adding configuration differences to manual. Adding to .gitignore

diff --git a/.gitignore b/.gitignore
index d7359c62b1cc954e1a0d7b66a1ad11d6e49d0b62..0c489488509443df92f81c56322fcd55c55bca67 100644 (file)
--- a/.gitignore
+++ b/.gitignore
@@ -54,3 +54,7 @@ stamp-h1
 tools/u2boat/u2boat
 tools/u2spewfoo/u2spewfoo
 ylwrap
+*results
+*snort.alert*
+*snort.out*
+*snort.log*

diff --git a/cmake/includePredefinedPackages.cmake b/cmake/includePredefinedPackages.cmake
index b6cd8618593f309814da811661dcda6b3724130e..8c542379fc990e9c6a2e9b7d9a229b860348b432 100644 (file)
--- a/cmake/includePredefinedPackages.cmake
+++ b/cmake/includePredefinedPackages.cmake
@@ -14,4 +14,4 @@ find_package(DNET REQUIRED)
 # optional libraries
 find_package(Asciidoc QUIET)
 find_package(DBLATEX QUIET)
-find_package(Ruby QUIET)
+find_package(Ruby QUIET 1.8.7)

diff --git a/doc/CMakeLists.txt b/doc/CMakeLists.txt
index 0a5cd2294fcaf1894cd4febf48c423d229fb80c1..505513514b8e46745c79f40a5cbe9f4ef2fec76f 100644 (file)
--- a/doc/CMakeLists.txt
+++ b/doc/CMakeLists.txt
@@ -20,8 +20,9 @@ set(BUILT_SOURCES
     config.txt
     options.txt
     gids.txt
-#    modules.txt   Requires Special formatting. manually added below.
-#    version.txt   Required special formatting. manually added below.
+#   modules.txt         Requires Special formatting. manually added below.
+#   version.txt         Required special formatting. manually added below.
+#   config_changes.txt  If ruby executable found
     CACHE INTERNAL "sources to be built" FORCE
 )
 
@@ -31,7 +32,7 @@ set (UNBUILT_SOURCES
     style.txt
     tips.txt
     plugins.txt
-#    images/snort.png   # images directory is manually included as an a2x option
+#   config_changes.txt  If ruby executable is NOT found
 )
 
 if (MAKE_HTML_DOC)
@@ -105,6 +106,23 @@ if (MAKE_PDF_DOC OR MAKE_HTML_DOC)
     list (APPEND ALL_SOURCES ${output})
 
 
+    # If ruby is present, built the configuration differences
+    if (RUBY_EXECUTABLE)
+        set (output ${CMAKE_CURRENT_BINARY_DIR}/config_changes.txt)
+        add_custom_command(
+            OUTPUT ${output}
+            COMMAND ${RUBY_EXECUTABLE}
+                ${CMAKE_CURRENT_SOURCE_DIR}/get_differences.rb
+                ${CMAKE_SOURCE_DIR}/tools/snort2lua
+                > ${output}
+            DEPENDS snort2lua
+            COMMENT "Documents: building config_changes.txt"
+        )
+        list (APPEND ALL_SOURCES ${output})
+    else()
+        list(APPEND UNBUILT_SOURCES conf_differences.txt)
+    endif()
+
     # next, Copy all distributed files into the binary tree (necessary for asciidocs).
     # Then create a dependency between the new and old files.
     foreach (file ${UNBUILT_SOURCES})

diff --git a/doc/Makefile.am b/doc/Makefile.am
index cba73eceb9629df156a7c8e798f1946124766ef0..e5193988f853de4f3f866209f69100a9b69d80b5 100644 (file)
--- a/doc/Makefile.am
+++ b/doc/Makefile.am
@@ -13,6 +13,7 @@ version.txt
 
 unbuilt_sources = \
 snort_manual.txt \
+config_changes.txt \
 differences.txt \
 plugins.txt \
 style.txt \

diff --git a/doc/config_changes.txt b/doc/config_changes.txt
new file mode 100644 (file)
index 0000000..dc49e74
--- /dev/null
+++ b/doc/config_changes.txt
@@ -0,0 +1,229 @@
+change:  ac ==> ac_full_q
+change:  ac-banded ==> ac_banded
+change:  ac-bnfa ==> ac_bnfa_q
+change:  ac-bnfa-nq ==> ac_bnfa
+change:  ac-bnfa-q ==> ac_bnfa_q
+change:  ac-nq ==> ac_full
+change:  ac-q ==> ac_full_q
+change:  ac-sparsebands ==> ac_sparse_bands
+change:  ac-split ==> ac_full_q
+change:  ac-split ==> split_any_any
+change:  ac-std ==> ac_std
+change:  accumulate ==> reset = false
+change:  acs ==> ac_sparse
+change:  addressspace_agnostic  ==> address_space_agnostic
+change:  alert_unified2 ==> unified2
+change:  alertfile  ==> alert_file
+change:  alt_max_param_len ==> cmd_validity
+change:  autogenerate_preprocessor_decoder_rules  ==> enable_builtin_rules
+change:  bind_to ==> bindings
+change:  bleedover-port-limit ==> bleedover_port_limit
+change:  bleedover-warnings-enabled ==> bleedover_warnings_enabled
+change:  block ==> base
+change:  checksum_mode  ==> checksum_eval
+change:  config file: file_block_timeout ==> block_timeout
+change:  config file: file_lookup_timeout ==> lookup_timeout
+change:  config file: file_signature_depth ==> signature_depth
+change:  config file: file_type_depth ==> type_depth
+change:  config file: signature ==> enable_signature
+change:  config file: type_id ==> enable_type
+change:  config mpls_payload_type: ethernet ==> mpls_payload_type = eth
+change:  config mpls_payload_type: ipv4 ==> mpls_payload_type = ip4
+change:  config mpls_payload_type: ipv6 ==> mpls_payload_type = ip6
+change:  daq  ==> name
+change:  daq_dir  ==> dir
+change:  daq_mode  ==> mode
+change:  daq_var  ==> var
+change:  data_chan ==> ignore_data_chan
+change:  debug-pkts ==> debug_pkts
+change:  debug-print-fast-pattern ==> debug_print_fast_pattern
+change:  debug-print-nocontent-rule-tests ==> debug_print_nocontent_rule_tests
+change:  debug-print-rule-group-build-details ==> debug_print_rule_group_build_details
+change:  debug-print-rule-groups-compiled ==> debug_print_rule_groups_compiled
+change:  debug-print-rule-groups-uncompiled ==> debug_print_rule_groups_uncompiled
+change:  detection_filter  ==> detection_filter_memcap
+change:  dgmlen ==> dgm_len
+change:  disable_inline_init_failopen  ==> enable_inline_init_failopen
+change:  disabled ==> enable
+change:  dont_reassemble_async ==> reassemble_async
+change:  dstport ==> dst_port
+change:  dynamicdetection ==> plugin_path
+change:  dynamicengine ==> plugin_path
+change:  dynamicpreprocessor ==> plugin_path
+change:  dynamicsidechannel ==> plugin_path
+change:  enable-single-rule-group ==> enable_single_rule_group
+change:  enable_cookie ==> enable_cookies
+change:  enable_deep_teredo_inspection  ==> deep_teredo_inspection
+change:  enabled ==> enable
+change:  ethdst ==> eth_dst
+change:  ethlen ==> eth_len
+change:  ethsrc ==> eth_src
+change:  event_filter  ==> event_filter_memcap
+change:  fastpath-expensive-packets ==> fastpath_expensive_packets
+change:  filename ==> file
+change:  flow-file ==> flow_file = true
+change:  flow-ip ==> flow_ip
+change:  flow-ip-file ==> flow_ip_file = true
+change:  flow-ip-memcap ==> flow_ip_memcap
+change:  flow-ports ==> flow_ports
+change:  flow_depth ==> server_flow_depth
+change:  footprint ==> use_static_footprint_sizes
+change:  gen_id ==> gid
+change:  icmpcode ==> icmp_code
+change:  icmpid ==> icmp_id
+change:  icmpseq ==> icmp_seq
+change:  icmptype ==> icmp_type
+change:  intel-cpm ==> intel_cpm
+change:  iplen ==> ip_len
+change:  log_alert ==> level = alert
+change:  log_auth ==> facility = auth
+change:  log_authpriv ==> facility = authpriv
+change:  log_cons ==> options = cons
+change:  log_crit ==> level = crit
+change:  log_daemon ==> facility = daemon
+change:  log_debug ==> level = debug
+change:  log_emerg ==> level = emerg
+change:  log_err ==> level = err
+change:  log_info ==> level = info
+change:  log_local0 ==> facility = local0
+change:  log_local1 ==> facility = local1
+change:  log_local2 ==> facility = local2
+change:  log_local3 ==> facility = local3
+change:  log_local4 ==> facility = local4
+change:  log_local5 ==> facility = local5
+change:  log_local6 ==> facility = local6
+change:  log_local7 ==> facility = local7
+change:  log_ndelay ==> options = ndelay
+change:  log_notice ==> level = notice
+change:  log_perror ==> options = perror
+change:  log_pid ==> options = pid
+change:  log_unified2 ==> unified2
+change:  log_user ==> facility = user
+change:  log_warning ==> level = warning
+change:  lowmem ==> lowmem_q
+change:  lowmem-nq ==> lowmem
+change:  lowmem-q ==> lowmem_q
+change:  max-pattern-len ==> max_pattern_len
+change:  max-pkt-time ==> max_pkt_time
+change:  max-rule-time ==> max_rule_time
+change:  max_active_responses ==> max_responses
+change:  max_attribute_hosts  ==> max_hosts
+change:  max_attribute_services_per_host  ==> max_services_per_host
+change:  max_icmp ==> max_sessions
+change:  max_ip ==> max_sessions
+change:  max_queued_bytes ==> queue_limit.max_bytes
+change:  max_queued_segs ==> queue_limit.max_segments
+change:  max_tcp ==> max_sessions
+change:  max_udp ==> max_sessions
+change:  min_fragment_length ==> min_frag_length
+change:  min_response_seconds ==> min_interval
+change:  non_rfc_char ==> non_rfc_chars
+change:  nopcre  ==> pcre_enable
+change:  overlap_limit ==> max_overlaps
+change:  pad ==> base
+change:  pkt-log  ==> pkt_log
+change:  pkt_count  ==> limit
+change:  pktcnt ==> packets
+change:  policy_mode  ==> mode
+change:  ports ==> bindings
+change:  ports ==> gtp_ports
+change:  ports both ==> both_ports
+change:  ports client ==> client_ports
+change:  ports server ==> server_ports
+change:  preprocessor normalize_icmp4 ==> icmp4 == <bool>
+change:  preprocessor normalize_icmp6 ==> icmp6 == <bool>
+change:  preprocessor normalize_ip6 ==> ip6 == <bool>
+change:  print ==> count
+change:  proto ==> protos
+change:  prune_log_max ==> histogram
+change:  rate_filter  ==> rate_filter_memcap
+change:  req_pay ==> base
+change:  req_urg ==> base
+change:  req_urp ==> base
+change:  rsv ==> base
+change:  rule-log ==> rule_log
+change:  scan_type ==> scan_types
+change:  search-method ==> search_method
+change:  search-optimize ==> search_optimize
+change:  sid_id ==> sid
+change:  sig_generator ==> gid
+change:  sig_id ==> sid
+change:  sig_rev ==> rev
+change:  snortfile ==> file = true
+change:  sort avg_ticks_per_nomatch ==> sort = avg_ticks_per_no_match
+change:  split-any-any ==> split_any_any
+change:  srcport ==> src_port
+change:  suspend-expensive-rules ==> suspend_expensive_rules
+change:  suspend-timeout ==> suspend_timeout
+change:  tcp_cache_nominal_timeout ==> pruning_timeout
+change:  tcp_cache_pruning_timeout ==> idle_timeout
+change:  tcpack ==> tcp_ack
+change:  tcpflags ==> tcp_flags
+change:  tcplen ==> tcp_len
+change:  tcpseq ==> tcp_seq
+change:  tcpwindow ==> tcp_win
+change:  threshold  ==> event_filter_memcap
+change:  time ==> seconds
+change:  timeout ==> session_timeout
+change:  trim_mss ==> trim
+change:  trim_rst ==> trim
+change:  trim_syn ==> trim
+change:  trim_win ==> trim
+change:  udp_cache_nominal_timeout ==> idle_timeout
+change:  udp_cache_pruning_timeout ==> pruning_timeout
+change:  unified2 ==> unified2
+deleted: action
+deleted: alert_fragments
+deleted: atexitonly
+deleted: atexitonly: base-stats
+deleted: atexitonly: events-stats
+deleted: atexitonly: flow-ip-stats
+deleted: atexitonly: flow-stats
+deleted: check_session_hijacking
+deleted: config cs_dir
+deleted: config disable_attribute_reload_thread
+deleted: config disable_decode_alerts
+deleted: config disable_decode_drops
+deleted: config disable_ipopt_alerts
+deleted: config disable_ipopt_drops
+deleted: config disable_tcpopt_alerts
+deleted: config disable_tcpopt_drops
+deleted: config disable_tcpopt_experimental_alerts
+deleted: config disable_tcpopt_experimental_drops
+deleted: config disable_tcpopt_obsolete_alerts
+deleted: config disable_tcpopt_obsolete_drops
+deleted: config disable_tcpopt_ttcp_alerts
+deleted: config disable_ttcp_alerts
+deleted: config disable_ttcp_drops
+deleted: config dump_dynamic_rules_path
+deleted: config enable_decode_drops
+deleted: config enable_decode_oversized_alerts
+deleted: config enable_decode_oversized_drops
+deleted: config enable_ipopt_drops
+deleted: config enable_tcpopt_drops
+deleted: config enable_tcpopt_experimental_drops
+deleted: config enable_tcpopt_obsolete_drops
+deleted: config enable_tcpopt_ttcp_drops
+deleted: config enable_ttcp_drops
+deleted: config flexresp2_attempts
+deleted: config flexresp2_interface
+deleted: config flexresp2_memcap
+deleted: config flexresp2_rows
+deleted: config include_vlan_in_alerts
+deleted: config interface
+deleted: config layer2resets
+deleted: config policy_version
+deleted: config so_rule_memcap
+deleted: default
+deleted: detect_ack_scans
+deleted: detect_anomalies
+deleted: disabled
+deleted: dont_store_large_packets
+deleted: flush_on_alert
+deleted: logfile
+deleted: mwm
+deleted: no_alert_incomplete
+deleted: no_alert_large_fragments
+deleted: no_alert_multiple_requests
+deleted: no_alerts
+deleted: no_midstream_drop_alerts

diff --git a/doc/get_differences.rb b/doc/get_differences.rb
new file mode 100755 (executable)
index 0000000..27fc8b6
--- /dev/null
+++ b/doc/get_differences.rb
@@ -0,0 +1,73 @@
+#!/usr/bin/ruby
+
+# CONST REG_EX.  DO NOT CHANGE
+delete_pattern = /add_deleted_comment\(\"(.*)\"\);/
+diff_pattern = /add_diff_option_comment\(\"(.*)\",\s?\"(.*)\"\)/
+template_diff = /<\s*&(.*),.*,\s*&(.*)>/
+config_delete_template = /deleted_ctor<&(.*)>/
+paths_diff = /paths_ctor<\s*&(.*)\s*>/  # check kws_paths.cc
+normalizers_diff = /norm_sans_options_ctor<\s?&(.*)>/  # check pps_normalizers
+unified2_diff = /unified2_ctor<\s?&(.*)>/  # checkout out_unified2.cc
+star_reg = /\*/
+
+if ARGV.empty?() || ARGV.length() > 1
+    abort("Usage: ruby get_differences.rb <path_to_search>")
+end
+
+dir = ARGV[0];
+
+if !File.directory?(dir)
+    abort("Cannot find directory #{dir}")
+end
+
+
+arr = Array.new()
+
+Dir.glob("#{dir}/**/*cc").each do |file|
+    File.open(file) do |f|
+        f.each_line do |line|
+            if line =~ star_reg
+                next
+            end
+
+            if line =~ delete_pattern
+                arr << "deleted: #{$1}"
+            end
+
+            if line =~ diff_pattern
+                arr << "change:  #{$1} ==> #{$2}"
+
+            end
+
+            if line =~ template_diff
+                arr << "change:  #{$1}  ==> #{$2}"
+            end
+
+            if line =~ config_delete_template
+                arr << "deleted: config #{$1}"
+            end
+
+            # Files with special templates
+
+            if line =~ paths_diff
+                arr << "change:  #{$1} ==> plugin_path"
+            end
+            
+            if line =~ normalizers_diff
+                arr << "change:  preprocessor normalize_#{$1} ==> #{$1} == <bool>"
+            end
+
+            if line =~ unified2_diff
+                arr << "change:  #{$1} ==> unified2"
+            end
+
+        end
+    end
+end
+
+arr.uniq!
+arr.sort!
+
+arr.each do |elem|
+    puts "#{elem}"
+end

diff --git a/doc/snort_manual.txt b/doc/snort_manual.txt
index d0ba037b01606ce4f37acc475d979a9d524f437a..7e33aa51d7fce22d1b1f25883d20f74fcb438ca4 100644 (file)
--- a/doc/snort_manual.txt
+++ b/doc/snort_manual.txt
@@ -18,6 +18,10 @@ include::tips.txt[]
 
 include::differences.txt[]
 
+=== Configuration Changes
+
+include::config_changes.txt
+
 == Modules
 
 include::modules.txt[]

diff --git a/src/codecs/ip/cd_ipv6.cc b/src/codecs/ip/cd_ipv6.cc
index af363e564c5797ed15e6655c8100744b2886b316..47404c104f7c817639f916fa9bec4da99a844316 100644 (file)
--- a/src/codecs/ip/cd_ipv6.cc
+++ b/src/codecs/ip/cd_ipv6.cc
@@ -616,7 +616,9 @@ bool Ipv6Codec::update (Packet* p, Layer* lyr, uint32_t* len)
     // extension headers are decoded and we stop at frag6.
     // in such case we do not modify the packet length.
     if ( (p->packet_flags & PKT_MODIFIED)
+#ifdef NORMALIZER
         && !(p->packet_flags & PKT_RESIZED)
+#endif
     ) {
         *len = ntohs(h->ip6plen) + sizeof(*h);
     }

diff --git a/src/codecs/ip/cd_ipv6_module.cc b/src/codecs/ip/cd_ipv6_module.cc
index ba54e8b7e4c0d08b330fc75d40f01ecba6d98da4..dae3577b9f796b50dd2b640357684bca0448116f 100644 (file)
--- a/src/codecs/ip/cd_ipv6_module.cc
+++ b/src/codecs/ip/cd_ipv6_module.cc
@@ -58,7 +58,7 @@ static const RuleMap ipv6_rules[] =
     { DECODE_IPV6_ISATAP_SPOOF, "(" CD_IPV6_NAME ") BAD-TRAFFIC ISATAP-addressed IPv6 traffic spoofing attempt" },
     { DECODE_IPV6_BAD_FRAG_PKT, "(" CD_IPV6_NAME ") bogus fragmentation packet. Possible BSD attack" },
     { DECODE_IPV6_ROUTE_ZERO, "(" CD_IPV6_NAME ") IPV6 routing type 0 extension header" },
-    { DECODE_IP6_EXCESS_EXT_HDR, "(decode) too many IP6 extension headers" },
+    { DECODE_IP6_EXCESS_EXT_HDR, "(" CD_IPV6_NAME ") too many IP6 extension headers" },
     { 0, nullptr }
 };
 

diff --git a/tools/snort2lua/CMakeLists.txt b/tools/snort2lua/CMakeLists.txt
index d9aa3982f970c4a49b8c81bb7e7ea6fbb068f419..62b02f70dc2d9c8d9d272858409929ee2629e528 100644 (file)
--- a/tools/snort2lua/CMakeLists.txt
+++ b/tools/snort2lua/CMakeLists.txt
@@ -33,7 +33,6 @@ target_link_libraries( snort2lua
     rule_states
 )
 
-
 install (TARGETS snort2lua
     RUNTIME DESTINATION bin
 )