From: Russ Combs Date: Tue, 23 Sep 2014 13:27:16 +0000 (-0400) Subject: basic reload restoration X-Git-Tag: 3.0.0-233~1404^2~9 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=38d0eb7ca8fcb7e05a2d71b3e1982fae29fc8812;p=thirdparty%2Fsnort3.git basic reload restoration --- diff --git a/ChangeLog b/ChangeLog index 4e036ce38..79c272dac 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,5 +1,6 @@ 121 -- valgrind fixes +-- basic reload restoration 120 -- tweaked --help! diff --git a/src/detection/fpcreate.cc b/src/detection/fpcreate.cc index 9a7cdb850..5f361662c 100644 --- a/src/detection/fpcreate.cc +++ b/src/detection/fpcreate.cc @@ -2220,29 +2220,29 @@ void fpBuildServicePortGroups( FatalError("Could not AddProtocolReference!\n"); else if( id >= MAX_PROTOCOL_ORDINAL ) - LogMessage("protocol-ordinal=%d exceeds " + ParseWarning("protocol-ordinal=%d exceeds " "limit of %d for service=%s\n",id,MAX_PROTOCOL_ORDINAL,srvc); } else if( id > 0 ) { if( id < MAX_PROTOCOL_ORDINAL ) { - LogMessage("adding protocol-ordinal=%d as service=%s\n",id,srvc); + //LogMessage("adding protocol-ordinal=%d as service=%s\n",id,srvc); sopg[ id ] = pg; } else - LogMessage("protocol-ordinal=%d exceeds " + ParseError("protocol-ordinal=%d exceeds " "limit of %d for service=%s\n",id,MAX_PROTOCOL_ORDINAL,srvc); } else /* id < 0 */ { - LogMessage("adding protocol-ordinal=%d for " + ParseError("adding protocol-ordinal=%d for " "service=%s, can't use that !!!\n",id,srvc); } } else { - LogMessage("*** failed to create and find a port group for '%s' !!! \n",srvc ); + ParseError("*** failed to create and find a port group for '%s' !!! \n",srvc ); } } } diff --git a/src/detection/treenodes.cc b/src/detection/treenodes.cc index ab07fa05f..e3a025090 100644 --- a/src/detection/treenodes.cc +++ b/src/detection/treenodes.cc @@ -118,14 +118,13 @@ void* get_rule_type_data(OptTreeNode* otn, const char* name) while ( fpl ) { - if ( !fpl->context ) - continue; - - IpsOption* opt = (IpsOption*)fpl->context; - - if ( !strcmp(opt->get_name(), name) ) - return fpl->context; + if ( fpl->context ) + { + IpsOption* opt = (IpsOption*)fpl->context; + if ( !strcmp(opt->get_name(), name) ) + return fpl->context; + } fpl = fpl->next; } return nullptr; diff --git a/src/main/analyzer.cc b/src/main/analyzer.cc index 0020245b2..fcca76daa 100644 --- a/src/main/analyzer.cc +++ b/src/main/analyzer.cc @@ -71,6 +71,7 @@ bool Analyzer::execute(AnalyzerCommand ac) // FIXIT-L executing a command while paused // will cause a resume command = ac; + take_break(); return true; } @@ -131,7 +132,7 @@ void Analyzer::analyze() if ( DAQ_Acquire(0, main_func, NULL) ) break; - // FIXIT-M acquire(0) won't return until no packets, signal, etc. + // FIXIT-L acquire(0) won't return until no packets, signal, etc. // which makes this idle unlikely to execute under high traffic // conditions; that means the idle processing may not be useful // or that we need a hook to do things periodically even when diff --git a/src/main/analyzer.h b/src/main/analyzer.h index 3351ac2eb..773e25048 100644 --- a/src/main/analyzer.h +++ b/src/main/analyzer.h @@ -50,7 +50,7 @@ public: bool execute(AnalyzerCommand); void set_config(Swapper* ps) { swap = ps; }; - bool swap_pending() { return swap != nullptr; }; + bool swap_pending() { return command == AC_SWAP; }; private: void analyze(); diff --git a/src/main/snort.cc b/src/main/snort.cc index e1087ec9b..12274bbc4 100644 --- a/src/main/snort.cc +++ b/src/main/snort.cc @@ -343,18 +343,19 @@ static void SnortInit(int argc, char **argv) */ SetRuleStates(snort_conf); - /* Need to do this after dynamic detection stuff is initialized, too */ - IpsManager::verify(snort_conf); - if (snort_conf->file_mask != 0) umask(snort_conf->file_mask); else umask(077); /* set default to be sane */ + /* Need to do this after dynamic detection stuff is initialized, too */ + IpsManager::verify(snort_conf); IpsManager::global_init(snort_conf); + ModuleManager::load_commands(snort_conf); fpCreateFastPacketDetection(snort_conf); MpseManager::activate_search_engine(snort_conf); + CodecManager::instantiate(); SFAT_Start(); @@ -604,6 +605,7 @@ static SnortConfig * get_reload_config(void) /* Need to do this after dynamic detection stuff is initialized, too */ IpsManager::verify(sc); + ModuleManager::load_commands(snort_conf); if ((sc->file_mask != 0) && (sc->file_mask != snort_conf->file_mask)) umask(sc->file_mask); @@ -896,6 +898,9 @@ DAQ_Verdict packet_callback( if ( snort_conf->pkt_cnt && pc.total_from_daq >= snort_conf->pkt_cnt ) DAQ_BreakLoop(-1); + if ( break_time() ) + DAQ_BreakLoop(0); + MODULE_PROFILE_END(totalPerfStats); return verdict; } diff --git a/src/main/thread.cc b/src/main/thread.cc index 72737c9d5..dfce671f1 100644 --- a/src/main/thread.cc +++ b/src/main/thread.cc @@ -56,6 +56,25 @@ unsigned get_instance_max() return instance_max; } +//------------------------------------------------------------------------- +// union rules +//------------------------------------------------------------------------- + +static unsigned g_breaks = 0; +static THREAD_LOCAL unsigned t_breaks = 0; + +void take_break() +{ g_breaks++; } + +bool break_time() +{ + if ( t_breaks == g_breaks ) + return false; + + t_breaks = g_breaks; + return true; +} + //------------------------------------------------------------------------- // format is: // /[][][] diff --git a/src/main/thread.h b/src/main/thread.h index ebfa1aac9..87d4100eb 100644 --- a/src/main/thread.h +++ b/src/main/thread.h @@ -43,5 +43,8 @@ SO_PUBLIC unsigned get_instance_max(); SO_PUBLIC const char* get_instance_file(std::string&, const char* name); +void take_break(); +bool break_time(); + #endif diff --git a/src/managers/action_manager.cc b/src/managers/action_manager.cc index cb67d2ae5..a5fd001b7 100644 --- a/src/managers/action_manager.cc +++ b/src/managers/action_manager.cc @@ -37,7 +37,7 @@ using namespace std; struct Actor { const ActionApi* api; - IpsAction* act; + IpsAction* act; // FIXIT-H must move to SnortConfig for reload? Actor(const ActionApi* p) { api = p; act = nullptr; }; @@ -80,7 +80,7 @@ static void store(const ActionApi* api, IpsAction* act) for ( auto& p : s_actors ) if ( p.api == api ) { - assert(!p.act); + //assert(!p.act); FIXIT-H memory leak on reload p.act = act; break; } diff --git a/src/managers/data_manager.cc b/src/managers/data_manager.cc index 3170996b9..2de9c5b42 100644 --- a/src/managers/data_manager.cc +++ b/src/managers/data_manager.cc @@ -31,6 +31,8 @@ using namespace std; struct DataBlock { const DataApi* api; + + // FIXIT-H move data to snort config for reload PlugData* data; DataBlock(const DataApi* p) @@ -120,7 +122,11 @@ PlugData* DataManager::acquire(const char* key, SnortConfig* sc) void DataManager::release(PlugData* p) { DataBlock* b = get_data(p); - assert(b && b->data); + + // FIXIT-H this implementation can't reload + //assert(b && b->data); + if ( !b ) + return; b->data->rem_ref(); diff --git a/src/managers/module_manager.cc b/src/managers/module_manager.cc index deab6b13b..84022138d 100644 --- a/src/managers/module_manager.cc +++ b/src/managers/module_manager.cc @@ -438,12 +438,6 @@ void ModuleManager::add_module(Module* m, const BaseApi* b) ModHook* mh = new ModHook(m, b); s_modules.push_back(mh); - if ( mh->reg ) - { - SnortConfig* sc = snort_conf; - sc->policy_map->get_shell()->install(m->get_name(), mh->reg); - } - #ifdef PERF_PROFILING RegisterProfile(m); #endif @@ -712,6 +706,19 @@ void ModuleManager::show_rules(const char* pfx) } } +void ModuleManager::load_commands(SnortConfig* sc) +{ + // FIXIT-L ideally only install commands from configured modules + // FIXIT-L install commands into working shell + Shell* sh = sc->policy_map->get_shell(); + + for ( auto p : s_modules ) + { + if ( p->reg ) + sh->install(p->mod->get_name(), p->reg); + } +} + // FIXIT-L currently no way to know whether a module was activated or not // so modules with common rules will cause duplicate sid warnings // eg http_inspect and nhttp_inspect both have 119:1-34 diff --git a/src/managers/module_manager.h b/src/managers/module_manager.h index 67a38a4f2..9e6b39a97 100644 --- a/src/managers/module_manager.h +++ b/src/managers/module_manager.h @@ -47,6 +47,7 @@ public: static void show_rules(const char* = nullptr); static void dump_rules(const char* = nullptr); + static void load_commands(SnortConfig*); static void load_rules(SnortConfig*); static void set_config(SnortConfig*); static unsigned get_errors(); diff --git a/src/network_inspectors/arp_spoof/arp_module.cc b/src/network_inspectors/arp_spoof/arp_module.cc index f5c4bc6ab..ed09532fd 100644 --- a/src/network_inspectors/arp_spoof/arp_module.cc +++ b/src/network_inspectors/arp_spoof/arp_module.cc @@ -79,8 +79,7 @@ static const RuleMap s_rules[] = ArpSpoofModule::ArpSpoofModule() : Module(MOD_NAME, MOD_HELP, s_params) { - config = new ArpSpoofConfig; - config->check_overwrite = false; + config = nullptr; } ArpSpoofModule::~ArpSpoofModule() @@ -109,8 +108,20 @@ bool ArpSpoofModule::set(const char*, Value& v, SnortConfig*) return true; } +ArpSpoofConfig* ArpSpoofModule::get_config() +{ + ArpSpoofConfig* temp = config; + config = nullptr; + return temp; +} + bool ArpSpoofModule::begin(const char*, int, SnortConfig*) { + if ( !config ) + { + config = new ArpSpoofConfig; + config->check_overwrite = false; + } memset(&host, 0, sizeof(host)); return true; } diff --git a/src/network_inspectors/arp_spoof/arp_module.h b/src/network_inspectors/arp_spoof/arp_module.h index f060ce88c..df1e94608 100644 --- a/src/network_inspectors/arp_spoof/arp_module.h +++ b/src/network_inspectors/arp_spoof/arp_module.h @@ -65,12 +65,7 @@ public: bool begin(const char*, int, SnortConfig*); bool end(const char*, int, SnortConfig*); - ArpSpoofConfig* get_config() - { - ArpSpoofConfig* temp = config; - config = nullptr; - return temp; - }; + ArpSpoofConfig* get_config(); const char** get_pegs() const; PegCount* get_counts() const; diff --git a/src/packet_io/sfdaq.cc b/src/packet_io/sfdaq.cc index b68128629..7ac9065cb 100644 --- a/src/packet_io/sfdaq.cc +++ b/src/packet_io/sfdaq.cc @@ -1,6 +1,6 @@ /**************************************************************************** * -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. + * Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. * Copyright (C) 2005-2013 Sourcefire, Inc. * * This program is free software; you can redistribute it and/or modify diff --git a/src/target_based/sftarget_reader.cc b/src/target_based/sftarget_reader.cc index 23153133c..291a9fd60 100644 --- a/src/target_based/sftarget_reader.cc +++ b/src/target_based/sftarget_reader.cc @@ -381,10 +381,10 @@ tTargetBasedConfig* SFAT_Swap() int IsAdaptiveConfigured() { - if ( !curr_cfg ) - return 0; + if ( curr_cfg || next_cfg ) + return 1; - return 1; + return 0; } void SFAT_UpdateApplicationProtocol(sfip_t *ipAddr, uint16_t port, uint16_t protocol, uint16_t id)