From: Russ Combs Date: Sat, 12 Sep 2015 14:03:47 +0000 (-0400) Subject: fix plain file processing X-Git-Tag: 3.0.0-233~833^2 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=46ce915bd21db62f4e7b63cdf6eeba48e6b576da;p=thirdparty%2Fsnort3.git fix plain file processing update location of dnet fix breakloop in file daq update usage and bug list move hext logger from extra to main source tree fix detection of stream_user and stream_file data --- diff --git a/configure.ac b/configure.ac index 9f021ef75..6ba2705d7 100644 --- a/configure.ac +++ b/configure.ac @@ -696,7 +696,7 @@ AC_CHECK_HEADERS(dumbnet.h,,DUMBNET_H="no") if test "x$DNET_H" = "xno" -a "x$DUMBNET_H" = "xno"; then echo echo " ERROR: dnet header not found, go get it from" - echo " http://code.google.com/p/libdnet/ or use the --with-dnet-*" + echo " https://github.com/dugsong/libdnet.git or use the --with-dnet-*" echo " options, if you have it installed in an unusual place" exit fi diff --git a/daqs/daq_file.c b/daqs/daq_file.c index 1b5730fd2..c39778302 100644 --- a/daqs/daq_file.c +++ b/daqs/daq_file.c @@ -273,7 +273,7 @@ static int file_daq_acquire ( int hit = 0, miss = 0; impl->stop = 0; - while ( hit < cnt || cnt <= 0 ) + while ( (hit < cnt || cnt <= 0) && !impl->stop ) { int status = file_daq_process(impl, callback, user); @@ -285,7 +285,7 @@ static int file_daq_acquire ( else if ( status < 0 ) return status; - else if ( ++miss == 2 || impl->stop ) + else if ( ++miss == 2 ) break; } return DAQ_SUCCESS; diff --git a/doc/bugs.txt b/doc/bugs.txt index d55baabe6..c231370a3 100644 --- a/doc/bugs.txt +++ b/doc/bugs.txt @@ -34,8 +34,11 @@ saves the correct version. ERROR: invalid perf_monitor.max_file_size = 4.29497e+09 -* Using -L when -c is also used will not actually log; nor will it warn or - error out. This is likely to confuse. +* When using -c and -L together, the last on the command line wins (-c -L + will dump; -L -c will analyze). + +* Modules instantiated by command line only will not get default settings + unless hard-coded. This notably applies to -A and -L options. ==== Rules diff --git a/doc/start.txt b/doc/start.txt index b0b3a28c5..a57431172 100644 --- a/doc/start.txt +++ b/doc/start.txt @@ -11,7 +11,7 @@ Required: * daq from http://www.snort.org for packet IO -* dnet from http://code.google.com/p/libdnet/ for network utility functions +* dnet from https://github.com/dugsong/libdnet.git for network utility functions * LuaJIT from http://luajit.org for configuration and scripting diff --git a/doc/usage.txt b/doc/usage.txt index 04cd1366d..ea788d61f 100644 --- a/doc/usage.txt +++ b/doc/usage.txt @@ -181,8 +181,7 @@ default to stdout. These options can be combined. Process hext packets from stdin: snort -c $my_path/etc/snort/snort.lua \ - --plugin-path $my_path/lib/snort_extra \ - --daq-dir $my_path/lib/snort_extra/daqs --daq hext -i tty << END + --daq-dir $my_path/lib/snort/daqs --daq hext -i tty << END $packet 10.1.2.3 48620 -> 10.9.8.7 80 "GET / HTTP/1.1\r\n" "Host: localhost\r\n" @@ -192,30 +191,27 @@ Process hext packets from stdin: Process raw ethernet from hext file: snort -c $my_path/etc/snort/snort.lua \ - --plugin-path $my_path/lib/snort_extra \ - --daq-dir $my_path/lib/snort_extra/daqs --daq hext \ + --daq-dir $my_path/lib/snort/daqs --daq hext \ --daq-var dlt=1 -r -Process a directory of plain files (ie non-pcap) with 4 threads: +Process a directory of plain files (ie non-pcap) with 4 threads with 8K +buffers: snort -c $my_path/etc/snort/snort.lua \ - --plugin-path $my_path/lib/snort_extra \ - --daq-dir $my_path/lib/snort_extra/daqs --daq file \ - --pcap-dir path/to/files -z 4 + --daq-dir $my_path/lib/snort/daqs --daq file \ + --pcap-dir path/to/files -z 4 -s 8192 Bridge two TCP connections on port 8000 and inspect the traffic: snort -c $my_path/etc/snort/snort.lua \ - --plugin-path $my_path/lib/snort_extra \ - --daq-dir $my_path/lib/snort_extra/daqs --daq socket + --daq-dir $my_path/lib/snort/daqs --daq socket ==== Logger Alternatives Dump TCP stream payload in hext mode: - snort -c $my_path/etc/snort/snort.lua \ - --plugin-path $my_path/lib/snort_extra -L hext + snort -c $my_path/etc/snort/snort.lua -L hext Output timestamp, pkt_num, proto, pkt_gen, dgm_len, dir, src_ap, dst_ap, rule, action for each alert: diff --git a/extra/src/loggers/CMakeLists.txt b/extra/src/loggers/CMakeLists.txt index fe217875f..bbe037765 100644 --- a/extra/src/loggers/CMakeLists.txt +++ b/extra/src/loggers/CMakeLists.txt @@ -1,6 +1,5 @@ add_example_library(alert_ex loggers alert_ex.cc) -add_example_library(log_hext loggers log_hext.cc) install ( FILES alert.lua diff --git a/extra/src/loggers/Makefile.am b/extra/src/loggers/Makefile.am index 4f7de2c40..0f3e46f1e 100644 --- a/extra/src/loggers/Makefile.am +++ b/extra/src/loggers/Makefile.am @@ -6,11 +6,6 @@ libalert_ex_la_CXXFLAGS = $(AM_CXXFLAGS) libalert_ex_la_LDFLAGS = -export-dynamic -shared libalert_ex_la_SOURCES = alert_ex.cc -loglib_LTLIBRARIES += liblog_hext.la -liblog_hext_la_CXXFLAGS = $(AM_CXXFLAGS) -liblog_hext_la_LDFLAGS = -export-dynamic -shared -liblog_hext_la_SOURCES = log_hext.cc - dist_loglib_SCRIPTS = alert.lua AM_CXXFLAGS = @AM_CXXFLAGS@ diff --git a/src/detection/fp_create.cc b/src/detection/fp_create.cc index 83a24208f..68af95585 100644 --- a/src/detection/fp_create.cc +++ b/src/detection/fp_create.cc @@ -1864,9 +1864,10 @@ int fpCreateFastPacketDetection(SnortConfig* sc) fp_print_service_groups(sc->spgmmTable); if ( mpse_count ) + { LogLabel("search engine"); - - MpseManager::print_mpse_summary(fp->get_search_api()); + MpseManager::print_mpse_summary(fp->get_search_api()); + } if ( fp->get_num_patterns_truncated() ) LogMessage("%25.25s: %-12u\n", "truncated patterns", fp->get_num_patterns_truncated()); diff --git a/src/detection/fp_detect.cc b/src/detection/fp_detect.cc index dc3c70aa1..51a1012f0 100644 --- a/src/detection/fp_detect.cc +++ b/src/detection/fp_detect.cc @@ -1304,7 +1304,7 @@ int fpEvalPacket(Packet* p) break; case PktType::FILE: - fpEvalHeaderSvc(p, omd, SNORT_PROTO_FILE); + fpEvalHeaderSvc(p, omd, SNORT_PROTO_USER); break; default: diff --git a/src/loggers/CMakeLists.txt b/src/loggers/CMakeLists.txt index a6a281fe6..e26616769 100644 --- a/src/loggers/CMakeLists.txt +++ b/src/loggers/CMakeLists.txt @@ -12,6 +12,7 @@ set (PLUGIN_LIST alert_full.cc alert_syslog.cc alert_unixsock.cc + log_hext.cc log_null.cc log_pcap.cc unified2.cc @@ -44,6 +45,7 @@ else (STATIC_LOGGERS) add_shared_library(alert_full loggers alert_full.cc) add_shared_library(alert_syslog loggers alert_syslog.cc) add_shared_library(alert_unixsock loggers alert_unixsock.cc) + add_shared_library(log_hext loggers log_hext.cc) add_shared_library(log_null loggers log_null.cc) add_shared_library(log_pcap loggers log_pcap.cc) add_shared_library(unified2 loggers unified2.cc unified2_common.h) diff --git a/src/loggers/Makefile.am b/src/loggers/Makefile.am index 5a52ef231..2e4ac58b3 100644 --- a/src/loggers/Makefile.am +++ b/src/loggers/Makefile.am @@ -12,6 +12,7 @@ alert_fast.cc \ alert_full.cc \ alert_syslog.cc \ alert_unixsock.cc \ +log_hext.cc \ log_null.cc \ log_pcap.cc \ unified2.cc \ @@ -52,6 +53,11 @@ libalert_unixsock_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO libalert_unixsock_la_LDFLAGS = -export-dynamic -shared libalert_unixsock_la_SOURCES = alert_unixsock.cc +ehlib_LTLIBRARIES += liblog_hext.la +liblog_hext_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO +liblog_hext_la_LDFLAGS = -export-dynamic -shared +liblog_hext_la_SOURCES = log_hext.cc + ehlib_LTLIBRARIES += liblog_null.la liblog_null_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO liblog_null_la_LDFLAGS = -export-dynamic -shared diff --git a/extra/src/loggers/log_hext.cc b/src/loggers/log_hext.cc similarity index 98% rename from extra/src/loggers/log_hext.cc rename to src/loggers/log_hext.cc index b35eb4eac..c1cd6322e 100644 --- a/extra/src/loggers/log_hext.cc +++ b/src/loggers/log_hext.cc @@ -172,7 +172,7 @@ bool HextModule::begin(const char*, int, SnortConfig*) raw = false; limit = 0; units = 0; - width = 0; + width = 20; return true; } @@ -276,9 +276,13 @@ static const LogApi hext_api = hext_dtor }; +#ifdef BUILDING_SO SO_PUBLIC const BaseApi* snort_plugins[] = { &hext_api.base, nullptr }; +#else +const BaseApi* log_hext = &hext_api.base; +#endif diff --git a/src/loggers/loggers.cc b/src/loggers/loggers.cc index df6ffd939..cf50d1d0c 100644 --- a/src/loggers/loggers.cc +++ b/src/loggers/loggers.cc @@ -38,6 +38,7 @@ extern const BaseApi* alert_fast; extern const BaseApi* alert_full; extern const BaseApi* alert_syslog; extern const BaseApi* alert_unix_sock; +extern const BaseApi* log_hext; extern const BaseApi* log_null; extern const BaseApi* log_pcap; extern const BaseApi* eh_unified2; @@ -57,6 +58,7 @@ const BaseApi* loggers[] = alert_syslog, alert_unix_sock, // loggers + log_hext, log_null, log_pcap, diff --git a/src/protocols/packet.cc b/src/protocols/packet.cc index d173b19f0..f71bf2507 100644 --- a/src/protocols/packet.cc +++ b/src/protocols/packet.cc @@ -137,6 +137,9 @@ const char* Packet::get_pseudo_type() const case PSEUDO_PKT_TCP: return "stream_tcp"; + case PSEUDO_PKT_USER: + return "stream_user"; + case PSEUDO_PKT_DCE_RPKT: return "dce2_rpc_reass"; diff --git a/src/protocols/packet.h b/src/protocols/packet.h index 87c21d813..d6efc1f5b 100644 --- a/src/protocols/packet.h +++ b/src/protocols/packet.h @@ -99,6 +99,7 @@ enum PseudoPacketType { PSEUDO_PKT_IP, PSEUDO_PKT_TCP, + PSEUDO_PKT_USER, PSEUDO_PKT_DCE_RPKT, PSEUDO_PKT_DCE_SEG, PSEUDO_PKT_DCE_FRAG, diff --git a/src/stream/file/file_session.cc b/src/stream/file/file_session.cc index b0926b797..d5df7acb4 100644 --- a/src/stream/file/file_session.cc +++ b/src/stream/file/file_session.cc @@ -28,6 +28,7 @@ #include "time/profiler.h" #include "packet_io/sfdaq.h" #include "detection/detection_util.h" +#include "target_based/snort_protocols.h" #include "stream_file.h" #include "file_module.h" @@ -73,6 +74,7 @@ int FileSession::process(Packet* p) PROFILE_VARS; MODULE_PROFILE_START(file_ssn_stats); + p->flow->ssn_state.application_protocol = SNORT_PROTO_USER; StreamFileConfig* c = get_file_cfg(p->flow->ssn_server); file_api->file_process(p->flow, (uint8_t*)p->data, p->dsize, position(p), c->upload, false); set_file_data((uint8_t*)p->data, p->dsize); diff --git a/src/stream/user/user_session.cc b/src/stream/user/user_session.cc index acb0113b5..df44b2956 100644 --- a/src/stream/user/user_session.cc +++ b/src/stream/user/user_session.cc @@ -151,8 +151,9 @@ void UserTracker::detect(const Packet* p, const StreamBuffer* sb, uint32_t flags up.proto_bits = p->proto_bits; up.application_protocol_ordinal = p->application_protocol_ordinal; + up.pseudo_type = PSEUDO_PKT_USER; - up.packet_flags = flags | PKT_REBUILT_STREAM; + up.packet_flags = flags | PKT_REBUILT_STREAM | PKT_PSEUDO; up.packet_flags |= (p->packet_flags & (PKT_FROM_CLIENT|PKT_FROM_SERVER)); up.packet_flags |= (p->packet_flags & (PKT_STREAM_EST|PKT_STREAM_UNEST_UNI));