From: Russ Combs <rucombs@cisco.com>
Date: Wed, 13 Aug 2014 01:19:39 +0000 (-0400)
Subject: basic reject action plugin working
X-Git-Tag: 3.0.0-233~1426^2~13
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6f24461e55d36ffa49c458d2f95c69af300e496d;p=thirdparty%2Fsnort3.git

basic reject action plugin working
---

diff --git a/src/actions/act_reject.cc b/src/actions/act_reject.cc
index 0272d44cc..7db8c104c 100644
--- a/src/actions/act_reject.cc
+++ b/src/actions/act_reject.cc
@@ -86,9 +86,11 @@ RejectAction::RejectAction(RejectModule*) :
     Active_SetEnabled(1);
 }
 
-void RejectAction::exec(Packet*)
+void RejectAction::exec(Packet* p)
 {
-    printf("ACT Now!");
+    if ( PacketIsRebuilt(p) )
+        return;
+
     Active_QueueReject();
 }
 
diff --git a/src/detection/fpdetect.cc b/src/detection/fpdetect.cc
index a798423f4..528fc8798 100644
--- a/src/detection/fpdetect.cc
+++ b/src/detection/fpdetect.cc
@@ -150,10 +150,8 @@ static inline void fpLogOther (
     // FIXIT some or all of these can be migrated to user defined actions
     otn_trigger_actions(otn, p);
 
-    if ( !EventTrace_IsEnabled() )
-        return;
-
-    EventTrace_Log(p, otn, action);
+    if ( EventTrace_IsEnabled() )
+        EventTrace_Log(p, otn, action);
 
     // user defined actions are done here
     if ( rtn->listhead->action )
diff --git a/src/detection/rules.h b/src/detection/rules.h
index 5641954b0..1afe036f1 100644
--- a/src/detection/rules.h
+++ b/src/detection/rules.h
@@ -66,12 +66,12 @@ struct ListHead
 
 struct RuleListNode
 {
-    ListHead *RuleList;         /* The rule list associated with this node */
-    RuleType mode;              /* the rule mode */
-    int rval;                   /* 0 == no detection, 1 == detection event */
-    int evalIndex;              /* eval index for this rule set */
-    char *name;                 /* name of this rule list (for debugging)  */
-    RuleListNode *next; /* the next RuleListNode */
+    ListHead *RuleList;   /* The rule list associated with this node */
+    RuleType mode;        /* the rule mode */
+    int rval;             /* 0 == no detection, 1 == detection event */
+    int evalIndex;        /* eval index for this rule set */
+    char* name;           /* name of this rule list */
+    RuleListNode* next;   /* the next RuleListNode */
 };
 
 struct RuleState
diff --git a/src/managers/action_manager.cc b/src/managers/action_manager.cc
index de267d7db..e7c814b71 100644
--- a/src/managers/action_manager.cc
+++ b/src/managers/action_manager.cc
@@ -72,9 +72,16 @@ RuleType ActionManager::get_action_type(const char* s)
 }
 
 void ActionManager::instantiate(
-    const ActionApi* api, Module*, SnortConfig* sc)
+    const ActionApi* api, Module* m, SnortConfig* sc)
 {
-    CreateRuleType(sc, api->base.name, api->type, 0, nullptr);
+    IpsAction* act = api->ctor(m);
+
+    if ( act )
+    {
+        ListHead* lh = CreateRuleType(sc, api->base.name, api->type, 0, nullptr);
+        assert(lh);
+        lh->action = act;
+    }
 }
 
 #if 0
diff --git a/src/parser/cmd_line.cc b/src/parser/cmd_line.cc
index 7ecc9bbc7..88925cdc4 100644
--- a/src/parser/cmd_line.cc
+++ b/src/parser/cmd_line.cc
@@ -544,13 +544,11 @@ static void config_log_mode(SnortConfig* sc, const char* val)
 
 static void config_inline(SnortConfig* sc, const char*)
 {
-    LogMessage("Enabling inline operation\n");
     sc->run_flags |= RUN_FLAG__INLINE;
 }
 
 static void config_inline_test(SnortConfig* sc, const char*)
 {
-    LogMessage("Enable Inline Test Mode\n");
     sc->run_flags |= RUN_FLAG__INLINE_TEST;
 }
 
diff --git a/src/parser/parse_conf.cc b/src/parser/parse_conf.cc
index 20dc35ac7..0946ee2d8 100644
--- a/src/parser/parse_conf.cc
+++ b/src/parser/parse_conf.cc
@@ -267,29 +267,14 @@ RuleType get_rule_type(const char* s)
     return rt;
 }
 
-ListHead* get_rule_list(SnortConfig* sc, RuleType type)
+ListHead* get_rule_list(SnortConfig* sc, const char* s)
 {
-    switch ( type )
-    {
-    case RULE_TYPE__ALERT:
-        return &sc->Alert;
-
-    case RULE_TYPE__LOG:
-        return &sc->Log;
-
-    case RULE_TYPE__PASS:
-        return &sc->Pass;
+    const RuleListNode* p = sc->rule_lists;
 
-    case RULE_TYPE__DROP:
-        return &sc->Drop; 
-
-    case RULE_TYPE__SDROP:
-        return &sc->SDrop;
-
-    default:
-        break;
-    }
-    return nullptr;
+    while ( p && strcmp(p->name, s) )
+        p = p->next;
+    
+    return p ? p->RuleList : nullptr;
 }
 
 // FIXIT find this a better home
diff --git a/src/parser/parse_conf.h b/src/parser/parse_conf.h
index 810d7f1fd..41139d179 100644
--- a/src/parser/parse_conf.h
+++ b/src/parser/parse_conf.h
@@ -39,7 +39,7 @@ void AddRuleState(SnortConfig*, const RuleState&);
 void add_service_to_otn(SnortConfig*, OptTreeNode*, const char*);
 
 RuleType get_rule_type(const char*);
-ListHead* get_rule_list(SnortConfig*, RuleType);
+ListHead* get_rule_list(SnortConfig*, const char*);
 
 #define ERR_PAIR_COUNT \
         "%s has incorrect argument count; should be %d pairs.", ERR_KEY
diff --git a/src/parser/parse_rule.cc b/src/parser/parse_rule.cc
index f7cc422f4..19fe71408 100644
--- a/src/parser/parse_rule.cc
+++ b/src/parser/parse_rule.cc
@@ -1346,7 +1346,7 @@ void parse_rule_type(SnortConfig* sc, const char* s, RuleTreeNode& rtn)
         s_ignore = true;
 
     else
-        rtn.listhead = get_rule_list(sc, (RuleType)rtn.type);
+        rtn.listhead = get_rule_list(sc, s);
 }
 
 void parse_rule_proto(SnortConfig* sc, const char* s, RuleTreeNode& rtn)