From: Russ Combs Date: Wed, 29 Apr 2015 20:54:07 +0000 (-0400) Subject: russ - cleanup some comments; build 150 X-Git-Tag: 3.0.0-233~988 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6e821603df533ca222a715ff541cd48098fb8396;p=thirdparty%2Fsnort3.git russ - cleanup some comments; build 150 --- diff --git a/ChangeLog b/ChangeLog index 779cfdfff..eedd85f42 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,4 +1,4 @@ -Pending - build 150 +15/04/30 - build 150 -- additional refactoring and cleanup -- fix http_inspect mpse search diff --git a/src/codecs/ip/cd_ipv4.cc b/src/codecs/ip/cd_ipv4.cc index 06107f3b3..24a4d1666 100644 --- a/src/codecs/ip/cd_ipv4.cc +++ b/src/codecs/ip/cd_ipv4.cc @@ -564,7 +564,7 @@ void Ipv4Codec::log(TextLog* const text_log, const uint8_t* raw_pkt, { const IP4Hdr* const ip4h = reinterpret_cast(raw_pkt); - // FIXIT-H --> This does NOT obfuscate correctly + // FIXIT-L --> This does NOT obfuscate correctly if (SnortConfig::obfuscate()) { TextLog_Print(text_log, "xxx.xxx.xxx.xxx -> xxx.xxx.xxx.xxx"); diff --git a/src/codecs/ip/cd_ipv6.cc b/src/codecs/ip/cd_ipv6.cc index f8040ba79..48d966770 100644 --- a/src/codecs/ip/cd_ipv6.cc +++ b/src/codecs/ip/cd_ipv6.cc @@ -530,7 +530,7 @@ void Ipv6Codec::log(TextLog* const text_log, const uint8_t* raw_pkt, { const ip::IP6Hdr* const ip6h = reinterpret_cast(raw_pkt); - // FIXIT-H --> This does NOT obfuscate correctly + // FIXIT-L --> This does NOT obfuscate correctly if (SnortConfig::obfuscate()) { TextLog_Print(text_log, "x:x:x:x::x:x:x:x -> x:x:x:x::x:x:x:x"); diff --git a/src/codecs/misc/cd_icmp4_ip.cc b/src/codecs/misc/cd_icmp4_ip.cc index 3e9bb0749..94503d689 100644 --- a/src/codecs/misc/cd_icmp4_ip.cc +++ b/src/codecs/misc/cd_icmp4_ip.cc @@ -153,7 +153,7 @@ void Icmp4IpCodec::log(TextLog* const text_log, const uint8_t* raw_pkt, // COPIED DIRECTLY FROM ipv4 CODEC. This is specificially replicated since // the two are not necessarily the same. - // FIXIT-H --> This does NOT obfuscate correctly + // FIXIT-L --> This does NOT obfuscate correctly if (SnortConfig::obfuscate()) { TextLog_Print(text_log, "xxx.xxx.xxx.xxx -> xxx.xxx.xxx.xxx"); diff --git a/src/main/build.h b/src/main/build.h index 31a46f41a..a76785c6a 100644 --- a/src/main/build.h +++ b/src/main/build.h @@ -7,5 +7,5 @@ // // //-----------------------------------------------// -#define BUILD "149" +#define BUILD "150" diff --git a/src/managers/action_manager.cc b/src/managers/action_manager.cc index f837e9949..e2afb9d32 100644 --- a/src/managers/action_manager.cc +++ b/src/managers/action_manager.cc @@ -37,7 +37,7 @@ using namespace std; struct Actor { const ActionApi* api; - IpsAction* act; // FIXIT-H must move to SnortConfig for reload? + IpsAction* act; Actor(const ActionApi* p) { api = p; act = nullptr; } @@ -88,7 +88,7 @@ static void store(const ActionApi* api, IpsAction* act) for ( auto& p : s_actors ) if ( p.api == api ) { - //assert(!p.act); FIXIT-H memory leak on reload + //assert(!p.act); FIXIT-H memory leak on reload; move to SnortConfig? p.act = act; break; } diff --git a/src/service_inspectors/http_inspect/hi_module.cc b/src/service_inspectors/http_inspect/hi_module.cc index 390bdd29b..b3e672169 100644 --- a/src/service_inspectors/http_inspect/hi_module.cc +++ b/src/service_inspectors/http_inspect/hi_module.cc @@ -26,6 +26,7 @@ #include "hi_events.h" #include "hi_cmd_lookup.h" #include "hi_ui_iis_unicode_map.h" +#include "decompress/file_decomp.h" #include "utils/util.h" //------------------------------------------------------------------------- @@ -262,10 +263,6 @@ bool HttpInspectModule::end(const char* fqn, int, SnortConfig*) // You must make a parallel change in Http_Server_Module::Begin(). #define default_non_rfc_chars "0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07" -// FIXIT-L refactor params to create a profile table so that user can define -// different profiles (like above) and use those. rename existing profile -// to profile_type. - static const Parameter hi_profile_server_params[] = { { "apache_whitespace", Parameter::PT_BOOL, nullptr, "false", @@ -280,7 +277,6 @@ static const Parameter hi_profile_server_params[] = { "chunk_length", Parameter::PT_INT, "1:", "500000", "alert on chunk lengths greater than specified" }, - // FIXIT-M this is backwards: 0 should mean nothing; -1 all { "client_flow_depth", Parameter::PT_INT, "-1:1460", "0", "raw request payload to inspect" }, @@ -356,11 +352,10 @@ static const Parameter hi_server_params[] = "don't alert on proxy use for this server" }, { "decompress_pdf", Parameter::PT_BOOL, nullptr, "false", - "????" }, // FIXIT-M need to figure out this parameter format and implement it + "enable decompression of the compressed portions of PDF files" }, { "decompress_swf", Parameter::PT_BOOL, nullptr, "false", - "????" }, // FIXIT-M need to figure out this parameter format and implement it with deflate - // and lzma + "enable decompression of SWF (Adobe Flash content)" }, { "enable_cookies", Parameter::PT_BOOL, nullptr, "true", "extract cookies" }, @@ -419,8 +414,14 @@ static const Parameter hi_server_params[] = { "unlimited_decompress", Parameter::PT_BOOL, nullptr, "true", "decompress across multiple packets" }, + // FIXIT-M need to implement xff header customization like: + // { + // { name = 'x-forwarded-highest-priority', priority = 1 }, + // { name = 'x-forwarded-second-highest-priority', priority = 2 }, + // { name = 'x-forwarded-lowest-priority-custom', priority = 3 } + // } { "xff_headers", Parameter::PT_BOOL, nullptr, "false", - "????" }, // FIXIT-M need to figure out this parameter format and implement it + "not implemented" }, { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; @@ -496,13 +497,13 @@ bool HttpServerModule::set(const char*, Value& v, SnortConfig*) server->iis_unicode_codepage = v.get_long(); else if ( v.is("decompress_pdf") ) - ; // FIXIT-M need to figure this out and implement it + server->file_decomp_modes |= (FILE_PDF_DEFL_BIT | FILE_REVERT_BIT); else if ( v.is("decompress_swf") ) - ; // FIXIT-M need to figure this out and implement it - // including #define DECOMPRESS_DEFLATE "deflate" and - // including #define DECOMPRESS_LZMA "lzma" - + { + server->file_decomp_modes |= (FILE_SWF_ZLIB_BIT | FILE_REVERT_BIT); + server->file_decomp_modes |= (FILE_SWF_LZMA_BIT | FILE_REVERT_BIT); + } else if ( v.is("directory") ) server->directory.on = v.get_bool(); @@ -621,7 +622,7 @@ bool HttpServerModule::set(const char*, Value& v, SnortConfig*) v.get_bits(server->whitespace); else if ( v.is("xff_headers") ) - ; // FIXIT-M need to figure this out and implement it + ; else return false;