From: Russ Combs Date: Thu, 21 Aug 2014 16:00:34 +0000 (-0400) Subject: prioritized FIXITs X-Git-Tag: 3.0.0-233~1419^2~33 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=32edb5f89766cdb6824dc3fc84c66d7f012b7e73;p=thirdparty%2Fsnort3.git prioritized FIXITs --- diff --git a/ChangeLog b/ChangeLog index eee88a359..3ed8bf60c 100644 --- a/ChangeLog +++ b/ChangeLog @@ -2,6 +2,7 @@ -- remove share.h -- misc FIXITs -- refactored cmd line parsing and moved options to SnortModule +-- prioritized all FIXITs; FIXIT-J are for josh to reprioritize 114 -- more FIXIT cleanup diff --git a/extra/src/ips_options/ips_urg.cc b/extra/src/ips_options/ips_urg.cc index 5994b9813..cb77b4e86 100644 --- a/extra/src/ips_options/ips_urg.cc +++ b/extra/src/ips_options/ips_urg.cc @@ -41,7 +41,7 @@ static const char* s_name = "urg"; -// FIXIT profiling is desirable but must be refactored to +// FIXIT-H profiling is desirable but must be refactored to // avoid dependence on snort_config.h which snowballs //#undef PERF_PROFILING @@ -50,7 +50,7 @@ static THREAD_LOCAL ProfileStats tcpUrgPerfStats; //------------------------------------------------------------------------- // range check //------------------------------------------------------------------------- -// FIXIT this is a stub until we can use range.{h,cc} +// FIXIT-L this is a stub until we can use range.{h,cc} struct RangeCheck { diff --git a/extra/src/search_engines/sfksearch.cc b/extra/src/search_engines/sfksearch.cc index 71abb4efb..a5eab1757 100644 --- a/extra/src/search_engines/sfksearch.cc +++ b/extra/src/search_engines/sfksearch.cc @@ -56,7 +56,7 @@ static void KTrieFree(KTRIENODE *n); -static unsigned int mtot = 0; // FIXIT 1 / process +static unsigned int mtot = 0; unsigned int KTrieMemUsed(void) { diff --git a/src/actions/act_replace.cc b/src/actions/act_replace.cc index 6273a7f58..e1ac578d7 100644 --- a/src/actions/act_replace.cc +++ b/src/actions/act_replace.cc @@ -34,8 +34,8 @@ static const char* s_name = "rewrite"; -// FIXIT ips_replace.cc should part of this lib -// FIXIT enforce that a rule with a replace option has a replace action +// FIXIT-L ips_replace.cc should part of this lib +// FIXIT-L enforce that a rule with a replace option has a replace action // (and vice-versa) //-------------------------------------------------------------------------- // queue foo diff --git a/src/actions/act_replace.h b/src/actions/act_replace.h index f7e102ba9..912df26b0 100644 --- a/src/actions/act_replace.h +++ b/src/actions/act_replace.h @@ -22,7 +22,7 @@ #include -// FIXIT these prevent ips replace option and action +// FIXIT-M these prevent ips replace option and action // from being dynamically built void Replace_ResetQueue(void); void Replace_QueueChange(const std::string&, unsigned); diff --git a/src/actions/actions.cc b/src/actions/actions.cc index 7f28d590a..ca684f255 100644 --- a/src/actions/actions.cc +++ b/src/actions/actions.cc @@ -53,7 +53,7 @@ int AlertAction(Packet* p, const OptTreeNode* otn) /* Call OptTreeNode specific output functions */ if(otn->outputFuncs) { - ListHead lh; // FIXIT "kinda hackish" + ListHead lh; // FIXIT-L "kinda hackish" lh.LogList = otn->outputFuncs; CallLogFuncs(p, otn, &lh); } diff --git a/src/codecs/ip/cd_icmp4.cc b/src/codecs/ip/cd_icmp4.cc index 564f2b44a..e7f86ca41 100644 --- a/src/codecs/ip/cd_icmp4.cc +++ b/src/codecs/ip/cd_icmp4.cc @@ -363,7 +363,7 @@ struct IcmpHdr { bool Icmp4Codec::encode(EncState* enc, Buffer* out, const uint8_t* /*raw_in*/) { - // FIXIT: speak with Russ, then get rid of commented lines + // FIXIT-J: speak with Russ, then get rid of commented lines // uint8_t* p; IcmpHdr* ho; diff --git a/src/codecs/ip/cd_udp.cc b/src/codecs/ip/cd_udp.cc index 1a1aad0ac..8e9630afb 100644 --- a/src/codecs/ip/cd_udp.cc +++ b/src/codecs/ip/cd_udp.cc @@ -60,7 +60,7 @@ static const Parameter udp_params[] = { "enable_gtp", Parameter::PT_BOOL, nullptr, "false", "decode GTP encapsulations" }, - // FIXIT use PT_BIT_LIST + // FIXIT-L use PT_BIT_LIST { "gtp_ports", Parameter::PT_STRING, nullptr, "'2152 3386'", "set GTP ports" }, @@ -93,7 +93,7 @@ public: { if ( v.is("deep_teredo_inspection") ) { - sc->enable_teredo = v.get_long(); // FIXIT move to existing bitfield + sc->enable_teredo = v.get_long(); // FIXIT-L move to existing bitfield } else if ( v.is("gtp_ports") ) { @@ -102,7 +102,7 @@ public: else if ( v.is("enable_gtp") ) { if ( v.get_bool() ) - sc->enable_gtp = 1; // FIXIT move to existing bitfield + sc->enable_gtp = 1; // FIXIT-L move to existing bitfield } else { diff --git a/src/codecs/link/cd_mpls.cc b/src/codecs/link/cd_mpls.cc index 60d26f282..cc69a8990 100644 --- a/src/codecs/link/cd_mpls.cc +++ b/src/codecs/link/cd_mpls.cc @@ -84,12 +84,12 @@ public: if ( v.is("enable_mpls_multicast") ) { if ( v.get_bool() ) - sc->run_flags |= RUN_FLAG__MPLS_MULTICAST; // FIXIT move to existing bitfield + sc->run_flags |= RUN_FLAG__MPLS_MULTICAST; // FIXIT-L move to existing bitfield } else if ( v.is("enable_mpls_overlapping_ip") ) { if ( v.get_bool() ) - sc->run_flags |= RUN_FLAG__MPLS_OVERLAPPING_IP; // FIXIT move to existing bitfield + sc->run_flags |= RUN_FLAG__MPLS_OVERLAPPING_IP; // FIXIT-L move to existing bitfield } else if ( v.is("max_mpls_stack_depth") ) { diff --git a/src/detection/detect.cc b/src/detection/detect.cc index 7320f01b4..ec51fbc3f 100644 --- a/src/detection/detect.cc +++ b/src/detection/detect.cc @@ -239,7 +239,7 @@ void CallAlertFuncs(Packet* p, const OptTreeNode* otn, ListHead* head) pc.total_alert_pkts++; #if 0 - // FIXIT this should be a generic feature of otn + // FIXIT-M this should be a generic feature of otn if ( otn->sigInfo.generator != GENERATOR_SPP_REPUTATION ) { /* Don't include IP Reputation events in count */ @@ -319,7 +319,7 @@ int Detect(Packet * p) return 0; } - // FIXIT: Curently, if a rule is found on any IP layer, we + // FIXIT-M: Curently, if a rule is found on any IP layer, we // perform the detect routine on the entire packet. // Instead, we should only perform detect on that // layer!! diff --git a/src/detection/detection_options.cc b/src/detection/detection_options.cc index 1d73c7b8c..e9347649f 100644 --- a/src/detection/detection_options.cc +++ b/src/detection/detection_options.cc @@ -849,7 +849,7 @@ static void detection_option_node_update_otn_stats( if (node->option_type == RULE_OPTION_TYPE_LEAF_NODE) { /* Update stats for this otn */ - // FIXIT should be sum of instances (only called from main thread) + // FIXIT-H should be sum of instances (only called from main thread) OptTreeNode *otn = (OptTreeNode *)node->option_data; OtnState* state = otn->state + get_instance_id(); state->ticks += local_stats.ticks; diff --git a/src/detection/detection_util.h b/src/detection/detection_util.h index 1b84e178c..9e2ab4eb7 100644 --- a/src/detection/detection_util.h +++ b/src/detection/detection_util.h @@ -153,7 +153,7 @@ static inline void DetectReset() ClearHttpBuffers(); } -int IsGzipData(Flow*); // FIXIT these from HI +int IsGzipData(Flow*); // FIXIT-M these from HI int IsJSNormData(Flow*); #endif diff --git a/src/detection/fpcreate.cc b/src/detection/fpcreate.cc index 07c5b2b82..12057aa06 100644 --- a/src/detection/fpcreate.cc +++ b/src/detection/fpcreate.cc @@ -1149,7 +1149,7 @@ static int fpAddPortGroupRule( return -1; // skip builtin rules - if ( !otn->sigInfo.text_rule ) // FIXIT must be set for so rules too! + if ( !otn->sigInfo.text_rule ) // FIXIT-H must be set for so rules too! return -1; /* Rule not enabled */ diff --git a/src/detection/fpdetect.cc b/src/detection/fpdetect.cc index f72218adf..e7ee165c9 100644 --- a/src/detection/fpdetect.cc +++ b/src/detection/fpdetect.cc @@ -847,7 +847,7 @@ static inline int fpFinalSelectEvent(OTNX_MATCH_DATA *o, Packet *p) ** 1 if flagged ** */ -// FIXIT this should include frags now that they are in session +// FIXIT-H this should include frags now that they are in session static inline int fpAddSessionAlert(Packet *p, OptTreeNode *otn) { if ( !p->flow ) @@ -878,7 +878,7 @@ static inline int fpAddSessionAlert(Packet *p, OptTreeNode *otn) ** 1 if alert previously generated ** */ -// FIXIT this should include frags now that they are in session +// FIXIT-H this should include frags now that they are in session static inline int fpSessionAlerted(Packet *p, OptTreeNode *otn) { SigInfo *si = &otn->sigInfo; @@ -960,7 +960,7 @@ static inline int fpEvalHeaderSW(PORT_GROUP *port_group, Packet *p, if (ip_rule) { - // FIXIT -- Copying p->ip_data may be unnecessary because when + // FIXIT-J -- Copying p->ip_data may be unnecessary because when // finished evaluating, ip_api will be the innermost // layer. Right now, ip_api should already be the // innermost layer @@ -1001,7 +1001,7 @@ static inline int fpEvalHeaderSW(PORT_GROUP *port_group, Packet *p, ** re-inject the stream we have. */ - // FIXIT sdf etc. runs here + // FIXIT-M sdf etc. runs here if ( fp->inspect_stream_insert || !(p->packet_flags & PKT_STREAM_INSERT) ) { @@ -1076,7 +1076,7 @@ static inline int fpEvalHeaderSW(PORT_GROUP *port_group, Packet *p, ** payload, in case any of the rules have the ** 'rawbytes' option. */ - // FIXIT alt buf and file data should be obtained from + // FIXIT-H alt buf and file data should be obtained from // inspector gadget as an extension of above so = port_group->pgPms[PM_TYPE__CONTENT]; diff --git a/src/detection/generators.h b/src/detection/generators.h index 8d6f781e1..4eb399f08 100644 --- a/src/detection/generators.h +++ b/src/detection/generators.h @@ -22,7 +22,7 @@ #ifndef GENERATORS_H #define GENERATORS_H -// FIXIT migrate all defines to respective modules and delete this file +// FIXIT-M migrate all defines to respective modules and delete this file #define GENERATOR_SNORT_ENGINE 1 diff --git a/src/detection/signature.h b/src/detection/signature.h index 5768bb435..df3f64058 100644 --- a/src/detection/signature.h +++ b/src/detection/signature.h @@ -63,7 +63,7 @@ void FPrintReference(FILE *, ReferenceNode *); /* struct for rule classification */ typedef struct _ClassType { - // FIXIT type and name are backwards (name -> text, type -> name) + // FIXIT-L type and name are backwards (name -> text, type -> name) char *type; /* classification type */ int id; /* classification id */ char *name; /* "pretty" classification name */ diff --git a/src/detection/tag.cc b/src/detection/tag.cc index 974094341..a731ca67d 100644 --- a/src/detection/tag.cc +++ b/src/detection/tag.cc @@ -107,7 +107,7 @@ typedef struct _TagNode /* G L O B A L S **************************************************/ static THREAD_LOCAL SFXHASH *host_tag_cache_ptr = nullptr; -// FIXIT utilize Flow instead of separate cache +// FIXIT-M utilize Flow instead of separate cache static THREAD_LOCAL SFXHASH *ssn_tag_cache_ptr = nullptr; static THREAD_LOCAL uint32_t last_prune_time = 0; diff --git a/src/events/event.cc b/src/events/event.cc index d87b345ee..68b8751de 100644 --- a/src/events/event.cc +++ b/src/events/event.cc @@ -30,8 +30,8 @@ #include "snort.h" -THREAD_LOCAL uint16_t event_id; // FIXIT also incremented in fpLogEvent() -THREAD_LOCAL SigInfo sig_info; // FIXIT move to stack +THREAD_LOCAL uint16_t event_id; // FIXIT-M also incremented in fpLogEvent() +THREAD_LOCAL SigInfo sig_info; // FIXIT-M move to stack void SetEvent( Event *event, uint32_t generator, uint32_t id, uint32_t rev, diff --git a/src/events/event_wrapper.cc b/src/events/event_wrapper.cc index d358506ba..81b299f0b 100644 --- a/src/events/event_wrapper.cc +++ b/src/events/event_wrapper.cc @@ -75,7 +75,7 @@ uint32_t GenerateSnortEvent(Packet *p, uint32_t gid, uint32_t sid) fpLogEvent(rtn, otn, p); - return 0; //otn->event_data.event_id; // FIXIT EVENT + return 0; //otn->event_data.event_id; // FIXIT-H EVENT } /** diff --git a/src/file_api/file_mime_process.cc b/src/file_api/file_mime_process.cc index f9c25728d..0f205833d 100644 --- a/src/file_api/file_mime_process.cc +++ b/src/file_api/file_mime_process.cc @@ -1063,7 +1063,7 @@ void init_mime(void) mime_hdr_search_mpse = search_api->search_instance_new(); if (mime_hdr_search_mpse == NULL) { - // FIXIT make configurable or at least fall back to any + // FIXIT-M make configurable or at least fall back to any // available search engine FatalError("Could not instantiate ac_bnfa search engine.\n"); } diff --git a/src/file_api/libs/file_sha256.h b/src/file_api/libs/file_sha256.h index 6f244bbed..3a6918097 100644 --- a/src/file_api/libs/file_sha256.h +++ b/src/file_api/libs/file_sha256.h @@ -37,7 +37,7 @@ #ifdef HAVE_OPENSSL_SHA #include #define SHA256CONTEXT SHA256_CTX -#define SHA256INIT SHA256_Init // FIXIT these are deprecated +#define SHA256INIT SHA256_Init // FIXIT-M these are deprecated #define SHA256UPDATE SHA256_Update #define SHA256FINAL SHA256_Final #else diff --git a/src/filters/detection_filter.cc b/src/filters/detection_filter.cc index 1187bd217..91f7918cf 100644 --- a/src/filters/detection_filter.cc +++ b/src/filters/detection_filter.cc @@ -102,7 +102,7 @@ void detection_filter_init(DetectionFilterConfig* df_config) detection_filter_hash = sfthd_local_new(df_config->memcap); if ( detection_filter_hash == NULL ) - return; // FIXIT this is fatal + return; // FIXIT-H this is fatal } } diff --git a/src/filters/rate_filter.cc b/src/filters/rate_filter.cc index 5df9f31bd..cdf3128a4 100644 --- a/src/filters/rate_filter.cc +++ b/src/filters/rate_filter.cc @@ -175,7 +175,7 @@ void RateFilter_ResetActive (void) void RateFilter_PrintConfig(RateFilterConfig*) { - // FIXIT print from module + // FIXIT-L print from module //_printThresholdContext(config); } diff --git a/src/filters/sfthd.cc b/src/filters/sfthd.cc index 68bce11f5..5c22d0185 100644 --- a/src/filters/sfthd.cc +++ b/src/filters/sfthd.cc @@ -656,7 +656,7 @@ int sfthd_create_threshold( sfthd_node.seconds = seconds; sfthd_node.ip_address= ip_address; - // FIXIT convert to std::vector + // FIXIT-L convert to std::vector sfDynArrayCheckBounds ((void **)&thd_objs->sfthd_garray, policyId, &thd_objs->numPoliciesAllocated); if (thd_objs->sfthd_garray[policyId] == NULL) { diff --git a/src/flow/expect_cache.cc b/src/flow/expect_cache.cc index 499864c4f..7e83bba10 100644 --- a/src/flow/expect_cache.cc +++ b/src/flow/expect_cache.cc @@ -23,11 +23,11 @@ #include #include "time/packet_time.h" -#include "stream/stream_api.h" // FIXIT bad dependency +#include "stream/stream_api.h" // FIXIT-M bad dependency #include "zhash.h" /* Reasonably small, and prime */ -// FIXIT size based on max_tcp + max_udp? +// FIXIT-L size based on max_tcp + max_udp? #define MAX_HASH 1021 #define MAX_LIST 8 #define MAX_DATA 4 @@ -64,8 +64,7 @@ // -- matching expected sessions are pulled off from the head of the node's // list struct chain // -// FIXIT -// -- expiration is by node struct but should be by list struct, ie +// FIXIT-M expiration is by node struct but should be by list struct, ie // individual sessions, not all sessions to a given 3-tuple // (this would make pruning a little harder unless we add linkage // a la FlowCache) diff --git a/src/flow/flow.cc b/src/flow/flow.cc index c85fd83c5..abefe75c0 100644 --- a/src/flow/flow.cc +++ b/src/flow/flow.cc @@ -34,7 +34,7 @@ unsigned FlowData:: flow_id = 0; -// FIXIT can't inline SO_PUBLIC ctor and dtor in header or we get problems: +// FIXIT-H can't inline SO_PUBLIC ctor and dtor in header or we get problems: // ld: warning: direct access in FlowData::FlowData(unsigned int, // Inspector*) to global weak symbol vtable for FlowData means the weak // symbol cannot be overridden at runtime. This was likely caused by @@ -61,7 +61,7 @@ Flow::Flow (int proto) memset(this, 0, sizeof(*this)); protocol = proto; - // FIXIT getFlowbitSizeInBytes() should be attribute of ??? + // FIXIT-M getFlowbitSizeInBytes() should be attribute of ??? (or eliminate) /* use giFlowbitSize - 1, since there is already 1 byte in the * StreamFlowData structure */ size_t sz = sizeof(StreamFlowData) + getFlowbitSizeInBytes() - 1; @@ -92,7 +92,7 @@ void Flow::reset() session->cleanup(); free_application_data(); } - // FIXIT cleanup() winds up calling clear() + // FIXIT-H cleanup() winds up calling clear() if ( ssn_client ) { ssn_client->rem_ref(); @@ -427,7 +427,7 @@ void Flow::set_ttl (Packet* p, bool client) */ if (outer_ip_api.is_valid()) { - // FIXIT!! -- Do we want more than just the outermost + // FIXIT-J!! -- Do we want more than just the outermost // and innermost ttl()? outer_ttl = outer_ip_api.ttl(); inner_ttl = p->ip_api.ttl(); diff --git a/src/flow/flow.h b/src/flow/flow.h index 5e336a299..ffacf2cf6 100644 --- a/src/flow/flow.h +++ b/src/flow/flow.h @@ -195,7 +195,7 @@ public: gadget = nullptr; }; -public: // FIXIT privatize if possible +public: // FIXIT-M privatize if possible // these fields are const after initialization const FlowKey* key; class Session* session; @@ -215,9 +215,9 @@ public: // FIXIT privatize if possible const char* service; int flow_state; - FlowState s5_state; // FIXIT rename this (s5 not appropriate) + FlowState s5_state; // FIXIT-L rename this (s5 not appropriate) - sfip_t client_ip; // FIXIT family and bits should be changed to uint16_t + sfip_t client_ip; // FIXIT-L family and bits should be changed to uint16_t sfip_t server_ip; // or uint8_t to reduce sizeof from 24 to 20 uint64_t expire_time; diff --git a/src/flow/flow_cache.cc b/src/flow/flow_cache.cc index 45844308f..6f42206e6 100644 --- a/src/flow/flow_cache.cc +++ b/src/flow/flow_cache.cc @@ -32,7 +32,6 @@ #include "zhash.h" #define SESSION_CACHE_FLAG_PURGING 0x01 -#define SESSION_CACHE_FLAG_PRUNING 0x02 // FIXIT not used? //------------------------------------------------------------------------- // FlowCache stuff @@ -183,7 +182,7 @@ uint32_t FlowCache::prune_stale(uint32_t thetime, Flow *save_me) while ( flow ) { - // FIXIT this loops forever if 1 flow in cache + // FIXIT-L this loops forever if 1 flow in cache if(flow == save_me) hash_table->touch(); @@ -211,7 +210,7 @@ uint32_t FlowCache::prune_stale(uint32_t thetime, Flow *save_me) uint32_t FlowCache::prune_unis() { // we may have many or few unis; need to find reasonable ratio - // FIXIT max_uni should be based on typical ratios seen in perfmon + // FIXIT-L max_uni should be based on typical ratios seen in perfmon const uint32_t max_uni = (max_flows >> 2) + 1; Flow* curr = uni_tail->prev; @@ -247,7 +246,7 @@ uint32_t FlowCache::prune_excess(bool memCheck, Flow *save_me) while ( (hash_table->get_count() > 1) && ((!memCheck && ((hash_table->get_count() > max_cap) || !pruned)) || - (memCheck && tcp_memcap->at_max()) )) // FIXIT remove explicit dependence on tcp_memcap + (memCheck && tcp_memcap->at_max()) )) // FIXIT-M remove explicit dependence on tcp_memcap { unsigned int blocks = 0; Flow* flow = (Flow*)hash_table->first(); diff --git a/src/flow/flow_control.cc b/src/flow/flow_control.cc index f079865f7..89c2e232e 100644 --- a/src/flow/flow_control.cc +++ b/src/flow/flow_control.cc @@ -117,7 +117,7 @@ Flow* FlowControl::new_flow (const FlowKey* key) return cache->get(key); } -// FIXIT cache* can be put in flow so that lookups by +// FIXIT-L cache* can be put in flow so that lookups by // protocol are obviated for existing / initialized flows void FlowControl::delete_flow (const FlowKey* key) { diff --git a/src/flow/session.h b/src/flow/session.h index eb03eeb52..bdb6acfbb 100644 --- a/src/flow/session.h +++ b/src/flow/session.h @@ -43,7 +43,7 @@ protected: Session(Flow* f) { flow = f; }; public: - Flow* flow; // FIXIT use reference? + Flow* flow; // FIXIT-L use reference? }; #endif diff --git a/src/framework/inspector.h b/src/framework/inspector.h index d977ef020..a4d92964b 100644 --- a/src/framework/inspector.h +++ b/src/framework/inspector.h @@ -42,7 +42,7 @@ struct InspectionBuffer enum Type { IBT_KEY, IBT_HEADER, IBT_BODY, - IBT_ALT, IBT_FILE, // FIXIT alt and file data are tbd + IBT_ALT, IBT_FILE, // FIXIT-M alt and file data are tbd IBT_MAX }; const uint8_t* data; @@ -140,7 +140,6 @@ typedef void (*InspectDelFunc)(Inspector*); typedef void (*InspectFunc)(); typedef class Session* (*InspectSsnFunc)(class Flow*); -// FIXIT ensure all provide stats struct InspectApi { BaseApi base; diff --git a/src/framework/ips_option.h b/src/framework/ips_option.h index ef9c5dc70..819c81fb0 100644 --- a/src/framework/ips_option.h +++ b/src/framework/ips_option.h @@ -98,9 +98,8 @@ private: option_type_t type; }; -enum RuleOptType // FIXIT is this still useful? +enum RuleOptType { - OPT_TYPE_ACTION = 0, OPT_TYPE_LOGGING, OPT_TYPE_DETECTION, OPT_TYPE_META, @@ -116,8 +115,9 @@ struct IpsApi { BaseApi base; RuleOptType type; - unsigned max_per_rule; // FIXIT this must be enforced - unsigned protos; + + unsigned max_per_rule; // FIXIT-H this must be enforced + unsigned protos; // FIXIT-H enforce or delete IpsOptFunc pinit; IpsOptFunc pterm; diff --git a/src/framework/logger.h b/src/framework/logger.h index cfab01462..97c7e8978 100644 --- a/src/framework/logger.h +++ b/src/framework/logger.h @@ -67,7 +67,6 @@ protected: typedef Logger* (*LogNewFunc)(struct SnortConfig*, class Module*); typedef void (*LogDelFunc)(Logger*); -// FIXIT ensure all eh provide stats struct LogApi { BaseApi base; diff --git a/src/framework/module.h b/src/framework/module.h index 94e547580..ed389d16b 100644 --- a/src/framework/module.h +++ b/src/framework/module.h @@ -18,11 +18,11 @@ */ // module.h author Russ Combs -// FIXIT -// -- add lua module default -// -- add set_default method -// -- add trace param(s) -// -- add memcap related +// FIXIT-H add brief help string to modules +// FIXIT-H add optional default config to modules +// FIXIT-M add trace param(s) +// FIXIT-M add memcap related +// FIXIT-L add set_default method #ifndef MODULE_H #define MODULE_H @@ -51,7 +51,6 @@ struct RuleMap struct ProfileStats; -// FIXIT add brief help string to modules class Module { public: diff --git a/src/framework/parameter.cc b/src/framework/parameter.cc index b0853a33a..d99e45030 100644 --- a/src/framework/parameter.cc +++ b/src/framework/parameter.cc @@ -35,7 +35,7 @@ static bool valid_bool(Value& v, const char*) return v.get_type() == Value::VT_BOOL; } -// FIXIT allow multiple , separated ranges +// FIXIT-L allow multiple , separated ranges static bool valid_int(Value& v, const char* r) { if ( !r ) @@ -67,7 +67,7 @@ static bool valid_int(Value& v, const char* r) return true; } -// FIXIT allow multiple , separated ranges +// FIXIT-L allow multiple , separated ranges static bool valid_real(Value& v, const char* r) { if ( !r ) diff --git a/src/framework/parameter.h b/src/framework/parameter.h index 148e2c82f..33cadc03b 100644 --- a/src/framework/parameter.h +++ b/src/framework/parameter.h @@ -36,6 +36,7 @@ struct Parameter PT_REAL, // double PT_PORT, // 0 to 64K-1 unless specified otherwise PT_STRING, // any string less than len chars + // range = "(optional)" if not required (eg on cmd line) PT_SELECT, // any string appearing in range PT_MULTI, // one or more strings appearing in range PT_ENUM, // string converted to unsigned by range sequence @@ -50,7 +51,7 @@ struct Parameter const char* name; Type type; const void* range; // nullptr|const char*|const Parameter* - const char* deflt; // FIXIT add defaults for tables and lists + const char* deflt; const char* help; const char* get_type() const; diff --git a/src/framework/plug_data.h b/src/framework/plug_data.h index ede4ba0b2..18ab7026e 100644 --- a/src/framework/plug_data.h +++ b/src/framework/plug_data.h @@ -23,8 +23,6 @@ #include "framework/base_api.h" -// FIXIT this must be tied to SnortConfig and moved to trash - struct SnortConfig; // this is the current version of the api diff --git a/src/hash/zhash.cc b/src/hash/zhash.cc index 58b9fe8e5..960a1458e 100644 --- a/src/hash/zhash.cc +++ b/src/hash/zhash.cc @@ -243,7 +243,7 @@ ZHash::ZHash(int rows, int keysz) sfhashfcn = sfhashfcn_new(rows); if ( !sfhashfcn ) - return; // FIXIT can't just return + return; // FIXIT-H can't just return /* Allocate the array of node ptrs */ table = new ZHashNode*[rows]; diff --git a/src/helpers/process.cc b/src/helpers/process.cc index 933caa1f6..7f8c7df7f 100644 --- a/src/helpers/process.cc +++ b/src/helpers/process.cc @@ -156,7 +156,7 @@ const char* get_signal_name(PigSignal s) // If check needed, also check whether previous signal_handler is neither // SIG_IGN nor SIG_DFL -// FIXIT convert sigaction, etc. to c++11 +// FIXIT-L convert sigaction, etc. to c++11 static int add_signal(int sig, sighandler_t signal_handler, int check_needed) { #ifdef VALGRIND_TESTING @@ -195,7 +195,7 @@ void init_signals(void) sigset_t set; sigemptyset(&set); - // FIXIT this is undefined for multithreaded apps + // FIXIT-L this is undefined for multithreaded apps sigprocmask(SIG_SETMASK, &set, NULL); # else sigsetmask(0); diff --git a/src/ips_options/ips_byte_extract.cc b/src/ips_options/ips_byte_extract.cc index 7d7109aa2..d39a735f7 100644 --- a/src/ips_options/ips_byte_extract.cc +++ b/src/ips_options/ips_byte_extract.cc @@ -522,7 +522,7 @@ static IpsOption* byte_extract_ctor(Module* p, OptTreeNode* otn) ClearVarNames(otn->opt_func); data.var_number = AddVarNameToList(&data); - // FIXIT can this be handled by setting max_per_rule = 2? + // FIXIT-H can this be handled by setting max_per_rule = 2? if (data.var_number >= NUM_BYTE_EXTRACT_VARS) { ParseError("Rule has more than %d byte_extract variables.", diff --git a/src/ips_options/ips_byte_test.cc b/src/ips_options/ips_byte_test.cc index 5a2f705ac..c64c1d64e 100644 --- a/src/ips_options/ips_byte_test.cc +++ b/src/ips_options/ips_byte_test.cc @@ -124,7 +124,6 @@ static THREAD_LOCAL ProfileStats byteTestPerfStats; static const char* s_name = "byte_test"; -// FIXIT cloned from sf_snort_plugin_api.h #define CHECK_EQ 0 #define CHECK_NEQ 1 #define CHECK_LT 2 @@ -134,20 +133,9 @@ static const char* s_name = "byte_test"; #define CHECK_AND 6 #define CHECK_XOR 7 #define CHECK_ALL 8 -#define CHECK_ATLEASTONE 9 +#define CHECK_GT0 9 #define CHECK_NONE 10 -#define BT_LESS_THAN CHECK_LT -#define BT_EQUALS CHECK_EQ -#define BT_GREATER_THAN CHECK_GT -#define BT_AND CHECK_AND -#define BT_XOR CHECK_XOR -#define BT_GREATER_THAN_EQUAL CHECK_GTE -#define BT_LESS_THAN_EQUAL CHECK_LTE -#define BT_CHECK_ALL CHECK_ALL -#define BT_CHECK_ATLEASTONE CHECK_ATLEASTONE -#define BT_CHECK_NONE CHECK_NONE - #define BIG 0 #define LITTLE 1 @@ -335,45 +323,45 @@ int ByteTestOption::eval(Cursor& c, Packet*) switch(btd->opcode) { - case BT_LESS_THAN: if(value < cmp_value) - success = 1; - break; + case CHECK_LT: + success = (value < cmp_value); + break; - case BT_EQUALS: if(value == cmp_value) - success = 1; - break; + case CHECK_EQ: + success = (value == cmp_value); + break; - case BT_GREATER_THAN: if(value > cmp_value) - success = 1; - break; + case CHECK_GT: + success = (value > cmp_value); + break; - case BT_AND: if ((value & cmp_value) > 0) - success = 1; - break; + case CHECK_AND: + success = ((value & cmp_value) > 0); + break; - case BT_XOR: if ((value ^ cmp_value) > 0) - success = 1; - break; + case CHECK_XOR: + success = ((value ^ cmp_value) > 0); + break; - case BT_GREATER_THAN_EQUAL: if (value >= cmp_value) - success = 1; - break; + case CHECK_GTE: + success = (value >= cmp_value); + break; - case BT_LESS_THAN_EQUAL: if (value <= cmp_value) - success = 1; - break; + case CHECK_LTE: + success = (value <= cmp_value); + break; - case BT_CHECK_ALL: if ((value & cmp_value) == cmp_value) - success = 1; - break; + case CHECK_ALL: + success = ((value & cmp_value) == cmp_value); + break; - case BT_CHECK_ATLEASTONE: if ((value & cmp_value) != 0) - success = 1; - break; + case CHECK_GT0: + success = ((value & cmp_value) != 0); + break; - case BT_CHECK_NONE: if ((value & cmp_value) == 0) - success = 1; - break; + case CHECK_NONE: + success = ((value & cmp_value) == 0); + break; } if (btd->not_flag) @@ -411,36 +399,36 @@ static void parse_operator(const char* cptr, ByteTestData& idx) if (idx.not_flag && strlen(cptr) == 0) { - idx.opcode = BT_EQUALS; + idx.opcode = CHECK_EQ; } else { /* set the opcode */ switch(*cptr) { - case '<': idx.opcode = BT_LESS_THAN; + case '<': idx.opcode = CHECK_LT; cptr++; if (*cptr == '=') - idx.opcode = BT_LESS_THAN_EQUAL; + idx.opcode = CHECK_LTE; else cptr--; break; - case '=': idx.opcode = BT_EQUALS; + case '=': idx.opcode = CHECK_EQ; break; - case '>': idx.opcode = BT_GREATER_THAN; + case '>': idx.opcode = CHECK_GT; cptr++; if (*cptr == '=') - idx.opcode = BT_GREATER_THAN_EQUAL; + idx.opcode = CHECK_GTE; else cptr--; break; - case '&': idx.opcode = BT_AND; + case '&': idx.opcode = CHECK_AND; break; - case '^': idx.opcode = BT_XOR; + case '^': idx.opcode = CHECK_XOR; break; default: ParseError( diff --git a/src/ips_options/ips_content.cc b/src/ips_options/ips_content.cc index ceaf4273e..eb65fd908 100644 --- a/src/ips_options/ips_content.cc +++ b/src/ips_options/ips_content.cc @@ -227,7 +227,7 @@ static PatternMatchData* new_pmd() return pmd; } -// FIXIT must ensure that fast_pattern is applied to +// FIXIT-H must ensure that fast_pattern is applied to // a fast_pattern inspection buffer static int fast_pattern_count(OptTreeNode *otn, int list_type) { @@ -724,7 +724,7 @@ static void parse_fast_pattern_offset(PatternMatchData* pmd, const char *data) } pmd->fp_offset = offset; - pmd->fp = 1; // FIXIT must ensure current buffer is fp compatible + pmd->fp = 1; // FIXIT-H must ensure current buffer is fp compatible } static void parse_fast_pattern_length(PatternMatchData* pmd, const char *data) @@ -744,7 +744,7 @@ static void parse_fast_pattern_length(PatternMatchData* pmd, const char *data) } pmd->fp_length = length; - pmd->fp = 1; // FIXIT must ensure current buffer is fp compatible + pmd->fp = 1; // FIXIT-H must ensure current buffer is fp compatible } //------------------------------------------------------------------------- @@ -849,7 +849,7 @@ bool ContentModule::set(const char*, Value& v, SnortConfig*) pmd->no_case = 1; else if ( v.is("fast_pattern") ) - pmd->fp = 1; // FIXIT must ensure current buffer is fp compatible + pmd->fp = 1; // FIXIT-H must ensure current buffer is fp compatible else if ( v.is("fast_pattern_offset") ) parse_fast_pattern_offset(pmd, v.get_string()); diff --git a/src/ips_options/ips_content.h b/src/ips_options/ips_content.h index f6e3edcdf..a96aa3332 100644 --- a/src/ips_options/ips_content.h +++ b/src/ips_options/ips_content.h @@ -71,7 +71,7 @@ struct PatternMatchData uint8_t negated; /* search for "not this pattern" */ uint8_t pm_type; - // FIXIT wasting some memory here: + // FIXIT-L wasting some memory here: // - this is not used by content option logic directly // - and only used on current eval (not across packets) // (partly mitigated by only allocating if excpetion_flag is set) @@ -89,7 +89,7 @@ int PatternMatchAdjustRelativeOffsets( void*, PatternMatchData *dup_pmd, const uint8_t *current_cursor, const uint8_t *orig_cursor); -// FIXIT if really needed, would b better as specific method +// FIXIT-L if really needed, would b better as specific method // so PMD isn't exposed PatternMatchData* get_pmd(OptFpList*); bool is_fast_pattern_only(OptFpList*); diff --git a/src/ips_options/ips_detection_filter.cc b/src/ips_options/ips_detection_filter.cc index a1229e9d6..f5df600c1 100644 --- a/src/ips_options/ips_detection_filter.cc +++ b/src/ips_options/ips_detection_filter.cc @@ -19,7 +19,7 @@ ** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */ // ips_detection_filter.cc author Russ Combs -// FIXIT add DetectionFilterOption::eval() instead of special case +// FIXIT-L add DetectionFilterOption::eval() instead of special case #include diff --git a/src/ips_options/ips_flowbits.cc b/src/ips_options/ips_flowbits.cc index dc399a877..9e99a4291 100644 --- a/src/ips_options/ips_flowbits.cc +++ b/src/ips_options/ips_flowbits.cc @@ -295,7 +295,7 @@ static inline int boUnSetGrpBit(BITOP *BitOp, char *group) if( group == NULL ) return 0; - // FIXIT why is the hash lookup done at runtime for flowbits groups? + // FIXIT-M why is the hash lookup done at runtime for flowbits groups? // a pointer to flowbis_grp should be in flowbits config data // this *should* be safe but iff splay mode is disabled flowbits_grp = (FLOWBITS_GRP *)sfghash_find(flowbits_grp_hash, group); @@ -1205,14 +1205,14 @@ static void flowbits_dtor(IpsOption* p) delete p; } -// FIXIT updating statics during reload is bad, mkay? +// FIXIT-M updating statics during reload is bad, mkay? static void flowbits_verify(SnortConfig*) { FlowBitsVerify(); } #if 0 - // FIXIT if add_detection_option() finds a dup, then + // FIXIT-M if add_detection_option() finds a dup, then // we can leak the original group name if same as current // also, why use new group name instead of original? char *group_name = ((FLOWBITS_OP *)idx_dup)->group; diff --git a/src/ips_options/ips_fragoffset.cc b/src/ips_options/ips_fragoffset.cc index f5d19842c..5ea55cfff 100644 --- a/src/ips_options/ips_fragoffset.cc +++ b/src/ips_options/ips_fragoffset.cc @@ -184,7 +184,7 @@ static const IpsApi fragoffset_api = mod_dtor }, OPT_TYPE_DETECTION, - 0, 0, // FIXIT more than one fragoffset per rule? + 1, 0, nullptr, nullptr, nullptr, diff --git a/src/ips_options/ips_http.cc b/src/ips_options/ips_http.cc index ca866e9f5..194844678 100644 --- a/src/ips_options/ips_http.cc +++ b/src/ips_options/ips_http.cc @@ -93,7 +93,7 @@ int HttpIpsOption::eval(Cursor& c, Packet* p) if ( !p->flow || !p->flow->gadget ) rval = DETECTION_OPTION_NO_MATCH; - // FIXIT cache id at parse time for runtime use + // FIXIT-P cache id at parse time for runtime use else if ( !p->flow->gadget->get_buf(key, p, hb) ) rval = DETECTION_OPTION_NO_MATCH; diff --git a/src/ips_options/ips_http_header.cc b/src/ips_options/ips_http_header.cc index 495429dd5..58e36b7a3 100644 --- a/src/ips_options/ips_http_header.cc +++ b/src/ips_options/ips_http_header.cc @@ -159,7 +159,7 @@ int HttpHeaderOption::eval(Cursor& c, Packet* p) if ( !p->flow || !p->flow->gadget ) rval = DETECTION_OPTION_NO_MATCH; - // FIXIT cache id at parse time for runtime use + // FIXIT-P cache id at parse time for runtime use else if ( !p->flow->gadget->get_buf(s_name, p, hb) ) rval = DETECTION_OPTION_NO_MATCH; diff --git a/src/ips_options/ips_pcre.cc b/src/ips_options/ips_pcre.cc index e43b5cccc..c060dfb10 100644 --- a/src/ips_options/ips_pcre.cc +++ b/src/ips_options/ips_pcre.cc @@ -53,6 +53,11 @@ #define PCRE_STUDY_JIT_COMPILE 0 #endif +#define SNORT_PCRE_RELATIVE 0x00010 // relative to the end of the last match +#define SNORT_PCRE_INVERT 0x00020 // invert detect +#define SNORT_PCRE_ANCHORED 0x00040 +#define SNORT_OVERRIDE_MATCH_LIMIT 0x00080 // Override default limits on match & match recursion + static const char* s_name = "pcre"; /* @@ -697,7 +702,7 @@ static void pcre_dtor(IpsOption* p) delete p; } -// FIXIT the thread specific ovector can be allocated and deallocated +// FIXIT-L the thread specific ovector can be allocated and deallocated // from the main thread since it isn't literally thread local void pcre_tinit(SnortConfig* sc) { diff --git a/src/ips_options/ips_pcre.h b/src/ips_options/ips_pcre.h index 505cc4729..aa0b9c231 100644 --- a/src/ips_options/ips_pcre.h +++ b/src/ips_options/ips_pcre.h @@ -23,13 +23,6 @@ #include -// FIXIT poor encapsulation -#define SNORT_PCRE_RELATIVE 0x00010 // relative to the end of the last match -#define SNORT_PCRE_INVERT 0x00020 // invert detect -#define SNORT_PCRE_RAWBYTES 0x00040 // Don't use decoded buffer (if available) -#define SNORT_PCRE_ANCHORED 0x00080 -#define SNORT_OVERRIDE_MATCH_LIMIT 0x00100 // Override default limits on match & match recursion - #include struct PcreData diff --git a/src/ips_options/ips_session.cc b/src/ips_options/ips_session.cc index 1157f1614..453bde0a1 100644 --- a/src/ips_options/ips_session.cc +++ b/src/ips_options/ips_session.cc @@ -40,7 +40,7 @@ * Warning, this plugin may slow Snort *way* down! * */ -// FIXIT delete this (sp_session) and use session tag instead +// FIXIT-L delete this (sp_session) and use session tag instead #ifdef HAVE_CONFIG_H #include "config.h" diff --git a/src/ips_options/ips_tag.cc b/src/ips_options/ips_tag.cc index bf707b277..4b2fda96a 100644 --- a/src/ips_options/ips_tag.cc +++ b/src/ips_options/ips_tag.cc @@ -17,7 +17,7 @@ ** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */ // ips_tag.cc author Russ Combs -// FIXIT add TagOption::eval() instead of special case +// FIXIT-L add TagOption::eval() instead of special case #include @@ -95,7 +95,7 @@ bool TagModule::end(const char*, int, SnortConfig*) return true; } -// FIXIT error if named option is set multiple times (general problem) +// FIXIT-L error if named option is set multiple times (general problem) // eg: tag:session, packets 10, packets 20; bool TagModule::set(const char*, Value& v, SnortConfig*) { diff --git a/src/ips_options/range.h b/src/ips_options/range.h index dece3be0b..3b1a782bf 100644 --- a/src/ips_options/range.h +++ b/src/ips_options/range.h @@ -21,9 +21,8 @@ #ifndef RANGE_H #define RANGE_H -// FIXIT ideally this would be in framework/ and we'd have just one copy -// but that breaks dynamic builds so each dynamic ips option plugin has -// its own copy for now. +// FIXIT-M ideally this would be in framework/ and we'd have just one copy +// but that breaks dynamic builds so each dynamic client has its own for now. // unfortunately, <> was implemented inconsistently. eg: // dsize implements <> as ( a <= c && c <= b ) and @@ -48,7 +47,7 @@ struct RangeCheck bool operator==(const RangeCheck&) const; void init(); - // FIXIT add ttl style syntax + // FIXIT-L add ttl style syntax bool parse(const char* s); bool eval(long); }; diff --git a/src/log/log_text.cc b/src/log/log_text.cc index 67b920ae8..51c7fda1b 100644 --- a/src/log/log_text.cc +++ b/src/log/log_text.cc @@ -429,7 +429,7 @@ void Log2ndHeader(TextLog* log, Packet* p) default: if (ScLogVerbose()) { - // FIXIT should only be output once! + // FIXIT-L should only be output once! ErrorMessage("Datalink %i type 2nd layer display is not " "supported\n", DAQ_GetBaseProtocol()); } @@ -1644,7 +1644,7 @@ static void LogPacketType(TextLog* log, Packet* p) TextLog_Print(log, "%s", "Frag reassembled packet"); break; default: - // FIXIT do we get here for portscan or sdf? + // FIXIT-L do we get here for portscan or sdf? TextLog_Print(log, "%s", "Cooked packet"); break; } @@ -1691,7 +1691,7 @@ void LogIPPkt(TextLog* log, int type, Packet * p) } - // FIXIT --> log everything in order!! + // FIXIT-J --> log everything in order!! ip::IpApi tmp_api = p->ip_api; int8_t num_layer = 0; bool first = true; diff --git a/src/log/messages.cc b/src/log/messages.cc index 1965b4505..884e01589 100644 --- a/src/log/messages.cc +++ b/src/log/messages.cc @@ -249,7 +249,7 @@ NORETURN void FatalError(const char *format,...) } #if 0 - // FIXIT need to stop analyzers / workers + // FIXIT-H need to stop analyzers / workers // and they should handle the DAQ break / abort if ( SnortIsInitializing() ) { @@ -259,8 +259,8 @@ NORETURN void FatalError(const char *format,...) else #endif { - // FIXIT this makes no sense from main thread - // FIXIT exit() segfaults too; looks like something borked in dylib + // FIXIT-H this makes no sense from main thread + // exit() segfaults too; looks like something borked in dylib exit(EXIT_FAILURE); } } diff --git a/src/log/messages.h b/src/log/messages.h index f79760b1e..210b07f01 100644 --- a/src/log/messages.h +++ b/src/log/messages.h @@ -49,7 +49,7 @@ struct ThrottleInfo void ErrorMessageThrottled(ThrottleInfo*,const char*, ...) __attribute__((format (printf, 2, 3))); -// FIXIT do not call FatalError() during runtime +// FIXIT-M do not call FatalError() during runtime NORETURN void FatalError(const char*, ...) __attribute__((format (printf, 1, 2))); void PrintPacketData(const uint8_t*, const uint32_t); diff --git a/src/loggers/alert_csv.cc b/src/loggers/alert_csv.cc index a0f09c9d2..46a0871fe 100644 --- a/src/loggers/alert_csv.cc +++ b/src/loggers/alert_csv.cc @@ -66,7 +66,7 @@ static const char* csv_deflt = static const Parameter csv_params[] = { - // FIXIT provide PT_FILE and PT_PATH and enforce no + // FIXIT-M provide PT_FILE and PT_PATH and enforce no // path chars in file (outputs file must be in instance dir) { "file", Parameter::PT_STRING, nullptr, "stdout", "name of alert file" }, @@ -77,7 +77,7 @@ static const Parameter csv_params[] = { "limit", Parameter::PT_INT, "0:", "0", "set limit (0 is unlimited)" }, - // FIXIT provide PT_UNITS that converts to multiplier automatically + // FIXIT-M provide PT_UNITS that converts to multiplier automatically { "units", Parameter::PT_ENUM, "B | K | M | G", "B", "bytes | KB | MB | GB" }, diff --git a/src/loggers/alert_sf_socket.cc b/src/loggers/alert_sf_socket.cc index 35ff4665a..ebaab8ede 100644 --- a/src/loggers/alert_sf_socket.cc +++ b/src/loggers/alert_sf_socket.cc @@ -61,7 +61,7 @@ using namespace std; // alert_sfsocket module //------------------------------------------------------------------------- -// FIXIT this file will probably fail to compile on Linux +// FIXIT-H this file will probably fail to compile on Linux static const Parameter sfsocket_params[] = { @@ -301,7 +301,7 @@ static OptTreeNode *OptTreeNode_Search(uint32_t, uint32_t sid) if(sid == 0) return NULL; - // FIXIT wow - this should be encapsulated somewhere ... + // FIXIT-H wow - this should be encapsulated somewhere ... for (hashNode = sfghash_findfirst(snort_conf->otn_map); hashNode; hashNode = sfghash_findnext(snort_conf->otn_map)) diff --git a/src/loggers/alert_syslog.cc b/src/loggers/alert_syslog.cc index bd559a276..f2628ef90 100644 --- a/src/loggers/alert_syslog.cc +++ b/src/loggers/alert_syslog.cc @@ -190,7 +190,7 @@ bool SyslogModule::end(const char*, int, SnortConfig*) // alert foo //------------------------------------------------------------------------- -// FIXIT can't message be put in Event? +// FIXIT-M can't message be put in Event? static void AlertSyslog( int priority, Packet *p, const char *msg, Event *event) { diff --git a/src/loggers/alert_unixsock.cc b/src/loggers/alert_unixsock.cc index 0012c2c88..9ed9a1b8f 100644 --- a/src/loggers/alert_unixsock.cc +++ b/src/loggers/alert_unixsock.cc @@ -57,7 +57,7 @@ struct pcap_pkthdr32 }; /* this struct is for the alert socket code.... */ -// FIXIT alert unix sock supports l2-l3-l4 encapsulations +// FIXIT-L alert unix sock supports l2-l3-l4 encapsulations const unsigned int ALERTMSG_LENGTH = 256; struct Alertpkt @@ -74,7 +74,7 @@ struct Alertpkt #define NOPACKET_STRUCT 0x1 /* no transport headers in packet */ #define NO_TRANSHDR 0x2 - uint8_t pkt[65535]; // FIXIT move to end and send actual size + uint8_t pkt[65535]; // FIXIT-L move to end and send actual size uint32_t gid; uint32_t sid; @@ -102,7 +102,7 @@ static THREAD_LOCAL UnixSock us; static const Parameter unixsock_params[] = { - // FIXIT add name param? + // FIXIT-L add name param? { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; @@ -121,7 +121,7 @@ static void get_alert_pkt( { DEBUG_WRAP(DebugMessage(DEBUG_LOG, "Logging Alert data!\n");); - // FIXIT ugh ... + // FIXIT-L ugh ... memset((char *)&us.alert,0,sizeof(us.alert)); us.alert.gid = event->sig_info->generator; @@ -147,7 +147,7 @@ static void get_alert_pkt( if (msg) { - // FIXIT ugh ... + // FIXIT-L ugh ... memmove( (void *)us.alert.alertmsg, (const void *)msg, strlen(msg)>ALERTMSG_LENGTH-1 ? ALERTMSG_LENGTH - 1 : strlen(msg)); } diff --git a/src/loggers/log_tcpdump.cc b/src/loggers/log_tcpdump.cc index 0e877ac05..f9c13f29d 100644 --- a/src/loggers/log_tcpdump.cc +++ b/src/loggers/log_tcpdump.cc @@ -176,7 +176,7 @@ static void LogTcpdumpSingle( pcap_dump((u_char *)context.dumpd,(struct pcap_pkthdr*)p->pkth,p->pkt); context.size += dumpSize; - if (!ScLineBufferedLogging()) // FIXIT misnomer + if (!ScLineBufferedLogging()) // FIXIT-L misnomer { fflush( (FILE*) context.dumpd ); } diff --git a/src/loggers/unified2.cc b/src/loggers/unified2.cc index a8107f895..808f741f9 100644 --- a/src/loggers/unified2.cc +++ b/src/loggers/unified2.cc @@ -183,7 +183,7 @@ static void Unified2InitFile(Unified2Config *config) fname_ptr = u2.filepath; } - // FIXIT should use open() instead of fopen() + // FIXIT-L should use open() instead of fopen() if ((u2.stream = fopen(fname_ptr, "wb")) == NULL) { FatalError("%s(%d) Could not open %s: %s\n", @@ -200,7 +200,7 @@ static void Unified2InitFile(Unified2Config *config) } /* If test mode, close and delete the file */ - if (ScTestMode()) // FIXIT eliminate test check; should always remove if empty + if (ScTestMode()) // FIXIT-L eliminate test check; should always remove if empty { fclose(u2.stream); u2.stream = NULL; diff --git a/src/main.cc b/src/main.cc index d25e812cf..9821d47b4 100644 --- a/src/main.cc +++ b/src/main.cc @@ -154,7 +154,7 @@ void Request::set(int f, const char* s) buf[sizeof(buf)-1] = '\0'; } -// FIXIT ignoring partial reads for now +// FIXIT-L ignoring partial reads for now // using simple text for now so can use telnet as client // but must parse commands out of stream (ending with \n) void Request::read(int f) @@ -167,7 +167,7 @@ void Request::read(int f) while ( n-- && isspace(buf[n]) ); } -// FIXIT supporting only simple strings for now +// FIXIT-L supporting only simple strings for now // should support var args formats void Request::respond(const char* s) const { @@ -177,7 +177,7 @@ void Request::respond(const char* s) const return; } if ( write(fd, s, strlen(s)) ) - return; // FIXIT count errors? + return; // FIXIT-L count errors? } void Request::show_prompt() const @@ -365,7 +365,7 @@ int main_quit(lua_State*) int main_help(lua_State*) { #if 0 - // FIXIT this should be generic for all modules + // FIXIT-H this should be generic for all modules RequestMap* map = cmd_set; while ( map->name ) @@ -425,7 +425,7 @@ static int signal_check() return 1; } -// FIXIT return true if something was done to avoid sleeping +// FIXIT-L return true if something was done to avoid sleeping static bool house_keeping() { signal_check(); @@ -443,9 +443,9 @@ static bool house_keeping() // socket foo //------------------------------------------------------------------------- -// FIXIT make these non-blocking -// FIXIT allow at least 2 remote controls -// FIXIT bind to configured ip including INADDR_ANY +// FIXIT-M make these non-blocking +// FIXIT-M allow at least 2 remote controls +// FIXIT-M bind to configured ip including INADDR_ANY // (default is loopback if enabled) static int listener = -1; static int remote_control = -1; @@ -463,7 +463,7 @@ static int socket_init() return -2; } - // FIXIT does this disable time wait for us? + // FIXIT-M does this disable time wait for us? int on = 1; setsockopt(listener, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on)); @@ -480,7 +480,7 @@ static int socket_init() return -3; } - // FIXIT configure max conns + // FIXIT-M configure max conns if ( listen(listener, 5) < 0 ) { FatalError("listen failed: %s\n", strerror(errno)); @@ -513,7 +513,7 @@ static int socket_conn() if ( remote_control < 0 ) return -1; - // FIXIT authenticate, use ssl ? + // FIXIT-L authenticate, use ssl ? return 0; } diff --git a/src/main/analyzer.cc b/src/main/analyzer.cc index b4c1fddf9..61483ef4c 100644 --- a/src/main/analyzer.cc +++ b/src/main/analyzer.cc @@ -68,7 +68,7 @@ bool Analyzer::execute(AnalyzerCommand ac) if ( command && command != AC_PAUSE ) return false; - // FIXIT executing a command while paused + // FIXIT-L executing a command while paused // will cause a resume command = ac; return true; diff --git a/src/main/analyzer.h b/src/main/analyzer.h index 56d7daf13..642f4a908 100644 --- a/src/main/analyzer.h +++ b/src/main/analyzer.h @@ -47,7 +47,7 @@ public: uint64_t get_count() { return count; }; const char* get_source() { return source; }; - // FIXIT add asynchronous response too + // FIXIT-M add asynchronous response too bool execute(AnalyzerCommand); void set_config(Swapper* ps) { swap = ps; }; diff --git a/src/main/help.cc b/src/main/help.cc index cacb0a302..0fb761900 100644 --- a/src/main/help.cc +++ b/src/main/help.cc @@ -83,7 +83,6 @@ static const char* snort_help = //------------------------------------------------------------------------- -// FIXIT must use SnortModule params void help_args(const char* pfx) { Module* m = get_snort_module(); diff --git a/src/main/modules.cc b/src/main/modules.cc index aec9b175a..126cb94ac 100644 --- a/src/main/modules.cc +++ b/src/main/modules.cc @@ -237,7 +237,7 @@ bool SearchEngineModule::set(const char*, Value& v, SnortConfig* sc) else if ( v.is("bleedover_warnings_enabled") ) { if ( v.get_bool() ) - fpDetectSetBleedOverWarnings(fp); // FIXIT these should take arg + fpDetectSetBleedOverWarnings(fp); // FIXIT-L these should take arg } else if ( v.is("enable_single_rule_group") ) { @@ -400,8 +400,8 @@ bool ProfileModule::set(const char* fqn, Value& v, SnortConfig* sc) p->append = v.get_long() + 1; else if ( v.is("name") ) - p->filename = SnortStrdup(v.get_string()); // FIXIT use c++ string - // FIXIT do this after log dir is set + p->filename = SnortStrdup(v.get_string()); // FIXIT-L use c++ string + // FIXIT-M do this after log dir is set //p->filename = ProcessFileOption(sc, v.get_string()); else @@ -414,7 +414,7 @@ bool ProfileModule::set(const char* fqn, Value& v, SnortConfig* sc) //------------------------------------------------------------------------- // classification module //------------------------------------------------------------------------- -// FIXIT signature.{h,cc} has type and name confused +// FIXIT-L signature.{h,cc} has type and name confused // the keys here make more sense static const Parameter classification_params[] = @@ -482,7 +482,7 @@ bool ClassificationsModule::set(const char*, Value& v, SnortConfig*) //------------------------------------------------------------------------- // reference module //------------------------------------------------------------------------- -// FIXIT signature.{h,cc} has type and name confused +// FIXIT-L signature.{h,cc} has type and name confused // the keys here make more sense static const Parameter reference_params[] = @@ -546,7 +546,7 @@ bool ReferencesModule::set(const char*, Value& v, SnortConfig*) static const Parameter alerts_params[] = { { "alert_file", Parameter::PT_STRING, nullptr, nullptr, - "set the alert output file name (FIXIT delete if not used)" }, + "set the alert output file name (FIXIT-H delete if not used)" }, { "alert_with_interface_name", Parameter::PT_BOOL, nullptr, "false", "include interface in alert info (fast, full, or syslog only)" }, @@ -720,7 +720,7 @@ bool OutputModule::set(const char*, Value& v, SnortConfig* sc) else if ( v.is("log_ipv6_extra_data") ) { if ( v.get_bool() ) - sc->log_ipv6_extra = 1; // FIXIT move to output|logging_flags + sc->log_ipv6_extra = 1; // FIXIT-M move to output|logging_flags } else if ( v.is("quiet") ) { @@ -884,7 +884,7 @@ bool PacketsModule::set(const char*, Value& v, SnortConfig* sc) static const Parameter daq_params[] = { - // FIXIT should be a list? + // FIXIT-L should be a list? { "dir", Parameter::PT_STRING, nullptr, nullptr, "directory where to search for DAQ plugins" }, @@ -894,11 +894,11 @@ static const Parameter daq_params[] = { "no_promisc", Parameter::PT_BOOL, nullptr, "false", "whether to put DAQ device into promiscuous mode" }, - // FIXIT range determined by available plugins + // FIXIT-H range determined by available plugins { "name", Parameter::PT_STRING, nullptr, "pcap", "select name of DAQ" }, - // FIXIT should be a list? + // FIXIT-L should be a list? { "var", Parameter::PT_STRING, nullptr, nullptr, "list of name=value DAQ-specific parameters" }, @@ -1207,7 +1207,7 @@ bool ProcessModule::set(const char*, Value& v, SnortConfig* sc) //------------------------------------------------------------------------- // vars module //------------------------------------------------------------------------- -// FIXIT signature.{h,cc} has type and name confused +// FIXIT-L signature.{h,cc} has type and name confused // the keys here make more sense static const Parameter vars_params[] = @@ -1494,7 +1494,7 @@ static const Parameter rate_filter_params[] = "count interval" }, { "new_action", Parameter::PT_SELECT, - // FIXIT range based on available action plugins + // FIXIT-H range based on available action plugins "alert | drop | log | pass | | reject | sdrop", "alert", "restrict filter to these addresses according to track" }, @@ -1629,7 +1629,7 @@ bool RuleStateModule::end(const char*, int idx, SnortConfig* sc) // hosts module //------------------------------------------------------------------------- -// FIXIT these are cloned from ip_module.cc and tcp_module.cc +// FIXIT-H these are cloned from ip_module.cc and tcp_module.cc static const char* ip_policies = "first | linux | bsd | bsd_right |last | windows | solaris"; diff --git a/src/main/policy.h b/src/main/policy.h index bbaff1809..50953c00c 100644 --- a/src/main/policy.h +++ b/src/main/policy.h @@ -31,7 +31,7 @@ typedef unsigned int PolicyId; -// FIXIT split into separate modules +// FIXIT-H split into separate modules //------------------------------------------------------------------------- // traffic stuff @@ -140,7 +140,7 @@ public: }; //------------------------------------------------------------------------- -// binding stuff - FIXIT tbd +// binding stuff - FIXIT-H tbd //------------------------------------------------------------------------- class PolicyMap diff --git a/src/main/snort.cc b/src/main/snort.cc index 2af89e39d..a22a41ef2 100644 --- a/src/main/snort.cc +++ b/src/main/snort.cc @@ -132,8 +132,8 @@ static void SnortCleanup(); //------------------------------------------------------------------------- // nascent policy management //------------------------------------------------------------------------- -// FIXIT need stub binding rule to set these for runtime -// FIXIT need to set these on load too somehow +// FIXIT-H need stub binding rule to set these for runtime +// FIXIT-H need to set these on load too somehow static THREAD_LOCAL NetworkPolicy* s_traffic_policy = nullptr; static THREAD_LOCAL InspectionPolicy* s_inspection_policy = nullptr; @@ -190,7 +190,7 @@ static void SetupMetadataCallback(void) // FIXDAQ #endif #if 0 -// FIXIT not yet used +// FIXIT-H not yet used static void restart() { int daemon_mode = ScDaemonMode(); @@ -229,7 +229,7 @@ static void restart() //------------------------------------------------------------------------- // perf stats -// FIXIT move these to appropriate modules +// FIXIT-M move these to appropriate modules //------------------------------------------------------------------------- #ifdef PERF_PROFILING @@ -324,7 +324,7 @@ static void SnortInit(int argc, char **argv) LogMessage("--------------------------------------------------\n"); - // FIXIT config plugin_path won't work like this + // FIXIT-H config plugin_path won't work like this Shell::init(); ModuleManager::init(); @@ -378,7 +378,7 @@ static void SnortInit(int argc, char **argv) ParseRules(snort_conf); - // FIXIT print should be through generic module list + // FIXIT-M print should be through generic module list // and only print configured / active stuff //detection_filter_print_config(snort_conf->detection_filter_config); //RateFilter_PrintConfig(snort_conf->rate_filter_config); @@ -412,7 +412,7 @@ static void SnortInit(int argc, char **argv) /* Finish up the pcap list and put in the queues */ Trough_SetUp(); - // FIXIT stuff like this that is also done in snort_config.cc::VerifyReload() + // FIXIT-L stuff like this that is also done in snort_config.cc::VerifyReload() // should be refactored if ((snort_conf->bpf_filter == NULL) && (snort_conf->bpf_file != NULL)) snort_conf->bpf_filter = read_infile(snort_conf->bpf_file); @@ -446,7 +446,7 @@ static void SnortInit(int argc, char **argv) // much initialization stuff in SnortInit() as possible and to restrict this // function to those things that depend on DAQ startup or non-root user/group. // -// FIXIT breaks DAQ_New()/Start() because packet threads won't be root when +// FIXIT-H breaks DAQ_New()/Start() because packet threads won't be root when // opening iface static void SnortUnprivilegedInit(void) { @@ -604,7 +604,7 @@ void snort_cleanup() { DAQ_Term(); - if ( !ScTestMode() ) // FIXIT ideally the check is in one place + if ( !ScTestMode() ) // FIXIT-M ideally the check is in one place PrintStatistics(); CloseLogger(); @@ -615,7 +615,7 @@ void snort_cleanup() // reload foo //------------------------------------------------------------------------- -// FIXIT refactor this so startup and reload call the same core function to +// FIXIT-M refactor this so startup and reload call the same core function to // instantiate things that can be reloaded static SnortConfig * get_reload_config(void) { @@ -652,7 +652,7 @@ static SnortConfig * get_reload_config(void) FlowbitResetCounts(); ParseRules(sc); - // FIXIT see SnortInit() on config printing + // FIXIT-L see SnortInit() on config printing //detection_filter_print_config(sc->detection_filter_config); ////RateFilter_PrintConfig(sc->rate_filter_config); //print_thresholding(sc->threshold_config, 0); @@ -734,7 +734,7 @@ void set_main_hook(MainHook_f f) Packet* get_current_packet() { return &s_packet; } -// FIXIT for multiple packet threads +// FIXIT-H for multiple packet threads // using thread locals for s_pkth and s_data won't work // will need array of s_packet, s_pkth, and s_data and // capture all if it is not clear which thread crashed @@ -823,7 +823,7 @@ DAQ_Verdict ProcessPacket( p->proto_bits = PROTO_BIT__OTHER; #if 0 - // FIXIT required until decoders are fixed + // FIXIT-H required until decoders are fixed (josh) else if ( !p->family && (p->proto_bits & PROTO_BIT__IP) ) p->proto_bits &= ~PROTO_BIT__IP; #endif @@ -858,7 +858,7 @@ DAQ_Verdict ProcessPacket( return verdict; } -// FIXIT need to call fail open from a different thread +// FIXIT-H need to call fail open from a different thread DAQ_Verdict fail_open( void*, const DAQ_PktHdr_t*, const uint8_t*) { @@ -958,12 +958,12 @@ DAQ_Verdict packet_callback( Active_Reset(); PacketManager::encode_reset(); - if ( flow_con ) // FIXIT always instantiate + if ( flow_con ) // FIXIT-H always instantiate flow_con->timeout_flows(4, pkthdr->ts.tv_sec); #if 0 - // FIXIT do this when idle - if ( flow_con ) // FIXIT always instantiate + // FIXIT-H do this when idle + if ( flow_con ) // FIXIT-H always instantiate flow_con->timeout_flows(16384, time(NULL)); #endif @@ -983,7 +983,7 @@ void snort_rotate() void snort_thread_init(const char* intf) { - // FIXIT the start-up sequence is a little off due to dropping privs + // FIXIT-H the start-up sequence is a little off due to dropping privs DAQ_New(snort_conf, intf); DAQ_Start(); diff --git a/src/main/snort.h b/src/main/snort.h index 3a1f21220..05c61af62 100644 --- a/src/main/snort.h +++ b/src/main/snort.h @@ -48,7 +48,7 @@ void snort_thread_term(); void snort_rotate(); -// FIXIT may be inlined at some point; on lockdown for now +// FIXIT-L may be inlined at some point; on lockdown for now NetworkPolicy* get_network_policy(); InspectionPolicy* get_inspection_policy(); IpsPolicy* get_ips_policy(); @@ -73,7 +73,7 @@ typedef void (*MainHook_f)(Packet*); void set_main_hook(MainHook_f); //------------------------------------------------------------------------- -// FIXIT most of what follows belongs in snort_config.h +// FIXIT-L most of what follows belongs in snort_config.h //------------------------------------------------------------------------- /* D E F I N E S ************************************************************/ @@ -204,7 +204,7 @@ static inline int ScLogQuiet(void) } //------------------------------------------------------------------------- -// FIXIT should be calling NetworkPolicy methods +// FIXIT-L should be calling NetworkPolicy methods static inline int ScIpChecksums(void) { @@ -480,7 +480,7 @@ static inline int ScGid(void) return snort_conf->group_id; } -// FIXIT this should be feature of otn +// FIXIT-L this should be feature of otn #define EventIsInternal(gid) (gid == GENERATOR_INTERNAL) static inline void EnableInternalEvent(RateFilterConfig *config, uint32_t sid) diff --git a/src/main/snort_config.cc b/src/main/snort_config.cc index 3780b03cd..59ae5f8f1 100644 --- a/src/main/snort_config.cc +++ b/src/main/snort_config.cc @@ -30,7 +30,7 @@ #include "detection/treenodes.h" #include "events/event_queue.h" #include "stream/stream_api.h" -#include "port_scan/ps_detect.h" // FIXIT for PS_PROTO_* +#include "port_scan/ps_detect.h" // FIXIT-L for PS_PROTO_* #include "utils/strvec.h" #include "file_api/file_service.h" #include "target_based/sftarget_reader.h" @@ -166,7 +166,7 @@ SnortConfig * SnortConfNew(void) sc->tagged_packet_limit = 256; sc->default_rule_state = RULE_STATE_ENABLED; - // FIXIT pcre_match_limit* are interdependent + // FIXIT-L pcre_match_limit* are interdependent // somehow a packet thread needs a much lower setting sc->pcre_match_limit = 1500; sc->pcre_match_limit_recursion = 1500; @@ -468,7 +468,7 @@ SnortConfig * MergeSnortConfs(SnortConfig *cmd_line, SnortConfig *config_file) config_file->max_encapsulations = cmd_line->max_encapsulations; // config file vars are stored differently - // FIXIT should config_file and cmd_line use the same var list / table? + // FIXIT-M should config_file and cmd_line use the same var list / table? config_file->var_list = NULL; free(config_file->state); diff --git a/src/main/snort_config.h b/src/main/snort_config.h index 3610d0e2e..c4dbc211a 100644 --- a/src/main/snort_config.h +++ b/src/main/snort_config.h @@ -183,14 +183,14 @@ struct SnortConfig #endif //------------------------------------------------------ - // FIXIT command line only stuff, add to conf / module + // FIXIT-L command line only stuff, add to conf / module uint32_t event_log_id; /* -G */ sfip_t obfuscation_net; // -B char *bpf_filter; // --bpf //------------------------------------------------------ - // FIXIT non-module stuff - separate config from derived state? + // FIXIT-L non-module stuff - separate config from derived state? char pid_filename[STD_BUF]; char *orig_log_dir; /* set in case of chroot */ diff --git a/src/main/snort_debug.cc b/src/main/snort_debug.cc index d1c658830..ccc7a0e90 100644 --- a/src/main/snort_debug.cc +++ b/src/main/snort_debug.cc @@ -41,8 +41,8 @@ #include "snort.h" #ifdef DEBUG_MSGS -SO_PUBLIC const char *DebugMessageFile = NULL; // FIXIT use access methods -SO_PUBLIC int DebugMessageLine = 0; // FIXIT use access methods +SO_PUBLIC const char *DebugMessageFile = NULL; // FIXIT-M use access methods +SO_PUBLIC int DebugMessageLine = 0; // FIXIT-M use access methods int DebugThis(uint64_t level) { diff --git a/src/main/snort_types.h b/src/main/snort_types.h index 571fa56c0..834a2b3cd 100644 --- a/src/main/snort_types.h +++ b/src/main/snort_types.h @@ -93,11 +93,11 @@ typedef uint16_t Port; /* utilities */ #ifndef SIZE_MAX -#define SIZE_MAX 0xFFFFFFFF // FIXIT not defined for g++? +#define SIZE_MAX 0xFFFFFFFF // FIXIT-L use c++ define #endif #ifndef INT32_MAX -#define INT32_MAX 0x7FFFFFFF // FIXIT not defined for g++? +#define INT32_MAX 0x7FFFFFFF // FIXIT-L use c++ define #endif #define UNUSED(x) (void)(x) diff --git a/src/main/thread.cc b/src/main/thread.cc index 6f318cb4d..673be538d 100644 --- a/src/main/thread.cc +++ b/src/main/thread.cc @@ -24,7 +24,7 @@ #include "snort.h" //------------------------------------------------------------------------- -// FIXIT instance_id zero indicates main thread during parse time and the +// FIXIT-L instance_id zero indicates main thread during parse time and the // first packet thread during runtime. not sure if i'm ok with that. // works for now. //------------------------------------------------------------------------- @@ -57,7 +57,7 @@ const char* get_instance_file(std::string& file, const char* name) struct stat s; if ( stat(file.c_str(), &s) ) - // FIXIT getting random 0750 or 0700 (umask not thread local)? + // FIXIT-H getting random 0750 or 0700 (umask not thread local)? mkdir(file.c_str(), 0770); file += name; diff --git a/src/managers/event_manager.cc b/src/managers/event_manager.cc index ee7ee9faa..db9e7ae17 100644 --- a/src/managers/event_manager.cc +++ b/src/managers/event_manager.cc @@ -155,7 +155,7 @@ void EventManager::instantiate( Output* p, Module* mod, SnortConfig* sc) { p->handler = p->api->ctor(sc, mod); - assert(p->handler); // FIXIT must handle case where not configured + assert(p->handler); // FIXIT-H must handle case where not configured if ( (p->api->flags & OUTPUT_TYPE_FLAG__ALERT) && (p->api->flags & OUTPUT_TYPE_FLAG__LOG) ) @@ -191,7 +191,7 @@ void EventManager::instantiate( return; } - // FIXIT this loses args if set in conf + // FIXIT-H this loses args if set in conf // emulate a config like name = { } //mod->begin(name, 0, sc); //mod->end(name, 0, sc); diff --git a/src/managers/inspector_manager.cc b/src/managers/inspector_manager.cc index 15fc3ca77..6ee820f48 100644 --- a/src/managers/inspector_manager.cc +++ b/src/managers/inspector_manager.cc @@ -293,7 +293,7 @@ static PHInstance* GetInstance( p = new PHInstance(*ppc); - if ( !p->handler ) // FIXIT is this even possible? + if ( !p->handler ) // FIXIT-M is this even possible? { delete p; return NULL; @@ -302,10 +302,10 @@ static PHInstance* GetInstance( return p; } -// FIXIT create a separate list for meta handlers? is there really more than one? +// FIXIT-M create a separate list for meta handlers? is there really more than one? void InspectorManager::dispatch_meta (FrameworkPolicy* fp, int type, const uint8_t* data) { - // FIXIT change to select instance by policy and pass that in + // FIXIT-M change to select instance by policy and pass that in for ( auto* p : fp->ilist ) p->handler->meta(type, data); } @@ -379,7 +379,7 @@ static PHClass* GetClass(const char* keyword, FrameworkConfig* fc) // this is per thread void InspectorManager::thread_init(SnortConfig* sc) { - // FIXIT BIND the policy related logic herein moves to binder + // FIXIT-H BIND the policy related logic herein moves to binder Inspector::slot = get_instance_id(); for ( auto* p : sc->framework_config->clist ) @@ -418,12 +418,12 @@ void InspectorManager::thread_term(SnortConfig* sc) void InspectorManager::instantiate( const InspectApi* api, Module*, SnortConfig* sc) { - // FIXIT only configures Lua inspectors in base policy; must be + // FIXIT-H only configures Lua inspectors in base policy; must be // revisited when bindings are implemented FrameworkConfig* fc = sc->framework_config; FrameworkPolicy* fp = sc->policy_map->inspection_policy[0]->framework_policy; - // FIXIT should not need to lookup inspector etc + // FIXIT-H should not need to lookup inspector etc // since given api and mod const char* keyword = api->base.name; @@ -446,7 +446,7 @@ bool InspectorManager::configure(SnortConfig *sc) Inspector::max_slots = sc->max_threads; s_handlers.sort(PHGlobal::comp); - // FIXIT use FrameworkConfig or FrameworkPolicy ? + // FIXIT-H use FrameworkConfig or FrameworkPolicy ? //FrameworkConfig* fc = sc->framework_config; FrameworkPolicy* fp = sc->policy_map->inspection_policy[0]->framework_policy; bool ok = true; @@ -485,7 +485,7 @@ static inline void execute( PHClass& ppc = (*prep)->pp_class; - // FIXIT these checks can eventually be optimized + // FIXIT-P these checks can eventually be optimized // but they are required to ensure that session and app // handlers aren't called w/o a session pointer if ( !p->flow && (ppc.api.type >= IT_SESSION) ) @@ -528,7 +528,7 @@ void InspectorManager::execute (Packet* p) FrameworkPolicy* fp = get_inspection_policy()->framework_policy; assert(fp); - // FIXIT structure lists so stream, normalize, etc. aren't + // FIXIT-M structure lists so stream, normalize, etc. aren't // called on reassembled packets ::execute(p, fp->session.vec, fp->session.num); ::execute(p, fp->network.vec, fp->network.num); @@ -544,7 +544,7 @@ void InspectorManager::execute (Packet* p) if ( flow->clouseau && (p->proto_bits & flow->clouseau->get_api()->proto_bits) ) bumble(p); - // FIXIT BIND need more than one service inspector? + // FIXIT-H BIND need more than one service inspector? //::execute(p, fp->service.vec, fp->service.num); if ( flow->gadget && (p->proto_bits & flow->gadget->get_api()->proto_bits) ) flow->gadget->eval(p); diff --git a/src/managers/ips_manager.cc b/src/managers/ips_manager.cc index b4b735db2..48dada1e6 100644 --- a/src/managers/ips_manager.cc +++ b/src/managers/ips_manager.cc @@ -176,7 +176,7 @@ bool IpsManager::option_begin( opt->api->pinit(sc); opt->init = true; } - // FIXIT verify api->protos and api->max_per_rule + // FIXIT-H verify api->protos and api->max_per_rule // before calling ctor current_module = ModuleManager::get_module(key); diff --git a/src/managers/module_manager.cc b/src/managers/module_manager.cc index 3328bfec9..0537aee88 100644 --- a/src/managers/module_manager.cc +++ b/src/managers/module_manager.cc @@ -246,15 +246,15 @@ static const Parameter* get_params(string& sfx, const Parameter* p) return get_params(sfx, p); } -// FIXIT vars may have been defined on command line +// FIXIT-M vars may have been defined on command line // that mechanism will be replaced with pulling a Lua // chunk from the command line and stuffing into L // before setting configs; that will overwrite // -// FIXIT should only need one table with +// FIXIT-M should only need one table with // dynamically typed vars // -// FIXIT this is a hack to tell vars by naming +// FIXIT-M this is a hack to tell vars by naming // convention; with one table this is obviated // but if multiple tables are kept might want // to change these to a module with parameters @@ -700,7 +700,7 @@ void ModuleManager::show_rules(const char* pfx) void ModuleManager::load_rules(SnortConfig* sc) { - // FIXIT callers of ParseConfigString() should not have to push parse loc + // FIXIT-M callers of ParseConfigString() should not have to push parse loc push_parse_location("builtin"); for ( auto p : s_modules ) @@ -717,11 +717,11 @@ void ModuleManager::load_rules(SnortConfig* sc) while ( r->msg ) { ss.str(""); - // FIXIT move builtin generation to a better home - // FIXIT builtins should allow configurable nets and ports - // FIXIT builtins should have accurate proto + // FIXIT-L move builtin generation to a better home + // FIXIT-L builtins should allow configurable nets and ports + // FIXIT-L builtins should have accurate proto // (but ip winds up in all others) - // FIXIT if msg has C escaped embedded quotes, we break + // FIXIT-L if msg has C escaped embedded quotes, we break //ss << "alert tcp any any -> any any ( "; ss << "alert ( "; ss << "gid:" << gid << "; "; @@ -761,7 +761,7 @@ void ModuleManager::dump_rules(const char* pfx) while ( r->msg ) { - // FIXIT builtin gen should be in exactly one place + // FIXIT-L builtin gen should be in exactly one place ss << "alert ( "; ss << "gid:" << gid << "; "; ss << "sid:" << r->sid << "; "; diff --git a/src/managers/mpse_manager.cc b/src/managers/mpse_manager.cc index f738852af..f301b2e94 100644 --- a/src/managers/mpse_manager.cc +++ b/src/managers/mpse_manager.cc @@ -158,7 +158,7 @@ bool MpseManager::search_engine_trim(const MpseApi* api) } // was called during drop stats but actually commented out -// FIXIT this one has to accumulate across threads +// FIXIT-M this one has to accumulate across threads #if 0 void MpseManager::print_qinfo() { diff --git a/src/managers/plugin_manager.cc b/src/managers/plugin_manager.cc index e6785d43a..8c12f5dc9 100644 --- a/src/managers/plugin_manager.cc +++ b/src/managers/plugin_manager.cc @@ -127,7 +127,7 @@ struct RefCount RefCount() { count = 0; }; - // FIXIT fails on fatal error + // FIXIT-L fails on fatal error //~RefCount() { assert(!count); }; }; @@ -334,8 +334,6 @@ void PluginManager::load_plugins(const char* paths) add_plugins(); } -// FIXIT some plugins don't have modules; consider adding them -// for stray parameters, perfstats, documentation, etc. void PluginManager::list_plugins() { PlugMap::iterator it; diff --git a/src/managers/script_manager.cc b/src/managers/script_manager.cc index 8b656ee56..b77ce7e2c 100644 --- a/src/managers/script_manager.cc +++ b/src/managers/script_manager.cc @@ -32,7 +32,7 @@ #include "parser/parser.h" #include "helpers/directory.h" -// FIXIT this approach results in N * K lua states where +// FIXIT-P this approach results in N * K lua states where // N ::= number of instances of script + args and // K ::= number of threads // change to create K lua states here for each script + args diff --git a/src/managers/so_manager.cc b/src/managers/so_manager.cc index 15dcb8188..2d099475f 100644 --- a/src/managers/so_manager.cc +++ b/src/managers/so_manager.cc @@ -77,7 +77,7 @@ void SoManager::dump_plugins() #define GZIP_WBITS 31 -// FIXIT make this into a general utility for one shot decompress +// FIXIT-L make this into a general utility for one shot decompress // and add class for stream decompress const char* uncompress(const uint8_t* data, unsigned len) { @@ -133,7 +133,7 @@ const char* SoManager::get_so_options(const char* soid) if ( !rule ) return nullptr; - // FIXIT this approach won't tolerate spaces and might get + // FIXIT-L this approach won't tolerate spaces and might get // fooled by matching content (should it precede this) char opt[32]; snprintf(opt, sizeof(opt), "soid:%s;", soid); @@ -175,7 +175,7 @@ void SoManager::dump_rule_stubs(const char* path) if ( !rule ) continue; - // FIXIT need to properly parse rule to avoid + // FIXIT-L need to properly parse rule to avoid // confusing other text for soid option if ( !(s = strstr(rule, "soid:")) ) continue; diff --git a/src/network_inspectors/arp_spoof/arp_spoof.cc b/src/network_inspectors/arp_spoof/arp_spoof.cc index 284e2dc16..636e57931 100644 --- a/src/network_inspectors/arp_spoof/arp_spoof.cc +++ b/src/network_inspectors/arp_spoof/arp_spoof.cc @@ -126,7 +126,7 @@ static void PrintIPMacEntryList(IPMacEntryList& ipmel) { sfip_t in; sfip_set_raw(&in, &p.ipv4_addr, AF_INET); - // FIXIT replace all inet_ntoa() with thread safe + // FIXIT-L replace all inet_ntoa() with thread safe LogMessage(" %s -> ", inet_ntoa(&in)); for (int i = 0; i < 6; i++) diff --git a/src/network_inspectors/binder/binder.cc b/src/network_inspectors/binder/binder.cc index 549d6a9fc..537450664 100644 --- a/src/network_inspectors/binder/binder.cc +++ b/src/network_inspectors/binder/binder.cc @@ -44,7 +44,7 @@ THREAD_LOCAL ProfileStats bindPerfStats; // helpers //------------------------------------------------------------------------- -// FIXIT bind this is a temporary hack. note that both ends must be set +// FIXIT-H bind this is a temporary hack. note that both ends must be set // independently and that we must ref count inspectors. static void set_session(Flow* flow, const char* key) { @@ -61,7 +61,7 @@ static void set_session(Flow* flow) flow->clouseau = nullptr; } -// FIXIT use IPPROTO_* directly (any == 0) +// FIXIT-H use IPPROTO_* directly (any == 0) static bool check_proto(const Flow* flow, BindProto bp) { switch ( bp ) @@ -121,7 +121,7 @@ void Binder::eval(Packet* p) ++bstats.total_packets; } -// FIXIT implement inspector lookup from policy / bindings +// FIXIT-H implement inspector lookup from policy / bindings Inspector* Binder::find_inspector(const char* s) { Binding* pb; @@ -167,7 +167,7 @@ int Binder::exec(int, void* pv) return 0; } -// FIXIT bind services - this is a temporary hack that just looks at ports, +// FIXIT-H bind services - this is a temporary hack that just looks at ports, // need to examine all key fields for matching. ultimately need a routing // table, scapegoat tree, etc. int Binder::check_rules(Flow* flow, Packet* p) @@ -175,8 +175,8 @@ int Binder::check_rules(Flow* flow, Packet* p) Binding* pb; unsigned i, sz = bindings.size(); - // FIXIT called before stream runs - these flags aren't set - // (below is structed to work by accident on initial syn until fixed) + // FIXIT-H called before stream runs - these flags aren't set + // (below is structured to work by accident on initial syn until fixed) Port port = (p->packet_flags & PKT_FROM_SERVER) ? p->sp : p->dp; for ( i = 0; i < sz; i++ ) @@ -191,7 +191,7 @@ int Binder::check_rules(Flow* flow, Packet* p) } if ( i == sz ) - return BA_ALLOW; // default action FIXIT make configurable + return BA_ALLOW; // default action FIXIT-H make configurable if ( pb->action != BA_INSPECT ) return pb->action; diff --git a/src/network_inspectors/normalize/norm.cc b/src/network_inspectors/normalize/norm.cc index cf68e3e26..f25a7fff2 100644 --- a/src/network_inspectors/normalize/norm.cc +++ b/src/network_inspectors/normalize/norm.cc @@ -540,7 +540,7 @@ int Norm_SetConfig (NormalizerConfig* nc) { if ( !DAQ_CanReplace() ) { - // FIXIT output only once + // FIXIT-L output only once //LogMessage("WARNING: normalizations disabled because DAQ" // " can't replace packets.\n"); nc->normalizer_flags = 0x0; diff --git a/src/network_inspectors/normalize/norm.h b/src/network_inspectors/normalize/norm.h index c17ebb07d..8af1cb749 100644 --- a/src/network_inspectors/normalize/norm.h +++ b/src/network_inspectors/normalize/norm.h @@ -30,7 +30,7 @@ struct NormalizerConfig; // all normalizers look like this: // the return is 1 if packet was changed, else 0 -typedef int (*NormalFunc)( // FIXIT why is this exposed? +typedef int (*NormalFunc)( // FIXIT-L why is this exposed? struct NormalizerConfig*, Packet*, uint8_t layer, int changes); struct NormalizerConfig diff --git a/src/network_inspectors/normalize/norm_module.cc b/src/network_inspectors/normalize/norm_module.cc index f0ff409fc..d038df332 100644 --- a/src/network_inspectors/normalize/norm_module.cc +++ b/src/network_inspectors/normalize/norm_module.cc @@ -126,7 +126,7 @@ static const Parameter norm_tcp_params[] = "sack | echo | partial_order | conn_count | alt_checksum | md5", "false", "don't clear given option names" }, - // FIXIT provide a byte list for stuff like this + // FIXIT-L provide a byte list for stuff like this { "allow_codes", Parameter::PT_STRING, nullptr, nullptr, "don't clear given option codes" }, diff --git a/src/network_inspectors/normalize/normalize.cc b/src/network_inspectors/normalize/normalize.cc index 9c0adbb48..d156b7b90 100644 --- a/src/network_inspectors/normalize/normalize.cc +++ b/src/network_inspectors/normalize/normalize.cc @@ -180,7 +180,7 @@ Normalizer::Normalizer(NormalizeModule* mod) bool Normalizer::configure(SnortConfig*) { - // FIXIT detection policy can't be used by normalizer + // FIXIT-M detection policy can't be used by normalizer // (not set until after normalizer runs) if ( get_ips_policy()->policy_mode != POLICY_MODE__INLINE ) { diff --git a/src/network_inspectors/perf_monitor/perf.cc b/src/network_inspectors/perf_monitor/perf.cc index b76dbb86b..cf2e7e879 100644 --- a/src/network_inspectors/perf_monitor/perf.cc +++ b/src/network_inspectors/perf_monitor/perf.cc @@ -479,7 +479,7 @@ void sfPerformanceStats(SFPERF *sfPerf, Packet *p) if (CheckSampleInterval(sfPerf, p)) { cnt = 0; - perfmon_config = sfPerf; // FIXIT sfPerf isn't propagated far enough + perfmon_config = sfPerf; // FIXIT-L sfPerf isn't propagated far enough if (!(sfPerf->perf_flags & SFPERF_SUMMARY_BASE)) { @@ -552,7 +552,7 @@ static bool CheckSampleInterval(SFPERF *sfPerf, Packet *p) void InitPerfStats(SFPERF *sfPerf) { - perfmon_config = sfPerf; // FIXIT sfPerf isn't propagated far enough + perfmon_config = sfPerf; // FIXIT-L sfPerf isn't propagated far enough if (sfPerf->perf_flags & SFPERF_BASE) InitBaseStats(&sfBase); @@ -573,7 +573,7 @@ void InitPerfStats(SFPERF *sfPerf) static void UpdatePerfStats(SFPERF *sfPerf, Packet *p) { - perfmon_config = sfPerf; // FIXIT sfPerf isn't propagated far enough + perfmon_config = sfPerf; // FIXIT-L sfPerf isn't propagated far enough bool rebuilt = PacketIsRebuilt(p); if (sfPerf->perf_flags & SFPERF_BASE) @@ -671,7 +671,7 @@ void sfPerfStatsSummary(SFPERF *sfPerf) if (sfPerf == NULL) return; - perfmon_config = sfPerf; // FIXIT sfPerf isn't propagated far enough + perfmon_config = sfPerf; // FIXIT-L sfPerf isn't propagated far enough if (sfPerf->perf_flags & SFPERF_SUMMARY_BASE) sfProcessBaseStats(sfPerf); diff --git a/src/network_inspectors/perf_monitor/perf_monitor.cc b/src/network_inspectors/perf_monitor/perf_monitor.cc index 9271f67dd..b35bc298d 100644 --- a/src/network_inspectors/perf_monitor/perf_monitor.cc +++ b/src/network_inspectors/perf_monitor/perf_monitor.cc @@ -63,7 +63,7 @@ THREAD_LOCAL ProfileStats perfmonStats; /* This function changes the perfmon log files permission if exists. It is done in the PerfMonitorInit() before Snort changed its user & group. */ -// FIXIT this should be deleted; was added as 1-time workaround to +// FIXIT-L this should be deleted; was added as 1-time workaround to // get around the borked perms due to a bug that has been fixed static void PerfMonitorChangeLogFilesPermission(void) { @@ -243,7 +243,7 @@ void PerfMonitor::show(SnortConfig*) PrintConfig(&config); } -// FIXIT perfmonitor should be logging to one file and writing record type and +// FIXIT-L perfmonitor should be logging to one file and writing record type and // version fields immediately after timestamp like // seconds, usec, type, version#, data1, data2, ... bool PerfMonitor::configure(SnortConfig*) diff --git a/src/network_inspectors/port_scan/port_scan.cc b/src/network_inspectors/port_scan/port_scan.cc index 5e7a7f282..99db9ab8d 100644 --- a/src/network_inspectors/port_scan/port_scan.cc +++ b/src/network_inspectors/port_scan/port_scan.cc @@ -418,7 +418,7 @@ static int MakePortscanPkt(PS_PKT *ps_pkt, PS_PROTO *proto, int proto_type, */ PacketManager::encode_update(g_tmp_pkt); - // FIXIT: IP4 is gauranteed to have been set in update(). Is IP6() + // FIXIT-L: IP4 is gauranteed to have been set in update(). Is IP6() // also gauranteed? if(g_tmp_pkt->ip_api.is_ip6()) ((ip::IP6Hdr*)g_tmp_pkt->ip_api.get_ip6h())->set_len(htons((uint16_t)ip_size)); @@ -854,7 +854,7 @@ PortScan::~PortScan() bool PortScan::configure(SnortConfig* sc) { - // FIXIT use fixed base file name + // FIXIT-L use fixed base file name config->logfile = SnortStrdup("portscan.log"); global = (PsData*)DataManager::acquire(PS_GLOBAL, sc); @@ -904,7 +904,7 @@ void PortScan::eval(Packet *p) MODULE_PROFILE_START(psPerfStats); ++spstats.total_packets; - memset(&ps_pkt, 0x00, sizeof(PS_PKT)); // FIXIT don't zap unless necessary + memset(&ps_pkt, 0x00, sizeof(PS_PKT)); // FIXIT-P don't zap unless necessary ps_pkt.pkt = (void *)p; /* See if there is already an exisiting node in the hash table */ @@ -991,7 +991,7 @@ static const InspectApi sp_api = mod_dtor }, IT_PROTOCOL, - PROTO_BIT__IP|PROTO_BIT__ICMP|PROTO_BIT__TCP|PROTO_BIT__UDP, // FIXIT dynamic assign + PROTO_BIT__IP|PROTO_BIT__ICMP|PROTO_BIT__TCP|PROTO_BIT__UDP, // FIXIT-L dynamic assign nullptr, // buffers nullptr, // service nullptr, // pinit diff --git a/src/network_inspectors/port_scan/ps_module.cc b/src/network_inspectors/port_scan/ps_module.cc index 951e9aaed..db0e81cce 100644 --- a/src/network_inspectors/port_scan/ps_module.cc +++ b/src/network_inspectors/port_scan/ps_module.cc @@ -118,7 +118,7 @@ const RuleMap* PortScanModule::get_rules() const { return port_scan_rules; } //------------------------------------------------------------------------- -// FIXIT ipset_parse() format must be changed to remove comma +// FIXIT-L ipset_parse() format must be changed to remove comma // separators between tokens which means using something other than // space between CIDR and port. the current format is: // CIDR[ ports][,CIDR[ ports]]* diff --git a/src/packet_io/active.cc b/src/packet_io/active.cc index d4b9c9331..bc2741db7 100644 --- a/src/packet_io/active.cc +++ b/src/packet_io/active.cc @@ -254,7 +254,7 @@ int Active_IsRSTCandidate(const Packet* p) int Active_IsUNRCandidate(const Packet* p) { - // FIXIT allow unr to tcp/udp/icmp4/icmp6 only or for all + // FIXIT-J allow unr to tcp/udp/icmp4/icmp6 only or for all switch ( GetInnerProto(p) ) { case PROTO_UDP: case PROTO_TCP: @@ -370,7 +370,7 @@ static inline int _Active_DoReset(Packet *p) ActionManager::queue_reject(); break; - // FIXIT send unr to udp/icmp4/icmp6 only or for all non-tcp? + // FIXIT-J send unr to udp/icmp4/icmp6 only or for all non-tcp? case IPPROTO_UDP: case IPPROTO_ICMP: case IPPROTO_ICMPV6: diff --git a/src/packet_io/sfdaq.cc b/src/packet_io/sfdaq.cc index 77d7e8939..3ca6cef02 100644 --- a/src/packet_io/sfdaq.cc +++ b/src/packet_io/sfdaq.cc @@ -268,7 +268,7 @@ void DAQ_Abort () DAQ_Stop(); DAQ_Delete(); - //DAQ_Term(); FIXIT this must be called from main thread on abort + //DAQ_Term(); FIXIT-H this must be called from main thread on abort } //-------------------------------------------------------------------- diff --git a/src/parser/arg_list.cc b/src/parser/arg_list.cc index 02a76f61c..9abf1e2e7 100644 --- a/src/parser/arg_list.cc +++ b/src/parser/arg_list.cc @@ -28,7 +28,7 @@ void ArgList::dump() printf("argv[%d]='%s'\n", i, argv[i]); } -// FIXIT this chokes on -n -4 because it thinks +// FIXIT-L this chokes on -n -4 because it thinks // -4 is another arg instead of an option to -n bool ArgList::get_arg(const char*& key, const char*& val) { diff --git a/src/parser/config_file.cc b/src/parser/config_file.cc index 76d501740..e9e13ad9c 100644 --- a/src/parser/config_file.cc +++ b/src/parser/config_file.cc @@ -61,16 +61,6 @@ #include "managers/event_manager.h" #include "detection/detect.h" -// FIXIT defines should be avoided here - the actual option -// may be from command line (a-b) or from config file (a_b) -// option should be passed into all parser function for error -// messages -#define CONFIG_OPT__POLICY_VERSION "policy_version" -#ifdef PERF_PROFILING -# define CONFIG_OPT__PROFILE_MODULES "profile_preprocs" -# define CONFIG_OPT__PROFILE_RULES "profile_rules" -#endif - #define LOG_NONE "none" #define LOG_TEXT "text" #define LOG_PCAP "pcap" @@ -83,7 +73,6 @@ #define OUTPUT_AJK "unified2" #define OUTPUT_CMG "alert_fast" -//#define OUTPUT_LOG "alert_syslog" // FIXIT should use? #define OUTPUT_PCAP "log_tcpdump" static std::string lua_conf; @@ -573,23 +562,6 @@ void ConfigShowYear(SnortConfig *sc, const char*) DEBUG_WRAP(DebugMessage(DEBUG_INIT, "Enabled year in timestamp\n");); } -// FIXIT-L who is calling this? get rid of SnortStrtoul() etc. when -// all are modularized -void ConfigSoRuleMemcap(SnortConfig *sc, const char *args) -{ - char *endptr; - - if ( !args ) - return; - - sc->so_rule_memcap = SnortStrtoul(args, &endptr, 0); - if ((errno == ERANGE) || (*endptr != '\0')) - { - ParseError("invalid so rule memcap: %s. Memcap must be between " - "0 and %u inclusive.", args, UINT32_MAX); - } -} - void ConfigTreatDropAsAlert(SnortConfig *sc, const char*) { sc->run_flags |= RUN_FLAG__TREAT_DROP_AS_ALERT; diff --git a/src/parser/config_file.h b/src/parser/config_file.h index 08ef4b4a3..0a1ef4086 100644 --- a/src/parser/config_file.h +++ b/src/parser/config_file.h @@ -49,7 +49,6 @@ void ConfigObfuscate(SnortConfig*, const char*); void ConfigObfuscationMask(SnortConfig*, const char*); void ConfigQuiet(SnortConfig*, const char*); void ConfigShowYear(SnortConfig*, const char*); -void ConfigSoRuleMemcap(SnortConfig*, const char*); void ConfigTreatDropAsAlert(SnortConfig*, const char*); void ConfigTreatDropAsIgnore(SnortConfig*, const char*); void ConfigProcessAllEvents(SnortConfig*, const char*); diff --git a/src/parser/parse_conf.cc b/src/parser/parse_conf.cc index 0946ee2d8..3dbf98220 100644 --- a/src/parser/parse_conf.cc +++ b/src/parser/parse_conf.cc @@ -154,7 +154,7 @@ void parse_include(SnortConfig *sc, const char *arg) void ParseIpVar(SnortConfig *sc, const char* var, const char* val) { int ret; - IpsPolicy* p = get_ips_policy(); // FIXIT double check, see below + IpsPolicy* p = get_ips_policy(); // FIXIT-M double check, see below DisallowCrossTableDuplicateVars(sc, var, VAR_TYPE__IPVAR); if((ret = sfvt_define(p->ip_vartable, var, val)) != SFIP_SUCCESS) @@ -277,7 +277,7 @@ ListHead* get_rule_list(SnortConfig* sc, const char* s) return p ? p->RuleList : nullptr; } -// FIXIT find this a better home +// FIXIT-L find this a better home void AddRuleState(SnortConfig* sc, const RuleState& rs) { if (sc == NULL) diff --git a/src/parser/parse_conf.h b/src/parser/parse_conf.h index 7a4f2a32e..bd29af43d 100644 --- a/src/parser/parse_conf.h +++ b/src/parser/parse_conf.h @@ -41,25 +41,5 @@ void add_service_to_otn(SnortConfig*, OptTreeNode*, const char*); RuleType get_rule_type(const char*); ListHead* get_rule_list(SnortConfig*, const char*); -#if 0 -// FIXIT delete this cruft -#define ERR_PAIR_COUNT \ - "%s has incorrect argument count; should be %d pairs.", ERR_KEY -#define ERR_NOT_PAIRED \ - "%s is missing an option or argument to go with: %s.", ERR_KEY, pairs[0] -#define ERR_EXTRA_OPTION \ - "%s has extra option of type: %s.", ERR_KEY, pairs[0] -#define ERR_BAD_OPTION \ - "%s has unknown option: %s.", ERR_KEY, pairs[0] -#define ERR_BAD_VALUE \ - "%s has unknown %s: %s.", ERR_KEY, pairs[0], pairs[1] -#define ERR_BAD_ARG_COUNT \ - "%s has incorrect argument count.", ERR_KEY -#define ERR_CREATE \ - "%s could not be created.", ERR_KEY -#define ERR_CREATE_EX \ - "%s could not be created: %s.", ERR_KEY -#endif - #endif diff --git a/src/parser/parse_rule.cc b/src/parser/parse_rule.cc index d57624758..3873e7135 100644 --- a/src/parser/parse_rule.cc +++ b/src/parser/parse_rule.cc @@ -1379,7 +1379,7 @@ void parse_rule_proto(SnortConfig* sc, const char* s, RuleTreeNode& rtn) rtn.proto = ETHERNET_TYPE_IP; /* This will be set via ip_protos */ - // FIXIT need to add these for a single ip any any rule? + // FIXIT-L need to add these for a single ip any any rule? sc->ip_proto_array[IPPROTO_TCP] = 1; sc->ip_proto_array[IPPROTO_UDP] = 1; sc->ip_proto_array[IPPROTO_ICMP] = 1; @@ -1510,7 +1510,7 @@ const char* parse_rule_close(SnortConfig* sc, RuleTreeNode& rtn, OptTreeNode* ot ParseError("SO rule %s not loaded.", otn->soid); else { - // FIXIT why isn't this set already? (don't hardcode) + // FIXIT-L why isn't this set already? (don't hardcode) otn->sigInfo.generator = GENERATOR_SNORT_SHARED; entered = true; return so_opts; @@ -1541,7 +1541,7 @@ const char* parse_rule_close(SnortConfig* sc, RuleTreeNode& rtn, OptTreeNode* ot otn_count++; rule_count++; - // FIXIT need more reliable way of knowing type of rule instead of hard + // FIXIT-L need more reliable way of knowing type of rule instead of hard // coding these gids if ( otn->sigInfo.generator == 1 ) { diff --git a/src/parser/parser.cc b/src/parser/parser.cc index 7b49719d4..f40d3a3e1 100644 --- a/src/parser/parser.cc +++ b/src/parser/parser.cc @@ -83,7 +83,7 @@ #include "target_based/sftarget_reader.h" #include "events/event_wrapper.h" // see s_hack -// FIXIT without s_hack, we get this error on Mac: +// FIXIT-L without s_hack, we get this error on Mac: // Symbol not found: __Z18GenerateSnortEventP6Packetjj // Referenced from: /Users/rucombs/install/lib/snort/inspectors/libport_scan.0.dylib // Expected in: flat namespace @@ -421,7 +421,7 @@ static void DefineIfaceVar(SnortConfig *sc, char *iname, uint8_t *network, uint8 ****************************************************************************/ static void DefineAllIfaceVars(SnortConfig *sc) { - // FIXIT don't come back here on reload unless we are going to find + // FIXIT-L don't come back here on reload unless we are going to find // new ifaces. /* Cache retrieved devs so if user is running with dropped privs and * does a reload, we can use previous values */ diff --git a/src/parser/vars.h b/src/parser/vars.h index 14dd75e84..b94678e3e 100644 --- a/src/parser/vars.h +++ b/src/parser/vars.h @@ -48,7 +48,7 @@ void VarTablesFree(IpsPolicy*); VarEntry * VarDefine(SnortConfig *sc, const char *name, const char *value); int PortVarDefine(SnortConfig *sc, const char *name, const char *s); -void ParseIpVar(SnortConfig *sc, const char *name, const char *s); // FIXIT actually in parse_conf.cc +void ParseIpVar(SnortConfig *sc, const char *name, const char *s); // FIXIT-L actually in parse_conf.cc VarEntry *VarAlloc(); void DeleteVars(VarEntry *var_table); diff --git a/src/protocols/ip.h b/src/protocols/ip.h index d72f838ee..4d004d962 100644 --- a/src/protocols/ip.h +++ b/src/protocols/ip.h @@ -42,7 +42,7 @@ struct Packet; -// FIXIT : can I assume api si always valid? i.e. if not ip4, then ipv6? +// FIXIT-J : can I assume api si always valid? i.e. if not ip4, then ipv6? // or if not ip4, also make sure its not ip6 namespace ip diff --git a/src/protocols/udp.h b/src/protocols/udp.h index c6e45b57b..b89d11fe8 100644 --- a/src/protocols/udp.h +++ b/src/protocols/udp.h @@ -27,7 +27,7 @@ /* otherwise defined in /usr/include/ppp_defs.h */ -// FIXIT udph should not be set for udp tunnel +// FIXIT-J udph should not be set for udp tunnel // (only if innermost layer == udp) #define IsUDP(p) (IsIP(p) && !IsTCP(p) && p->udph) diff --git a/src/search_engines/ac_sparse.cc b/src/search_engines/ac_sparse.cc index 11c0d2454..0d9fb26ed 100644 --- a/src/search_engines/ac_sparse.cc +++ b/src/search_engines/ac_sparse.cc @@ -73,7 +73,7 @@ public: const unsigned char* T, int n, mpse_action_f action, void* data, int* current_state) { - // FIXIT make sure DFA and NFA flavors aren't swapped + // FIXIT-H make sure DFA and NFA flavors aren't swapped return acsmSearchSparseDFA( obj, (unsigned char *)T, n, action, data, current_state); }; diff --git a/src/search_engines/ac_sparse_bands.cc b/src/search_engines/ac_sparse_bands.cc index 2f73f12f0..86ffa0d1a 100644 --- a/src/search_engines/ac_sparse_bands.cc +++ b/src/search_engines/ac_sparse_bands.cc @@ -76,7 +76,7 @@ public: const unsigned char* T, int n, mpse_action_f action, void* data, int* current_state ) { - // FIXIT make sure NFA and DFA flavors aren't swapped + // FIXIT-H make sure NFA and DFA flavors aren't swapped return acsmSearchSparseNFA( obj, (unsigned char *)T, n, action, data, current_state); }; diff --git a/src/search_engines/bnfa_search.cc b/src/search_engines/bnfa_search.cc index bcb539955..80e9a5bd4 100644 --- a/src/search_engines/bnfa_search.cc +++ b/src/search_engines/bnfa_search.cc @@ -2247,7 +2247,7 @@ unsigned bnfaSearchX( return _process_queue( bnfa, Match, data ); } -// FIXIT eliminate the if-else- +// FIXIT-L eliminate the if-else- unsigned bnfaSearch( bnfa_struct_t * bnfa, unsigned char *Tx, int n, int (*Match)(void * id, void *tree, int index, void *data, void *neg_list), void *data, unsigned sindex, int* current_state ) diff --git a/src/search_engines/intel_soft_cpm.cc b/src/search_engines/intel_soft_cpm.cc index 0596e6804..262364c3f 100644 --- a/src/search_engines/intel_soft_cpm.cc +++ b/src/search_engines/intel_soft_cpm.cc @@ -78,7 +78,7 @@ typedef int (*MatchFunc)(void * id, void *tree, int index, void *data, void *neg /* GLOBALS ********************************************************************/ -static CpaInstanceHandle ipm_instance = NULL; /* instance handle */ // FIXIT 1 / process +static CpaInstanceHandle ipm_instance = NULL; /* instance handle */ static IntelPmHandles *ipm_handles = NULL; /* XXX Temporary stat for Intel */ diff --git a/src/search_engines/str_search.h b/src/search_engines/str_search.h index e96f4cbc4..328a8106f 100644 --- a/src/search_engines/str_search.h +++ b/src/search_engines/str_search.h @@ -35,7 +35,7 @@ typedef struct _search_api } SearchAPI; -// FIXIT search_api should be turned into a class +// FIXIT-L search_api should be turned into a class // (constructed of an Mpse, not subclassed) extern SearchAPI *search_api; diff --git a/src/service_inspectors/ftp_telnet/ft_main.cc b/src/service_inspectors/ftp_telnet/ft_main.cc index 417aa25c1..cafb88612 100644 --- a/src/service_inspectors/ftp_telnet/ft_main.cc +++ b/src/service_inspectors/ftp_telnet/ft_main.cc @@ -67,7 +67,7 @@ #include "sfsnprintfappend.h" #ifdef PERF_PROFILING -// FIXIT ftp, http, etc. should not be calling Detect() +// FIXIT-M ftp, http, etc. should not be calling Detect() static THREAD_LOCAL int ftppDetectCalled = 0; static THREAD_LOCAL ProfileStats ftppDetectPerfStats; @@ -193,7 +193,7 @@ int CheckFTPServerConfigs( * Returns: None * */ -// FIXIT eliminate legacy void* cruft +// FIXIT-L eliminate legacy void* cruft int FTPCheckConfigs(SnortConfig* sc, void* pData) { FTP_SERVER_PROTO_CONF* config = (FTP_SERVER_PROTO_CONF*)pData; @@ -207,7 +207,7 @@ int FTPCheckConfigs(SnortConfig* sc, void* pData) #if 0 if ( file_api->get_max_file_depth() < 0 ) { - // FIXIT need to change to IT_SERVICE and FTPTelnetChecks + // FIXIT-M need to change to IT_SERVICE and FTPTelnetChecks // for optimization } #endif diff --git a/src/service_inspectors/ftp_telnet/ftp.cc b/src/service_inspectors/ftp_telnet/ftp.cc index 54ab645cb..bc3cf30fe 100644 --- a/src/service_inspectors/ftp_telnet/ftp.cc +++ b/src/service_inspectors/ftp_telnet/ftp.cc @@ -106,7 +106,7 @@ static int SnortFTP( DEBUG_WRAP(DebugMessage(DEBUG_FTPTELNET, "Server packet: %.*s\n", p->dsize, p->data)); - // FIXIT breaks target-based non-standard ports + // FIXIT-L breaks target-based non-standard ports //if ( !ScPafEnabled() ) /* Force flush of client side of stream */ stream.response_flush_stream(p); @@ -284,7 +284,7 @@ static int ProcessFTPDataChanCmdsList( strcpy(FTPCmd->cmd_name, cmd); - // FIXIT make sure pulled from server conf when used if not + // FIXIT-L make sure pulled from server conf when used if not // overridden //FTPCmd->max_param_len = ServerConf->def_max_param_len; @@ -374,7 +374,7 @@ public: private: FTP_SERVER_PROTO_CONF* ftp_server; - ClientData* ftp_client; // FIXIT delete this when bindings implemented + ClientData* ftp_client; // FIXIT-H delete this when bindings implemented }; FtpServer::FtpServer(FTP_SERVER_PROTO_CONF* server) @@ -389,7 +389,7 @@ FtpServer::~FtpServer () delete ftp_server; if ( ftp_client ) - // FIXIT make sure CleanupFTPClientConf() is called + // FIXIT-L make sure CleanupFTPClientConf() is called DataManager::release(ftp_client); } @@ -429,7 +429,7 @@ void FtpServer::eval(Packet* p) // fc_ = ftp_client // fs_ = ftp_server // -// FIXIT fc is a data module but may need to +// FIXIT-L fc is a data module but may need to // be an inspector with separate bindings. //------------------------------------------------------------------------- @@ -509,7 +509,6 @@ static const InspectApi fs_api = fs_mod_ctor, mod_dtor }, - //IT_SESSION, // FIXIT should be service only IT_SERVICE, PROTO_BIT__TCP, nullptr, // buffers diff --git a/src/service_inspectors/ftp_telnet/ftp_data.cc b/src/service_inspectors/ftp_telnet/ftp_data.cc index 2b158fc1a..560211440 100644 --- a/src/service_inspectors/ftp_telnet/ftp_data.cc +++ b/src/service_inspectors/ftp_telnet/ftp_data.cc @@ -289,7 +289,7 @@ const InspectApi fd_api = mod_ctor, mod_dtor }, - IT_SERVICE, // FIXIT does this still need to be session?? + IT_SERVICE, // FIXIT-M does this still need to be session?? PROTO_BIT__TCP, nullptr, // buffers "ftp-data", diff --git a/src/service_inspectors/ftp_telnet/ftp_module.cc b/src/service_inspectors/ftp_telnet/ftp_module.cc index 4537da0ba..e1120784e 100644 --- a/src/service_inspectors/ftp_telnet/ftp_module.cc +++ b/src/service_inspectors/ftp_telnet/ftp_module.cc @@ -37,7 +37,7 @@ static const Parameter client_bounce_params[] = { "address", Parameter::PT_ADDR, nullptr, nullptr, "allowed ip address in CIDR format" }, - // FIXIT port and last_port should be replaced with a port list + // FIXIT-L port and last_port should be replaced with a port list { "port", Parameter::PT_PORT, "1:", nullptr, "allowed port" }, @@ -221,14 +221,13 @@ FtpCmd::FtpCmd(std::string& key, std::string& fmt, int num) #define FTP_EVASIVE_TELNET_CMD_STR \ "(ftp) Evasive (incomplete) TELNET CMD on FTP Command Channel" -// FIXIT convert to Lua and use as module default settings +// FIXIT-H convert to Lua and use as module default settings #if 0 static const char* DEFAULT_FTP_CONF[] = { "hardcoded_config " "def_max_param_len 100 " - // FIXIT should not have to list commands more than once // eg must appear in at least one *_cmds parameter "ftp_cmds { USER PASS ACCT CWD CDUP SMNT QUIT REIN TYPE STRU" " MODE RETR STOR STOU APPE ALLO REST RNFR RNTO ABOR" diff --git a/src/service_inspectors/ftp_telnet/ftpp_si.cc b/src/service_inspectors/ftp_telnet/ftpp_si.cc index 91eb79f3a..b5b784ffc 100644 --- a/src/service_inspectors/ftp_telnet/ftpp_si.cc +++ b/src/service_inspectors/ftp_telnet/ftpp_si.cc @@ -101,7 +101,7 @@ static int TelnetStatefulsessionInspection(Packet *p, TelnetFlowData* fd = new TelnetFlowData; TELNET_SESSION* Newsession = &fd->session; - // FIXIT lots of redundancy; clean up and move to ctor + // FIXIT-L lots of redundancy; clean up and move to ctor TelnetResetsession(Newsession); Newsession->ft_ssn.proto = FTPP_SI_PROTO_TELNET; Newsession->telnet_conf = GlobalConf; @@ -198,24 +198,13 @@ int FTPGetPacketDir(Packet *p) return FTPP_SI_NO_MODE; } -/* - * // FIXIT this goes away when bindings are implemented - * Purpose: When a session is initialized, we must select the appropriate - * server configuration and select the type of inspection based - * on the source and destination ports. - * - * IMPORTANT NOTE: - * We should check to make sure that there are some unique configurations, - * otherwise we can just default to the global default and work some magic - * that way. - */ static int FTPInitConf( Packet *p, FTP_CLIENT_PROTO_CONF **ClientConf, FTP_SERVER_PROTO_CONF **ServerConf, FTPP_SI_INPUT *SiInput, int *piInspectMode) { - // FIXIT BINDING ftp client and server must set by external bindings + // FIXIT-H BINDING ftp client and server must set by external bindings // at that point these get deleted FTP_CLIENT_PROTO_CONF *ClientConfSip = get_default_ftp_client(); FTP_CLIENT_PROTO_CONF *ClientConfDip = get_default_ftp_client(); @@ -526,7 +515,7 @@ static int FTPStatefulsessionInspection( FtpFlowData* fd = new FtpFlowData; FTP_SESSION* Newsession = &fd->session; - // FIXIT lots of redundancy; clean up and move to ctor + // FIXIT-L lots of redundancy; clean up and move to ctor FTPResetsession(Newsession); Newsession->ft_ssn.proto = FTPP_SI_PROTO_FTP; Newsession->client_conf = ClientConf; diff --git a/src/service_inspectors/ftp_telnet/hi_util_kmap.h b/src/service_inspectors/ftp_telnet/hi_util_kmap.h index e20789d34..ec15c3332 100644 --- a/src/service_inspectors/ftp_telnet/hi_util_kmap.h +++ b/src/service_inspectors/ftp_telnet/hi_util_kmap.h @@ -31,7 +31,7 @@ #ifndef HI_UTIL_KMAP_H #define HI_UTIL_KMAP_H -// FIXIT this is a dup of the file in http_inspect +// FIXIT-L this is a dup of the file in http_inspect #define ALPHABET_SIZE 256 diff --git a/src/service_inspectors/ftp_telnet/hi_util_xmalloc.cc b/src/service_inspectors/ftp_telnet/hi_util_xmalloc.cc index fa582f3dd..46c3da7b6 100644 --- a/src/service_inspectors/ftp_telnet/hi_util_xmalloc.cc +++ b/src/service_inspectors/ftp_telnet/hi_util_xmalloc.cc @@ -39,7 +39,7 @@ static THREAD_LOCAL unsigned msize=0; -void * xmalloc(size_t byteSize) // FIXIT eliminate this nonsense +void * xmalloc(size_t byteSize) // FIXIT-L eliminate this nonsense { #ifdef MDEBUG int * data = (int*) malloc( byteSize + 4 ); diff --git a/src/service_inspectors/ftp_telnet/hi_util_xmalloc.h b/src/service_inspectors/ftp_telnet/hi_util_xmalloc.h index 5c1e74d13..f96a91649 100644 --- a/src/service_inspectors/ftp_telnet/hi_util_xmalloc.h +++ b/src/service_inspectors/ftp_telnet/hi_util_xmalloc.h @@ -20,7 +20,7 @@ */ #ifndef HI_UTIL_XMALLOC_H #define HI_UTIL_XMALLOC_H -// FIXIT this is a dup of the file in http_inspect +// FIXIT-L this is a dup of the file in http_inspect #include diff --git a/src/service_inspectors/http_inspect/hi_client.cc b/src/service_inspectors/http_inspect/hi_client.cc index 7f16c4a93..dc86b688c 100644 --- a/src/service_inspectors/http_inspect/hi_client.cc +++ b/src/service_inspectors/http_inspect/hi_client.cc @@ -1519,7 +1519,7 @@ static inline void HTTP_CopyUri( cur_ptr = start; - if(/*ServerConf->log_uri &&*/ !stream_ins && hsd) // FIXIT move back to ServerConf? + if(/*ServerConf->log_uri &&*/ !stream_ins && hsd) // FIXIT-L move back to ServerConf? { SkipBlankSpace(start,end,&cur_ptr); @@ -2226,7 +2226,7 @@ static inline const u_char *extractHeaderFieldValues(HI_SESSION *session, else { hdrs_args->hst_name_hdr = 1; - if ( hsd && !(hdrs_args->strm_ins) /*&& (ServerConf->log_hostname)*/) // FIXIT move back to ServerConf? + if ( hsd && !(hdrs_args->strm_ins) /*&& (ServerConf->log_hostname)*/) // FIXIT-L move back to ServerConf? { if(!SetLogBuffers(hsd)) { diff --git a/src/service_inspectors/http_inspect/hi_main.cc b/src/service_inspectors/http_inspect/hi_main.cc index 59f254f68..63144ba42 100644 --- a/src/service_inspectors/http_inspect/hi_main.cc +++ b/src/service_inspectors/http_inspect/hi_main.cc @@ -95,7 +95,7 @@ const HiSearchToken html_patterns[] = {NULL, 0, 0} }; -// FIXIT verify these don't need to be thread local +// FIXIT-H verify these don't need to be thread local void *hi_javascript_search_mpse = NULL; void *hi_htmltype_search_mpse = NULL; @@ -428,7 +428,7 @@ static inline FilePosition getFilePoistion(Packet *p) return position; } -// FIXIT extra data masks should only be updated as extra data changes state +// FIXIT-P extra data masks should only be updated as extra data changes state // eg just once when captured; this function is called on every packet and // repeatedly sets the flags on session static inline void HttpLogFuncs( @@ -679,7 +679,7 @@ int HttpInspectMain(HTTPINSPECT_CONF* conf, Packet *p) if ( iInspectMode == HI_SI_CLIENT_MODE ) { const HttpBuffer* hb; - ClearHttpBuffers(); // FIXIT needed here and right above?? + ClearHttpBuffers(); // FIXIT-P needed here and right above?? if ( session->client.request.uri_norm ) { @@ -1110,7 +1110,7 @@ void FreeHttpsessionData(void *data) file_api->free_mime_session(hsd->mime_ssn); } -// FIXIT this should leverage inspector get_buf() +// FIXIT-H this should leverage inspector get_buf() int GetHttpTrueIP(Flow* flow, uint8_t **buf, uint32_t *len, uint32_t *type) { HttpsessionData* hsd = get_session_data(flow); diff --git a/src/service_inspectors/http_inspect/hi_module.cc b/src/service_inspectors/http_inspect/hi_module.cc index 87f071a22..a6edbe28e 100644 --- a/src/service_inspectors/http_inspect/hi_module.cc +++ b/src/service_inspectors/http_inspect/hi_module.cc @@ -76,7 +76,7 @@ static const Parameter hi_global_params[] = { "decompress_depth", Parameter::PT_INT, "1:65535", "2920", "maximum amount of decompressed data to process" }, - // FIXIT does this work with bindings? + // FIXIT-L does this work with bindings? { "detect_anomalous_servers", Parameter::PT_BOOL, nullptr, "false", "inspect non-configured ports for HTTP - bad idea" }, @@ -250,7 +250,7 @@ bool HttpInspectModule::end(const char* fqn, int, SnortConfig*) static const char* profiles = "none | all | apache | iis | iis_40 | iis_50"; -// FIXIT refactor params to create a profile table so that user can define +// FIXIT-L refactor params to create a profile table so that user can define // different profiles (like above) and use those. rename existing profile // to profile_type. diff --git a/src/service_inspectors/http_inspect/hi_norm.cc b/src/service_inspectors/http_inspect/hi_norm.cc index 967ee7b0b..12c56623d 100644 --- a/src/service_inspectors/http_inspect/hi_norm.cc +++ b/src/service_inspectors/http_inspect/hi_norm.cc @@ -582,7 +582,7 @@ static int UTF8Decode(HI_SESSION *session, const u_char *start, { if(ServerConf->iis_unicode.on) { - // FIXIT iNorm is an int; is it guaranteed to be < 64K? + // FIXIT-L iNorm is an int; is it guaranteed to be < 64K? iNorm = ServerConf->iis_unicode_map[iNorm]; if(iNorm == HI_UI_NON_ASCII_CODEPOINT) diff --git a/src/service_inspectors/http_inspect/hi_paf.cc b/src/service_inspectors/http_inspect/hi_paf.cc index 577dd6c9f..178e2f5d8 100644 --- a/src/service_inspectors/http_inspect/hi_paf.cc +++ b/src/service_inspectors/http_inspect/hi_paf.cc @@ -88,7 +88,7 @@ static uint32_t hi_cap = 0; // stats -// FIXIT eliminate these counts +// FIXIT-L eliminate these counts static THREAD_LOCAL uint32_t hi_paf_calls = 0; static THREAD_LOCAL uint32_t hi_paf_bytes = 0; diff --git a/src/service_inspectors/http_inspect/hi_server.cc b/src/service_inspectors/http_inspect/hi_server.cc index 1f8ad964d..64233538a 100644 --- a/src/service_inspectors/http_inspect/hi_server.cc +++ b/src/service_inspectors/http_inspect/hi_server.cc @@ -618,7 +618,7 @@ static inline const u_char *extractHttpRespHeaderFieldValues(HTTPINSPECT_CONF *S } else if ( IsHeaderFieldName(p, end, HTTPRESP_HEADER_NAME__CONTENT_ENCODING, - HTTPRESP_HEADER_LENGTH__CONTENT_ENCODING) /*&& ServerConf->extract_gzip*/ && // FIXIT move back to ServerConf? + HTTPRESP_HEADER_LENGTH__CONTENT_ENCODING) /*&& ServerConf->extract_gzip*/ && // FIXIT-L move back to ServerConf? parse_cont_encoding) { p = extract_http_content_encoding(ServerConf, p, start, end, header_ptr, header_field_ptr ); diff --git a/src/service_inspectors/http_inspect/hi_ui_config.cc b/src/service_inspectors/http_inspect/hi_ui_config.cc index 5b5dfd366..e70b0405b 100644 --- a/src/service_inspectors/http_inspect/hi_ui_config.cc +++ b/src/service_inspectors/http_inspect/hi_ui_config.cc @@ -64,7 +64,7 @@ HTTPINSPECT_GLOBAL_CONF::~HTTPINSPECT_GLOBAL_CONF() HTTPINSPECT_CONF::HTTPINSPECT_CONF() { // can't just zero the whole thing because of embedded objects - // FIXIT really need explicit assignments or refactor into substruct(s) + // FIXIT-L really need explicit assignments or refactor into substruct(s) // that can simply be zeroed uint8_t* end = (uint8_t*)&whitespace; unsigned len = end - (uint8_t*)this; @@ -75,7 +75,7 @@ HTTPINSPECT_CONF::HTTPINSPECT_CONF() HTTPINSPECT_CONF::~HTTPINSPECT_CONF() { - // FIXIT xfree() etc should go + // FIXIT-L xfree() etc should go xfree(iis_unicode_map_filename); xfree(iis_unicode_map); diff --git a/src/service_inspectors/http_inspect/http_inspect.cc b/src/service_inspectors/http_inspect/http_inspect.cc index de24f11db..dc4ed097e 100644 --- a/src/service_inspectors/http_inspect/http_inspect.cc +++ b/src/service_inspectors/http_inspect/http_inspect.cc @@ -171,7 +171,7 @@ static void updateConfigFromFileProcessing (HTTPINSPECT_CONF* ServerConf) static int HttpInspectVerifyPolicy(SnortConfig*, HTTPINSPECT_CONF* pData) { - HttpInspectRegisterXtraDataFuncs(); // FIXIT must be done once + HttpInspectRegisterXtraDataFuncs(); // FIXIT-L must be done once updateConfigFromFileProcessing(pData); return 0; @@ -306,7 +306,6 @@ bool HttpInspect::configure (SnortConfig* sc) HttpInspectInitializeGlobalConfig(config->global); - // FIXIT must load default unicode map from const char* CheckGzipConfig(config->global); CheckMemcap(config->global); @@ -423,7 +422,7 @@ static void hs_init() { HttpFlowData::init(); HI_SearchInit(); - hi_paf_init(0); // FIXIT is cap needed? + hi_paf_init(0); // FIXIT-L is cap needed? InitLookupTables(); InitJSNormLookupTable(); } diff --git a/src/service_inspectors/wizard/hexes.cc b/src/service_inspectors/wizard/hexes.cc index bfd949148..04c2990e2 100644 --- a/src/service_inspectors/wizard/hexes.cc +++ b/src/service_inspectors/wizard/hexes.cc @@ -159,7 +159,7 @@ MagicPage* HexBook::find_spell( return p; } -// FIXIT make this incremental based on last position +// FIXIT-H make this incremental based on last position const char* HexBook::find_spell(const uint8_t* data, unsigned len) const { if ( MagicPage* p = find_spell(data, len, root) ) diff --git a/src/service_inspectors/wizard/spells.cc b/src/service_inspectors/wizard/spells.cc index ece9b8c89..2a98861a0 100644 --- a/src/service_inspectors/wizard/spells.cc +++ b/src/service_inspectors/wizard/spells.cc @@ -152,10 +152,10 @@ MagicPage* SpellBook::find_spell( return p; } -// FIXIT make this incremental based on last position +// FIXIT-H make this incremental based on last position const char* SpellBook::find_spell(const uint8_t* data, unsigned len) const { - // FIXIT make configurable upper bound to limit globbing + // FIXIT-L make configurable upper bound to limit globbing unsigned max = 16; if ( len > max ) diff --git a/src/service_inspectors/wizard/wizard.cc b/src/service_inspectors/wizard/wizard.cc index bd7889bf2..7ad54936a 100644 --- a/src/service_inspectors/wizard/wizard.cc +++ b/src/service_inspectors/wizard/wizard.cc @@ -198,7 +198,7 @@ StreamSplitter* Wizard::get_splitter(bool c2s) bool Wizard::spellbind( const MagicPage* m, Flow* f, const uint8_t* data, unsigned len) { - // FIXIT convert to stateful find + // FIXIT-H convert to stateful find f->service = m->book.find_spell(data, len); return f->service != nullptr; } diff --git a/src/sfrt/sfrt_dir.cc b/src/sfrt/sfrt_dir.cc index 742ec7c02..6ce7a8095 100644 --- a/src/sfrt/sfrt_dir.cc +++ b/src/sfrt/sfrt_dir.cc @@ -33,7 +33,7 @@ #include "config.h" #endif -#include "sfrt.h" // FIXIT these includes are circular +#include "sfrt.h" // FIXIT-L these includes are circular #include "sfrt_dir.h" #include /* For variadic */ diff --git a/src/sfrt/sfrt_flat.h b/src/sfrt/sfrt_flat.h index 4d4559a51..cda8be4dd 100644 --- a/src/sfrt/sfrt_flat.h +++ b/src/sfrt/sfrt_flat.h @@ -49,7 +49,7 @@ typedef struct { int length; } tuple_flat_t; -// FIXIT circular include here +// FIXIT-L circular include here #include "sfrt/sfrt_flat_dir.h" /*******************************************************************/ diff --git a/src/sfrt/sfrt_flat_dir.cc b/src/sfrt/sfrt_flat_dir.cc index 0f33b0356..9e7ee7362 100644 --- a/src/sfrt/sfrt_flat_dir.cc +++ b/src/sfrt/sfrt_flat_dir.cc @@ -25,7 +25,7 @@ #include "config.h" #endif -#include "sfrt_flat.h" // FIXIT these includes are circular +#include "sfrt_flat.h" // FIXIT-L these includes are circular #include "sfrt_flat_dir.h" #include /* For variadic */ diff --git a/src/stream/base/stream_base.cc b/src/stream/base/stream_base.cc index 6f2fd5bad..a71086d5f 100644 --- a/src/stream/base/stream_base.cc +++ b/src/stream/base/stream_base.cc @@ -196,7 +196,7 @@ void StreamBase::tterm() void StreamBase::show(SnortConfig*) { - // FIXIT SSN print + // FIXIT-L SSN print //Stream5PrintGlobalConfig(&config); } @@ -239,7 +239,7 @@ void StreamBase::eval(Packet *p) } #if 0 - // FIXIT add method to get exp cache? + // FIXIT-L add method to get exp cache? LogMessage(" Expected Flows\n"); LogMessage(" Expected: %lu\n", exp_cache->get_expects()); LogMessage(" Realized: %lu\n", exp_cache->get_realized()); @@ -279,7 +279,7 @@ static const InspectApi base_api = mod_dtor }, IT_STREAM, - PROTO_BIT__ALL, // FIXIT which bits?? + PROTO_BIT__ALL, // FIXIT-H which bits?? nullptr, // buffers nullptr, // service nullptr, // init diff --git a/src/stream/icmp/icmp_session.cc b/src/stream/icmp/icmp_session.cc index c5f0a5254..8ec6db96e 100644 --- a/src/stream/icmp/icmp_session.cc +++ b/src/stream/icmp/icmp_session.cc @@ -256,8 +256,8 @@ void IcmpSession::update_direction(char dir, const sfip_t *ip, uint16_t) #if 0 void icmp_stats() { - // FIXIT move these to the actual owner - // FIXIT need to get these before delete flow_con + // FIXIT-L move these to the actual owner + // FIXIT-L need to get these before delete flow_con //flow_con->get_prunes(IPPROTO_UDP, icmpStats.prunes); } #endif diff --git a/src/stream/ip/ip_defrag.cc b/src/stream/ip/ip_defrag.cc index 5d52df81c..a7a11d21c 100644 --- a/src/stream/ip/ip_defrag.cc +++ b/src/stream/ip/ip_defrag.cc @@ -226,7 +226,7 @@ static const char* peg_names[] = /* G L O B A L S **************************************************/ -// FIXIT convert to session memcap +// FIXIT-M convert to session memcap static THREAD_LOCAL unsigned long mem_in_use = 0; /* memory in use, used for self pres */ static THREAD_LOCAL FragStats t_stats; @@ -1015,7 +1015,7 @@ static void FragRebuild(FragTracker *ft, Packet *p) /* Set the 'next' protocol */ if (p->ip6_frag_index > 0) { - // FIXIT use of last_extension works but is ugly + // FIXIT-J use of last_extension works but is ugly ip::IP6Extension *last_extension = (ip::IP6Extension *) (dpkt->pkt + (p->ip6_extensions[p->ip6_frag_index -1].data - p->pkt)); last_extension->ip6e_nxt = ft->protocol; @@ -1055,7 +1055,7 @@ static void FragRebuild(FragTracker *ft, Packet *p) SnortEventqPush(); p->packet_flags |= (PKT_PSEUDO | PKT_REBUILT_FRAG); p->pseudo_type = PSEUDO_PKT_IP; - //Encode_SetPkt(p); // FIXIT needed for responses to defragged packets + //Encode_SetPkt(p); // FIXIT-J needed for responses to defragged packets ProcessPacket(dpkt, dpkt->pkth, dpkt->pkt); SnortEventqPop(); diff --git a/src/stream/ip/ip_defrag.h b/src/stream/ip/ip_defrag.h index 355302e20..1b45e332a 100644 --- a/src/stream/ip/ip_defrag.h +++ b/src/stream/ip/ip_defrag.h @@ -24,7 +24,7 @@ #include "fpcreate.h" -// FIXIT integrate into stream api +// FIXIT-L integrate into stream api //int fpAddFragAlert(Packet *p, OptTreeNode *otn); //int fpFragAlerted(Packet *p, OptTreeNode *otn); int drop_all_fragments(Packet *p); @@ -58,7 +58,7 @@ private: int new_tracker(Packet *p, FragTracker*); int add_frag_node( - // FIXIT too many args + // FIXIT-L too many args FragTracker *ft, Packet*, FragEngine*, const uint8_t *fragStart, int16_t fragLength, char lastfrag, int16_t len, diff --git a/src/stream/ip/ip_module.cc b/src/stream/ip/ip_module.cc index 0383faa1f..4554395a4 100644 --- a/src/stream/ip/ip_module.cc +++ b/src/stream/ip/ip_module.cc @@ -189,7 +189,7 @@ bool StreamIpModule::set(const char*, Value& v, SnortConfig*) else if ( v.is("session_timeout") ) { - // FIXIT need to integrate to eliminate redundant data + // FIXIT-L need to integrate to eliminate redundant data config->session_timeout = v.get_long(); config->frag_engine.frag_timeout = v.get_long(); } diff --git a/src/stream/ip/stream_ip.cc b/src/stream/ip/stream_ip.cc index c5de4be41..b35daa207 100644 --- a/src/stream/ip/stream_ip.cc +++ b/src/stream/ip/stream_ip.cc @@ -93,7 +93,7 @@ bool StreamIp::configure(SnortConfig* sc) int StreamIp::verify_config(SnortConfig*) { - // FIXIT needed for defrag? + // FIXIT-L needed for defrag? return 0; } diff --git a/src/stream/stream.h b/src/stream/stream.h index 23513313b..3d076de0e 100644 --- a/src/stream/stream.h +++ b/src/stream/stream.h @@ -50,7 +50,7 @@ #define S5_TRACK_YES 1 #define S5_TRACK_NO 0 -// FIXIT move to proto specific where possible +// FIXIT-L move to proto specific where possible #define STREAM5_CONFIG_STATEFUL_INSPECTION 0x00000001 #define STREAM5_CONFIG_LOG_STREAMS 0x00000004 #define STREAM5_CONFIG_REASS_CLIENT 0x00000008 @@ -86,7 +86,7 @@ private: }; /* D A T A S T R U C T U R E S **********************************/ -// FIXIT some of this stuff can be better encapsulated +// FIXIT-L some of this stuff can be better encapsulated struct Stream5GlobalConfig { diff --git a/src/stream/stream_api.cc b/src/stream/stream_api.cc index f06b26d1c..1afbf2468 100644 --- a/src/stream/stream_api.cc +++ b/src/stream/stream_api.cc @@ -63,7 +63,7 @@ // public methods other than ctor / dtor must all be declared SO_PUBLIC //------------------------------------------------------------------------- -Stream stream; // FIXIT global for SnortContext +Stream stream; // FIXIT-L global for SnortContext Stream::Stream() { @@ -845,7 +845,7 @@ void Stream::set_extra_data( Stream5SetExtraDataTcp(flow, p, flag); } -// FIXIT get pv/flow from packet directly? +// FIXIT-L get pv/flow from packet directly? void Stream::clear_extra_data( Flow* pv, Packet* p, uint32_t flag) { diff --git a/src/stream/stream_api.h b/src/stream/stream_api.h index 475eb5d13..cfc663ad1 100644 --- a/src/stream/stream_api.h +++ b/src/stream/stream_api.h @@ -26,7 +26,7 @@ * preprocessors and detection plugins. */ -// FIXIT stream_api should not be tied to a particular version of stream +// FIXIT-L stream_api should not be tied to a particular version of stream #ifndef STREAM_API_H #define STREAM_API_H diff --git a/src/stream/stream_splitter.cc b/src/stream/stream_splitter.cc index d9857f9ae..1fb77440a 100644 --- a/src/stream/stream_splitter.cc +++ b/src/stream/stream_splitter.cc @@ -30,7 +30,7 @@ static THREAD_LOCAL uint8_t pdu_buf[65536]; static THREAD_LOCAL StreamBuffer str_buf; uint32_t StreamSplitter::max() -{ return 16384; } // FIXIT make default configurable +{ return 16384; } // FIXIT-H make default configurable const StreamBuffer* StreamSplitter::reassemble( Flow*, unsigned, unsigned offset, const uint8_t* p, @@ -84,7 +84,7 @@ void AtomSplitter::update() } #if 0 -// FIXIT this should be part of a new splitter +// FIXIT-H this should be part of a new splitter static inline int CheckFlushCoercion ( Packet* p, FlushMgr* fm, uint16_t flush_factor ) { diff --git a/src/stream/stream_splitter.h b/src/stream/stream_splitter.h index dc8ef8943..7ad7de841 100644 --- a/src/stream/stream_splitter.h +++ b/src/stream/stream_splitter.h @@ -27,7 +27,7 @@ class Flow; -enum PAF_Status // FIXIT move inside StreamSplitter +enum PAF_Status // FIXIT-H move inside StreamSplitter { PAF_ABORT, // non-paf operation PAF_START, // internal use only diff --git a/src/stream/tcp/ips_stream_reassemble.cc b/src/stream/tcp/ips_stream_reassemble.cc index 776be6d62..f63d742c0 100644 --- a/src/stream/tcp/ips_stream_reassemble.cc +++ b/src/stream/tcp/ips_stream_reassemble.cc @@ -123,8 +123,8 @@ int ReassembleOption::eval(Cursor&, Packet* pkt) } else { - // FIXIT PAF need to instantiate atom splitter? - // FIXIT PAF need to check for ips / on-data + // FIXIT-H PAF need to instantiate atom splitter? + // FIXIT-H PAF need to check for ips / on-data if ( srod.direction & SSN_DIR_SERVER ) tcpssn->server.flush_policy = STREAM_FLPOLICY_ON_ACK; diff --git a/src/stream/tcp/stream_paf.cc b/src/stream/tcp/stream_paf.cc index 30a13ca73..fe0f38704 100644 --- a/src/stream/tcp/stream_paf.cc +++ b/src/stream/tcp/stream_paf.cc @@ -69,7 +69,7 @@ static THREAD_LOCAL uint64_t prep_bytes = 0; // s5_len and s5_idx are used only during the // lifetime of s5_paf_check() -// FIXIT these thread local should be moved into thread context +// FIXIT-L these thread local should be moved into thread context static THREAD_LOCAL uint32_t s5_len; // total bytes queued static THREAD_LOCAL uint32_t s5_idx; // offset from start of queued bytes @@ -132,7 +132,7 @@ static uint32_t s5_paf_flush ( } //-------------------------------------------------------------------- -// FIXIT PAF support multiple scanners +// FIXIT-L PAF support multiple scanners static bool s5_paf_callback ( StreamSplitter* ss, PAF_State* ps, Flow* ssn, @@ -165,7 +165,7 @@ static inline bool s5_paf_eval ( "%s: paf=%d, idx=%u, len=%u, fpt=%u\n", __FUNCTION__, ps->paf, s5_idx, s5_len, ps->fpt);) - uint16_t fuzz = 0; // FIXIT PAF add a little zippedy-do-dah + uint16_t fuzz = 0; // FIXIT-L PAF add a little zippedy-do-dah switch ( ps->paf ) { @@ -301,7 +301,7 @@ uint32_t s5_paf_check ( } while ( 1 ); - uint16_t fuzz = 0; // FIXIT PAF add a little zippedy-do-dah + uint16_t fuzz = 0; // FIXIT-L PAF add a little zippedy-do-dah if ( (ps->paf != PAF_FLUSH) && (s5_len > ss->max()+fuzz) ) { uint32_t fp = s5_paf_flush(ss, ps, FT_MAX, flags); diff --git a/src/stream/tcp/tcp_session.cc b/src/stream/tcp/tcp_session.cc index a4ba2c1a1..a862e02f3 100644 --- a/src/stream/tcp/tcp_session.cc +++ b/src/stream/tcp/tcp_session.cc @@ -368,7 +368,7 @@ static inline bool DataToFlush (const StreamTracker* st) if ( st->flush_policy ) return ( SegsToFlush(st, 1) > 0 ); - return ( SegsToFlush(st, 2) > 1 ); // FIXIT return false? + return ( SegsToFlush(st, 2) > 1 ); // FIXIT-L return false? } /* P R O T O T Y P E S ********************************************/ @@ -665,7 +665,7 @@ StreamTcpConfig::StreamTcpConfig() } //------------------------------------------------------------------------- -// FIXIT directionality must be fixed per 297 bug fixes +// FIXIT-L directionality must be fixed per 297 bug fixes // // when client ports are configured, that means c2s and is stored on the // client side; when the session starts, the server policy is obtained from @@ -1306,7 +1306,7 @@ static inline int ValidTimestamp(StreamTracker *talker, if ( p->tcph->th_flags & TH_ACK && Normalize_IsEnabled(p, NORM_TCP_OPT) ) { - // FIXIT validate tsecr here (check that it was previously sent) + // FIXIT-L validate tsecr here (check that it was previously sent) // checking for the most recent ts is easy enough must check if // ts are up to date in retransmitted packets } @@ -1582,7 +1582,7 @@ static inline void UpdateSsn( { #if 0 if ( - // FIXIT these checks are a hack to avoid off by one normalization + // FIXIT-L these checks are a hack to avoid off by one normalization // due to FIN ... if last segment filled a hole, r_nxt_ack is not at // end of data, FIN is ignored so sequence isn't bumped, and this // forces seq-- on ACK of FIN. :( @@ -1594,8 +1594,8 @@ static inline void UpdateSsn( // if a gap exists prior to ack, move ack back to start of gap StreamSegment* seg = snd->seglist; - // FIXIT must check ack oob with empty seglist - // FIXIT add lower gap bound to tracker for efficiency? + // FIXIT-L must check ack oob with empty seglist + // FIXIT-L add lower gap bound to tracker for efficiency? while ( seg ) { uint32_t seq = seg->seq + seg->size; @@ -1645,8 +1645,8 @@ static inline void UpdateSsn( void tcp_sinit() { s5_pkt = PacketManager::encode_new(); - tcp_memcap = new Memcap(26214400); // FIXIT replace with session memcap - //AtomSplitter::init(); // FIXIT PAF implement + tcp_memcap = new Memcap(26214400); // FIXIT-M replace with session memcap + //AtomSplitter::init(); // FIXIT-L PAF implement } void tcp_sterm() @@ -1858,7 +1858,7 @@ static inline void purge_all (StreamTracker *st) // * we may flush partial segments // * must adjust seq->seq and seg->size when a flush gets only the // initial part of a segment -// * FIXIT need flag to mark any reassembled packets that have a gap +// * FIXIT-L need flag to mark any reassembled packets that have a gap // (if we reassemble such) static inline int purge_flushed_ackd (TcpSession *tcpssn, StreamTracker *st) { @@ -1967,7 +1967,7 @@ static int FlushStream( } else if ( !bytes_copied ) { - // FIXIT change stream splitter default reassemble + // FIXIT-P change stream splitter default reassemble // to copy into external buffer to eliminate this special case memcpy(flushbuf, ss->payload, bytes_to_copy); } @@ -1999,9 +1999,9 @@ static int FlushStream( break; /* Check for a gap/missing packet */ - // FIXIT PAF should account for missing data and resume + // FIXIT-L PAF should account for missing data and resume // scanning at the start of next PDU instead of aborting. - // FIXIT FIN may be in toSeq causing bogus gap counts. + // FIXIT-L FIN may be in toSeq causing bogus gap counts. if ( (ss->next && (ss->seq + ss->size != ss->next->seq)) || (!ss->next && (ss->seq + ss->size < toSeq))) { @@ -2061,7 +2061,7 @@ static inline int _flush_to_seq ( if ( !bytes && SEQ_GT(st->r_win_base, st->seglist_base_seq) ) bytes = st->r_win_base - st->seglist_base_seq; - // FIXIT this should not be necessary here + // FIXIT-L this should not be necessary here st->seglist_base_seq = st->seglist_next->seq; stop_seq = st->seglist_base_seq + bytes; @@ -2239,7 +2239,7 @@ static inline uint32_t get_q_footprint(StreamTracker *st) return fp; } -// FIXIT get_q_sequenced() performance could possibly be +// FIXIT-L get_q_sequenced() performance could possibly be // boosted by tracking sequenced bytes as seglist is updated // to avoid the while loop, etc. below. static inline uint32_t get_q_sequenced(StreamTracker *st) @@ -2280,7 +2280,7 @@ static inline int flush_ackd( return flush_to_seq(tcpssn, st, bytes, p, dir); } -// FIXIT flush_stream() calls should be replaced with calls to +// FIXIT-L flush_stream() calls should be replaced with calls to // CheckFlushPolicyOn*() with the exception that for the *OnAck() case, // any available ackd data must be flushed in both directions. static inline int flush_stream( @@ -2588,7 +2588,7 @@ static void CheckSegments (const StreamTracker* a) #define LCL(p, x) (p->x - p->isn) #define RMT(p, x, q) (p->x - (q ? q->isn : 0)) -// FIXIT this should not be thread specific +// FIXIT-L this should not be thread specific static THREAD_LOCAL int s5_trace_enabled = -1; static void TraceEvent ( @@ -3996,7 +3996,7 @@ static int ProcessTcpData( } /* move the ack boundry up, this is the only way we'll accept data */ - // FIXIT for ips, must move all the way to first hole or right end + // FIXIT-L for ips, must move all the way to first hole or right end if (listener->s_mgr.state_queue == TCP_STATE_NONE) listener->r_nxt_ack = tdb->end_seq; @@ -4047,7 +4047,7 @@ static int ProcessTcpData( { /* set next ack so we are within the window going forward on * this side. */ - // FIXIT for ips, must move all the way to first hole or right end + // FIXIT-L for ips, must move all the way to first hole or right end listener->r_nxt_ack = tdb->end_seq; } } @@ -4262,7 +4262,7 @@ static int NewTcpSession( /* Set the StreamTcpConfig for each direction (pkt from client) */ - tmp->client.config = dstPolicy; // FIXIT BINDING use external for both dirs + tmp->client.config = dstPolicy; // FIXIT-H BINDING use external for both dirs tmp->server.config = dstPolicy; CopyMacAddr(p, tmp, FROM_CLIENT); @@ -4312,7 +4312,7 @@ static int NewTcpSession( tmp->server.flags |= Stream5GetWscale(p, &tmp->server.wscale); /* Set the config for each direction (pkt from server) */ - tmp->server.config = dstPolicy; // FIXIT BINDING use external for both dirs + tmp->server.config = dstPolicy; // FIXIT-H BINDING use external for both dirs tmp->client.config = dstPolicy; CopyMacAddr(p, tmp, FROM_SERVER); @@ -4359,7 +4359,7 @@ static int NewTcpSession( tmp->client.flags |= Stream5GetWscale(p, &tmp->client.wscale); /* Set the config for each direction (pkt from client) */ - tmp->client.config = dstPolicy; // FIXIT BINDING use external for both dirs + tmp->client.config = dstPolicy; // FIXIT-H BINDING use external for both dirs tmp->server.config = dstPolicy; CopyMacAddr(p, tmp, FROM_CLIENT); @@ -4415,7 +4415,7 @@ static int NewTcpSession( tmp->client.flags |= Stream5GetWscale(p, &tmp->client.wscale); /* Set the config for each direction (pkt from client) */ - tmp->client.config = dstPolicy; // FIXIT BINDING use external for both dirs + tmp->client.config = dstPolicy; // FIXIT-H BINDING use external for both dirs tmp->server.config = dstPolicy; CopyMacAddr(p, tmp, FROM_CLIENT); @@ -4457,7 +4457,7 @@ static int NewTcpSession( tmp->server.flags |= Stream5GetWscale(p, &tmp->server.wscale); /* Set the config for each direction (pkt from server) */ - tmp->server.config = dstPolicy; // FIXIT BINDING use external for both dirs + tmp->server.config = dstPolicy; // FIXIT-H BINDING use external for both dirs tmp->client.config = dstPolicy; CopyMacAddr(p, tmp, FROM_SERVER); @@ -4701,7 +4701,7 @@ static int ProcessTcp( if ( !tcpssn->tcp_init ) { { - // FIXIT expected flow should be checked by flow_con before we + // FIXIT-L expected flow should be checked by flow_con before we // get here char ignore = flow_con->expected_flow(lwssn, p); @@ -4997,7 +4997,7 @@ static int ProcessTcp( "Got SYN pkt on reset ssn, re-SYN-ing\n");); } - // FIXIT why flush here instead of just purge? + // FIXIT-L why flush here instead of just purge? // s5_ignored_session() may be disabling detection too soon if we really want to flush if ( stream.ignored_session(lwssn, p) ) { @@ -5436,7 +5436,7 @@ static int ProcessTcp( } if ( lwssn->s5_state.session_flags & SSNFLAG_MIDSTREAM ) { - // FIXIT this should be handled below in fin section + // FIXIT-L this should be handled below in fin section // but midstream sessions fail the seq test listener->s_mgr.state_queue = TCP_STATE_TIME_WAIT; listener->s_mgr.transition_seq = tdb->end_seq; @@ -5487,7 +5487,7 @@ static int ProcessTcp( break; default: - // FIXIT safe to ignore when inline? + // FIXIT-L safe to ignore when inline? break; } } @@ -5714,7 +5714,7 @@ dupfin: if(flushed) { - // FIXIT - these calls redundant? + // FIXIT-L - these calls redundant? purge_alerts(talker, talker->r_win_base, tcpssn->flow); purge_to_seq(tcpssn, talker, talker->seglist->seq + flushed); } @@ -5903,7 +5903,7 @@ static inline int CheckFlushPolicyOnData( while ( flush_amt > 0 ) { #if 0 - // FIXIT can't do this with new HI - copy is inevitable + // FIXIT-P can't do this with new HI - copy is inevitable // if this payload is exactly one pdu, don't // actually flush, just use the raw packet if ( (tdb->seq == listener->seglist->seq) && @@ -5933,7 +5933,7 @@ static inline int CheckFlushPolicyOnData( } if ( !flags && listener->splitter->is_paf() ) { - // FIXIT PAF auto disable with multiple splitters? + // FIXIT-L PAF auto disable with multiple splitters? //if ( AutoDisable(listener, talker) ) // return 0; @@ -6063,7 +6063,7 @@ int CheckFlushPolicyOnAck( } if ( !flags && talker->splitter->is_paf() ) { - // FIXIT PAF auto disable with multiple splitters? + // FIXIT-L PAF auto disable with multiple splitters? //if ( AutoDisable(talker, listener) ) // return 0; @@ -6597,7 +6597,7 @@ bool TcpSession::setup (Packet* p) { if ( TCP_ISFLAGSET(p->tcph, TH_SYN) && !TCP_ISFLAGSET(p->tcph, TH_ACK) ) - flow->session_state = STREAM5_STATE_SYN; // FIXIT same as line 4555 + flow->session_state = STREAM5_STATE_SYN; // FIXIT-L same as line 4555 assert(flow->session == this); reset(); @@ -6614,7 +6614,7 @@ bool TcpSession::setup (Packet* p) return true; } -// FIXIT diff betw TcpSessionCleanup() and TcpSessionClear() ? +// FIXIT-L diff betw TcpSessionCleanup() and TcpSessionClear() ? // Cleanup() flushes data; Clear() does not flush data void TcpSession::cleanup() { @@ -6622,7 +6622,7 @@ void TcpSession::cleanup() TcpSessionCleanup(flow, 1); } -// FIXIT this was originally called by Stream::drop_packet() +// FIXIT-L this was originally called by Stream::drop_packet() // which is now calling Session::clear() void TcpSession::clear() { @@ -6707,7 +6707,7 @@ int TcpSession::process(Packet *p) !TCP_ISFLAGSET(p->tcph, TH_ACK)) { /* SYN only */ - flow->session_state = STREAM5_STATE_SYN; // FIXIT same as line 4511 + flow->session_state = STREAM5_STATE_SYN; // FIXIT-L same as line 4511 } else { diff --git a/src/stream/tcp/tcp_session.h b/src/stream/tcp/tcp_session.h index b99f47ea3..e18d25093 100644 --- a/src/stream/tcp/tcp_session.h +++ b/src/stream/tcp/tcp_session.h @@ -136,7 +136,7 @@ struct StreamTracker StreamSegment *seglist; /* first queued segment */ StreamSegment *seglist_tail; /* last queued segment */ - // FIXIT seglist_base_seq is the sequence number to flush from + // FIXIT-P seglist_base_seq is the sequence number to flush from // and is valid even when seglist is empty. seglist_next is // the segment to flush from and is set per packet. should keep // up to date. @@ -186,7 +186,7 @@ struct StreamTracker }; -// FIXIT ideally, session tracking would be split from reassembly +// FIXIT-L ideally, session tracking would be split from reassembly // into a separate module a la ip_session.cc and ip_defrag.cc // (of course defrag should also be cleaned up) class TcpSession : public Session diff --git a/src/stream/udp/udp_session.cc b/src/stream/udp/udp_session.cc index 866ca5981..4213d17ee 100644 --- a/src/stream/udp/udp_session.cc +++ b/src/stream/udp/udp_session.cc @@ -81,8 +81,8 @@ static void UdpSessionCleanup(Flow *lwssn) static int ProcessUdp( Flow *lwssn, Packet *p, StreamUdpConfig*, SFXHASH_NODE*) { - if (lwssn->protocol != IPPROTO_UDP) // FIXIT checked by tcp, icmp, and ip too? - // FIXIT need to free lwssn and get a new one + if (lwssn->protocol != IPPROTO_UDP) // FIXIT-P checked by tcp, icmp, and ip too? + // FIXIT-L need to free lwssn and get a new one { DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, "Lightweight session not UDP on UDP packet\n");); @@ -236,7 +236,7 @@ int UdpSession::process(Packet *p) #if 0 void udp_stats() { - // FIXIT need to get these before delete flow_con + // FIXIT-L need to get these before delete flow_con //flow_con->get_prunes(IPPROTO_UDP, udpStats.prunes); } #endif diff --git a/src/target_based/sftarget_reader.cc b/src/target_based/sftarget_reader.cc index 3a180ffa1..8c47d46c3 100644 --- a/src/target_based/sftarget_reader.cc +++ b/src/target_based/sftarget_reader.cc @@ -75,8 +75,8 @@ tTargetBasedConfig::tTargetBasedConfig() { /* Add 1 to max for table purposes * We use max_hosts to limit memcap, assume 16k per entry costs*/ - // FIXIT 16k per host is no longer true - // FIXIT init before snort_conf; move to filename and load separately + // FIXIT-M 16k per host is no longer true + // FIXIT-M init before snort_conf; move to filename and load separately // this is a hack to get it going uint32_t max = snort_conf ? ScMaxAttrHosts() : DEFAULT_MAX_ATTRIBUTE_HOSTS; lookupTable = sfrt_new(DIR_8x16, IPv6, max + 1, (max>>6) + 1); @@ -91,7 +91,7 @@ tTargetBasedConfig::~tTargetBasedConfig() static THREAD_LOCAL tTargetBasedConfig* curr_cfg = NULL; static tTargetBasedConfig* next_cfg = NULL; -// FIXIT ensure these are not used by packet threads +// FIXIT-H ensure these are not used by packet threads static HostAttributeEntry *current_host = NULL; static ApplicationEntry *current_app = NULL; diff --git a/src/time/ppm.cc b/src/time/ppm.cc index 6d700eee8..1d28b3cbd 100644 --- a/src/time/ppm.cc +++ b/src/time/ppm.cc @@ -114,7 +114,7 @@ typedef struct } ppm_rules_t; /* suspended rules */ -// FIXIT storing rule tree pointers is a bad idea +// FIXIT-L storing rule tree pointers is a bad idea // - no accommodation for reload // - really not used except to log // - should be deleted @@ -122,7 +122,7 @@ static THREAD_LOCAL ppm_rules_t ppm_rules[MAX_DP_NRULES]; static THREAD_LOCAL int ppm_n_rules; /* cleared rules - re-enabled */ -// FIXIT see above re storing rule tree pointers +// FIXIT-L see above re storing rule tree pointers static THREAD_LOCAL detection_option_tree_root_t * ppm_crules[MAX_DP_NRULES]; static THREAD_LOCAL int ppm_n_crules; @@ -238,7 +238,7 @@ static int print_rule( int, RuleTreeNode*, OptTreeNode * o ) return 0; } -// FIXIT ppm_stats should be rolled into ppm module +// FIXIT-L ppm_stats should be rolled into ppm module // (not just peg counts; need module support) void ppm_sum_stats() diff --git a/src/time/profiler.cc b/src/time/profiler.cc index 792622aab..db3c69a17 100644 --- a/src/time/profiler.cc +++ b/src/time/profiler.cc @@ -255,7 +255,7 @@ void PrintWorstRules(int numToPrint) if (numToPrint != -1) { - // FIXIT this is fugly; should have a LogMessage() type "file" within + // FIXIT-L this is fugly; should have a LogMessage() type "file" within // TextLog so this if (log) TextLog_Print() else LogMessage() isn't // necessary. if(log) diff --git a/src/utils/dyn_array.cc b/src/utils/dyn_array.cc index 0177b8573..c2dc45054 100644 --- a/src/utils/dyn_array.cc +++ b/src/utils/dyn_array.cc @@ -30,7 +30,7 @@ /**Number of additional policies allocated with each re-alloc operation. */ #define POLICY_ALLOCATION_CHUNK 10 -// FIXIT replace with vector +// FIXIT-L replace with vector int sfDynArrayCheckBounds ( void ** dynArray, unsigned int index, diff --git a/src/utils/dyn_array.h b/src/utils/dyn_array.h index f969d9d24..5d0e54679 100644 --- a/src/utils/dyn_array.h +++ b/src/utils/dyn_array.h @@ -34,7 +34,7 @@ * 0 value means no elements are allocated * and therefore dynArray[0] will cause memory allocation. */ -int sfDynArrayCheckBounds ( // FIXIT replace with std::vector +int sfDynArrayCheckBounds ( void** dynArray, unsigned int index, unsigned int *maxElements); #endif diff --git a/src/utils/segment_mem.cc b/src/utils/segment_mem.cc index 1e2f42c24..24f747f91 100644 --- a/src/utils/segment_mem.cc +++ b/src/utils/segment_mem.cc @@ -30,7 +30,7 @@ #include "snort_types.h" #ifndef SIZE_MAX -#define SIZE_MAX 0xFFFFFFFF // FIXIT use c++ value +#define SIZE_MAX 0xFFFFFFFF // FIXIT-L use c++ value #endif /*point to the start of the unused memory*/ diff --git a/src/utils/stats.cc b/src/utils/stats.cc index 1605b133d..66339c47a 100644 --- a/src/utils/stats.cc +++ b/src/utils/stats.cc @@ -306,7 +306,7 @@ void DropStats() // ensure proper counting of log_limit SnortEventqResetCounts(); - // FIXIT alert_pkts excludes rep hits + // FIXIT-L alert_pkts excludes rep hits if ( gpc.total_alert_pkts == gpc.alert_pkts ) gpc.total_alert_pkts = 0; @@ -327,7 +327,7 @@ void PrintStatistics (void) DropStats(); timing_stats(); - // FIXIT below stats need to be made consistent with above + // FIXIT-L below stats need to be made consistent with above fpShowEventStats(snort_conf); print_thresholding(snort_conf->threshold_config, 1); diff --git a/src/utils/util.h b/src/utils/util.h index 0b9e19583..a8ff4e8de 100644 --- a/src/utils/util.h +++ b/src/utils/util.h @@ -131,7 +131,7 @@ static inline void* SnortAlloc (unsigned long size) if ( pv ) return pv; - // FIXIT do not FatalError() on runtime allocation failures + // FIXIT-M do not FatalError() on runtime allocation failures FatalError("Unable to allocate memory! (%lu requested)\n", size); return NULL; @@ -267,10 +267,4 @@ const char* get_error(int errnum); // reentrant. char* get_tok(char* s, const char* delim); -/* for getopt */ -extern char *optarg; // FIXIT add header -extern int optind; -extern int opterr; -extern int optopt; - #endif /*__UTIL_H__*/