From: Michael Altizer (mialtize) Date: Mon, 6 Feb 2017 21:24:46 +0000 (-0500) Subject: Merge pull request #803 in SNORT/snort3 from rna_config_ifdef to master X-Git-Tag: 3.0.0-233~84 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=644198b6db9dae26e7055dfa17401f42fa27f60f;p=thirdparty%2Fsnort3.git Merge pull request #803 in SNORT/snort3 from rna_config_ifdef to master Squashed commit of the following: commit a93cbfe4df5a29411d790c873862a8e2df997c60 Author: Michael Altizer Date: Mon Feb 6 13:30:54 2017 -0500 appid: Complete the removal of RNA config and network lists for now --- diff --git a/src/network_inspectors/appid/appid_config.cc b/src/network_inspectors/appid/appid_config.cc index c09970380..edb2ba240 100644 --- a/src/network_inspectors/appid/appid_config.cc +++ b/src/network_inspectors/appid/appid_config.cc @@ -33,7 +33,9 @@ #include "app_info_table.h" #include "appid_utils/appid_utils.h" +#ifdef USE_RNA_CONFIG #include "appid_utils/network_set.h" +#endif #include "service_plugins/service_base.h" #define ODP_PORT_DETECTORS "odp/port/*" @@ -71,8 +73,10 @@ AppIdModuleConfig::~AppIdModuleConfig() AppIdConfig::AppIdConfig( AppIdModuleConfig* config ) : mod_config( config ), app_info_mgr(AppInfoManager::get_instance()) { +#ifdef USE_RNA_CONFIG for( unsigned i = 0; i < MAX_ZONES; i++ ) net_list_by_zone[ i ] = nullptr; +#endif for( unsigned i = 0; i < 65535; i++ ) { @@ -755,12 +759,14 @@ void AppIdConfig::cleanup() app_info_mgr.cleanup_appid_info_table(); +#ifdef USE_RNA_CONFIG NetworkSet* net_list; ///< list of network sets while ((net_list = net_list_list)) { net_list_list = net_list->next; NetworkSetManager::destroy(net_list); } +#endif free_port_exclusion_list(tcp_port_exclusions_src); free_port_exclusion_list(tcp_port_exclusions_dst); @@ -795,75 +801,75 @@ static void display_port_exclusion_list(SF_LIST* pe_list, uint16_t port) void AppIdConfig::show() { unsigned i; - int j; + + if (mod_config->thirdparty_appid_dir) + LogMessage(" 3rd Party Dir: %s\n", mod_config->thirdparty_appid_dir); + +#ifdef USE_RNA_CONFIG struct in_addr ia; + NSIPv6Addr six; char inet_buffer[INET6_ADDRSTRLEN]; char inet_buffer2[INET6_ADDRSTRLEN]; - NSIPv6Addr six; const char* p; const char* p2; - NetworkSet* my_net_list; - if (mod_config->thirdparty_appid_dir) - LogMessage(" 3rd Party Dir: %s\n", mod_config->thirdparty_appid_dir); - - my_net_list = net_list; LogMessage(" Monitoring Networks for any zone:\n"); - for (i = 0; i < my_net_list->count; i++) + for (i = 0; i < net_list->count; i++) { - ia.s_addr = htonl(my_net_list->pnetwork[i]->range_min); + ia.s_addr = htonl(net_list->pnetwork[i]->range_min); p = inet_ntop(AF_INET, &ia, inet_buffer, sizeof(inet_buffer)); - ia.s_addr = htonl(my_net_list->pnetwork[i]->range_max); + ia.s_addr = htonl(net_list->pnetwork[i]->range_max); p2 = inet_ntop(AF_INET, &ia, inet_buffer2, sizeof(inet_buffer2)); - LogMessage(" %s%s-%s %04X\n", (my_net_list->pnetwork[i]->info.ip_not) ? "!" : "", + LogMessage(" %s%s-%s %04X\n", (net_list->pnetwork[i]->info.ip_not) ? "!" : "", p ? p : "ERROR", - p2 ? p2 : "ERROR", my_net_list->pnetwork[i]->info.type); + p2 ? p2 : "ERROR", net_list->pnetwork[i]->info.type); } - for (i = 0; i < my_net_list->count6; i++) + for (i = 0; i < net_list->count6; i++) { - six = my_net_list->pnetwork6[i]->range_min; + six = net_list->pnetwork6[i]->range_min; NetworkSetManager::ntoh_ipv6(&six); p = inet_ntop(AF_INET6, (struct in6_addr*)&six, inet_buffer, sizeof(inet_buffer)); - six = my_net_list->pnetwork6[i]->range_max; + six = net_list->pnetwork6[i]->range_max; NetworkSetManager::ntoh_ipv6(&six); p2 = inet_ntop(AF_INET6, (struct in6_addr*)&six, inet_buffer2, sizeof(inet_buffer2)); - LogMessage(" %s%s-%s %04X\n", (my_net_list->pnetwork6[i]->info.ip_not) ? "!" : "", + LogMessage(" %s%s-%s %04X\n", (net_list->pnetwork6[i]->info.ip_not) ? "!" : "", p ? p : "ERROR", - p2 ? p2 : "ERROR", my_net_list->pnetwork6[i]->info.type); + p2 ? p2 : "ERROR", net_list->pnetwork6[i]->info.type); } - for (j=0; j < MAX_ZONES; j++) + for (int j = 0; j < MAX_ZONES; j++) { - if (!(my_net_list = net_list_by_zone[j])) + if (!(net_list = net_list_by_zone[j])) continue; LogMessage(" Monitoring Networks for zone %d:\n", j); - for (i = 0; i < my_net_list->count; i++) + for (i = 0; i < net_list->count; i++) { - ia.s_addr = htonl(my_net_list->pnetwork[i]->range_min); + ia.s_addr = htonl(net_list->pnetwork[i]->range_min); p = inet_ntop(AF_INET, &ia, inet_buffer, sizeof(inet_buffer)); - ia.s_addr = htonl(my_net_list->pnetwork[i]->range_max); + ia.s_addr = htonl(net_list->pnetwork[i]->range_max); p2 = inet_ntop(AF_INET, &ia, inet_buffer2, sizeof(inet_buffer2)); - LogMessage(" %s%s-%s %04X\n", (my_net_list->pnetwork[i]->info.ip_not) ? "!" : + LogMessage(" %s%s-%s %04X\n", (net_list->pnetwork[i]->info.ip_not) ? "!" : "", p ? p : "ERROR", - p2 ? p2 : "ERROR", my_net_list->pnetwork[i]->info.type); + p2 ? p2 : "ERROR", net_list->pnetwork[i]->info.type); } - for (i = 0; i < my_net_list->count6; i++) + for (i = 0; i < net_list->count6; i++) { - six = my_net_list->pnetwork6[i]->range_min; + six = net_list->pnetwork6[i]->range_min; NetworkSetManager::ntoh_ipv6(&six); p = inet_ntop(AF_INET6, (struct in6_addr*)&six, inet_buffer, sizeof(inet_buffer)); - six = my_net_list->pnetwork6[i]->range_max; + six = net_list->pnetwork6[i]->range_max; NetworkSetManager::ntoh_ipv6(&six); p2 = inet_ntop(AF_INET6, (struct in6_addr*)&six, inet_buffer2, sizeof(inet_buffer2)); - LogMessage(" %s%s-%s %04X\n", (my_net_list->pnetwork6[i]->info.ip_not) ? "!" : + LogMessage(" %s%s-%s %04X\n", (net_list->pnetwork6[i]->info.ip_not) ? "!" : "", p ? p : "ERROR", - p2 ? p2 : "ERROR", my_net_list->pnetwork6[i]->info.type); + p2 ? p2 : "ERROR", net_list->pnetwork6[i]->info.type); } } +#endif LogMessage(" Excluded TCP Ports for Src:\n"); for (i = 0; i < APP_ID_PORT_ARRAY_SIZE; i++) diff --git a/src/network_inspectors/appid/appid_config.h b/src/network_inspectors/appid/appid_config.h index 3c6335315..75ec4f51a 100644 --- a/src/network_inspectors/appid/appid_config.h +++ b/src/network_inspectors/appid/appid_config.h @@ -143,10 +143,12 @@ public: void set_safe_search_enforcement(int enabled); unsigned max_service_info = 0; +#ifdef USE_RNA_CONFIG unsigned net_list_count = 0; NetworkSet* net_list_list = nullptr; NetworkSet* net_list = nullptr; std::array net_list_by_zone; +#endif std::array tcp_port_only; ///< Service IDs for port-only TCP services std::array udp_port_only; ///< Service IDs for port-only UDP services std::array ip_protocol; ///< Service IDs for non-TCP / UDP protocol services diff --git a/src/network_inspectors/appid/appid_session.cc b/src/network_inspectors/appid/appid_session.cc index bae549ff5..59c8e576c 100644 --- a/src/network_inspectors/appid/appid_session.cc +++ b/src/network_inspectors/appid/appid_session.cc @@ -1942,11 +1942,13 @@ static inline int check_port_exclusion(const Packet* pkt, bool reversed) static inline unsigned get_ipfuncs_flags(const Packet* p, bool dst) { const SfIp* sf_ip; - NetworkSet* net_list; unsigned flags; int32_t zone; +#ifdef USE_RNA_CONFIG NSIPv6Addr ip6; AppIdConfig* config = AppIdConfig::get_appid_config(); + NetworkSet* net_list; +#endif if (!dst) { @@ -1962,6 +1964,7 @@ static inline unsigned get_ipfuncs_flags(const Packet* p, bool dst) sf_ip = p->ptrs.ip_api.get_dst(); } +#ifdef USE_RNA_CONFIG if (zone >= 0 && zone < MAX_ZONES && config->net_list_by_zone[zone]) net_list = config->net_list_by_zone[zone]; else @@ -1979,6 +1982,12 @@ static inline unsigned get_ipfuncs_flags(const Packet* p, bool dst) NetworkSetManager::ntoh_ipv6(&ip6); NetworkSetManager::contains6_ex(net_list, &ip6, &flags); } +#else + if (sf_ip->is_ip4() && sf_ip->get_ip4_value() == 0xFFFFFFFF) + return IPFUNCS_CHECKED; + // FIXIT-M Defaulting to checking everything everywhere until RNA config is reimplemented + flags = IPFUNCS_HOSTS_IP | IPFUNCS_USER_IP | IPFUNCS_APPLICATION; +#endif return flags | IPFUNCS_CHECKED; } diff --git a/src/network_inspectors/appid/appid_utils/ip_funcs.cc b/src/network_inspectors/appid/appid_utils/ip_funcs.cc index f086f3b87..5502d9f06 100644 --- a/src/network_inspectors/appid/appid_utils/ip_funcs.cc +++ b/src/network_inspectors/appid/appid_utils/ip_funcs.cc @@ -25,6 +25,8 @@ #include "ip_funcs.h" +#ifdef USE_RNA_CONFIG + #include #include "log/messages.h" @@ -212,3 +214,5 @@ RNAIpv6AddrSet* ParseIpv6Cidr(char* ipstring) return ias; } +#endif + diff --git a/src/network_inspectors/appid/appid_utils/ip_funcs.h b/src/network_inspectors/appid/appid_utils/ip_funcs.h index e593e9566..7a24ebf37 100644 --- a/src/network_inspectors/appid/appid_utils/ip_funcs.h +++ b/src/network_inspectors/appid/appid_utils/ip_funcs.h @@ -31,12 +31,12 @@ #define IPFUNCS_EXCEPT_IP 0x01 #define IPFUNCS_SECONDARY_IP 0x02 -#define IPFUNCS_APPID_SESSION_EXCLUDE_IP 0x04 -#define IPFUNCS_USER_IP 0x08 -#define IPFUNCS_HOSTS_IP 0x10 -#define IPFUNCS_APPLICATION 0x20 +#define IPFUNCS_USER_IP 0x04 +#define IPFUNCS_HOSTS_IP 0x08 +#define IPFUNCS_APPLICATION 0x10 #define IPFUNCS_CHECKED 0x80000000 +#ifdef USE_RNA_CONFIG struct RNAIpAddrSet { uint32_t range_min; @@ -78,6 +78,7 @@ inline int cmpSnortIpToHostKey(const ip::snort_in6_addr* keyIp, const SfIp* snor { return memcmp(keyIp, snortIp->get_ip6_ptr(), sizeof(*keyIp)); } +#endif #endif diff --git a/src/network_inspectors/appid/appid_utils/network_set.cc b/src/network_inspectors/appid/appid_utils/network_set.cc index 9ceeff5ba..68db0d663 100644 --- a/src/network_inspectors/appid/appid_utils/network_set.cc +++ b/src/network_inspectors/appid/appid_utils/network_set.cc @@ -25,6 +25,8 @@ #include "network_set.h" +#ifdef USE_RNA_CONFIG + #include #include "log/messages.h" @@ -1157,3 +1159,5 @@ int NetworkSetManager::add_set(NetworkSet* dest_set, NetworkSet* src_set) return 0; } +#endif + diff --git a/src/network_inspectors/appid/appid_utils/network_set.h b/src/network_inspectors/appid/appid_utils/network_set.h index e970700a3..58e6403b8 100644 --- a/src/network_inspectors/appid/appid_utils/network_set.h +++ b/src/network_inspectors/appid/appid_utils/network_set.h @@ -22,6 +22,8 @@ #ifndef NETWORK_SET_H #define NETWORK_SET_H +#ifdef USE_RNA_CONFIG + #include #include "hash/sfxhash.h" @@ -359,3 +361,5 @@ private: static int reduce_network_set6(SF_LIST* networks); }; #endif + +#endif diff --git a/src/network_inspectors/appid/service_plugins/service_base.cc b/src/network_inspectors/appid/service_plugins/service_base.cc index 9efae62cf..90e2a2802 100644 --- a/src/network_inspectors/appid/service_plugins/service_base.cc +++ b/src/network_inspectors/appid/service_plugins/service_base.cc @@ -1011,6 +1011,7 @@ void AppIdFreeDhcpInfo(DHCPInfo* dd) } } +#ifdef USE_RNA_CONFIG static unsigned isIPv4HostMonitored(uint32_t ip4, int32_t zone) { NetworkSet* net_list; @@ -1025,6 +1026,13 @@ static unsigned isIPv4HostMonitored(uint32_t ip4, int32_t zone) NetworkSetManager::contains_ex(net_list, ip4, &flags); return flags; } +#else +static unsigned isIPv4HostMonitored(uint32_t, int32_t) +{ + // FIXIT-M Defaulting to checking everything everywhere until RNA config is reimplemented + return IPFUNCS_HOSTS_IP | IPFUNCS_USER_IP | IPFUNCS_APPLICATION; +} +#endif static void add_host_ip_info(AppIdSession* asd, const uint8_t* mac, uint32_t ip, int32_t zone, uint32_t subnetmask, uint32_t leaseSecs, uint32_t router)