER,
- "tbd",
+ "luajit",
LOGAPI_PLUGIN_V0,
0,
mod_ctor,
using namespace std;
typedef vector<RuleId> RuleVector;
+static const char* s_name = "alert_sfsocket";
+
//-------------------------------------------------------------------------
// alert_sfsocket module
//-------------------------------------------------------------------------
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
-static const Parameter sfsocket_params[] =
+static const Parameter s_params[] =
{
{ "file", Parameter::PT_STRING, nullptr, nullptr,
"name of unix socket file" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "output event over socket";
+
class SfSocketModule : public Module
{
public:
- SfSocketModule() : Module("alert_sfsocket", sfsocket_params) { };
+ SfSocketModule() : Module(s_name, s_help, s_params) { };
bool set(const char*, Value&, SnortConfig*);
bool begin(const char*, int, SnortConfig*);
bool end(const char*, int, SnortConfig*);
{
{
PT_LOGGER,
- "alert_sfsocket",
+ s_name,
LOGAPI_PLUGIN_V0,
0,
mod_ctor,
using namespace std;
+static const char* s_name = "alert_syslog";
+
//-------------------------------------------------------------------------
// translation stuff
//-------------------------------------------------------------------------
// module stuff
//-------------------------------------------------------------------------
-static const Parameter syslog_params[] =
+static const Parameter s_params[] =
{
{ "facility", Parameter::PT_ENUM, syslog_facilities, "auth",
"part of priority applied to each message" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "output event to syslog";
+
class SyslogModule : public Module
{
public:
- SyslogModule() : Module("alert_syslog", syslog_params) { };
+ SyslogModule() : Module(s_name, s_help, s_params) { };
bool set(const char*, Value&, SnortConfig*);
bool begin(const char*, int, SnortConfig*);
bool end(const char*, int, SnortConfig*);
{
{
PT_LOGGER,
- "alert_syslog",
+ s_name,
LOGAPI_PLUGIN_V0,
0,
mod_ctor,
using namespace std;
+static const char* s_name = "alert_test";
+
//-------------------------------------------------------------------------
// alert_test module
//-------------------------------------------------------------------------
-static const Parameter test_params[] =
+static const Parameter s_params[] =
{
{ "file", Parameter::PT_STRING, nullptr, "stdout",
"name of tsv alert file or 'stdout'" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "output event in custom tsv format";
+
class TestModule : public Module
{
public:
- TestModule() : Module("alert_test", test_params) { };
+ TestModule() : Module(s_name, s_help, s_params) { };
bool set(const char*, Value&, SnortConfig*);
bool begin(const char*, int, SnortConfig*);
bool end(const char*, int, SnortConfig*);
{
{
PT_LOGGER,
- "alert_test",
+ s_name,
LOGAPI_PLUGIN_V0,
0,
mod_ctor,
static THREAD_LOCAL UnixSock us;
+static const char* s_name = "alert_unixsock";
+
//-------------------------------------------------------------------------
// alert_unixsock module
//-------------------------------------------------------------------------
-static const Parameter unixsock_params[] =
+static const Parameter s_params[] =
{
// FIXIT-L add name param?
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "output event over unix socket";
+
class UnixSockModule : public Module
{
public:
- UnixSockModule() : Module("alert_unixsock", unixsock_params) { };
+ UnixSockModule() : Module(s_name, s_help, s_params) { };
bool set(const char*, Value&, SnortConfig*) { return false; };
};
{
{
PT_LOGGER,
- "alert_unixsock",
+ s_name,
LOGAPI_PLUGIN_V0,
0,
mod_ctor,
static void TcpdumpRollLogFile(LtdConfig*);
+static const char* s_name = "log_tcpdump";
+
//-------------------------------------------------------------------------
// module stuff
//-------------------------------------------------------------------------
-static const Parameter tcpdump_params[] =
+static const Parameter s_params[] =
{
{ "file", Parameter::PT_STRING, nullptr, "snort.pcap",
"name of alert file" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "log packet in pcap format";
+
class TcpdumpModule : public Module
{
public:
- TcpdumpModule() : Module("log_tcpdump", tcpdump_params) { };
+ TcpdumpModule() : Module(s_name, s_help, s_params) { };
bool set(const char*, Value&, SnortConfig*);
bool begin(const char*, int, SnortConfig*);
bool end(const char*, int, SnortConfig*);
pcap = pcap_open_dead(dlt, DAQ_GetSnapLen());
if ( !pcap )
- FatalError("log_tcpdump: can't get pcap context\n");
+ FatalError("%s: can't get pcap context\n", s_name);
context.dumpd = pcap ? pcap_dump_open(pcap, file.c_str()) : NULL;
if(context.dumpd == NULL)
{
- FatalError("log_tcpdump: can't open %s: %s\n",
- file.c_str(), pcap_geterr(pcap));
+ FatalError("%s: can't open %s: %s\n",
+ s_name, file.c_str(), pcap_geterr(pcap));
}
pcap_close(pcap);
}
{
{
PT_LOGGER,
- "log_tcpdump",
+ s_name,
LOGAPI_PLUGIN_V0,
0,
mod_ctor,
using namespace std;
+static const char* s_name = "unified2";
+
/* ------------------ Data structures --------------------------*/
typedef struct _Unified2Config
{
// unified2 module
//-------------------------------------------------------------------------
-static const Parameter u2_params[] =
+static const Parameter s_params[] =
{
{ "file", Parameter::PT_STRING, nullptr, "unified2.log",
"name of alert file" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "ouput event and packet in unified2 format file";
+
class U2Module : public Module
{
public:
- U2Module() : Module("unified2", u2_params) { };
+ U2Module() : Module(s_name, s_help, s_params) { };
bool set(const char*, Value&, SnortConfig*);
bool begin(const char*, int, SnortConfig*);
bool end(const char*, int, SnortConfig*);
{
{
PT_LOGGER,
- "unified2",
+ s_name,
LOGAPI_PLUGIN_V0,
0,
mod_ctor,
enum HelpType {
HT_CFG, HT_CMD, HT_GID, HT_IPS, HT_MOD,
- HT_BUF, HT_LST, HT_PLG, HT_DDR, HT_DBR
+ HT_BUF, HT_LST, HT_PLG, HT_DDR, HT_DBR,
+ HT_SHO
};
static void show_help(SnortConfig* sc, const char* val, HelpType ht)
case HT_DBR:
ModuleManager::dump_rules(val);
break;
+ case HT_SHO:
+ ModuleManager::show_modules();
+ break;
}
ModuleManager::term();
PluginManager::release_plugins();
show_help(sc, val, HT_MOD);
}
+void help_modules(SnortConfig* sc, const char* val)
+{
+ show_help(sc, val, HT_SHO);
+}
+
void list_modules(SnortConfig* sc, const char* val)
{
show_help(sc, val, HT_LST);
void help_buffers(SnortConfig* sc, const char*);
void help_builtin(SnortConfig* sc, const char*);
void help_module(SnortConfig* sc, const char*);
+void help_modules(SnortConfig* sc, const char*);
void help_version(SnortConfig*, const char*);
void list_modules(SnortConfig* sc, const char*);
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* detection_help =
+ "configure general IPS rule processing parameters";
+
class DetectionModule : public Module
{
public:
- DetectionModule() : Module("detection", detection_params) { };
+ DetectionModule() : Module("detection", detection_help, detection_params) { };
bool set(const char*, Value&, SnortConfig*);
};
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* event_queue_help =
+ "configure event queue parameters";
+
class EventQueueModule : public Module
{
public:
- EventQueueModule() : Module("event_queue", event_queue_params) { };
+ EventQueueModule() : Module("event_queue", event_queue_help, event_queue_params) { };
bool set(const char*, Value&, SnortConfig*);
};
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* search_engine_help =
+ "configure fast pattern matcher";
+
class SearchEngineModule : public Module
{
public:
- SearchEngineModule() : Module("search_engine", search_engine_params) { };
+ SearchEngineModule() : Module("search_engine", search_engine_help, search_engine_params) { };
bool set(const char*, Value&, SnortConfig*);
};
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* profile_help =
+ "configure profiling of rules and/or modules";
+
class ProfileModule : public Module
{
public:
- ProfileModule() : Module("profile", profile_params) { };
+ ProfileModule() : Module("profile", profile_help, profile_params) { };
bool set(const char*, Value&, SnortConfig*);
bool begin(const char*, int, SnortConfig*);
};
// FIXIT-L signature.{h,cc} has type and name confused
// the keys here make more sense
+static const char* classifications_help =
+ "define rule categories with priority";
+
static const Parameter classification_params[] =
{
{ "name", Parameter::PT_STRING, nullptr, nullptr,
{
public:
ClassificationsModule() :
- Module("classifications", classification_params, true) { };
+ Module("classifications", classifications_help, classification_params, true) { };
bool set(const char*, Value&, SnortConfig*);
bool begin(const char*, int, SnortConfig*);
//-------------------------------------------------------------------------
// reference module
//-------------------------------------------------------------------------
-// FIXIT-L signature.{h,cc} has type and name confused
-// the keys here make more sense
+
+static const char* reference_help =
+ "define reference systems used in rules";
static const Parameter reference_params[] =
{
{ "name", Parameter::PT_STRING, nullptr, nullptr,
- "name used with classtype rule option" },
+ "name used with reference rule option" },
{ "url", Parameter::PT_STRING, nullptr, nullptr,
"where this reference is defined" },
{
public:
ReferencesModule() :
- Module("references", reference_params, true) { };
+ Module("references", reference_help, reference_params, true) { };
bool set(const char*, Value&, SnortConfig*);
bool begin(const char*, int, SnortConfig*);
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* alerts_help =
+ "configure alerts";
+
class AlertsModule : public Module
{
public:
- AlertsModule() : Module("alerts", alerts_params) { };
+ AlertsModule() : Module("alerts", alerts_help, alerts_params) { };
bool set(const char*, Value&, SnortConfig*);
};
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* output_help =
+ "configure general output parameters";
+
class OutputModule : public Module
{
public:
- OutputModule() : Module("output", output_params) { };
+ OutputModule() : Module("output", output_help, output_params) { };
bool set(const char*, Value&, SnortConfig*);
};
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* active_help =
+ "configure responses";
+
class ActiveModule : public Module
{
public:
- ActiveModule() : Module("active", active_params) { };
+ ActiveModule() : Module("active", active_help, active_params) { };
bool set(const char*, Value&, SnortConfig*);
};
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* packets_help =
+ "configure basic packet handling";
+
class PacketsModule : public Module
{
public:
- PacketsModule() : Module("packets", packets_params) { };
+ PacketsModule() : Module("packets", packets_help, packets_params) { };
bool set(const char*, Value&, SnortConfig*);
};
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* daq_help =
+ "configure packet acquisition interface";
+
class DaqModule : public Module
{
public:
- DaqModule() : Module("daq", daq_params) { };
+ DaqModule() : Module("daq", daq_help, daq_params) { };
bool set(const char*, Value&, SnortConfig*);
};
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+const char* attribute_table_help =
+ "configure hosts loading";
+
class AttributeTableModule : public Module
{
public:
- AttributeTableModule() : Module("attribute_table", attribute_table_params) { };
+ AttributeTableModule() :
+ Module("attribute_table", attribute_table_help, attribute_table_params) { };
bool set(const char*, Value&, SnortConfig*);
};
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* network_help =
+ "configure basic network parameters";
+
class NetworkModule : public Module
{
public:
- NetworkModule() : Module("network", network_params) { };
+ NetworkModule() : Module("network", network_help, network_params) { };
bool set(const char*, Value&, SnortConfig*);
};
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* ips_help =
+ "configure IPS rule processing";
+
class IpsModule : public Module
{
public:
- IpsModule() : Module("ips", ips_params) { };
+ IpsModule() : Module("ips", ips_help, ips_params) { };
bool set(const char*, Value&, SnortConfig*);
};
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* process_help =
+ "configure basic process setup";
+
class ProcessModule : public Module
{
public:
- ProcessModule() : Module("process", process_params) { };
+ ProcessModule() : Module("process", process_help, process_params) { };
bool set(const char*, Value&, SnortConfig*);
};
return true;
}
-//-------------------------------------------------------------------------
-// vars module
-//-------------------------------------------------------------------------
-// FIXIT-L signature.{h,cc} has type and name confused
-// the keys here make more sense
-
-static const Parameter vars_params[] =
-{
- { nullptr, Parameter::PT_STRING, nullptr, nullptr,
- "port, ip, or path variable" },
-
- { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
-};
-
-class VarsModule : public Module
-{
-public:
- VarsModule() :
- Module("vars", vars_params, true) { };
-
- bool set(const char*, Value&, SnortConfig*);
-};
-
-#include <iostream>
-bool VarsModule::set(const char* fqn, Value& v, SnortConfig*)
-{
- cout << fqn << " = " << v.get_name() << endl;
-
- return true;
-}
-
//-------------------------------------------------------------------------
// file_id module
//-------------------------------------------------------------------------
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* file_id_help =
+ "configure file identification";
+
class FileIdModule : public Module
{
public:
- FileIdModule() : Module("file_id", file_id_params) { };
+ FileIdModule() : Module("file_id", file_id_help, file_id_params) { };
bool set(const char*, Value&, SnortConfig*);
};
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* suppress_help =
+ "configure event suppressions";
+
class SuppressModule : public Module
{
public:
- SuppressModule() : Module("suppress", suppress_params, true) { };
+ SuppressModule() : Module("suppress", suppress_help, suppress_params, true) { };
bool set(const char*, Value&, SnortConfig*);
bool begin(const char*, int, SnortConfig*);
bool end(const char*, int, SnortConfig*);
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* event_filter_help =
+ "configure thresholding of events";
+
class EventFilterModule : public Module
{
public:
- EventFilterModule() : Module("event_filter", event_filter_params, true) { };
+ EventFilterModule() :
+ Module("event_filter", event_filter_help, event_filter_params, true) { };
bool set(const char*, Value&, SnortConfig*);
bool begin(const char*, int, SnortConfig*);
bool end(const char*, int, SnortConfig*);
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* rate_filter_help =
+ "configure rate filters (which change rule actions)";
+
class RateFilterModule : public Module
{
public:
- RateFilterModule() : Module("rate_filter", rate_filter_params, true) { };
+ RateFilterModule() : Module("rate_filter", rate_filter_help, rate_filter_params, true) { };
bool set(const char*, Value&, SnortConfig*);
bool begin(const char*, int, SnortConfig*);
bool end(const char*, int, SnortConfig*);
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* rule_state_help =
+ "enable/disable specific IPS rules";
+
class RuleStateModule : public Module
{
public:
- RuleStateModule() : Module("rule_state", rule_state_params) { };
+ RuleStateModule() : Module("rule_state", rule_state_help, rule_state_params) { };
bool set(const char*, Value&, SnortConfig*);
bool begin(const char*, int, SnortConfig*);
bool end(const char*, int, SnortConfig*);
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* hosts_help =
+ "configure hosts";
+
class HostsModule : public Module
{
public:
- HostsModule() : Module("hosts", hosts_params, true) { };
+ HostsModule() : Module("hosts", hosts_help, hosts_params, true) { };
~HostsModule() { assert(!host && !app); };
bool set(const char*, Value&, SnortConfig*);
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* _help =
+ "configure ";
+
class XXXModule : public Module
{
public:
- XXXModule() : Module("xxx", xxx_params) { };
+ XXXModule() : Module("xxx", xxx_help, xxx_params) { };
const RuleMap* get_rules() { return xxx_rules; };
bool set(const char*, Value&, SnortConfig*);
bool begin(const char*, int, SnortConfig*);
{
return true;
}
-
-static const Parameter xxx_params[] =
-{
- { "name", Parameter::PT_INT, "range", "deflt",
- "help" },
-
- { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
-};
-
-class XXXModule : public Module
-{
-public:
- XXXModule() : Module("xxx", xxx_params) { };
- bool set(const char*, Value&, SnortConfig*);
-};
-
-bool XXXModule::set(const char*, Value& v, SnortConfig* sc)
-{
- if ( v.is("name") )
- sc->pkt_cnt = v.get_long();
-
- else
- return false;
-
- return true;
-}
-
#endif
+
//-------------------------------------------------------------------------
// module manager stuff - move to framework/module_manager.cc
//-------------------------------------------------------------------------
ModuleManager::add_module(new EventFilterModule);
ModuleManager::add_module(new RateFilterModule);
ModuleManager::add_module(new SuppressModule);
- ModuleManager::add_module(new VarsModule);
// these are preliminary policies
ModuleManager::add_module(new NetworkModule);
// parameters
//-------------------------------------------------------------------------
-static const Parameter snort_params[] =
+static const Parameter s_params[] =
{
{ "-?", Parameter::PT_IMPLIED, nullptr, nullptr,
"list command line options (same as --help)" },
{ "--help-module", Parameter::PT_STRING, nullptr, nullptr,
"<module> output description of given module" },
+ { "--help-modules", Parameter::PT_IMPLIED, nullptr, nullptr,
+ "list all modules with brief help" },
+
{ "--help-options", Parameter::PT_STRING, "(optional)", nullptr,
"<option prefix> output matching command line option quick help" },
// module
//-------------------------------------------------------------------------
+static const char* s_name = "snort";
+
+static const char* s_help =
+ "command line configuration and shell commands";
+
class SnortModule : public Module
{
public:
- SnortModule() : Module("snort", snort_params)
+ SnortModule() : Module(s_name, s_help, s_params)
{ };
const Command* get_commands() const
else if ( v.is("--help-module") )
help_module(sc, v.get_string());
+ else if ( v.is("--help-modules") )
+ help_modules(sc, v.get_string());
+
else if ( v.is("--help-options") )
help_options(sc, v.get_string());
LogMessage("%s\n", p->mod->get_name());
}
+void ModuleManager::show_modules()
+{
+ s_modules.sort(comp_mods);
+
+ for ( auto* p : s_modules )
+ LogMessage("%s: %s\n", p->mod->get_name(), p->mod->get_help());
+}
+
void ModuleManager::dump_modules()
{
s_modules.sort(comp_mods);
continue;
cout << endl << Markup::head() << name << endl << endl;
- cout << "Type: " << mod_type(p->api) << endl << endl;
+
+ if ( const char* h = m->get_help() )
+ cout << "What: " << h << endl;
+
+ cout << "Type: " << mod_type(p->api) << endl;
if ( const Parameter* p = m->get_parameters() )
{
if ( p->type < Parameter::PT_MAX )
{
- cout << endl << "Configuration: " << endl << endl;
+ cout << endl << "Configuration: " << endl;
show_configs(name, true);
}
}
if ( m->get_commands() )
{
- cout << endl << "Commands: " << endl << endl;
+ cout << endl << "Commands: " << endl;
show_commands(name);
}
if ( m->get_rules() )
{
- cout << endl << "Rules: " << endl << endl;
+ cout << endl << "Rules: " << endl;
show_rules(name);
}
if ( m->get_pegs() )
{
- cout << endl << "Peg counts: " << endl << endl;
+ cout << endl << "Peg counts: " << endl;
show_pegs(name);
}
}
static void list_modules();
static void dump_modules();
+ static void show_modules();
static void show_module(const char*);
static void show_configs(const char* = nullptr, bool exact = false);
#include "arp_module.h"
-static const char* mod_name = "arp_spoof";
+static const char* s_name = MOD_NAME;
+
+static const char* s_help =
+ "detect ARP attacks and anomalies";
#define ARPSPOOF_UNICAST_ARP_REQUEST_STR \
"(arp_spoof) Unicast ARP request"
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
-static const Parameter arp_spoof_params[] =
+static const Parameter s_params[] =
{
{ "hosts", Parameter::PT_LIST, arp_spoof_hosts_params, nullptr,
"configure ARP cache overwrite attacks" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
-static const RuleMap arp_spoof_rules[] =
+static const RuleMap s_rules[] =
{
{ ARPSPOOF_UNICAST_ARP_REQUEST,
ARPSPOOF_UNICAST_ARP_REQUEST_STR },
//-------------------------------------------------------------------------
ArpSpoofModule::ArpSpoofModule() :
- Module(mod_name, arp_spoof_params)
+ Module(s_name, s_help, s_params)
{
config = new ArpSpoofConfig;
config->check_overwrite = false;
}
const RuleMap* ArpSpoofModule::get_rules() const
-{ return arp_spoof_rules; }
+{ return s_rules; }
ProfileStats* ArpSpoofModule::get_profile() const
{ return &arpPerfStats; }
nullptr
};
+static const char* s_name = "binder";
+
+static const char* s_help =
+ "configure processing based on CIDRs, ports, services, etc.";
+
//-------------------------------------------------------------------------
// binder module
//-------------------------------------------------------------------------
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
-static const Parameter binder_params[] =
+static const Parameter s_params[] =
{
{ "when", Parameter::PT_TABLE, binder_when_params, nullptr,
"match criteria" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
-BinderModule::BinderModule() : Module("binder", binder_params)
+BinderModule::BinderModule() : Module(s_name, s_help, s_params)
{ work = nullptr; }
BinderModule::~BinderModule()
bool BinderModule::begin(const char* fqn, int idx, SnortConfig*)
{
- if ( idx && !strcmp(fqn, "binder") )
+ if ( idx && !strcmp(fqn, s_name) )
work = new Binding;
return true;
bool BinderModule::end(const char* fqn, int idx, SnortConfig*)
{
- if ( idx && !strcmp(fqn, "binder") )
+ if ( idx && !strcmp(fqn, s_name) )
{
bindings.push_back(work);
work = nullptr;
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
-static const Parameter normalize_params[] =
+static const Parameter s_params[] =
{
{ "ip4", Parameter::PT_TABLE, norm_ip4_params, nullptr,
"set ip4 normalization options" },
// normalize parameters
//-------------------------------------------------------------------------
+static const char* s_name = "normalize";
+
+static const char* s_help =
+ "packet scrubbing for inline mode";
+
NormalizeModule::NormalizeModule() :
- Module("normalize", normalize_params)
+ Module(s_name, s_help, s_params)
{
memset(&config, 0, sizeof(config));
}
bool NormalizeModule::begin(const char* fqn, int, SnortConfig*)
{
- if ( !strcmp(fqn, "normalize") )
+ if ( !strcmp(fqn, s_name) )
{
NetworkPolicy* policy = get_network_policy();
// perf attributes
//-------------------------------------------------------------------------
-static const Parameter perf_params[] =
+static const Parameter s_params[] =
{
{ "packets", Parameter::PT_INT, "0:", "10000",
"minim packets to report" },
// perf attributes
//-------------------------------------------------------------------------
+static const char* s_name = "perf_monitor";
+
+static const char* s_help =
+ "performance monitoring and flow statistics collection";
+
PerfMonModule::PerfMonModule() :
- Module("perf_monitor", perf_params)
+ Module(s_name, s_help, s_params)
{ }
ProfileStats* PerfMonModule::get_profile() const
static const char* scans =
"portscan | portsweep | decoy_portscan | distributed_portscan | all";
-static const Parameter port_scan_params[] =
+static const Parameter ps_params[] =
{
{ "protos", Parameter::PT_MULTI, protos, "all",
"choose the protocols to monitor" },
// port_scan module
//-------------------------------------------------------------------------
+static const char* ps_name = "port_scan";
+
+static const char* ps_help =
+ "port scan detection";
+
PortScanModule::PortScanModule() :
- Module("port_scan", port_scan_params)
+ Module(ps_name, ps_help, ps_params)
{
config = nullptr;
}
// port_scan module
//-------------------------------------------------------------------------
-static const Parameter ps_global_params[] =
+static const char* psg_name = "port_scan_global";
+static const char* psg_help =
+ "shared settings for port_scan inspectors";
+
+static const Parameter psg_params[] =
{
{ "memcap", Parameter::PT_INT, "1:", "1048576",
"maxium tracker memory" },
};
PortScanGlobalModule::PortScanGlobalModule() :
- Module("port_scan_global", ps_global_params)
+ Module(psg_name, psg_help, psg_params)
{
common = nullptr;
}
#define BO_BUF_SIZE 8
#define BO_BUF_ATTACK_SIZE 1024
-static const char* mod_name = "back_orifice";
+static const char* s_name = "back_orifice";
/* global keyvalue for the BoRand() function */
static THREAD_LOCAL long holdrand = 1L;
{ 0, nullptr }
};
+static const char* s_help =
+ "back orifice detection";
+
class BoModule : public Module
{
public:
- BoModule() : Module(mod_name)
+ BoModule() : Module(s_name, s_help)
{ };
const RuleMap* get_rules() const
void BackOrifice::show(SnortConfig*)
{
- LogMessage("%s\n", mod_name);
+ LogMessage("%s\n", s_name);
}
void BackOrifice::eval(Packet *p)
{
{
PT_INSPECTOR,
- mod_name,
+ s_name,
INSAPI_PLUGIN_V0,
0,
mod_ctor,
#include "framework/plug_data.h"
#include "detection/detection_util.h"
-static const char* data_key = "ftp_data";
+static const char* s_name = "ftp_data";
+
+static const char* s_help =
+ "FTP data channel handler";
static THREAD_LOCAL ProfileStats ftpdataPerfStats;
static THREAD_LOCAL SimpleStats fdstats;
void eval(Packet*);
};
-static const Parameter fd_params[] =
-{
- { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
-};
-
class FtpDataModule : public Module
{
public:
- FtpDataModule() : Module(data_key, fd_params) { };
+ FtpDataModule() : Module(s_name, s_help) { };
const char** get_pegs() const;
PegCount* get_counts() const;
{
{
PT_INSPECTOR,
- data_key,
+ s_name,
INSAPI_PLUGIN_V0,
0,
mod_ctor,
#define FTP_CLIENT "ftp_client"
#define FTP_SERVER "ftp_server"
+static const char* ftp_client_help =
+ "FTP client configuration module";
+
+static const char* ftp_server_help =
+ "main FTP module";
+
//-------------------------------------------------------------------------
// client stuff
//-------------------------------------------------------------------------
};
FtpClientModule::FtpClientModule() :
- Module(FTP_CLIENT, ftp_client_params)
+ Module(FTP_CLIENT, ftp_client_help, ftp_client_params)
{
conf = nullptr;
}
//-------------------------------------------------------------------------
FtpServerModule::FtpServerModule() :
- Module(FTP_SERVER, ftp_server_params)
+ Module(FTP_SERVER, ftp_server_help, ftp_server_params)
{
conf = nullptr;
}
using namespace std;
+static const char* s_name = "telnet";
+
+static const char* s_help =
+ "telnet inspector";
+
//-------------------------------------------------------------------------
// telnet module
//-------------------------------------------------------------------------
#define TELNET_SB_NO_SE_STR \
"(telnet) Telnet Subnegotiation Begin Command without Subnegotiation End"
-static const Parameter telnet_params[] =
+static const Parameter s_params[] =
{
{ "ayt_attack_thresh", Parameter::PT_INT, "-1:", "-1",
"alert on this number of consecutive telnet AYT commands" },
};
TelnetModule::TelnetModule() :
- Module("telnet", telnet_params)
+ Module(s_name, s_help, s_params)
{
conf = nullptr;
}
{ 0, nullptr }
};
+static const char* hi_global_help =
+ "http inspector global configuration and client rules";
+
HttpInspectModule::HttpInspectModule() :
- Module(GLOBAL_KEYWORD, hi_global_params)
+ Module(GLOBAL_KEYWORD, hi_global_help, hi_global_params)
{
config = nullptr;
}
{ 0, nullptr }
};
+static const char* hi_server_help =
+ "http inspection and server rules";
+
HttpServerModule::HttpServerModule() :
- Module(SERVER_KEYWORD, hi_server_params)
+ Module(SERVER_KEYWORD, hi_server_help, hi_server_params)
{
server = nullptr;
}
#include "framework/module.h"
+#define NHTTP_HELP "new HTTP inspector"
+
class NHttpModule : public Module
{
public:
- NHttpModule() : Module("nhttp_inspect", nhttp_params) {};
+ NHttpModule() : Module("nhttp_inspect", NHTTP_HELP, nhttp_params) {};
bool begin(const char*, int, SnortConfig*);
bool end(const char*, int, SnortConfig*) { return true; };
bool set(const char*, Value&, SnortConfig*);
#define RPC_ZERO_LENGTH_FRAGMENT_STR \
"(rpc_decode) Zero-length RPC Fragment"
-static const Parameter rpc_params[] =
+static const Parameter s_params[] =
{
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
// rpc module
//-------------------------------------------------------------------------
-RpcDecodeModule::RpcDecodeModule() : Module("rpc_decode", rpc_params)
+static const char* s_name = "rpc_decode";
+static const char* s_help = "RPC inspector";
+
+RpcDecodeModule::RpcDecodeModule() : Module(s_name, s_help, s_params)
{ }
const RuleMap* RpcDecodeModule::get_rules() const
#include "magic.h"
static const char* s_name = "wizard";
+static const char* s_help =
+ "inspector that implements port-independent protocol identification";
//-------------------------------------------------------------------------
// wizard module
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
-static const Parameter wizard_params[] =
+static const Parameter s_params[] =
{
{ "hexes", Parameter::PT_LIST, wizard_hexes_params, nullptr,
"criteria for binary service identification" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
-WizardModule::WizardModule() : Module(s_name, wizard_params)
+WizardModule::WizardModule() : Module(s_name, s_help, s_params)
{
c2s_hexes = nullptr;
s2c_hexes = nullptr;
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
-static const Parameter stream_params[] =
+static const Parameter s_params[] =
{
{ "icmp_cache", Parameter::PT_TABLE, proto_params, nullptr,
"configure icmp cache limits" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "base stream inspector for flow tracking";
+
StreamModule::StreamModule() :
- Module(MOD_NAME, stream_params)
+ Module(MOD_NAME, s_help, s_params)
{
proto = &stream_cfg.ip_cfg;
}
// stream_icmp module
//-------------------------------------------------------------------------
-static const Parameter stream_icmp_params[] =
+static const Parameter s_params[] =
{
{ "session_timeout", Parameter::PT_INT, "1:86400", "30",
"session tracking timeout" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "stream inspector for ICMP flow tracking";
+
StreamIcmpModule::StreamIcmpModule() :
- Module(MOD_NAME, stream_icmp_params)
+ Module(MOD_NAME, s_help, s_params)
{
config = nullptr;
}
{ 0, nullptr }
};
-static const Parameter stream_ip_params[] =
+static const Parameter s_params[] =
{
{ "max_frags", Parameter::PT_INT, "1:", "8192",
"maximum number of simultaneous fragments being tracked" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "stream inspector for IP flow tracking";
+
StreamIpModule::StreamIpModule() :
- Module(MOD_NAME, stream_ip_params)
+ Module(MOD_NAME, s_help, s_params)
{
config = nullptr;
}
// stream_reassemble
//-------------------------------------------------------------------------
-#define IPS_REASS "stream_reassemble"
+static const char* s_name = "stream_reassemble";
+static const char* s_help =
+ "detection option for stream reassembly control";
static THREAD_LOCAL ProfileStats streamReassembleRuleOptionPerfStats;
{
public:
ReassembleOption(const StreamReassembleRuleOptionData& c) :
- IpsOption(IPS_REASS)
+ IpsOption(s_name)
{ srod = c; };
uint32_t hash() const;
// stream_reassemble module
//-------------------------------------------------------------------------
-static const Parameter reassemble_params[] =
+static const Parameter s_params[] =
{
{ "*action", Parameter::PT_ENUM, "disable|enable", nullptr,
"stop or start stream reassembly" },
class ReassembleModule : public Module
{
public:
- ReassembleModule() : Module(IPS_REASS, reassemble_params) { };
+ ReassembleModule() : Module(s_name, s_help, s_params) { };
bool begin(const char*, int, SnortConfig*);
bool set(const char*, Value&, SnortConfig*);
{
{
PT_IPS_OPTION,
- IPS_REASS,
+ s_name,
IPSAPI_PLUGIN_V0,
0,
reassemble_mod_ctor,
// stream_size
//-------------------------------------------------------------------------
-#define IPS_SIZE "stream_size"
+static const char* s_name = "stream_size";
+static const char* s_help =
+ "detection option for stream size checking";
static THREAD_LOCAL ProfileStats streamSizePerfStats;
{
public:
SizeOption(const StreamSizeOptionData& c) :
- IpsOption(IPS_SIZE)
+ IpsOption(s_name)
{ ssod = c; };
uint32_t hash() const;
// stream_size module
//-------------------------------------------------------------------------
-static const Parameter size_params[] =
+static const Parameter s_params[] =
{
{ "*direction", Parameter::PT_ENUM, "either|client|server|both", nullptr,
"compare applies to the given direction(s)" },
class SizeModule : public Module
{
public:
- SizeModule() : Module(IPS_SIZE, size_params) { };
+ SizeModule() : Module(s_name, s_help, s_params) { };
bool begin(const char*, int, SnortConfig*);
bool set(const char*, Value&, SnortConfig*);
{
{
PT_IPS_OPTION,
- IPS_SIZE,
+ s_name,
IPSAPI_PLUGIN_V0,
0,
size_mod_ctor,
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
-static const Parameter stream_tcp_params[] =
+static const Parameter s_params[] =
{
{ "flush_factor", Parameter::PT_INT, "0:", "0",
"flush upon seeing a drop in segment size after given number of non-decreasing segments" },
{ 0, nullptr }
};
+static const char* s_help =
+ "stream inspector for TCP flow tracking and stream normalization and reassembly";
+
StreamTcpModule::StreamTcpModule() :
- Module(MOD_NAME, stream_tcp_params)
+ Module(MOD_NAME, s_help, s_params)
{
config = nullptr;
}
// stream_udp module
//-------------------------------------------------------------------------
-static const Parameter stream_udp_params[] =
+static const Parameter s_params[] =
{
{ "session_timeout", Parameter::PT_INT, "1:86400", "30",
"session tracking timeout" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
+static const char* s_help =
+ "stream inspector for UDP flow tracking";
+
StreamUdpModule::StreamUdpModule() :
- Module(MOD_NAME, stream_udp_params)
+ Module(MOD_NAME, s_help, s_params)
{
config = nullptr;
}
#include "main/snort_config.h"
#include "main/snort.h"
+static const char* s_name = "ppm";
+static const char* s_help =
+ "packet and rule latency monitoring and control";
+
//-------------------------------------------------------------------------
// ppm attributes
//-------------------------------------------------------------------------
#ifdef PPM_MGR
-static const Parameter ppm_params[] =
+static const Parameter s_params[] =
{
{ "max_pkt_time", Parameter::PT_INT, "0:", "0",
"enable packet latency thresholding (usec), 0 = off" },
// ppm module
//-------------------------------------------------------------------------
-PpmModule::PpmModule() : Module("ppm", ppm_params) { }
+PpmModule::PpmModule() : Module(s_name, s_help, s_params) { }
const RuleMap* PpmModule::get_rules() const
{ return ppm_rules; }
projects / thirdparty / snort3.git / commitdiff
