From: Russ Combs <rucombs@cisco.com>
Date: Thu, 30 Oct 2014 13:36:49 +0000 (-0400)
Subject: see changelog
X-Git-Tag: 3.0.0-233~1298^2~1^2~2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=705bee3589db132d51142a22e8c8d525b39ab1ab;p=thirdparty%2Fsnort3.git

see changelog
---

diff --git a/ChangeLog b/ChangeLog
index a5da39162..5762a59fd 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -45,6 +45,8 @@
 -- fixed segfaults due to unitialized cleanup_pkt and unset stream_tcp
 -- matched up stream_tcp.policy enum with defines
 -- tweaked S5_TRACE output
+-- streamlined session restart handling
+-- changed #begin & #end to have to start beginning of line
 
 125
 -- discovered can't catch exceptions thrown from Lua to C++; need to
diff --git a/src/flow/session.h b/src/flow/session.h
index 8c7da4427..6ecaff27e 100644
--- a/src/flow/session.h
+++ b/src/flow/session.h
@@ -36,6 +36,7 @@ public:
     virtual bool setup(Packet*) { return true; };
     virtual void update_direction(char /*dir*/, const sfip_t*, uint16_t /*port*/) { };
     virtual int process(Packet*) { return 0; };
+    virtual void restart(Packet*) { };
     virtual void clear() = 0;
     virtual void cleanup() { clear(); };
 
diff --git a/src/managers/inspector_manager.cc b/src/managers/inspector_manager.cc
index c11ff6ed4..817df2422 100644
--- a/src/managers/inspector_manager.cc
+++ b/src/managers/inspector_manager.cc
@@ -27,6 +27,7 @@
 
 #include "module_manager.h"
 #include "flow/flow.h"
+#include "flow/session.h"
 #include "framework/inspector.h"
 #include "detection/detection_util.h"
 #include "obfuscation.h"
@@ -630,10 +631,8 @@ void InspectorManager::bumble(Packet* p)
     if ( !flow->gadget || flow->protocol != PktType::TCP )
         return;
 
-    ins = get_inspector("stream_tcp");
-
-    if ( ins )
-        ins->exec(0, p);
+    if ( flow->session )
+        flow->session->restart(p);
 }
 
 void InspectorManager::execute (Packet* p)
@@ -645,27 +644,24 @@ void InspectorManager::execute (Packet* p)
     // called on reassembled packets
     ::execute(p, fp->packet.vec, fp->packet.num);
     ::execute(p, fp->session.vec, fp->session.num);
-    ::execute(p, fp->network.vec, fp->network.num);
 
     Flow* flow = p->flow;
 
-    if ( flow && flow->clouseau && flow->service )
+    if ( !flow || !flow->service )
+        ::execute(p, fp->network.vec, fp->network.num);
+
+    else if ( flow->clouseau )
         bumble(p);
 
-    if ( p->dsize )
-    {
-        if ( !flow )
-            return;
+    if ( !p->dsize )
+        DisableDetect(p);
 
-        // FIXIT-M need more than one service inspector?
-        // (should be daisy chained since inspector1 will generate PDUs for
-        // inspector2)
-        //::execute(p, fp->service.vec, fp->service.num);
-        if ( flow->gadget && ((unsigned)p->type() & flow->gadget->get_api()->proto_bits) )
+    // FIXIT-M need more than one service inspector?
+    else if ( flow && flow->gadget )
+    {
+        if ( ((unsigned)p->type() & flow->gadget->get_api()->proto_bits) )
             flow->gadget->eval(p);
     }
-    else
-        DisableDetect(p);
 
     ::execute(p, fp->probe.vec, fp->probe.num);
 }
diff --git a/src/parser/parse_stream.cc b/src/parser/parse_stream.cc
index b546f1318..d6099bd92 100644
--- a/src/parser/parse_stream.cc
+++ b/src/parser/parse_stream.cc
@@ -63,6 +63,7 @@ static TokenType get_token(
     int c, list = 0, state = 0;
     s.clear();
     bool inc = true;
+    static int pos = 1;
 
     if ( prev != EOF )
     {
@@ -83,11 +84,15 @@ static TokenType get_token(
         if ( c == '\n' )
         {
             lines++;
+            pos = 0;
+
             if ( inc )
                 inc_parse_position();
             else
                 inc = true;
         }
+        else
+            pos++;
 
         switch ( state )
         {
@@ -141,7 +146,7 @@ static TokenType get_token(
             else if ( s.size() < 6 )
             {
                 s += c;
-                if ( s == "#begin" )
+                if ( pos == 6 && !strcasecmp(s.c_str(), "#begin") )
                     state = 8;
             }
             break;
@@ -214,7 +219,7 @@ static TokenType get_token(
             else if ( s.size() < 4 )
             {
                 s += c;
-                if ( s == "#end" )
+                if ( !strcasecmp(s.c_str(), "#end") )
                     state = 1;
             }
             break;
diff --git a/src/stream/tcp/stream_tcp.cc b/src/stream/tcp/stream_tcp.cc
index f8ba3e69d..f72adf720 100644
--- a/src/stream/tcp/stream_tcp.cc
+++ b/src/stream/tcp/stream_tcp.cc
@@ -48,7 +48,6 @@ public:
     void tterm() override;
 
     void eval(Packet*) override;
-    int exec(int, void*) override;
 
 public:
     StreamTcpConfig* config;
@@ -86,18 +85,6 @@ void StreamTcp::eval(Packet*)
     assert(false);
 }
 
-int StreamTcp::exec(int, void* v)
-{
-    Packet* p = (Packet*)v;
-    assert(p && p->flow);
-
-    TcpSession* ssn = (TcpSession*)p->flow->session;
-    assert(ssn);
-
-    ssn->restart_paf(p);
-    return 0;
-}
-
 StreamTcpConfig* get_tcp_cfg(Inspector* ins)
 {
     assert(ins);
diff --git a/src/stream/tcp/tcp_session.cc b/src/stream/tcp/tcp_session.cc
index 7c8b177c9..ac9a800ba 100644
--- a/src/stream/tcp/tcp_session.cc
+++ b/src/stream/tcp/tcp_session.cc
@@ -2416,7 +2416,7 @@ int Stream5FlushListener(Packet *p, Flow *lwssn)
     return flushed;
 }
 
-void TcpSession::restart_paf(Packet* p)
+void TcpSession::restart(Packet* p)
 {
     StreamTracker* talker, * listener;
     TcpSession* tcpssn = (TcpSession*)p->flow->session;
diff --git a/src/stream/tcp/tcp_session.h b/src/stream/tcp/tcp_session.h
index f8a85cf44..f44627105 100644
--- a/src/stream/tcp/tcp_session.h
+++ b/src/stream/tcp/tcp_session.h
@@ -204,7 +204,7 @@ public:
     void cleanup() override;
 
     void reset();
-    void restart_paf(Packet*);
+    void restart(Packet*) override;
 
 public:
     StreamTracker client;