refactored inspector groups

diff --git a/ChangeLog b/ChangeLog
index 73827db04d28e4123bbc35c8b27373ef56b36bde..b6dd3b0735105aa1962e6fc7c26e961b05c618ce 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -33,6 +33,7 @@
 -- added missing ip|tcp|udp|icmp options to checksum_drop/eval
 -- pulled in latest from Josh
 -- pulled in HI defaults patch from Bhagya
+-- refactored inspector groups
 
 125
 -- discovered can't catch exceptions thrown from Lua to C++; need to

diff --git a/src/framework/inspector.h b/src/framework/inspector.h
index 396f4ec51c66126c7638fd5f599f86a96c4c4e43..01fd1901deaa8593e14edeb2fc4de8f2c2fd2d84 100644 (file)
--- a/src/framework/inspector.h
+++ b/src/framework/inspector.h
@@ -128,10 +128,10 @@ enum InspectorType
     IT_BINDER,
     IT_WIZARD,
     IT_PACKET,
-    IT_PROTOCOL,
+    IT_NETWORK,
     IT_STREAM,
-    IT_SESSION,
     IT_SERVICE,
+    IT_PROBE,
     IT_MAX
 };
 

diff --git a/src/main/snort.cc b/src/main/snort.cc
index 2ff293c6a7e6d342f4a2f6b6e2fd6133045c0d27..1f690ddd2dc7c0cb1febbe9877d5ab9716c4440b 100644 (file)
--- a/src/main/snort.cc
+++ b/src/main/snort.cc
@@ -747,7 +747,7 @@ DAQ_Verdict ProcessPacket(
         p->proto_bits = PROTO_BIT__OTHER;
 
 #if 0
-    // FIXIT-J required until decoders are fixed
+    // FIXIT-H-J required until decoders are fixed
     else if ( !p->family && (p->proto_bits & PROTO_BIT__IP) )
         p->proto_bits &= ~PROTO_BIT__IP;
 #endif

diff --git a/src/managers/inspector_manager.cc b/src/managers/inspector_manager.cc
index d55b58528d1e26623a0bcc9a7a2eb6283a480ef2..c11ff6ed4456b54fbb3eced92e9f44e018983f71 100644 (file)
--- a/src/managers/inspector_manager.cc
+++ b/src/managers/inspector_manager.cc
@@ -147,10 +147,11 @@ struct FrameworkPolicy
 {
     PHInstanceList ilist;
 
-    PHVector session;
+    PHVector packet;
     PHVector network;
-    PHVector generic;
+    PHVector session;
     PHVector service;
+    PHVector probe;
 
     Inspector* binder;
     Inspector* wizard;
@@ -160,27 +161,27 @@ struct FrameworkPolicy
 
 void FrameworkPolicy::vectorize()
 {
-    session.alloc(ilist.size());
+    packet.alloc(ilist.size());
     network.alloc(ilist.size());
+    session.alloc(ilist.size());
     service.alloc(ilist.size());
-    generic.alloc(ilist.size());
+    probe.alloc(ilist.size());
 
     for ( auto* p : ilist )
     {
         switch ( p->pp_class.api.type )
         {
-        case IT_STREAM:
-            if ( !p->pp_class.api.ssn )
-                session.add(p);
+        case IT_PACKET:
+            packet.add(p);
             break;
 
-        case IT_PACKET:
-        case IT_PROTOCOL:
+        case IT_NETWORK:
             network.add(p);
             break;
 
-        case IT_SESSION:
-            generic.add(p);
+        case IT_STREAM:
+            if ( !p->pp_class.api.ssn )
+                session.add(p);
             break;
 
         case IT_SERVICE:
@@ -195,6 +196,10 @@ void FrameworkPolicy::vectorize()
             wizard = p->handler;
             break;
 
+        case IT_PROBE:
+            probe.add(p);
+            break;
+
         case IT_MAX:
             break;
         }
@@ -604,7 +609,7 @@ static inline void execute(
         // FIXIT-P these checks can eventually be optimized
            // but they are required to ensure that session and app
            // handlers aren't called w/o a session pointer
-        if ( !p->flow && (ppc.api.type >= IT_SESSION) )
+        if ( !p->flow && (ppc.api.type == IT_SERVICE) )
             break;
 
         if ( ((unsigned)p->type() & ppc.api.proto_bits) )
@@ -638,9 +643,9 @@ void InspectorManager::execute (Packet* p)
 
     // FIXIT-M structure lists so stream, normalize, etc. aren't
     // called on reassembled packets
+    ::execute(p, fp->packet.vec, fp->packet.num);
     ::execute(p, fp->session.vec, fp->session.num);
     ::execute(p, fp->network.vec, fp->network.num);
-    ::execute(p, fp->generic.vec, fp->generic.num);
 
     Flow* flow = p->flow;
 
@@ -661,5 +666,7 @@ void InspectorManager::execute (Packet* p)
     }
     else
         DisableDetect(p);
+
+    ::execute(p, fp->probe.vec, fp->probe.num);
 }
 

diff --git a/src/network_inspectors/arp_spoof/arp_spoof.cc b/src/network_inspectors/arp_spoof/arp_spoof.cc
index 4ca4f56ae2d7151a3857375ccefe5082fb3ffd4a..6ed79d5cd8b13fc9588b4db9aef1f5db59d9cbc4 100644 (file)
--- a/src/network_inspectors/arp_spoof/arp_spoof.cc
+++ b/src/network_inspectors/arp_spoof/arp_spoof.cc
@@ -307,7 +307,7 @@ static const InspectApi as_api =
         mod_ctor,
         mod_dtor
     },
-    IT_PROTOCOL, 
+    IT_NETWORK, 
     (uint16_t)PktType::ARP,
     nullptr, // buffers
     nullptr, // service

diff --git a/src/network_inspectors/perf_monitor/perf_monitor.cc b/src/network_inspectors/perf_monitor/perf_monitor.cc
index defc10778c64b147a05ff4d5efead7296e10921d..e334006005544cb1837b3c88755120fe0277ef26 100644 (file)
--- a/src/network_inspectors/perf_monitor/perf_monitor.cc
+++ b/src/network_inspectors/perf_monitor/perf_monitor.cc
@@ -382,7 +382,7 @@ static const InspectApi pm_api =
         mod_ctor,
         mod_dtor
     },
-    IT_PACKET,
+    IT_PROBE,
     (uint16_t)PktType::ANY,
     nullptr, // buffers
     nullptr, // service

diff --git a/src/network_inspectors/port_scan/port_scan.cc b/src/network_inspectors/port_scan/port_scan.cc
index 2dbd471e30e61a2ffdc0d1e6af24a463303b9a2d..ae5f002e97e215c2d71b5e4a1e0a66ae98d5225c 100644 (file)
--- a/src/network_inspectors/port_scan/port_scan.cc
+++ b/src/network_inspectors/port_scan/port_scan.cc
@@ -1002,7 +1002,7 @@ static const InspectApi sp_api =
         mod_ctor,
         mod_dtor
     },
-    IT_PROTOCOL,
+    IT_PROBE,
     (uint16_t)PktType::ANY_IP,  // FIXIT-L dynamic assign
     nullptr, // buffers
     nullptr, // service

diff --git a/src/service_inspectors/back_orifice/back_orifice.cc b/src/service_inspectors/back_orifice/back_orifice.cc
index 1de84b30be2d8c19b734d1ce03b3c6a49c5afcd1..30552e53cc171cca95c52ed3524da9536a405462 100644 (file)
--- a/src/service_inspectors/back_orifice/back_orifice.cc
+++ b/src/service_inspectors/back_orifice/back_orifice.cc
@@ -606,7 +606,7 @@ static const InspectApi bo_api =
         mod_ctor,
         mod_dtor
     },
-    IT_PROTOCOL, 
+    IT_NETWORK, 
     (uint16_t)PktType::UDP,
     nullptr, // buffers
     nullptr, // service

diff --git a/src/service_inspectors/ftp_telnet/ftp_data.cc b/src/service_inspectors/ftp_telnet/ftp_data.cc
index bac7757e12e35f6a3a0d6c61dc6970f93241f485..3759e60055ec06a0a13c040199e3c5e9344d7d0c 100644 (file)
--- a/src/service_inspectors/ftp_telnet/ftp_data.cc
+++ b/src/service_inspectors/ftp_telnet/ftp_data.cc
@@ -288,7 +288,7 @@ const InspectApi fd_api =
         mod_ctor,
         mod_dtor
     },
-    IT_SERVICE,  // FIXIT-M does this still need to be session??
+    IT_SERVICE,
     (uint16_t)PktType::TCP,
     nullptr, // buffers
     "ftp-data",